diff --git a/4.x/_gen/data/bigquery_dataset.libsonnet b/4.x/_gen/data/bigquery_dataset.libsonnet
new file mode 100644
index 00000000..8c9011bb
--- /dev/null
+++ b/4.x/_gen/data/bigquery_dataset.libsonnet
@@ -0,0 +1,45 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='bigquery_dataset', url='', help='`bigquery_dataset` represents the `google_bigquery_dataset` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.data.bigquery_dataset.new` injects a new `data_google_bigquery_dataset` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.bigquery_dataset.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.bigquery_dataset` using the reference:\n\n    $._ref.data_google_bigquery_dataset.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_bigquery_dataset.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `dataset_id` (`string`): A unique ID for this dataset, without the project name. The ID\nmust contain only letters (a-z, A-Z), numbers (0-9), or\nunderscores (_). The maximum length is 1,024 characters.\n  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    dataset_id,
+    project=null,
+    _meta={}
+  ):: tf.withData(
+    type='google_bigquery_dataset',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(dataset_id=dataset_id, project=project),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.bigquery_dataset.newAttrs` constructs a new object with attributes and blocks configured for the `bigquery_dataset`\nTerraform data source.\n\nUnlike [google.data.bigquery_dataset.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `dataset_id` (`string`): A unique ID for this dataset, without the project name. The ID\nmust contain only letters (a-z, A-Z), numbers (0-9), or\nunderscores (_). The maximum length is 1,024 characters.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `bigquery_dataset` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    dataset_id,
+    project=null
+  ):: std.prune(a={
+    dataset_id: dataset_id,
+    project: project,
+  }),
+  '#withDatasetId':: d.fn(help='`google.string.withDatasetId` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the dataset_id field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `dataset_id` field.\n', args=[]),
+  withDatasetId(dataSrcLabel, value): {
+    data+: {
+      google_bigquery_dataset+: {
+        [dataSrcLabel]+: {
+          dataset_id: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the project field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(dataSrcLabel, value): {
+    data+: {
+      google_bigquery_dataset+: {
+        [dataSrcLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/data/cloud_identity_group_lookup.libsonnet b/4.x/_gen/data/cloud_identity_group_lookup.libsonnet
new file mode 100644
index 00000000..9a8f9302
--- /dev/null
+++ b/4.x/_gen/data/cloud_identity_group_lookup.libsonnet
@@ -0,0 +1,50 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='cloud_identity_group_lookup', url='', help='`cloud_identity_group_lookup` represents the `google_cloud_identity_group_lookup` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  group_key:: {
+    '#new':: d.fn(help='\n`google.cloud_identity_group_lookup.group_key.new` constructs a new object with attributes and blocks configured for the `group_key`\nTerraform sub block.\n\n\n\n**Args**:\n  - `namespace` (`string`): The namespace in which the entity exists. If not specified, the EntityKey represents a Google-managed entity such as a Google user or a Google Group.\nIf specified, the EntityKey represents an external-identity-mapped group. The namespace must correspond to an identity source created in Admin Console and must be in the form of identitysources/{identity_source}. When `null`, the `namespace` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `group_key` sub block.\n', args=[]),
+    new(
+      namespace=null
+    ):: std.prune(a={
+      namespace: namespace,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.data.cloud_identity_group_lookup.new` injects a new `data_google_cloud_identity_group_lookup` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.cloud_identity_group_lookup.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.cloud_identity_group_lookup` using the reference:\n\n    $._ref.data_google_cloud_identity_group_lookup.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_cloud_identity_group_lookup.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `group_key` (`list[obj]`): The EntityKey of the Group to lookup. A unique identifier for an entity in the Cloud Identity Groups API.\nAn entity can represent either a group with an optional namespace or a user without a namespace.\nThe combination of id and namespace must be unique; however, the same id can be used with different namespaces. When `null`, the `group_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data.cloud_identity_group_lookup.group_key.new](#fn-group_keynew) constructor.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    group_key=null,
+    _meta={}
+  ):: tf.withData(
+    type='google_cloud_identity_group_lookup',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(group_key=group_key),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.cloud_identity_group_lookup.newAttrs` constructs a new object with attributes and blocks configured for the `cloud_identity_group_lookup`\nTerraform data source.\n\nUnlike [google.data.cloud_identity_group_lookup.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `group_key` (`list[obj]`): The EntityKey of the Group to lookup. A unique identifier for an entity in the Cloud Identity Groups API.\nAn entity can represent either a group with an optional namespace or a user without a namespace.\nThe combination of id and namespace must be unique; however, the same id can be used with different namespaces. When `null`, the `group_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data.cloud_identity_group_lookup.group_key.new](#fn-group_keynew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `cloud_identity_group_lookup` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    group_key=null
+  ):: std.prune(a={
+    group_key: group_key,
+  }),
+  '#withGroupKey':: d.fn(help='`google.list[obj].withGroupKey` constructs a mixin object that can be merged into the `list[obj]`\nTerraform data source block to set or update the group_key field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withGroupKeyMixin](TODO) function.\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `group_key` field.\n', args=[]),
+  withGroupKey(dataSrcLabel, value): {
+    data+: {
+      google_cloud_identity_group_lookup+: {
+        [dataSrcLabel]+: {
+          group_key: value,
+        },
+      },
+    },
+  },
+  '#withGroupKeyMixin':: d.fn(help='`google.list[obj].withGroupKeyMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform data source block to set or update the group_key field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withGroupKey](TODO)\nfunction.\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `group_key` field.\n', args=[]),
+  withGroupKeyMixin(dataSrcLabel, value): {
+    data+: {
+      google_cloud_identity_group_lookup+: {
+        [dataSrcLabel]+: {
+          group_key+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/data/cloud_run_v2_job.libsonnet b/4.x/_gen/data/cloud_run_v2_job.libsonnet
new file mode 100644
index 00000000..6ef3b91c
--- /dev/null
+++ b/4.x/_gen/data/cloud_run_v2_job.libsonnet
@@ -0,0 +1,58 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='cloud_run_v2_job', url='', help='`cloud_run_v2_job` represents the `google_cloud_run_v2_job` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.data.cloud_run_v2_job.new` injects a new `data_google_cloud_run_v2_job` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.cloud_run_v2_job.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.cloud_run_v2_job` using the reference:\n\n    $._ref.data_google_cloud_run_v2_job.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_cloud_run_v2_job.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `location` (`string`): The location of the cloud run job When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the Job.\n  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    name,
+    location=null,
+    project=null,
+    _meta={}
+  ):: tf.withData(
+    type='google_cloud_run_v2_job',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(location=location, name=name, project=project),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.cloud_run_v2_job.newAttrs` constructs a new object with attributes and blocks configured for the `cloud_run_v2_job`\nTerraform data source.\n\nUnlike [google.data.cloud_run_v2_job.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `location` (`string`): The location of the cloud run job When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the Job.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `cloud_run_v2_job` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    name,
+    location=null,
+    project=null
+  ):: std.prune(a={
+    location: location,
+    name: name,
+    project: project,
+  }),
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the location field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(dataSrcLabel, value): {
+    data+: {
+      google_cloud_run_v2_job+: {
+        [dataSrcLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the name field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(dataSrcLabel, value): {
+    data+: {
+      google_cloud_run_v2_job+: {
+        [dataSrcLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the project field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(dataSrcLabel, value): {
+    data+: {
+      google_cloud_run_v2_job+: {
+        [dataSrcLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/data/cloud_run_v2_service.libsonnet b/4.x/_gen/data/cloud_run_v2_service.libsonnet
new file mode 100644
index 00000000..1a6388ca
--- /dev/null
+++ b/4.x/_gen/data/cloud_run_v2_service.libsonnet
@@ -0,0 +1,58 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='cloud_run_v2_service', url='', help='`cloud_run_v2_service` represents the `google_cloud_run_v2_service` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.data.cloud_run_v2_service.new` injects a new `data_google_cloud_run_v2_service` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.cloud_run_v2_service.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.cloud_run_v2_service` using the reference:\n\n    $._ref.data_google_cloud_run_v2_service.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_cloud_run_v2_service.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `location` (`string`): The location of the cloud run service When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the Service.\n  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    name,
+    location=null,
+    project=null,
+    _meta={}
+  ):: tf.withData(
+    type='google_cloud_run_v2_service',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(location=location, name=name, project=project),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.cloud_run_v2_service.newAttrs` constructs a new object with attributes and blocks configured for the `cloud_run_v2_service`\nTerraform data source.\n\nUnlike [google.data.cloud_run_v2_service.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `location` (`string`): The location of the cloud run service When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the Service.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `cloud_run_v2_service` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    name,
+    location=null,
+    project=null
+  ):: std.prune(a={
+    location: location,
+    name: name,
+    project: project,
+  }),
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the location field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(dataSrcLabel, value): {
+    data+: {
+      google_cloud_run_v2_service+: {
+        [dataSrcLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the name field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(dataSrcLabel, value): {
+    data+: {
+      google_cloud_run_v2_service+: {
+        [dataSrcLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the project field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(dataSrcLabel, value): {
+    data+: {
+      google_cloud_run_v2_service+: {
+        [dataSrcLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/data/cloudiot_registry_iam_policy.libsonnet b/4.x/_gen/data/cloudiot_registry_iam_policy.libsonnet
deleted file mode 100644
index de607446..00000000
--- a/4.x/_gen/data/cloudiot_registry_iam_policy.libsonnet
+++ /dev/null
@@ -1,58 +0,0 @@
-local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
-local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
-{
-  '#':: d.pkg(name='cloudiot_registry_iam_policy', url='', help='`cloudiot_registry_iam_policy` represents the `google_cloudiot_registry_iam_policy` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.data.cloudiot_registry_iam_policy.new` injects a new `data_google_cloudiot_registry_iam_policy` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.cloudiot_registry_iam_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.cloudiot_registry_iam_policy` using the reference:\n\n    $._ref.data_google_cloudiot_registry_iam_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_cloudiot_registry_iam_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `name` (`string`): Set the `name` field on the resulting data source block.\n  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Set the `region` field on the resulting data source block. When `null`, the `region` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
-  new(
-    dataSrcLabel,
-    name,
-    project=null,
-    region=null,
-    _meta={}
-  ):: tf.withData(
-    type='google_cloudiot_registry_iam_policy',
-    label=dataSrcLabel,
-    attrs=self.newAttrs(name=name, project=project, region=region),
-    _meta=_meta
-  ),
-  '#newAttrs':: d.fn(help='\n`google.data.cloudiot_registry_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `cloudiot_registry_iam_policy`\nTerraform data source.\n\nUnlike [google.data.cloudiot_registry_iam_policy.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `name` (`string`): Set the `name` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Set the `region` field on the resulting object. When `null`, the `region` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `cloudiot_registry_iam_policy` data source into the root Terraform configuration.\n', args=[]),
-  newAttrs(
-    name,
-    project=null,
-    region=null
-  ):: std.prune(a={
-    name: name,
-    project: project,
-    region: region,
-  }),
-  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the name field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
-  withName(dataSrcLabel, value): {
-    data+: {
-      google_cloudiot_registry_iam_policy+: {
-        [dataSrcLabel]+: {
-          name: value,
-        },
-      },
-    },
-  },
-  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the project field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
-  withProject(dataSrcLabel, value): {
-    data+: {
-      google_cloudiot_registry_iam_policy+: {
-        [dataSrcLabel]+: {
-          project: value,
-        },
-      },
-    },
-  },
-  '#withRegion':: d.fn(help='`google.string.withRegion` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the region field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `region` field.\n', args=[]),
-  withRegion(dataSrcLabel, value): {
-    data+: {
-      google_cloudiot_registry_iam_policy+: {
-        [dataSrcLabel]+: {
-          region: value,
-        },
-      },
-    },
-  },
-}
diff --git a/4.x/_gen/data/compute_networks.libsonnet b/4.x/_gen/data/compute_networks.libsonnet
new file mode 100644
index 00000000..9a9c2a36
--- /dev/null
+++ b/4.x/_gen/data/compute_networks.libsonnet
@@ -0,0 +1,32 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='compute_networks', url='', help='`compute_networks` represents the `google_compute_networks` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.data.compute_networks.new` injects a new `data_google_compute_networks` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.compute_networks.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.compute_networks` using the reference:\n\n    $._ref.data_google_compute_networks.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_compute_networks.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    project=null,
+    _meta={}
+  ):: tf.withData(
+    type='google_compute_networks',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(project=project),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.compute_networks.newAttrs` constructs a new object with attributes and blocks configured for the `compute_networks`\nTerraform data source.\n\nUnlike [google.data.compute_networks.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `compute_networks` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    project=null
+  ):: std.prune(a={
+    project: project,
+  }),
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the project field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(dataSrcLabel, value): {
+    data+: {
+      google_compute_networks+: {
+        [dataSrcLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/data/game_services_game_server_deployment_rollout.libsonnet b/4.x/_gen/data/game_services_game_server_deployment_rollout.libsonnet
deleted file mode 100644
index 30415dc4..00000000
--- a/4.x/_gen/data/game_services_game_server_deployment_rollout.libsonnet
+++ /dev/null
@@ -1,32 +0,0 @@
-local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
-local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
-{
-  '#':: d.pkg(name='game_services_game_server_deployment_rollout', url='', help='`game_services_game_server_deployment_rollout` represents the `google_game_services_game_server_deployment_rollout` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.data.game_services_game_server_deployment_rollout.new` injects a new `data_google_game_services_game_server_deployment_rollout` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.game_services_game_server_deployment_rollout.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.game_services_game_server_deployment_rollout` using the reference:\n\n    $._ref.data_google_game_services_game_server_deployment_rollout.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_game_services_game_server_deployment_rollout.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `deployment_id` (`string`): The deployment to rollout the new config to. Only 1 rollout must be associated with each deployment.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
-  new(
-    dataSrcLabel,
-    deployment_id,
-    _meta={}
-  ):: tf.withData(
-    type='google_game_services_game_server_deployment_rollout',
-    label=dataSrcLabel,
-    attrs=self.newAttrs(deployment_id=deployment_id),
-    _meta=_meta
-  ),
-  '#newAttrs':: d.fn(help='\n`google.data.game_services_game_server_deployment_rollout.newAttrs` constructs a new object with attributes and blocks configured for the `game_services_game_server_deployment_rollout`\nTerraform data source.\n\nUnlike [google.data.game_services_game_server_deployment_rollout.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `deployment_id` (`string`): The deployment to rollout the new config to. Only 1 rollout must be associated with each deployment.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `game_services_game_server_deployment_rollout` data source into the root Terraform configuration.\n', args=[]),
-  newAttrs(
-    deployment_id
-  ):: std.prune(a={
-    deployment_id: deployment_id,
-  }),
-  '#withDeploymentId':: d.fn(help='`google.string.withDeploymentId` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the deployment_id field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `deployment_id` field.\n', args=[]),
-  withDeploymentId(dataSrcLabel, value): {
-    data+: {
-      google_game_services_game_server_deployment_rollout+: {
-        [dataSrcLabel]+: {
-          deployment_id: value,
-        },
-      },
-    },
-  },
-}
diff --git a/4.x/_gen/data/gke_hub_membership_iam_policy.libsonnet b/4.x/_gen/data/gke_hub_membership_iam_policy.libsonnet
index 9fb5e4b7..3f4abd29 100644
--- a/4.x/_gen/data/gke_hub_membership_iam_policy.libsonnet
+++ b/4.x/_gen/data/gke_hub_membership_iam_policy.libsonnet
@@ -2,26 +2,39 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='gke_hub_membership_iam_policy', url='', help='`gke_hub_membership_iam_policy` represents the `google_gke_hub_membership_iam_policy` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.data.gke_hub_membership_iam_policy.new` injects a new `data_google_gke_hub_membership_iam_policy` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.gke_hub_membership_iam_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.gke_hub_membership_iam_policy` using the reference:\n\n    $._ref.data_google_gke_hub_membership_iam_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_gke_hub_membership_iam_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `membership_id` (`string`): Set the `membership_id` field on the resulting data source block.\n  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.data.gke_hub_membership_iam_policy.new` injects a new `data_google_gke_hub_membership_iam_policy` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.gke_hub_membership_iam_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.gke_hub_membership_iam_policy` using the reference:\n\n    $._ref.data_google_gke_hub_membership_iam_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_gke_hub_membership_iam_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `location` (`string`): Set the `location` field on the resulting data source block. When `null`, the `location` field will be omitted from the resulting object.\n  - `membership_id` (`string`): Set the `membership_id` field on the resulting data source block.\n  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
   new(
     dataSrcLabel,
     membership_id,
+    location=null,
     project=null,
     _meta={}
   ):: tf.withData(
     type='google_gke_hub_membership_iam_policy',
     label=dataSrcLabel,
-    attrs=self.newAttrs(membership_id=membership_id, project=project),
+    attrs=self.newAttrs(location=location, membership_id=membership_id, project=project),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.data.gke_hub_membership_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_membership_iam_policy`\nTerraform data source.\n\nUnlike [google.data.gke_hub_membership_iam_policy.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `membership_id` (`string`): Set the `membership_id` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `gke_hub_membership_iam_policy` data source into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.data.gke_hub_membership_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_membership_iam_policy`\nTerraform data source.\n\nUnlike [google.data.gke_hub_membership_iam_policy.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.\n  - `membership_id` (`string`): Set the `membership_id` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `gke_hub_membership_iam_policy` data source into the root Terraform configuration.\n', args=[]),
   newAttrs(
     membership_id,
+    location=null,
     project=null
   ):: std.prune(a={
+    location: location,
     membership_id: membership_id,
     project: project,
   }),
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the location field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(dataSrcLabel, value): {
+    data+: {
+      google_gke_hub_membership_iam_policy+: {
+        [dataSrcLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
   '#withMembershipId':: d.fn(help='`google.string.withMembershipId` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the membership_id field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `membership_id` field.\n', args=[]),
   withMembershipId(dataSrcLabel, value): {
     data+: {
diff --git a/4.x/_gen/data/main.libsonnet b/4.x/_gen/data/main.libsonnet
index 677f8722..54a15bd6 100644
--- a/4.x/_gen/data/main.libsonnet
+++ b/4.x/_gen/data/main.libsonnet
@@ -19,6 +19,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   bigquery_analytics_hub_listing_iam_policy: (import 'bigquery_analytics_hub_listing_iam_policy.libsonnet'),
   bigquery_connection_iam_policy: (import 'bigquery_connection_iam_policy.libsonnet'),
   bigquery_datapolicy_data_policy_iam_policy: (import 'bigquery_datapolicy_data_policy_iam_policy.libsonnet'),
+  bigquery_dataset: (import 'bigquery_dataset.libsonnet'),
   bigquery_dataset_iam_policy: (import 'bigquery_dataset_iam_policy.libsonnet'),
   bigquery_default_service_account: (import 'bigquery_default_service_account.libsonnet'),
   bigquery_table_iam_policy: (import 'bigquery_table_iam_policy.libsonnet'),
@@ -30,12 +31,15 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   certificate_manager_certificate_map: (import 'certificate_manager_certificate_map.libsonnet'),
   client_config: (import 'client_config.libsonnet'),
   client_openid_userinfo: (import 'client_openid_userinfo.libsonnet'),
+  cloud_identity_group_lookup: (import 'cloud_identity_group_lookup.libsonnet'),
   cloud_identity_group_memberships: (import 'cloud_identity_group_memberships.libsonnet'),
   cloud_identity_groups: (import 'cloud_identity_groups.libsonnet'),
   cloud_run_locations: (import 'cloud_run_locations.libsonnet'),
   cloud_run_service: (import 'cloud_run_service.libsonnet'),
   cloud_run_service_iam_policy: (import 'cloud_run_service_iam_policy.libsonnet'),
+  cloud_run_v2_job: (import 'cloud_run_v2_job.libsonnet'),
   cloud_run_v2_job_iam_policy: (import 'cloud_run_v2_job_iam_policy.libsonnet'),
+  cloud_run_v2_service: (import 'cloud_run_v2_service.libsonnet'),
   cloud_run_v2_service_iam_policy: (import 'cloud_run_v2_service_iam_policy.libsonnet'),
   cloud_tasks_queue_iam_policy: (import 'cloud_tasks_queue_iam_policy.libsonnet'),
   cloudbuild_trigger: (import 'cloudbuild_trigger.libsonnet'),
@@ -44,7 +48,6 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   cloudfunctions2_function_iam_policy: (import 'cloudfunctions2_function_iam_policy.libsonnet'),
   cloudfunctions_function: (import 'cloudfunctions_function.libsonnet'),
   cloudfunctions_function_iam_policy: (import 'cloudfunctions_function_iam_policy.libsonnet'),
-  cloudiot_registry_iam_policy: (import 'cloudiot_registry_iam_policy.libsonnet'),
   composer_environment: (import 'composer_environment.libsonnet'),
   composer_image_versions: (import 'composer_image_versions.libsonnet'),
   compute_address: (import 'compute_address.libsonnet'),
@@ -71,6 +74,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   compute_network: (import 'compute_network.libsonnet'),
   compute_network_endpoint_group: (import 'compute_network_endpoint_group.libsonnet'),
   compute_network_peering: (import 'compute_network_peering.libsonnet'),
+  compute_networks: (import 'compute_networks.libsonnet'),
   compute_node_types: (import 'compute_node_types.libsonnet'),
   compute_region_disk_iam_policy: (import 'compute_region_disk_iam_policy.libsonnet'),
   compute_region_instance_group: (import 'compute_region_instance_group.libsonnet'),
@@ -125,7 +129,6 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   folder_iam_policy: (import 'folder_iam_policy.libsonnet'),
   folder_organization_policy: (import 'folder_organization_policy.libsonnet'),
   folders: (import 'folders.libsonnet'),
-  game_services_game_server_deployment_rollout: (import 'game_services_game_server_deployment_rollout.libsonnet'),
   gke_backup_backup_plan_iam_policy: (import 'gke_backup_backup_plan_iam_policy.libsonnet'),
   gke_backup_restore_plan_iam_policy: (import 'gke_backup_restore_plan_iam_policy.libsonnet'),
   gke_hub_feature_iam_policy: (import 'gke_hub_feature_iam_policy.libsonnet'),
@@ -177,6 +180,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   project_organization_policy: (import 'project_organization_policy.libsonnet'),
   project_service: (import 'project_service.libsonnet'),
   projects: (import 'projects.libsonnet'),
+  pubsub_schema_iam_policy: (import 'pubsub_schema_iam_policy.libsonnet'),
   pubsub_subscription: (import 'pubsub_subscription.libsonnet'),
   pubsub_subscription_iam_policy: (import 'pubsub_subscription_iam_policy.libsonnet'),
   pubsub_topic: (import 'pubsub_topic.libsonnet'),
@@ -187,6 +191,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   secret_manager_secret_iam_policy: (import 'secret_manager_secret_iam_policy.libsonnet'),
   secret_manager_secret_version: (import 'secret_manager_secret_version.libsonnet'),
   secret_manager_secret_version_access: (import 'secret_manager_secret_version_access.libsonnet'),
+  secret_manager_secrets: (import 'secret_manager_secrets.libsonnet'),
   service_account: (import 'service_account.libsonnet'),
   service_account_access_token: (import 'service_account_access_token.libsonnet'),
   service_account_iam_policy: (import 'service_account_iam_policy.libsonnet'),
diff --git a/4.x/_gen/data/pubsub_schema_iam_policy.libsonnet b/4.x/_gen/data/pubsub_schema_iam_policy.libsonnet
new file mode 100644
index 00000000..b409c206
--- /dev/null
+++ b/4.x/_gen/data/pubsub_schema_iam_policy.libsonnet
@@ -0,0 +1,45 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='pubsub_schema_iam_policy', url='', help='`pubsub_schema_iam_policy` represents the `google_pubsub_schema_iam_policy` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.data.pubsub_schema_iam_policy.new` injects a new `data_google_pubsub_schema_iam_policy` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.pubsub_schema_iam_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.pubsub_schema_iam_policy` using the reference:\n\n    $._ref.data_google_pubsub_schema_iam_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_pubsub_schema_iam_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.\n  - `schema` (`string`): Set the `schema` field on the resulting data source block.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    schema,
+    project=null,
+    _meta={}
+  ):: tf.withData(
+    type='google_pubsub_schema_iam_policy',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(project=project, schema=schema),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.pubsub_schema_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `pubsub_schema_iam_policy`\nTerraform data source.\n\nUnlike [google.data.pubsub_schema_iam_policy.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `schema` (`string`): Set the `schema` field on the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `pubsub_schema_iam_policy` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    schema,
+    project=null
+  ):: std.prune(a={
+    project: project,
+    schema: schema,
+  }),
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the project field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(dataSrcLabel, value): {
+    data+: {
+      google_pubsub_schema_iam_policy+: {
+        [dataSrcLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withSchema':: d.fn(help='`google.string.withSchema` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the schema field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `schema` field.\n', args=[]),
+  withSchema(dataSrcLabel, value): {
+    data+: {
+      google_pubsub_schema_iam_policy+: {
+        [dataSrcLabel]+: {
+          schema: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/data/secret_manager_secrets.libsonnet b/4.x/_gen/data/secret_manager_secrets.libsonnet
new file mode 100644
index 00000000..da291491
--- /dev/null
+++ b/4.x/_gen/data/secret_manager_secrets.libsonnet
@@ -0,0 +1,45 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='secret_manager_secrets', url='', help='`secret_manager_secrets` represents the `google_secret_manager_secrets` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.data.secret_manager_secrets.new` injects a new `data_google_secret_manager_secrets` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data.secret_manager_secrets.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data.secret_manager_secrets` using the reference:\n\n    $._ref.data_google_secret_manager_secrets.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_google_secret_manager_secrets.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `filter` (`string`): Filter string, adhering to the rules in List-operation filtering (https://cloud.google.com/secret-manager/docs/filtering).\nList only secrets matching the filter. If filter is empty, all secrets are listed. When `null`, the `filter` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    filter=null,
+    project=null,
+    _meta={}
+  ):: tf.withData(
+    type='google_secret_manager_secrets',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(filter=filter, project=project),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.data.secret_manager_secrets.newAttrs` constructs a new object with attributes and blocks configured for the `secret_manager_secrets`\nTerraform data source.\n\nUnlike [google.data.secret_manager_secrets.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `filter` (`string`): Filter string, adhering to the rules in List-operation filtering (https://cloud.google.com/secret-manager/docs/filtering).\nList only secrets matching the filter. If filter is empty, all secrets are listed. When `null`, the `filter` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `secret_manager_secrets` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    filter=null,
+    project=null
+  ):: std.prune(a={
+    filter: filter,
+    project: project,
+  }),
+  '#withFilter':: d.fn(help='`google.string.withFilter` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the filter field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `filter` field.\n', args=[]),
+  withFilter(dataSrcLabel, value): {
+    data+: {
+      google_secret_manager_secrets+: {
+        [dataSrcLabel]+: {
+          filter: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the project field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(dataSrcLabel, value): {
+    data+: {
+      google_secret_manager_secrets+: {
+        [dataSrcLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/main.libsonnet b/4.x/_gen/main.libsonnet
index 887418a9..3654f17f 100644
--- a/4.x/_gen/main.libsonnet
+++ b/4.x/_gen/main.libsonnet
@@ -23,6 +23,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   alloydb_backup: (import 'resources/alloydb_backup.libsonnet'),
   alloydb_cluster: (import 'resources/alloydb_cluster.libsonnet'),
   alloydb_instance: (import 'resources/alloydb_instance.libsonnet'),
+  alloydb_user: (import 'resources/alloydb_user.libsonnet'),
   apigee_addons_config: (import 'resources/apigee_addons_config.libsonnet'),
   apigee_endpoint_attachment: (import 'resources/apigee_endpoint_attachment.libsonnet'),
   apigee_env_keystore: (import 'resources/apigee_env_keystore.libsonnet'),
@@ -166,11 +167,6 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   cloudfunctions_function_iam_binding: (import 'resources/cloudfunctions_function_iam_binding.libsonnet'),
   cloudfunctions_function_iam_member: (import 'resources/cloudfunctions_function_iam_member.libsonnet'),
   cloudfunctions_function_iam_policy: (import 'resources/cloudfunctions_function_iam_policy.libsonnet'),
-  cloudiot_device: (import 'resources/cloudiot_device.libsonnet'),
-  cloudiot_registry: (import 'resources/cloudiot_registry.libsonnet'),
-  cloudiot_registry_iam_binding: (import 'resources/cloudiot_registry_iam_binding.libsonnet'),
-  cloudiot_registry_iam_member: (import 'resources/cloudiot_registry_iam_member.libsonnet'),
-  cloudiot_registry_iam_policy: (import 'resources/cloudiot_registry_iam_policy.libsonnet'),
   composer_environment: (import 'resources/composer_environment.libsonnet'),
   compute_address: (import 'resources/compute_address.libsonnet'),
   compute_attached_disk: (import 'resources/compute_attached_disk.libsonnet'),
@@ -327,6 +323,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   data_loss_prevention_stored_info_type: (import 'resources/data_loss_prevention_stored_info_type.libsonnet'),
   data_pipeline_pipeline: (import 'resources/data_pipeline_pipeline.libsonnet'),
   database_migration_service_connection_profile: (import 'resources/database_migration_service_connection_profile.libsonnet'),
+  database_migration_service_private_connection: (import 'resources/database_migration_service_private_connection.libsonnet'),
   dataflow_job: (import 'resources/dataflow_job.libsonnet'),
   dataplex_asset: (import 'resources/dataplex_asset.libsonnet'),
   dataplex_asset_iam_binding: (import 'resources/dataplex_asset_iam_binding.libsonnet'),
@@ -396,6 +393,9 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   document_ai_processor_default_version: (import 'resources/document_ai_processor_default_version.libsonnet'),
   document_ai_warehouse_document_schema: (import 'resources/document_ai_warehouse_document_schema.libsonnet'),
   document_ai_warehouse_location: (import 'resources/document_ai_warehouse_location.libsonnet'),
+  edgecontainer_cluster: (import 'resources/edgecontainer_cluster.libsonnet'),
+  edgecontainer_node_pool: (import 'resources/edgecontainer_node_pool.libsonnet'),
+  edgecontainer_vpn_connection: (import 'resources/edgecontainer_vpn_connection.libsonnet'),
   edgenetwork_network: (import 'resources/edgenetwork_network.libsonnet'),
   edgenetwork_subnet: (import 'resources/edgenetwork_subnet.libsonnet'),
   endpoints_service: (import 'resources/endpoints_service.libsonnet'),
@@ -414,6 +414,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   filestore_snapshot: (import 'resources/filestore_snapshot.libsonnet'),
   firebaserules_release: (import 'resources/firebaserules_release.libsonnet'),
   firebaserules_ruleset: (import 'resources/firebaserules_ruleset.libsonnet'),
+  firestore_backup_schedule: (import 'resources/firestore_backup_schedule.libsonnet'),
   firestore_database: (import 'resources/firestore_database.libsonnet'),
   firestore_document: (import 'resources/firestore_document.libsonnet'),
   firestore_field: (import 'resources/firestore_field.libsonnet'),
@@ -425,11 +426,6 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   folder_iam_member: (import 'resources/folder_iam_member.libsonnet'),
   folder_iam_policy: (import 'resources/folder_iam_policy.libsonnet'),
   folder_organization_policy: (import 'resources/folder_organization_policy.libsonnet'),
-  game_services_game_server_cluster: (import 'resources/game_services_game_server_cluster.libsonnet'),
-  game_services_game_server_config: (import 'resources/game_services_game_server_config.libsonnet'),
-  game_services_game_server_deployment: (import 'resources/game_services_game_server_deployment.libsonnet'),
-  game_services_game_server_deployment_rollout: (import 'resources/game_services_game_server_deployment_rollout.libsonnet'),
-  game_services_realm: (import 'resources/game_services_realm.libsonnet'),
   gke_backup_backup_plan: (import 'resources/gke_backup_backup_plan.libsonnet'),
   gke_backup_backup_plan_iam_binding: (import 'resources/gke_backup_backup_plan_iam_binding.libsonnet'),
   gke_backup_backup_plan_iam_member: (import 'resources/gke_backup_backup_plan_iam_member.libsonnet'),
@@ -443,6 +439,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   gke_hub_feature_iam_member: (import 'resources/gke_hub_feature_iam_member.libsonnet'),
   gke_hub_feature_iam_policy: (import 'resources/gke_hub_feature_iam_policy.libsonnet'),
   gke_hub_feature_membership: (import 'resources/gke_hub_feature_membership.libsonnet'),
+  gke_hub_fleet: (import 'resources/gke_hub_fleet.libsonnet'),
   gke_hub_membership: (import 'resources/gke_hub_membership.libsonnet'),
   gke_hub_membership_binding: (import 'resources/gke_hub_membership_binding.libsonnet'),
   gke_hub_membership_iam_binding: (import 'resources/gke_hub_membership_iam_binding.libsonnet'),
@@ -454,6 +451,11 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   gke_hub_scope_iam_member: (import 'resources/gke_hub_scope_iam_member.libsonnet'),
   gke_hub_scope_iam_policy: (import 'resources/gke_hub_scope_iam_policy.libsonnet'),
   gke_hub_scope_rbac_role_binding: (import 'resources/gke_hub_scope_rbac_role_binding.libsonnet'),
+  gkeonprem_bare_metal_admin_cluster: (import 'resources/gkeonprem_bare_metal_admin_cluster.libsonnet'),
+  gkeonprem_bare_metal_cluster: (import 'resources/gkeonprem_bare_metal_cluster.libsonnet'),
+  gkeonprem_bare_metal_node_pool: (import 'resources/gkeonprem_bare_metal_node_pool.libsonnet'),
+  gkeonprem_vmware_cluster: (import 'resources/gkeonprem_vmware_cluster.libsonnet'),
+  gkeonprem_vmware_node_pool: (import 'resources/gkeonprem_vmware_node_pool.libsonnet'),
   healthcare_consent_store: (import 'resources/healthcare_consent_store.libsonnet'),
   healthcare_consent_store_iam_binding: (import 'resources/healthcare_consent_store_iam_binding.libsonnet'),
   healthcare_consent_store_iam_member: (import 'resources/healthcare_consent_store_iam_member.libsonnet'),
@@ -558,6 +560,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   monitoring_slo: (import 'resources/monitoring_slo.libsonnet'),
   monitoring_uptime_check_config: (import 'resources/monitoring_uptime_check_config.libsonnet'),
   network_connectivity_hub: (import 'resources/network_connectivity_hub.libsonnet'),
+  network_connectivity_policy_based_route: (import 'resources/network_connectivity_policy_based_route.libsonnet'),
   network_connectivity_service_connection_policy: (import 'resources/network_connectivity_service_connection_policy.libsonnet'),
   network_connectivity_spoke: (import 'resources/network_connectivity_spoke.libsonnet'),
   network_management_connectivity_test: (import 'resources/network_management_connectivity_test.libsonnet'),
@@ -579,6 +582,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   notebooks_runtime_iam_binding: (import 'resources/notebooks_runtime_iam_binding.libsonnet'),
   notebooks_runtime_iam_member: (import 'resources/notebooks_runtime_iam_member.libsonnet'),
   notebooks_runtime_iam_policy: (import 'resources/notebooks_runtime_iam_policy.libsonnet'),
+  org_policy_custom_constraint: (import 'resources/org_policy_custom_constraint.libsonnet'),
   org_policy_policy: (import 'resources/org_policy_policy.libsonnet'),
   organization_access_approval_settings: (import 'resources/organization_access_approval_settings.libsonnet'),
   organization_iam_audit_config: (import 'resources/organization_iam_audit_config.libsonnet'),
@@ -616,6 +620,9 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   pubsub_lite_subscription: (import 'resources/pubsub_lite_subscription.libsonnet'),
   pubsub_lite_topic: (import 'resources/pubsub_lite_topic.libsonnet'),
   pubsub_schema: (import 'resources/pubsub_schema.libsonnet'),
+  pubsub_schema_iam_binding: (import 'resources/pubsub_schema_iam_binding.libsonnet'),
+  pubsub_schema_iam_member: (import 'resources/pubsub_schema_iam_member.libsonnet'),
+  pubsub_schema_iam_policy: (import 'resources/pubsub_schema_iam_policy.libsonnet'),
   pubsub_subscription: (import 'resources/pubsub_subscription.libsonnet'),
   pubsub_subscription_iam_binding: (import 'resources/pubsub_subscription_iam_binding.libsonnet'),
   pubsub_subscription_iam_member: (import 'resources/pubsub_subscription_iam_member.libsonnet'),
@@ -625,10 +632,13 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   pubsub_topic_iam_member: (import 'resources/pubsub_topic_iam_member.libsonnet'),
   pubsub_topic_iam_policy: (import 'resources/pubsub_topic_iam_policy.libsonnet'),
   recaptcha_enterprise_key: (import 'resources/recaptcha_enterprise_key.libsonnet'),
+  redis_cluster: (import 'resources/redis_cluster.libsonnet'),
   redis_instance: (import 'resources/redis_instance.libsonnet'),
   resource_manager_lien: (import 'resources/resource_manager_lien.libsonnet'),
+  scc_folder_custom_module: (import 'resources/scc_folder_custom_module.libsonnet'),
   scc_mute_config: (import 'resources/scc_mute_config.libsonnet'),
   scc_notification_config: (import 'resources/scc_notification_config.libsonnet'),
+  scc_organization_custom_module: (import 'resources/scc_organization_custom_module.libsonnet'),
   scc_project_custom_module: (import 'resources/scc_project_custom_module.libsonnet'),
   scc_source: (import 'resources/scc_source.libsonnet'),
   scc_source_iam_binding: (import 'resources/scc_source_iam_binding.libsonnet'),
diff --git a/4.x/_gen/provider_google.libsonnet b/4.x/_gen/provider_google.libsonnet
index 00871df2..b5d8b983 100644
--- a/4.x/_gen/provider_google.libsonnet
+++ b/4.x/_gen/provider_google.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='provider', url='', help='`provider` represents the `google` Terraform provider config.\n\n\n\nThis package contains functions and utilities for setting up the provider using Jsonnet code.\n'),
-  '#new':: d.fn(help='\n`google.provider.new` injects a new `google` Terraform `provider`\nblock into the root module document.\n\nOptionally, this inserts the provider into the\n[required_providers](https://developer.hashicorp.com/terraform/language/providers/requirements) `terraform` sub block if\nthe `src` and/or `version` parameters are set.\n\n**Args**:\n  - `access_approval_custom_endpoint` (`string`): Set the `access_approval_custom_endpoint` field on the resulting provider block. When `null`, the `access_approval_custom_endpoint` field will be omitted from the resulting object.\n  - `access_context_manager_custom_endpoint` (`string`): Set the `access_context_manager_custom_endpoint` field on the resulting provider block. When `null`, the `access_context_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `access_token` (`string`): Set the `access_token` field on the resulting provider block. When `null`, the `access_token` field will be omitted from the resulting object.\n  - `active_directory_custom_endpoint` (`string`): Set the `active_directory_custom_endpoint` field on the resulting provider block. When `null`, the `active_directory_custom_endpoint` field will be omitted from the resulting object.\n  - `alloydb_custom_endpoint` (`string`): Set the `alloydb_custom_endpoint` field on the resulting provider block. When `null`, the `alloydb_custom_endpoint` field will be omitted from the resulting object.\n  - `apigee_custom_endpoint` (`string`): Set the `apigee_custom_endpoint` field on the resulting provider block. When `null`, the `apigee_custom_endpoint` field will be omitted from the resulting object.\n  - `apikeys_custom_endpoint` (`string`): Set the `apikeys_custom_endpoint` field on the resulting provider block. When `null`, the `apikeys_custom_endpoint` field will be omitted from the resulting object.\n  - `app_engine_custom_endpoint` (`string`): Set the `app_engine_custom_endpoint` field on the resulting provider block. When `null`, the `app_engine_custom_endpoint` field will be omitted from the resulting object.\n  - `artifact_registry_custom_endpoint` (`string`): Set the `artifact_registry_custom_endpoint` field on the resulting provider block. When `null`, the `artifact_registry_custom_endpoint` field will be omitted from the resulting object.\n  - `assured_workloads_custom_endpoint` (`string`): Set the `assured_workloads_custom_endpoint` field on the resulting provider block. When `null`, the `assured_workloads_custom_endpoint` field will be omitted from the resulting object.\n  - `beyondcorp_custom_endpoint` (`string`): Set the `beyondcorp_custom_endpoint` field on the resulting provider block. When `null`, the `beyondcorp_custom_endpoint` field will be omitted from the resulting object.\n  - `big_query_custom_endpoint` (`string`): Set the `big_query_custom_endpoint` field on the resulting provider block. When `null`, the `big_query_custom_endpoint` field will be omitted from the resulting object.\n  - `biglake_custom_endpoint` (`string`): Set the `biglake_custom_endpoint` field on the resulting provider block. When `null`, the `biglake_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_analytics_hub_custom_endpoint` (`string`): Set the `bigquery_analytics_hub_custom_endpoint` field on the resulting provider block. When `null`, the `bigquery_analytics_hub_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_connection_custom_endpoint` (`string`): Set the `bigquery_connection_custom_endpoint` field on the resulting provider block. When `null`, the `bigquery_connection_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_data_transfer_custom_endpoint` (`string`): Set the `bigquery_data_transfer_custom_endpoint` field on the resulting provider block. When `null`, the `bigquery_data_transfer_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_datapolicy_custom_endpoint` (`string`): Set the `bigquery_datapolicy_custom_endpoint` field on the resulting provider block. When `null`, the `bigquery_datapolicy_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_reservation_custom_endpoint` (`string`): Set the `bigquery_reservation_custom_endpoint` field on the resulting provider block. When `null`, the `bigquery_reservation_custom_endpoint` field will be omitted from the resulting object.\n  - `bigtable_custom_endpoint` (`string`): Set the `bigtable_custom_endpoint` field on the resulting provider block. When `null`, the `bigtable_custom_endpoint` field will be omitted from the resulting object.\n  - `billing_custom_endpoint` (`string`): Set the `billing_custom_endpoint` field on the resulting provider block. When `null`, the `billing_custom_endpoint` field will be omitted from the resulting object.\n  - `billing_project` (`string`): Set the `billing_project` field on the resulting provider block. When `null`, the `billing_project` field will be omitted from the resulting object.\n  - `binary_authorization_custom_endpoint` (`string`): Set the `binary_authorization_custom_endpoint` field on the resulting provider block. When `null`, the `binary_authorization_custom_endpoint` field will be omitted from the resulting object.\n  - `certificate_manager_custom_endpoint` (`string`): Set the `certificate_manager_custom_endpoint` field on the resulting provider block. When `null`, the `certificate_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_asset_custom_endpoint` (`string`): Set the `cloud_asset_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_asset_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_billing_custom_endpoint` (`string`): Set the `cloud_billing_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_billing_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_build_custom_endpoint` (`string`): Set the `cloud_build_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_build_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_build_worker_pool_custom_endpoint` (`string`): Set the `cloud_build_worker_pool_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_build_worker_pool_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_functions_custom_endpoint` (`string`): Set the `cloud_functions_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_functions_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_identity_custom_endpoint` (`string`): Set the `cloud_identity_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_identity_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_ids_custom_endpoint` (`string`): Set the `cloud_ids_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_ids_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_iot_custom_endpoint` (`string`): Set the `cloud_iot_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_iot_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_resource_manager_custom_endpoint` (`string`): Set the `cloud_resource_manager_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_resource_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_run_custom_endpoint` (`string`): Set the `cloud_run_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_run_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_run_v2_custom_endpoint` (`string`): Set the `cloud_run_v2_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_run_v2_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_scheduler_custom_endpoint` (`string`): Set the `cloud_scheduler_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_scheduler_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_tasks_custom_endpoint` (`string`): Set the `cloud_tasks_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_tasks_custom_endpoint` field will be omitted from the resulting object.\n  - `cloudbuildv2_custom_endpoint` (`string`): Set the `cloudbuildv2_custom_endpoint` field on the resulting provider block. When `null`, the `cloudbuildv2_custom_endpoint` field will be omitted from the resulting object.\n  - `clouddeploy_custom_endpoint` (`string`): Set the `clouddeploy_custom_endpoint` field on the resulting provider block. When `null`, the `clouddeploy_custom_endpoint` field will be omitted from the resulting object.\n  - `cloudfunctions2_custom_endpoint` (`string`): Set the `cloudfunctions2_custom_endpoint` field on the resulting provider block. When `null`, the `cloudfunctions2_custom_endpoint` field will be omitted from the resulting object.\n  - `composer_custom_endpoint` (`string`): Set the `composer_custom_endpoint` field on the resulting provider block. When `null`, the `composer_custom_endpoint` field will be omitted from the resulting object.\n  - `compute_custom_endpoint` (`string`): Set the `compute_custom_endpoint` field on the resulting provider block. When `null`, the `compute_custom_endpoint` field will be omitted from the resulting object.\n  - `container_analysis_custom_endpoint` (`string`): Set the `container_analysis_custom_endpoint` field on the resulting provider block. When `null`, the `container_analysis_custom_endpoint` field will be omitted from the resulting object.\n  - `container_attached_custom_endpoint` (`string`): Set the `container_attached_custom_endpoint` field on the resulting provider block. When `null`, the `container_attached_custom_endpoint` field will be omitted from the resulting object.\n  - `container_aws_custom_endpoint` (`string`): Set the `container_aws_custom_endpoint` field on the resulting provider block. When `null`, the `container_aws_custom_endpoint` field will be omitted from the resulting object.\n  - `container_azure_custom_endpoint` (`string`): Set the `container_azure_custom_endpoint` field on the resulting provider block. When `null`, the `container_azure_custom_endpoint` field will be omitted from the resulting object.\n  - `container_custom_endpoint` (`string`): Set the `container_custom_endpoint` field on the resulting provider block. When `null`, the `container_custom_endpoint` field will be omitted from the resulting object.\n  - `core_billing_custom_endpoint` (`string`): Set the `core_billing_custom_endpoint` field on the resulting provider block. When `null`, the `core_billing_custom_endpoint` field will be omitted from the resulting object.\n  - `credentials` (`string`): Set the `credentials` field on the resulting provider block. When `null`, the `credentials` field will be omitted from the resulting object.\n  - `data_catalog_custom_endpoint` (`string`): Set the `data_catalog_custom_endpoint` field on the resulting provider block. When `null`, the `data_catalog_custom_endpoint` field will be omitted from the resulting object.\n  - `data_fusion_custom_endpoint` (`string`): Set the `data_fusion_custom_endpoint` field on the resulting provider block. When `null`, the `data_fusion_custom_endpoint` field will be omitted from the resulting object.\n  - `data_loss_prevention_custom_endpoint` (`string`): Set the `data_loss_prevention_custom_endpoint` field on the resulting provider block. When `null`, the `data_loss_prevention_custom_endpoint` field will be omitted from the resulting object.\n  - `data_pipeline_custom_endpoint` (`string`): Set the `data_pipeline_custom_endpoint` field on the resulting provider block. When `null`, the `data_pipeline_custom_endpoint` field will be omitted from the resulting object.\n  - `database_migration_service_custom_endpoint` (`string`): Set the `database_migration_service_custom_endpoint` field on the resulting provider block. When `null`, the `database_migration_service_custom_endpoint` field will be omitted from the resulting object.\n  - `dataflow_custom_endpoint` (`string`): Set the `dataflow_custom_endpoint` field on the resulting provider block. When `null`, the `dataflow_custom_endpoint` field will be omitted from the resulting object.\n  - `dataplex_custom_endpoint` (`string`): Set the `dataplex_custom_endpoint` field on the resulting provider block. When `null`, the `dataplex_custom_endpoint` field will be omitted from the resulting object.\n  - `dataproc_custom_endpoint` (`string`): Set the `dataproc_custom_endpoint` field on the resulting provider block. When `null`, the `dataproc_custom_endpoint` field will be omitted from the resulting object.\n  - `dataproc_metastore_custom_endpoint` (`string`): Set the `dataproc_metastore_custom_endpoint` field on the resulting provider block. When `null`, the `dataproc_metastore_custom_endpoint` field will be omitted from the resulting object.\n  - `datastore_custom_endpoint` (`string`): Set the `datastore_custom_endpoint` field on the resulting provider block. When `null`, the `datastore_custom_endpoint` field will be omitted from the resulting object.\n  - `datastream_custom_endpoint` (`string`): Set the `datastream_custom_endpoint` field on the resulting provider block. When `null`, the `datastream_custom_endpoint` field will be omitted from the resulting object.\n  - `deployment_manager_custom_endpoint` (`string`): Set the `deployment_manager_custom_endpoint` field on the resulting provider block. When `null`, the `deployment_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `dialogflow_custom_endpoint` (`string`): Set the `dialogflow_custom_endpoint` field on the resulting provider block. When `null`, the `dialogflow_custom_endpoint` field will be omitted from the resulting object.\n  - `dialogflow_cx_custom_endpoint` (`string`): Set the `dialogflow_cx_custom_endpoint` field on the resulting provider block. When `null`, the `dialogflow_cx_custom_endpoint` field will be omitted from the resulting object.\n  - `dns_custom_endpoint` (`string`): Set the `dns_custom_endpoint` field on the resulting provider block. When `null`, the `dns_custom_endpoint` field will be omitted from the resulting object.\n  - `document_ai_custom_endpoint` (`string`): Set the `document_ai_custom_endpoint` field on the resulting provider block. When `null`, the `document_ai_custom_endpoint` field will be omitted from the resulting object.\n  - `document_ai_warehouse_custom_endpoint` (`string`): Set the `document_ai_warehouse_custom_endpoint` field on the resulting provider block. When `null`, the `document_ai_warehouse_custom_endpoint` field will be omitted from the resulting object.\n  - `edgenetwork_custom_endpoint` (`string`): Set the `edgenetwork_custom_endpoint` field on the resulting provider block. When `null`, the `edgenetwork_custom_endpoint` field will be omitted from the resulting object.\n  - `essential_contacts_custom_endpoint` (`string`): Set the `essential_contacts_custom_endpoint` field on the resulting provider block. When `null`, the `essential_contacts_custom_endpoint` field will be omitted from the resulting object.\n  - `eventarc_custom_endpoint` (`string`): Set the `eventarc_custom_endpoint` field on the resulting provider block. When `null`, the `eventarc_custom_endpoint` field will be omitted from the resulting object.\n  - `filestore_custom_endpoint` (`string`): Set the `filestore_custom_endpoint` field on the resulting provider block. When `null`, the `filestore_custom_endpoint` field will be omitted from the resulting object.\n  - `firebaserules_custom_endpoint` (`string`): Set the `firebaserules_custom_endpoint` field on the resulting provider block. When `null`, the `firebaserules_custom_endpoint` field will be omitted from the resulting object.\n  - `firestore_custom_endpoint` (`string`): Set the `firestore_custom_endpoint` field on the resulting provider block. When `null`, the `firestore_custom_endpoint` field will be omitted from the resulting object.\n  - `game_services_custom_endpoint` (`string`): Set the `game_services_custom_endpoint` field on the resulting provider block. When `null`, the `game_services_custom_endpoint` field will be omitted from the resulting object.\n  - `gke_backup_custom_endpoint` (`string`): Set the `gke_backup_custom_endpoint` field on the resulting provider block. When `null`, the `gke_backup_custom_endpoint` field will be omitted from the resulting object.\n  - `gke_hub2_custom_endpoint` (`string`): Set the `gke_hub2_custom_endpoint` field on the resulting provider block. When `null`, the `gke_hub2_custom_endpoint` field will be omitted from the resulting object.\n  - `gke_hub_custom_endpoint` (`string`): Set the `gke_hub_custom_endpoint` field on the resulting provider block. When `null`, the `gke_hub_custom_endpoint` field will be omitted from the resulting object.\n  - `gkehub_feature_custom_endpoint` (`string`): Set the `gkehub_feature_custom_endpoint` field on the resulting provider block. When `null`, the `gkehub_feature_custom_endpoint` field will be omitted from the resulting object.\n  - `healthcare_custom_endpoint` (`string`): Set the `healthcare_custom_endpoint` field on the resulting provider block. When `null`, the `healthcare_custom_endpoint` field will be omitted from the resulting object.\n  - `iam2_custom_endpoint` (`string`): Set the `iam2_custom_endpoint` field on the resulting provider block. When `null`, the `iam2_custom_endpoint` field will be omitted from the resulting object.\n  - `iam_beta_custom_endpoint` (`string`): Set the `iam_beta_custom_endpoint` field on the resulting provider block. When `null`, the `iam_beta_custom_endpoint` field will be omitted from the resulting object.\n  - `iam_credentials_custom_endpoint` (`string`): Set the `iam_credentials_custom_endpoint` field on the resulting provider block. When `null`, the `iam_credentials_custom_endpoint` field will be omitted from the resulting object.\n  - `iam_custom_endpoint` (`string`): Set the `iam_custom_endpoint` field on the resulting provider block. When `null`, the `iam_custom_endpoint` field will be omitted from the resulting object.\n  - `iam_workforce_pool_custom_endpoint` (`string`): Set the `iam_workforce_pool_custom_endpoint` field on the resulting provider block. When `null`, the `iam_workforce_pool_custom_endpoint` field will be omitted from the resulting object.\n  - `iap_custom_endpoint` (`string`): Set the `iap_custom_endpoint` field on the resulting provider block. When `null`, the `iap_custom_endpoint` field will be omitted from the resulting object.\n  - `identity_platform_custom_endpoint` (`string`): Set the `identity_platform_custom_endpoint` field on the resulting provider block. When `null`, the `identity_platform_custom_endpoint` field will be omitted from the resulting object.\n  - `impersonate_service_account` (`string`): Set the `impersonate_service_account` field on the resulting provider block. When `null`, the `impersonate_service_account` field will be omitted from the resulting object.\n  - `impersonate_service_account_delegates` (`list`): Set the `impersonate_service_account_delegates` field on the resulting provider block. When `null`, the `impersonate_service_account_delegates` field will be omitted from the resulting object.\n  - `kms_custom_endpoint` (`string`): Set the `kms_custom_endpoint` field on the resulting provider block. When `null`, the `kms_custom_endpoint` field will be omitted from the resulting object.\n  - `logging_custom_endpoint` (`string`): Set the `logging_custom_endpoint` field on the resulting provider block. When `null`, the `logging_custom_endpoint` field will be omitted from the resulting object.\n  - `looker_custom_endpoint` (`string`): Set the `looker_custom_endpoint` field on the resulting provider block. When `null`, the `looker_custom_endpoint` field will be omitted from the resulting object.\n  - `memcache_custom_endpoint` (`string`): Set the `memcache_custom_endpoint` field on the resulting provider block. When `null`, the `memcache_custom_endpoint` field will be omitted from the resulting object.\n  - `ml_engine_custom_endpoint` (`string`): Set the `ml_engine_custom_endpoint` field on the resulting provider block. When `null`, the `ml_engine_custom_endpoint` field will be omitted from the resulting object.\n  - `monitoring_custom_endpoint` (`string`): Set the `monitoring_custom_endpoint` field on the resulting provider block. When `null`, the `monitoring_custom_endpoint` field will be omitted from the resulting object.\n  - `network_connectivity_custom_endpoint` (`string`): Set the `network_connectivity_custom_endpoint` field on the resulting provider block. When `null`, the `network_connectivity_custom_endpoint` field will be omitted from the resulting object.\n  - `network_management_custom_endpoint` (`string`): Set the `network_management_custom_endpoint` field on the resulting provider block. When `null`, the `network_management_custom_endpoint` field will be omitted from the resulting object.\n  - `network_security_custom_endpoint` (`string`): Set the `network_security_custom_endpoint` field on the resulting provider block. When `null`, the `network_security_custom_endpoint` field will be omitted from the resulting object.\n  - `network_services_custom_endpoint` (`string`): Set the `network_services_custom_endpoint` field on the resulting provider block. When `null`, the `network_services_custom_endpoint` field will be omitted from the resulting object.\n  - `notebooks_custom_endpoint` (`string`): Set the `notebooks_custom_endpoint` field on the resulting provider block. When `null`, the `notebooks_custom_endpoint` field will be omitted from the resulting object.\n  - `org_policy_custom_endpoint` (`string`): Set the `org_policy_custom_endpoint` field on the resulting provider block. When `null`, the `org_policy_custom_endpoint` field will be omitted from the resulting object.\n  - `os_config_custom_endpoint` (`string`): Set the `os_config_custom_endpoint` field on the resulting provider block. When `null`, the `os_config_custom_endpoint` field will be omitted from the resulting object.\n  - `os_login_custom_endpoint` (`string`): Set the `os_login_custom_endpoint` field on the resulting provider block. When `null`, the `os_login_custom_endpoint` field will be omitted from the resulting object.\n  - `privateca_custom_endpoint` (`string`): Set the `privateca_custom_endpoint` field on the resulting provider block. When `null`, the `privateca_custom_endpoint` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting provider block. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_ca_custom_endpoint` (`string`): Set the `public_ca_custom_endpoint` field on the resulting provider block. When `null`, the `public_ca_custom_endpoint` field will be omitted from the resulting object.\n  - `pubsub_custom_endpoint` (`string`): Set the `pubsub_custom_endpoint` field on the resulting provider block. When `null`, the `pubsub_custom_endpoint` field will be omitted from the resulting object.\n  - `pubsub_lite_custom_endpoint` (`string`): Set the `pubsub_lite_custom_endpoint` field on the resulting provider block. When `null`, the `pubsub_lite_custom_endpoint` field will be omitted from the resulting object.\n  - `recaptcha_enterprise_custom_endpoint` (`string`): Set the `recaptcha_enterprise_custom_endpoint` field on the resulting provider block. When `null`, the `recaptcha_enterprise_custom_endpoint` field will be omitted from the resulting object.\n  - `redis_custom_endpoint` (`string`): Set the `redis_custom_endpoint` field on the resulting provider block. When `null`, the `redis_custom_endpoint` field will be omitted from the resulting object.\n  - `region` (`string`): Set the `region` field on the resulting provider block. When `null`, the `region` field will be omitted from the resulting object.\n  - `request_reason` (`string`): Set the `request_reason` field on the resulting provider block. When `null`, the `request_reason` field will be omitted from the resulting object.\n  - `request_timeout` (`string`): Set the `request_timeout` field on the resulting provider block. When `null`, the `request_timeout` field will be omitted from the resulting object.\n  - `resource_manager_custom_endpoint` (`string`): Set the `resource_manager_custom_endpoint` field on the resulting provider block. When `null`, the `resource_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `resource_manager_v3_custom_endpoint` (`string`): Set the `resource_manager_v3_custom_endpoint` field on the resulting provider block. When `null`, the `resource_manager_v3_custom_endpoint` field will be omitted from the resulting object.\n  - `scopes` (`list`): Set the `scopes` field on the resulting provider block. When `null`, the `scopes` field will be omitted from the resulting object.\n  - `secret_manager_custom_endpoint` (`string`): Set the `secret_manager_custom_endpoint` field on the resulting provider block. When `null`, the `secret_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `security_center_custom_endpoint` (`string`): Set the `security_center_custom_endpoint` field on the resulting provider block. When `null`, the `security_center_custom_endpoint` field will be omitted from the resulting object.\n  - `service_management_custom_endpoint` (`string`): Set the `service_management_custom_endpoint` field on the resulting provider block. When `null`, the `service_management_custom_endpoint` field will be omitted from the resulting object.\n  - `service_networking_custom_endpoint` (`string`): Set the `service_networking_custom_endpoint` field on the resulting provider block. When `null`, the `service_networking_custom_endpoint` field will be omitted from the resulting object.\n  - `service_usage_custom_endpoint` (`string`): Set the `service_usage_custom_endpoint` field on the resulting provider block. When `null`, the `service_usage_custom_endpoint` field will be omitted from the resulting object.\n  - `source_repo_custom_endpoint` (`string`): Set the `source_repo_custom_endpoint` field on the resulting provider block. When `null`, the `source_repo_custom_endpoint` field will be omitted from the resulting object.\n  - `spanner_custom_endpoint` (`string`): Set the `spanner_custom_endpoint` field on the resulting provider block. When `null`, the `spanner_custom_endpoint` field will be omitted from the resulting object.\n  - `sql_custom_endpoint` (`string`): Set the `sql_custom_endpoint` field on the resulting provider block. When `null`, the `sql_custom_endpoint` field will be omitted from the resulting object.\n  - `storage_custom_endpoint` (`string`): Set the `storage_custom_endpoint` field on the resulting provider block. When `null`, the `storage_custom_endpoint` field will be omitted from the resulting object.\n  - `storage_insights_custom_endpoint` (`string`): Set the `storage_insights_custom_endpoint` field on the resulting provider block. When `null`, the `storage_insights_custom_endpoint` field will be omitted from the resulting object.\n  - `storage_transfer_custom_endpoint` (`string`): Set the `storage_transfer_custom_endpoint` field on the resulting provider block. When `null`, the `storage_transfer_custom_endpoint` field will be omitted from the resulting object.\n  - `tags_custom_endpoint` (`string`): Set the `tags_custom_endpoint` field on the resulting provider block. When `null`, the `tags_custom_endpoint` field will be omitted from the resulting object.\n  - `tags_location_custom_endpoint` (`string`): Set the `tags_location_custom_endpoint` field on the resulting provider block. When `null`, the `tags_location_custom_endpoint` field will be omitted from the resulting object.\n  - `tpu_custom_endpoint` (`string`): Set the `tpu_custom_endpoint` field on the resulting provider block. When `null`, the `tpu_custom_endpoint` field will be omitted from the resulting object.\n  - `user_project_override` (`bool`): Set the `user_project_override` field on the resulting provider block. When `null`, the `user_project_override` field will be omitted from the resulting object.\n  - `vertex_ai_custom_endpoint` (`string`): Set the `vertex_ai_custom_endpoint` field on the resulting provider block. When `null`, the `vertex_ai_custom_endpoint` field will be omitted from the resulting object.\n  - `vpc_access_custom_endpoint` (`string`): Set the `vpc_access_custom_endpoint` field on the resulting provider block. When `null`, the `vpc_access_custom_endpoint` field will be omitted from the resulting object.\n  - `workflows_custom_endpoint` (`string`): Set the `workflows_custom_endpoint` field on the resulting provider block. When `null`, the `workflows_custom_endpoint` field will be omitted from the resulting object.\n  - `zone` (`string`): Set the `zone` field on the resulting provider block. When `null`, the `zone` field will be omitted from the resulting object.\n  - `batching` (`list[obj]`): Set the `batching` field on the resulting provider block. When `null`, the `batching` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.provider.batching.new](#fn-googlebatchingnew) constructor.\n  - `alias` (`string`): The provider `alias` to set for this instance of the provider block. When `null`, the `alias`\n  field will be omitted from the resulting provider block.\n  - `src` (`string`): The provider `source` to set on the resulting `required_providers` block. If `src` or `version` is\n  set and is not `null`, a `required_providers` block and entry for the provider will be injected into the document.\n  - `version` (`string`): The provider `version` to set on the resulting `required_providers` block. If `src` or\n  `version` is set and is not `null`, a `required_providers` block and entry for the provider will be injected into the\n  document.\n\n\n**Returns**:\n- A mixin object that injects the new provider (and optionally, `required_providers` block) into the root Terraform configuration.\n', args=[]),
+  '#new':: d.fn(help='\n`google.provider.new` injects a new `google` Terraform `provider`\nblock into the root module document.\n\nOptionally, this inserts the provider into the\n[required_providers](https://developer.hashicorp.com/terraform/language/providers/requirements) `terraform` sub block if\nthe `src` and/or `version` parameters are set.\n\n**Args**:\n  - `access_approval_custom_endpoint` (`string`): Set the `access_approval_custom_endpoint` field on the resulting provider block. When `null`, the `access_approval_custom_endpoint` field will be omitted from the resulting object.\n  - `access_context_manager_custom_endpoint` (`string`): Set the `access_context_manager_custom_endpoint` field on the resulting provider block. When `null`, the `access_context_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `access_token` (`string`): Set the `access_token` field on the resulting provider block. When `null`, the `access_token` field will be omitted from the resulting object.\n  - `active_directory_custom_endpoint` (`string`): Set the `active_directory_custom_endpoint` field on the resulting provider block. When `null`, the `active_directory_custom_endpoint` field will be omitted from the resulting object.\n  - `alloydb_custom_endpoint` (`string`): Set the `alloydb_custom_endpoint` field on the resulting provider block. When `null`, the `alloydb_custom_endpoint` field will be omitted from the resulting object.\n  - `apigee_custom_endpoint` (`string`): Set the `apigee_custom_endpoint` field on the resulting provider block. When `null`, the `apigee_custom_endpoint` field will be omitted from the resulting object.\n  - `apikeys_custom_endpoint` (`string`): Set the `apikeys_custom_endpoint` field on the resulting provider block. When `null`, the `apikeys_custom_endpoint` field will be omitted from the resulting object.\n  - `app_engine_custom_endpoint` (`string`): Set the `app_engine_custom_endpoint` field on the resulting provider block. When `null`, the `app_engine_custom_endpoint` field will be omitted from the resulting object.\n  - `artifact_registry_custom_endpoint` (`string`): Set the `artifact_registry_custom_endpoint` field on the resulting provider block. When `null`, the `artifact_registry_custom_endpoint` field will be omitted from the resulting object.\n  - `assured_workloads_custom_endpoint` (`string`): Set the `assured_workloads_custom_endpoint` field on the resulting provider block. When `null`, the `assured_workloads_custom_endpoint` field will be omitted from the resulting object.\n  - `beyondcorp_custom_endpoint` (`string`): Set the `beyondcorp_custom_endpoint` field on the resulting provider block. When `null`, the `beyondcorp_custom_endpoint` field will be omitted from the resulting object.\n  - `big_query_custom_endpoint` (`string`): Set the `big_query_custom_endpoint` field on the resulting provider block. When `null`, the `big_query_custom_endpoint` field will be omitted from the resulting object.\n  - `biglake_custom_endpoint` (`string`): Set the `biglake_custom_endpoint` field on the resulting provider block. When `null`, the `biglake_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_analytics_hub_custom_endpoint` (`string`): Set the `bigquery_analytics_hub_custom_endpoint` field on the resulting provider block. When `null`, the `bigquery_analytics_hub_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_connection_custom_endpoint` (`string`): Set the `bigquery_connection_custom_endpoint` field on the resulting provider block. When `null`, the `bigquery_connection_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_data_transfer_custom_endpoint` (`string`): Set the `bigquery_data_transfer_custom_endpoint` field on the resulting provider block. When `null`, the `bigquery_data_transfer_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_datapolicy_custom_endpoint` (`string`): Set the `bigquery_datapolicy_custom_endpoint` field on the resulting provider block. When `null`, the `bigquery_datapolicy_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_reservation_custom_endpoint` (`string`): Set the `bigquery_reservation_custom_endpoint` field on the resulting provider block. When `null`, the `bigquery_reservation_custom_endpoint` field will be omitted from the resulting object.\n  - `bigtable_custom_endpoint` (`string`): Set the `bigtable_custom_endpoint` field on the resulting provider block. When `null`, the `bigtable_custom_endpoint` field will be omitted from the resulting object.\n  - `billing_custom_endpoint` (`string`): Set the `billing_custom_endpoint` field on the resulting provider block. When `null`, the `billing_custom_endpoint` field will be omitted from the resulting object.\n  - `billing_project` (`string`): Set the `billing_project` field on the resulting provider block. When `null`, the `billing_project` field will be omitted from the resulting object.\n  - `binary_authorization_custom_endpoint` (`string`): Set the `binary_authorization_custom_endpoint` field on the resulting provider block. When `null`, the `binary_authorization_custom_endpoint` field will be omitted from the resulting object.\n  - `certificate_manager_custom_endpoint` (`string`): Set the `certificate_manager_custom_endpoint` field on the resulting provider block. When `null`, the `certificate_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_asset_custom_endpoint` (`string`): Set the `cloud_asset_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_asset_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_billing_custom_endpoint` (`string`): Set the `cloud_billing_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_billing_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_build_custom_endpoint` (`string`): Set the `cloud_build_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_build_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_build_worker_pool_custom_endpoint` (`string`): Set the `cloud_build_worker_pool_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_build_worker_pool_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_functions_custom_endpoint` (`string`): Set the `cloud_functions_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_functions_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_identity_custom_endpoint` (`string`): Set the `cloud_identity_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_identity_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_ids_custom_endpoint` (`string`): Set the `cloud_ids_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_ids_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_resource_manager_custom_endpoint` (`string`): Set the `cloud_resource_manager_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_resource_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_run_custom_endpoint` (`string`): Set the `cloud_run_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_run_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_run_v2_custom_endpoint` (`string`): Set the `cloud_run_v2_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_run_v2_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_scheduler_custom_endpoint` (`string`): Set the `cloud_scheduler_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_scheduler_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_tasks_custom_endpoint` (`string`): Set the `cloud_tasks_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_tasks_custom_endpoint` field will be omitted from the resulting object.\n  - `cloudbuildv2_custom_endpoint` (`string`): Set the `cloudbuildv2_custom_endpoint` field on the resulting provider block. When `null`, the `cloudbuildv2_custom_endpoint` field will be omitted from the resulting object.\n  - `clouddeploy_custom_endpoint` (`string`): Set the `clouddeploy_custom_endpoint` field on the resulting provider block. When `null`, the `clouddeploy_custom_endpoint` field will be omitted from the resulting object.\n  - `cloudfunctions2_custom_endpoint` (`string`): Set the `cloudfunctions2_custom_endpoint` field on the resulting provider block. When `null`, the `cloudfunctions2_custom_endpoint` field will be omitted from the resulting object.\n  - `composer_custom_endpoint` (`string`): Set the `composer_custom_endpoint` field on the resulting provider block. When `null`, the `composer_custom_endpoint` field will be omitted from the resulting object.\n  - `compute_custom_endpoint` (`string`): Set the `compute_custom_endpoint` field on the resulting provider block. When `null`, the `compute_custom_endpoint` field will be omitted from the resulting object.\n  - `container_analysis_custom_endpoint` (`string`): Set the `container_analysis_custom_endpoint` field on the resulting provider block. When `null`, the `container_analysis_custom_endpoint` field will be omitted from the resulting object.\n  - `container_attached_custom_endpoint` (`string`): Set the `container_attached_custom_endpoint` field on the resulting provider block. When `null`, the `container_attached_custom_endpoint` field will be omitted from the resulting object.\n  - `container_aws_custom_endpoint` (`string`): Set the `container_aws_custom_endpoint` field on the resulting provider block. When `null`, the `container_aws_custom_endpoint` field will be omitted from the resulting object.\n  - `container_azure_custom_endpoint` (`string`): Set the `container_azure_custom_endpoint` field on the resulting provider block. When `null`, the `container_azure_custom_endpoint` field will be omitted from the resulting object.\n  - `container_custom_endpoint` (`string`): Set the `container_custom_endpoint` field on the resulting provider block. When `null`, the `container_custom_endpoint` field will be omitted from the resulting object.\n  - `core_billing_custom_endpoint` (`string`): Set the `core_billing_custom_endpoint` field on the resulting provider block. When `null`, the `core_billing_custom_endpoint` field will be omitted from the resulting object.\n  - `credentials` (`string`): Set the `credentials` field on the resulting provider block. When `null`, the `credentials` field will be omitted from the resulting object.\n  - `data_catalog_custom_endpoint` (`string`): Set the `data_catalog_custom_endpoint` field on the resulting provider block. When `null`, the `data_catalog_custom_endpoint` field will be omitted from the resulting object.\n  - `data_fusion_custom_endpoint` (`string`): Set the `data_fusion_custom_endpoint` field on the resulting provider block. When `null`, the `data_fusion_custom_endpoint` field will be omitted from the resulting object.\n  - `data_loss_prevention_custom_endpoint` (`string`): Set the `data_loss_prevention_custom_endpoint` field on the resulting provider block. When `null`, the `data_loss_prevention_custom_endpoint` field will be omitted from the resulting object.\n  - `data_pipeline_custom_endpoint` (`string`): Set the `data_pipeline_custom_endpoint` field on the resulting provider block. When `null`, the `data_pipeline_custom_endpoint` field will be omitted from the resulting object.\n  - `database_migration_service_custom_endpoint` (`string`): Set the `database_migration_service_custom_endpoint` field on the resulting provider block. When `null`, the `database_migration_service_custom_endpoint` field will be omitted from the resulting object.\n  - `dataflow_custom_endpoint` (`string`): Set the `dataflow_custom_endpoint` field on the resulting provider block. When `null`, the `dataflow_custom_endpoint` field will be omitted from the resulting object.\n  - `dataplex_custom_endpoint` (`string`): Set the `dataplex_custom_endpoint` field on the resulting provider block. When `null`, the `dataplex_custom_endpoint` field will be omitted from the resulting object.\n  - `dataproc_custom_endpoint` (`string`): Set the `dataproc_custom_endpoint` field on the resulting provider block. When `null`, the `dataproc_custom_endpoint` field will be omitted from the resulting object.\n  - `dataproc_metastore_custom_endpoint` (`string`): Set the `dataproc_metastore_custom_endpoint` field on the resulting provider block. When `null`, the `dataproc_metastore_custom_endpoint` field will be omitted from the resulting object.\n  - `datastore_custom_endpoint` (`string`): Set the `datastore_custom_endpoint` field on the resulting provider block. When `null`, the `datastore_custom_endpoint` field will be omitted from the resulting object.\n  - `datastream_custom_endpoint` (`string`): Set the `datastream_custom_endpoint` field on the resulting provider block. When `null`, the `datastream_custom_endpoint` field will be omitted from the resulting object.\n  - `default_labels` (`obj`): Set the `default_labels` field on the resulting provider block. When `null`, the `default_labels` field will be omitted from the resulting object.\n  - `deployment_manager_custom_endpoint` (`string`): Set the `deployment_manager_custom_endpoint` field on the resulting provider block. When `null`, the `deployment_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `dialogflow_custom_endpoint` (`string`): Set the `dialogflow_custom_endpoint` field on the resulting provider block. When `null`, the `dialogflow_custom_endpoint` field will be omitted from the resulting object.\n  - `dialogflow_cx_custom_endpoint` (`string`): Set the `dialogflow_cx_custom_endpoint` field on the resulting provider block. When `null`, the `dialogflow_cx_custom_endpoint` field will be omitted from the resulting object.\n  - `dns_custom_endpoint` (`string`): Set the `dns_custom_endpoint` field on the resulting provider block. When `null`, the `dns_custom_endpoint` field will be omitted from the resulting object.\n  - `document_ai_custom_endpoint` (`string`): Set the `document_ai_custom_endpoint` field on the resulting provider block. When `null`, the `document_ai_custom_endpoint` field will be omitted from the resulting object.\n  - `document_ai_warehouse_custom_endpoint` (`string`): Set the `document_ai_warehouse_custom_endpoint` field on the resulting provider block. When `null`, the `document_ai_warehouse_custom_endpoint` field will be omitted from the resulting object.\n  - `edgecontainer_custom_endpoint` (`string`): Set the `edgecontainer_custom_endpoint` field on the resulting provider block. When `null`, the `edgecontainer_custom_endpoint` field will be omitted from the resulting object.\n  - `edgenetwork_custom_endpoint` (`string`): Set the `edgenetwork_custom_endpoint` field on the resulting provider block. When `null`, the `edgenetwork_custom_endpoint` field will be omitted from the resulting object.\n  - `essential_contacts_custom_endpoint` (`string`): Set the `essential_contacts_custom_endpoint` field on the resulting provider block. When `null`, the `essential_contacts_custom_endpoint` field will be omitted from the resulting object.\n  - `eventarc_custom_endpoint` (`string`): Set the `eventarc_custom_endpoint` field on the resulting provider block. When `null`, the `eventarc_custom_endpoint` field will be omitted from the resulting object.\n  - `filestore_custom_endpoint` (`string`): Set the `filestore_custom_endpoint` field on the resulting provider block. When `null`, the `filestore_custom_endpoint` field will be omitted from the resulting object.\n  - `firebaserules_custom_endpoint` (`string`): Set the `firebaserules_custom_endpoint` field on the resulting provider block. When `null`, the `firebaserules_custom_endpoint` field will be omitted from the resulting object.\n  - `firestore_custom_endpoint` (`string`): Set the `firestore_custom_endpoint` field on the resulting provider block. When `null`, the `firestore_custom_endpoint` field will be omitted from the resulting object.\n  - `gke_backup_custom_endpoint` (`string`): Set the `gke_backup_custom_endpoint` field on the resulting provider block. When `null`, the `gke_backup_custom_endpoint` field will be omitted from the resulting object.\n  - `gke_hub2_custom_endpoint` (`string`): Set the `gke_hub2_custom_endpoint` field on the resulting provider block. When `null`, the `gke_hub2_custom_endpoint` field will be omitted from the resulting object.\n  - `gke_hub_custom_endpoint` (`string`): Set the `gke_hub_custom_endpoint` field on the resulting provider block. When `null`, the `gke_hub_custom_endpoint` field will be omitted from the resulting object.\n  - `gkehub_feature_custom_endpoint` (`string`): Set the `gkehub_feature_custom_endpoint` field on the resulting provider block. When `null`, the `gkehub_feature_custom_endpoint` field will be omitted from the resulting object.\n  - `gkeonprem_custom_endpoint` (`string`): Set the `gkeonprem_custom_endpoint` field on the resulting provider block. When `null`, the `gkeonprem_custom_endpoint` field will be omitted from the resulting object.\n  - `healthcare_custom_endpoint` (`string`): Set the `healthcare_custom_endpoint` field on the resulting provider block. When `null`, the `healthcare_custom_endpoint` field will be omitted from the resulting object.\n  - `iam2_custom_endpoint` (`string`): Set the `iam2_custom_endpoint` field on the resulting provider block. When `null`, the `iam2_custom_endpoint` field will be omitted from the resulting object.\n  - `iam_beta_custom_endpoint` (`string`): Set the `iam_beta_custom_endpoint` field on the resulting provider block. When `null`, the `iam_beta_custom_endpoint` field will be omitted from the resulting object.\n  - `iam_credentials_custom_endpoint` (`string`): Set the `iam_credentials_custom_endpoint` field on the resulting provider block. When `null`, the `iam_credentials_custom_endpoint` field will be omitted from the resulting object.\n  - `iam_custom_endpoint` (`string`): Set the `iam_custom_endpoint` field on the resulting provider block. When `null`, the `iam_custom_endpoint` field will be omitted from the resulting object.\n  - `iam_workforce_pool_custom_endpoint` (`string`): Set the `iam_workforce_pool_custom_endpoint` field on the resulting provider block. When `null`, the `iam_workforce_pool_custom_endpoint` field will be omitted from the resulting object.\n  - `iap_custom_endpoint` (`string`): Set the `iap_custom_endpoint` field on the resulting provider block. When `null`, the `iap_custom_endpoint` field will be omitted from the resulting object.\n  - `identity_platform_custom_endpoint` (`string`): Set the `identity_platform_custom_endpoint` field on the resulting provider block. When `null`, the `identity_platform_custom_endpoint` field will be omitted from the resulting object.\n  - `impersonate_service_account` (`string`): Set the `impersonate_service_account` field on the resulting provider block. When `null`, the `impersonate_service_account` field will be omitted from the resulting object.\n  - `impersonate_service_account_delegates` (`list`): Set the `impersonate_service_account_delegates` field on the resulting provider block. When `null`, the `impersonate_service_account_delegates` field will be omitted from the resulting object.\n  - `kms_custom_endpoint` (`string`): Set the `kms_custom_endpoint` field on the resulting provider block. When `null`, the `kms_custom_endpoint` field will be omitted from the resulting object.\n  - `logging_custom_endpoint` (`string`): Set the `logging_custom_endpoint` field on the resulting provider block. When `null`, the `logging_custom_endpoint` field will be omitted from the resulting object.\n  - `looker_custom_endpoint` (`string`): Set the `looker_custom_endpoint` field on the resulting provider block. When `null`, the `looker_custom_endpoint` field will be omitted from the resulting object.\n  - `memcache_custom_endpoint` (`string`): Set the `memcache_custom_endpoint` field on the resulting provider block. When `null`, the `memcache_custom_endpoint` field will be omitted from the resulting object.\n  - `ml_engine_custom_endpoint` (`string`): Set the `ml_engine_custom_endpoint` field on the resulting provider block. When `null`, the `ml_engine_custom_endpoint` field will be omitted from the resulting object.\n  - `monitoring_custom_endpoint` (`string`): Set the `monitoring_custom_endpoint` field on the resulting provider block. When `null`, the `monitoring_custom_endpoint` field will be omitted from the resulting object.\n  - `network_connectivity_custom_endpoint` (`string`): Set the `network_connectivity_custom_endpoint` field on the resulting provider block. When `null`, the `network_connectivity_custom_endpoint` field will be omitted from the resulting object.\n  - `network_management_custom_endpoint` (`string`): Set the `network_management_custom_endpoint` field on the resulting provider block. When `null`, the `network_management_custom_endpoint` field will be omitted from the resulting object.\n  - `network_security_custom_endpoint` (`string`): Set the `network_security_custom_endpoint` field on the resulting provider block. When `null`, the `network_security_custom_endpoint` field will be omitted from the resulting object.\n  - `network_services_custom_endpoint` (`string`): Set the `network_services_custom_endpoint` field on the resulting provider block. When `null`, the `network_services_custom_endpoint` field will be omitted from the resulting object.\n  - `notebooks_custom_endpoint` (`string`): Set the `notebooks_custom_endpoint` field on the resulting provider block. When `null`, the `notebooks_custom_endpoint` field will be omitted from the resulting object.\n  - `org_policy_custom_endpoint` (`string`): Set the `org_policy_custom_endpoint` field on the resulting provider block. When `null`, the `org_policy_custom_endpoint` field will be omitted from the resulting object.\n  - `os_config_custom_endpoint` (`string`): Set the `os_config_custom_endpoint` field on the resulting provider block. When `null`, the `os_config_custom_endpoint` field will be omitted from the resulting object.\n  - `os_login_custom_endpoint` (`string`): Set the `os_login_custom_endpoint` field on the resulting provider block. When `null`, the `os_login_custom_endpoint` field will be omitted from the resulting object.\n  - `privateca_custom_endpoint` (`string`): Set the `privateca_custom_endpoint` field on the resulting provider block. When `null`, the `privateca_custom_endpoint` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting provider block. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_ca_custom_endpoint` (`string`): Set the `public_ca_custom_endpoint` field on the resulting provider block. When `null`, the `public_ca_custom_endpoint` field will be omitted from the resulting object.\n  - `pubsub_custom_endpoint` (`string`): Set the `pubsub_custom_endpoint` field on the resulting provider block. When `null`, the `pubsub_custom_endpoint` field will be omitted from the resulting object.\n  - `pubsub_lite_custom_endpoint` (`string`): Set the `pubsub_lite_custom_endpoint` field on the resulting provider block. When `null`, the `pubsub_lite_custom_endpoint` field will be omitted from the resulting object.\n  - `recaptcha_enterprise_custom_endpoint` (`string`): Set the `recaptcha_enterprise_custom_endpoint` field on the resulting provider block. When `null`, the `recaptcha_enterprise_custom_endpoint` field will be omitted from the resulting object.\n  - `redis_custom_endpoint` (`string`): Set the `redis_custom_endpoint` field on the resulting provider block. When `null`, the `redis_custom_endpoint` field will be omitted from the resulting object.\n  - `region` (`string`): Set the `region` field on the resulting provider block. When `null`, the `region` field will be omitted from the resulting object.\n  - `request_reason` (`string`): Set the `request_reason` field on the resulting provider block. When `null`, the `request_reason` field will be omitted from the resulting object.\n  - `request_timeout` (`string`): Set the `request_timeout` field on the resulting provider block. When `null`, the `request_timeout` field will be omitted from the resulting object.\n  - `resource_manager_custom_endpoint` (`string`): Set the `resource_manager_custom_endpoint` field on the resulting provider block. When `null`, the `resource_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `resource_manager_v3_custom_endpoint` (`string`): Set the `resource_manager_v3_custom_endpoint` field on the resulting provider block. When `null`, the `resource_manager_v3_custom_endpoint` field will be omitted from the resulting object.\n  - `scopes` (`list`): Set the `scopes` field on the resulting provider block. When `null`, the `scopes` field will be omitted from the resulting object.\n  - `secret_manager_custom_endpoint` (`string`): Set the `secret_manager_custom_endpoint` field on the resulting provider block. When `null`, the `secret_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `security_center_custom_endpoint` (`string`): Set the `security_center_custom_endpoint` field on the resulting provider block. When `null`, the `security_center_custom_endpoint` field will be omitted from the resulting object.\n  - `service_management_custom_endpoint` (`string`): Set the `service_management_custom_endpoint` field on the resulting provider block. When `null`, the `service_management_custom_endpoint` field will be omitted from the resulting object.\n  - `service_networking_custom_endpoint` (`string`): Set the `service_networking_custom_endpoint` field on the resulting provider block. When `null`, the `service_networking_custom_endpoint` field will be omitted from the resulting object.\n  - `service_usage_custom_endpoint` (`string`): Set the `service_usage_custom_endpoint` field on the resulting provider block. When `null`, the `service_usage_custom_endpoint` field will be omitted from the resulting object.\n  - `source_repo_custom_endpoint` (`string`): Set the `source_repo_custom_endpoint` field on the resulting provider block. When `null`, the `source_repo_custom_endpoint` field will be omitted from the resulting object.\n  - `spanner_custom_endpoint` (`string`): Set the `spanner_custom_endpoint` field on the resulting provider block. When `null`, the `spanner_custom_endpoint` field will be omitted from the resulting object.\n  - `sql_custom_endpoint` (`string`): Set the `sql_custom_endpoint` field on the resulting provider block. When `null`, the `sql_custom_endpoint` field will be omitted from the resulting object.\n  - `storage_custom_endpoint` (`string`): Set the `storage_custom_endpoint` field on the resulting provider block. When `null`, the `storage_custom_endpoint` field will be omitted from the resulting object.\n  - `storage_insights_custom_endpoint` (`string`): Set the `storage_insights_custom_endpoint` field on the resulting provider block. When `null`, the `storage_insights_custom_endpoint` field will be omitted from the resulting object.\n  - `storage_transfer_custom_endpoint` (`string`): Set the `storage_transfer_custom_endpoint` field on the resulting provider block. When `null`, the `storage_transfer_custom_endpoint` field will be omitted from the resulting object.\n  - `tags_custom_endpoint` (`string`): Set the `tags_custom_endpoint` field on the resulting provider block. When `null`, the `tags_custom_endpoint` field will be omitted from the resulting object.\n  - `tags_location_custom_endpoint` (`string`): Set the `tags_location_custom_endpoint` field on the resulting provider block. When `null`, the `tags_location_custom_endpoint` field will be omitted from the resulting object.\n  - `tpu_custom_endpoint` (`string`): Set the `tpu_custom_endpoint` field on the resulting provider block. When `null`, the `tpu_custom_endpoint` field will be omitted from the resulting object.\n  - `universe_domain` (`string`): Set the `universe_domain` field on the resulting provider block. When `null`, the `universe_domain` field will be omitted from the resulting object.\n  - `user_project_override` (`bool`): Set the `user_project_override` field on the resulting provider block. When `null`, the `user_project_override` field will be omitted from the resulting object.\n  - `vertex_ai_custom_endpoint` (`string`): Set the `vertex_ai_custom_endpoint` field on the resulting provider block. When `null`, the `vertex_ai_custom_endpoint` field will be omitted from the resulting object.\n  - `vpc_access_custom_endpoint` (`string`): Set the `vpc_access_custom_endpoint` field on the resulting provider block. When `null`, the `vpc_access_custom_endpoint` field will be omitted from the resulting object.\n  - `workflows_custom_endpoint` (`string`): Set the `workflows_custom_endpoint` field on the resulting provider block. When `null`, the `workflows_custom_endpoint` field will be omitted from the resulting object.\n  - `zone` (`string`): Set the `zone` field on the resulting provider block. When `null`, the `zone` field will be omitted from the resulting object.\n  - `batching` (`list[obj]`): Set the `batching` field on the resulting provider block. When `null`, the `batching` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.provider.batching.new](#fn-googlebatchingnew) constructor.\n  - `alias` (`string`): The provider `alias` to set for this instance of the provider block. When `null`, the `alias`\n  field will be omitted from the resulting provider block.\n  - `src` (`string`): The provider `source` to set on the resulting `required_providers` block. If `src` or `version` is\n  set and is not `null`, a `required_providers` block and entry for the provider will be injected into the document.\n  - `version` (`string`): The provider `version` to set on the resulting `required_providers` block. If `src` or\n  `version` is set and is not `null`, a `required_providers` block and entry for the provider will be injected into the\n  document.\n\n\n**Returns**:\n- A mixin object that injects the new provider (and optionally, `required_providers` block) into the root Terraform configuration.\n', args=[]),
   new(
     access_approval_custom_endpoint=null,
     access_context_manager_custom_endpoint=null,
@@ -35,7 +35,6 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     cloud_functions_custom_endpoint=null,
     cloud_identity_custom_endpoint=null,
     cloud_ids_custom_endpoint=null,
-    cloud_iot_custom_endpoint=null,
     cloud_resource_manager_custom_endpoint=null,
     cloud_run_custom_endpoint=null,
     cloud_run_v2_custom_endpoint=null,
@@ -64,23 +63,25 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     dataproc_metastore_custom_endpoint=null,
     datastore_custom_endpoint=null,
     datastream_custom_endpoint=null,
+    default_labels=null,
     deployment_manager_custom_endpoint=null,
     dialogflow_custom_endpoint=null,
     dialogflow_cx_custom_endpoint=null,
     dns_custom_endpoint=null,
     document_ai_custom_endpoint=null,
     document_ai_warehouse_custom_endpoint=null,
+    edgecontainer_custom_endpoint=null,
     edgenetwork_custom_endpoint=null,
     essential_contacts_custom_endpoint=null,
     eventarc_custom_endpoint=null,
     filestore_custom_endpoint=null,
     firebaserules_custom_endpoint=null,
     firestore_custom_endpoint=null,
-    game_services_custom_endpoint=null,
     gke_backup_custom_endpoint=null,
     gke_hub2_custom_endpoint=null,
     gke_hub_custom_endpoint=null,
     gkehub_feature_custom_endpoint=null,
+    gkeonprem_custom_endpoint=null,
     healthcare_custom_endpoint=null,
     iam2_custom_endpoint=null,
     iam_beta_custom_endpoint=null,
@@ -132,6 +133,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     tags_custom_endpoint=null,
     tags_location_custom_endpoint=null,
     tpu_custom_endpoint=null,
+    universe_domain=null,
     user_project_override=null,
     vertex_ai_custom_endpoint=null,
     vpc_access_custom_endpoint=null,
@@ -177,7 +179,6 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       cloud_functions_custom_endpoint=cloud_functions_custom_endpoint,
       cloud_identity_custom_endpoint=cloud_identity_custom_endpoint,
       cloud_ids_custom_endpoint=cloud_ids_custom_endpoint,
-      cloud_iot_custom_endpoint=cloud_iot_custom_endpoint,
       cloud_resource_manager_custom_endpoint=cloud_resource_manager_custom_endpoint,
       cloud_run_custom_endpoint=cloud_run_custom_endpoint,
       cloud_run_v2_custom_endpoint=cloud_run_v2_custom_endpoint,
@@ -206,23 +207,25 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       dataproc_metastore_custom_endpoint=dataproc_metastore_custom_endpoint,
       datastore_custom_endpoint=datastore_custom_endpoint,
       datastream_custom_endpoint=datastream_custom_endpoint,
+      default_labels=default_labels,
       deployment_manager_custom_endpoint=deployment_manager_custom_endpoint,
       dialogflow_custom_endpoint=dialogflow_custom_endpoint,
       dialogflow_cx_custom_endpoint=dialogflow_cx_custom_endpoint,
       dns_custom_endpoint=dns_custom_endpoint,
       document_ai_custom_endpoint=document_ai_custom_endpoint,
       document_ai_warehouse_custom_endpoint=document_ai_warehouse_custom_endpoint,
+      edgecontainer_custom_endpoint=edgecontainer_custom_endpoint,
       edgenetwork_custom_endpoint=edgenetwork_custom_endpoint,
       essential_contacts_custom_endpoint=essential_contacts_custom_endpoint,
       eventarc_custom_endpoint=eventarc_custom_endpoint,
       filestore_custom_endpoint=filestore_custom_endpoint,
       firebaserules_custom_endpoint=firebaserules_custom_endpoint,
       firestore_custom_endpoint=firestore_custom_endpoint,
-      game_services_custom_endpoint=game_services_custom_endpoint,
       gke_backup_custom_endpoint=gke_backup_custom_endpoint,
       gke_hub2_custom_endpoint=gke_hub2_custom_endpoint,
       gke_hub_custom_endpoint=gke_hub_custom_endpoint,
       gkehub_feature_custom_endpoint=gkehub_feature_custom_endpoint,
+      gkeonprem_custom_endpoint=gkeonprem_custom_endpoint,
       healthcare_custom_endpoint=healthcare_custom_endpoint,
       iam2_custom_endpoint=iam2_custom_endpoint,
       iam_beta_custom_endpoint=iam_beta_custom_endpoint,
@@ -274,6 +277,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       tags_custom_endpoint=tags_custom_endpoint,
       tags_location_custom_endpoint=tags_location_custom_endpoint,
       tpu_custom_endpoint=tpu_custom_endpoint,
+      universe_domain=universe_domain,
       user_project_override=user_project_override,
       vertex_ai_custom_endpoint=vertex_ai_custom_endpoint,
       vpc_access_custom_endpoint=vpc_access_custom_endpoint,
@@ -281,7 +285,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       zone=zone
     )
   ),
-  '#newAttrs':: d.fn(help='\n`google.provider.` constructs a new object with attributes and blocks configured for the `google`\nTerraform `provider`.\n\nUnlike [google.provider.new](#fn-googlenew), this function will not inject the `provider`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withProvider](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withprovider) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `access_approval_custom_endpoint` (`string`): Set the `access_approval_custom_endpoint` field on the resulting object. When `null`, the `access_approval_custom_endpoint` field will be omitted from the resulting object.\n  - `access_context_manager_custom_endpoint` (`string`): Set the `access_context_manager_custom_endpoint` field on the resulting object. When `null`, the `access_context_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `access_token` (`string`): Set the `access_token` field on the resulting object. When `null`, the `access_token` field will be omitted from the resulting object.\n  - `active_directory_custom_endpoint` (`string`): Set the `active_directory_custom_endpoint` field on the resulting object. When `null`, the `active_directory_custom_endpoint` field will be omitted from the resulting object.\n  - `alloydb_custom_endpoint` (`string`): Set the `alloydb_custom_endpoint` field on the resulting object. When `null`, the `alloydb_custom_endpoint` field will be omitted from the resulting object.\n  - `apigee_custom_endpoint` (`string`): Set the `apigee_custom_endpoint` field on the resulting object. When `null`, the `apigee_custom_endpoint` field will be omitted from the resulting object.\n  - `apikeys_custom_endpoint` (`string`): Set the `apikeys_custom_endpoint` field on the resulting object. When `null`, the `apikeys_custom_endpoint` field will be omitted from the resulting object.\n  - `app_engine_custom_endpoint` (`string`): Set the `app_engine_custom_endpoint` field on the resulting object. When `null`, the `app_engine_custom_endpoint` field will be omitted from the resulting object.\n  - `artifact_registry_custom_endpoint` (`string`): Set the `artifact_registry_custom_endpoint` field on the resulting object. When `null`, the `artifact_registry_custom_endpoint` field will be omitted from the resulting object.\n  - `assured_workloads_custom_endpoint` (`string`): Set the `assured_workloads_custom_endpoint` field on the resulting object. When `null`, the `assured_workloads_custom_endpoint` field will be omitted from the resulting object.\n  - `beyondcorp_custom_endpoint` (`string`): Set the `beyondcorp_custom_endpoint` field on the resulting object. When `null`, the `beyondcorp_custom_endpoint` field will be omitted from the resulting object.\n  - `big_query_custom_endpoint` (`string`): Set the `big_query_custom_endpoint` field on the resulting object. When `null`, the `big_query_custom_endpoint` field will be omitted from the resulting object.\n  - `biglake_custom_endpoint` (`string`): Set the `biglake_custom_endpoint` field on the resulting object. When `null`, the `biglake_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_analytics_hub_custom_endpoint` (`string`): Set the `bigquery_analytics_hub_custom_endpoint` field on the resulting object. When `null`, the `bigquery_analytics_hub_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_connection_custom_endpoint` (`string`): Set the `bigquery_connection_custom_endpoint` field on the resulting object. When `null`, the `bigquery_connection_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_data_transfer_custom_endpoint` (`string`): Set the `bigquery_data_transfer_custom_endpoint` field on the resulting object. When `null`, the `bigquery_data_transfer_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_datapolicy_custom_endpoint` (`string`): Set the `bigquery_datapolicy_custom_endpoint` field on the resulting object. When `null`, the `bigquery_datapolicy_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_reservation_custom_endpoint` (`string`): Set the `bigquery_reservation_custom_endpoint` field on the resulting object. When `null`, the `bigquery_reservation_custom_endpoint` field will be omitted from the resulting object.\n  - `bigtable_custom_endpoint` (`string`): Set the `bigtable_custom_endpoint` field on the resulting object. When `null`, the `bigtable_custom_endpoint` field will be omitted from the resulting object.\n  - `billing_custom_endpoint` (`string`): Set the `billing_custom_endpoint` field on the resulting object. When `null`, the `billing_custom_endpoint` field will be omitted from the resulting object.\n  - `billing_project` (`string`): Set the `billing_project` field on the resulting object. When `null`, the `billing_project` field will be omitted from the resulting object.\n  - `binary_authorization_custom_endpoint` (`string`): Set the `binary_authorization_custom_endpoint` field on the resulting object. When `null`, the `binary_authorization_custom_endpoint` field will be omitted from the resulting object.\n  - `certificate_manager_custom_endpoint` (`string`): Set the `certificate_manager_custom_endpoint` field on the resulting object. When `null`, the `certificate_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_asset_custom_endpoint` (`string`): Set the `cloud_asset_custom_endpoint` field on the resulting object. When `null`, the `cloud_asset_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_billing_custom_endpoint` (`string`): Set the `cloud_billing_custom_endpoint` field on the resulting object. When `null`, the `cloud_billing_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_build_custom_endpoint` (`string`): Set the `cloud_build_custom_endpoint` field on the resulting object. When `null`, the `cloud_build_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_build_worker_pool_custom_endpoint` (`string`): Set the `cloud_build_worker_pool_custom_endpoint` field on the resulting object. When `null`, the `cloud_build_worker_pool_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_functions_custom_endpoint` (`string`): Set the `cloud_functions_custom_endpoint` field on the resulting object. When `null`, the `cloud_functions_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_identity_custom_endpoint` (`string`): Set the `cloud_identity_custom_endpoint` field on the resulting object. When `null`, the `cloud_identity_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_ids_custom_endpoint` (`string`): Set the `cloud_ids_custom_endpoint` field on the resulting object. When `null`, the `cloud_ids_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_iot_custom_endpoint` (`string`): Set the `cloud_iot_custom_endpoint` field on the resulting object. When `null`, the `cloud_iot_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_resource_manager_custom_endpoint` (`string`): Set the `cloud_resource_manager_custom_endpoint` field on the resulting object. When `null`, the `cloud_resource_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_run_custom_endpoint` (`string`): Set the `cloud_run_custom_endpoint` field on the resulting object. When `null`, the `cloud_run_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_run_v2_custom_endpoint` (`string`): Set the `cloud_run_v2_custom_endpoint` field on the resulting object. When `null`, the `cloud_run_v2_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_scheduler_custom_endpoint` (`string`): Set the `cloud_scheduler_custom_endpoint` field on the resulting object. When `null`, the `cloud_scheduler_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_tasks_custom_endpoint` (`string`): Set the `cloud_tasks_custom_endpoint` field on the resulting object. When `null`, the `cloud_tasks_custom_endpoint` field will be omitted from the resulting object.\n  - `cloudbuildv2_custom_endpoint` (`string`): Set the `cloudbuildv2_custom_endpoint` field on the resulting object. When `null`, the `cloudbuildv2_custom_endpoint` field will be omitted from the resulting object.\n  - `clouddeploy_custom_endpoint` (`string`): Set the `clouddeploy_custom_endpoint` field on the resulting object. When `null`, the `clouddeploy_custom_endpoint` field will be omitted from the resulting object.\n  - `cloudfunctions2_custom_endpoint` (`string`): Set the `cloudfunctions2_custom_endpoint` field on the resulting object. When `null`, the `cloudfunctions2_custom_endpoint` field will be omitted from the resulting object.\n  - `composer_custom_endpoint` (`string`): Set the `composer_custom_endpoint` field on the resulting object. When `null`, the `composer_custom_endpoint` field will be omitted from the resulting object.\n  - `compute_custom_endpoint` (`string`): Set the `compute_custom_endpoint` field on the resulting object. When `null`, the `compute_custom_endpoint` field will be omitted from the resulting object.\n  - `container_analysis_custom_endpoint` (`string`): Set the `container_analysis_custom_endpoint` field on the resulting object. When `null`, the `container_analysis_custom_endpoint` field will be omitted from the resulting object.\n  - `container_attached_custom_endpoint` (`string`): Set the `container_attached_custom_endpoint` field on the resulting object. When `null`, the `container_attached_custom_endpoint` field will be omitted from the resulting object.\n  - `container_aws_custom_endpoint` (`string`): Set the `container_aws_custom_endpoint` field on the resulting object. When `null`, the `container_aws_custom_endpoint` field will be omitted from the resulting object.\n  - `container_azure_custom_endpoint` (`string`): Set the `container_azure_custom_endpoint` field on the resulting object. When `null`, the `container_azure_custom_endpoint` field will be omitted from the resulting object.\n  - `container_custom_endpoint` (`string`): Set the `container_custom_endpoint` field on the resulting object. When `null`, the `container_custom_endpoint` field will be omitted from the resulting object.\n  - `core_billing_custom_endpoint` (`string`): Set the `core_billing_custom_endpoint` field on the resulting object. When `null`, the `core_billing_custom_endpoint` field will be omitted from the resulting object.\n  - `credentials` (`string`): Set the `credentials` field on the resulting object. When `null`, the `credentials` field will be omitted from the resulting object.\n  - `data_catalog_custom_endpoint` (`string`): Set the `data_catalog_custom_endpoint` field on the resulting object. When `null`, the `data_catalog_custom_endpoint` field will be omitted from the resulting object.\n  - `data_fusion_custom_endpoint` (`string`): Set the `data_fusion_custom_endpoint` field on the resulting object. When `null`, the `data_fusion_custom_endpoint` field will be omitted from the resulting object.\n  - `data_loss_prevention_custom_endpoint` (`string`): Set the `data_loss_prevention_custom_endpoint` field on the resulting object. When `null`, the `data_loss_prevention_custom_endpoint` field will be omitted from the resulting object.\n  - `data_pipeline_custom_endpoint` (`string`): Set the `data_pipeline_custom_endpoint` field on the resulting object. When `null`, the `data_pipeline_custom_endpoint` field will be omitted from the resulting object.\n  - `database_migration_service_custom_endpoint` (`string`): Set the `database_migration_service_custom_endpoint` field on the resulting object. When `null`, the `database_migration_service_custom_endpoint` field will be omitted from the resulting object.\n  - `dataflow_custom_endpoint` (`string`): Set the `dataflow_custom_endpoint` field on the resulting object. When `null`, the `dataflow_custom_endpoint` field will be omitted from the resulting object.\n  - `dataplex_custom_endpoint` (`string`): Set the `dataplex_custom_endpoint` field on the resulting object. When `null`, the `dataplex_custom_endpoint` field will be omitted from the resulting object.\n  - `dataproc_custom_endpoint` (`string`): Set the `dataproc_custom_endpoint` field on the resulting object. When `null`, the `dataproc_custom_endpoint` field will be omitted from the resulting object.\n  - `dataproc_metastore_custom_endpoint` (`string`): Set the `dataproc_metastore_custom_endpoint` field on the resulting object. When `null`, the `dataproc_metastore_custom_endpoint` field will be omitted from the resulting object.\n  - `datastore_custom_endpoint` (`string`): Set the `datastore_custom_endpoint` field on the resulting object. When `null`, the `datastore_custom_endpoint` field will be omitted from the resulting object.\n  - `datastream_custom_endpoint` (`string`): Set the `datastream_custom_endpoint` field on the resulting object. When `null`, the `datastream_custom_endpoint` field will be omitted from the resulting object.\n  - `deployment_manager_custom_endpoint` (`string`): Set the `deployment_manager_custom_endpoint` field on the resulting object. When `null`, the `deployment_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `dialogflow_custom_endpoint` (`string`): Set the `dialogflow_custom_endpoint` field on the resulting object. When `null`, the `dialogflow_custom_endpoint` field will be omitted from the resulting object.\n  - `dialogflow_cx_custom_endpoint` (`string`): Set the `dialogflow_cx_custom_endpoint` field on the resulting object. When `null`, the `dialogflow_cx_custom_endpoint` field will be omitted from the resulting object.\n  - `dns_custom_endpoint` (`string`): Set the `dns_custom_endpoint` field on the resulting object. When `null`, the `dns_custom_endpoint` field will be omitted from the resulting object.\n  - `document_ai_custom_endpoint` (`string`): Set the `document_ai_custom_endpoint` field on the resulting object. When `null`, the `document_ai_custom_endpoint` field will be omitted from the resulting object.\n  - `document_ai_warehouse_custom_endpoint` (`string`): Set the `document_ai_warehouse_custom_endpoint` field on the resulting object. When `null`, the `document_ai_warehouse_custom_endpoint` field will be omitted from the resulting object.\n  - `edgenetwork_custom_endpoint` (`string`): Set the `edgenetwork_custom_endpoint` field on the resulting object. When `null`, the `edgenetwork_custom_endpoint` field will be omitted from the resulting object.\n  - `essential_contacts_custom_endpoint` (`string`): Set the `essential_contacts_custom_endpoint` field on the resulting object. When `null`, the `essential_contacts_custom_endpoint` field will be omitted from the resulting object.\n  - `eventarc_custom_endpoint` (`string`): Set the `eventarc_custom_endpoint` field on the resulting object. When `null`, the `eventarc_custom_endpoint` field will be omitted from the resulting object.\n  - `filestore_custom_endpoint` (`string`): Set the `filestore_custom_endpoint` field on the resulting object. When `null`, the `filestore_custom_endpoint` field will be omitted from the resulting object.\n  - `firebaserules_custom_endpoint` (`string`): Set the `firebaserules_custom_endpoint` field on the resulting object. When `null`, the `firebaserules_custom_endpoint` field will be omitted from the resulting object.\n  - `firestore_custom_endpoint` (`string`): Set the `firestore_custom_endpoint` field on the resulting object. When `null`, the `firestore_custom_endpoint` field will be omitted from the resulting object.\n  - `game_services_custom_endpoint` (`string`): Set the `game_services_custom_endpoint` field on the resulting object. When `null`, the `game_services_custom_endpoint` field will be omitted from the resulting object.\n  - `gke_backup_custom_endpoint` (`string`): Set the `gke_backup_custom_endpoint` field on the resulting object. When `null`, the `gke_backup_custom_endpoint` field will be omitted from the resulting object.\n  - `gke_hub2_custom_endpoint` (`string`): Set the `gke_hub2_custom_endpoint` field on the resulting object. When `null`, the `gke_hub2_custom_endpoint` field will be omitted from the resulting object.\n  - `gke_hub_custom_endpoint` (`string`): Set the `gke_hub_custom_endpoint` field on the resulting object. When `null`, the `gke_hub_custom_endpoint` field will be omitted from the resulting object.\n  - `gkehub_feature_custom_endpoint` (`string`): Set the `gkehub_feature_custom_endpoint` field on the resulting object. When `null`, the `gkehub_feature_custom_endpoint` field will be omitted from the resulting object.\n  - `healthcare_custom_endpoint` (`string`): Set the `healthcare_custom_endpoint` field on the resulting object. When `null`, the `healthcare_custom_endpoint` field will be omitted from the resulting object.\n  - `iam2_custom_endpoint` (`string`): Set the `iam2_custom_endpoint` field on the resulting object. When `null`, the `iam2_custom_endpoint` field will be omitted from the resulting object.\n  - `iam_beta_custom_endpoint` (`string`): Set the `iam_beta_custom_endpoint` field on the resulting object. When `null`, the `iam_beta_custom_endpoint` field will be omitted from the resulting object.\n  - `iam_credentials_custom_endpoint` (`string`): Set the `iam_credentials_custom_endpoint` field on the resulting object. When `null`, the `iam_credentials_custom_endpoint` field will be omitted from the resulting object.\n  - `iam_custom_endpoint` (`string`): Set the `iam_custom_endpoint` field on the resulting object. When `null`, the `iam_custom_endpoint` field will be omitted from the resulting object.\n  - `iam_workforce_pool_custom_endpoint` (`string`): Set the `iam_workforce_pool_custom_endpoint` field on the resulting object. When `null`, the `iam_workforce_pool_custom_endpoint` field will be omitted from the resulting object.\n  - `iap_custom_endpoint` (`string`): Set the `iap_custom_endpoint` field on the resulting object. When `null`, the `iap_custom_endpoint` field will be omitted from the resulting object.\n  - `identity_platform_custom_endpoint` (`string`): Set the `identity_platform_custom_endpoint` field on the resulting object. When `null`, the `identity_platform_custom_endpoint` field will be omitted from the resulting object.\n  - `impersonate_service_account` (`string`): Set the `impersonate_service_account` field on the resulting object. When `null`, the `impersonate_service_account` field will be omitted from the resulting object.\n  - `impersonate_service_account_delegates` (`list`): Set the `impersonate_service_account_delegates` field on the resulting object. When `null`, the `impersonate_service_account_delegates` field will be omitted from the resulting object.\n  - `kms_custom_endpoint` (`string`): Set the `kms_custom_endpoint` field on the resulting object. When `null`, the `kms_custom_endpoint` field will be omitted from the resulting object.\n  - `logging_custom_endpoint` (`string`): Set the `logging_custom_endpoint` field on the resulting object. When `null`, the `logging_custom_endpoint` field will be omitted from the resulting object.\n  - `looker_custom_endpoint` (`string`): Set the `looker_custom_endpoint` field on the resulting object. When `null`, the `looker_custom_endpoint` field will be omitted from the resulting object.\n  - `memcache_custom_endpoint` (`string`): Set the `memcache_custom_endpoint` field on the resulting object. When `null`, the `memcache_custom_endpoint` field will be omitted from the resulting object.\n  - `ml_engine_custom_endpoint` (`string`): Set the `ml_engine_custom_endpoint` field on the resulting object. When `null`, the `ml_engine_custom_endpoint` field will be omitted from the resulting object.\n  - `monitoring_custom_endpoint` (`string`): Set the `monitoring_custom_endpoint` field on the resulting object. When `null`, the `monitoring_custom_endpoint` field will be omitted from the resulting object.\n  - `network_connectivity_custom_endpoint` (`string`): Set the `network_connectivity_custom_endpoint` field on the resulting object. When `null`, the `network_connectivity_custom_endpoint` field will be omitted from the resulting object.\n  - `network_management_custom_endpoint` (`string`): Set the `network_management_custom_endpoint` field on the resulting object. When `null`, the `network_management_custom_endpoint` field will be omitted from the resulting object.\n  - `network_security_custom_endpoint` (`string`): Set the `network_security_custom_endpoint` field on the resulting object. When `null`, the `network_security_custom_endpoint` field will be omitted from the resulting object.\n  - `network_services_custom_endpoint` (`string`): Set the `network_services_custom_endpoint` field on the resulting object. When `null`, the `network_services_custom_endpoint` field will be omitted from the resulting object.\n  - `notebooks_custom_endpoint` (`string`): Set the `notebooks_custom_endpoint` field on the resulting object. When `null`, the `notebooks_custom_endpoint` field will be omitted from the resulting object.\n  - `org_policy_custom_endpoint` (`string`): Set the `org_policy_custom_endpoint` field on the resulting object. When `null`, the `org_policy_custom_endpoint` field will be omitted from the resulting object.\n  - `os_config_custom_endpoint` (`string`): Set the `os_config_custom_endpoint` field on the resulting object. When `null`, the `os_config_custom_endpoint` field will be omitted from the resulting object.\n  - `os_login_custom_endpoint` (`string`): Set the `os_login_custom_endpoint` field on the resulting object. When `null`, the `os_login_custom_endpoint` field will be omitted from the resulting object.\n  - `privateca_custom_endpoint` (`string`): Set the `privateca_custom_endpoint` field on the resulting object. When `null`, the `privateca_custom_endpoint` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_ca_custom_endpoint` (`string`): Set the `public_ca_custom_endpoint` field on the resulting object. When `null`, the `public_ca_custom_endpoint` field will be omitted from the resulting object.\n  - `pubsub_custom_endpoint` (`string`): Set the `pubsub_custom_endpoint` field on the resulting object. When `null`, the `pubsub_custom_endpoint` field will be omitted from the resulting object.\n  - `pubsub_lite_custom_endpoint` (`string`): Set the `pubsub_lite_custom_endpoint` field on the resulting object. When `null`, the `pubsub_lite_custom_endpoint` field will be omitted from the resulting object.\n  - `recaptcha_enterprise_custom_endpoint` (`string`): Set the `recaptcha_enterprise_custom_endpoint` field on the resulting object. When `null`, the `recaptcha_enterprise_custom_endpoint` field will be omitted from the resulting object.\n  - `redis_custom_endpoint` (`string`): Set the `redis_custom_endpoint` field on the resulting object. When `null`, the `redis_custom_endpoint` field will be omitted from the resulting object.\n  - `region` (`string`): Set the `region` field on the resulting object. When `null`, the `region` field will be omitted from the resulting object.\n  - `request_reason` (`string`): Set the `request_reason` field on the resulting object. When `null`, the `request_reason` field will be omitted from the resulting object.\n  - `request_timeout` (`string`): Set the `request_timeout` field on the resulting object. When `null`, the `request_timeout` field will be omitted from the resulting object.\n  - `resource_manager_custom_endpoint` (`string`): Set the `resource_manager_custom_endpoint` field on the resulting object. When `null`, the `resource_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `resource_manager_v3_custom_endpoint` (`string`): Set the `resource_manager_v3_custom_endpoint` field on the resulting object. When `null`, the `resource_manager_v3_custom_endpoint` field will be omitted from the resulting object.\n  - `scopes` (`list`): Set the `scopes` field on the resulting object. When `null`, the `scopes` field will be omitted from the resulting object.\n  - `secret_manager_custom_endpoint` (`string`): Set the `secret_manager_custom_endpoint` field on the resulting object. When `null`, the `secret_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `security_center_custom_endpoint` (`string`): Set the `security_center_custom_endpoint` field on the resulting object. When `null`, the `security_center_custom_endpoint` field will be omitted from the resulting object.\n  - `service_management_custom_endpoint` (`string`): Set the `service_management_custom_endpoint` field on the resulting object. When `null`, the `service_management_custom_endpoint` field will be omitted from the resulting object.\n  - `service_networking_custom_endpoint` (`string`): Set the `service_networking_custom_endpoint` field on the resulting object. When `null`, the `service_networking_custom_endpoint` field will be omitted from the resulting object.\n  - `service_usage_custom_endpoint` (`string`): Set the `service_usage_custom_endpoint` field on the resulting object. When `null`, the `service_usage_custom_endpoint` field will be omitted from the resulting object.\n  - `source_repo_custom_endpoint` (`string`): Set the `source_repo_custom_endpoint` field on the resulting object. When `null`, the `source_repo_custom_endpoint` field will be omitted from the resulting object.\n  - `spanner_custom_endpoint` (`string`): Set the `spanner_custom_endpoint` field on the resulting object. When `null`, the `spanner_custom_endpoint` field will be omitted from the resulting object.\n  - `sql_custom_endpoint` (`string`): Set the `sql_custom_endpoint` field on the resulting object. When `null`, the `sql_custom_endpoint` field will be omitted from the resulting object.\n  - `storage_custom_endpoint` (`string`): Set the `storage_custom_endpoint` field on the resulting object. When `null`, the `storage_custom_endpoint` field will be omitted from the resulting object.\n  - `storage_insights_custom_endpoint` (`string`): Set the `storage_insights_custom_endpoint` field on the resulting object. When `null`, the `storage_insights_custom_endpoint` field will be omitted from the resulting object.\n  - `storage_transfer_custom_endpoint` (`string`): Set the `storage_transfer_custom_endpoint` field on the resulting object. When `null`, the `storage_transfer_custom_endpoint` field will be omitted from the resulting object.\n  - `tags_custom_endpoint` (`string`): Set the `tags_custom_endpoint` field on the resulting object. When `null`, the `tags_custom_endpoint` field will be omitted from the resulting object.\n  - `tags_location_custom_endpoint` (`string`): Set the `tags_location_custom_endpoint` field on the resulting object. When `null`, the `tags_location_custom_endpoint` field will be omitted from the resulting object.\n  - `tpu_custom_endpoint` (`string`): Set the `tpu_custom_endpoint` field on the resulting object. When `null`, the `tpu_custom_endpoint` field will be omitted from the resulting object.\n  - `user_project_override` (`bool`): Set the `user_project_override` field on the resulting object. When `null`, the `user_project_override` field will be omitted from the resulting object.\n  - `vertex_ai_custom_endpoint` (`string`): Set the `vertex_ai_custom_endpoint` field on the resulting object. When `null`, the `vertex_ai_custom_endpoint` field will be omitted from the resulting object.\n  - `vpc_access_custom_endpoint` (`string`): Set the `vpc_access_custom_endpoint` field on the resulting object. When `null`, the `vpc_access_custom_endpoint` field will be omitted from the resulting object.\n  - `workflows_custom_endpoint` (`string`): Set the `workflows_custom_endpoint` field on the resulting object. When `null`, the `workflows_custom_endpoint` field will be omitted from the resulting object.\n  - `zone` (`string`): Set the `zone` field on the resulting object. When `null`, the `zone` field will be omitted from the resulting object.\n  - `batching` (`list[obj]`): Set the `batching` field on the resulting object. When `null`, the `batching` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.provider.batching.new](#fn-googlebatchingnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withProvider](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withprovider) to construct a new `google` provider\n  configuration into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.provider.` constructs a new object with attributes and blocks configured for the `google`\nTerraform `provider`.\n\nUnlike [google.provider.new](#fn-googlenew), this function will not inject the `provider`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withProvider](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withprovider) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `access_approval_custom_endpoint` (`string`): Set the `access_approval_custom_endpoint` field on the resulting object. When `null`, the `access_approval_custom_endpoint` field will be omitted from the resulting object.\n  - `access_context_manager_custom_endpoint` (`string`): Set the `access_context_manager_custom_endpoint` field on the resulting object. When `null`, the `access_context_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `access_token` (`string`): Set the `access_token` field on the resulting object. When `null`, the `access_token` field will be omitted from the resulting object.\n  - `active_directory_custom_endpoint` (`string`): Set the `active_directory_custom_endpoint` field on the resulting object. When `null`, the `active_directory_custom_endpoint` field will be omitted from the resulting object.\n  - `alloydb_custom_endpoint` (`string`): Set the `alloydb_custom_endpoint` field on the resulting object. When `null`, the `alloydb_custom_endpoint` field will be omitted from the resulting object.\n  - `apigee_custom_endpoint` (`string`): Set the `apigee_custom_endpoint` field on the resulting object. When `null`, the `apigee_custom_endpoint` field will be omitted from the resulting object.\n  - `apikeys_custom_endpoint` (`string`): Set the `apikeys_custom_endpoint` field on the resulting object. When `null`, the `apikeys_custom_endpoint` field will be omitted from the resulting object.\n  - `app_engine_custom_endpoint` (`string`): Set the `app_engine_custom_endpoint` field on the resulting object. When `null`, the `app_engine_custom_endpoint` field will be omitted from the resulting object.\n  - `artifact_registry_custom_endpoint` (`string`): Set the `artifact_registry_custom_endpoint` field on the resulting object. When `null`, the `artifact_registry_custom_endpoint` field will be omitted from the resulting object.\n  - `assured_workloads_custom_endpoint` (`string`): Set the `assured_workloads_custom_endpoint` field on the resulting object. When `null`, the `assured_workloads_custom_endpoint` field will be omitted from the resulting object.\n  - `beyondcorp_custom_endpoint` (`string`): Set the `beyondcorp_custom_endpoint` field on the resulting object. When `null`, the `beyondcorp_custom_endpoint` field will be omitted from the resulting object.\n  - `big_query_custom_endpoint` (`string`): Set the `big_query_custom_endpoint` field on the resulting object. When `null`, the `big_query_custom_endpoint` field will be omitted from the resulting object.\n  - `biglake_custom_endpoint` (`string`): Set the `biglake_custom_endpoint` field on the resulting object. When `null`, the `biglake_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_analytics_hub_custom_endpoint` (`string`): Set the `bigquery_analytics_hub_custom_endpoint` field on the resulting object. When `null`, the `bigquery_analytics_hub_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_connection_custom_endpoint` (`string`): Set the `bigquery_connection_custom_endpoint` field on the resulting object. When `null`, the `bigquery_connection_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_data_transfer_custom_endpoint` (`string`): Set the `bigquery_data_transfer_custom_endpoint` field on the resulting object. When `null`, the `bigquery_data_transfer_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_datapolicy_custom_endpoint` (`string`): Set the `bigquery_datapolicy_custom_endpoint` field on the resulting object. When `null`, the `bigquery_datapolicy_custom_endpoint` field will be omitted from the resulting object.\n  - `bigquery_reservation_custom_endpoint` (`string`): Set the `bigquery_reservation_custom_endpoint` field on the resulting object. When `null`, the `bigquery_reservation_custom_endpoint` field will be omitted from the resulting object.\n  - `bigtable_custom_endpoint` (`string`): Set the `bigtable_custom_endpoint` field on the resulting object. When `null`, the `bigtable_custom_endpoint` field will be omitted from the resulting object.\n  - `billing_custom_endpoint` (`string`): Set the `billing_custom_endpoint` field on the resulting object. When `null`, the `billing_custom_endpoint` field will be omitted from the resulting object.\n  - `billing_project` (`string`): Set the `billing_project` field on the resulting object. When `null`, the `billing_project` field will be omitted from the resulting object.\n  - `binary_authorization_custom_endpoint` (`string`): Set the `binary_authorization_custom_endpoint` field on the resulting object. When `null`, the `binary_authorization_custom_endpoint` field will be omitted from the resulting object.\n  - `certificate_manager_custom_endpoint` (`string`): Set the `certificate_manager_custom_endpoint` field on the resulting object. When `null`, the `certificate_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_asset_custom_endpoint` (`string`): Set the `cloud_asset_custom_endpoint` field on the resulting object. When `null`, the `cloud_asset_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_billing_custom_endpoint` (`string`): Set the `cloud_billing_custom_endpoint` field on the resulting object. When `null`, the `cloud_billing_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_build_custom_endpoint` (`string`): Set the `cloud_build_custom_endpoint` field on the resulting object. When `null`, the `cloud_build_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_build_worker_pool_custom_endpoint` (`string`): Set the `cloud_build_worker_pool_custom_endpoint` field on the resulting object. When `null`, the `cloud_build_worker_pool_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_functions_custom_endpoint` (`string`): Set the `cloud_functions_custom_endpoint` field on the resulting object. When `null`, the `cloud_functions_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_identity_custom_endpoint` (`string`): Set the `cloud_identity_custom_endpoint` field on the resulting object. When `null`, the `cloud_identity_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_ids_custom_endpoint` (`string`): Set the `cloud_ids_custom_endpoint` field on the resulting object. When `null`, the `cloud_ids_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_resource_manager_custom_endpoint` (`string`): Set the `cloud_resource_manager_custom_endpoint` field on the resulting object. When `null`, the `cloud_resource_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_run_custom_endpoint` (`string`): Set the `cloud_run_custom_endpoint` field on the resulting object. When `null`, the `cloud_run_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_run_v2_custom_endpoint` (`string`): Set the `cloud_run_v2_custom_endpoint` field on the resulting object. When `null`, the `cloud_run_v2_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_scheduler_custom_endpoint` (`string`): Set the `cloud_scheduler_custom_endpoint` field on the resulting object. When `null`, the `cloud_scheduler_custom_endpoint` field will be omitted from the resulting object.\n  - `cloud_tasks_custom_endpoint` (`string`): Set the `cloud_tasks_custom_endpoint` field on the resulting object. When `null`, the `cloud_tasks_custom_endpoint` field will be omitted from the resulting object.\n  - `cloudbuildv2_custom_endpoint` (`string`): Set the `cloudbuildv2_custom_endpoint` field on the resulting object. When `null`, the `cloudbuildv2_custom_endpoint` field will be omitted from the resulting object.\n  - `clouddeploy_custom_endpoint` (`string`): Set the `clouddeploy_custom_endpoint` field on the resulting object. When `null`, the `clouddeploy_custom_endpoint` field will be omitted from the resulting object.\n  - `cloudfunctions2_custom_endpoint` (`string`): Set the `cloudfunctions2_custom_endpoint` field on the resulting object. When `null`, the `cloudfunctions2_custom_endpoint` field will be omitted from the resulting object.\n  - `composer_custom_endpoint` (`string`): Set the `composer_custom_endpoint` field on the resulting object. When `null`, the `composer_custom_endpoint` field will be omitted from the resulting object.\n  - `compute_custom_endpoint` (`string`): Set the `compute_custom_endpoint` field on the resulting object. When `null`, the `compute_custom_endpoint` field will be omitted from the resulting object.\n  - `container_analysis_custom_endpoint` (`string`): Set the `container_analysis_custom_endpoint` field on the resulting object. When `null`, the `container_analysis_custom_endpoint` field will be omitted from the resulting object.\n  - `container_attached_custom_endpoint` (`string`): Set the `container_attached_custom_endpoint` field on the resulting object. When `null`, the `container_attached_custom_endpoint` field will be omitted from the resulting object.\n  - `container_aws_custom_endpoint` (`string`): Set the `container_aws_custom_endpoint` field on the resulting object. When `null`, the `container_aws_custom_endpoint` field will be omitted from the resulting object.\n  - `container_azure_custom_endpoint` (`string`): Set the `container_azure_custom_endpoint` field on the resulting object. When `null`, the `container_azure_custom_endpoint` field will be omitted from the resulting object.\n  - `container_custom_endpoint` (`string`): Set the `container_custom_endpoint` field on the resulting object. When `null`, the `container_custom_endpoint` field will be omitted from the resulting object.\n  - `core_billing_custom_endpoint` (`string`): Set the `core_billing_custom_endpoint` field on the resulting object. When `null`, the `core_billing_custom_endpoint` field will be omitted from the resulting object.\n  - `credentials` (`string`): Set the `credentials` field on the resulting object. When `null`, the `credentials` field will be omitted from the resulting object.\n  - `data_catalog_custom_endpoint` (`string`): Set the `data_catalog_custom_endpoint` field on the resulting object. When `null`, the `data_catalog_custom_endpoint` field will be omitted from the resulting object.\n  - `data_fusion_custom_endpoint` (`string`): Set the `data_fusion_custom_endpoint` field on the resulting object. When `null`, the `data_fusion_custom_endpoint` field will be omitted from the resulting object.\n  - `data_loss_prevention_custom_endpoint` (`string`): Set the `data_loss_prevention_custom_endpoint` field on the resulting object. When `null`, the `data_loss_prevention_custom_endpoint` field will be omitted from the resulting object.\n  - `data_pipeline_custom_endpoint` (`string`): Set the `data_pipeline_custom_endpoint` field on the resulting object. When `null`, the `data_pipeline_custom_endpoint` field will be omitted from the resulting object.\n  - `database_migration_service_custom_endpoint` (`string`): Set the `database_migration_service_custom_endpoint` field on the resulting object. When `null`, the `database_migration_service_custom_endpoint` field will be omitted from the resulting object.\n  - `dataflow_custom_endpoint` (`string`): Set the `dataflow_custom_endpoint` field on the resulting object. When `null`, the `dataflow_custom_endpoint` field will be omitted from the resulting object.\n  - `dataplex_custom_endpoint` (`string`): Set the `dataplex_custom_endpoint` field on the resulting object. When `null`, the `dataplex_custom_endpoint` field will be omitted from the resulting object.\n  - `dataproc_custom_endpoint` (`string`): Set the `dataproc_custom_endpoint` field on the resulting object. When `null`, the `dataproc_custom_endpoint` field will be omitted from the resulting object.\n  - `dataproc_metastore_custom_endpoint` (`string`): Set the `dataproc_metastore_custom_endpoint` field on the resulting object. When `null`, the `dataproc_metastore_custom_endpoint` field will be omitted from the resulting object.\n  - `datastore_custom_endpoint` (`string`): Set the `datastore_custom_endpoint` field on the resulting object. When `null`, the `datastore_custom_endpoint` field will be omitted from the resulting object.\n  - `datastream_custom_endpoint` (`string`): Set the `datastream_custom_endpoint` field on the resulting object. When `null`, the `datastream_custom_endpoint` field will be omitted from the resulting object.\n  - `default_labels` (`obj`): Set the `default_labels` field on the resulting object. When `null`, the `default_labels` field will be omitted from the resulting object.\n  - `deployment_manager_custom_endpoint` (`string`): Set the `deployment_manager_custom_endpoint` field on the resulting object. When `null`, the `deployment_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `dialogflow_custom_endpoint` (`string`): Set the `dialogflow_custom_endpoint` field on the resulting object. When `null`, the `dialogflow_custom_endpoint` field will be omitted from the resulting object.\n  - `dialogflow_cx_custom_endpoint` (`string`): Set the `dialogflow_cx_custom_endpoint` field on the resulting object. When `null`, the `dialogflow_cx_custom_endpoint` field will be omitted from the resulting object.\n  - `dns_custom_endpoint` (`string`): Set the `dns_custom_endpoint` field on the resulting object. When `null`, the `dns_custom_endpoint` field will be omitted from the resulting object.\n  - `document_ai_custom_endpoint` (`string`): Set the `document_ai_custom_endpoint` field on the resulting object. When `null`, the `document_ai_custom_endpoint` field will be omitted from the resulting object.\n  - `document_ai_warehouse_custom_endpoint` (`string`): Set the `document_ai_warehouse_custom_endpoint` field on the resulting object. When `null`, the `document_ai_warehouse_custom_endpoint` field will be omitted from the resulting object.\n  - `edgecontainer_custom_endpoint` (`string`): Set the `edgecontainer_custom_endpoint` field on the resulting object. When `null`, the `edgecontainer_custom_endpoint` field will be omitted from the resulting object.\n  - `edgenetwork_custom_endpoint` (`string`): Set the `edgenetwork_custom_endpoint` field on the resulting object. When `null`, the `edgenetwork_custom_endpoint` field will be omitted from the resulting object.\n  - `essential_contacts_custom_endpoint` (`string`): Set the `essential_contacts_custom_endpoint` field on the resulting object. When `null`, the `essential_contacts_custom_endpoint` field will be omitted from the resulting object.\n  - `eventarc_custom_endpoint` (`string`): Set the `eventarc_custom_endpoint` field on the resulting object. When `null`, the `eventarc_custom_endpoint` field will be omitted from the resulting object.\n  - `filestore_custom_endpoint` (`string`): Set the `filestore_custom_endpoint` field on the resulting object. When `null`, the `filestore_custom_endpoint` field will be omitted from the resulting object.\n  - `firebaserules_custom_endpoint` (`string`): Set the `firebaserules_custom_endpoint` field on the resulting object. When `null`, the `firebaserules_custom_endpoint` field will be omitted from the resulting object.\n  - `firestore_custom_endpoint` (`string`): Set the `firestore_custom_endpoint` field on the resulting object. When `null`, the `firestore_custom_endpoint` field will be omitted from the resulting object.\n  - `gke_backup_custom_endpoint` (`string`): Set the `gke_backup_custom_endpoint` field on the resulting object. When `null`, the `gke_backup_custom_endpoint` field will be omitted from the resulting object.\n  - `gke_hub2_custom_endpoint` (`string`): Set the `gke_hub2_custom_endpoint` field on the resulting object. When `null`, the `gke_hub2_custom_endpoint` field will be omitted from the resulting object.\n  - `gke_hub_custom_endpoint` (`string`): Set the `gke_hub_custom_endpoint` field on the resulting object. When `null`, the `gke_hub_custom_endpoint` field will be omitted from the resulting object.\n  - `gkehub_feature_custom_endpoint` (`string`): Set the `gkehub_feature_custom_endpoint` field on the resulting object. When `null`, the `gkehub_feature_custom_endpoint` field will be omitted from the resulting object.\n  - `gkeonprem_custom_endpoint` (`string`): Set the `gkeonprem_custom_endpoint` field on the resulting object. When `null`, the `gkeonprem_custom_endpoint` field will be omitted from the resulting object.\n  - `healthcare_custom_endpoint` (`string`): Set the `healthcare_custom_endpoint` field on the resulting object. When `null`, the `healthcare_custom_endpoint` field will be omitted from the resulting object.\n  - `iam2_custom_endpoint` (`string`): Set the `iam2_custom_endpoint` field on the resulting object. When `null`, the `iam2_custom_endpoint` field will be omitted from the resulting object.\n  - `iam_beta_custom_endpoint` (`string`): Set the `iam_beta_custom_endpoint` field on the resulting object. When `null`, the `iam_beta_custom_endpoint` field will be omitted from the resulting object.\n  - `iam_credentials_custom_endpoint` (`string`): Set the `iam_credentials_custom_endpoint` field on the resulting object. When `null`, the `iam_credentials_custom_endpoint` field will be omitted from the resulting object.\n  - `iam_custom_endpoint` (`string`): Set the `iam_custom_endpoint` field on the resulting object. When `null`, the `iam_custom_endpoint` field will be omitted from the resulting object.\n  - `iam_workforce_pool_custom_endpoint` (`string`): Set the `iam_workforce_pool_custom_endpoint` field on the resulting object. When `null`, the `iam_workforce_pool_custom_endpoint` field will be omitted from the resulting object.\n  - `iap_custom_endpoint` (`string`): Set the `iap_custom_endpoint` field on the resulting object. When `null`, the `iap_custom_endpoint` field will be omitted from the resulting object.\n  - `identity_platform_custom_endpoint` (`string`): Set the `identity_platform_custom_endpoint` field on the resulting object. When `null`, the `identity_platform_custom_endpoint` field will be omitted from the resulting object.\n  - `impersonate_service_account` (`string`): Set the `impersonate_service_account` field on the resulting object. When `null`, the `impersonate_service_account` field will be omitted from the resulting object.\n  - `impersonate_service_account_delegates` (`list`): Set the `impersonate_service_account_delegates` field on the resulting object. When `null`, the `impersonate_service_account_delegates` field will be omitted from the resulting object.\n  - `kms_custom_endpoint` (`string`): Set the `kms_custom_endpoint` field on the resulting object. When `null`, the `kms_custom_endpoint` field will be omitted from the resulting object.\n  - `logging_custom_endpoint` (`string`): Set the `logging_custom_endpoint` field on the resulting object. When `null`, the `logging_custom_endpoint` field will be omitted from the resulting object.\n  - `looker_custom_endpoint` (`string`): Set the `looker_custom_endpoint` field on the resulting object. When `null`, the `looker_custom_endpoint` field will be omitted from the resulting object.\n  - `memcache_custom_endpoint` (`string`): Set the `memcache_custom_endpoint` field on the resulting object. When `null`, the `memcache_custom_endpoint` field will be omitted from the resulting object.\n  - `ml_engine_custom_endpoint` (`string`): Set the `ml_engine_custom_endpoint` field on the resulting object. When `null`, the `ml_engine_custom_endpoint` field will be omitted from the resulting object.\n  - `monitoring_custom_endpoint` (`string`): Set the `monitoring_custom_endpoint` field on the resulting object. When `null`, the `monitoring_custom_endpoint` field will be omitted from the resulting object.\n  - `network_connectivity_custom_endpoint` (`string`): Set the `network_connectivity_custom_endpoint` field on the resulting object. When `null`, the `network_connectivity_custom_endpoint` field will be omitted from the resulting object.\n  - `network_management_custom_endpoint` (`string`): Set the `network_management_custom_endpoint` field on the resulting object. When `null`, the `network_management_custom_endpoint` field will be omitted from the resulting object.\n  - `network_security_custom_endpoint` (`string`): Set the `network_security_custom_endpoint` field on the resulting object. When `null`, the `network_security_custom_endpoint` field will be omitted from the resulting object.\n  - `network_services_custom_endpoint` (`string`): Set the `network_services_custom_endpoint` field on the resulting object. When `null`, the `network_services_custom_endpoint` field will be omitted from the resulting object.\n  - `notebooks_custom_endpoint` (`string`): Set the `notebooks_custom_endpoint` field on the resulting object. When `null`, the `notebooks_custom_endpoint` field will be omitted from the resulting object.\n  - `org_policy_custom_endpoint` (`string`): Set the `org_policy_custom_endpoint` field on the resulting object. When `null`, the `org_policy_custom_endpoint` field will be omitted from the resulting object.\n  - `os_config_custom_endpoint` (`string`): Set the `os_config_custom_endpoint` field on the resulting object. When `null`, the `os_config_custom_endpoint` field will be omitted from the resulting object.\n  - `os_login_custom_endpoint` (`string`): Set the `os_login_custom_endpoint` field on the resulting object. When `null`, the `os_login_custom_endpoint` field will be omitted from the resulting object.\n  - `privateca_custom_endpoint` (`string`): Set the `privateca_custom_endpoint` field on the resulting object. When `null`, the `privateca_custom_endpoint` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_ca_custom_endpoint` (`string`): Set the `public_ca_custom_endpoint` field on the resulting object. When `null`, the `public_ca_custom_endpoint` field will be omitted from the resulting object.\n  - `pubsub_custom_endpoint` (`string`): Set the `pubsub_custom_endpoint` field on the resulting object. When `null`, the `pubsub_custom_endpoint` field will be omitted from the resulting object.\n  - `pubsub_lite_custom_endpoint` (`string`): Set the `pubsub_lite_custom_endpoint` field on the resulting object. When `null`, the `pubsub_lite_custom_endpoint` field will be omitted from the resulting object.\n  - `recaptcha_enterprise_custom_endpoint` (`string`): Set the `recaptcha_enterprise_custom_endpoint` field on the resulting object. When `null`, the `recaptcha_enterprise_custom_endpoint` field will be omitted from the resulting object.\n  - `redis_custom_endpoint` (`string`): Set the `redis_custom_endpoint` field on the resulting object. When `null`, the `redis_custom_endpoint` field will be omitted from the resulting object.\n  - `region` (`string`): Set the `region` field on the resulting object. When `null`, the `region` field will be omitted from the resulting object.\n  - `request_reason` (`string`): Set the `request_reason` field on the resulting object. When `null`, the `request_reason` field will be omitted from the resulting object.\n  - `request_timeout` (`string`): Set the `request_timeout` field on the resulting object. When `null`, the `request_timeout` field will be omitted from the resulting object.\n  - `resource_manager_custom_endpoint` (`string`): Set the `resource_manager_custom_endpoint` field on the resulting object. When `null`, the `resource_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `resource_manager_v3_custom_endpoint` (`string`): Set the `resource_manager_v3_custom_endpoint` field on the resulting object. When `null`, the `resource_manager_v3_custom_endpoint` field will be omitted from the resulting object.\n  - `scopes` (`list`): Set the `scopes` field on the resulting object. When `null`, the `scopes` field will be omitted from the resulting object.\n  - `secret_manager_custom_endpoint` (`string`): Set the `secret_manager_custom_endpoint` field on the resulting object. When `null`, the `secret_manager_custom_endpoint` field will be omitted from the resulting object.\n  - `security_center_custom_endpoint` (`string`): Set the `security_center_custom_endpoint` field on the resulting object. When `null`, the `security_center_custom_endpoint` field will be omitted from the resulting object.\n  - `service_management_custom_endpoint` (`string`): Set the `service_management_custom_endpoint` field on the resulting object. When `null`, the `service_management_custom_endpoint` field will be omitted from the resulting object.\n  - `service_networking_custom_endpoint` (`string`): Set the `service_networking_custom_endpoint` field on the resulting object. When `null`, the `service_networking_custom_endpoint` field will be omitted from the resulting object.\n  - `service_usage_custom_endpoint` (`string`): Set the `service_usage_custom_endpoint` field on the resulting object. When `null`, the `service_usage_custom_endpoint` field will be omitted from the resulting object.\n  - `source_repo_custom_endpoint` (`string`): Set the `source_repo_custom_endpoint` field on the resulting object. When `null`, the `source_repo_custom_endpoint` field will be omitted from the resulting object.\n  - `spanner_custom_endpoint` (`string`): Set the `spanner_custom_endpoint` field on the resulting object. When `null`, the `spanner_custom_endpoint` field will be omitted from the resulting object.\n  - `sql_custom_endpoint` (`string`): Set the `sql_custom_endpoint` field on the resulting object. When `null`, the `sql_custom_endpoint` field will be omitted from the resulting object.\n  - `storage_custom_endpoint` (`string`): Set the `storage_custom_endpoint` field on the resulting object. When `null`, the `storage_custom_endpoint` field will be omitted from the resulting object.\n  - `storage_insights_custom_endpoint` (`string`): Set the `storage_insights_custom_endpoint` field on the resulting object. When `null`, the `storage_insights_custom_endpoint` field will be omitted from the resulting object.\n  - `storage_transfer_custom_endpoint` (`string`): Set the `storage_transfer_custom_endpoint` field on the resulting object. When `null`, the `storage_transfer_custom_endpoint` field will be omitted from the resulting object.\n  - `tags_custom_endpoint` (`string`): Set the `tags_custom_endpoint` field on the resulting object. When `null`, the `tags_custom_endpoint` field will be omitted from the resulting object.\n  - `tags_location_custom_endpoint` (`string`): Set the `tags_location_custom_endpoint` field on the resulting object. When `null`, the `tags_location_custom_endpoint` field will be omitted from the resulting object.\n  - `tpu_custom_endpoint` (`string`): Set the `tpu_custom_endpoint` field on the resulting object. When `null`, the `tpu_custom_endpoint` field will be omitted from the resulting object.\n  - `universe_domain` (`string`): Set the `universe_domain` field on the resulting object. When `null`, the `universe_domain` field will be omitted from the resulting object.\n  - `user_project_override` (`bool`): Set the `user_project_override` field on the resulting object. When `null`, the `user_project_override` field will be omitted from the resulting object.\n  - `vertex_ai_custom_endpoint` (`string`): Set the `vertex_ai_custom_endpoint` field on the resulting object. When `null`, the `vertex_ai_custom_endpoint` field will be omitted from the resulting object.\n  - `vpc_access_custom_endpoint` (`string`): Set the `vpc_access_custom_endpoint` field on the resulting object. When `null`, the `vpc_access_custom_endpoint` field will be omitted from the resulting object.\n  - `workflows_custom_endpoint` (`string`): Set the `workflows_custom_endpoint` field on the resulting object. When `null`, the `workflows_custom_endpoint` field will be omitted from the resulting object.\n  - `zone` (`string`): Set the `zone` field on the resulting object. When `null`, the `zone` field will be omitted from the resulting object.\n  - `batching` (`list[obj]`): Set the `batching` field on the resulting object. When `null`, the `batching` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.provider.batching.new](#fn-googlebatchingnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withProvider](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withprovider) to construct a new `google` provider\n  configuration into the root Terraform configuration.\n', args=[]),
   newAttrs(
     access_approval_custom_endpoint=null,
     access_context_manager_custom_endpoint=null,
@@ -314,7 +318,6 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     cloud_functions_custom_endpoint=null,
     cloud_identity_custom_endpoint=null,
     cloud_ids_custom_endpoint=null,
-    cloud_iot_custom_endpoint=null,
     cloud_resource_manager_custom_endpoint=null,
     cloud_run_custom_endpoint=null,
     cloud_run_v2_custom_endpoint=null,
@@ -343,23 +346,25 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     dataproc_metastore_custom_endpoint=null,
     datastore_custom_endpoint=null,
     datastream_custom_endpoint=null,
+    default_labels=null,
     deployment_manager_custom_endpoint=null,
     dialogflow_custom_endpoint=null,
     dialogflow_cx_custom_endpoint=null,
     dns_custom_endpoint=null,
     document_ai_custom_endpoint=null,
     document_ai_warehouse_custom_endpoint=null,
+    edgecontainer_custom_endpoint=null,
     edgenetwork_custom_endpoint=null,
     essential_contacts_custom_endpoint=null,
     eventarc_custom_endpoint=null,
     filestore_custom_endpoint=null,
     firebaserules_custom_endpoint=null,
     firestore_custom_endpoint=null,
-    game_services_custom_endpoint=null,
     gke_backup_custom_endpoint=null,
     gke_hub2_custom_endpoint=null,
     gke_hub_custom_endpoint=null,
     gkehub_feature_custom_endpoint=null,
+    gkeonprem_custom_endpoint=null,
     healthcare_custom_endpoint=null,
     iam2_custom_endpoint=null,
     iam_beta_custom_endpoint=null,
@@ -411,6 +416,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     tags_custom_endpoint=null,
     tags_location_custom_endpoint=null,
     tpu_custom_endpoint=null,
+    universe_domain=null,
     user_project_override=null,
     vertex_ai_custom_endpoint=null,
     vpc_access_custom_endpoint=null,
@@ -448,7 +454,6 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     cloud_functions_custom_endpoint: cloud_functions_custom_endpoint,
     cloud_identity_custom_endpoint: cloud_identity_custom_endpoint,
     cloud_ids_custom_endpoint: cloud_ids_custom_endpoint,
-    cloud_iot_custom_endpoint: cloud_iot_custom_endpoint,
     cloud_resource_manager_custom_endpoint: cloud_resource_manager_custom_endpoint,
     cloud_run_custom_endpoint: cloud_run_custom_endpoint,
     cloud_run_v2_custom_endpoint: cloud_run_v2_custom_endpoint,
@@ -477,23 +482,25 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     dataproc_metastore_custom_endpoint: dataproc_metastore_custom_endpoint,
     datastore_custom_endpoint: datastore_custom_endpoint,
     datastream_custom_endpoint: datastream_custom_endpoint,
+    default_labels: default_labels,
     deployment_manager_custom_endpoint: deployment_manager_custom_endpoint,
     dialogflow_custom_endpoint: dialogflow_custom_endpoint,
     dialogflow_cx_custom_endpoint: dialogflow_cx_custom_endpoint,
     dns_custom_endpoint: dns_custom_endpoint,
     document_ai_custom_endpoint: document_ai_custom_endpoint,
     document_ai_warehouse_custom_endpoint: document_ai_warehouse_custom_endpoint,
+    edgecontainer_custom_endpoint: edgecontainer_custom_endpoint,
     edgenetwork_custom_endpoint: edgenetwork_custom_endpoint,
     essential_contacts_custom_endpoint: essential_contacts_custom_endpoint,
     eventarc_custom_endpoint: eventarc_custom_endpoint,
     filestore_custom_endpoint: filestore_custom_endpoint,
     firebaserules_custom_endpoint: firebaserules_custom_endpoint,
     firestore_custom_endpoint: firestore_custom_endpoint,
-    game_services_custom_endpoint: game_services_custom_endpoint,
     gke_backup_custom_endpoint: gke_backup_custom_endpoint,
     gke_hub2_custom_endpoint: gke_hub2_custom_endpoint,
     gke_hub_custom_endpoint: gke_hub_custom_endpoint,
     gkehub_feature_custom_endpoint: gkehub_feature_custom_endpoint,
+    gkeonprem_custom_endpoint: gkeonprem_custom_endpoint,
     healthcare_custom_endpoint: healthcare_custom_endpoint,
     iam2_custom_endpoint: iam2_custom_endpoint,
     iam_beta_custom_endpoint: iam_beta_custom_endpoint,
@@ -545,6 +552,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     tags_custom_endpoint: tags_custom_endpoint,
     tags_location_custom_endpoint: tags_location_custom_endpoint,
     tpu_custom_endpoint: tpu_custom_endpoint,
+    universe_domain: universe_domain,
     user_project_override: user_project_override,
     vertex_ai_custom_endpoint: vertex_ai_custom_endpoint,
     vpc_access_custom_endpoint: vpc_access_custom_endpoint,
diff --git a/4.x/_gen/resources/access_context_manager_access_level.libsonnet b/4.x/_gen/resources/access_context_manager_access_level.libsonnet
index 3fa88717..f9123805 100644
--- a/4.x/_gen/resources/access_context_manager_access_level.libsonnet
+++ b/4.x/_gen/resources/access_context_manager_access_level.libsonnet
@@ -34,14 +34,15 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
           }),
         },
       },
-      '#new':: d.fn(help='\n`google.access_context_manager_access_level.basic.conditions.new` constructs a new object with attributes and blocks configured for the `conditions`\nTerraform sub block.\n\n\n\n**Args**:\n  - `ip_subnetworks` (`list`): A list of CIDR block IP subnetwork specification. May be IPv4\nor IPv6.\nNote that for a CIDR IP address block, the specified IP address\nportion must be properly truncated (i.e. all the host bits must\nbe zero) or the input is considered malformed. For example,\n"192.0.2.0/24" is accepted but "192.0.2.1/24" is not. Similarly,\nfor IPv6, "2001:db8::/32" is accepted whereas "2001:db8::1/32"\nis not. The originating IP of a request must be in one of the\nlisted subnets in order for this Condition to be true.\nIf empty, all IP addresses are allowed. When `null`, the `ip_subnetworks` field will be omitted from the resulting object.\n  - `members` (`list`): An allowed list of members (users, service accounts).\nUsing groups is not supported yet.\n\nThe signed-in user originating the request must be a part of one\nof the provided members. If not specified, a request may come\nfrom any user (logged in/not logged in, not present in any\ngroups, etc.).\nFormats: 'user:{emailid}', 'serviceAccount:{emailid}' When `null`, the `members` field will be omitted from the resulting object.\n  - `negate` (`bool`): Whether to negate the Condition. If true, the Condition becomes\na NAND over its non-empty fields, each field must be false for\nthe Condition overall to be satisfied. Defaults to false. When `null`, the `negate` field will be omitted from the resulting object.\n  - `regions` (`list`): The request must originate from one of the provided\ncountries/regions.\nFormat: A valid ISO 3166-1 alpha-2 code. When `null`, the `regions` field will be omitted from the resulting object.\n  - `required_access_levels` (`list`): A list of other access levels defined in the same Policy,\nreferenced by resource name. Referencing an AccessLevel which\ndoes not exist is an error. All access levels listed must be\ngranted for the Condition to be true.\nFormat: accessPolicies/{policy_id}/accessLevels/{short_name} When `null`, the `required_access_levels` field will be omitted from the resulting object.\n  - `device_policy` (`list[obj]`): Device specific restrictions, all restrictions must hold for\nthe Condition to be true. If not specified, all devices are\nallowed. When `null`, the `device_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level.basic.conditions.device_policy.new](#fn-basicbasicdevice_policynew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `conditions` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.access_context_manager_access_level.basic.conditions.new` constructs a new object with attributes and blocks configured for the `conditions`\nTerraform sub block.\n\n\n\n**Args**:\n  - `ip_subnetworks` (`list`): A list of CIDR block IP subnetwork specification. May be IPv4\nor IPv6.\nNote that for a CIDR IP address block, the specified IP address\nportion must be properly truncated (i.e. all the host bits must\nbe zero) or the input is considered malformed. For example,\n"192.0.2.0/24" is accepted but "192.0.2.1/24" is not. Similarly,\nfor IPv6, "2001:db8::/32" is accepted whereas "2001:db8::1/32"\nis not. The originating IP of a request must be in one of the\nlisted subnets in order for this Condition to be true.\nIf empty, all IP addresses are allowed. When `null`, the `ip_subnetworks` field will be omitted from the resulting object.\n  - `members` (`list`): An allowed list of members (users, service accounts).\nUsing groups is not supported yet.\n\nThe signed-in user originating the request must be a part of one\nof the provided members. If not specified, a request may come\nfrom any user (logged in/not logged in, not present in any\ngroups, etc.).\nFormats: 'user:{emailid}', 'serviceAccount:{emailid}' When `null`, the `members` field will be omitted from the resulting object.\n  - `negate` (`bool`): Whether to negate the Condition. If true, the Condition becomes\na NAND over its non-empty fields, each field must be false for\nthe Condition overall to be satisfied. Defaults to false. When `null`, the `negate` field will be omitted from the resulting object.\n  - `regions` (`list`): The request must originate from one of the provided\ncountries/regions.\nFormat: A valid ISO 3166-1 alpha-2 code. When `null`, the `regions` field will be omitted from the resulting object.\n  - `required_access_levels` (`list`): A list of other access levels defined in the same Policy,\nreferenced by resource name. Referencing an AccessLevel which\ndoes not exist is an error. All access levels listed must be\ngranted for the Condition to be true.\nFormat: accessPolicies/{policy_id}/accessLevels/{short_name} When `null`, the `required_access_levels` field will be omitted from the resulting object.\n  - `device_policy` (`list[obj]`): Device specific restrictions, all restrictions must hold for\nthe Condition to be true. If not specified, all devices are\nallowed. When `null`, the `device_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level.basic.conditions.device_policy.new](#fn-basicbasicdevice_policynew) constructor.\n  - `vpc_network_sources` (`list[obj]`): The request must originate from one of the provided VPC networks in Google Cloud. Cannot specify this field together with 'ip_subnetworks'. When `null`, the `vpc_network_sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level.basic.conditions.vpc_network_sources.new](#fn-basicbasicvpc_network_sourcesnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `conditions` sub block.\n', args=[]),
       new(
         device_policy=null,
         ip_subnetworks=null,
         members=null,
         negate=null,
         regions=null,
-        required_access_levels=null
+        required_access_levels=null,
+        vpc_network_sources=null
       ):: std.prune(a={
         device_policy: device_policy,
         ip_subnetworks: ip_subnetworks,
@@ -49,7 +50,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         negate: negate,
         regions: regions,
         required_access_levels: required_access_levels,
+        vpc_network_sources: vpc_network_sources,
       }),
+      vpc_network_sources:: {
+        '#new':: d.fn(help='\n`google.access_context_manager_access_level.basic.conditions.vpc_network_sources.new` constructs a new object with attributes and blocks configured for the `vpc_network_sources`\nTerraform sub block.\n\n\n\n**Args**:\n  - `vpc_subnetwork` (`list[obj]`): Sub networks within a VPC network. When `null`, the `vpc_subnetwork` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level.basic.conditions.vpc_network_sources.vpc_subnetwork.new](#fn-basicbasicconditionsvpc_subnetworknew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `vpc_network_sources` sub block.\n', args=[]),
+        new(
+          vpc_subnetwork=null
+        ):: std.prune(a={
+          vpc_subnetwork: vpc_subnetwork,
+        }),
+        vpc_subnetwork:: {
+          '#new':: d.fn(help='\n`google.access_context_manager_access_level.basic.conditions.vpc_network_sources.vpc_subnetwork.new` constructs a new object with attributes and blocks configured for the `vpc_subnetwork`\nTerraform sub block.\n\n\n\n**Args**:\n  - `network` (`string`): Required. Network name to be allowed by this Access Level. Networks of foreign organizations requires 'compute.network.get' permission to be granted to caller.\n  - `vpc_ip_subnetworks` (`list`): CIDR block IP subnetwork specification. Must be IPv4. When `null`, the `vpc_ip_subnetworks` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `vpc_subnetwork` sub block.\n', args=[]),
+          new(
+            network,
+            vpc_ip_subnetworks=null
+          ):: std.prune(a={
+            network: network,
+            vpc_ip_subnetworks: vpc_ip_subnetworks,
+          }),
+        },
+      },
     },
     '#new':: d.fn(help='\n`google.access_context_manager_access_level.basic.new` constructs a new object with attributes and blocks configured for the `basic`\nTerraform sub block.\n\n\n\n**Args**:\n  - `combining_function` (`string`): How the conditions list should be combined to determine if a request\nis granted this AccessLevel. If AND is used, each Condition in\nconditions must be satisfied for the AccessLevel to be applied. If\nOR is used, at least one Condition in conditions must be satisfied\nfor the AccessLevel to be applied. Default value: "AND" Possible values: ["AND", "OR"] When `null`, the `combining_function` field will be omitted from the resulting object.\n  - `conditions` (`list[obj]`): A set of requirements for the AccessLevel to be granted. When `null`, the `conditions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level.basic.conditions.new](#fn-basicconditionsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `basic` sub block.\n', args=[]),
     new(
diff --git a/4.x/_gen/resources/access_context_manager_access_level_condition.libsonnet b/4.x/_gen/resources/access_context_manager_access_level_condition.libsonnet
index 74c554a0..6f36ed55 100644
--- a/4.x/_gen/resources/access_context_manager_access_level_condition.libsonnet
+++ b/4.x/_gen/resources/access_context_manager_access_level_condition.libsonnet
@@ -30,7 +30,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
   },
-  '#new':: d.fn(help="\n`google.access_context_manager_access_level_condition.new` injects a new `google_access_context_manager_access_level_condition` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.access_context_manager_access_level_condition.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.access_context_manager_access_level_condition` using the reference:\n\n    $._ref.google_access_context_manager_access_level_condition.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_access_context_manager_access_level_condition.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `access_level` (`string`): The name of the Access Level to add this condition to.\n  - `ip_subnetworks` (`list`): A list of CIDR block IP subnetwork specification. May be IPv4\nor IPv6.\nNote that for a CIDR IP address block, the specified IP address\nportion must be properly truncated (i.e. all the host bits must\nbe zero) or the input is considered malformed. For example,\n\u0026#34;192.0.2.0/24\u0026#34; is accepted but \u0026#34;192.0.2.1/24\u0026#34; is not. Similarly,\nfor IPv6, \u0026#34;2001:db8::/32\u0026#34; is accepted whereas \u0026#34;2001:db8::1/32\u0026#34;\nis not. The originating IP of a request must be in one of the\nlisted subnets in order for this Condition to be true.\nIf empty, all IP addresses are allowed. When `null`, the `ip_subnetworks` field will be omitted from the resulting object.\n  - `members` (`list`): An allowed list of members (users, service accounts).\nUsing groups is not supported yet.\n\nThe signed-in user originating the request must be a part of one\nof the provided members. If not specified, a request may come\nfrom any user (logged in/not logged in, not present in any\ngroups, etc.).\nFormats: \u0026#39;user:{emailid}\u0026#39;, \u0026#39;serviceAccount:{emailid}\u0026#39; When `null`, the `members` field will be omitted from the resulting object.\n  - `negate` (`bool`): Whether to negate the Condition. If true, the Condition becomes\na NAND over its non-empty fields, each field must be false for\nthe Condition overall to be satisfied. Defaults to false. When `null`, the `negate` field will be omitted from the resulting object.\n  - `regions` (`list`): The request must originate from one of the provided\ncountries/regions.\nFormat: A valid ISO 3166-1 alpha-2 code. When `null`, the `regions` field will be omitted from the resulting object.\n  - `required_access_levels` (`list`): A list of other access levels defined in the same Policy,\nreferenced by resource name. Referencing an AccessLevel which\ndoes not exist is an error. All access levels listed must be\ngranted for the Condition to be true.\nFormat: accessPolicies/{policy_id}/accessLevels/{short_name} When `null`, the `required_access_levels` field will be omitted from the resulting object.\n  - `device_policy` (`list[obj]`): Device specific restrictions, all restrictions must hold for\nthe Condition to be true. If not specified, all devices are\nallowed. When `null`, the `device_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.device_policy.new](#fn-device_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.access_context_manager_access_level_condition.new` injects a new `google_access_context_manager_access_level_condition` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.access_context_manager_access_level_condition.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.access_context_manager_access_level_condition` using the reference:\n\n    $._ref.google_access_context_manager_access_level_condition.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_access_context_manager_access_level_condition.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `access_level` (`string`): The name of the Access Level to add this condition to.\n  - `ip_subnetworks` (`list`): A list of CIDR block IP subnetwork specification. May be IPv4\nor IPv6.\nNote that for a CIDR IP address block, the specified IP address\nportion must be properly truncated (i.e. all the host bits must\nbe zero) or the input is considered malformed. For example,\n\u0026#34;192.0.2.0/24\u0026#34; is accepted but \u0026#34;192.0.2.1/24\u0026#34; is not. Similarly,\nfor IPv6, \u0026#34;2001:db8::/32\u0026#34; is accepted whereas \u0026#34;2001:db8::1/32\u0026#34;\nis not. The originating IP of a request must be in one of the\nlisted subnets in order for this Condition to be true.\nIf empty, all IP addresses are allowed. When `null`, the `ip_subnetworks` field will be omitted from the resulting object.\n  - `members` (`list`): An allowed list of members (users, service accounts).\nUsing groups is not supported yet.\n\nThe signed-in user originating the request must be a part of one\nof the provided members. If not specified, a request may come\nfrom any user (logged in/not logged in, not present in any\ngroups, etc.).\nFormats: \u0026#39;user:{emailid}\u0026#39;, \u0026#39;serviceAccount:{emailid}\u0026#39; When `null`, the `members` field will be omitted from the resulting object.\n  - `negate` (`bool`): Whether to negate the Condition. If true, the Condition becomes\na NAND over its non-empty fields, each field must be false for\nthe Condition overall to be satisfied. Defaults to false. When `null`, the `negate` field will be omitted from the resulting object.\n  - `regions` (`list`): The request must originate from one of the provided\ncountries/regions.\nFormat: A valid ISO 3166-1 alpha-2 code. When `null`, the `regions` field will be omitted from the resulting object.\n  - `required_access_levels` (`list`): A list of other access levels defined in the same Policy,\nreferenced by resource name. Referencing an AccessLevel which\ndoes not exist is an error. All access levels listed must be\ngranted for the Condition to be true.\nFormat: accessPolicies/{policy_id}/accessLevels/{short_name} When `null`, the `required_access_levels` field will be omitted from the resulting object.\n  - `device_policy` (`list[obj]`): Device specific restrictions, all restrictions must hold for\nthe Condition to be true. If not specified, all devices are\nallowed. When `null`, the `device_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.device_policy.new](#fn-device_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vpc_network_sources` (`list[obj]`): The request must originate from one of the provided VPC networks in Google Cloud. Cannot specify this field together with \u0026#39;ip_subnetworks\u0026#39;. When `null`, the `vpc_network_sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.vpc_network_sources.new](#fn-vpc_network_sourcesnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     access_level,
@@ -41,6 +41,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     regions=null,
     required_access_levels=null,
     timeouts=null,
+    vpc_network_sources=null,
     _meta={}
   ):: tf.withResource(
     type='google_access_context_manager_access_level_condition',
@@ -53,11 +54,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       negate=negate,
       regions=regions,
       required_access_levels=required_access_levels,
-      timeouts=timeouts
+      timeouts=timeouts,
+      vpc_network_sources=vpc_network_sources
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.access_context_manager_access_level_condition.newAttrs` constructs a new object with attributes and blocks configured for the `access_context_manager_access_level_condition`\nTerraform resource.\n\nUnlike [google.access_context_manager_access_level_condition.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `access_level` (`string`): The name of the Access Level to add this condition to.\n  - `ip_subnetworks` (`list`): A list of CIDR block IP subnetwork specification. May be IPv4\nor IPv6.\nNote that for a CIDR IP address block, the specified IP address\nportion must be properly truncated (i.e. all the host bits must\nbe zero) or the input is considered malformed. For example,\n"192.0.2.0/24" is accepted but "192.0.2.1/24" is not. Similarly,\nfor IPv6, "2001:db8::/32" is accepted whereas "2001:db8::1/32"\nis not. The originating IP of a request must be in one of the\nlisted subnets in order for this Condition to be true.\nIf empty, all IP addresses are allowed. When `null`, the `ip_subnetworks` field will be omitted from the resulting object.\n  - `members` (`list`): An allowed list of members (users, service accounts).\nUsing groups is not supported yet.\n\nThe signed-in user originating the request must be a part of one\nof the provided members. If not specified, a request may come\nfrom any user (logged in/not logged in, not present in any\ngroups, etc.).\nFormats: 'user:{emailid}', 'serviceAccount:{emailid}' When `null`, the `members` field will be omitted from the resulting object.\n  - `negate` (`bool`): Whether to negate the Condition. If true, the Condition becomes\na NAND over its non-empty fields, each field must be false for\nthe Condition overall to be satisfied. Defaults to false. When `null`, the `negate` field will be omitted from the resulting object.\n  - `regions` (`list`): The request must originate from one of the provided\ncountries/regions.\nFormat: A valid ISO 3166-1 alpha-2 code. When `null`, the `regions` field will be omitted from the resulting object.\n  - `required_access_levels` (`list`): A list of other access levels defined in the same Policy,\nreferenced by resource name. Referencing an AccessLevel which\ndoes not exist is an error. All access levels listed must be\ngranted for the Condition to be true.\nFormat: accessPolicies/{policy_id}/accessLevels/{short_name} When `null`, the `required_access_levels` field will be omitted from the resulting object.\n  - `device_policy` (`list[obj]`): Device specific restrictions, all restrictions must hold for\nthe Condition to be true. If not specified, all devices are\nallowed. When `null`, the `device_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.device_policy.new](#fn-device_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `access_context_manager_access_level_condition` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.access_context_manager_access_level_condition.newAttrs` constructs a new object with attributes and blocks configured for the `access_context_manager_access_level_condition`\nTerraform resource.\n\nUnlike [google.access_context_manager_access_level_condition.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `access_level` (`string`): The name of the Access Level to add this condition to.\n  - `ip_subnetworks` (`list`): A list of CIDR block IP subnetwork specification. May be IPv4\nor IPv6.\nNote that for a CIDR IP address block, the specified IP address\nportion must be properly truncated (i.e. all the host bits must\nbe zero) or the input is considered malformed. For example,\n"192.0.2.0/24" is accepted but "192.0.2.1/24" is not. Similarly,\nfor IPv6, "2001:db8::/32" is accepted whereas "2001:db8::1/32"\nis not. The originating IP of a request must be in one of the\nlisted subnets in order for this Condition to be true.\nIf empty, all IP addresses are allowed. When `null`, the `ip_subnetworks` field will be omitted from the resulting object.\n  - `members` (`list`): An allowed list of members (users, service accounts).\nUsing groups is not supported yet.\n\nThe signed-in user originating the request must be a part of one\nof the provided members. If not specified, a request may come\nfrom any user (logged in/not logged in, not present in any\ngroups, etc.).\nFormats: 'user:{emailid}', 'serviceAccount:{emailid}' When `null`, the `members` field will be omitted from the resulting object.\n  - `negate` (`bool`): Whether to negate the Condition. If true, the Condition becomes\na NAND over its non-empty fields, each field must be false for\nthe Condition overall to be satisfied. Defaults to false. When `null`, the `negate` field will be omitted from the resulting object.\n  - `regions` (`list`): The request must originate from one of the provided\ncountries/regions.\nFormat: A valid ISO 3166-1 alpha-2 code. When `null`, the `regions` field will be omitted from the resulting object.\n  - `required_access_levels` (`list`): A list of other access levels defined in the same Policy,\nreferenced by resource name. Referencing an AccessLevel which\ndoes not exist is an error. All access levels listed must be\ngranted for the Condition to be true.\nFormat: accessPolicies/{policy_id}/accessLevels/{short_name} When `null`, the `required_access_levels` field will be omitted from the resulting object.\n  - `device_policy` (`list[obj]`): Device specific restrictions, all restrictions must hold for\nthe Condition to be true. If not specified, all devices are\nallowed. When `null`, the `device_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.device_policy.new](#fn-device_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vpc_network_sources` (`list[obj]`): The request must originate from one of the provided VPC networks in Google Cloud. Cannot specify this field together with 'ip_subnetworks'. When `null`, the `vpc_network_sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.vpc_network_sources.new](#fn-vpc_network_sourcesnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `access_context_manager_access_level_condition` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     access_level,
     device_policy=null,
@@ -66,7 +68,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     negate=null,
     regions=null,
     required_access_levels=null,
-    timeouts=null
+    timeouts=null,
+    vpc_network_sources=null
   ):: std.prune(a={
     access_level: access_level,
     device_policy: device_policy,
@@ -76,6 +79,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     regions: regions,
     required_access_levels: required_access_levels,
     timeouts: timeouts,
+    vpc_network_sources: vpc_network_sources,
   }),
   timeouts:: {
     '#new':: d.fn(help='\n`google.access_context_manager_access_level_condition.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
@@ -87,6 +91,24 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       delete: delete,
     }),
   },
+  vpc_network_sources:: {
+    '#new':: d.fn(help='\n`google.access_context_manager_access_level_condition.vpc_network_sources.new` constructs a new object with attributes and blocks configured for the `vpc_network_sources`\nTerraform sub block.\n\n\n\n**Args**:\n  - `vpc_subnetwork` (`list[obj]`): Sub networks within a VPC network. When `null`, the `vpc_subnetwork` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.vpc_network_sources.vpc_subnetwork.new](#fn-vpc_network_sourcesvpc_subnetworknew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `vpc_network_sources` sub block.\n', args=[]),
+    new(
+      vpc_subnetwork=null
+    ):: std.prune(a={
+      vpc_subnetwork: vpc_subnetwork,
+    }),
+    vpc_subnetwork:: {
+      '#new':: d.fn(help='\n`google.access_context_manager_access_level_condition.vpc_network_sources.vpc_subnetwork.new` constructs a new object with attributes and blocks configured for the `vpc_subnetwork`\nTerraform sub block.\n\n\n\n**Args**:\n  - `network` (`string`): Required. Network name to be allowed by this Access Level. Networks of foreign organizations requires 'compute.network.get' permission to be granted to caller.\n  - `vpc_ip_subnetworks` (`list`): CIDR block IP subnetwork specification. Must be IPv4. When `null`, the `vpc_ip_subnetworks` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `vpc_subnetwork` sub block.\n', args=[]),
+      new(
+        network,
+        vpc_ip_subnetworks=null
+      ):: std.prune(a={
+        network: network,
+        vpc_ip_subnetworks: vpc_ip_subnetworks,
+      }),
+    },
+  },
   '#withAccessLevel':: d.fn(help='`google.string.withAccessLevel` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the access_level field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `access_level` field.\n', args=[]),
   withAccessLevel(resourceLabel, value): {
     resource+: {
@@ -187,4 +209,24 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withVpcNetworkSources':: d.fn(help='`google.list[obj].withVpcNetworkSources` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the vpc_network_sources field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withVpcNetworkSourcesMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `vpc_network_sources` field.\n', args=[]),
+  withVpcNetworkSources(resourceLabel, value): {
+    resource+: {
+      google_access_context_manager_access_level_condition+: {
+        [resourceLabel]+: {
+          vpc_network_sources: value,
+        },
+      },
+    },
+  },
+  '#withVpcNetworkSourcesMixin':: d.fn(help='`google.list[obj].withVpcNetworkSourcesMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the vpc_network_sources field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withVpcNetworkSources](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `vpc_network_sources` field.\n', args=[]),
+  withVpcNetworkSourcesMixin(resourceLabel, value): {
+    resource+: {
+      google_access_context_manager_access_level_condition+: {
+        [resourceLabel]+: {
+          vpc_network_sources+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
 }
diff --git a/4.x/_gen/resources/access_context_manager_access_levels.libsonnet b/4.x/_gen/resources/access_context_manager_access_levels.libsonnet
index d00bb22b..c38c7217 100644
--- a/4.x/_gen/resources/access_context_manager_access_levels.libsonnet
+++ b/4.x/_gen/resources/access_context_manager_access_levels.libsonnet
@@ -33,14 +33,15 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
             }),
           },
         },
-        '#new':: d.fn(help='\n`google.access_context_manager_access_levels.access_levels.basic.conditions.new` constructs a new object with attributes and blocks configured for the `conditions`\nTerraform sub block.\n\n\n\n**Args**:\n  - `ip_subnetworks` (`list`): A list of CIDR block IP subnetwork specification. May be IPv4\nor IPv6.\nNote that for a CIDR IP address block, the specified IP address\nportion must be properly truncated (i.e. all the host bits must\nbe zero) or the input is considered malformed. For example,\n"192.0.2.0/24" is accepted but "192.0.2.1/24" is not. Similarly,\nfor IPv6, "2001:db8::/32" is accepted whereas "2001:db8::1/32"\nis not. The originating IP of a request must be in one of the\nlisted subnets in order for this Condition to be true.\nIf empty, all IP addresses are allowed. When `null`, the `ip_subnetworks` field will be omitted from the resulting object.\n  - `members` (`list`): An allowed list of members (users, service accounts).\nUsing groups is not supported yet.\n\nThe signed-in user originating the request must be a part of one\nof the provided members. If not specified, a request may come\nfrom any user (logged in/not logged in, not present in any\ngroups, etc.).\nFormats: 'user:{emailid}', 'serviceAccount:{emailid}' When `null`, the `members` field will be omitted from the resulting object.\n  - `negate` (`bool`): Whether to negate the Condition. If true, the Condition becomes\na NAND over its non-empty fields, each field must be false for\nthe Condition overall to be satisfied. Defaults to false. When `null`, the `negate` field will be omitted from the resulting object.\n  - `regions` (`list`): The request must originate from one of the provided\ncountries/regions.\nFormat: A valid ISO 3166-1 alpha-2 code. When `null`, the `regions` field will be omitted from the resulting object.\n  - `required_access_levels` (`list`): A list of other access levels defined in the same Policy,\nreferenced by resource name. Referencing an AccessLevel which\ndoes not exist is an error. All access levels listed must be\ngranted for the Condition to be true.\nFormat: accessPolicies/{policy_id}/accessLevels/{short_name} When `null`, the `required_access_levels` field will be omitted from the resulting object.\n  - `device_policy` (`list[obj]`): Device specific restrictions, all restrictions must hold for\nthe Condition to be true. If not specified, all devices are\nallowed. When `null`, the `device_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_levels.access_levels.basic.conditions.device_policy.new](#fn-access_levelsaccess_levelsbasicdevice_policynew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `conditions` sub block.\n', args=[]),
+        '#new':: d.fn(help='\n`google.access_context_manager_access_levels.access_levels.basic.conditions.new` constructs a new object with attributes and blocks configured for the `conditions`\nTerraform sub block.\n\n\n\n**Args**:\n  - `ip_subnetworks` (`list`): A list of CIDR block IP subnetwork specification. May be IPv4\nor IPv6.\nNote that for a CIDR IP address block, the specified IP address\nportion must be properly truncated (i.e. all the host bits must\nbe zero) or the input is considered malformed. For example,\n"192.0.2.0/24" is accepted but "192.0.2.1/24" is not. Similarly,\nfor IPv6, "2001:db8::/32" is accepted whereas "2001:db8::1/32"\nis not. The originating IP of a request must be in one of the\nlisted subnets in order for this Condition to be true.\nIf empty, all IP addresses are allowed. When `null`, the `ip_subnetworks` field will be omitted from the resulting object.\n  - `members` (`list`): An allowed list of members (users, service accounts).\nUsing groups is not supported yet.\n\nThe signed-in user originating the request must be a part of one\nof the provided members. If not specified, a request may come\nfrom any user (logged in/not logged in, not present in any\ngroups, etc.).\nFormats: 'user:{emailid}', 'serviceAccount:{emailid}' When `null`, the `members` field will be omitted from the resulting object.\n  - `negate` (`bool`): Whether to negate the Condition. If true, the Condition becomes\na NAND over its non-empty fields, each field must be false for\nthe Condition overall to be satisfied. Defaults to false. When `null`, the `negate` field will be omitted from the resulting object.\n  - `regions` (`list`): The request must originate from one of the provided\ncountries/regions.\nFormat: A valid ISO 3166-1 alpha-2 code. When `null`, the `regions` field will be omitted from the resulting object.\n  - `required_access_levels` (`list`): A list of other access levels defined in the same Policy,\nreferenced by resource name. Referencing an AccessLevel which\ndoes not exist is an error. All access levels listed must be\ngranted for the Condition to be true.\nFormat: accessPolicies/{policy_id}/accessLevels/{short_name} When `null`, the `required_access_levels` field will be omitted from the resulting object.\n  - `device_policy` (`list[obj]`): Device specific restrictions, all restrictions must hold for\nthe Condition to be true. If not specified, all devices are\nallowed. When `null`, the `device_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_levels.access_levels.basic.conditions.device_policy.new](#fn-access_levelsaccess_levelsbasicdevice_policynew) constructor.\n  - `vpc_network_sources` (`list[obj]`): The request must originate from one of the provided VPC networks in Google Cloud. Cannot specify this field together with 'ip_subnetworks'. When `null`, the `vpc_network_sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_levels.access_levels.basic.conditions.vpc_network_sources.new](#fn-access_levelsaccess_levelsbasicvpc_network_sourcesnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `conditions` sub block.\n', args=[]),
         new(
           device_policy=null,
           ip_subnetworks=null,
           members=null,
           negate=null,
           regions=null,
-          required_access_levels=null
+          required_access_levels=null,
+          vpc_network_sources=null
         ):: std.prune(a={
           device_policy: device_policy,
           ip_subnetworks: ip_subnetworks,
@@ -48,7 +49,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
           negate: negate,
           regions: regions,
           required_access_levels: required_access_levels,
+          vpc_network_sources: vpc_network_sources,
         }),
+        vpc_network_sources:: {
+          '#new':: d.fn(help='\n`google.access_context_manager_access_levels.access_levels.basic.conditions.vpc_network_sources.new` constructs a new object with attributes and blocks configured for the `vpc_network_sources`\nTerraform sub block.\n\n\n\n**Args**:\n  - `vpc_subnetwork` (`list[obj]`): Sub networks within a VPC network. When `null`, the `vpc_subnetwork` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_levels.access_levels.basic.conditions.vpc_network_sources.vpc_subnetwork.new](#fn-access_levelsaccess_levelsbasicconditionsvpc_subnetworknew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `vpc_network_sources` sub block.\n', args=[]),
+          new(
+            vpc_subnetwork=null
+          ):: std.prune(a={
+            vpc_subnetwork: vpc_subnetwork,
+          }),
+          vpc_subnetwork:: {
+            '#new':: d.fn(help='\n`google.access_context_manager_access_levels.access_levels.basic.conditions.vpc_network_sources.vpc_subnetwork.new` constructs a new object with attributes and blocks configured for the `vpc_subnetwork`\nTerraform sub block.\n\n\n\n**Args**:\n  - `network` (`string`): Required. Network name to be allowed by this Access Level. Networks of foreign organizations requires 'compute.network.get' permission to be granted to caller.\n  - `vpc_ip_subnetworks` (`list`): CIDR block IP subnetwork specification. Must be IPv4. When `null`, the `vpc_ip_subnetworks` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `vpc_subnetwork` sub block.\n', args=[]),
+            new(
+              network,
+              vpc_ip_subnetworks=null
+            ):: std.prune(a={
+              network: network,
+              vpc_ip_subnetworks: vpc_ip_subnetworks,
+            }),
+          },
+        },
       },
       '#new':: d.fn(help='\n`google.access_context_manager_access_levels.access_levels.basic.new` constructs a new object with attributes and blocks configured for the `basic`\nTerraform sub block.\n\n\n\n**Args**:\n  - `combining_function` (`string`): How the conditions list should be combined to determine if a request\nis granted this AccessLevel. If AND is used, each Condition in\nconditions must be satisfied for the AccessLevel to be applied. If\nOR is used, at least one Condition in conditions must be satisfied\nfor the AccessLevel to be applied. Default value: "AND" Possible values: ["AND", "OR"] When `null`, the `combining_function` field will be omitted from the resulting object.\n  - `conditions` (`list[obj]`): A set of requirements for the AccessLevel to be granted. When `null`, the `conditions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_levels.access_levels.basic.conditions.new](#fn-access_levelsaccess_levelsconditionsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `basic` sub block.\n', args=[]),
       new(
diff --git a/4.x/_gen/resources/access_context_manager_service_perimeter.libsonnet b/4.x/_gen/resources/access_context_manager_service_perimeter.libsonnet
index bdc6d1b3..a7409d34 100644
--- a/4.x/_gen/resources/access_context_manager_service_perimeter.libsonnet
+++ b/4.x/_gen/resources/access_context_manager_service_perimeter.libsonnet
@@ -56,14 +56,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   spec:: {
     egress_policies:: {
       egress_from:: {
-        '#new':: d.fn(help='\n`google.access_context_manager_service_perimeter.spec.egress_policies.egress_from.new` constructs a new object with attributes and blocks configured for the `egress_from`\nTerraform sub block.\n\n\n\n**Args**:\n  - `identities` (`list`): A list of identities that are allowed access through this 'EgressPolicy'.\nShould be in the format of email address. The email address should\nrepresent individual user or service account only. When `null`, the `identities` field will be omitted from the resulting object.\n  - `identity_type` (`string`): Specifies the type of identities that are allowed access to outside the\nperimeter. If left unspecified, then members of 'identities' field will\nbe allowed access. Possible values: ["IDENTITY_TYPE_UNSPECIFIED", "ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"] When `null`, the `identity_type` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `egress_from` sub block.\n', args=[]),
+        '#new':: d.fn(help='\n`google.access_context_manager_service_perimeter.spec.egress_policies.egress_from.new` constructs a new object with attributes and blocks configured for the `egress_from`\nTerraform sub block.\n\n\n\n**Args**:\n  - `identities` (`list`): A list of identities that are allowed access through this 'EgressPolicy'.\nShould be in the format of email address. The email address should\nrepresent individual user or service account only. When `null`, the `identities` field will be omitted from the resulting object.\n  - `identity_type` (`string`): Specifies the type of identities that are allowed access to outside the\nperimeter. If left unspecified, then members of 'identities' field will\nbe allowed access. Possible values: ["IDENTITY_TYPE_UNSPECIFIED", "ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"] When `null`, the `identity_type` field will be omitted from the resulting object.\n  - `source_restriction` (`string`): Whether to enforce traffic restrictions based on 'sources' field. If the 'sources' field is non-empty, then this field must be set to 'SOURCE_RESTRICTION_ENABLED'. Possible values: ["SOURCE_RESTRICTION_UNSPECIFIED", "SOURCE_RESTRICTION_ENABLED", "SOURCE_RESTRICTION_DISABLED"] When `null`, the `source_restriction` field will be omitted from the resulting object.\n  - `sources` (`list[obj]`): Sources that this EgressPolicy authorizes access from. When `null`, the `sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter.spec.egress_policies.egress_from.sources.new](#fn-specspecegress_policiessourcesnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `egress_from` sub block.\n', args=[]),
         new(
           identities=null,
-          identity_type=null
+          identity_type=null,
+          source_restriction=null,
+          sources=null
         ):: std.prune(a={
           identities: identities,
           identity_type: identity_type,
+          source_restriction: source_restriction,
+          sources: sources,
         }),
+        sources:: {
+          '#new':: d.fn(help='\n`google.access_context_manager_service_perimeter.spec.egress_policies.egress_from.sources.new` constructs a new object with attributes and blocks configured for the `sources`\nTerraform sub block.\n\n\n\n**Args**:\n  - `access_level` (`string`): An AccessLevel resource name that allows resources outside the ServicePerimeter to be accessed from the inside. When `null`, the `access_level` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `sources` sub block.\n', args=[]),
+          new(
+            access_level=null
+          ):: std.prune(a={
+            access_level: access_level,
+          }),
+        },
       },
       egress_to:: {
         '#new':: d.fn(help='\n`google.access_context_manager_service_perimeter.spec.egress_policies.egress_to.new` constructs a new object with attributes and blocks configured for the `egress_to`\nTerraform sub block.\n\n\n\n**Args**:\n  - `external_resources` (`list`): A list of external resources that are allowed to be accessed. A request\nmatches if it contains an external resource in this list (Example:\ns3://bucket/path). Currently '*' is not allowed. When `null`, the `external_resources` field will be omitted from the resulting object.\n  - `resources` (`list`): A list of resources, currently only projects in the form\n'projects/<projectnumber>', that match this to stanza. A request matches\nif it contains a resource in this list. If * is specified for resources,\nthen this 'EgressTo' rule will authorize access to all resources outside\nthe perimeter. When `null`, the `resources` field will be omitted from the resulting object.\n  - `operations` (`list[obj]`): A list of 'ApiOperations' that this egress rule applies to. A request matches\nif it contains an operation/service in this list. When `null`, the `operations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter.spec.egress_policies.egress_to.operations.new](#fn-specspecegress_policiesoperationsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `egress_to` sub block.\n', args=[]),
@@ -198,14 +210,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   status:: {
     egress_policies:: {
       egress_from:: {
-        '#new':: d.fn(help='\n`google.access_context_manager_service_perimeter.status.egress_policies.egress_from.new` constructs a new object with attributes and blocks configured for the `egress_from`\nTerraform sub block.\n\n\n\n**Args**:\n  - `identities` (`list`): A list of identities that are allowed access through this 'EgressPolicy'.\nShould be in the format of email address. The email address should\nrepresent individual user or service account only. When `null`, the `identities` field will be omitted from the resulting object.\n  - `identity_type` (`string`): Specifies the type of identities that are allowed access to outside the\nperimeter. If left unspecified, then members of 'identities' field will\nbe allowed access. Possible values: ["IDENTITY_TYPE_UNSPECIFIED", "ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"] When `null`, the `identity_type` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `egress_from` sub block.\n', args=[]),
+        '#new':: d.fn(help='\n`google.access_context_manager_service_perimeter.status.egress_policies.egress_from.new` constructs a new object with attributes and blocks configured for the `egress_from`\nTerraform sub block.\n\n\n\n**Args**:\n  - `identities` (`list`): A list of identities that are allowed access through this 'EgressPolicy'.\nShould be in the format of email address. The email address should\nrepresent individual user or service account only. When `null`, the `identities` field will be omitted from the resulting object.\n  - `identity_type` (`string`): Specifies the type of identities that are allowed access to outside the\nperimeter. If left unspecified, then members of 'identities' field will\nbe allowed access. Possible values: ["IDENTITY_TYPE_UNSPECIFIED", "ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"] When `null`, the `identity_type` field will be omitted from the resulting object.\n  - `source_restriction` (`string`): Whether to enforce traffic restrictions based on 'sources' field. If the 'sources' field is non-empty, then this field must be set to 'SOURCE_RESTRICTION_ENABLED'. Possible values: ["SOURCE_RESTRICTION_UNSPECIFIED", "SOURCE_RESTRICTION_ENABLED", "SOURCE_RESTRICTION_DISABLED"] When `null`, the `source_restriction` field will be omitted from the resulting object.\n  - `sources` (`list[obj]`): Sources that this EgressPolicy authorizes access from. When `null`, the `sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter.status.egress_policies.egress_from.sources.new](#fn-statusstatusegress_policiessourcesnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `egress_from` sub block.\n', args=[]),
         new(
           identities=null,
-          identity_type=null
+          identity_type=null,
+          source_restriction=null,
+          sources=null
         ):: std.prune(a={
           identities: identities,
           identity_type: identity_type,
+          source_restriction: source_restriction,
+          sources: sources,
         }),
+        sources:: {
+          '#new':: d.fn(help='\n`google.access_context_manager_service_perimeter.status.egress_policies.egress_from.sources.new` constructs a new object with attributes and blocks configured for the `sources`\nTerraform sub block.\n\n\n\n**Args**:\n  - `access_level` (`string`): An AccessLevel resource name that allows resources outside the ServicePerimeter to be accessed from the inside. When `null`, the `access_level` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `sources` sub block.\n', args=[]),
+          new(
+            access_level=null
+          ):: std.prune(a={
+            access_level: access_level,
+          }),
+        },
       },
       egress_to:: {
         '#new':: d.fn(help='\n`google.access_context_manager_service_perimeter.status.egress_policies.egress_to.new` constructs a new object with attributes and blocks configured for the `egress_to`\nTerraform sub block.\n\n\n\n**Args**:\n  - `external_resources` (`list`): A list of external resources that are allowed to be accessed. A request\nmatches if it contains an external resource in this list (Example:\ns3://bucket/path). Currently '*' is not allowed. When `null`, the `external_resources` field will be omitted from the resulting object.\n  - `resources` (`list`): A list of resources, currently only projects in the form\n'projects/<projectnumber>', that match this to stanza. A request matches\nif it contains a resource in this list. If * is specified for resources,\nthen this 'EgressTo' rule will authorize access to all resources outside\nthe perimeter. When `null`, the `resources` field will be omitted from the resulting object.\n  - `operations` (`list[obj]`): A list of 'ApiOperations' that this egress rule applies to. A request matches\nif it contains an operation/service in this list. When `null`, the `operations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter.status.egress_policies.egress_to.operations.new](#fn-statusstatusegress_policiesoperationsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `egress_to` sub block.\n', args=[]),
diff --git a/4.x/_gen/resources/access_context_manager_service_perimeter_egress_policy.libsonnet b/4.x/_gen/resources/access_context_manager_service_perimeter_egress_policy.libsonnet
index b3f2f3e7..f50cb45c 100644
--- a/4.x/_gen/resources/access_context_manager_service_perimeter_egress_policy.libsonnet
+++ b/4.x/_gen/resources/access_context_manager_service_perimeter_egress_policy.libsonnet
@@ -3,14 +3,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='access_context_manager_service_perimeter_egress_policy', url='', help='`access_context_manager_service_perimeter_egress_policy` represents the `google_access_context_manager_service_perimeter_egress_policy` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
   egress_from:: {
-    '#new':: d.fn(help='\n`google.access_context_manager_service_perimeter_egress_policy.egress_from.new` constructs a new object with attributes and blocks configured for the `egress_from`\nTerraform sub block.\n\n\n\n**Args**:\n  - `identities` (`list`): A list of identities that are allowed access through this 'EgressPolicy'.\nShould be in the format of email address. The email address should\nrepresent individual user or service account only. When `null`, the `identities` field will be omitted from the resulting object.\n  - `identity_type` (`string`): Specifies the type of identities that are allowed access to outside the\nperimeter. If left unspecified, then members of 'identities' field will\nbe allowed access. Possible values: ["ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"] When `null`, the `identity_type` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `egress_from` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.access_context_manager_service_perimeter_egress_policy.egress_from.new` constructs a new object with attributes and blocks configured for the `egress_from`\nTerraform sub block.\n\n\n\n**Args**:\n  - `identities` (`list`): A list of identities that are allowed access through this 'EgressPolicy'.\nShould be in the format of email address. The email address should\nrepresent individual user or service account only. When `null`, the `identities` field will be omitted from the resulting object.\n  - `identity_type` (`string`): Specifies the type of identities that are allowed access to outside the\nperimeter. If left unspecified, then members of 'identities' field will\nbe allowed access. Possible values: ["ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"] When `null`, the `identity_type` field will be omitted from the resulting object.\n  - `source_restriction` (`string`): Whether to enforce traffic restrictions based on 'sources' field. If the 'sources' field is non-empty, then this field must be set to 'SOURCE_RESTRICTION_ENABLED'. Possible values: ["SOURCE_RESTRICTION_UNSPECIFIED", "SOURCE_RESTRICTION_ENABLED", "SOURCE_RESTRICTION_DISABLED"] When `null`, the `source_restriction` field will be omitted from the resulting object.\n  - `sources` (`list[obj]`): Sources that this EgressPolicy authorizes access from. When `null`, the `sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_egress_policy.egress_from.sources.new](#fn-egress_fromsourcesnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `egress_from` sub block.\n', args=[]),
     new(
       identities=null,
-      identity_type=null
+      identity_type=null,
+      source_restriction=null,
+      sources=null
     ):: std.prune(a={
       identities: identities,
       identity_type: identity_type,
+      source_restriction: source_restriction,
+      sources: sources,
     }),
+    sources:: {
+      '#new':: d.fn(help='\n`google.access_context_manager_service_perimeter_egress_policy.egress_from.sources.new` constructs a new object with attributes and blocks configured for the `sources`\nTerraform sub block.\n\n\n\n**Args**:\n  - `access_level` (`string`): An AccessLevel resource name that allows resources outside the ServicePerimeter to be accessed from the inside. When `null`, the `access_level` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `sources` sub block.\n', args=[]),
+      new(
+        access_level=null
+      ):: std.prune(a={
+        access_level: access_level,
+      }),
+    },
   },
   egress_to:: {
     '#new':: d.fn(help='\n`google.access_context_manager_service_perimeter_egress_policy.egress_to.new` constructs a new object with attributes and blocks configured for the `egress_to`\nTerraform sub block.\n\n\n\n**Args**:\n  - `external_resources` (`list`): A list of external resources that are allowed to be accessed. A request\nmatches if it contains an external resource in this list (Example:\ns3://bucket/path). Currently '*' is not allowed. When `null`, the `external_resources` field will be omitted from the resulting object.\n  - `resources` (`list`): A list of resources, currently only projects in the form\n'projects/<projectnumber>', that match this to stanza. A request matches\nif it contains a resource in this list. If * is specified for resources,\nthen this 'EgressTo' rule will authorize access to all resources outside\nthe perimeter. When `null`, the `resources` field will be omitted from the resulting object.\n  - `operations` (`list[obj]`): A list of 'ApiOperations' that this egress rule applies to. A request matches\nif it contains an operation/service in this list. When `null`, the `operations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_egress_policy.egress_to.operations.new](#fn-egress_tooperationsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `egress_to` sub block.\n', args=[]),
diff --git a/4.x/_gen/resources/access_context_manager_service_perimeters.libsonnet b/4.x/_gen/resources/access_context_manager_service_perimeters.libsonnet
index 46c5584b..c257f81c 100644
--- a/4.x/_gen/resources/access_context_manager_service_perimeters.libsonnet
+++ b/4.x/_gen/resources/access_context_manager_service_perimeters.libsonnet
@@ -47,14 +47,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     spec:: {
       egress_policies:: {
         egress_from:: {
-          '#new':: d.fn(help='\n`google.access_context_manager_service_perimeters.service_perimeters.spec.egress_policies.egress_from.new` constructs a new object with attributes and blocks configured for the `egress_from`\nTerraform sub block.\n\n\n\n**Args**:\n  - `identities` (`list`): A list of identities that are allowed access through this 'EgressPolicy'.\nShould be in the format of email address. The email address should\nrepresent individual user or service account only. When `null`, the `identities` field will be omitted from the resulting object.\n  - `identity_type` (`string`): Specifies the type of identities that are allowed access to outside the\nperimeter. If left unspecified, then members of 'identities' field will\nbe allowed access. Possible values: ["IDENTITY_TYPE_UNSPECIFIED", "ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"] When `null`, the `identity_type` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `egress_from` sub block.\n', args=[]),
+          '#new':: d.fn(help='\n`google.access_context_manager_service_perimeters.service_perimeters.spec.egress_policies.egress_from.new` constructs a new object with attributes and blocks configured for the `egress_from`\nTerraform sub block.\n\n\n\n**Args**:\n  - `identities` (`list`): A list of identities that are allowed access through this 'EgressPolicy'.\nShould be in the format of email address. The email address should\nrepresent individual user or service account only. When `null`, the `identities` field will be omitted from the resulting object.\n  - `identity_type` (`string`): Specifies the type of identities that are allowed access to outside the\nperimeter. If left unspecified, then members of 'identities' field will\nbe allowed access. Possible values: ["IDENTITY_TYPE_UNSPECIFIED", "ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"] When `null`, the `identity_type` field will be omitted from the resulting object.\n  - `source_restriction` (`string`): Whether to enforce traffic restrictions based on 'sources' field. If the 'sources' field is non-empty, then this field must be set to 'SOURCE_RESTRICTION_ENABLED'. Possible values: ["SOURCE_RESTRICTION_UNSPECIFIED", "SOURCE_RESTRICTION_ENABLED", "SOURCE_RESTRICTION_DISABLED"] When `null`, the `source_restriction` field will be omitted from the resulting object.\n  - `sources` (`list[obj]`): Sources that this EgressPolicy authorizes access from. When `null`, the `sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeters.service_perimeters.spec.egress_policies.egress_from.sources.new](#fn-service_perimetersservice_perimetersspecegress_policiessourcesnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `egress_from` sub block.\n', args=[]),
           new(
             identities=null,
-            identity_type=null
+            identity_type=null,
+            source_restriction=null,
+            sources=null
           ):: std.prune(a={
             identities: identities,
             identity_type: identity_type,
+            source_restriction: source_restriction,
+            sources: sources,
           }),
+          sources:: {
+            '#new':: d.fn(help='\n`google.access_context_manager_service_perimeters.service_perimeters.spec.egress_policies.egress_from.sources.new` constructs a new object with attributes and blocks configured for the `sources`\nTerraform sub block.\n\n\n\n**Args**:\n  - `access_level` (`string`): An AccessLevel resource name that allows resources outside the ServicePerimeter to be accessed from the inside. When `null`, the `access_level` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `sources` sub block.\n', args=[]),
+            new(
+              access_level=null
+            ):: std.prune(a={
+              access_level: access_level,
+            }),
+          },
         },
         egress_to:: {
           '#new':: d.fn(help='\n`google.access_context_manager_service_perimeters.service_perimeters.spec.egress_policies.egress_to.new` constructs a new object with attributes and blocks configured for the `egress_to`\nTerraform sub block.\n\n\n\n**Args**:\n  - `external_resources` (`list`): A list of external resources that are allowed to be accessed. A request\nmatches if it contains an external resource in this list (Example:\ns3://bucket/path). Currently '*' is not allowed. When `null`, the `external_resources` field will be omitted from the resulting object.\n  - `resources` (`list`): A list of resources, currently only projects in the form\n'projects/<projectnumber>', that match this to stanza. A request matches\nif it contains a resource in this list. If * is specified for resources,\nthen this 'EgressTo' rule will authorize access to all resources outside\nthe perimeter. When `null`, the `resources` field will be omitted from the resulting object.\n  - `operations` (`list[obj]`): A list of 'ApiOperations' that this egress rule applies to. A request matches\nif it contains an operation/service in this list. When `null`, the `operations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeters.service_perimeters.spec.egress_policies.egress_to.operations.new](#fn-service_perimetersservice_perimetersspecegress_policiesoperationsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `egress_to` sub block.\n', args=[]),
@@ -189,14 +201,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     status:: {
       egress_policies:: {
         egress_from:: {
-          '#new':: d.fn(help='\n`google.access_context_manager_service_perimeters.service_perimeters.status.egress_policies.egress_from.new` constructs a new object with attributes and blocks configured for the `egress_from`\nTerraform sub block.\n\n\n\n**Args**:\n  - `identities` (`list`): A list of identities that are allowed access through this 'EgressPolicy'.\nShould be in the format of email address. The email address should\nrepresent individual user or service account only. When `null`, the `identities` field will be omitted from the resulting object.\n  - `identity_type` (`string`): Specifies the type of identities that are allowed access to outside the\nperimeter. If left unspecified, then members of 'identities' field will\nbe allowed access. Possible values: ["IDENTITY_TYPE_UNSPECIFIED", "ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"] When `null`, the `identity_type` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `egress_from` sub block.\n', args=[]),
+          '#new':: d.fn(help='\n`google.access_context_manager_service_perimeters.service_perimeters.status.egress_policies.egress_from.new` constructs a new object with attributes and blocks configured for the `egress_from`\nTerraform sub block.\n\n\n\n**Args**:\n  - `identities` (`list`): A list of identities that are allowed access through this 'EgressPolicy'.\nShould be in the format of email address. The email address should\nrepresent individual user or service account only. When `null`, the `identities` field will be omitted from the resulting object.\n  - `identity_type` (`string`): Specifies the type of identities that are allowed access to outside the\nperimeter. If left unspecified, then members of 'identities' field will\nbe allowed access. Possible values: ["IDENTITY_TYPE_UNSPECIFIED", "ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"] When `null`, the `identity_type` field will be omitted from the resulting object.\n  - `source_restriction` (`string`): Whether to enforce traffic restrictions based on 'sources' field. If the 'sources' field is non-empty, then this field must be set to 'SOURCE_RESTRICTION_ENABLED'. Possible values: ["SOURCE_RESTRICTION_UNSPECIFIED", "SOURCE_RESTRICTION_ENABLED", "SOURCE_RESTRICTION_DISABLED"] When `null`, the `source_restriction` field will be omitted from the resulting object.\n  - `sources` (`list[obj]`): Sources that this EgressPolicy authorizes access from. When `null`, the `sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeters.service_perimeters.status.egress_policies.egress_from.sources.new](#fn-service_perimetersservice_perimetersstatusegress_policiessourcesnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `egress_from` sub block.\n', args=[]),
           new(
             identities=null,
-            identity_type=null
+            identity_type=null,
+            source_restriction=null,
+            sources=null
           ):: std.prune(a={
             identities: identities,
             identity_type: identity_type,
+            source_restriction: source_restriction,
+            sources: sources,
           }),
+          sources:: {
+            '#new':: d.fn(help='\n`google.access_context_manager_service_perimeters.service_perimeters.status.egress_policies.egress_from.sources.new` constructs a new object with attributes and blocks configured for the `sources`\nTerraform sub block.\n\n\n\n**Args**:\n  - `access_level` (`string`): An AccessLevel resource name that allows resources outside the ServicePerimeter to be accessed from the inside. When `null`, the `access_level` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `sources` sub block.\n', args=[]),
+            new(
+              access_level=null
+            ):: std.prune(a={
+              access_level: access_level,
+            }),
+          },
         },
         egress_to:: {
           '#new':: d.fn(help='\n`google.access_context_manager_service_perimeters.service_perimeters.status.egress_policies.egress_to.new` constructs a new object with attributes and blocks configured for the `egress_to`\nTerraform sub block.\n\n\n\n**Args**:\n  - `external_resources` (`list`): A list of external resources that are allowed to be accessed. A request\nmatches if it contains an external resource in this list (Example:\ns3://bucket/path). Currently '*' is not allowed. When `null`, the `external_resources` field will be omitted from the resulting object.\n  - `resources` (`list`): A list of resources, currently only projects in the form\n'projects/<projectnumber>', that match this to stanza. A request matches\nif it contains a resource in this list. If * is specified for resources,\nthen this 'EgressTo' rule will authorize access to all resources outside\nthe perimeter. When `null`, the `resources` field will be omitted from the resulting object.\n  - `operations` (`list[obj]`): A list of 'ApiOperations' that this egress rule applies to. A request matches\nif it contains an operation/service in this list. When `null`, the `operations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeters.service_perimeters.status.egress_policies.egress_to.operations.new](#fn-service_perimetersservice_perimetersstatusegress_policiesoperationsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `egress_to` sub block.\n', args=[]),
diff --git a/4.x/_gen/resources/active_directory_domain.libsonnet b/4.x/_gen/resources/active_directory_domain.libsonnet
index 24678f10..e834e123 100644
--- a/4.x/_gen/resources/active_directory_domain.libsonnet
+++ b/4.x/_gen/resources/active_directory_domain.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='active_directory_domain', url='', help='`active_directory_domain` represents the `google_active_directory_domain` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.active_directory_domain.new` injects a new `google_active_directory_domain` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.active_directory_domain.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.active_directory_domain` using the reference:\n\n    $._ref.google_active_directory_domain.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_active_directory_domain.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `admin` (`string`): The name of delegated administrator account used to perform Active Directory operations.\nIf not specified, setupadmin will be used. When `null`, the `admin` field will be omitted from the resulting object.\n  - `authorized_networks` (`list`): The full names of the Google Compute Engine networks the domain instance is connected to. The domain is only available on networks listed in authorizedNetworks.\nIf CIDR subnets overlap between networks, domain creation will fail. When `null`, the `authorized_networks` field will be omitted from the resulting object.\n  - `domain_name` (`string`): The fully qualified domain name. e.g. mydomain.myorganization.com, with the restrictions,\nhttps://cloud.google.com/managed-microsoft-ad/reference/rest/v1/projects.locations.global.domains.\n  - `labels` (`obj`): Resource labels that can contain user-provided metadata When `null`, the `labels` field will be omitted from the resulting object.\n  - `locations` (`list`): Locations where domain needs to be provisioned. [regions][compute/docs/regions-zones/]\ne.g. us-west1 or us-east4 Service supports up to 4 locations at once. Each location will use a /26 block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `reserved_ip_range` (`string`): The CIDR range of internal addresses that are reserved for this domain. Reserved networks must be /24 or larger.\nRanges must be unique and non-overlapping with existing subnets in authorizedNetworks\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.active_directory_domain.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.active_directory_domain.new` injects a new `google_active_directory_domain` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.active_directory_domain.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.active_directory_domain` using the reference:\n\n    $._ref.google_active_directory_domain.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_active_directory_domain.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `admin` (`string`): The name of delegated administrator account used to perform Active Directory operations.\nIf not specified, setupadmin will be used. When `null`, the `admin` field will be omitted from the resulting object.\n  - `authorized_networks` (`list`): The full names of the Google Compute Engine networks the domain instance is connected to. The domain is only available on networks listed in authorizedNetworks.\nIf CIDR subnets overlap between networks, domain creation will fail. When `null`, the `authorized_networks` field will be omitted from the resulting object.\n  - `domain_name` (`string`): The fully qualified domain name. e.g. mydomain.myorganization.com, with the restrictions,\nhttps://cloud.google.com/managed-microsoft-ad/reference/rest/v1/projects.locations.global.domains.\n  - `labels` (`obj`): Resource labels that can contain user-provided metadata\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `locations` (`list`): Locations where domain needs to be provisioned. [regions][compute/docs/regions-zones/]\ne.g. us-west1 or us-east4 Service supports up to 4 locations at once. Each location will use a /26 block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `reserved_ip_range` (`string`): The CIDR range of internal addresses that are reserved for this domain. Reserved networks must be /24 or larger.\nRanges must be unique and non-overlapping with existing subnets in authorizedNetworks\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.active_directory_domain.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     domain_name,
@@ -29,7 +29,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.active_directory_domain.newAttrs` constructs a new object with attributes and blocks configured for the `active_directory_domain`\nTerraform resource.\n\nUnlike [google.active_directory_domain.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `admin` (`string`): The name of delegated administrator account used to perform Active Directory operations.\nIf not specified, setupadmin will be used. When `null`, the `admin` field will be omitted from the resulting object.\n  - `authorized_networks` (`list`): The full names of the Google Compute Engine networks the domain instance is connected to. The domain is only available on networks listed in authorizedNetworks.\nIf CIDR subnets overlap between networks, domain creation will fail. When `null`, the `authorized_networks` field will be omitted from the resulting object.\n  - `domain_name` (`string`): The fully qualified domain name. e.g. mydomain.myorganization.com, with the restrictions,\nhttps://cloud.google.com/managed-microsoft-ad/reference/rest/v1/projects.locations.global.domains.\n  - `labels` (`obj`): Resource labels that can contain user-provided metadata When `null`, the `labels` field will be omitted from the resulting object.\n  - `locations` (`list`): Locations where domain needs to be provisioned. [regions][compute/docs/regions-zones/]\ne.g. us-west1 or us-east4 Service supports up to 4 locations at once. Each location will use a /26 block.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `reserved_ip_range` (`string`): The CIDR range of internal addresses that are reserved for this domain. Reserved networks must be /24 or larger.\nRanges must be unique and non-overlapping with existing subnets in authorizedNetworks\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.active_directory_domain.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `active_directory_domain` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.active_directory_domain.newAttrs` constructs a new object with attributes and blocks configured for the `active_directory_domain`\nTerraform resource.\n\nUnlike [google.active_directory_domain.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `admin` (`string`): The name of delegated administrator account used to perform Active Directory operations.\nIf not specified, setupadmin will be used. When `null`, the `admin` field will be omitted from the resulting object.\n  - `authorized_networks` (`list`): The full names of the Google Compute Engine networks the domain instance is connected to. The domain is only available on networks listed in authorizedNetworks.\nIf CIDR subnets overlap between networks, domain creation will fail. When `null`, the `authorized_networks` field will be omitted from the resulting object.\n  - `domain_name` (`string`): The fully qualified domain name. e.g. mydomain.myorganization.com, with the restrictions,\nhttps://cloud.google.com/managed-microsoft-ad/reference/rest/v1/projects.locations.global.domains.\n  - `labels` (`obj`): Resource labels that can contain user-provided metadata\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `locations` (`list`): Locations where domain needs to be provisioned. [regions][compute/docs/regions-zones/]\ne.g. us-west1 or us-east4 Service supports up to 4 locations at once. Each location will use a /26 block.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `reserved_ip_range` (`string`): The CIDR range of internal addresses that are reserved for this domain. Reserved networks must be /24 or larger.\nRanges must be unique and non-overlapping with existing subnets in authorizedNetworks\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.active_directory_domain.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `active_directory_domain` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     domain_name,
     locations,
diff --git a/4.x/_gen/resources/alloydb_backup.libsonnet b/4.x/_gen/resources/alloydb_backup.libsonnet
index cb2f5002..27b7d57c 100644
--- a/4.x/_gen/resources/alloydb_backup.libsonnet
+++ b/4.x/_gen/resources/alloydb_backup.libsonnet
@@ -10,52 +10,64 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       kms_key_name: kms_key_name,
     }),
   },
-  '#new':: d.fn(help="\n`google.alloydb_backup.new` injects a new `google_alloydb_backup` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.alloydb_backup.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.alloydb_backup` using the reference:\n\n    $._ref.google_alloydb_backup.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_alloydb_backup.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `backup_id` (`string`): The ID of the alloydb backup.\n  - `cluster_name` (`string`): The full resource name of the backup source cluster (e.g., projects/{project}/locations/{location}/clusters/{clusterId}).\n  - `description` (`string`): User-provided description of the backup. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the alloydb backup. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the alloydb backup should reside.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `encryption_config` (`list[obj]`): EncryptionConfig describes the encryption config of a cluster or a backup that is encrypted with a CMEK (customer-managed encryption key). When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_backup.encryption_config.new](#fn-encryption_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_backup.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.alloydb_backup.new` injects a new `google_alloydb_backup` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.alloydb_backup.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.alloydb_backup` using the reference:\n\n    $._ref.google_alloydb_backup.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_alloydb_backup.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels. https://google.aip.dev/128\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field \u0026#39;effective_annotations\u0026#39; for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `backup_id` (`string`): The ID of the alloydb backup.\n  - `cluster_name` (`string`): The full resource name of the backup source cluster (e.g., projects/{project}/locations/{location}/clusters/{clusterId}).\n  - `description` (`string`): User-provided description of the backup. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User-settable and human-readable display name for the Backup. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the alloydb backup. An object containing a list of \u0026#34;key\u0026#34;: value pairs. Example: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the alloydb backup should reside.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `type` (`string`): The backup type, which suggests the trigger for the backup. Possible values: [\u0026#34;TYPE_UNSPECIFIED\u0026#34;, \u0026#34;ON_DEMAND\u0026#34;, \u0026#34;AUTOMATED\u0026#34;, \u0026#34;CONTINUOUS\u0026#34;] When `null`, the `type` field will be omitted from the resulting object.\n  - `encryption_config` (`list[obj]`): EncryptionConfig describes the encryption config of a cluster or a backup that is encrypted with a CMEK (customer-managed encryption key). When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_backup.encryption_config.new](#fn-encryption_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_backup.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     backup_id,
     cluster_name,
     location,
+    annotations=null,
     description=null,
+    display_name=null,
     encryption_config=null,
     labels=null,
     project=null,
     timeouts=null,
+    type=null,
     _meta={}
   ):: tf.withResource(
     type='google_alloydb_backup',
     label=resourceLabel,
     attrs=self.newAttrs(
+      annotations=annotations,
       backup_id=backup_id,
       cluster_name=cluster_name,
       description=description,
+      display_name=display_name,
       encryption_config=encryption_config,
       labels=labels,
       location=location,
       project=project,
-      timeouts=timeouts
+      timeouts=timeouts,
+      type=type
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.alloydb_backup.newAttrs` constructs a new object with attributes and blocks configured for the `alloydb_backup`\nTerraform resource.\n\nUnlike [google.alloydb_backup.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `backup_id` (`string`): The ID of the alloydb backup.\n  - `cluster_name` (`string`): The full resource name of the backup source cluster (e.g., projects/{project}/locations/{location}/clusters/{clusterId}).\n  - `description` (`string`): User-provided description of the backup. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the alloydb backup. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the alloydb backup should reside.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `encryption_config` (`list[obj]`): EncryptionConfig describes the encryption config of a cluster or a backup that is encrypted with a CMEK (customer-managed encryption key). When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_backup.encryption_config.new](#fn-encryption_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_backup.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `alloydb_backup` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.alloydb_backup.newAttrs` constructs a new object with attributes and blocks configured for the `alloydb_backup`\nTerraform resource.\n\nUnlike [google.alloydb_backup.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels. https://google.aip.dev/128\nAn object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `backup_id` (`string`): The ID of the alloydb backup.\n  - `cluster_name` (`string`): The full resource name of the backup source cluster (e.g., projects/{project}/locations/{location}/clusters/{clusterId}).\n  - `description` (`string`): User-provided description of the backup. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User-settable and human-readable display name for the Backup. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the alloydb backup. An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the alloydb backup should reside.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `type` (`string`): The backup type, which suggests the trigger for the backup. Possible values: ["TYPE_UNSPECIFIED", "ON_DEMAND", "AUTOMATED", "CONTINUOUS"] When `null`, the `type` field will be omitted from the resulting object.\n  - `encryption_config` (`list[obj]`): EncryptionConfig describes the encryption config of a cluster or a backup that is encrypted with a CMEK (customer-managed encryption key). When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_backup.encryption_config.new](#fn-encryption_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_backup.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `alloydb_backup` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     backup_id,
     cluster_name,
     location,
+    annotations=null,
     description=null,
+    display_name=null,
     encryption_config=null,
     labels=null,
     project=null,
-    timeouts=null
+    timeouts=null,
+    type=null
   ):: std.prune(a={
+    annotations: annotations,
     backup_id: backup_id,
     cluster_name: cluster_name,
     description: description,
+    display_name: display_name,
     encryption_config: encryption_config,
     labels: labels,
     location: location,
     project: project,
     timeouts: timeouts,
+    type: type,
   }),
   timeouts:: {
     '#new':: d.fn(help='\n`google.alloydb_backup.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
@@ -69,6 +81,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       update: update,
     }),
   },
+  '#withAnnotations':: d.fn(help='`google.obj.withAnnotations` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the annotations field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `annotations` field.\n', args=[]),
+  withAnnotations(resourceLabel, value): {
+    resource+: {
+      google_alloydb_backup+: {
+        [resourceLabel]+: {
+          annotations: value,
+        },
+      },
+    },
+  },
   '#withBackupId':: d.fn(help='`google.string.withBackupId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the backup_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `backup_id` field.\n', args=[]),
   withBackupId(resourceLabel, value): {
     resource+: {
@@ -99,6 +121,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withDisplayName':: d.fn(help='`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the display_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `display_name` field.\n', args=[]),
+  withDisplayName(resourceLabel, value): {
+    resource+: {
+      google_alloydb_backup+: {
+        [resourceLabel]+: {
+          display_name: value,
+        },
+      },
+    },
+  },
   '#withEncryptionConfig':: d.fn(help='`google.list[obj].withEncryptionConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the encryption_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withEncryptionConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `encryption_config` field.\n', args=[]),
   withEncryptionConfig(resourceLabel, value): {
     resource+: {
@@ -169,4 +201,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withType':: d.fn(help='`google.string.withType` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the type field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `type` field.\n', args=[]),
+  withType(resourceLabel, value): {
+    resource+: {
+      google_alloydb_backup+: {
+        [resourceLabel]+: {
+          type: value,
+        },
+      },
+    },
+  },
 }
diff --git a/4.x/_gen/resources/alloydb_cluster.libsonnet b/4.x/_gen/resources/alloydb_cluster.libsonnet
index 5f1bd7ff..da54df36 100644
--- a/4.x/_gen/resources/alloydb_cluster.libsonnet
+++ b/4.x/_gen/resources/alloydb_cluster.libsonnet
@@ -120,15 +120,19 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       network: network,
     }),
   },
-  '#new':: d.fn(help="\n`google.alloydb_cluster.new` injects a new `google_alloydb_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.alloydb_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.alloydb_cluster` using the reference:\n\n    $._ref.google_alloydb_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_alloydb_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `cluster_id` (`string`): The ID of the alloydb cluster.\n  - `display_name` (`string`): User-settable and human-readable display name for the Cluster. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the alloydb cluster. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the alloydb cluster should reside.\n  - `network` (`string`): The relative resource name of the VPC network on which the instance can be accessed. It is specified in the following form:\n\n\u0026#34;projects/{projectNumber}/global/networks/{network_id}\u0026#34;. When `null`, the `network` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `automated_backup_policy` (`list[obj]`): The automated backup policy for this cluster. AutomatedBackupPolicy is disabled by default. When `null`, the `automated_backup_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.automated_backup_policy.new](#fn-automated_backup_policynew) constructor.\n  - `continuous_backup_config` (`list[obj]`): The continuous backup config for this cluster.\n\nIf no policy is provided then the default policy will be used. The default policy takes one backup a day and retains backups for 14 days. When `null`, the `continuous_backup_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.continuous_backup_config.new](#fn-continuous_backup_confignew) constructor.\n  - `encryption_config` (`list[obj]`): EncryptionConfig describes the encryption config of a cluster or a backup that is encrypted with a CMEK (customer-managed encryption key). When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.encryption_config.new](#fn-encryption_confignew) constructor.\n  - `initial_user` (`list[obj]`): Initial user to setup during cluster creation. When `null`, the `initial_user` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.initial_user.new](#fn-initial_usernew) constructor.\n  - `network_config` (`list[obj]`): Metadata related to network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.network_config.new](#fn-network_confignew) constructor.\n  - `restore_backup_source` (`list[obj]`): The source when restoring from a backup. Conflicts with \u0026#39;restore_continuous_backup_source\u0026#39;, both can\u0026#39;t be set together. When `null`, the `restore_backup_source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.restore_backup_source.new](#fn-restore_backup_sourcenew) constructor.\n  - `restore_continuous_backup_source` (`list[obj]`): The source when restoring via point in time recovery (PITR). Conflicts with \u0026#39;restore_backup_source\u0026#39;, both can\u0026#39;t be set together. When `null`, the `restore_continuous_backup_source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.restore_continuous_backup_source.new](#fn-restore_continuous_backup_sourcenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.alloydb_cluster.new` injects a new `google_alloydb_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.alloydb_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.alloydb_cluster` using the reference:\n\n    $._ref.google_alloydb_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_alloydb_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels. https://google.aip.dev/128\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field \u0026#39;effective_annotations\u0026#39; for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `cluster_id` (`string`): The ID of the alloydb cluster.\n  - `cluster_type` (`string`): The type of cluster. If not set, defaults to PRIMARY. Default value: \u0026#34;PRIMARY\u0026#34; Possible values: [\u0026#34;PRIMARY\u0026#34;, \u0026#34;SECONDARY\u0026#34;] When `null`, the `cluster_type` field will be omitted from the resulting object.\n  - `deletion_policy` (`string`): Policy to determine if the cluster should be deleted forcefully.\nDeleting a cluster forcefully, deletes the cluster and all its associated instances within the cluster.\nDeleting a Secondary cluster with a secondary instance REQUIRES setting deletion_policy = \u0026#34;FORCE\u0026#34; otherwise an error is returned. This is needed as there is no support to delete just the secondary instance, and the only way to delete secondary instance is to delete the associated secondary cluster forcefully which also deletes the secondary instance. When `null`, the `deletion_policy` field will be omitted from the resulting object.\n  - `display_name` (`string`): User-settable and human-readable display name for the Cluster. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `etag` (`string`): For Resource freshness validation (https://google.aip.dev/154) When `null`, the `etag` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the alloydb cluster.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the alloydb cluster should reside.\n  - `network` (`string`): The relative resource name of the VPC network on which the instance can be accessed. It is specified in the following form:\n\n\u0026#34;projects/{projectNumber}/global/networks/{network_id}\u0026#34;. When `null`, the `network` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `automated_backup_policy` (`list[obj]`): The automated backup policy for this cluster. AutomatedBackupPolicy is disabled by default. When `null`, the `automated_backup_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.automated_backup_policy.new](#fn-automated_backup_policynew) constructor.\n  - `continuous_backup_config` (`list[obj]`): The continuous backup config for this cluster.\n\nIf no policy is provided then the default policy will be used. The default policy takes one backup a day and retains backups for 14 days. When `null`, the `continuous_backup_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.continuous_backup_config.new](#fn-continuous_backup_confignew) constructor.\n  - `encryption_config` (`list[obj]`): EncryptionConfig describes the encryption config of a cluster or a backup that is encrypted with a CMEK (customer-managed encryption key). When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.encryption_config.new](#fn-encryption_confignew) constructor.\n  - `initial_user` (`list[obj]`): Initial user to setup during cluster creation. When `null`, the `initial_user` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.initial_user.new](#fn-initial_usernew) constructor.\n  - `network_config` (`list[obj]`): Metadata related to network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.network_config.new](#fn-network_confignew) constructor.\n  - `restore_backup_source` (`list[obj]`): The source when restoring from a backup. Conflicts with \u0026#39;restore_continuous_backup_source\u0026#39;, both can\u0026#39;t be set together. When `null`, the `restore_backup_source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.restore_backup_source.new](#fn-restore_backup_sourcenew) constructor.\n  - `restore_continuous_backup_source` (`list[obj]`): The source when restoring via point in time recovery (PITR). Conflicts with \u0026#39;restore_backup_source\u0026#39;, both can\u0026#39;t be set together. When `null`, the `restore_continuous_backup_source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.restore_continuous_backup_source.new](#fn-restore_continuous_backup_sourcenew) constructor.\n  - `secondary_config` (`list[obj]`): Configuration of the secondary cluster for Cross Region Replication. This should be set if and only if the cluster is of type SECONDARY. When `null`, the `secondary_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.secondary_config.new](#fn-secondary_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     cluster_id,
     location,
+    annotations=null,
     automated_backup_policy=null,
+    cluster_type=null,
     continuous_backup_config=null,
+    deletion_policy=null,
     display_name=null,
     encryption_config=null,
+    etag=null,
     initial_user=null,
     labels=null,
     network=null,
@@ -136,17 +140,22 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project=null,
     restore_backup_source=null,
     restore_continuous_backup_source=null,
+    secondary_config=null,
     timeouts=null,
     _meta={}
   ):: tf.withResource(
     type='google_alloydb_cluster',
     label=resourceLabel,
     attrs=self.newAttrs(
+      annotations=annotations,
       automated_backup_policy=automated_backup_policy,
       cluster_id=cluster_id,
+      cluster_type=cluster_type,
       continuous_backup_config=continuous_backup_config,
+      deletion_policy=deletion_policy,
       display_name=display_name,
       encryption_config=encryption_config,
+      etag=etag,
       initial_user=initial_user,
       labels=labels,
       location=location,
@@ -155,18 +164,23 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       project=project,
       restore_backup_source=restore_backup_source,
       restore_continuous_backup_source=restore_continuous_backup_source,
+      secondary_config=secondary_config,
       timeouts=timeouts
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.alloydb_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `alloydb_cluster`\nTerraform resource.\n\nUnlike [google.alloydb_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `cluster_id` (`string`): The ID of the alloydb cluster.\n  - `display_name` (`string`): User-settable and human-readable display name for the Cluster. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the alloydb cluster. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the alloydb cluster should reside.\n  - `network` (`string`): The relative resource name of the VPC network on which the instance can be accessed. It is specified in the following form:\n\n"projects/{projectNumber}/global/networks/{network_id}". When `null`, the `network` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `automated_backup_policy` (`list[obj]`): The automated backup policy for this cluster. AutomatedBackupPolicy is disabled by default. When `null`, the `automated_backup_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.automated_backup_policy.new](#fn-automated_backup_policynew) constructor.\n  - `continuous_backup_config` (`list[obj]`): The continuous backup config for this cluster.\n\nIf no policy is provided then the default policy will be used. The default policy takes one backup a day and retains backups for 14 days. When `null`, the `continuous_backup_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.continuous_backup_config.new](#fn-continuous_backup_confignew) constructor.\n  - `encryption_config` (`list[obj]`): EncryptionConfig describes the encryption config of a cluster or a backup that is encrypted with a CMEK (customer-managed encryption key). When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.encryption_config.new](#fn-encryption_confignew) constructor.\n  - `initial_user` (`list[obj]`): Initial user to setup during cluster creation. When `null`, the `initial_user` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.initial_user.new](#fn-initial_usernew) constructor.\n  - `network_config` (`list[obj]`): Metadata related to network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.network_config.new](#fn-network_confignew) constructor.\n  - `restore_backup_source` (`list[obj]`): The source when restoring from a backup. Conflicts with 'restore_continuous_backup_source', both can't be set together. When `null`, the `restore_backup_source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.restore_backup_source.new](#fn-restore_backup_sourcenew) constructor.\n  - `restore_continuous_backup_source` (`list[obj]`): The source when restoring via point in time recovery (PITR). Conflicts with 'restore_backup_source', both can't be set together. When `null`, the `restore_continuous_backup_source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.restore_continuous_backup_source.new](#fn-restore_continuous_backup_sourcenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `alloydb_cluster` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.alloydb_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `alloydb_cluster`\nTerraform resource.\n\nUnlike [google.alloydb_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels. https://google.aip.dev/128\nAn object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `cluster_id` (`string`): The ID of the alloydb cluster.\n  - `cluster_type` (`string`): The type of cluster. If not set, defaults to PRIMARY. Default value: "PRIMARY" Possible values: ["PRIMARY", "SECONDARY"] When `null`, the `cluster_type` field will be omitted from the resulting object.\n  - `deletion_policy` (`string`): Policy to determine if the cluster should be deleted forcefully.\nDeleting a cluster forcefully, deletes the cluster and all its associated instances within the cluster.\nDeleting a Secondary cluster with a secondary instance REQUIRES setting deletion_policy = "FORCE" otherwise an error is returned. This is needed as there is no support to delete just the secondary instance, and the only way to delete secondary instance is to delete the associated secondary cluster forcefully which also deletes the secondary instance. When `null`, the `deletion_policy` field will be omitted from the resulting object.\n  - `display_name` (`string`): User-settable and human-readable display name for the Cluster. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `etag` (`string`): For Resource freshness validation (https://google.aip.dev/154) When `null`, the `etag` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the alloydb cluster.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the alloydb cluster should reside.\n  - `network` (`string`): The relative resource name of the VPC network on which the instance can be accessed. It is specified in the following form:\n\n"projects/{projectNumber}/global/networks/{network_id}". When `null`, the `network` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `automated_backup_policy` (`list[obj]`): The automated backup policy for this cluster. AutomatedBackupPolicy is disabled by default. When `null`, the `automated_backup_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.automated_backup_policy.new](#fn-automated_backup_policynew) constructor.\n  - `continuous_backup_config` (`list[obj]`): The continuous backup config for this cluster.\n\nIf no policy is provided then the default policy will be used. The default policy takes one backup a day and retains backups for 14 days. When `null`, the `continuous_backup_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.continuous_backup_config.new](#fn-continuous_backup_confignew) constructor.\n  - `encryption_config` (`list[obj]`): EncryptionConfig describes the encryption config of a cluster or a backup that is encrypted with a CMEK (customer-managed encryption key). When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.encryption_config.new](#fn-encryption_confignew) constructor.\n  - `initial_user` (`list[obj]`): Initial user to setup during cluster creation. When `null`, the `initial_user` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.initial_user.new](#fn-initial_usernew) constructor.\n  - `network_config` (`list[obj]`): Metadata related to network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.network_config.new](#fn-network_confignew) constructor.\n  - `restore_backup_source` (`list[obj]`): The source when restoring from a backup. Conflicts with 'restore_continuous_backup_source', both can't be set together. When `null`, the `restore_backup_source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.restore_backup_source.new](#fn-restore_backup_sourcenew) constructor.\n  - `restore_continuous_backup_source` (`list[obj]`): The source when restoring via point in time recovery (PITR). Conflicts with 'restore_backup_source', both can't be set together. When `null`, the `restore_continuous_backup_source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.restore_continuous_backup_source.new](#fn-restore_continuous_backup_sourcenew) constructor.\n  - `secondary_config` (`list[obj]`): Configuration of the secondary cluster for Cross Region Replication. This should be set if and only if the cluster is of type SECONDARY. When `null`, the `secondary_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.secondary_config.new](#fn-secondary_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `alloydb_cluster` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     cluster_id,
     location,
+    annotations=null,
     automated_backup_policy=null,
+    cluster_type=null,
     continuous_backup_config=null,
+    deletion_policy=null,
     display_name=null,
     encryption_config=null,
+    etag=null,
     initial_user=null,
     labels=null,
     network=null,
@@ -174,13 +188,18 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project=null,
     restore_backup_source=null,
     restore_continuous_backup_source=null,
+    secondary_config=null,
     timeouts=null
   ):: std.prune(a={
+    annotations: annotations,
     automated_backup_policy: automated_backup_policy,
     cluster_id: cluster_id,
+    cluster_type: cluster_type,
     continuous_backup_config: continuous_backup_config,
+    deletion_policy: deletion_policy,
     display_name: display_name,
     encryption_config: encryption_config,
+    etag: etag,
     initial_user: initial_user,
     labels: labels,
     location: location,
@@ -189,6 +208,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project: project,
     restore_backup_source: restore_backup_source,
     restore_continuous_backup_source: restore_continuous_backup_source,
+    secondary_config: secondary_config,
     timeouts: timeouts,
   }),
   restore_backup_source:: {
@@ -209,6 +229,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       point_in_time: point_in_time,
     }),
   },
+  secondary_config:: {
+    '#new':: d.fn(help='\n`google.alloydb_cluster.secondary_config.new` constructs a new object with attributes and blocks configured for the `secondary_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `primary_cluster_name` (`string`): Name of the primary cluster must be in the format\n'projects/{project}/locations/{location}/clusters/{cluster_id}'\n\n**Returns**:\n  - An attribute object that represents the `secondary_config` sub block.\n', args=[]),
+    new(
+      primary_cluster_name
+    ):: std.prune(a={
+      primary_cluster_name: primary_cluster_name,
+    }),
+  },
   timeouts:: {
     '#new':: d.fn(help='\n`google.alloydb_cluster.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
     new(
@@ -221,6 +249,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       update: update,
     }),
   },
+  '#withAnnotations':: d.fn(help='`google.obj.withAnnotations` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the annotations field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `annotations` field.\n', args=[]),
+  withAnnotations(resourceLabel, value): {
+    resource+: {
+      google_alloydb_cluster+: {
+        [resourceLabel]+: {
+          annotations: value,
+        },
+      },
+    },
+  },
   '#withAutomatedBackupPolicy':: d.fn(help='`google.list[obj].withAutomatedBackupPolicy` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the automated_backup_policy field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withAutomatedBackupPolicyMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `automated_backup_policy` field.\n', args=[]),
   withAutomatedBackupPolicy(resourceLabel, value): {
     resource+: {
@@ -251,6 +289,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withClusterType':: d.fn(help='`google.string.withClusterType` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the cluster_type field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `cluster_type` field.\n', args=[]),
+  withClusterType(resourceLabel, value): {
+    resource+: {
+      google_alloydb_cluster+: {
+        [resourceLabel]+: {
+          cluster_type: value,
+        },
+      },
+    },
+  },
   '#withContinuousBackupConfig':: d.fn(help='`google.list[obj].withContinuousBackupConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the continuous_backup_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withContinuousBackupConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `continuous_backup_config` field.\n', args=[]),
   withContinuousBackupConfig(resourceLabel, value): {
     resource+: {
@@ -271,6 +319,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withDeletionPolicy':: d.fn(help='`google.string.withDeletionPolicy` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the deletion_policy field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `deletion_policy` field.\n', args=[]),
+  withDeletionPolicy(resourceLabel, value): {
+    resource+: {
+      google_alloydb_cluster+: {
+        [resourceLabel]+: {
+          deletion_policy: value,
+        },
+      },
+    },
+  },
   '#withDisplayName':: d.fn(help='`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the display_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `display_name` field.\n', args=[]),
   withDisplayName(resourceLabel, value): {
     resource+: {
@@ -301,6 +359,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withEtag':: d.fn(help='`google.string.withEtag` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the etag field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `etag` field.\n', args=[]),
+  withEtag(resourceLabel, value): {
+    resource+: {
+      google_alloydb_cluster+: {
+        [resourceLabel]+: {
+          etag: value,
+        },
+      },
+    },
+  },
   '#withInitialUser':: d.fn(help='`google.list[obj].withInitialUser` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the initial_user field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withInitialUserMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `initial_user` field.\n', args=[]),
   withInitialUser(resourceLabel, value): {
     resource+: {
@@ -421,6 +489,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withSecondaryConfig':: d.fn(help='`google.list[obj].withSecondaryConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the secondary_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withSecondaryConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `secondary_config` field.\n', args=[]),
+  withSecondaryConfig(resourceLabel, value): {
+    resource+: {
+      google_alloydb_cluster+: {
+        [resourceLabel]+: {
+          secondary_config: value,
+        },
+      },
+    },
+  },
+  '#withSecondaryConfigMixin':: d.fn(help='`google.list[obj].withSecondaryConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the secondary_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withSecondaryConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `secondary_config` field.\n', args=[]),
+  withSecondaryConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_alloydb_cluster+: {
+        [resourceLabel]+: {
+          secondary_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
   withTimeouts(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/alloydb_instance.libsonnet b/4.x/_gen/resources/alloydb_instance.libsonnet
index 84ec8f08..e91d8023 100644
--- a/4.x/_gen/resources/alloydb_instance.libsonnet
+++ b/4.x/_gen/resources/alloydb_instance.libsonnet
@@ -2,6 +2,24 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='alloydb_instance', url='', help='`alloydb_instance` represents the `google_alloydb_instance` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  client_connection_config:: {
+    '#new':: d.fn(help='\n`google.alloydb_instance.client_connection_config.new` constructs a new object with attributes and blocks configured for the `client_connection_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `require_connectors` (`bool`): Configuration to enforce connectors only (ex: AuthProxy) connections to the database. When `null`, the `require_connectors` field will be omitted from the resulting object.\n  - `ssl_config` (`list[obj]`): SSL config option for this instance. When `null`, the `ssl_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.client_connection_config.ssl_config.new](#fn-client_connection_configssl_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `client_connection_config` sub block.\n', args=[]),
+    new(
+      require_connectors=null,
+      ssl_config=null
+    ):: std.prune(a={
+      require_connectors: require_connectors,
+      ssl_config: ssl_config,
+    }),
+    ssl_config:: {
+      '#new':: d.fn(help='\n`google.alloydb_instance.client_connection_config.ssl_config.new` constructs a new object with attributes and blocks configured for the `ssl_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `ssl_mode` (`string`): SSL mode. Specifies client-server SSL/TLS connection behavior. Possible values: ["ENCRYPTED_ONLY", "ALLOW_UNENCRYPTED_AND_ENCRYPTED"] When `null`, the `ssl_mode` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `ssl_config` sub block.\n', args=[]),
+      new(
+        ssl_mode=null
+      ):: std.prune(a={
+        ssl_mode: ssl_mode,
+      }),
+    },
+  },
   machine_config:: {
     '#new':: d.fn(help='\n`google.alloydb_instance.machine_config.new` constructs a new object with attributes and blocks configured for the `machine_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `cpu_count` (`number`): The number of CPU's in the VM instance. When `null`, the `cpu_count` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `machine_config` sub block.\n', args=[]),
     new(
@@ -10,7 +28,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       cpu_count: cpu_count,
     }),
   },
-  '#new':: d.fn(help="\n`google.alloydb_instance.new` injects a new `google_alloydb_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.alloydb_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.alloydb_instance` using the reference:\n\n    $._ref.google_alloydb_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_alloydb_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `availability_type` (`string`): \u0026#39;Availability type of an Instance. Defaults to REGIONAL for both primary and read instances.\nNote that primary and read instances can have different availability types.\nOnly READ_POOL instance supports ZONAL type. Users can\u0026#39;t specify the zone for READ_POOL instance.\nZone is automatically chosen from the list of zones in the region specified.\nRead pool of size 1 can only have zonal availability. Read pools with node count of 2 or more\ncan have regional availability (nodes are present in 2 or more zones in a region).\u0026#39; Possible values: [\u0026#34;AVAILABILITY_TYPE_UNSPECIFIED\u0026#34;, \u0026#34;ZONAL\u0026#34;, \u0026#34;REGIONAL\u0026#34;] When `null`, the `availability_type` field will be omitted from the resulting object.\n  - `cluster` (`string`): Identifies the alloydb cluster. Must be in the format\n\u0026#39;projects/{project}/locations/{location}/clusters/{cluster_id}\u0026#39;\n  - `database_flags` (`obj`): Database flags. Set at instance level. * They are copied from primary instance on read instance creation. * Read instances can set new or override existing flags that are relevant for reads, e.g. for enabling columnar cache on a read instance. Flags set on read instance may or may not be present on primary. When `null`, the `database_flags` field will be omitted from the resulting object.\n  - `display_name` (`string`): User-settable and human-readable display name for the Instance. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `gce_zone` (`string`): The Compute Engine zone that the instance should serve from, per https://cloud.google.com/compute/docs/regions-zones This can ONLY be specified for ZONAL instances. If present for a REGIONAL instance, an error will be thrown. If this is absent for a ZONAL instance, instance is created in a random zone with available capacity. When `null`, the `gce_zone` field will be omitted from the resulting object.\n  - `instance_id` (`string`): The ID of the alloydb instance.\n  - `instance_type` (`string`): The type of the instance. If the instance type is READ_POOL, provide the associated PRIMARY instance in the \u0026#39;depends_on\u0026#39; meta-data attribute. Possible values: [\u0026#34;PRIMARY\u0026#34;, \u0026#34;READ_POOL\u0026#34;]\n  - `labels` (`obj`): User-defined labels for the alloydb instance. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_config` (`list[obj]`): Configurations for the machines that host the underlying database engine. When `null`, the `machine_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.machine_config.new](#fn-machine_confignew) constructor.\n  - `read_pool_config` (`list[obj]`): Read pool specific config. If the instance type is READ_POOL, this configuration must be provided. When `null`, the `read_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.read_pool_config.new](#fn-read_pool_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.alloydb_instance.new` injects a new `google_alloydb_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.alloydb_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.alloydb_instance` using the reference:\n\n    $._ref.google_alloydb_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_alloydb_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field \u0026#39;effective_annotations\u0026#39; for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `availability_type` (`string`): \u0026#39;Availability type of an Instance. Defaults to REGIONAL for both primary and read instances.\nNote that primary and read instances can have different availability types.\nOnly READ_POOL instance supports ZONAL type. Users can\u0026#39;t specify the zone for READ_POOL instance.\nZone is automatically chosen from the list of zones in the region specified.\nRead pool of size 1 can only have zonal availability. Read pools with node count of 2 or more\ncan have regional availability (nodes are present in 2 or more zones in a region).\u0026#39; Possible values: [\u0026#34;AVAILABILITY_TYPE_UNSPECIFIED\u0026#34;, \u0026#34;ZONAL\u0026#34;, \u0026#34;REGIONAL\u0026#34;] When `null`, the `availability_type` field will be omitted from the resulting object.\n  - `cluster` (`string`): Identifies the alloydb cluster. Must be in the format\n\u0026#39;projects/{project}/locations/{location}/clusters/{cluster_id}\u0026#39;\n  - `database_flags` (`obj`): Database flags. Set at instance level. * They are copied from primary instance on read instance creation. * Read instances can set new or override existing flags that are relevant for reads, e.g. for enabling columnar cache on a read instance. Flags set on read instance may or may not be present on primary. When `null`, the `database_flags` field will be omitted from the resulting object.\n  - `display_name` (`string`): User-settable and human-readable display name for the Instance. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `gce_zone` (`string`): The Compute Engine zone that the instance should serve from, per https://cloud.google.com/compute/docs/regions-zones This can ONLY be specified for ZONAL instances. If present for a REGIONAL instance, an error will be thrown. If this is absent for a ZONAL instance, instance is created in a random zone with available capacity. When `null`, the `gce_zone` field will be omitted from the resulting object.\n  - `instance_id` (`string`): The ID of the alloydb instance.\n  - `instance_type` (`string`): The type of the instance.\nIf the instance type is READ_POOL, provide the associated PRIMARY/SECONDARY instance in the \u0026#39;depends_on\u0026#39; meta-data attribute.\nIf the instance type is SECONDARY, point to the cluster_type of the associated secondary cluster instead of mentioning SECONDARY.\nExample: {instance_type = google_alloydb_cluster.\u0026lt;secondary_cluster_name\u0026gt;.cluster_type} instead of {instance_type = SECONDARY}\nIf the instance type is SECONDARY, the terraform delete instance operation does not delete the secondary instance but abandons it instead.\nUse deletion_policy = \u0026#34;FORCE\u0026#34; in the associated secondary cluster and delete the cluster forcefully to delete the secondary cluster as well its associated secondary instance.\nUsers can undo the delete secondary instance action by importing the deleted secondary instance by calling terraform import. Possible values: [\u0026#34;PRIMARY\u0026#34;, \u0026#34;READ_POOL\u0026#34;, \u0026#34;SECONDARY\u0026#34;]\n  - `labels` (`obj`): User-defined labels for the alloydb instance.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `client_connection_config` (`list[obj]`): Client connection specific configurations. When `null`, the `client_connection_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.client_connection_config.new](#fn-client_connection_confignew) constructor.\n  - `machine_config` (`list[obj]`): Configurations for the machines that host the underlying database engine. When `null`, the `machine_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.machine_config.new](#fn-machine_confignew) constructor.\n  - `query_insights_config` (`list[obj]`): Configuration for query insights. When `null`, the `query_insights_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.query_insights_config.new](#fn-query_insights_confignew) constructor.\n  - `read_pool_config` (`list[obj]`): Read pool specific config. If the instance type is READ_POOL, this configuration must be provided. When `null`, the `read_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.read_pool_config.new](#fn-read_pool_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     cluster,
@@ -18,11 +36,13 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     instance_type,
     annotations=null,
     availability_type=null,
+    client_connection_config=null,
     database_flags=null,
     display_name=null,
     gce_zone=null,
     labels=null,
     machine_config=null,
+    query_insights_config=null,
     read_pool_config=null,
     timeouts=null,
     _meta={}
@@ -32,6 +52,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     attrs=self.newAttrs(
       annotations=annotations,
       availability_type=availability_type,
+      client_connection_config=client_connection_config,
       cluster=cluster,
       database_flags=database_flags,
       display_name=display_name,
@@ -40,28 +61,32 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       instance_type=instance_type,
       labels=labels,
       machine_config=machine_config,
+      query_insights_config=query_insights_config,
       read_pool_config=read_pool_config,
       timeouts=timeouts
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.alloydb_instance.newAttrs` constructs a new object with attributes and blocks configured for the `alloydb_instance`\nTerraform resource.\n\nUnlike [google.alloydb_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `availability_type` (`string`): 'Availability type of an Instance. Defaults to REGIONAL for both primary and read instances.\nNote that primary and read instances can have different availability types.\nOnly READ_POOL instance supports ZONAL type. Users can't specify the zone for READ_POOL instance.\nZone is automatically chosen from the list of zones in the region specified.\nRead pool of size 1 can only have zonal availability. Read pools with node count of 2 or more\ncan have regional availability (nodes are present in 2 or more zones in a region).' Possible values: ["AVAILABILITY_TYPE_UNSPECIFIED", "ZONAL", "REGIONAL"] When `null`, the `availability_type` field will be omitted from the resulting object.\n  - `cluster` (`string`): Identifies the alloydb cluster. Must be in the format\n'projects/{project}/locations/{location}/clusters/{cluster_id}'\n  - `database_flags` (`obj`): Database flags. Set at instance level. * They are copied from primary instance on read instance creation. * Read instances can set new or override existing flags that are relevant for reads, e.g. for enabling columnar cache on a read instance. Flags set on read instance may or may not be present on primary. When `null`, the `database_flags` field will be omitted from the resulting object.\n  - `display_name` (`string`): User-settable and human-readable display name for the Instance. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `gce_zone` (`string`): The Compute Engine zone that the instance should serve from, per https://cloud.google.com/compute/docs/regions-zones This can ONLY be specified for ZONAL instances. If present for a REGIONAL instance, an error will be thrown. If this is absent for a ZONAL instance, instance is created in a random zone with available capacity. When `null`, the `gce_zone` field will be omitted from the resulting object.\n  - `instance_id` (`string`): The ID of the alloydb instance.\n  - `instance_type` (`string`): The type of the instance. If the instance type is READ_POOL, provide the associated PRIMARY instance in the 'depends_on' meta-data attribute. Possible values: ["PRIMARY", "READ_POOL"]\n  - `labels` (`obj`): User-defined labels for the alloydb instance. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_config` (`list[obj]`): Configurations for the machines that host the underlying database engine. When `null`, the `machine_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.machine_config.new](#fn-machine_confignew) constructor.\n  - `read_pool_config` (`list[obj]`): Read pool specific config. If the instance type is READ_POOL, this configuration must be provided. When `null`, the `read_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.read_pool_config.new](#fn-read_pool_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `alloydb_instance` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.alloydb_instance.newAttrs` constructs a new object with attributes and blocks configured for the `alloydb_instance`\nTerraform resource.\n\nUnlike [google.alloydb_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `availability_type` (`string`): 'Availability type of an Instance. Defaults to REGIONAL for both primary and read instances.\nNote that primary and read instances can have different availability types.\nOnly READ_POOL instance supports ZONAL type. Users can't specify the zone for READ_POOL instance.\nZone is automatically chosen from the list of zones in the region specified.\nRead pool of size 1 can only have zonal availability. Read pools with node count of 2 or more\ncan have regional availability (nodes are present in 2 or more zones in a region).' Possible values: ["AVAILABILITY_TYPE_UNSPECIFIED", "ZONAL", "REGIONAL"] When `null`, the `availability_type` field will be omitted from the resulting object.\n  - `cluster` (`string`): Identifies the alloydb cluster. Must be in the format\n'projects/{project}/locations/{location}/clusters/{cluster_id}'\n  - `database_flags` (`obj`): Database flags. Set at instance level. * They are copied from primary instance on read instance creation. * Read instances can set new or override existing flags that are relevant for reads, e.g. for enabling columnar cache on a read instance. Flags set on read instance may or may not be present on primary. When `null`, the `database_flags` field will be omitted from the resulting object.\n  - `display_name` (`string`): User-settable and human-readable display name for the Instance. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `gce_zone` (`string`): The Compute Engine zone that the instance should serve from, per https://cloud.google.com/compute/docs/regions-zones This can ONLY be specified for ZONAL instances. If present for a REGIONAL instance, an error will be thrown. If this is absent for a ZONAL instance, instance is created in a random zone with available capacity. When `null`, the `gce_zone` field will be omitted from the resulting object.\n  - `instance_id` (`string`): The ID of the alloydb instance.\n  - `instance_type` (`string`): The type of the instance.\nIf the instance type is READ_POOL, provide the associated PRIMARY/SECONDARY instance in the 'depends_on' meta-data attribute.\nIf the instance type is SECONDARY, point to the cluster_type of the associated secondary cluster instead of mentioning SECONDARY.\nExample: {instance_type = google_alloydb_cluster.<secondary_cluster_name>.cluster_type} instead of {instance_type = SECONDARY}\nIf the instance type is SECONDARY, the terraform delete instance operation does not delete the secondary instance but abandons it instead.\nUse deletion_policy = "FORCE" in the associated secondary cluster and delete the cluster forcefully to delete the secondary cluster as well its associated secondary instance.\nUsers can undo the delete secondary instance action by importing the deleted secondary instance by calling terraform import. Possible values: ["PRIMARY", "READ_POOL", "SECONDARY"]\n  - `labels` (`obj`): User-defined labels for the alloydb instance.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `client_connection_config` (`list[obj]`): Client connection specific configurations. When `null`, the `client_connection_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.client_connection_config.new](#fn-client_connection_confignew) constructor.\n  - `machine_config` (`list[obj]`): Configurations for the machines that host the underlying database engine. When `null`, the `machine_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.machine_config.new](#fn-machine_confignew) constructor.\n  - `query_insights_config` (`list[obj]`): Configuration for query insights. When `null`, the `query_insights_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.query_insights_config.new](#fn-query_insights_confignew) constructor.\n  - `read_pool_config` (`list[obj]`): Read pool specific config. If the instance type is READ_POOL, this configuration must be provided. When `null`, the `read_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.read_pool_config.new](#fn-read_pool_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `alloydb_instance` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     cluster,
     instance_id,
     instance_type,
     annotations=null,
     availability_type=null,
+    client_connection_config=null,
     database_flags=null,
     display_name=null,
     gce_zone=null,
     labels=null,
     machine_config=null,
+    query_insights_config=null,
     read_pool_config=null,
     timeouts=null
   ):: std.prune(a={
     annotations: annotations,
     availability_type: availability_type,
+    client_connection_config: client_connection_config,
     cluster: cluster,
     database_flags: database_flags,
     display_name: display_name,
@@ -70,9 +95,24 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     instance_type: instance_type,
     labels: labels,
     machine_config: machine_config,
+    query_insights_config: query_insights_config,
     read_pool_config: read_pool_config,
     timeouts: timeouts,
   }),
+  query_insights_config:: {
+    '#new':: d.fn(help='\n`google.alloydb_instance.query_insights_config.new` constructs a new object with attributes and blocks configured for the `query_insights_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `query_plans_per_minute` (`number`): Number of query execution plans captured by Insights per minute for all queries combined. The default value is 5. Any integer between 0 and 20 is considered valid. When `null`, the `query_plans_per_minute` field will be omitted from the resulting object.\n  - `query_string_length` (`number`): Query string length. The default value is 1024. Any integer between 256 and 4500 is considered valid. When `null`, the `query_string_length` field will be omitted from the resulting object.\n  - `record_application_tags` (`bool`): Record application tags for an instance. This flag is turned "on" by default. When `null`, the `record_application_tags` field will be omitted from the resulting object.\n  - `record_client_address` (`bool`): Record client address for an instance. Client address is PII information. This flag is turned "on" by default. When `null`, the `record_client_address` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `query_insights_config` sub block.\n', args=[]),
+    new(
+      query_plans_per_minute=null,
+      query_string_length=null,
+      record_application_tags=null,
+      record_client_address=null
+    ):: std.prune(a={
+      query_plans_per_minute: query_plans_per_minute,
+      query_string_length: query_string_length,
+      record_application_tags: record_application_tags,
+      record_client_address: record_client_address,
+    }),
+  },
   read_pool_config:: {
     '#new':: d.fn(help='\n`google.alloydb_instance.read_pool_config.new` constructs a new object with attributes and blocks configured for the `read_pool_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `node_count` (`number`): Read capacity, i.e. number of nodes in a read pool instance. When `null`, the `node_count` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `read_pool_config` sub block.\n', args=[]),
     new(
@@ -113,6 +153,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withClientConnectionConfig':: d.fn(help='`google.list[obj].withClientConnectionConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the client_connection_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withClientConnectionConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `client_connection_config` field.\n', args=[]),
+  withClientConnectionConfig(resourceLabel, value): {
+    resource+: {
+      google_alloydb_instance+: {
+        [resourceLabel]+: {
+          client_connection_config: value,
+        },
+      },
+    },
+  },
+  '#withClientConnectionConfigMixin':: d.fn(help='`google.list[obj].withClientConnectionConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the client_connection_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withClientConnectionConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `client_connection_config` field.\n', args=[]),
+  withClientConnectionConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_alloydb_instance+: {
+        [resourceLabel]+: {
+          client_connection_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withCluster':: d.fn(help='`google.string.withCluster` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the cluster field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `cluster` field.\n', args=[]),
   withCluster(resourceLabel, value): {
     resource+: {
@@ -203,6 +263,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withQueryInsightsConfig':: d.fn(help='`google.list[obj].withQueryInsightsConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the query_insights_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withQueryInsightsConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `query_insights_config` field.\n', args=[]),
+  withQueryInsightsConfig(resourceLabel, value): {
+    resource+: {
+      google_alloydb_instance+: {
+        [resourceLabel]+: {
+          query_insights_config: value,
+        },
+      },
+    },
+  },
+  '#withQueryInsightsConfigMixin':: d.fn(help='`google.list[obj].withQueryInsightsConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the query_insights_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withQueryInsightsConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `query_insights_config` field.\n', args=[]),
+  withQueryInsightsConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_alloydb_instance+: {
+        [resourceLabel]+: {
+          query_insights_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withReadPoolConfig':: d.fn(help='`google.list[obj].withReadPoolConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the read_pool_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withReadPoolConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `read_pool_config` field.\n', args=[]),
   withReadPoolConfig(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/alloydb_user.libsonnet b/4.x/_gen/resources/alloydb_user.libsonnet
new file mode 100644
index 00000000..5affc7a2
--- /dev/null
+++ b/4.x/_gen/resources/alloydb_user.libsonnet
@@ -0,0 +1,126 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='alloydb_user', url='', help='`alloydb_user` represents the `google_alloydb_user` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.alloydb_user.new` injects a new `google_alloydb_user` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.alloydb_user.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.alloydb_user` using the reference:\n\n    $._ref.google_alloydb_user.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_alloydb_user.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `cluster` (`string`): Identifies the alloydb cluster. Must be in the format\n\u0026#39;projects/{project}/locations/{location}/clusters/{cluster_id}\u0026#39;\n  - `database_roles` (`list`): List of database roles this database user has. When `null`, the `database_roles` field will be omitted from the resulting object.\n  - `password` (`string`): Password for this database user. When `null`, the `password` field will be omitted from the resulting object.\n  - `user_id` (`string`): The database role name of the user.\n  - `user_type` (`string`): The type of this user. Possible values: [\u0026#34;ALLOYDB_BUILT_IN\u0026#34;, \u0026#34;ALLOYDB_IAM_USER\u0026#34;]\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_user.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    cluster,
+    user_id,
+    user_type,
+    database_roles=null,
+    password=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_alloydb_user',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      cluster=cluster,
+      database_roles=database_roles,
+      password=password,
+      timeouts=timeouts,
+      user_id=user_id,
+      user_type=user_type
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.alloydb_user.newAttrs` constructs a new object with attributes and blocks configured for the `alloydb_user`\nTerraform resource.\n\nUnlike [google.alloydb_user.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `cluster` (`string`): Identifies the alloydb cluster. Must be in the format\n'projects/{project}/locations/{location}/clusters/{cluster_id}'\n  - `database_roles` (`list`): List of database roles this database user has. When `null`, the `database_roles` field will be omitted from the resulting object.\n  - `password` (`string`): Password for this database user. When `null`, the `password` field will be omitted from the resulting object.\n  - `user_id` (`string`): The database role name of the user.\n  - `user_type` (`string`): The type of this user. Possible values: ["ALLOYDB_BUILT_IN", "ALLOYDB_IAM_USER"]\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_user.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `alloydb_user` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    cluster,
+    user_id,
+    user_type,
+    database_roles=null,
+    password=null,
+    timeouts=null
+  ):: std.prune(a={
+    cluster: cluster,
+    database_roles: database_roles,
+    password: password,
+    timeouts: timeouts,
+    user_id: user_id,
+    user_type: user_type,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.alloydb_user.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withCluster':: d.fn(help='`google.string.withCluster` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the cluster field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `cluster` field.\n', args=[]),
+  withCluster(resourceLabel, value): {
+    resource+: {
+      google_alloydb_user+: {
+        [resourceLabel]+: {
+          cluster: value,
+        },
+      },
+    },
+  },
+  '#withDatabaseRoles':: d.fn(help='`google.list.withDatabaseRoles` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the database_roles field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `database_roles` field.\n', args=[]),
+  withDatabaseRoles(resourceLabel, value): {
+    resource+: {
+      google_alloydb_user+: {
+        [resourceLabel]+: {
+          database_roles: value,
+        },
+      },
+    },
+  },
+  '#withPassword':: d.fn(help='`google.string.withPassword` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the password field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `password` field.\n', args=[]),
+  withPassword(resourceLabel, value): {
+    resource+: {
+      google_alloydb_user+: {
+        [resourceLabel]+: {
+          password: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_alloydb_user+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_alloydb_user+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+  '#withUserId':: d.fn(help='`google.string.withUserId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the user_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `user_id` field.\n', args=[]),
+  withUserId(resourceLabel, value): {
+    resource+: {
+      google_alloydb_user+: {
+        [resourceLabel]+: {
+          user_id: value,
+        },
+      },
+    },
+  },
+  '#withUserType':: d.fn(help='`google.string.withUserType` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the user_type field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `user_type` field.\n', args=[]),
+  withUserType(resourceLabel, value): {
+    resource+: {
+      google_alloydb_user+: {
+        [resourceLabel]+: {
+          user_type: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/apigee_environment.libsonnet b/4.x/_gen/resources/apigee_environment.libsonnet
index 831dc33a..31ae5b3a 100644
--- a/4.x/_gen/resources/apigee_environment.libsonnet
+++ b/4.x/_gen/resources/apigee_environment.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='apigee_environment', url='', help='`apigee_environment` represents the `google_apigee_environment` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.apigee_environment.new` injects a new `google_apigee_environment` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.apigee_environment.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.apigee_environment` using the reference:\n\n    $._ref.google_apigee_environment.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_apigee_environment.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `api_proxy_type` (`string`): Optional. API Proxy type supported by the environment. The type can be set when creating\nthe Environment and cannot be changed. Possible values: [\u0026#34;API_PROXY_TYPE_UNSPECIFIED\u0026#34;, \u0026#34;PROGRAMMABLE\u0026#34;, \u0026#34;CONFIGURABLE\u0026#34;] When `null`, the `api_proxy_type` field will be omitted from the resulting object.\n  - `deployment_type` (`string`): Optional. Deployment type supported by the environment. The deployment type can be\nset when creating the environment and cannot be changed. When you enable archive\ndeployment, you will be prevented from performing a subset of actions within the\nenvironment, including:\nManaging the deployment of API proxy or shared flow revisions;\nCreating, updating, or deleting resource files;\nCreating, updating, or deleting target servers. Possible values: [\u0026#34;DEPLOYMENT_TYPE_UNSPECIFIED\u0026#34;, \u0026#34;PROXY\u0026#34;, \u0026#34;ARCHIVE\u0026#34;] When `null`, the `deployment_type` field will be omitted from the resulting object.\n  - `description` (`string`): Description of the environment. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Display name of the environment. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `name` (`string`): The resource ID of the environment.\n  - `org_id` (`string`): The Apigee Organization associated with the Apigee environment,\nin the format \u0026#39;organizations/{{org_name}}\u0026#39;.\n  - `node_config` (`list[obj]`): NodeConfig for setting the min/max number of nodes associated with the environment. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.apigee_environment.node_config.new](#fn-node_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.apigee_environment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.apigee_environment.new` injects a new `google_apigee_environment` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.apigee_environment.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.apigee_environment` using the reference:\n\n    $._ref.google_apigee_environment.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_apigee_environment.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `api_proxy_type` (`string`): Optional. API Proxy type supported by the environment. The type can be set when creating\nthe Environment and cannot be changed. Possible values: [\u0026#34;API_PROXY_TYPE_UNSPECIFIED\u0026#34;, \u0026#34;PROGRAMMABLE\u0026#34;, \u0026#34;CONFIGURABLE\u0026#34;] When `null`, the `api_proxy_type` field will be omitted from the resulting object.\n  - `deployment_type` (`string`): Optional. Deployment type supported by the environment. The deployment type can be\nset when creating the environment and cannot be changed. When you enable archive\ndeployment, you will be prevented from performing a subset of actions within the\nenvironment, including:\nManaging the deployment of API proxy or shared flow revisions;\nCreating, updating, or deleting resource files;\nCreating, updating, or deleting target servers. Possible values: [\u0026#34;DEPLOYMENT_TYPE_UNSPECIFIED\u0026#34;, \u0026#34;PROXY\u0026#34;, \u0026#34;ARCHIVE\u0026#34;] When `null`, the `deployment_type` field will be omitted from the resulting object.\n  - `description` (`string`): Description of the environment. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Display name of the environment. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `name` (`string`): The resource ID of the environment.\n  - `org_id` (`string`): The Apigee Organization associated with the Apigee environment,\nin the format \u0026#39;organizations/{{org_name}}\u0026#39;.\n  - `type` (`string`): Types that can be selected for an Environment. Each of the types are\nlimited by capability and capacity. Refer to Apigee\u0026#39;s public documentation\nto understand about each of these types in details.\nAn Apigee org can support heterogeneous Environments. Possible values: [\u0026#34;ENVIRONMENT_TYPE_UNSPECIFIED\u0026#34;, \u0026#34;BASE\u0026#34;, \u0026#34;INTERMEDIATE\u0026#34;, \u0026#34;COMPREHENSIVE\u0026#34;] When `null`, the `type` field will be omitted from the resulting object.\n  - `node_config` (`list[obj]`): NodeConfig for setting the min/max number of nodes associated with the environment. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.apigee_environment.node_config.new](#fn-node_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.apigee_environment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -13,6 +13,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     display_name=null,
     node_config=null,
     timeouts=null,
+    type=null,
     _meta={}
   ):: tf.withResource(
     type='google_apigee_environment',
@@ -25,11 +26,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       name=name,
       node_config=node_config,
       org_id=org_id,
-      timeouts=timeouts
+      timeouts=timeouts,
+      type=type
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.apigee_environment.newAttrs` constructs a new object with attributes and blocks configured for the `apigee_environment`\nTerraform resource.\n\nUnlike [google.apigee_environment.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `api_proxy_type` (`string`): Optional. API Proxy type supported by the environment. The type can be set when creating\nthe Environment and cannot be changed. Possible values: ["API_PROXY_TYPE_UNSPECIFIED", "PROGRAMMABLE", "CONFIGURABLE"] When `null`, the `api_proxy_type` field will be omitted from the resulting object.\n  - `deployment_type` (`string`): Optional. Deployment type supported by the environment. The deployment type can be\nset when creating the environment and cannot be changed. When you enable archive\ndeployment, you will be prevented from performing a subset of actions within the\nenvironment, including:\nManaging the deployment of API proxy or shared flow revisions;\nCreating, updating, or deleting resource files;\nCreating, updating, or deleting target servers. Possible values: ["DEPLOYMENT_TYPE_UNSPECIFIED", "PROXY", "ARCHIVE"] When `null`, the `deployment_type` field will be omitted from the resulting object.\n  - `description` (`string`): Description of the environment. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Display name of the environment. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `name` (`string`): The resource ID of the environment.\n  - `org_id` (`string`): The Apigee Organization associated with the Apigee environment,\nin the format 'organizations/{{org_name}}'.\n  - `node_config` (`list[obj]`): NodeConfig for setting the min/max number of nodes associated with the environment. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.apigee_environment.node_config.new](#fn-node_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.apigee_environment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `apigee_environment` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.apigee_environment.newAttrs` constructs a new object with attributes and blocks configured for the `apigee_environment`\nTerraform resource.\n\nUnlike [google.apigee_environment.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `api_proxy_type` (`string`): Optional. API Proxy type supported by the environment. The type can be set when creating\nthe Environment and cannot be changed. Possible values: ["API_PROXY_TYPE_UNSPECIFIED", "PROGRAMMABLE", "CONFIGURABLE"] When `null`, the `api_proxy_type` field will be omitted from the resulting object.\n  - `deployment_type` (`string`): Optional. Deployment type supported by the environment. The deployment type can be\nset when creating the environment and cannot be changed. When you enable archive\ndeployment, you will be prevented from performing a subset of actions within the\nenvironment, including:\nManaging the deployment of API proxy or shared flow revisions;\nCreating, updating, or deleting resource files;\nCreating, updating, or deleting target servers. Possible values: ["DEPLOYMENT_TYPE_UNSPECIFIED", "PROXY", "ARCHIVE"] When `null`, the `deployment_type` field will be omitted from the resulting object.\n  - `description` (`string`): Description of the environment. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Display name of the environment. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `name` (`string`): The resource ID of the environment.\n  - `org_id` (`string`): The Apigee Organization associated with the Apigee environment,\nin the format 'organizations/{{org_name}}'.\n  - `type` (`string`): Types that can be selected for an Environment. Each of the types are\nlimited by capability and capacity. Refer to Apigee's public documentation\nto understand about each of these types in details.\nAn Apigee org can support heterogeneous Environments. Possible values: ["ENVIRONMENT_TYPE_UNSPECIFIED", "BASE", "INTERMEDIATE", "COMPREHENSIVE"] When `null`, the `type` field will be omitted from the resulting object.\n  - `node_config` (`list[obj]`): NodeConfig for setting the min/max number of nodes associated with the environment. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.apigee_environment.node_config.new](#fn-node_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.apigee_environment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `apigee_environment` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     org_id,
@@ -38,7 +40,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     description=null,
     display_name=null,
     node_config=null,
-    timeouts=null
+    timeouts=null,
+    type=null
   ):: std.prune(a={
     api_proxy_type: api_proxy_type,
     deployment_type: deployment_type,
@@ -48,6 +51,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     node_config: node_config,
     org_id: org_id,
     timeouts: timeouts,
+    type: type,
   }),
   node_config:: {
     '#new':: d.fn(help='\n`google.apigee_environment.node_config.new` constructs a new object with attributes and blocks configured for the `node_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `max_node_count` (`string`): The maximum total number of gateway nodes that the is reserved for all instances that\nhas the specified environment. If not specified, the default is determined by the\nrecommended maximum number of nodes for that gateway. When `null`, the `max_node_count` field will be omitted from the resulting object.\n  - `min_node_count` (`string`): The minimum total number of gateway nodes that the is reserved for all instances that\nhas the specified environment. If not specified, the default is determined by the\nrecommended minimum number of nodes for that gateway. When `null`, the `min_node_count` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `node_config` sub block.\n', args=[]),
@@ -171,4 +175,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withType':: d.fn(help='`google.string.withType` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the type field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `type` field.\n', args=[]),
+  withType(resourceLabel, value): {
+    resource+: {
+      google_apigee_environment+: {
+        [resourceLabel]+: {
+          type: value,
+        },
+      },
+    },
+  },
 }
diff --git a/4.x/_gen/resources/artifact_registry_repository.libsonnet b/4.x/_gen/resources/artifact_registry_repository.libsonnet
index 283fb4eb..0604bcfc 100644
--- a/4.x/_gen/resources/artifact_registry_repository.libsonnet
+++ b/4.x/_gen/resources/artifact_registry_repository.libsonnet
@@ -20,7 +20,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       version_policy: version_policy,
     }),
   },
-  '#new':: d.fn(help="\n`google.artifact_registry_repository.new` injects a new `google_artifact_registry_repository` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.artifact_registry_repository.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.artifact_registry_repository` using the reference:\n\n    $._ref.google_artifact_registry_repository.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_artifact_registry_repository.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): The user-provided description of the repository. When `null`, the `description` field will be omitted from the resulting object.\n  - `format` (`string`): The format of packages that are stored in the repository. Supported formats\ncan be found [here](https://cloud.google.com/artifact-registry/docs/supported-formats).\nYou can only create alpha formats if you are a member of the\n[alpha user group](https://cloud.google.com/artifact-registry/docs/supported-formats#alpha-access).\n  - `kms_key_name` (`string`): The Cloud KMS resource name of the customer managed encryption key that’s\nused to encrypt the contents of the Repository. Has the form:\n\u0026#39;projects/my-project/locations/my-region/keyRings/my-kr/cryptoKeys/my-key\u0026#39;.\nThis value may not be changed after the Repository has been created. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels with user-defined metadata.\nThis field may contain up to 64 entries. Label keys and values may be no\nlonger than 63 characters. Label keys must begin with a lowercase letter\nand may only contain lowercase letters, numeric characters, underscores,\nand dashes. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this repository is located in. When `null`, the `location` field will be omitted from the resulting object.\n  - `mode` (`string`): The mode configures the repository to serve artifacts from different sources. Default value: \u0026#34;STANDARD_REPOSITORY\u0026#34; Possible values: [\u0026#34;STANDARD_REPOSITORY\u0026#34;, \u0026#34;VIRTUAL_REPOSITORY\u0026#34;, \u0026#34;REMOTE_REPOSITORY\u0026#34;] When `null`, the `mode` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `repository_id` (`string`): The last part of the repository name, for example:\n\u0026#34;repo1\u0026#34;\n  - `docker_config` (`list[obj]`): Docker repository config contains repository level configuration for the repositories of docker type. When `null`, the `docker_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.docker_config.new](#fn-docker_confignew) constructor.\n  - `maven_config` (`list[obj]`): MavenRepositoryConfig is maven related repository details.\nProvides additional configuration details for repositories of the maven\nformat type. When `null`, the `maven_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.maven_config.new](#fn-maven_confignew) constructor.\n  - `remote_repository_config` (`list[obj]`): Configuration specific for a Remote Repository. When `null`, the `remote_repository_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.new](#fn-remote_repository_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.timeouts.new](#fn-timeoutsnew) constructor.\n  - `virtual_repository_config` (`list[obj]`): Configuration specific for a Virtual Repository. When `null`, the `virtual_repository_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.virtual_repository_config.new](#fn-virtual_repository_confignew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.artifact_registry_repository.new` injects a new `google_artifact_registry_repository` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.artifact_registry_repository.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.artifact_registry_repository` using the reference:\n\n    $._ref.google_artifact_registry_repository.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_artifact_registry_repository.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): The user-provided description of the repository. When `null`, the `description` field will be omitted from the resulting object.\n  - `format` (`string`): The format of packages that are stored in the repository. Supported formats\ncan be found [here](https://cloud.google.com/artifact-registry/docs/supported-formats).\nYou can only create alpha formats if you are a member of the\n[alpha user group](https://cloud.google.com/artifact-registry/docs/supported-formats#alpha-access).\n  - `kms_key_name` (`string`): The Cloud KMS resource name of the customer managed encryption key that’s\nused to encrypt the contents of the Repository. Has the form:\n\u0026#39;projects/my-project/locations/my-region/keyRings/my-kr/cryptoKeys/my-key\u0026#39;.\nThis value may not be changed after the Repository has been created. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels with user-defined metadata.\nThis field may contain up to 64 entries. Label keys and values may be no\nlonger than 63 characters. Label keys must begin with a lowercase letter\nand may only contain lowercase letters, numeric characters, underscores,\nand dashes.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this repository is located in. When `null`, the `location` field will be omitted from the resulting object.\n  - `mode` (`string`): The mode configures the repository to serve artifacts from different sources. Default value: \u0026#34;STANDARD_REPOSITORY\u0026#34; Possible values: [\u0026#34;STANDARD_REPOSITORY\u0026#34;, \u0026#34;VIRTUAL_REPOSITORY\u0026#34;, \u0026#34;REMOTE_REPOSITORY\u0026#34;] When `null`, the `mode` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `repository_id` (`string`): The last part of the repository name, for example:\n\u0026#34;repo1\u0026#34;\n  - `docker_config` (`list[obj]`): Docker repository config contains repository level configuration for the repositories of docker type. When `null`, the `docker_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.docker_config.new](#fn-docker_confignew) constructor.\n  - `maven_config` (`list[obj]`): MavenRepositoryConfig is maven related repository details.\nProvides additional configuration details for repositories of the maven\nformat type. When `null`, the `maven_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.maven_config.new](#fn-maven_confignew) constructor.\n  - `remote_repository_config` (`list[obj]`): Configuration specific for a Remote Repository. When `null`, the `remote_repository_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.new](#fn-remote_repository_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.timeouts.new](#fn-timeoutsnew) constructor.\n  - `virtual_repository_config` (`list[obj]`): Configuration specific for a Virtual Repository. When `null`, the `virtual_repository_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.virtual_repository_config.new](#fn-virtual_repository_confignew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     format,
@@ -57,7 +57,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.artifact_registry_repository.newAttrs` constructs a new object with attributes and blocks configured for the `artifact_registry_repository`\nTerraform resource.\n\nUnlike [google.artifact_registry_repository.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): The user-provided description of the repository. When `null`, the `description` field will be omitted from the resulting object.\n  - `format` (`string`): The format of packages that are stored in the repository. Supported formats\ncan be found [here](https://cloud.google.com/artifact-registry/docs/supported-formats).\nYou can only create alpha formats if you are a member of the\n[alpha user group](https://cloud.google.com/artifact-registry/docs/supported-formats#alpha-access).\n  - `kms_key_name` (`string`): The Cloud KMS resource name of the customer managed encryption key that’s\nused to encrypt the contents of the Repository. Has the form:\n'projects/my-project/locations/my-region/keyRings/my-kr/cryptoKeys/my-key'.\nThis value may not be changed after the Repository has been created. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels with user-defined metadata.\nThis field may contain up to 64 entries. Label keys and values may be no\nlonger than 63 characters. Label keys must begin with a lowercase letter\nand may only contain lowercase letters, numeric characters, underscores,\nand dashes. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this repository is located in. When `null`, the `location` field will be omitted from the resulting object.\n  - `mode` (`string`): The mode configures the repository to serve artifacts from different sources. Default value: "STANDARD_REPOSITORY" Possible values: ["STANDARD_REPOSITORY", "VIRTUAL_REPOSITORY", "REMOTE_REPOSITORY"] When `null`, the `mode` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `repository_id` (`string`): The last part of the repository name, for example:\n"repo1"\n  - `docker_config` (`list[obj]`): Docker repository config contains repository level configuration for the repositories of docker type. When `null`, the `docker_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.docker_config.new](#fn-docker_confignew) constructor.\n  - `maven_config` (`list[obj]`): MavenRepositoryConfig is maven related repository details.\nProvides additional configuration details for repositories of the maven\nformat type. When `null`, the `maven_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.maven_config.new](#fn-maven_confignew) constructor.\n  - `remote_repository_config` (`list[obj]`): Configuration specific for a Remote Repository. When `null`, the `remote_repository_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.new](#fn-remote_repository_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.timeouts.new](#fn-timeoutsnew) constructor.\n  - `virtual_repository_config` (`list[obj]`): Configuration specific for a Virtual Repository. When `null`, the `virtual_repository_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.virtual_repository_config.new](#fn-virtual_repository_confignew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `artifact_registry_repository` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.artifact_registry_repository.newAttrs` constructs a new object with attributes and blocks configured for the `artifact_registry_repository`\nTerraform resource.\n\nUnlike [google.artifact_registry_repository.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): The user-provided description of the repository. When `null`, the `description` field will be omitted from the resulting object.\n  - `format` (`string`): The format of packages that are stored in the repository. Supported formats\ncan be found [here](https://cloud.google.com/artifact-registry/docs/supported-formats).\nYou can only create alpha formats if you are a member of the\n[alpha user group](https://cloud.google.com/artifact-registry/docs/supported-formats#alpha-access).\n  - `kms_key_name` (`string`): The Cloud KMS resource name of the customer managed encryption key that’s\nused to encrypt the contents of the Repository. Has the form:\n'projects/my-project/locations/my-region/keyRings/my-kr/cryptoKeys/my-key'.\nThis value may not be changed after the Repository has been created. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels with user-defined metadata.\nThis field may contain up to 64 entries. Label keys and values may be no\nlonger than 63 characters. Label keys must begin with a lowercase letter\nand may only contain lowercase letters, numeric characters, underscores,\nand dashes.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this repository is located in. When `null`, the `location` field will be omitted from the resulting object.\n  - `mode` (`string`): The mode configures the repository to serve artifacts from different sources. Default value: "STANDARD_REPOSITORY" Possible values: ["STANDARD_REPOSITORY", "VIRTUAL_REPOSITORY", "REMOTE_REPOSITORY"] When `null`, the `mode` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `repository_id` (`string`): The last part of the repository name, for example:\n"repo1"\n  - `docker_config` (`list[obj]`): Docker repository config contains repository level configuration for the repositories of docker type. When `null`, the `docker_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.docker_config.new](#fn-docker_confignew) constructor.\n  - `maven_config` (`list[obj]`): MavenRepositoryConfig is maven related repository details.\nProvides additional configuration details for repositories of the maven\nformat type. When `null`, the `maven_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.maven_config.new](#fn-maven_confignew) constructor.\n  - `remote_repository_config` (`list[obj]`): Configuration specific for a Remote Repository. When `null`, the `remote_repository_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.new](#fn-remote_repository_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.timeouts.new](#fn-timeoutsnew) constructor.\n  - `virtual_repository_config` (`list[obj]`): Configuration specific for a Virtual Repository. When `null`, the `virtual_repository_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.virtual_repository_config.new](#fn-virtual_repository_confignew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `artifact_registry_repository` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     format,
     repository_id,
@@ -88,6 +88,24 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     virtual_repository_config: virtual_repository_config,
   }),
   remote_repository_config:: {
+    apt_repository:: {
+      '#new':: d.fn(help='\n`google.artifact_registry_repository.remote_repository_config.apt_repository.new` constructs a new object with attributes and blocks configured for the `apt_repository`\nTerraform sub block.\n\n\n\n**Args**:\n  - `public_repository` (`list[obj]`): One of the publicly available Apt repositories supported by Artifact Registry. When `null`, the `public_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.apt_repository.public_repository.new](#fn-remote_repository_configremote_repository_configpublic_repositorynew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `apt_repository` sub block.\n', args=[]),
+      new(
+        public_repository=null
+      ):: std.prune(a={
+        public_repository: public_repository,
+      }),
+      public_repository:: {
+        '#new':: d.fn(help='\n`google.artifact_registry_repository.remote_repository_config.apt_repository.public_repository.new` constructs a new object with attributes and blocks configured for the `public_repository`\nTerraform sub block.\n\n\n\n**Args**:\n  - `repository_base` (`string`): A common public repository base for Apt, e.g. '"debian/dists/buster"' Possible values: ["DEBIAN", "UBUNTU"]\n  - `repository_path` (`string`): Specific repository from the base.\n\n**Returns**:\n  - An attribute object that represents the `public_repository` sub block.\n', args=[]),
+        new(
+          repository_base,
+          repository_path
+        ):: std.prune(a={
+          repository_base: repository_base,
+          repository_path: repository_path,
+        }),
+      },
+    },
     docker_repository:: {
       '#new':: d.fn(help='\n`google.artifact_registry_repository.remote_repository_config.docker_repository.new` constructs a new object with attributes and blocks configured for the `docker_repository`\nTerraform sub block.\n\n\n\n**Args**:\n  - `public_repository` (`string`): Address of the remote repository. Default value: "DOCKER_HUB" Possible values: ["DOCKER_HUB"] When `null`, the `public_repository` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `docker_repository` sub block.\n', args=[]),
       new(
@@ -104,19 +122,23 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         public_repository: public_repository,
       }),
     },
-    '#new':: d.fn(help='\n`google.artifact_registry_repository.remote_repository_config.new` constructs a new object with attributes and blocks configured for the `remote_repository_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): The description of the remote source. When `null`, the `description` field will be omitted from the resulting object.\n  - `docker_repository` (`list[obj]`): Specific settings for a Docker remote repository. When `null`, the `docker_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.docker_repository.new](#fn-remote_repository_configdocker_repositorynew) constructor.\n  - `maven_repository` (`list[obj]`): Specific settings for a Maven remote repository. When `null`, the `maven_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.maven_repository.new](#fn-remote_repository_configmaven_repositorynew) constructor.\n  - `npm_repository` (`list[obj]`): Specific settings for an Npm remote repository. When `null`, the `npm_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.npm_repository.new](#fn-remote_repository_confignpm_repositorynew) constructor.\n  - `python_repository` (`list[obj]`): Specific settings for a Python remote repository. When `null`, the `python_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.python_repository.new](#fn-remote_repository_configpython_repositorynew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `remote_repository_config` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.artifact_registry_repository.remote_repository_config.new` constructs a new object with attributes and blocks configured for the `remote_repository_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): The description of the remote source. When `null`, the `description` field will be omitted from the resulting object.\n  - `apt_repository` (`list[obj]`): Specific settings for an Apt remote repository. When `null`, the `apt_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.apt_repository.new](#fn-remote_repository_configapt_repositorynew) constructor.\n  - `docker_repository` (`list[obj]`): Specific settings for a Docker remote repository. When `null`, the `docker_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.docker_repository.new](#fn-remote_repository_configdocker_repositorynew) constructor.\n  - `maven_repository` (`list[obj]`): Specific settings for a Maven remote repository. When `null`, the `maven_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.maven_repository.new](#fn-remote_repository_configmaven_repositorynew) constructor.\n  - `npm_repository` (`list[obj]`): Specific settings for an Npm remote repository. When `null`, the `npm_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.npm_repository.new](#fn-remote_repository_confignpm_repositorynew) constructor.\n  - `python_repository` (`list[obj]`): Specific settings for a Python remote repository. When `null`, the `python_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.python_repository.new](#fn-remote_repository_configpython_repositorynew) constructor.\n  - `yum_repository` (`list[obj]`): Specific settings for an Yum remote repository. When `null`, the `yum_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.yum_repository.new](#fn-remote_repository_configyum_repositorynew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `remote_repository_config` sub block.\n', args=[]),
     new(
+      apt_repository=null,
       description=null,
       docker_repository=null,
       maven_repository=null,
       npm_repository=null,
-      python_repository=null
+      python_repository=null,
+      yum_repository=null
     ):: std.prune(a={
+      apt_repository: apt_repository,
       description: description,
       docker_repository: docker_repository,
       maven_repository: maven_repository,
       npm_repository: npm_repository,
       python_repository: python_repository,
+      yum_repository: yum_repository,
     }),
     npm_repository:: {
       '#new':: d.fn(help='\n`google.artifact_registry_repository.remote_repository_config.npm_repository.new` constructs a new object with attributes and blocks configured for the `npm_repository`\nTerraform sub block.\n\n\n\n**Args**:\n  - `public_repository` (`string`): Address of the remote repository. Default value: "NPMJS" Possible values: ["NPMJS"] When `null`, the `public_repository` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `npm_repository` sub block.\n', args=[]),
@@ -134,6 +156,24 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         public_repository: public_repository,
       }),
     },
+    yum_repository:: {
+      '#new':: d.fn(help='\n`google.artifact_registry_repository.remote_repository_config.yum_repository.new` constructs a new object with attributes and blocks configured for the `yum_repository`\nTerraform sub block.\n\n\n\n**Args**:\n  - `public_repository` (`list[obj]`): One of the publicly available Yum repositories supported by Artifact Registry. When `null`, the `public_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.yum_repository.public_repository.new](#fn-remote_repository_configremote_repository_configpublic_repositorynew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `yum_repository` sub block.\n', args=[]),
+      new(
+        public_repository=null
+      ):: std.prune(a={
+        public_repository: public_repository,
+      }),
+      public_repository:: {
+        '#new':: d.fn(help='\n`google.artifact_registry_repository.remote_repository_config.yum_repository.public_repository.new` constructs a new object with attributes and blocks configured for the `public_repository`\nTerraform sub block.\n\n\n\n**Args**:\n  - `repository_base` (`string`): A common public repository base for Yum. Possible values: ["CENTOS", "CENTOS_DEBUG", "CENTOS_VAULT", "CENTOS_STREAM", "ROCKY", "EPEL"]\n  - `repository_path` (`string`): Specific repository from the base, e.g. '"centos/8-stream/BaseOS/x86_64/os"'\n\n**Returns**:\n  - An attribute object that represents the `public_repository` sub block.\n', args=[]),
+        new(
+          repository_base,
+          repository_path
+        ):: std.prune(a={
+          repository_base: repository_base,
+          repository_path: repository_path,
+        }),
+      },
+    },
   },
   timeouts:: {
     '#new':: d.fn(help='\n`google.artifact_registry_repository.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
diff --git a/4.x/_gen/resources/assured_workloads_workload.libsonnet b/4.x/_gen/resources/assured_workloads_workload.libsonnet
index aae94e4e..15d672fe 100644
--- a/4.x/_gen/resources/assured_workloads_workload.libsonnet
+++ b/4.x/_gen/resources/assured_workloads_workload.libsonnet
@@ -12,7 +12,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       rotation_period: rotation_period,
     }),
   },
-  '#new':: d.fn(help="\n`google.assured_workloads_workload.new` injects a new `google_assured_workloads_workload` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.assured_workloads_workload.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.assured_workloads_workload` using the reference:\n\n    $._ref.google_assured_workloads_workload.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_assured_workloads_workload.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `billing_account` (`string`): Required. Input only. The billing account used for the resources which are direct children of workload. This billing account is initially associated with the resources created as part of Workload creation. After the initial creation of these resources, the customer can change the assigned billing account. The resource name has the form `billingAccounts/{billing_account_id}`. For example, \u0026#39;billingAccounts/012345-567890-ABCDEF`.\n  - `compliance_regime` (`string`): Required. Immutable. Compliance Regime associated with this workload. Possible values: COMPLIANCE_REGIME_UNSPECIFIED, IL4, CJIS, FEDRAMP_HIGH, FEDRAMP_MODERATE, US_REGIONAL_ACCESS, HIPAA, EU_REGIONS_AND_SUPPORT, CA_REGIONS_AND_SUPPORT, ITAR, AU_REGIONS_AND_US_SUPPORT, ASSURED_WORKLOADS_FOR_PARTNERS\n  - `display_name` (`string`): Required. The user-assigned display name of the Workload. When present it must be between 4 to 30 characters. Allowed characters are: lowercase and uppercase letters, numbers, hyphen, and spaces. Example: My Workload\n  - `labels` (`obj`): Optional. Labels applied to the workload. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `organization` (`string`): The organization for the resource\n  - `provisioned_resources_parent` (`string`): Input only. The parent resource for the resources managed by this Assured Workload. May be either an organization or a folder. Must be the same or a child of the Workload parent. If not specified all resources are created under the Workload parent. Formats: folders/{folder_id}, organizations/{organization_id} When `null`, the `provisioned_resources_parent` field will be omitted from the resulting object.\n  - `kms_settings` (`list[obj]`): Input only. Settings used to create a CMEK crypto key. When set a project with a KMS CMEK key is provisioned. This field is mandatory for a subset of Compliance Regimes. When `null`, the `kms_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.kms_settings.new](#fn-kms_settingsnew) constructor.\n  - `resource_settings` (`list[obj]`): Input only. Resource properties that are used to customize workload resources. These properties (such as custom project id) will be used to create workload resources if possible. This field is optional. When `null`, the `resource_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.resource_settings.new](#fn-resource_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.assured_workloads_workload.new` injects a new `google_assured_workloads_workload` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.assured_workloads_workload.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.assured_workloads_workload` using the reference:\n\n    $._ref.google_assured_workloads_workload.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_assured_workloads_workload.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `billing_account` (`string`): Required. Input only. The billing account used for the resources which are direct children of workload. This billing account is initially associated with the resources created as part of Workload creation. After the initial creation of these resources, the customer can change the assigned billing account. The resource name has the form `billingAccounts/{billing_account_id}`. For example, \u0026#39;billingAccounts/012345-567890-ABCDEF`.\n  - `compliance_regime` (`string`): Required. Immutable. Compliance Regime associated with this workload. Possible values: COMPLIANCE_REGIME_UNSPECIFIED, IL4, CJIS, FEDRAMP_HIGH, FEDRAMP_MODERATE, US_REGIONAL_ACCESS, HIPAA, EU_REGIONS_AND_SUPPORT, CA_REGIONS_AND_SUPPORT, ITAR, AU_REGIONS_AND_US_SUPPORT, ASSURED_WORKLOADS_FOR_PARTNERS\n  - `display_name` (`string`): Required. The user-assigned display name of the Workload. When present it must be between 4 to 30 characters. Allowed characters are: lowercase and uppercase letters, numbers, hyphen, and spaces. Example: My Workload\n  - `labels` (`obj`): Optional. Labels applied to the workload.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `organization` (`string`): The organization for the resource\n  - `provisioned_resources_parent` (`string`): Input only. The parent resource for the resources managed by this Assured Workload. May be either an organization or a folder. Must be the same or a child of the Workload parent. If not specified all resources are created under the Workload parent. Formats: folders/{folder_id}, organizations/{organization_id} When `null`, the `provisioned_resources_parent` field will be omitted from the resulting object.\n  - `kms_settings` (`list[obj]`): Input only. Settings used to create a CMEK crypto key. When set a project with a KMS CMEK key is provisioned. This field is mandatory for a subset of Compliance Regimes. When `null`, the `kms_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.kms_settings.new](#fn-kms_settingsnew) constructor.\n  - `resource_settings` (`list[obj]`): Input only. Resource properties that are used to customize workload resources. These properties (such as custom project id) will be used to create workload resources if possible. This field is optional. When `null`, the `resource_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.resource_settings.new](#fn-resource_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     billing_account,
@@ -43,7 +43,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.assured_workloads_workload.newAttrs` constructs a new object with attributes and blocks configured for the `assured_workloads_workload`\nTerraform resource.\n\nUnlike [google.assured_workloads_workload.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `billing_account` (`string`): Required. Input only. The billing account used for the resources which are direct children of workload. This billing account is initially associated with the resources created as part of Workload creation. After the initial creation of these resources, the customer can change the assigned billing account. The resource name has the form `billingAccounts/{billing_account_id}`. For example, 'billingAccounts/012345-567890-ABCDEF`.\n  - `compliance_regime` (`string`): Required. Immutable. Compliance Regime associated with this workload. Possible values: COMPLIANCE_REGIME_UNSPECIFIED, IL4, CJIS, FEDRAMP_HIGH, FEDRAMP_MODERATE, US_REGIONAL_ACCESS, HIPAA, EU_REGIONS_AND_SUPPORT, CA_REGIONS_AND_SUPPORT, ITAR, AU_REGIONS_AND_US_SUPPORT, ASSURED_WORKLOADS_FOR_PARTNERS\n  - `display_name` (`string`): Required. The user-assigned display name of the Workload. When present it must be between 4 to 30 characters. Allowed characters are: lowercase and uppercase letters, numbers, hyphen, and spaces. Example: My Workload\n  - `labels` (`obj`): Optional. Labels applied to the workload. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `organization` (`string`): The organization for the resource\n  - `provisioned_resources_parent` (`string`): Input only. The parent resource for the resources managed by this Assured Workload. May be either an organization or a folder. Must be the same or a child of the Workload parent. If not specified all resources are created under the Workload parent. Formats: folders/{folder_id}, organizations/{organization_id} When `null`, the `provisioned_resources_parent` field will be omitted from the resulting object.\n  - `kms_settings` (`list[obj]`): Input only. Settings used to create a CMEK crypto key. When set a project with a KMS CMEK key is provisioned. This field is mandatory for a subset of Compliance Regimes. When `null`, the `kms_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.kms_settings.new](#fn-kms_settingsnew) constructor.\n  - `resource_settings` (`list[obj]`): Input only. Resource properties that are used to customize workload resources. These properties (such as custom project id) will be used to create workload resources if possible. This field is optional. When `null`, the `resource_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.resource_settings.new](#fn-resource_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `assured_workloads_workload` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.assured_workloads_workload.newAttrs` constructs a new object with attributes and blocks configured for the `assured_workloads_workload`\nTerraform resource.\n\nUnlike [google.assured_workloads_workload.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `billing_account` (`string`): Required. Input only. The billing account used for the resources which are direct children of workload. This billing account is initially associated with the resources created as part of Workload creation. After the initial creation of these resources, the customer can change the assigned billing account. The resource name has the form `billingAccounts/{billing_account_id}`. For example, 'billingAccounts/012345-567890-ABCDEF`.\n  - `compliance_regime` (`string`): Required. Immutable. Compliance Regime associated with this workload. Possible values: COMPLIANCE_REGIME_UNSPECIFIED, IL4, CJIS, FEDRAMP_HIGH, FEDRAMP_MODERATE, US_REGIONAL_ACCESS, HIPAA, EU_REGIONS_AND_SUPPORT, CA_REGIONS_AND_SUPPORT, ITAR, AU_REGIONS_AND_US_SUPPORT, ASSURED_WORKLOADS_FOR_PARTNERS\n  - `display_name` (`string`): Required. The user-assigned display name of the Workload. When present it must be between 4 to 30 characters. Allowed characters are: lowercase and uppercase letters, numbers, hyphen, and spaces. Example: My Workload\n  - `labels` (`obj`): Optional. Labels applied to the workload.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `organization` (`string`): The organization for the resource\n  - `provisioned_resources_parent` (`string`): Input only. The parent resource for the resources managed by this Assured Workload. May be either an organization or a folder. Must be the same or a child of the Workload parent. If not specified all resources are created under the Workload parent. Formats: folders/{folder_id}, organizations/{organization_id} When `null`, the `provisioned_resources_parent` field will be omitted from the resulting object.\n  - `kms_settings` (`list[obj]`): Input only. Settings used to create a CMEK crypto key. When set a project with a KMS CMEK key is provisioned. This field is mandatory for a subset of Compliance Regimes. When `null`, the `kms_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.kms_settings.new](#fn-kms_settingsnew) constructor.\n  - `resource_settings` (`list[obj]`): Input only. Resource properties that are used to customize workload resources. These properties (such as custom project id) will be used to create workload resources if possible. This field is optional. When `null`, the `resource_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.resource_settings.new](#fn-resource_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.assured_workloads_workload.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `assured_workloads_workload` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     billing_account,
     compliance_regime,
diff --git a/4.x/_gen/resources/beyondcorp_app_connection.libsonnet b/4.x/_gen/resources/beyondcorp_app_connection.libsonnet
index 16589ca3..b01f8fe2 100644
--- a/4.x/_gen/resources/beyondcorp_app_connection.libsonnet
+++ b/4.x/_gen/resources/beyondcorp_app_connection.libsonnet
@@ -22,7 +22,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       type: type,
     }),
   },
-  '#new':: d.fn(help="\n`google.beyondcorp_app_connection.new` injects a new `google_beyondcorp_app_connection` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.beyondcorp_app_connection.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.beyondcorp_app_connection` using the reference:\n\n    $._ref.google_beyondcorp_app_connection.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_beyondcorp_app_connection.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `connectors` (`list`): List of AppConnectors that are authorised to be associated with this AppConnection When `null`, the `connectors` field will be omitted from the resulting object.\n  - `display_name` (`string`): An arbitrary user-provided name for the AppConnection. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): ID of the AppConnection.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the AppConnection. When `null`, the `region` field will be omitted from the resulting object.\n  - `type` (`string`): The type of network connectivity used by the AppConnection. Refer to\nhttps://cloud.google.com/beyondcorp/docs/reference/rest/v1/projects.locations.appConnections#type\nfor a list of possible values. When `null`, the `type` field will be omitted from the resulting object.\n  - `application_endpoint` (`list[obj]`): Address of the remote application endpoint for the BeyondCorp AppConnection. When `null`, the `application_endpoint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connection.application_endpoint.new](#fn-application_endpointnew) constructor.\n  - `gateway` (`list[obj]`): Gateway used by the AppConnection. When `null`, the `gateway` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connection.gateway.new](#fn-gatewaynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connection.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.beyondcorp_app_connection.new` injects a new `google_beyondcorp_app_connection` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.beyondcorp_app_connection.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.beyondcorp_app_connection` using the reference:\n\n    $._ref.google_beyondcorp_app_connection.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_beyondcorp_app_connection.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `connectors` (`list`): List of AppConnectors that are authorised to be associated with this AppConnection When `null`, the `connectors` field will be omitted from the resulting object.\n  - `display_name` (`string`): An arbitrary user-provided name for the AppConnection. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): ID of the AppConnection.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the AppConnection. When `null`, the `region` field will be omitted from the resulting object.\n  - `type` (`string`): The type of network connectivity used by the AppConnection. Refer to\nhttps://cloud.google.com/beyondcorp/docs/reference/rest/v1/projects.locations.appConnections#type\nfor a list of possible values. When `null`, the `type` field will be omitted from the resulting object.\n  - `application_endpoint` (`list[obj]`): Address of the remote application endpoint for the BeyondCorp AppConnection. When `null`, the `application_endpoint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connection.application_endpoint.new](#fn-application_endpointnew) constructor.\n  - `gateway` (`list[obj]`): Gateway used by the AppConnection. When `null`, the `gateway` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connection.gateway.new](#fn-gatewaynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connection.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -53,7 +53,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.beyondcorp_app_connection.newAttrs` constructs a new object with attributes and blocks configured for the `beyondcorp_app_connection`\nTerraform resource.\n\nUnlike [google.beyondcorp_app_connection.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `connectors` (`list`): List of AppConnectors that are authorised to be associated with this AppConnection When `null`, the `connectors` field will be omitted from the resulting object.\n  - `display_name` (`string`): An arbitrary user-provided name for the AppConnection. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): ID of the AppConnection.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the AppConnection. When `null`, the `region` field will be omitted from the resulting object.\n  - `type` (`string`): The type of network connectivity used by the AppConnection. Refer to\nhttps://cloud.google.com/beyondcorp/docs/reference/rest/v1/projects.locations.appConnections#type\nfor a list of possible values. When `null`, the `type` field will be omitted from the resulting object.\n  - `application_endpoint` (`list[obj]`): Address of the remote application endpoint for the BeyondCorp AppConnection. When `null`, the `application_endpoint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connection.application_endpoint.new](#fn-application_endpointnew) constructor.\n  - `gateway` (`list[obj]`): Gateway used by the AppConnection. When `null`, the `gateway` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connection.gateway.new](#fn-gatewaynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connection.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `beyondcorp_app_connection` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.beyondcorp_app_connection.newAttrs` constructs a new object with attributes and blocks configured for the `beyondcorp_app_connection`\nTerraform resource.\n\nUnlike [google.beyondcorp_app_connection.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `connectors` (`list`): List of AppConnectors that are authorised to be associated with this AppConnection When `null`, the `connectors` field will be omitted from the resulting object.\n  - `display_name` (`string`): An arbitrary user-provided name for the AppConnection. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): ID of the AppConnection.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the AppConnection. When `null`, the `region` field will be omitted from the resulting object.\n  - `type` (`string`): The type of network connectivity used by the AppConnection. Refer to\nhttps://cloud.google.com/beyondcorp/docs/reference/rest/v1/projects.locations.appConnections#type\nfor a list of possible values. When `null`, the `type` field will be omitted from the resulting object.\n  - `application_endpoint` (`list[obj]`): Address of the remote application endpoint for the BeyondCorp AppConnection. When `null`, the `application_endpoint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connection.application_endpoint.new](#fn-application_endpointnew) constructor.\n  - `gateway` (`list[obj]`): Gateway used by the AppConnection. When `null`, the `gateway` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connection.gateway.new](#fn-gatewaynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connection.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `beyondcorp_app_connection` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     application_endpoint=null,
diff --git a/4.x/_gen/resources/beyondcorp_app_connector.libsonnet b/4.x/_gen/resources/beyondcorp_app_connector.libsonnet
index 138f4820..2b3e8481 100644
--- a/4.x/_gen/resources/beyondcorp_app_connector.libsonnet
+++ b/4.x/_gen/resources/beyondcorp_app_connector.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='beyondcorp_app_connector', url='', help='`beyondcorp_app_connector` represents the `google_beyondcorp_app_connector` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.beyondcorp_app_connector.new` injects a new `google_beyondcorp_app_connector` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.beyondcorp_app_connector.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.beyondcorp_app_connector` using the reference:\n\n    $._ref.google_beyondcorp_app_connector.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_beyondcorp_app_connector.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `display_name` (`string`): An arbitrary user-provided name for the AppConnector. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): ID of the AppConnector.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the AppConnector. When `null`, the `region` field will be omitted from the resulting object.\n  - `principal_info` (`list[obj]`): Principal information about the Identity of the AppConnector. When `null`, the `principal_info` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connector.principal_info.new](#fn-principal_infonew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connector.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.beyondcorp_app_connector.new` injects a new `google_beyondcorp_app_connector` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.beyondcorp_app_connector.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.beyondcorp_app_connector` using the reference:\n\n    $._ref.google_beyondcorp_app_connector.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_beyondcorp_app_connector.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `display_name` (`string`): An arbitrary user-provided name for the AppConnector. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): ID of the AppConnector.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the AppConnector. When `null`, the `region` field will be omitted from the resulting object.\n  - `principal_info` (`list[obj]`): Principal information about the Identity of the AppConnector. When `null`, the `principal_info` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connector.principal_info.new](#fn-principal_infonew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connector.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -27,7 +27,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.beyondcorp_app_connector.newAttrs` constructs a new object with attributes and blocks configured for the `beyondcorp_app_connector`\nTerraform resource.\n\nUnlike [google.beyondcorp_app_connector.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `display_name` (`string`): An arbitrary user-provided name for the AppConnector. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): ID of the AppConnector.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the AppConnector. When `null`, the `region` field will be omitted from the resulting object.\n  - `principal_info` (`list[obj]`): Principal information about the Identity of the AppConnector. When `null`, the `principal_info` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connector.principal_info.new](#fn-principal_infonew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connector.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `beyondcorp_app_connector` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.beyondcorp_app_connector.newAttrs` constructs a new object with attributes and blocks configured for the `beyondcorp_app_connector`\nTerraform resource.\n\nUnlike [google.beyondcorp_app_connector.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `display_name` (`string`): An arbitrary user-provided name for the AppConnector. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): ID of the AppConnector.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the AppConnector. When `null`, the `region` field will be omitted from the resulting object.\n  - `principal_info` (`list[obj]`): Principal information about the Identity of the AppConnector. When `null`, the `principal_info` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connector.principal_info.new](#fn-principal_infonew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_connector.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `beyondcorp_app_connector` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     display_name=null,
diff --git a/4.x/_gen/resources/beyondcorp_app_gateway.libsonnet b/4.x/_gen/resources/beyondcorp_app_gateway.libsonnet
index 50477a70..198724bb 100644
--- a/4.x/_gen/resources/beyondcorp_app_gateway.libsonnet
+++ b/4.x/_gen/resources/beyondcorp_app_gateway.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='beyondcorp_app_gateway', url='', help='`beyondcorp_app_gateway` represents the `google_beyondcorp_app_gateway` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.beyondcorp_app_gateway.new` injects a new `google_beyondcorp_app_gateway` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.beyondcorp_app_gateway.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.beyondcorp_app_gateway` using the reference:\n\n    $._ref.google_beyondcorp_app_gateway.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_beyondcorp_app_gateway.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `display_name` (`string`): An arbitrary user-provided name for the AppGateway. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `host_type` (`string`): The type of hosting used by the AppGateway. Default value: \u0026#34;HOST_TYPE_UNSPECIFIED\u0026#34; Possible values: [\u0026#34;HOST_TYPE_UNSPECIFIED\u0026#34;, \u0026#34;GCP_REGIONAL_MIG\u0026#34;] When `null`, the `host_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): ID of the AppGateway.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the AppGateway. When `null`, the `region` field will be omitted from the resulting object.\n  - `type` (`string`): The type of network connectivity used by the AppGateway. Default value: \u0026#34;TYPE_UNSPECIFIED\u0026#34; Possible values: [\u0026#34;TYPE_UNSPECIFIED\u0026#34;, \u0026#34;TCP_PROXY\u0026#34;] When `null`, the `type` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_gateway.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.beyondcorp_app_gateway.new` injects a new `google_beyondcorp_app_gateway` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.beyondcorp_app_gateway.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.beyondcorp_app_gateway` using the reference:\n\n    $._ref.google_beyondcorp_app_gateway.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_beyondcorp_app_gateway.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `display_name` (`string`): An arbitrary user-provided name for the AppGateway. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `host_type` (`string`): The type of hosting used by the AppGateway. Default value: \u0026#34;HOST_TYPE_UNSPECIFIED\u0026#34; Possible values: [\u0026#34;HOST_TYPE_UNSPECIFIED\u0026#34;, \u0026#34;GCP_REGIONAL_MIG\u0026#34;] When `null`, the `host_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): ID of the AppGateway.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the AppGateway. When `null`, the `region` field will be omitted from the resulting object.\n  - `type` (`string`): The type of network connectivity used by the AppGateway. Default value: \u0026#34;TYPE_UNSPECIFIED\u0026#34; Possible values: [\u0026#34;TYPE_UNSPECIFIED\u0026#34;, \u0026#34;TCP_PROXY\u0026#34;] When `null`, the `type` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_gateway.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -29,7 +29,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.beyondcorp_app_gateway.newAttrs` constructs a new object with attributes and blocks configured for the `beyondcorp_app_gateway`\nTerraform resource.\n\nUnlike [google.beyondcorp_app_gateway.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `display_name` (`string`): An arbitrary user-provided name for the AppGateway. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `host_type` (`string`): The type of hosting used by the AppGateway. Default value: "HOST_TYPE_UNSPECIFIED" Possible values: ["HOST_TYPE_UNSPECIFIED", "GCP_REGIONAL_MIG"] When `null`, the `host_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): ID of the AppGateway.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the AppGateway. When `null`, the `region` field will be omitted from the resulting object.\n  - `type` (`string`): The type of network connectivity used by the AppGateway. Default value: "TYPE_UNSPECIFIED" Possible values: ["TYPE_UNSPECIFIED", "TCP_PROXY"] When `null`, the `type` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_gateway.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `beyondcorp_app_gateway` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.beyondcorp_app_gateway.newAttrs` constructs a new object with attributes and blocks configured for the `beyondcorp_app_gateway`\nTerraform resource.\n\nUnlike [google.beyondcorp_app_gateway.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `display_name` (`string`): An arbitrary user-provided name for the AppGateway. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `host_type` (`string`): The type of hosting used by the AppGateway. Default value: "HOST_TYPE_UNSPECIFIED" Possible values: ["HOST_TYPE_UNSPECIFIED", "GCP_REGIONAL_MIG"] When `null`, the `host_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): ID of the AppGateway.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the AppGateway. When `null`, the `region` field will be omitted from the resulting object.\n  - `type` (`string`): The type of network connectivity used by the AppGateway. Default value: "TYPE_UNSPECIFIED" Possible values: ["TYPE_UNSPECIFIED", "TCP_PROXY"] When `null`, the `type` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.beyondcorp_app_gateway.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `beyondcorp_app_gateway` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     display_name=null,
diff --git a/4.x/_gen/resources/bigquery_capacity_commitment.libsonnet b/4.x/_gen/resources/bigquery_capacity_commitment.libsonnet
index c2f8f85f..66345d45 100644
--- a/4.x/_gen/resources/bigquery_capacity_commitment.libsonnet
+++ b/4.x/_gen/resources/bigquery_capacity_commitment.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='bigquery_capacity_commitment', url='', help='`bigquery_capacity_commitment` represents the `google_bigquery_capacity_commitment` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.bigquery_capacity_commitment.new` injects a new `google_bigquery_capacity_commitment` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.bigquery_capacity_commitment.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.bigquery_capacity_commitment` using the reference:\n\n    $._ref.google_bigquery_capacity_commitment.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_bigquery_capacity_commitment.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `capacity_commitment_id` (`string`): The optional capacity commitment ID. Capacity commitment name will be generated automatically if this field is\nempty. This field must only contain lower case alphanumeric characters or dashes. The first and last character\ncannot be a dash. Max length is 64 characters. NOTE: this ID won\u0026#39;t be kept if the capacity commitment is split\nor merged. When `null`, the `capacity_commitment_id` field will be omitted from the resulting object.\n  - `edition` (`string`): The edition type. Valid values are STANDARD, ENTERPRISE, ENTERPRISE_PLUS When `null`, the `edition` field will be omitted from the resulting object.\n  - `enforce_single_admin_project_per_org` (`string`): If true, fail the request if another project in the organization has a capacity commitment. When `null`, the `enforce_single_admin_project_per_org` field will be omitted from the resulting object.\n  - `location` (`string`): The geographic location where the transfer config should reside.\nExamples: US, EU, asia-northeast1. The default value is US. When `null`, the `location` field will be omitted from the resulting object.\n  - `plan` (`string`): Capacity commitment plan. Valid values are at https://cloud.google.com/bigquery/docs/reference/reservations/rpc/google.cloud.bigquery.reservation.v1#commitmentplan\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `renewal_plan` (`string`): The plan this capacity commitment is converted to after commitmentEndTime passes. Once the plan is changed, committed period is extended according to commitment plan. Only applicable some commitment plans. When `null`, the `renewal_plan` field will be omitted from the resulting object.\n  - `slot_count` (`number`): Number of slots in this commitment.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_capacity_commitment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.bigquery_capacity_commitment.new` injects a new `google_bigquery_capacity_commitment` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.bigquery_capacity_commitment.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.bigquery_capacity_commitment` using the reference:\n\n    $._ref.google_bigquery_capacity_commitment.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_bigquery_capacity_commitment.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `capacity_commitment_id` (`string`): The optional capacity commitment ID. Capacity commitment name will be generated automatically if this field is\nempty. This field must only contain lower case alphanumeric characters or dashes. The first and last character\ncannot be a dash. Max length is 64 characters. NOTE: this ID won\u0026#39;t be kept if the capacity commitment is split\nor merged. When `null`, the `capacity_commitment_id` field will be omitted from the resulting object.\n  - `edition` (`string`): The edition type. Valid values are STANDARD, ENTERPRISE, ENTERPRISE_PLUS When `null`, the `edition` field will be omitted from the resulting object.\n  - `enforce_single_admin_project_per_org` (`string`): If true, fail the request if another project in the organization has a capacity commitment. When `null`, the `enforce_single_admin_project_per_org` field will be omitted from the resulting object.\n  - `location` (`string`): The geographic location where the transfer config should reside.\nExamples: US, EU, asia-northeast1. The default value is US. When `null`, the `location` field will be omitted from the resulting object.\n  - `plan` (`string`): Capacity commitment plan. Valid values are at https://cloud.google.com/bigquery/docs/reference/reservations/rpc/google.cloud.bigquery.reservation.v1#commitmentplan\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `renewal_plan` (`string`): The plan this capacity commitment is converted to after commitmentEndTime passes. Once the plan is changed, committed period is extended according to commitment plan. Only applicable for some commitment plans. When `null`, the `renewal_plan` field will be omitted from the resulting object.\n  - `slot_count` (`number`): Number of slots in this commitment.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_capacity_commitment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     plan,
@@ -31,7 +31,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.bigquery_capacity_commitment.newAttrs` constructs a new object with attributes and blocks configured for the `bigquery_capacity_commitment`\nTerraform resource.\n\nUnlike [google.bigquery_capacity_commitment.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `capacity_commitment_id` (`string`): The optional capacity commitment ID. Capacity commitment name will be generated automatically if this field is\nempty. This field must only contain lower case alphanumeric characters or dashes. The first and last character\ncannot be a dash. Max length is 64 characters. NOTE: this ID won't be kept if the capacity commitment is split\nor merged. When `null`, the `capacity_commitment_id` field will be omitted from the resulting object.\n  - `edition` (`string`): The edition type. Valid values are STANDARD, ENTERPRISE, ENTERPRISE_PLUS When `null`, the `edition` field will be omitted from the resulting object.\n  - `enforce_single_admin_project_per_org` (`string`): If true, fail the request if another project in the organization has a capacity commitment. When `null`, the `enforce_single_admin_project_per_org` field will be omitted from the resulting object.\n  - `location` (`string`): The geographic location where the transfer config should reside.\nExamples: US, EU, asia-northeast1. The default value is US. When `null`, the `location` field will be omitted from the resulting object.\n  - `plan` (`string`): Capacity commitment plan. Valid values are at https://cloud.google.com/bigquery/docs/reference/reservations/rpc/google.cloud.bigquery.reservation.v1#commitmentplan\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `renewal_plan` (`string`): The plan this capacity commitment is converted to after commitmentEndTime passes. Once the plan is changed, committed period is extended according to commitment plan. Only applicable some commitment plans. When `null`, the `renewal_plan` field will be omitted from the resulting object.\n  - `slot_count` (`number`): Number of slots in this commitment.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_capacity_commitment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `bigquery_capacity_commitment` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.bigquery_capacity_commitment.newAttrs` constructs a new object with attributes and blocks configured for the `bigquery_capacity_commitment`\nTerraform resource.\n\nUnlike [google.bigquery_capacity_commitment.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `capacity_commitment_id` (`string`): The optional capacity commitment ID. Capacity commitment name will be generated automatically if this field is\nempty. This field must only contain lower case alphanumeric characters or dashes. The first and last character\ncannot be a dash. Max length is 64 characters. NOTE: this ID won't be kept if the capacity commitment is split\nor merged. When `null`, the `capacity_commitment_id` field will be omitted from the resulting object.\n  - `edition` (`string`): The edition type. Valid values are STANDARD, ENTERPRISE, ENTERPRISE_PLUS When `null`, the `edition` field will be omitted from the resulting object.\n  - `enforce_single_admin_project_per_org` (`string`): If true, fail the request if another project in the organization has a capacity commitment. When `null`, the `enforce_single_admin_project_per_org` field will be omitted from the resulting object.\n  - `location` (`string`): The geographic location where the transfer config should reside.\nExamples: US, EU, asia-northeast1. The default value is US. When `null`, the `location` field will be omitted from the resulting object.\n  - `plan` (`string`): Capacity commitment plan. Valid values are at https://cloud.google.com/bigquery/docs/reference/reservations/rpc/google.cloud.bigquery.reservation.v1#commitmentplan\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `renewal_plan` (`string`): The plan this capacity commitment is converted to after commitmentEndTime passes. Once the plan is changed, committed period is extended according to commitment plan. Only applicable for some commitment plans. When `null`, the `renewal_plan` field will be omitted from the resulting object.\n  - `slot_count` (`number`): Number of slots in this commitment.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_capacity_commitment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `bigquery_capacity_commitment` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     plan,
     slot_count,
diff --git a/4.x/_gen/resources/bigquery_connection.libsonnet b/4.x/_gen/resources/bigquery_connection.libsonnet
index ef95b6f2..f6cb4301 100644
--- a/4.x/_gen/resources/bigquery_connection.libsonnet
+++ b/4.x/_gen/resources/bigquery_connection.libsonnet
@@ -35,13 +35,19 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ):: std.prune(a={}),
   },
   cloud_spanner:: {
-    '#new':: d.fn(help='\n`google.bigquery_connection.cloud_spanner.new` constructs a new object with attributes and blocks configured for the `cloud_spanner`\nTerraform sub block.\n\n\n\n**Args**:\n  - `database` (`string`): Cloud Spanner database in the form 'project/instance/database'\n  - `use_parallelism` (`bool`): If parallelism should be used when reading from Cloud Spanner When `null`, the `use_parallelism` field will be omitted from the resulting object.\n  - `use_serverless_analytics` (`bool`): If the serverless analytics service should be used to read data from Cloud Spanner. useParallelism must be set when using serverless analytics When `null`, the `use_serverless_analytics` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `cloud_spanner` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.bigquery_connection.cloud_spanner.new` constructs a new object with attributes and blocks configured for the `cloud_spanner`\nTerraform sub block.\n\n\n\n**Args**:\n  - `database` (`string`): Cloud Spanner database in the form 'project/instance/database'.\n  - `database_role` (`string`): Cloud Spanner database role for fine-grained access control. The Cloud Spanner admin should have provisioned the database role with appropriate permissions, such as 'SELECT' and 'INSERT'. Other users should only use roles provided by their Cloud Spanner admins. The database role name must start with a letter, and can only contain letters, numbers, and underscores. For more details, see https://cloud.google.com/spanner/docs/fgac-about. When `null`, the `database_role` field will be omitted from the resulting object.\n  - `max_parallelism` (`number`): Allows setting max parallelism per query when executing on Spanner independent compute resources. If unspecified, default values of parallelism are chosen that are dependent on the Cloud Spanner instance configuration. 'useParallelism' and 'useDataBoost' must be set when setting max parallelism. When `null`, the `max_parallelism` field will be omitted from the resulting object.\n  - `use_data_boost` (`bool`): If set, the request will be executed via Spanner independent compute resources. 'use_parallelism' must be set when using data boost. When `null`, the `use_data_boost` field will be omitted from the resulting object.\n  - `use_parallelism` (`bool`): If parallelism should be used when reading from Cloud Spanner. When `null`, the `use_parallelism` field will be omitted from the resulting object.\n  - `use_serverless_analytics` (`bool`): If the serverless analytics service should be used to read data from Cloud Spanner. 'useParallelism' must be set when using serverless analytics. When `null`, the `use_serverless_analytics` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `cloud_spanner` sub block.\n', args=[]),
     new(
       database,
+      database_role=null,
+      max_parallelism=null,
+      use_data_boost=null,
       use_parallelism=null,
       use_serverless_analytics=null
     ):: std.prune(a={
       database: database,
+      database_role: database_role,
+      max_parallelism: max_parallelism,
+      use_data_boost: use_data_boost,
       use_parallelism: use_parallelism,
       use_serverless_analytics: use_serverless_analytics,
     }),
diff --git a/4.x/_gen/resources/bigquery_dataset.libsonnet b/4.x/_gen/resources/bigquery_dataset.libsonnet
index df57fea8..1f40ddce 100644
--- a/4.x/_gen/resources/bigquery_dataset.libsonnet
+++ b/4.x/_gen/resources/bigquery_dataset.libsonnet
@@ -23,11 +23,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         target_types: target_types,
       }),
     },
-    '#new':: d.fn(help='\n`google.bigquery_dataset.access.new` constructs a new object with attributes and blocks configured for the `access`\nTerraform sub block.\n\n\n\n**Args**:\n  - `domain` (`string`): A domain to grant access to. Any users signed in with the\ndomain specified will be granted the specified access When `null`, the `domain` field will be omitted from the resulting object.\n  - `group_by_email` (`string`): An email address of a Google Group to grant access to. When `null`, the `group_by_email` field will be omitted from the resulting object.\n  - `role` (`string`): Describes the rights granted to the user specified by the other\nmember of the access object. Basic, predefined, and custom roles\nare supported. Predefined roles that have equivalent basic roles\nare swapped by the API to their basic counterparts. See\n[official docs](https://cloud.google.com/bigquery/docs/access-control). When `null`, the `role` field will be omitted from the resulting object.\n  - `special_group` (`string`): A special group to grant access to. Possible values include:\n\n\n* 'projectOwners': Owners of the enclosing project.\n\n\n* 'projectReaders': Readers of the enclosing project.\n\n\n* 'projectWriters': Writers of the enclosing project.\n\n\n* 'allAuthenticatedUsers': All authenticated BigQuery users. When `null`, the `special_group` field will be omitted from the resulting object.\n  - `user_by_email` (`string`): An email address of a user to grant access to. For example:\nfred@example.com When `null`, the `user_by_email` field will be omitted from the resulting object.\n  - `dataset` (`list[obj]`): Grants all resources of particular types in a particular dataset read access to the current dataset. When `null`, the `dataset` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.access.dataset.new](#fn-accessdatasetnew) constructor.\n  - `routine` (`list[obj]`): A routine from a different dataset to grant access to. Queries\nexecuted against that routine will have read access to tables in\nthis dataset. The role field is not required when this field is\nset. If that routine is updated by any user, access to the routine\nneeds to be granted again via an update operation. When `null`, the `routine` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.access.routine.new](#fn-accessroutinenew) constructor.\n  - `view` (`list[obj]`): A view from a different dataset to grant access to. Queries\nexecuted against that view will have read access to tables in\nthis dataset. The role field is not required when this field is\nset. If that view is updated by any user, access to the view\nneeds to be granted again via an update operation. When `null`, the `view` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.access.view.new](#fn-accessviewnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `access` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.bigquery_dataset.access.new` constructs a new object with attributes and blocks configured for the `access`\nTerraform sub block.\n\n\n\n**Args**:\n  - `domain` (`string`): A domain to grant access to. Any users signed in with the\ndomain specified will be granted the specified access When `null`, the `domain` field will be omitted from the resulting object.\n  - `group_by_email` (`string`): An email address of a Google Group to grant access to. When `null`, the `group_by_email` field will be omitted from the resulting object.\n  - `iam_member` (`string`): Some other type of member that appears in the IAM Policy but isn't a user,\ngroup, domain, or special group. For example: 'allUsers' When `null`, the `iam_member` field will be omitted from the resulting object.\n  - `role` (`string`): Describes the rights granted to the user specified by the other\nmember of the access object. Basic, predefined, and custom roles\nare supported. Predefined roles that have equivalent basic roles\nare swapped by the API to their basic counterparts. See\n[official docs](https://cloud.google.com/bigquery/docs/access-control). When `null`, the `role` field will be omitted from the resulting object.\n  - `special_group` (`string`): A special group to grant access to. Possible values include:\n\n\n* 'projectOwners': Owners of the enclosing project.\n\n\n* 'projectReaders': Readers of the enclosing project.\n\n\n* 'projectWriters': Writers of the enclosing project.\n\n\n* 'allAuthenticatedUsers': All authenticated BigQuery users. When `null`, the `special_group` field will be omitted from the resulting object.\n  - `user_by_email` (`string`): An email address of a user to grant access to. For example:\nfred@example.com When `null`, the `user_by_email` field will be omitted from the resulting object.\n  - `dataset` (`list[obj]`): Grants all resources of particular types in a particular dataset read access to the current dataset. When `null`, the `dataset` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.access.dataset.new](#fn-accessdatasetnew) constructor.\n  - `routine` (`list[obj]`): A routine from a different dataset to grant access to. Queries\nexecuted against that routine will have read access to tables in\nthis dataset. The role field is not required when this field is\nset. If that routine is updated by any user, access to the routine\nneeds to be granted again via an update operation. When `null`, the `routine` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.access.routine.new](#fn-accessroutinenew) constructor.\n  - `view` (`list[obj]`): A view from a different dataset to grant access to. Queries\nexecuted against that view will have read access to tables in\nthis dataset. The role field is not required when this field is\nset. If that view is updated by any user, access to the view\nneeds to be granted again via an update operation. When `null`, the `view` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.access.view.new](#fn-accessviewnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `access` sub block.\n', args=[]),
     new(
       dataset=null,
       domain=null,
       group_by_email=null,
+      iam_member=null,
       role=null,
       routine=null,
       special_group=null,
@@ -37,6 +38,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       dataset: dataset,
       domain: domain,
       group_by_email: group_by_email,
+      iam_member: iam_member,
       role: role,
       routine: routine,
       special_group: special_group,
@@ -76,7 +78,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       kms_key_name: kms_key_name,
     }),
   },
-  '#new':: d.fn(help="\n`google.bigquery_dataset.new` injects a new `google_bigquery_dataset` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.bigquery_dataset.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.bigquery_dataset` using the reference:\n\n    $._ref.google_bigquery_dataset.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_bigquery_dataset.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `dataset_id` (`string`): A unique ID for this dataset, without the project name. The ID\nmust contain only letters (a-z, A-Z), numbers (0-9), or\nunderscores (_). The maximum length is 1,024 characters.\n  - `default_collation` (`string`): Defines the default collation specification of future tables created\nin the dataset. If a table is created in this dataset without table-level\ndefault collation, then the table inherits the dataset default collation,\nwhich is applied to the string fields that do not have explicit collation\nspecified. A change to this field affects only tables created afterwards,\nand does not alter the existing tables.\n\nThe following values are supported:\n- \u0026#39;und:ci\u0026#39;: undetermined locale, case insensitive.\n- \u0026#39;\u0026#39;: empty string. Default to case-sensitive behavior. When `null`, the `default_collation` field will be omitted from the resulting object.\n  - `default_partition_expiration_ms` (`number`): The default partition expiration for all partitioned tables in\nthe dataset, in milliseconds.\n\n\nOnce this property is set, all newly-created partitioned tables in\nthe dataset will have an \u0026#39;expirationMs\u0026#39; property in the \u0026#39;timePartitioning\u0026#39;\nsettings set to this value, and changing the value will only\naffect new tables, not existing ones. The storage in a partition will\nhave an expiration time of its partition time plus this value.\nSetting this property overrides the use of \u0026#39;defaultTableExpirationMs\u0026#39;\nfor partitioned tables: only one of \u0026#39;defaultTableExpirationMs\u0026#39; and\n\u0026#39;defaultPartitionExpirationMs\u0026#39; will be used for any new partitioned\ntable. If you provide an explicit \u0026#39;timePartitioning.expirationMs\u0026#39; when\ncreating or updating a partitioned table, that value takes precedence\nover the default partition expiration time indicated by this property. When `null`, the `default_partition_expiration_ms` field will be omitted from the resulting object.\n  - `default_table_expiration_ms` (`number`): The default lifetime of all tables in the dataset, in milliseconds.\nThe minimum value is 3600000 milliseconds (one hour).\n\n\nOnce this property is set, all newly-created tables in the dataset\nwill have an \u0026#39;expirationTime\u0026#39; property set to the creation time plus\nthe value in this property, and changing the value will only affect\nnew tables, not existing ones. When the \u0026#39;expirationTime\u0026#39; for a given\ntable is reached, that table will be deleted automatically.\nIf a table\u0026#39;s \u0026#39;expirationTime\u0026#39; is modified or removed before the\ntable expires, or if you provide an explicit \u0026#39;expirationTime\u0026#39; when\ncreating a table, that value takes precedence over the default\nexpiration time indicated by this property. When `null`, the `default_table_expiration_ms` field will be omitted from the resulting object.\n  - `delete_contents_on_destroy` (`bool`): If set to \u0026#39;true\u0026#39;, delete all the tables in the\ndataset when destroying the resource; otherwise,\ndestroying the resource will fail if tables are present. When `null`, the `delete_contents_on_destroy` field will be omitted from the resulting object.\n  - `description` (`string`): A user-friendly description of the dataset When `null`, the `description` field will be omitted from the resulting object.\n  - `friendly_name` (`string`): A descriptive name for the dataset When `null`, the `friendly_name` field will be omitted from the resulting object.\n  - `is_case_insensitive` (`bool`): TRUE if the dataset and its table names are case-insensitive, otherwise FALSE.\nBy default, this is FALSE, which means the dataset and its table names are\ncase-sensitive. This field does not affect routine references. When `null`, the `is_case_insensitive` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels associated with this dataset. You can use these to\norganize and group your datasets When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The geographic location where the dataset should reside.\nSee [official docs](https://cloud.google.com/bigquery/docs/dataset-locations).\n\n\nThere are two types of locations, regional or multi-regional. A regional\nlocation is a specific geographic place, such as Tokyo, and a multi-regional\nlocation is a large geographic area, such as the United States, that\ncontains at least two geographic places.\n\n\nThe default value is multi-regional location \u0026#39;US\u0026#39;.\nChanging this forces a new resource to be created. When `null`, the `location` field will be omitted from the resulting object.\n  - `max_time_travel_hours` (`string`): Defines the time travel window in hours. The value can be from 48 to 168 hours (2 to 7 days). When `null`, the `max_time_travel_hours` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `storage_billing_model` (`string`): Specifies the storage billing model for the dataset.\nSet this flag value to LOGICAL to use logical bytes for storage billing,\nor to PHYSICAL to use physical bytes instead.\n\nLOGICAL is the default if this flag isn\u0026#39;t specified. When `null`, the `storage_billing_model` field will be omitted from the resulting object.\n  - `access` (`list[obj]`): An array of objects that define dataset access for one or more entities. When `null`, the `access` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.access.new](#fn-accessnew) constructor.\n  - `default_encryption_configuration` (`list[obj]`): The default encryption key for all tables in the dataset. Once this property is set,\nall newly-created partitioned tables in the dataset will have encryption key set to\nthis value, unless table creation request (or query) overrides the key. When `null`, the `default_encryption_configuration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.default_encryption_configuration.new](#fn-default_encryption_configurationnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.bigquery_dataset.new` injects a new `google_bigquery_dataset` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.bigquery_dataset.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.bigquery_dataset` using the reference:\n\n    $._ref.google_bigquery_dataset.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_bigquery_dataset.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `dataset_id` (`string`): A unique ID for this dataset, without the project name. The ID\nmust contain only letters (a-z, A-Z), numbers (0-9), or\nunderscores (_). The maximum length is 1,024 characters.\n  - `default_collation` (`string`): Defines the default collation specification of future tables created\nin the dataset. If a table is created in this dataset without table-level\ndefault collation, then the table inherits the dataset default collation,\nwhich is applied to the string fields that do not have explicit collation\nspecified. A change to this field affects only tables created afterwards,\nand does not alter the existing tables.\n\nThe following values are supported:\n- \u0026#39;und:ci\u0026#39;: undetermined locale, case insensitive.\n- \u0026#39;\u0026#39;: empty string. Default to case-sensitive behavior. When `null`, the `default_collation` field will be omitted from the resulting object.\n  - `default_partition_expiration_ms` (`number`): The default partition expiration for all partitioned tables in\nthe dataset, in milliseconds.\n\n\nOnce this property is set, all newly-created partitioned tables in\nthe dataset will have an \u0026#39;expirationMs\u0026#39; property in the \u0026#39;timePartitioning\u0026#39;\nsettings set to this value, and changing the value will only\naffect new tables, not existing ones. The storage in a partition will\nhave an expiration time of its partition time plus this value.\nSetting this property overrides the use of \u0026#39;defaultTableExpirationMs\u0026#39;\nfor partitioned tables: only one of \u0026#39;defaultTableExpirationMs\u0026#39; and\n\u0026#39;defaultPartitionExpirationMs\u0026#39; will be used for any new partitioned\ntable. If you provide an explicit \u0026#39;timePartitioning.expirationMs\u0026#39; when\ncreating or updating a partitioned table, that value takes precedence\nover the default partition expiration time indicated by this property. When `null`, the `default_partition_expiration_ms` field will be omitted from the resulting object.\n  - `default_table_expiration_ms` (`number`): The default lifetime of all tables in the dataset, in milliseconds.\nThe minimum value is 3600000 milliseconds (one hour).\n\n\nOnce this property is set, all newly-created tables in the dataset\nwill have an \u0026#39;expirationTime\u0026#39; property set to the creation time plus\nthe value in this property, and changing the value will only affect\nnew tables, not existing ones. When the \u0026#39;expirationTime\u0026#39; for a given\ntable is reached, that table will be deleted automatically.\nIf a table\u0026#39;s \u0026#39;expirationTime\u0026#39; is modified or removed before the\ntable expires, or if you provide an explicit \u0026#39;expirationTime\u0026#39; when\ncreating a table, that value takes precedence over the default\nexpiration time indicated by this property. When `null`, the `default_table_expiration_ms` field will be omitted from the resulting object.\n  - `delete_contents_on_destroy` (`bool`): If set to \u0026#39;true\u0026#39;, delete all the tables in the\ndataset when destroying the resource; otherwise,\ndestroying the resource will fail if tables are present. When `null`, the `delete_contents_on_destroy` field will be omitted from the resulting object.\n  - `description` (`string`): A user-friendly description of the dataset When `null`, the `description` field will be omitted from the resulting object.\n  - `friendly_name` (`string`): A descriptive name for the dataset When `null`, the `friendly_name` field will be omitted from the resulting object.\n  - `is_case_insensitive` (`bool`): TRUE if the dataset and its table names are case-insensitive, otherwise FALSE.\nBy default, this is FALSE, which means the dataset and its table names are\ncase-sensitive. This field does not affect routine references. When `null`, the `is_case_insensitive` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels associated with this dataset. You can use these to\norganize and group your datasets.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The geographic location where the dataset should reside.\nSee [official docs](https://cloud.google.com/bigquery/docs/dataset-locations).\n\n\nThere are two types of locations, regional or multi-regional. A regional\nlocation is a specific geographic place, such as Tokyo, and a multi-regional\nlocation is a large geographic area, such as the United States, that\ncontains at least two geographic places.\n\n\nThe default value is multi-regional location \u0026#39;US\u0026#39;.\nChanging this forces a new resource to be created. When `null`, the `location` field will be omitted from the resulting object.\n  - `max_time_travel_hours` (`string`): Defines the time travel window in hours. The value can be from 48 to 168 hours (2 to 7 days). When `null`, the `max_time_travel_hours` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `storage_billing_model` (`string`): Specifies the storage billing model for the dataset.\nSet this flag value to LOGICAL to use logical bytes for storage billing,\nor to PHYSICAL to use physical bytes instead.\n\nLOGICAL is the default if this flag isn\u0026#39;t specified. When `null`, the `storage_billing_model` field will be omitted from the resulting object.\n  - `access` (`list[obj]`): An array of objects that define dataset access for one or more entities. When `null`, the `access` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.access.new](#fn-accessnew) constructor.\n  - `default_encryption_configuration` (`list[obj]`): The default encryption key for all tables in the dataset. Once this property is set,\nall newly-created partitioned tables in the dataset will have encryption key set to\nthis value, unless table creation request (or query) overrides the key. When `null`, the `default_encryption_configuration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.default_encryption_configuration.new](#fn-default_encryption_configurationnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     dataset_id,
@@ -119,7 +121,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.bigquery_dataset.newAttrs` constructs a new object with attributes and blocks configured for the `bigquery_dataset`\nTerraform resource.\n\nUnlike [google.bigquery_dataset.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `dataset_id` (`string`): A unique ID for this dataset, without the project name. The ID\nmust contain only letters (a-z, A-Z), numbers (0-9), or\nunderscores (_). The maximum length is 1,024 characters.\n  - `default_collation` (`string`): Defines the default collation specification of future tables created\nin the dataset. If a table is created in this dataset without table-level\ndefault collation, then the table inherits the dataset default collation,\nwhich is applied to the string fields that do not have explicit collation\nspecified. A change to this field affects only tables created afterwards,\nand does not alter the existing tables.\n\nThe following values are supported:\n- 'und:ci': undetermined locale, case insensitive.\n- '': empty string. Default to case-sensitive behavior. When `null`, the `default_collation` field will be omitted from the resulting object.\n  - `default_partition_expiration_ms` (`number`): The default partition expiration for all partitioned tables in\nthe dataset, in milliseconds.\n\n\nOnce this property is set, all newly-created partitioned tables in\nthe dataset will have an 'expirationMs' property in the 'timePartitioning'\nsettings set to this value, and changing the value will only\naffect new tables, not existing ones. The storage in a partition will\nhave an expiration time of its partition time plus this value.\nSetting this property overrides the use of 'defaultTableExpirationMs'\nfor partitioned tables: only one of 'defaultTableExpirationMs' and\n'defaultPartitionExpirationMs' will be used for any new partitioned\ntable. If you provide an explicit 'timePartitioning.expirationMs' when\ncreating or updating a partitioned table, that value takes precedence\nover the default partition expiration time indicated by this property. When `null`, the `default_partition_expiration_ms` field will be omitted from the resulting object.\n  - `default_table_expiration_ms` (`number`): The default lifetime of all tables in the dataset, in milliseconds.\nThe minimum value is 3600000 milliseconds (one hour).\n\n\nOnce this property is set, all newly-created tables in the dataset\nwill have an 'expirationTime' property set to the creation time plus\nthe value in this property, and changing the value will only affect\nnew tables, not existing ones. When the 'expirationTime' for a given\ntable is reached, that table will be deleted automatically.\nIf a table's 'expirationTime' is modified or removed before the\ntable expires, or if you provide an explicit 'expirationTime' when\ncreating a table, that value takes precedence over the default\nexpiration time indicated by this property. When `null`, the `default_table_expiration_ms` field will be omitted from the resulting object.\n  - `delete_contents_on_destroy` (`bool`): If set to 'true', delete all the tables in the\ndataset when destroying the resource; otherwise,\ndestroying the resource will fail if tables are present. When `null`, the `delete_contents_on_destroy` field will be omitted from the resulting object.\n  - `description` (`string`): A user-friendly description of the dataset When `null`, the `description` field will be omitted from the resulting object.\n  - `friendly_name` (`string`): A descriptive name for the dataset When `null`, the `friendly_name` field will be omitted from the resulting object.\n  - `is_case_insensitive` (`bool`): TRUE if the dataset and its table names are case-insensitive, otherwise FALSE.\nBy default, this is FALSE, which means the dataset and its table names are\ncase-sensitive. This field does not affect routine references. When `null`, the `is_case_insensitive` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels associated with this dataset. You can use these to\norganize and group your datasets When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The geographic location where the dataset should reside.\nSee [official docs](https://cloud.google.com/bigquery/docs/dataset-locations).\n\n\nThere are two types of locations, regional or multi-regional. A regional\nlocation is a specific geographic place, such as Tokyo, and a multi-regional\nlocation is a large geographic area, such as the United States, that\ncontains at least two geographic places.\n\n\nThe default value is multi-regional location 'US'.\nChanging this forces a new resource to be created. When `null`, the `location` field will be omitted from the resulting object.\n  - `max_time_travel_hours` (`string`): Defines the time travel window in hours. The value can be from 48 to 168 hours (2 to 7 days). When `null`, the `max_time_travel_hours` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `storage_billing_model` (`string`): Specifies the storage billing model for the dataset.\nSet this flag value to LOGICAL to use logical bytes for storage billing,\nor to PHYSICAL to use physical bytes instead.\n\nLOGICAL is the default if this flag isn't specified. When `null`, the `storage_billing_model` field will be omitted from the resulting object.\n  - `access` (`list[obj]`): An array of objects that define dataset access for one or more entities. When `null`, the `access` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.access.new](#fn-accessnew) constructor.\n  - `default_encryption_configuration` (`list[obj]`): The default encryption key for all tables in the dataset. Once this property is set,\nall newly-created partitioned tables in the dataset will have encryption key set to\nthis value, unless table creation request (or query) overrides the key. When `null`, the `default_encryption_configuration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.default_encryption_configuration.new](#fn-default_encryption_configurationnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `bigquery_dataset` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.bigquery_dataset.newAttrs` constructs a new object with attributes and blocks configured for the `bigquery_dataset`\nTerraform resource.\n\nUnlike [google.bigquery_dataset.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `dataset_id` (`string`): A unique ID for this dataset, without the project name. The ID\nmust contain only letters (a-z, A-Z), numbers (0-9), or\nunderscores (_). The maximum length is 1,024 characters.\n  - `default_collation` (`string`): Defines the default collation specification of future tables created\nin the dataset. If a table is created in this dataset without table-level\ndefault collation, then the table inherits the dataset default collation,\nwhich is applied to the string fields that do not have explicit collation\nspecified. A change to this field affects only tables created afterwards,\nand does not alter the existing tables.\n\nThe following values are supported:\n- 'und:ci': undetermined locale, case insensitive.\n- '': empty string. Default to case-sensitive behavior. When `null`, the `default_collation` field will be omitted from the resulting object.\n  - `default_partition_expiration_ms` (`number`): The default partition expiration for all partitioned tables in\nthe dataset, in milliseconds.\n\n\nOnce this property is set, all newly-created partitioned tables in\nthe dataset will have an 'expirationMs' property in the 'timePartitioning'\nsettings set to this value, and changing the value will only\naffect new tables, not existing ones. The storage in a partition will\nhave an expiration time of its partition time plus this value.\nSetting this property overrides the use of 'defaultTableExpirationMs'\nfor partitioned tables: only one of 'defaultTableExpirationMs' and\n'defaultPartitionExpirationMs' will be used for any new partitioned\ntable. If you provide an explicit 'timePartitioning.expirationMs' when\ncreating or updating a partitioned table, that value takes precedence\nover the default partition expiration time indicated by this property. When `null`, the `default_partition_expiration_ms` field will be omitted from the resulting object.\n  - `default_table_expiration_ms` (`number`): The default lifetime of all tables in the dataset, in milliseconds.\nThe minimum value is 3600000 milliseconds (one hour).\n\n\nOnce this property is set, all newly-created tables in the dataset\nwill have an 'expirationTime' property set to the creation time plus\nthe value in this property, and changing the value will only affect\nnew tables, not existing ones. When the 'expirationTime' for a given\ntable is reached, that table will be deleted automatically.\nIf a table's 'expirationTime' is modified or removed before the\ntable expires, or if you provide an explicit 'expirationTime' when\ncreating a table, that value takes precedence over the default\nexpiration time indicated by this property. When `null`, the `default_table_expiration_ms` field will be omitted from the resulting object.\n  - `delete_contents_on_destroy` (`bool`): If set to 'true', delete all the tables in the\ndataset when destroying the resource; otherwise,\ndestroying the resource will fail if tables are present. When `null`, the `delete_contents_on_destroy` field will be omitted from the resulting object.\n  - `description` (`string`): A user-friendly description of the dataset When `null`, the `description` field will be omitted from the resulting object.\n  - `friendly_name` (`string`): A descriptive name for the dataset When `null`, the `friendly_name` field will be omitted from the resulting object.\n  - `is_case_insensitive` (`bool`): TRUE if the dataset and its table names are case-insensitive, otherwise FALSE.\nBy default, this is FALSE, which means the dataset and its table names are\ncase-sensitive. This field does not affect routine references. When `null`, the `is_case_insensitive` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels associated with this dataset. You can use these to\norganize and group your datasets.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The geographic location where the dataset should reside.\nSee [official docs](https://cloud.google.com/bigquery/docs/dataset-locations).\n\n\nThere are two types of locations, regional or multi-regional. A regional\nlocation is a specific geographic place, such as Tokyo, and a multi-regional\nlocation is a large geographic area, such as the United States, that\ncontains at least two geographic places.\n\n\nThe default value is multi-regional location 'US'.\nChanging this forces a new resource to be created. When `null`, the `location` field will be omitted from the resulting object.\n  - `max_time_travel_hours` (`string`): Defines the time travel window in hours. The value can be from 48 to 168 hours (2 to 7 days). When `null`, the `max_time_travel_hours` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `storage_billing_model` (`string`): Specifies the storage billing model for the dataset.\nSet this flag value to LOGICAL to use logical bytes for storage billing,\nor to PHYSICAL to use physical bytes instead.\n\nLOGICAL is the default if this flag isn't specified. When `null`, the `storage_billing_model` field will be omitted from the resulting object.\n  - `access` (`list[obj]`): An array of objects that define dataset access for one or more entities. When `null`, the `access` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.access.new](#fn-accessnew) constructor.\n  - `default_encryption_configuration` (`list[obj]`): The default encryption key for all tables in the dataset. Once this property is set,\nall newly-created partitioned tables in the dataset will have encryption key set to\nthis value, unless table creation request (or query) overrides the key. When `null`, the `default_encryption_configuration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.default_encryption_configuration.new](#fn-default_encryption_configurationnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_dataset.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `bigquery_dataset` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     dataset_id,
     access=null,
diff --git a/4.x/_gen/resources/bigquery_job.libsonnet b/4.x/_gen/resources/bigquery_job.libsonnet
index 6ec174a7..8cf41729 100644
--- a/4.x/_gen/resources/bigquery_job.libsonnet
+++ b/4.x/_gen/resources/bigquery_job.libsonnet
@@ -186,7 +186,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
   },
-  '#new':: d.fn(help="\n`google.bigquery_job.new` injects a new `google_bigquery_job` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.bigquery_job.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.bigquery_job` using the reference:\n\n    $._ref.google_bigquery_job.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_bigquery_job.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `job_id` (`string`): The ID of the job. The ID must contain only letters (a-z, A-Z), numbers (0-9), underscores (_), or dashes (-). The maximum length is 1,024 characters.\n  - `job_timeout_ms` (`string`): Job timeout in milliseconds. If this time limit is exceeded, BigQuery may attempt to terminate the job. When `null`, the `job_timeout_ms` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels associated with this job. You can use these to organize and group your jobs. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The geographic location of the job. The default value is US. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `copy` (`list[obj]`): Copies a table. When `null`, the `copy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.copy.new](#fn-copynew) constructor.\n  - `extract` (`list[obj]`): Configures an extract job. When `null`, the `extract` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.extract.new](#fn-extractnew) constructor.\n  - `load` (`list[obj]`): Configures a load job. When `null`, the `load` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.load.new](#fn-loadnew) constructor.\n  - `query` (`list[obj]`): Configures a query job. When `null`, the `query` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.query.new](#fn-querynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.bigquery_job.new` injects a new `google_bigquery_job` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.bigquery_job.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.bigquery_job` using the reference:\n\n    $._ref.google_bigquery_job.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_bigquery_job.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `job_id` (`string`): The ID of the job. The ID must contain only letters (a-z, A-Z), numbers (0-9), underscores (_), or dashes (-). The maximum length is 1,024 characters.\n  - `job_timeout_ms` (`string`): Job timeout in milliseconds. If this time limit is exceeded, BigQuery may attempt to terminate the job. When `null`, the `job_timeout_ms` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels associated with this job. You can use these to organize and group your jobs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The geographic location of the job. The default value is US. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `copy` (`list[obj]`): Copies a table. When `null`, the `copy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.copy.new](#fn-copynew) constructor.\n  - `extract` (`list[obj]`): Configures an extract job. When `null`, the `extract` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.extract.new](#fn-extractnew) constructor.\n  - `load` (`list[obj]`): Configures a load job. When `null`, the `load` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.load.new](#fn-loadnew) constructor.\n  - `query` (`list[obj]`): Configures a query job. When `null`, the `query` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.query.new](#fn-querynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     job_id,
@@ -217,7 +217,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.bigquery_job.newAttrs` constructs a new object with attributes and blocks configured for the `bigquery_job`\nTerraform resource.\n\nUnlike [google.bigquery_job.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `job_id` (`string`): The ID of the job. The ID must contain only letters (a-z, A-Z), numbers (0-9), underscores (_), or dashes (-). The maximum length is 1,024 characters.\n  - `job_timeout_ms` (`string`): Job timeout in milliseconds. If this time limit is exceeded, BigQuery may attempt to terminate the job. When `null`, the `job_timeout_ms` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels associated with this job. You can use these to organize and group your jobs. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The geographic location of the job. The default value is US. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `copy` (`list[obj]`): Copies a table. When `null`, the `copy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.copy.new](#fn-copynew) constructor.\n  - `extract` (`list[obj]`): Configures an extract job. When `null`, the `extract` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.extract.new](#fn-extractnew) constructor.\n  - `load` (`list[obj]`): Configures a load job. When `null`, the `load` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.load.new](#fn-loadnew) constructor.\n  - `query` (`list[obj]`): Configures a query job. When `null`, the `query` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.query.new](#fn-querynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `bigquery_job` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.bigquery_job.newAttrs` constructs a new object with attributes and blocks configured for the `bigquery_job`\nTerraform resource.\n\nUnlike [google.bigquery_job.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `job_id` (`string`): The ID of the job. The ID must contain only letters (a-z, A-Z), numbers (0-9), underscores (_), or dashes (-). The maximum length is 1,024 characters.\n  - `job_timeout_ms` (`string`): Job timeout in milliseconds. If this time limit is exceeded, BigQuery may attempt to terminate the job. When `null`, the `job_timeout_ms` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels associated with this job. You can use these to organize and group your jobs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The geographic location of the job. The default value is US. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `copy` (`list[obj]`): Copies a table. When `null`, the `copy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.copy.new](#fn-copynew) constructor.\n  - `extract` (`list[obj]`): Configures an extract job. When `null`, the `extract` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.extract.new](#fn-extractnew) constructor.\n  - `load` (`list[obj]`): Configures a load job. When `null`, the `load` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.load.new](#fn-loadnew) constructor.\n  - `query` (`list[obj]`): Configures a query job. When `null`, the `query` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.query.new](#fn-querynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `bigquery_job` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     job_id,
     copy=null,
diff --git a/4.x/_gen/resources/bigquery_routine.libsonnet b/4.x/_gen/resources/bigquery_routine.libsonnet
index c3a73c84..eefa62ac 100644
--- a/4.x/_gen/resources/bigquery_routine.libsonnet
+++ b/4.x/_gen/resources/bigquery_routine.libsonnet
@@ -16,12 +16,13 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       name: name,
     }),
   },
-  '#new':: d.fn(help="\n`google.bigquery_routine.new` injects a new `google_bigquery_routine` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.bigquery_routine.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.bigquery_routine` using the reference:\n\n    $._ref.google_bigquery_routine.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_bigquery_routine.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `dataset_id` (`string`): The ID of the dataset containing this routine\n  - `definition_body` (`string`): The body of the routine. For functions, this is the expression in the AS clause.\nIf language=SQL, it is the substring inside (but excluding) the parentheses.\n  - `description` (`string`): The description of the routine if defined. When `null`, the `description` field will be omitted from the resulting object.\n  - `determinism_level` (`string`): The determinism level of the JavaScript UDF if defined. Possible values: [\u0026#34;DETERMINISM_LEVEL_UNSPECIFIED\u0026#34;, \u0026#34;DETERMINISTIC\u0026#34;, \u0026#34;NOT_DETERMINISTIC\u0026#34;] When `null`, the `determinism_level` field will be omitted from the resulting object.\n  - `imported_libraries` (`list`): Optional. If language = \u0026#34;JAVASCRIPT\u0026#34;, this field stores the path of the\nimported JAVASCRIPT libraries. When `null`, the `imported_libraries` field will be omitted from the resulting object.\n  - `language` (`string`): The language of the routine. Possible values: [\u0026#34;SQL\u0026#34;, \u0026#34;JAVASCRIPT\u0026#34;] When `null`, the `language` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `return_table_type` (`string`): Optional. Can be set only if routineType = \u0026#34;TABLE_VALUED_FUNCTION\u0026#34;.\n\nIf absent, the return table type is inferred from definitionBody at query time in each query\nthat references this routine. If present, then the columns in the evaluated table result will\nbe cast to match the column types specificed in return table type, at query time. When `null`, the `return_table_type` field will be omitted from the resulting object.\n  - `return_type` (`string`): A JSON schema for the return type. Optional if language = \u0026#34;SQL\u0026#34;; required otherwise.\nIf absent, the return type is inferred from definitionBody at query time in each query\nthat references this routine. If present, then the evaluated result will be cast to\nthe specified returned type at query time. ~\u0026gt;**NOTE**: Because this field expects a JSON\nstring, any changes to the string will create a diff, even if the JSON itself hasn\u0026#39;t\nchanged. If the API returns a different value for the same schema, e.g. it switche\nd the order of values or replaced STRUCT field type with RECORD field type, we currently\ncannot suppress the recurring diff this causes. As a workaround, we recommend using\nthe schema as returned by the API. When `null`, the `return_type` field will be omitted from the resulting object.\n  - `routine_id` (`string`): The ID of the the routine. The ID must contain only letters (a-z, A-Z), numbers (0-9), or underscores (_). The maximum length is 256 characters.\n  - `routine_type` (`string`): The type of routine. Possible values: [\u0026#34;SCALAR_FUNCTION\u0026#34;, \u0026#34;PROCEDURE\u0026#34;, \u0026#34;TABLE_VALUED_FUNCTION\u0026#34;] When `null`, the `routine_type` field will be omitted from the resulting object.\n  - `arguments` (`list[obj]`): Input/output argument of a function or a stored procedure. When `null`, the `arguments` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_routine.arguments.new](#fn-argumentsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_routine.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.bigquery_routine.new` injects a new `google_bigquery_routine` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.bigquery_routine.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.bigquery_routine` using the reference:\n\n    $._ref.google_bigquery_routine.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_bigquery_routine.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `dataset_id` (`string`): The ID of the dataset containing this routine\n  - `definition_body` (`string`): The body of the routine. For functions, this is the expression in the AS clause.\nIf language=SQL, it is the substring inside (but excluding) the parentheses.\n  - `description` (`string`): The description of the routine if defined. When `null`, the `description` field will be omitted from the resulting object.\n  - `determinism_level` (`string`): The determinism level of the JavaScript UDF if defined. Possible values: [\u0026#34;DETERMINISM_LEVEL_UNSPECIFIED\u0026#34;, \u0026#34;DETERMINISTIC\u0026#34;, \u0026#34;NOT_DETERMINISTIC\u0026#34;] When `null`, the `determinism_level` field will be omitted from the resulting object.\n  - `imported_libraries` (`list`): Optional. If language = \u0026#34;JAVASCRIPT\u0026#34;, this field stores the path of the\nimported JAVASCRIPT libraries. When `null`, the `imported_libraries` field will be omitted from the resulting object.\n  - `language` (`string`): The language of the routine. Possible values: [\u0026#34;SQL\u0026#34;, \u0026#34;JAVASCRIPT\u0026#34;] When `null`, the `language` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `return_table_type` (`string`): Optional. Can be set only if routineType = \u0026#34;TABLE_VALUED_FUNCTION\u0026#34;.\n\nIf absent, the return table type is inferred from definitionBody at query time in each query\nthat references this routine. If present, then the columns in the evaluated table result will\nbe cast to match the column types specificed in return table type, at query time. When `null`, the `return_table_type` field will be omitted from the resulting object.\n  - `return_type` (`string`): A JSON schema for the return type. Optional if language = \u0026#34;SQL\u0026#34;; required otherwise.\nIf absent, the return type is inferred from definitionBody at query time in each query\nthat references this routine. If present, then the evaluated result will be cast to\nthe specified returned type at query time. ~\u0026gt;**NOTE**: Because this field expects a JSON\nstring, any changes to the string will create a diff, even if the JSON itself hasn\u0026#39;t\nchanged. If the API returns a different value for the same schema, e.g. it switche\nd the order of values or replaced STRUCT field type with RECORD field type, we currently\ncannot suppress the recurring diff this causes. As a workaround, we recommend using\nthe schema as returned by the API. When `null`, the `return_type` field will be omitted from the resulting object.\n  - `routine_id` (`string`): The ID of the the routine. The ID must contain only letters (a-z, A-Z), numbers (0-9), or underscores (_). The maximum length is 256 characters.\n  - `routine_type` (`string`): The type of routine. Possible values: [\u0026#34;SCALAR_FUNCTION\u0026#34;, \u0026#34;PROCEDURE\u0026#34;, \u0026#34;TABLE_VALUED_FUNCTION\u0026#34;]\n  - `arguments` (`list[obj]`): Input/output argument of a function or a stored procedure. When `null`, the `arguments` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_routine.arguments.new](#fn-argumentsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_routine.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     dataset_id,
     definition_body,
     routine_id,
+    routine_type,
     arguments=null,
     description=null,
     determinism_level=null,
@@ -30,7 +31,6 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project=null,
     return_table_type=null,
     return_type=null,
-    routine_type=null,
     timeouts=null,
     _meta={}
   ):: tf.withResource(
@@ -53,11 +53,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.bigquery_routine.newAttrs` constructs a new object with attributes and blocks configured for the `bigquery_routine`\nTerraform resource.\n\nUnlike [google.bigquery_routine.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `dataset_id` (`string`): The ID of the dataset containing this routine\n  - `definition_body` (`string`): The body of the routine. For functions, this is the expression in the AS clause.\nIf language=SQL, it is the substring inside (but excluding) the parentheses.\n  - `description` (`string`): The description of the routine if defined. When `null`, the `description` field will be omitted from the resulting object.\n  - `determinism_level` (`string`): The determinism level of the JavaScript UDF if defined. Possible values: ["DETERMINISM_LEVEL_UNSPECIFIED", "DETERMINISTIC", "NOT_DETERMINISTIC"] When `null`, the `determinism_level` field will be omitted from the resulting object.\n  - `imported_libraries` (`list`): Optional. If language = "JAVASCRIPT", this field stores the path of the\nimported JAVASCRIPT libraries. When `null`, the `imported_libraries` field will be omitted from the resulting object.\n  - `language` (`string`): The language of the routine. Possible values: ["SQL", "JAVASCRIPT"] When `null`, the `language` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `return_table_type` (`string`): Optional. Can be set only if routineType = "TABLE_VALUED_FUNCTION".\n\nIf absent, the return table type is inferred from definitionBody at query time in each query\nthat references this routine. If present, then the columns in the evaluated table result will\nbe cast to match the column types specificed in return table type, at query time. When `null`, the `return_table_type` field will be omitted from the resulting object.\n  - `return_type` (`string`): A JSON schema for the return type. Optional if language = "SQL"; required otherwise.\nIf absent, the return type is inferred from definitionBody at query time in each query\nthat references this routine. If present, then the evaluated result will be cast to\nthe specified returned type at query time. ~>**NOTE**: Because this field expects a JSON\nstring, any changes to the string will create a diff, even if the JSON itself hasn't\nchanged. If the API returns a different value for the same schema, e.g. it switche\nd the order of values or replaced STRUCT field type with RECORD field type, we currently\ncannot suppress the recurring diff this causes. As a workaround, we recommend using\nthe schema as returned by the API. When `null`, the `return_type` field will be omitted from the resulting object.\n  - `routine_id` (`string`): The ID of the the routine. The ID must contain only letters (a-z, A-Z), numbers (0-9), or underscores (_). The maximum length is 256 characters.\n  - `routine_type` (`string`): The type of routine. Possible values: ["SCALAR_FUNCTION", "PROCEDURE", "TABLE_VALUED_FUNCTION"] When `null`, the `routine_type` field will be omitted from the resulting object.\n  - `arguments` (`list[obj]`): Input/output argument of a function or a stored procedure. When `null`, the `arguments` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_routine.arguments.new](#fn-argumentsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_routine.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `bigquery_routine` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.bigquery_routine.newAttrs` constructs a new object with attributes and blocks configured for the `bigquery_routine`\nTerraform resource.\n\nUnlike [google.bigquery_routine.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `dataset_id` (`string`): The ID of the dataset containing this routine\n  - `definition_body` (`string`): The body of the routine. For functions, this is the expression in the AS clause.\nIf language=SQL, it is the substring inside (but excluding) the parentheses.\n  - `description` (`string`): The description of the routine if defined. When `null`, the `description` field will be omitted from the resulting object.\n  - `determinism_level` (`string`): The determinism level of the JavaScript UDF if defined. Possible values: ["DETERMINISM_LEVEL_UNSPECIFIED", "DETERMINISTIC", "NOT_DETERMINISTIC"] When `null`, the `determinism_level` field will be omitted from the resulting object.\n  - `imported_libraries` (`list`): Optional. If language = "JAVASCRIPT", this field stores the path of the\nimported JAVASCRIPT libraries. When `null`, the `imported_libraries` field will be omitted from the resulting object.\n  - `language` (`string`): The language of the routine. Possible values: ["SQL", "JAVASCRIPT"] When `null`, the `language` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `return_table_type` (`string`): Optional. Can be set only if routineType = "TABLE_VALUED_FUNCTION".\n\nIf absent, the return table type is inferred from definitionBody at query time in each query\nthat references this routine. If present, then the columns in the evaluated table result will\nbe cast to match the column types specificed in return table type, at query time. When `null`, the `return_table_type` field will be omitted from the resulting object.\n  - `return_type` (`string`): A JSON schema for the return type. Optional if language = "SQL"; required otherwise.\nIf absent, the return type is inferred from definitionBody at query time in each query\nthat references this routine. If present, then the evaluated result will be cast to\nthe specified returned type at query time. ~>**NOTE**: Because this field expects a JSON\nstring, any changes to the string will create a diff, even if the JSON itself hasn't\nchanged. If the API returns a different value for the same schema, e.g. it switche\nd the order of values or replaced STRUCT field type with RECORD field type, we currently\ncannot suppress the recurring diff this causes. As a workaround, we recommend using\nthe schema as returned by the API. When `null`, the `return_type` field will be omitted from the resulting object.\n  - `routine_id` (`string`): The ID of the the routine. The ID must contain only letters (a-z, A-Z), numbers (0-9), or underscores (_). The maximum length is 256 characters.\n  - `routine_type` (`string`): The type of routine. Possible values: ["SCALAR_FUNCTION", "PROCEDURE", "TABLE_VALUED_FUNCTION"]\n  - `arguments` (`list[obj]`): Input/output argument of a function or a stored procedure. When `null`, the `arguments` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_routine.arguments.new](#fn-argumentsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_routine.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `bigquery_routine` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     dataset_id,
     definition_body,
     routine_id,
+    routine_type,
     arguments=null,
     description=null,
     determinism_level=null,
@@ -66,7 +67,6 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project=null,
     return_table_type=null,
     return_type=null,
-    routine_type=null,
     timeouts=null
   ):: std.prune(a={
     arguments: arguments,
diff --git a/4.x/_gen/resources/bigquery_table.libsonnet b/4.x/_gen/resources/bigquery_table.libsonnet
index fc97f2c7..6525a566 100644
--- a/4.x/_gen/resources/bigquery_table.libsonnet
+++ b/4.x/_gen/resources/bigquery_table.libsonnet
@@ -132,7 +132,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       refresh_interval_ms: refresh_interval_ms,
     }),
   },
-  '#new':: d.fn(help="\n`google.bigquery_table.new` injects a new `google_bigquery_table` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.bigquery_table.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.bigquery_table` using the reference:\n\n    $._ref.google_bigquery_table.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_bigquery_table.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `clustering` (`list`): Specifies column names to use for data clustering. Up to four top-level columns are allowed, and should be specified in descending priority order. When `null`, the `clustering` field will be omitted from the resulting object.\n  - `dataset_id` (`string`): The dataset ID to create the table in. Changing this forces a new resource to be created.\n  - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the instance. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the instance will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `description` (`string`): The field description. When `null`, the `description` field will be omitted from the resulting object.\n  - `expiration_time` (`number`): The time when this table expires, in milliseconds since the epoch. If not present, the table will persist indefinitely. Expired tables will be deleted and their storage reclaimed. When `null`, the `expiration_time` field will be omitted from the resulting object.\n  - `friendly_name` (`string`): A descriptive name for the table. When `null`, the `friendly_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): A mapping of labels to assign to the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `max_staleness` (`string`): The maximum staleness of data that could be returned when the table (or stale MV) is queried. Staleness encoded as a string encoding of sql IntervalValue type. When `null`, the `max_staleness` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. When `null`, the `project` field will be omitted from the resulting object.\n  - `schema` (`string`): A JSON schema for the table. When `null`, the `schema` field will be omitted from the resulting object.\n  - `table_id` (`string`): A unique ID for the resource. Changing this forces a new resource to be created.\n  - `encryption_configuration` (`list[obj]`): Specifies how the table should be encrypted. If left blank, the table will be encrypted with a Google-managed key; that process is transparent to the user. When `null`, the `encryption_configuration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.encryption_configuration.new](#fn-encryption_configurationnew) constructor.\n  - `external_data_configuration` (`list[obj]`): Describes the data format, location, and other properties of a table stored outside of BigQuery. By defining these properties, the data source can then be queried as if it were a standard BigQuery table. When `null`, the `external_data_configuration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.external_data_configuration.new](#fn-external_data_configurationnew) constructor.\n  - `materialized_view` (`list[obj]`): If specified, configures this table as a materialized view. When `null`, the `materialized_view` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.materialized_view.new](#fn-materialized_viewnew) constructor.\n  - `range_partitioning` (`list[obj]`): If specified, configures range-based partitioning for this table. When `null`, the `range_partitioning` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.range_partitioning.new](#fn-range_partitioningnew) constructor.\n  - `table_constraints` (`list[obj]`): Defines the primary key and foreign keys. When `null`, the `table_constraints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.table_constraints.new](#fn-table_constraintsnew) constructor.\n  - `time_partitioning` (`list[obj]`): If specified, configures time-based partitioning for this table. When `null`, the `time_partitioning` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.time_partitioning.new](#fn-time_partitioningnew) constructor.\n  - `view` (`list[obj]`): If specified, configures this table as a view. When `null`, the `view` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.view.new](#fn-viewnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.bigquery_table.new` injects a new `google_bigquery_table` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.bigquery_table.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.bigquery_table` using the reference:\n\n    $._ref.google_bigquery_table.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_bigquery_table.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `clustering` (`list`): Specifies column names to use for data clustering. Up to four top-level columns are allowed, and should be specified in descending priority order. When `null`, the `clustering` field will be omitted from the resulting object.\n  - `dataset_id` (`string`): The dataset ID to create the table in. Changing this forces a new resource to be created.\n  - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the instance. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the instance will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `description` (`string`): The field description. When `null`, the `description` field will be omitted from the resulting object.\n  - `expiration_time` (`number`): The time when this table expires, in milliseconds since the epoch. If not present, the table will persist indefinitely. Expired tables will be deleted and their storage reclaimed. When `null`, the `expiration_time` field will be omitted from the resulting object.\n  - `friendly_name` (`string`): A descriptive name for the table. When `null`, the `friendly_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): A mapping of labels to assign to the resource.\n\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `max_staleness` (`string`): The maximum staleness of data that could be returned when the table (or stale MV) is queried. Staleness encoded as a string encoding of [SQL IntervalValue type](https://cloud.google.com/bigquery/docs/reference/standard-sql/data-types#interval_type). When `null`, the `max_staleness` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. When `null`, the `project` field will be omitted from the resulting object.\n  - `require_partition_filter` (`bool`): If set to true, queries over this table require a partition filter that can be used for partition elimination to be specified. When `null`, the `require_partition_filter` field will be omitted from the resulting object.\n  - `schema` (`string`): A JSON schema for the table. When `null`, the `schema` field will be omitted from the resulting object.\n  - `table_id` (`string`): A unique ID for the resource. Changing this forces a new resource to be created.\n  - `encryption_configuration` (`list[obj]`): Specifies how the table should be encrypted. If left blank, the table will be encrypted with a Google-managed key; that process is transparent to the user. When `null`, the `encryption_configuration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.encryption_configuration.new](#fn-encryption_configurationnew) constructor.\n  - `external_data_configuration` (`list[obj]`): Describes the data format, location, and other properties of a table stored outside of BigQuery. By defining these properties, the data source can then be queried as if it were a standard BigQuery table. When `null`, the `external_data_configuration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.external_data_configuration.new](#fn-external_data_configurationnew) constructor.\n  - `materialized_view` (`list[obj]`): If specified, configures this table as a materialized view. When `null`, the `materialized_view` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.materialized_view.new](#fn-materialized_viewnew) constructor.\n  - `range_partitioning` (`list[obj]`): If specified, configures range-based partitioning for this table. When `null`, the `range_partitioning` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.range_partitioning.new](#fn-range_partitioningnew) constructor.\n  - `table_constraints` (`list[obj]`): Defines the primary key and foreign keys. When `null`, the `table_constraints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.table_constraints.new](#fn-table_constraintsnew) constructor.\n  - `time_partitioning` (`list[obj]`): If specified, configures time-based partitioning for this table. When `null`, the `time_partitioning` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.time_partitioning.new](#fn-time_partitioningnew) constructor.\n  - `view` (`list[obj]`): If specified, configures this table as a view. When `null`, the `view` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.view.new](#fn-viewnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     dataset_id,
@@ -149,6 +149,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     max_staleness=null,
     project=null,
     range_partitioning=null,
+    require_partition_filter=null,
     schema=null,
     table_constraints=null,
     time_partitioning=null,
@@ -171,6 +172,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       max_staleness=max_staleness,
       project=project,
       range_partitioning=range_partitioning,
+      require_partition_filter=require_partition_filter,
       schema=schema,
       table_constraints=table_constraints,
       table_id=table_id,
@@ -179,7 +181,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.bigquery_table.newAttrs` constructs a new object with attributes and blocks configured for the `bigquery_table`\nTerraform resource.\n\nUnlike [google.bigquery_table.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `clustering` (`list`): Specifies column names to use for data clustering. Up to four top-level columns are allowed, and should be specified in descending priority order. When `null`, the `clustering` field will be omitted from the resulting object.\n  - `dataset_id` (`string`): The dataset ID to create the table in. Changing this forces a new resource to be created.\n  - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the instance. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the instance will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `description` (`string`): The field description. When `null`, the `description` field will be omitted from the resulting object.\n  - `expiration_time` (`number`): The time when this table expires, in milliseconds since the epoch. If not present, the table will persist indefinitely. Expired tables will be deleted and their storage reclaimed. When `null`, the `expiration_time` field will be omitted from the resulting object.\n  - `friendly_name` (`string`): A descriptive name for the table. When `null`, the `friendly_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): A mapping of labels to assign to the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `max_staleness` (`string`): The maximum staleness of data that could be returned when the table (or stale MV) is queried. Staleness encoded as a string encoding of sql IntervalValue type. When `null`, the `max_staleness` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. When `null`, the `project` field will be omitted from the resulting object.\n  - `schema` (`string`): A JSON schema for the table. When `null`, the `schema` field will be omitted from the resulting object.\n  - `table_id` (`string`): A unique ID for the resource. Changing this forces a new resource to be created.\n  - `encryption_configuration` (`list[obj]`): Specifies how the table should be encrypted. If left blank, the table will be encrypted with a Google-managed key; that process is transparent to the user. When `null`, the `encryption_configuration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.encryption_configuration.new](#fn-encryption_configurationnew) constructor.\n  - `external_data_configuration` (`list[obj]`): Describes the data format, location, and other properties of a table stored outside of BigQuery. By defining these properties, the data source can then be queried as if it were a standard BigQuery table. When `null`, the `external_data_configuration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.external_data_configuration.new](#fn-external_data_configurationnew) constructor.\n  - `materialized_view` (`list[obj]`): If specified, configures this table as a materialized view. When `null`, the `materialized_view` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.materialized_view.new](#fn-materialized_viewnew) constructor.\n  - `range_partitioning` (`list[obj]`): If specified, configures range-based partitioning for this table. When `null`, the `range_partitioning` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.range_partitioning.new](#fn-range_partitioningnew) constructor.\n  - `table_constraints` (`list[obj]`): Defines the primary key and foreign keys. When `null`, the `table_constraints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.table_constraints.new](#fn-table_constraintsnew) constructor.\n  - `time_partitioning` (`list[obj]`): If specified, configures time-based partitioning for this table. When `null`, the `time_partitioning` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.time_partitioning.new](#fn-time_partitioningnew) constructor.\n  - `view` (`list[obj]`): If specified, configures this table as a view. When `null`, the `view` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.view.new](#fn-viewnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `bigquery_table` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.bigquery_table.newAttrs` constructs a new object with attributes and blocks configured for the `bigquery_table`\nTerraform resource.\n\nUnlike [google.bigquery_table.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `clustering` (`list`): Specifies column names to use for data clustering. Up to four top-level columns are allowed, and should be specified in descending priority order. When `null`, the `clustering` field will be omitted from the resulting object.\n  - `dataset_id` (`string`): The dataset ID to create the table in. Changing this forces a new resource to be created.\n  - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the instance. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the instance will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `description` (`string`): The field description. When `null`, the `description` field will be omitted from the resulting object.\n  - `expiration_time` (`number`): The time when this table expires, in milliseconds since the epoch. If not present, the table will persist indefinitely. Expired tables will be deleted and their storage reclaimed. When `null`, the `expiration_time` field will be omitted from the resulting object.\n  - `friendly_name` (`string`): A descriptive name for the table. When `null`, the `friendly_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): A mapping of labels to assign to the resource.\n\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `max_staleness` (`string`): The maximum staleness of data that could be returned when the table (or stale MV) is queried. Staleness encoded as a string encoding of [SQL IntervalValue type](https://cloud.google.com/bigquery/docs/reference/standard-sql/data-types#interval_type). When `null`, the `max_staleness` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. When `null`, the `project` field will be omitted from the resulting object.\n  - `require_partition_filter` (`bool`): If set to true, queries over this table require a partition filter that can be used for partition elimination to be specified. When `null`, the `require_partition_filter` field will be omitted from the resulting object.\n  - `schema` (`string`): A JSON schema for the table. When `null`, the `schema` field will be omitted from the resulting object.\n  - `table_id` (`string`): A unique ID for the resource. Changing this forces a new resource to be created.\n  - `encryption_configuration` (`list[obj]`): Specifies how the table should be encrypted. If left blank, the table will be encrypted with a Google-managed key; that process is transparent to the user. When `null`, the `encryption_configuration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.encryption_configuration.new](#fn-encryption_configurationnew) constructor.\n  - `external_data_configuration` (`list[obj]`): Describes the data format, location, and other properties of a table stored outside of BigQuery. By defining these properties, the data source can then be queried as if it were a standard BigQuery table. When `null`, the `external_data_configuration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.external_data_configuration.new](#fn-external_data_configurationnew) constructor.\n  - `materialized_view` (`list[obj]`): If specified, configures this table as a materialized view. When `null`, the `materialized_view` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.materialized_view.new](#fn-materialized_viewnew) constructor.\n  - `range_partitioning` (`list[obj]`): If specified, configures range-based partitioning for this table. When `null`, the `range_partitioning` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.range_partitioning.new](#fn-range_partitioningnew) constructor.\n  - `table_constraints` (`list[obj]`): Defines the primary key and foreign keys. When `null`, the `table_constraints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.table_constraints.new](#fn-table_constraintsnew) constructor.\n  - `time_partitioning` (`list[obj]`): If specified, configures time-based partitioning for this table. When `null`, the `time_partitioning` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.time_partitioning.new](#fn-time_partitioningnew) constructor.\n  - `view` (`list[obj]`): If specified, configures this table as a view. When `null`, the `view` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.view.new](#fn-viewnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `bigquery_table` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     dataset_id,
     table_id,
@@ -195,6 +197,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     max_staleness=null,
     project=null,
     range_partitioning=null,
+    require_partition_filter=null,
     schema=null,
     table_constraints=null,
     time_partitioning=null,
@@ -213,6 +216,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     max_staleness: max_staleness,
     project: project,
     range_partitioning: range_partitioning,
+    require_partition_filter: require_partition_filter,
     schema: schema,
     table_constraints: table_constraints,
     table_id: table_id,
@@ -487,6 +491,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withRequirePartitionFilter':: d.fn(help='`google.bool.withRequirePartitionFilter` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the require_partition_filter field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `require_partition_filter` field.\n', args=[]),
+  withRequirePartitionFilter(resourceLabel, value): {
+    resource+: {
+      google_bigquery_table+: {
+        [resourceLabel]+: {
+          require_partition_filter: value,
+        },
+      },
+    },
+  },
   '#withSchema':: d.fn(help='`google.string.withSchema` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the schema field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `schema` field.\n', args=[]),
   withSchema(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/bigtable_instance.libsonnet b/4.x/_gen/resources/bigtable_instance.libsonnet
index 368c9566..cfe17fe9 100644
--- a/4.x/_gen/resources/bigtable_instance.libsonnet
+++ b/4.x/_gen/resources/bigtable_instance.libsonnet
@@ -34,7 +34,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       zone: zone,
     }),
   },
-  '#new':: d.fn(help="\n`google.bigtable_instance.new` injects a new `google_bigtable_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.bigtable_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.bigtable_instance` using the reference:\n\n    $._ref.google_bigtable_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_bigtable_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the instance. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the instance will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable display name of the Bigtable instance. Defaults to the instance name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `instance_type` (`string`): The instance type to create. One of \u0026#34;DEVELOPMENT\u0026#34; or \u0026#34;PRODUCTION\u0026#34;. Defaults to \u0026#34;PRODUCTION\u0026#34;. When `null`, the `instance_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): A mapping of labels to assign to the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name (also called Instance Id in the Cloud Console) of the Cloud Bigtable instance. Must be 6-33 characters and must only contain hyphens, lowercase letters and numbers.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `cluster` (`list[obj]`): A block of cluster configuration options. This can be specified at least once. When `null`, the `cluster` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_instance.cluster.new](#fn-clusternew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.bigtable_instance.new` injects a new `google_bigtable_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.bigtable_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.bigtable_instance` using the reference:\n\n    $._ref.google_bigtable_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_bigtable_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the instance. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the instance will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable display name of the Bigtable instance. Defaults to the instance name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `instance_type` (`string`): The instance type to create. One of \u0026#34;DEVELOPMENT\u0026#34; or \u0026#34;PRODUCTION\u0026#34;. Defaults to \u0026#34;PRODUCTION\u0026#34;. When `null`, the `instance_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): A mapping of labels to assign to the resource.\n\t\t\t\t\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name (also called Instance Id in the Cloud Console) of the Cloud Bigtable instance. Must be 6-33 characters and must only contain hyphens, lowercase letters and numbers.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `cluster` (`list[obj]`): A block of cluster configuration options. This can be specified at least once. When `null`, the `cluster` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_instance.cluster.new](#fn-clusternew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -61,7 +61,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.bigtable_instance.newAttrs` constructs a new object with attributes and blocks configured for the `bigtable_instance`\nTerraform resource.\n\nUnlike [google.bigtable_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the instance. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the instance will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable display name of the Bigtable instance. Defaults to the instance name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `instance_type` (`string`): The instance type to create. One of "DEVELOPMENT" or "PRODUCTION". Defaults to "PRODUCTION". When `null`, the `instance_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): A mapping of labels to assign to the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name (also called Instance Id in the Cloud Console) of the Cloud Bigtable instance. Must be 6-33 characters and must only contain hyphens, lowercase letters and numbers.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `cluster` (`list[obj]`): A block of cluster configuration options. This can be specified at least once. When `null`, the `cluster` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_instance.cluster.new](#fn-clusternew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `bigtable_instance` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.bigtable_instance.newAttrs` constructs a new object with attributes and blocks configured for the `bigtable_instance`\nTerraform resource.\n\nUnlike [google.bigtable_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the instance. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the instance will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable display name of the Bigtable instance. Defaults to the instance name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `instance_type` (`string`): The instance type to create. One of "DEVELOPMENT" or "PRODUCTION". Defaults to "PRODUCTION". When `null`, the `instance_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): A mapping of labels to assign to the resource.\n\t\t\t\t\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name (also called Instance Id in the Cloud Console) of the Cloud Bigtable instance. Must be 6-33 characters and must only contain hyphens, lowercase letters and numbers.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `cluster` (`list[obj]`): A block of cluster configuration options. This can be specified at least once. When `null`, the `cluster` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_instance.cluster.new](#fn-clusternew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `bigtable_instance` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     cluster=null,
diff --git a/4.x/_gen/resources/certificate_manager_certificate.libsonnet b/4.x/_gen/resources/certificate_manager_certificate.libsonnet
index c0e02d0a..78ad9ee5 100644
--- a/4.x/_gen/resources/certificate_manager_certificate.libsonnet
+++ b/4.x/_gen/resources/certificate_manager_certificate.libsonnet
@@ -14,7 +14,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       issuance_config: issuance_config,
     }),
   },
-  '#new':: d.fn(help="\n`google.certificate_manager_certificate.new` injects a new `google_certificate_manager_certificate` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.certificate_manager_certificate.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.certificate_manager_certificate` using the reference:\n\n    $._ref.google_certificate_manager_certificate.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_certificate_manager_certificate.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the Certificate resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The Certificate Manager location. If not specified, \u0026#34;global\u0026#34; is used. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the certificate. Certificate names must be unique\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope` (`string`): The scope of the certificate.\n\nDEFAULT: Certificates with default scope are served from core Google data centers.\nIf unsure, choose this option.\n\nEDGE_CACHE: Certificates with scope EDGE_CACHE are special-purposed certificates,\nserved from non-core Google data centers.\n\nALL_REGIONS: Certificates with ALL_REGIONS scope are served from all GCP regions (You can only use ALL_REGIONS with global certs).\nsee https://cloud.google.com/compute/docs/regions-zones When `null`, the `scope` field will be omitted from the resulting object.\n  - `managed` (`list[obj]`): Configuration and state of a Managed Certificate.\nCertificate Manager provisions and renews Managed Certificates\nautomatically, for as long as it\u0026#39;s authorized to do so. When `null`, the `managed` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate.managed.new](#fn-managednew) constructor.\n  - `self_managed` (`list[obj]`): Certificate data for a SelfManaged Certificate.\nSelfManaged Certificates are uploaded by the user. Updating such\ncertificates before they expire remains the user\u0026#39;s responsibility. When `null`, the `self_managed` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate.self_managed.new](#fn-self_managednew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.certificate_manager_certificate.new` injects a new `google_certificate_manager_certificate` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.certificate_manager_certificate.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.certificate_manager_certificate` using the reference:\n\n    $._ref.google_certificate_manager_certificate.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_certificate_manager_certificate.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the Certificate resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The Certificate Manager location. If not specified, \u0026#34;global\u0026#34; is used. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the certificate. Certificate names must be unique\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope` (`string`): The scope of the certificate.\n\nDEFAULT: Certificates with default scope are served from core Google data centers.\nIf unsure, choose this option.\n\nEDGE_CACHE: Certificates with scope EDGE_CACHE are special-purposed certificates, served from Edge Points of Presence.\nSee https://cloud.google.com/vpc/docs/edge-locations.\n\nALL_REGIONS: Certificates with ALL_REGIONS scope are served from all GCP regions (You can only use ALL_REGIONS with global certs).\nSee https://cloud.google.com/compute/docs/regions-zones When `null`, the `scope` field will be omitted from the resulting object.\n  - `managed` (`list[obj]`): Configuration and state of a Managed Certificate.\nCertificate Manager provisions and renews Managed Certificates\nautomatically, for as long as it\u0026#39;s authorized to do so. When `null`, the `managed` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate.managed.new](#fn-managednew) constructor.\n  - `self_managed` (`list[obj]`): Certificate data for a SelfManaged Certificate.\nSelfManaged Certificates are uploaded by the user. Updating such\ncertificates before they expire remains the user\u0026#39;s responsibility. When `null`, the `self_managed` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate.self_managed.new](#fn-self_managednew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -43,7 +43,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.certificate_manager_certificate.newAttrs` constructs a new object with attributes and blocks configured for the `certificate_manager_certificate`\nTerraform resource.\n\nUnlike [google.certificate_manager_certificate.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the Certificate resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The Certificate Manager location. If not specified, "global" is used. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the certificate. Certificate names must be unique\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope` (`string`): The scope of the certificate.\n\nDEFAULT: Certificates with default scope are served from core Google data centers.\nIf unsure, choose this option.\n\nEDGE_CACHE: Certificates with scope EDGE_CACHE are special-purposed certificates,\nserved from non-core Google data centers.\n\nALL_REGIONS: Certificates with ALL_REGIONS scope are served from all GCP regions (You can only use ALL_REGIONS with global certs).\nsee https://cloud.google.com/compute/docs/regions-zones When `null`, the `scope` field will be omitted from the resulting object.\n  - `managed` (`list[obj]`): Configuration and state of a Managed Certificate.\nCertificate Manager provisions and renews Managed Certificates\nautomatically, for as long as it's authorized to do so. When `null`, the `managed` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate.managed.new](#fn-managednew) constructor.\n  - `self_managed` (`list[obj]`): Certificate data for a SelfManaged Certificate.\nSelfManaged Certificates are uploaded by the user. Updating such\ncertificates before they expire remains the user's responsibility. When `null`, the `self_managed` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate.self_managed.new](#fn-self_managednew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `certificate_manager_certificate` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.certificate_manager_certificate.newAttrs` constructs a new object with attributes and blocks configured for the `certificate_manager_certificate`\nTerraform resource.\n\nUnlike [google.certificate_manager_certificate.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the Certificate resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The Certificate Manager location. If not specified, "global" is used. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the certificate. Certificate names must be unique\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope` (`string`): The scope of the certificate.\n\nDEFAULT: Certificates with default scope are served from core Google data centers.\nIf unsure, choose this option.\n\nEDGE_CACHE: Certificates with scope EDGE_CACHE are special-purposed certificates, served from Edge Points of Presence.\nSee https://cloud.google.com/vpc/docs/edge-locations.\n\nALL_REGIONS: Certificates with ALL_REGIONS scope are served from all GCP regions (You can only use ALL_REGIONS with global certs).\nSee https://cloud.google.com/compute/docs/regions-zones When `null`, the `scope` field will be omitted from the resulting object.\n  - `managed` (`list[obj]`): Configuration and state of a Managed Certificate.\nCertificate Manager provisions and renews Managed Certificates\nautomatically, for as long as it's authorized to do so. When `null`, the `managed` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate.managed.new](#fn-managednew) constructor.\n  - `self_managed` (`list[obj]`): Certificate data for a SelfManaged Certificate.\nSelfManaged Certificates are uploaded by the user. Updating such\ncertificates before they expire remains the user's responsibility. When `null`, the `self_managed` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate.self_managed.new](#fn-self_managednew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `certificate_manager_certificate` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     description=null,
diff --git a/4.x/_gen/resources/certificate_manager_certificate_issuance_config.libsonnet b/4.x/_gen/resources/certificate_manager_certificate_issuance_config.libsonnet
index 8cee0053..dfe7a28f 100644
--- a/4.x/_gen/resources/certificate_manager_certificate_issuance_config.libsonnet
+++ b/4.x/_gen/resources/certificate_manager_certificate_issuance_config.libsonnet
@@ -18,7 +18,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       certificate_authority_service_config: certificate_authority_service_config,
     }),
   },
-  '#new':: d.fn(help="\n`google.certificate_manager_certificate_issuance_config.new` injects a new `google_certificate_manager_certificate_issuance_config` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.certificate_manager_certificate_issuance_config.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.certificate_manager_certificate_issuance_config` using the reference:\n\n    $._ref.google_certificate_manager_certificate_issuance_config.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_certificate_manager_certificate_issuance_config.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): One or more paragraphs of text description of a CertificateIssuanceConfig. When `null`, the `description` field will be omitted from the resulting object.\n  - `key_algorithm` (`string`): Key algorithm to use when generating the private key. Possible values: [\u0026#34;RSA_2048\u0026#34;, \u0026#34;ECDSA_P256\u0026#34;]\n  - `labels` (`obj`): \u0026#39;Set of label tags associated with the CertificateIssuanceConfig resource.\n An object containing a list of \u0026#34;key\u0026#34;: value pairs. Example: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lifetime` (`string`): Lifetime of issued certificates. A duration in seconds with up to nine fractional digits, ending with \u0026#39;s\u0026#39;.\nExample: \u0026#34;1814400s\u0026#34;. Valid values are from 21 days (1814400s) to 30 days (2592000s)\n  - `location` (`string`): The Certificate Manager location. If not specified, \u0026#34;global\u0026#34; is used. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the certificate issuance config.\nCertificateIssuanceConfig names must be unique globally.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `rotation_window_percentage` (`number`): It specifies the percentage of elapsed time of the certificate lifetime to wait before renewing the certificate.\nMust be a number between 1-99, inclusive.\nYou must set the rotation window percentage in relation to the certificate lifetime so that certificate renewal occurs at least 7 days after\nthe certificate has been issued and at least 7 days before it expires.\n  - `certificate_authority_config` (`list[obj]`): The CA that issues the workload certificate. It includes the CA address, type, authentication to CA service, etc. When `null`, the `certificate_authority_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_issuance_config.certificate_authority_config.new](#fn-certificate_authority_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_issuance_config.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.certificate_manager_certificate_issuance_config.new` injects a new `google_certificate_manager_certificate_issuance_config` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.certificate_manager_certificate_issuance_config.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.certificate_manager_certificate_issuance_config` using the reference:\n\n    $._ref.google_certificate_manager_certificate_issuance_config.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_certificate_manager_certificate_issuance_config.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): One or more paragraphs of text description of a CertificateIssuanceConfig. When `null`, the `description` field will be omitted from the resulting object.\n  - `key_algorithm` (`string`): Key algorithm to use when generating the private key. Possible values: [\u0026#34;RSA_2048\u0026#34;, \u0026#34;ECDSA_P256\u0026#34;]\n  - `labels` (`obj`): \u0026#39;Set of label tags associated with the CertificateIssuanceConfig resource.\n An object containing a list of \u0026#34;key\u0026#34;: value pairs. Example: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lifetime` (`string`): Lifetime of issued certificates. A duration in seconds with up to nine fractional digits, ending with \u0026#39;s\u0026#39;.\nExample: \u0026#34;1814400s\u0026#34;. Valid values are from 21 days (1814400s) to 30 days (2592000s)\n  - `location` (`string`): The Certificate Manager location. If not specified, \u0026#34;global\u0026#34; is used. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the certificate issuance config.\nCertificateIssuanceConfig names must be unique globally.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `rotation_window_percentage` (`number`): It specifies the percentage of elapsed time of the certificate lifetime to wait before renewing the certificate.\nMust be a number between 1-99, inclusive.\nYou must set the rotation window percentage in relation to the certificate lifetime so that certificate renewal occurs at least 7 days after\nthe certificate has been issued and at least 7 days before it expires.\n  - `certificate_authority_config` (`list[obj]`): The CA that issues the workload certificate. It includes the CA address, type, authentication to CA service, etc. When `null`, the `certificate_authority_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_issuance_config.certificate_authority_config.new](#fn-certificate_authority_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_issuance_config.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     key_algorithm,
@@ -49,7 +49,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.certificate_manager_certificate_issuance_config.newAttrs` constructs a new object with attributes and blocks configured for the `certificate_manager_certificate_issuance_config`\nTerraform resource.\n\nUnlike [google.certificate_manager_certificate_issuance_config.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): One or more paragraphs of text description of a CertificateIssuanceConfig. When `null`, the `description` field will be omitted from the resulting object.\n  - `key_algorithm` (`string`): Key algorithm to use when generating the private key. Possible values: ["RSA_2048", "ECDSA_P256"]\n  - `labels` (`obj`): 'Set of label tags associated with the CertificateIssuanceConfig resource.\n An object containing a list of "key": value pairs. Example: { "name": "wrench", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lifetime` (`string`): Lifetime of issued certificates. A duration in seconds with up to nine fractional digits, ending with 's'.\nExample: "1814400s". Valid values are from 21 days (1814400s) to 30 days (2592000s)\n  - `location` (`string`): The Certificate Manager location. If not specified, "global" is used. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the certificate issuance config.\nCertificateIssuanceConfig names must be unique globally.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `rotation_window_percentage` (`number`): It specifies the percentage of elapsed time of the certificate lifetime to wait before renewing the certificate.\nMust be a number between 1-99, inclusive.\nYou must set the rotation window percentage in relation to the certificate lifetime so that certificate renewal occurs at least 7 days after\nthe certificate has been issued and at least 7 days before it expires.\n  - `certificate_authority_config` (`list[obj]`): The CA that issues the workload certificate. It includes the CA address, type, authentication to CA service, etc. When `null`, the `certificate_authority_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_issuance_config.certificate_authority_config.new](#fn-certificate_authority_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_issuance_config.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `certificate_manager_certificate_issuance_config` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.certificate_manager_certificate_issuance_config.newAttrs` constructs a new object with attributes and blocks configured for the `certificate_manager_certificate_issuance_config`\nTerraform resource.\n\nUnlike [google.certificate_manager_certificate_issuance_config.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): One or more paragraphs of text description of a CertificateIssuanceConfig. When `null`, the `description` field will be omitted from the resulting object.\n  - `key_algorithm` (`string`): Key algorithm to use when generating the private key. Possible values: ["RSA_2048", "ECDSA_P256"]\n  - `labels` (`obj`): 'Set of label tags associated with the CertificateIssuanceConfig resource.\n An object containing a list of "key": value pairs. Example: { "name": "wrench", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lifetime` (`string`): Lifetime of issued certificates. A duration in seconds with up to nine fractional digits, ending with 's'.\nExample: "1814400s". Valid values are from 21 days (1814400s) to 30 days (2592000s)\n  - `location` (`string`): The Certificate Manager location. If not specified, "global" is used. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the certificate issuance config.\nCertificateIssuanceConfig names must be unique globally.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `rotation_window_percentage` (`number`): It specifies the percentage of elapsed time of the certificate lifetime to wait before renewing the certificate.\nMust be a number between 1-99, inclusive.\nYou must set the rotation window percentage in relation to the certificate lifetime so that certificate renewal occurs at least 7 days after\nthe certificate has been issued and at least 7 days before it expires.\n  - `certificate_authority_config` (`list[obj]`): The CA that issues the workload certificate. It includes the CA address, type, authentication to CA service, etc. When `null`, the `certificate_authority_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_issuance_config.certificate_authority_config.new](#fn-certificate_authority_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_issuance_config.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `certificate_manager_certificate_issuance_config` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     key_algorithm,
     lifetime,
diff --git a/4.x/_gen/resources/certificate_manager_certificate_map.libsonnet b/4.x/_gen/resources/certificate_manager_certificate_map.libsonnet
index eef2c992..63ed3509 100644
--- a/4.x/_gen/resources/certificate_manager_certificate_map.libsonnet
+++ b/4.x/_gen/resources/certificate_manager_certificate_map.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='certificate_manager_certificate_map', url='', help='`certificate_manager_certificate_map` represents the `google_certificate_manager_certificate_map` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.certificate_manager_certificate_map.new` injects a new `google_certificate_manager_certificate_map` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.certificate_manager_certificate_map.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.certificate_manager_certificate_map` using the reference:\n\n    $._ref.google_certificate_manager_certificate_map.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_certificate_manager_certificate_map.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of labels associated with a Certificate Map resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the Certificate Map. Certificate Map names must be unique\nglobally and match the pattern \u0026#39;projects/*/locations/*/certificateMaps/*\u0026#39;.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_map.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.certificate_manager_certificate_map.new` injects a new `google_certificate_manager_certificate_map` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.certificate_manager_certificate_map.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.certificate_manager_certificate_map` using the reference:\n\n    $._ref.google_certificate_manager_certificate_map.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_certificate_manager_certificate_map.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of labels associated with a Certificate Map resource.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the Certificate Map. Certificate Map names must be unique\nglobally and match the pattern \u0026#39;projects/*/locations/*/certificateMaps/*\u0026#39;.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_map.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -23,7 +23,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.certificate_manager_certificate_map.newAttrs` constructs a new object with attributes and blocks configured for the `certificate_manager_certificate_map`\nTerraform resource.\n\nUnlike [google.certificate_manager_certificate_map.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of labels associated with a Certificate Map resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the Certificate Map. Certificate Map names must be unique\nglobally and match the pattern 'projects/*/locations/*/certificateMaps/*'.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_map.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `certificate_manager_certificate_map` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.certificate_manager_certificate_map.newAttrs` constructs a new object with attributes and blocks configured for the `certificate_manager_certificate_map`\nTerraform resource.\n\nUnlike [google.certificate_manager_certificate_map.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of labels associated with a Certificate Map resource.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the Certificate Map. Certificate Map names must be unique\nglobally and match the pattern 'projects/*/locations/*/certificateMaps/*'.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_map.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `certificate_manager_certificate_map` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     description=null,
diff --git a/4.x/_gen/resources/certificate_manager_certificate_map_entry.libsonnet b/4.x/_gen/resources/certificate_manager_certificate_map_entry.libsonnet
index 171ffaf9..eab868aa 100644
--- a/4.x/_gen/resources/certificate_manager_certificate_map_entry.libsonnet
+++ b/4.x/_gen/resources/certificate_manager_certificate_map_entry.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='certificate_manager_certificate_map_entry', url='', help='`certificate_manager_certificate_map_entry` represents the `google_certificate_manager_certificate_map_entry` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.certificate_manager_certificate_map_entry.new` injects a new `google_certificate_manager_certificate_map_entry` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.certificate_manager_certificate_map_entry.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.certificate_manager_certificate_map_entry` using the reference:\n\n    $._ref.google_certificate_manager_certificate_map_entry.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_certificate_manager_certificate_map_entry.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `certificates` (`list`): A set of Certificates defines for the given hostname.\nThere can be defined up to fifteen certificates in each Certificate Map Entry.\nEach certificate must match pattern projects/*/locations/*/certificates/*.\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `hostname` (`string`): A Hostname (FQDN, e.g. example.com) or a wildcard hostname expression (*.example.com)\nfor a set of hostnames with common suffix. Used as Server Name Indication (SNI) for\nselecting a proper certificate. When `null`, the `hostname` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of labels associated with a Certificate Map Entry.\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs.\nExample: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `map` (`string`): A map entry that is inputted into the cetrificate map\n  - `matcher` (`string`): A predefined matcher for particular cases, other than SNI selection When `null`, the `matcher` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the Certificate Map Entry. Certificate Map Entry\nnames must be unique globally and match pattern\n\u0026#39;projects/*/locations/*/certificateMaps/*/certificateMapEntries/*\u0026#39;\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_map_entry.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.certificate_manager_certificate_map_entry.new` injects a new `google_certificate_manager_certificate_map_entry` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.certificate_manager_certificate_map_entry.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.certificate_manager_certificate_map_entry` using the reference:\n\n    $._ref.google_certificate_manager_certificate_map_entry.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_certificate_manager_certificate_map_entry.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `certificates` (`list`): A set of Certificates defines for the given hostname.\nThere can be defined up to fifteen certificates in each Certificate Map Entry.\nEach certificate must match pattern projects/*/locations/*/certificates/*.\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `hostname` (`string`): A Hostname (FQDN, e.g. example.com) or a wildcard hostname expression (*.example.com)\nfor a set of hostnames with common suffix. Used as Server Name Indication (SNI) for\nselecting a proper certificate. When `null`, the `hostname` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of labels associated with a Certificate Map Entry.\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs.\nExample: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `map` (`string`): A map entry that is inputted into the cetrificate map\n  - `matcher` (`string`): A predefined matcher for particular cases, other than SNI selection When `null`, the `matcher` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the Certificate Map Entry. Certificate Map Entry\nnames must be unique globally and match pattern\n\u0026#39;projects/*/locations/*/certificateMaps/*/certificateMapEntries/*\u0026#39;\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_map_entry.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     certificates,
@@ -31,7 +31,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.certificate_manager_certificate_map_entry.newAttrs` constructs a new object with attributes and blocks configured for the `certificate_manager_certificate_map_entry`\nTerraform resource.\n\nUnlike [google.certificate_manager_certificate_map_entry.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `certificates` (`list`): A set of Certificates defines for the given hostname.\nThere can be defined up to fifteen certificates in each Certificate Map Entry.\nEach certificate must match pattern projects/*/locations/*/certificates/*.\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `hostname` (`string`): A Hostname (FQDN, e.g. example.com) or a wildcard hostname expression (*.example.com)\nfor a set of hostnames with common suffix. Used as Server Name Indication (SNI) for\nselecting a proper certificate. When `null`, the `hostname` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of labels associated with a Certificate Map Entry.\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `map` (`string`): A map entry that is inputted into the cetrificate map\n  - `matcher` (`string`): A predefined matcher for particular cases, other than SNI selection When `null`, the `matcher` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the Certificate Map Entry. Certificate Map Entry\nnames must be unique globally and match pattern\n'projects/*/locations/*/certificateMaps/*/certificateMapEntries/*'\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_map_entry.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `certificate_manager_certificate_map_entry` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.certificate_manager_certificate_map_entry.newAttrs` constructs a new object with attributes and blocks configured for the `certificate_manager_certificate_map_entry`\nTerraform resource.\n\nUnlike [google.certificate_manager_certificate_map_entry.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `certificates` (`list`): A set of Certificates defines for the given hostname.\nThere can be defined up to fifteen certificates in each Certificate Map Entry.\nEach certificate must match pattern projects/*/locations/*/certificates/*.\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `hostname` (`string`): A Hostname (FQDN, e.g. example.com) or a wildcard hostname expression (*.example.com)\nfor a set of hostnames with common suffix. Used as Server Name Indication (SNI) for\nselecting a proper certificate. When `null`, the `hostname` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of labels associated with a Certificate Map Entry.\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `map` (`string`): A map entry that is inputted into the cetrificate map\n  - `matcher` (`string`): A predefined matcher for particular cases, other than SNI selection When `null`, the `matcher` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the Certificate Map Entry. Certificate Map Entry\nnames must be unique globally and match pattern\n'projects/*/locations/*/certificateMaps/*/certificateMapEntries/*'\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate_map_entry.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `certificate_manager_certificate_map_entry` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     certificates,
     map,
diff --git a/4.x/_gen/resources/certificate_manager_dns_authorization.libsonnet b/4.x/_gen/resources/certificate_manager_dns_authorization.libsonnet
index 99d2a0f8..e5b4a26a 100644
--- a/4.x/_gen/resources/certificate_manager_dns_authorization.libsonnet
+++ b/4.x/_gen/resources/certificate_manager_dns_authorization.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='certificate_manager_dns_authorization', url='', help='`certificate_manager_dns_authorization` represents the `google_certificate_manager_dns_authorization` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.certificate_manager_dns_authorization.new` injects a new `google_certificate_manager_dns_authorization` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.certificate_manager_dns_authorization.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.certificate_manager_dns_authorization` using the reference:\n\n    $._ref.google_certificate_manager_dns_authorization.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_certificate_manager_dns_authorization.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `domain` (`string`): A domain which is being authorized. A DnsAuthorization resource covers a\nsingle domain and its wildcard, e.g. authorization for \u0026#34;example.com\u0026#34; can\nbe used to issue certificates for \u0026#34;example.com\u0026#34; and \u0026#34;*.example.com\u0026#34;.\n  - `labels` (`obj`): Set of label tags associated with the DNS Authorization resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_dns_authorization.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.certificate_manager_dns_authorization.new` injects a new `google_certificate_manager_dns_authorization` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.certificate_manager_dns_authorization.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.certificate_manager_dns_authorization` using the reference:\n\n    $._ref.google_certificate_manager_dns_authorization.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_certificate_manager_dns_authorization.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `domain` (`string`): A domain which is being authorized. A DnsAuthorization resource covers a\nsingle domain and its wildcard, e.g. authorization for \u0026#34;example.com\u0026#34; can\nbe used to issue certificates for \u0026#34;example.com\u0026#34; and \u0026#34;*.example.com\u0026#34;.\n  - `labels` (`obj`): Set of label tags associated with the DNS Authorization resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_dns_authorization.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     domain,
@@ -25,7 +25,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.certificate_manager_dns_authorization.newAttrs` constructs a new object with attributes and blocks configured for the `certificate_manager_dns_authorization`\nTerraform resource.\n\nUnlike [google.certificate_manager_dns_authorization.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `domain` (`string`): A domain which is being authorized. A DnsAuthorization resource covers a\nsingle domain and its wildcard, e.g. authorization for "example.com" can\nbe used to issue certificates for "example.com" and "*.example.com".\n  - `labels` (`obj`): Set of label tags associated with the DNS Authorization resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_dns_authorization.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `certificate_manager_dns_authorization` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.certificate_manager_dns_authorization.newAttrs` constructs a new object with attributes and blocks configured for the `certificate_manager_dns_authorization`\nTerraform resource.\n\nUnlike [google.certificate_manager_dns_authorization.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `domain` (`string`): A domain which is being authorized. A DnsAuthorization resource covers a\nsingle domain and its wildcard, e.g. authorization for "example.com" can\nbe used to issue certificates for "example.com" and "*.example.com".\n  - `labels` (`obj`): Set of label tags associated with the DNS Authorization resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_dns_authorization.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `certificate_manager_dns_authorization` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     domain,
     name,
diff --git a/4.x/_gen/resources/certificate_manager_trust_config.libsonnet b/4.x/_gen/resources/certificate_manager_trust_config.libsonnet
index c44d9704..91dc1356 100644
--- a/4.x/_gen/resources/certificate_manager_trust_config.libsonnet
+++ b/4.x/_gen/resources/certificate_manager_trust_config.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='certificate_manager_trust_config', url='', help='`certificate_manager_trust_config` represents the `google_certificate_manager_trust_config` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.certificate_manager_trust_config.new` injects a new `google_certificate_manager_trust_config` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.certificate_manager_trust_config.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.certificate_manager_trust_config` using the reference:\n\n    $._ref.google_certificate_manager_trust_config.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_certificate_manager_trust_config.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): One or more paragraphs of text description of a trust config. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the trust config. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The trust config location.\n  - `name` (`string`): A user-defined name of the trust config. Trust config names must be unique globally.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_trust_config.timeouts.new](#fn-timeoutsnew) constructor.\n  - `trust_stores` (`list[obj]`): Set of trust stores to perform validation against.\nThis field is supported when TrustConfig is configured with Load Balancers, currently not supported for SPIFFE certificate validation. When `null`, the `trust_stores` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_trust_config.trust_stores.new](#fn-trust_storesnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.certificate_manager_trust_config.new` injects a new `google_certificate_manager_trust_config` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.certificate_manager_trust_config.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.certificate_manager_trust_config` using the reference:\n\n    $._ref.google_certificate_manager_trust_config.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_certificate_manager_trust_config.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): One or more paragraphs of text description of a trust config. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the trust config.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The trust config location.\n  - `name` (`string`): A user-defined name of the trust config. Trust config names must be unique globally.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_trust_config.timeouts.new](#fn-timeoutsnew) constructor.\n  - `trust_stores` (`list[obj]`): Set of trust stores to perform validation against.\nThis field is supported when TrustConfig is configured with Load Balancers, currently not supported for SPIFFE certificate validation. When `null`, the `trust_stores` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_trust_config.trust_stores.new](#fn-trust_storesnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -27,7 +27,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.certificate_manager_trust_config.newAttrs` constructs a new object with attributes and blocks configured for the `certificate_manager_trust_config`\nTerraform resource.\n\nUnlike [google.certificate_manager_trust_config.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): One or more paragraphs of text description of a trust config. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the trust config. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The trust config location.\n  - `name` (`string`): A user-defined name of the trust config. Trust config names must be unique globally.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_trust_config.timeouts.new](#fn-timeoutsnew) constructor.\n  - `trust_stores` (`list[obj]`): Set of trust stores to perform validation against.\nThis field is supported when TrustConfig is configured with Load Balancers, currently not supported for SPIFFE certificate validation. When `null`, the `trust_stores` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_trust_config.trust_stores.new](#fn-trust_storesnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `certificate_manager_trust_config` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.certificate_manager_trust_config.newAttrs` constructs a new object with attributes and blocks configured for the `certificate_manager_trust_config`\nTerraform resource.\n\nUnlike [google.certificate_manager_trust_config.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): One or more paragraphs of text description of a trust config. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the trust config.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The trust config location.\n  - `name` (`string`): A user-defined name of the trust config. Trust config names must be unique globally.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_trust_config.timeouts.new](#fn-timeoutsnew) constructor.\n  - `trust_stores` (`list[obj]`): Set of trust stores to perform validation against.\nThis field is supported when TrustConfig is configured with Load Balancers, currently not supported for SPIFFE certificate validation. When `null`, the `trust_stores` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_trust_config.trust_stores.new](#fn-trust_storesnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `certificate_manager_trust_config` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     name,
diff --git a/4.x/_gen/resources/cloud_run_domain_mapping.libsonnet b/4.x/_gen/resources/cloud_run_domain_mapping.libsonnet
index 8d635695..bcce33a6 100644
--- a/4.x/_gen/resources/cloud_run_domain_mapping.libsonnet
+++ b/4.x/_gen/resources/cloud_run_domain_mapping.libsonnet
@@ -3,7 +3,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='cloud_run_domain_mapping', url='', help='`cloud_run_domain_mapping` represents the `google_cloud_run_domain_mapping` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
   metadata:: {
-    '#new':: d.fn(help='\n`google.cloud_run_domain_mapping.metadata.new` constructs a new object with attributes and blocks configured for the `metadata`\nTerraform sub block.\n\n\n\n**Args**:\n  - `annotations` (`obj`): Annotations is a key value map stored with a resource that\nmay be set by external tools to store and retrieve arbitrary metadata. More\ninfo: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations\n\n**Note**: The Cloud Run API may add additional annotations that were not provided in your config.\nIf terraform plan shows a diff where a server-side annotation is added, you can add it to your config\nor apply the lifecycle.ignore_changes rule to the metadata.0.annotations field. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `labels` (`obj`): Map of string keys and values that can be used to organize and categorize\n(scope and select) objects. May match selectors of replication controllers\nand routes.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels When `null`, the `labels` field will be omitted from the resulting object.\n  - `namespace` (`string`): In Cloud Run the namespace must be equal to either the\nproject ID or project number.\n\n**Returns**:\n  - An attribute object that represents the `metadata` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.cloud_run_domain_mapping.metadata.new` constructs a new object with attributes and blocks configured for the `metadata`\nTerraform sub block.\n\n\n\n**Args**:\n  - `annotations` (`obj`): Annotations is a key value map stored with a resource that\nmay be set by external tools to store and retrieve arbitrary metadata. More\ninfo: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations\n\n**Note**: The Cloud Run API may add additional annotations that were not provided in your config.\nIf terraform plan shows a diff where a server-side annotation is added, you can add it to your config\nor apply the lifecycle.ignore_changes rule to the metadata.0.annotations field.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `labels` (`obj`): Map of string keys and values that can be used to organize and categorize\n(scope and select) objects. May match selectors of replication controllers\nand routes.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `namespace` (`string`): In Cloud Run the namespace must be equal to either the\nproject ID or project number.\n\n**Returns**:\n  - An attribute object that represents the `metadata` sub block.\n', args=[]),
     new(
       namespace,
       annotations=null,
diff --git a/4.x/_gen/resources/cloud_run_service.libsonnet b/4.x/_gen/resources/cloud_run_service.libsonnet
index 79d220c4..6c1d5a08 100644
--- a/4.x/_gen/resources/cloud_run_service.libsonnet
+++ b/4.x/_gen/resources/cloud_run_service.libsonnet
@@ -3,7 +3,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='cloud_run_service', url='', help='`cloud_run_service` represents the `google_cloud_run_service` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
   metadata:: {
-    '#new':: d.fn(help='\n`google.cloud_run_service.metadata.new` constructs a new object with attributes and blocks configured for the `metadata`\nTerraform sub block.\n\n\n\n**Args**:\n  - `annotations` (`obj`): Annotations is a key value map stored with a resource that\nmay be set by external tools to store and retrieve arbitrary metadata. More\ninfo: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations\n\n**Note**: The Cloud Run API may add additional annotations that were not provided in your config.\nIf terraform plan shows a diff where a server-side annotation is added, you can add it to your config\nor apply the lifecycle.ignore_changes rule to the metadata.0.annotations field.\n\nAnnotations with 'run.googleapis.com/' and 'autoscaling.knative.dev' are restricted. Use the following annotation\nkeys to configure features on a Service:\n\n- 'run.googleapis.com/binary-authorization-breakglass' sets the [Binary Authorization breakglass](https://cloud.google.com/sdk/gcloud/reference/run/deploy#--breakglass).\n- 'run.googleapis.com/binary-authorization' sets the [Binary Authorization](https://cloud.google.com/sdk/gcloud/reference/run/deploy#--binary-authorization).\n- 'run.googleapis.com/client-name' sets the client name calling the Cloud Run API.\n- 'run.googleapis.com/custom-audiences' sets the [custom audiences](https://cloud.google.com/sdk/gcloud/reference/alpha/run/deploy#--add-custom-audiences)\n  that can be used in the audience field of ID token for authenticated requests.\n- 'run.googleapis.com/description' sets a user defined description for the Service.\n- 'run.googleapis.com/ingress' sets the [ingress settings](https://cloud.google.com/sdk/gcloud/reference/run/deploy#--ingress)\n  for the Service. For example, '"run.googleapis.com/ingress" = "all"'.\n- 'run.googleapis.com/launch-stage' sets the [launch stage](https://cloud.google.com/run/docs/troubleshooting#launch-stage-validation)\n  when a preview feature is used. For example, '"run.googleapis.com/launch-stage": "BETA"' When `null`, the `annotations` field will be omitted from the resulting object.\n  - `labels` (`obj`): Map of string keys and values that can be used to organize and categorize\n(scope and select) objects. May match selectors of replication controllers\nand routes. When `null`, the `labels` field will be omitted from the resulting object.\n  - `namespace` (`string`): In Cloud Run the namespace must be equal to either the\nproject ID or project number. When `null`, the `namespace` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `metadata` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.cloud_run_service.metadata.new` constructs a new object with attributes and blocks configured for the `metadata`\nTerraform sub block.\n\n\n\n**Args**:\n  - `annotations` (`obj`): Annotations is a key value map stored with a resource that\nmay be set by external tools to store and retrieve arbitrary metadata. More\ninfo: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations\n\n**Note**: The Cloud Run API may add additional annotations that were not provided in your config.\nIf terraform plan shows a diff where a server-side annotation is added, you can add it to your config\nor apply the lifecycle.ignore_changes rule to the metadata.0.annotations field.\n\nAnnotations with 'run.googleapis.com/' and 'autoscaling.knative.dev' are restricted. Use the following annotation\nkeys to configure features on a Service:\n\n- 'run.googleapis.com/binary-authorization-breakglass' sets the [Binary Authorization breakglass](https://cloud.google.com/sdk/gcloud/reference/run/deploy#--breakglass).\n- 'run.googleapis.com/binary-authorization' sets the [Binary Authorization](https://cloud.google.com/sdk/gcloud/reference/run/deploy#--binary-authorization).\n- 'run.googleapis.com/client-name' sets the client name calling the Cloud Run API.\n- 'run.googleapis.com/custom-audiences' sets the [custom audiences](https://cloud.google.com/sdk/gcloud/reference/alpha/run/deploy#--add-custom-audiences)\n  that can be used in the audience field of ID token for authenticated requests.\n- 'run.googleapis.com/description' sets a user defined description for the Service.\n- 'run.googleapis.com/ingress' sets the [ingress settings](https://cloud.google.com/sdk/gcloud/reference/run/deploy#--ingress)\n  for the Service. For example, '"run.googleapis.com/ingress" = "all"'.\n- 'run.googleapis.com/launch-stage' sets the [launch stage](https://cloud.google.com/run/docs/troubleshooting#launch-stage-validation)\n  when a preview feature is used. For example, '"run.googleapis.com/launch-stage": "BETA"'\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `labels` (`obj`): Map of string keys and values that can be used to organize and categorize\n(scope and select) objects. May match selectors of replication controllers\nand routes.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `namespace` (`string`): In Cloud Run the namespace must be equal to either the\nproject ID or project number. When `null`, the `namespace` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `metadata` sub block.\n', args=[]),
     new(
       annotations=null,
       labels=null,
diff --git a/4.x/_gen/resources/cloud_run_v2_job.libsonnet b/4.x/_gen/resources/cloud_run_v2_job.libsonnet
index e5334e89..80668c4f 100644
--- a/4.x/_gen/resources/cloud_run_v2_job.libsonnet
+++ b/4.x/_gen/resources/cloud_run_v2_job.libsonnet
@@ -12,9 +12,10 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       use_default: use_default,
     }),
   },
-  '#new':: d.fn(help="\n`google.cloud_run_v2_job.new` injects a new `google_cloud_run_v2_job` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloud_run_v2_job.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloud_run_v2_job` using the reference:\n\n    $._ref.google_cloud_run_v2_job.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloud_run_v2_job.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Unstructured key value map that may be set by external tools to store and arbitrary metadata. They are not queryable and should be preserved when modifying objects.\n\nCloud Run API v2 does not support annotations with \u0026#39;run.googleapis.com\u0026#39;, \u0026#39;cloud.googleapis.com\u0026#39;, \u0026#39;serving.knative.dev\u0026#39;, or \u0026#39;autoscaling.knative.dev\u0026#39; namespaces, and they will be rejected on new resources.\nAll system annotations in v1 now have a corresponding field in v2 Job.\n\nThis field follows Kubernetes annotations\u0026#39; namespacing, limits, and rules. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `client` (`string`): Arbitrary identifier for the API client. When `null`, the `client` field will be omitted from the resulting object.\n  - `client_version` (`string`): Arbitrary version identifier for the API client. When `null`, the `client_version` field will be omitted from the resulting object.\n  - `labels` (`obj`): Unstructured key value map that can be used to organize and categorize objects. User-provided labels are shared with Google\u0026#39;s billing system, so they can be used to filter, or break down billing charges by team, component,\nenvironment, state, etc. For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or https://cloud.google.com/run/docs/configuring/labels.\n\nCloud Run API v2 does not support labels with \u0026#39;run.googleapis.com\u0026#39;, \u0026#39;cloud.googleapis.com\u0026#39;, \u0026#39;serving.knative.dev\u0026#39;, or \u0026#39;autoscaling.knative.dev\u0026#39; namespaces, and they will be rejected.\nAll system labels in v1 now have a corresponding field in v2 Job. When `null`, the `labels` field will be omitted from the resulting object.\n  - `launch_stage` (`string`): The launch stage as defined by [Google Cloud Platform Launch Stages](https://cloud.google.com/products#product-launch-stages). Cloud Run supports ALPHA, BETA, and GA.\nIf no value is specified, GA is assumed. Set the launch stage to a preview stage on input to allow use of preview features in that stage. On read (or output), describes whether the resource uses preview features.\n\nFor example, if ALPHA is provided as input, but only BETA and GA-level features are used, this field will be BETA on output. Possible values: [\u0026#34;UNIMPLEMENTED\u0026#34;, \u0026#34;PRELAUNCH\u0026#34;, \u0026#34;EARLY_ACCESS\u0026#34;, \u0026#34;ALPHA\u0026#34;, \u0026#34;BETA\u0026#34;, \u0026#34;GA\u0026#34;, \u0026#34;DEPRECATED\u0026#34;] When `null`, the `launch_stage` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the cloud run job When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the Job.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `binary_authorization` (`list[obj]`): Settings for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `template` (`list[obj]`): The template used to create executions for this Job. When `null`, the `template` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.new](#fn-templatenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.cloud_run_v2_job.new` injects a new `google_cloud_run_v2_job` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloud_run_v2_job.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloud_run_v2_job` using the reference:\n\n    $._ref.google_cloud_run_v2_job.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloud_run_v2_job.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Unstructured key value map that may be set by external tools to store and arbitrary metadata. They are not queryable and should be preserved when modifying objects.\n\nCloud Run API v2 does not support annotations with \u0026#39;run.googleapis.com\u0026#39;, \u0026#39;cloud.googleapis.com\u0026#39;, \u0026#39;serving.knative.dev\u0026#39;, or \u0026#39;autoscaling.knative.dev\u0026#39; namespaces, and they will be rejected on new resources.\nAll system annotations in v1 now have a corresponding field in v2 Job.\n\nThis field follows Kubernetes annotations\u0026#39; namespacing, limits, and rules.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field \u0026#39;effective_annotations\u0026#39; for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `client` (`string`): Arbitrary identifier for the API client. When `null`, the `client` field will be omitted from the resulting object.\n  - `client_version` (`string`): Arbitrary version identifier for the API client. When `null`, the `client_version` field will be omitted from the resulting object.\n  - `labels` (`obj`): Unstructured key value map that can be used to organize and categorize objects. User-provided labels are shared with Google\u0026#39;s billing system, so they can be used to filter, or break down billing charges by team, component,\nenvironment, state, etc. For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or https://cloud.google.com/run/docs/configuring/labels.\n\nCloud Run API v2 does not support labels with \u0026#39;run.googleapis.com\u0026#39;, \u0026#39;cloud.googleapis.com\u0026#39;, \u0026#39;serving.knative.dev\u0026#39;, or \u0026#39;autoscaling.knative.dev\u0026#39; namespaces, and they will be rejected.\nAll system labels in v1 now have a corresponding field in v2 Job.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `launch_stage` (`string`): The launch stage as defined by [Google Cloud Platform Launch Stages](https://cloud.google.com/products#product-launch-stages). Cloud Run supports ALPHA, BETA, and GA.\nIf no value is specified, GA is assumed. Set the launch stage to a preview stage on input to allow use of preview features in that stage. On read (or output), describes whether the resource uses preview features.\n\nFor example, if ALPHA is provided as input, but only BETA and GA-level features are used, this field will be BETA on output. Possible values: [\u0026#34;UNIMPLEMENTED\u0026#34;, \u0026#34;PRELAUNCH\u0026#34;, \u0026#34;EARLY_ACCESS\u0026#34;, \u0026#34;ALPHA\u0026#34;, \u0026#34;BETA\u0026#34;, \u0026#34;GA\u0026#34;, \u0026#34;DEPRECATED\u0026#34;] When `null`, the `launch_stage` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the cloud run job\n  - `name` (`string`): Name of the Job.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `binary_authorization` (`list[obj]`): Settings for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `template` (`list[obj]`): The template used to create executions for this Job. When `null`, the `template` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.new](#fn-templatenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
+    location,
     name,
     annotations=null,
     binary_authorization=null,
@@ -22,7 +23,6 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     client_version=null,
     labels=null,
     launch_stage=null,
-    location=null,
     project=null,
     template=null,
     timeouts=null,
@@ -45,8 +45,9 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.cloud_run_v2_job.newAttrs` constructs a new object with attributes and blocks configured for the `cloud_run_v2_job`\nTerraform resource.\n\nUnlike [google.cloud_run_v2_job.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Unstructured key value map that may be set by external tools to store and arbitrary metadata. They are not queryable and should be preserved when modifying objects.\n\nCloud Run API v2 does not support annotations with 'run.googleapis.com', 'cloud.googleapis.com', 'serving.knative.dev', or 'autoscaling.knative.dev' namespaces, and they will be rejected on new resources.\nAll system annotations in v1 now have a corresponding field in v2 Job.\n\nThis field follows Kubernetes annotations' namespacing, limits, and rules. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `client` (`string`): Arbitrary identifier for the API client. When `null`, the `client` field will be omitted from the resulting object.\n  - `client_version` (`string`): Arbitrary version identifier for the API client. When `null`, the `client_version` field will be omitted from the resulting object.\n  - `labels` (`obj`): Unstructured key value map that can be used to organize and categorize objects. User-provided labels are shared with Google's billing system, so they can be used to filter, or break down billing charges by team, component,\nenvironment, state, etc. For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or https://cloud.google.com/run/docs/configuring/labels.\n\nCloud Run API v2 does not support labels with 'run.googleapis.com', 'cloud.googleapis.com', 'serving.knative.dev', or 'autoscaling.knative.dev' namespaces, and they will be rejected.\nAll system labels in v1 now have a corresponding field in v2 Job. When `null`, the `labels` field will be omitted from the resulting object.\n  - `launch_stage` (`string`): The launch stage as defined by [Google Cloud Platform Launch Stages](https://cloud.google.com/products#product-launch-stages). Cloud Run supports ALPHA, BETA, and GA.\nIf no value is specified, GA is assumed. Set the launch stage to a preview stage on input to allow use of preview features in that stage. On read (or output), describes whether the resource uses preview features.\n\nFor example, if ALPHA is provided as input, but only BETA and GA-level features are used, this field will be BETA on output. Possible values: ["UNIMPLEMENTED", "PRELAUNCH", "EARLY_ACCESS", "ALPHA", "BETA", "GA", "DEPRECATED"] When `null`, the `launch_stage` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the cloud run job When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the Job.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `binary_authorization` (`list[obj]`): Settings for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `template` (`list[obj]`): The template used to create executions for this Job. When `null`, the `template` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.new](#fn-templatenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloud_run_v2_job` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.cloud_run_v2_job.newAttrs` constructs a new object with attributes and blocks configured for the `cloud_run_v2_job`\nTerraform resource.\n\nUnlike [google.cloud_run_v2_job.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Unstructured key value map that may be set by external tools to store and arbitrary metadata. They are not queryable and should be preserved when modifying objects.\n\nCloud Run API v2 does not support annotations with 'run.googleapis.com', 'cloud.googleapis.com', 'serving.knative.dev', or 'autoscaling.knative.dev' namespaces, and they will be rejected on new resources.\nAll system annotations in v1 now have a corresponding field in v2 Job.\n\nThis field follows Kubernetes annotations' namespacing, limits, and rules.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `client` (`string`): Arbitrary identifier for the API client. When `null`, the `client` field will be omitted from the resulting object.\n  - `client_version` (`string`): Arbitrary version identifier for the API client. When `null`, the `client_version` field will be omitted from the resulting object.\n  - `labels` (`obj`): Unstructured key value map that can be used to organize and categorize objects. User-provided labels are shared with Google's billing system, so they can be used to filter, or break down billing charges by team, component,\nenvironment, state, etc. For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or https://cloud.google.com/run/docs/configuring/labels.\n\nCloud Run API v2 does not support labels with 'run.googleapis.com', 'cloud.googleapis.com', 'serving.knative.dev', or 'autoscaling.knative.dev' namespaces, and they will be rejected.\nAll system labels in v1 now have a corresponding field in v2 Job.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `launch_stage` (`string`): The launch stage as defined by [Google Cloud Platform Launch Stages](https://cloud.google.com/products#product-launch-stages). Cloud Run supports ALPHA, BETA, and GA.\nIf no value is specified, GA is assumed. Set the launch stage to a preview stage on input to allow use of preview features in that stage. On read (or output), describes whether the resource uses preview features.\n\nFor example, if ALPHA is provided as input, but only BETA and GA-level features are used, this field will be BETA on output. Possible values: ["UNIMPLEMENTED", "PRELAUNCH", "EARLY_ACCESS", "ALPHA", "BETA", "GA", "DEPRECATED"] When `null`, the `launch_stage` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the cloud run job\n  - `name` (`string`): Name of the Job.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `binary_authorization` (`list[obj]`): Settings for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `template` (`list[obj]`): The template used to create executions for this Job. When `null`, the `template` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.new](#fn-templatenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloud_run_v2_job` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
+    location,
     name,
     annotations=null,
     binary_authorization=null,
@@ -54,7 +55,6 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     client_version=null,
     labels=null,
     launch_stage=null,
-    location=null,
     project=null,
     template=null,
     timeouts=null
@@ -118,63 +118,15 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
             },
           },
         },
-        liveness_probe:: {
-          http_get:: {
-            http_headers:: {
-              '#new':: d.fn(help='\n`google.cloud_run_v2_job.template.template.containers.liveness_probe.http_get.http_headers.new` constructs a new object with attributes and blocks configured for the `http_headers`\nTerraform sub block.\n\n\n\n**Args**:\n  - `name` (`string`): The header field name\n  - `value` (`string`): The header field value When `null`, the `value` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `http_headers` sub block.\n', args=[]),
-              new(
-                name,
-                value=null
-              ):: std.prune(a={
-                name: name,
-                value: value,
-              }),
-            },
-            '#new':: d.fn(help='\n`google.cloud_run_v2_job.template.template.containers.liveness_probe.http_get.new` constructs a new object with attributes and blocks configured for the `http_get`\nTerraform sub block.\n\n\n\n**Args**:\n  - `path` (`string`): Path to access on the HTTP server. Defaults to '/'. When `null`, the `path` field will be omitted from the resulting object.\n  - `http_headers` (`list[obj]`): Custom headers to set in the request. HTTP allows repeated headers. When `null`, the `http_headers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.liveness_probe.http_get.http_headers.new](#fn-templatetemplatetemplatecontainersliveness_probehttp_headersnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `http_get` sub block.\n', args=[]),
-            new(
-              http_headers=null,
-              path=null
-            ):: std.prune(a={
-              http_headers: http_headers,
-              path: path,
-            }),
-          },
-          '#new':: d.fn(help='\n`google.cloud_run_v2_job.template.template.containers.liveness_probe.new` constructs a new object with attributes and blocks configured for the `liveness_probe`\nTerraform sub block.\n\n\n\n**Args**:\n  - `failure_threshold` (`number`): Minimum consecutive failures for the probe to be considered failed after having succeeded. Defaults to 3. Minimum value is 1. When `null`, the `failure_threshold` field will be omitted from the resulting object.\n  - `initial_delay_seconds` (`number`): Number of seconds after the container has started before the probe is initiated. Defaults to 0 seconds. Minimum value is 0. Maximum value for liveness probe is 3600. Maximum value for startup probe is 240. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes When `null`, the `initial_delay_seconds` field will be omitted from the resulting object.\n  - `period_seconds` (`number`): How often (in seconds) to perform the probe. Default to 10 seconds. Minimum value is 1. Maximum value for liveness probe is 3600. Maximum value for startup probe is 240. Must be greater or equal than timeoutSeconds When `null`, the `period_seconds` field will be omitted from the resulting object.\n  - `timeout_seconds` (`number`): Number of seconds after which the probe times out. Defaults to 1 second. Minimum value is 1. Maximum value is 3600. Must be smaller than periodSeconds. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes When `null`, the `timeout_seconds` field will be omitted from the resulting object.\n  - `http_get` (`list[obj]`): HTTPGet specifies the http request to perform. Exactly one of HTTPGet or TCPSocket must be specified. When `null`, the `http_get` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.liveness_probe.http_get.new](#fn-templatetemplatetemplatecontainershttp_getnew) constructor.\n  - `tcp_socket` (`list[obj]`): TCPSocket specifies an action involving a TCP port. Exactly one of HTTPGet or TCPSocket must be specified. When `null`, the `tcp_socket` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.liveness_probe.tcp_socket.new](#fn-templatetemplatetemplatecontainerstcp_socketnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `liveness_probe` sub block.\n', args=[]),
-          new(
-            failure_threshold=null,
-            http_get=null,
-            initial_delay_seconds=null,
-            period_seconds=null,
-            tcp_socket=null,
-            timeout_seconds=null
-          ):: std.prune(a={
-            failure_threshold: failure_threshold,
-            http_get: http_get,
-            initial_delay_seconds: initial_delay_seconds,
-            period_seconds: period_seconds,
-            tcp_socket: tcp_socket,
-            timeout_seconds: timeout_seconds,
-          }),
-          tcp_socket:: {
-            '#new':: d.fn(help='\n`google.cloud_run_v2_job.template.template.containers.liveness_probe.tcp_socket.new` constructs a new object with attributes and blocks configured for the `tcp_socket`\nTerraform sub block.\n\n\n\n**Args**:\n  - `port` (`number`): Port number to access on the container. Must be in the range 1 to 65535. If not specified, defaults to 8080. When `null`, the `port` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `tcp_socket` sub block.\n', args=[]),
-            new(
-              port=null
-            ):: std.prune(a={
-              port: port,
-            }),
-          },
-        },
-        '#new':: d.fn(help='\n`google.cloud_run_v2_job.template.template.containers.new` constructs a new object with attributes and blocks configured for the `containers`\nTerraform sub block.\n\n\n\n**Args**:\n  - `args` (`list`): Arguments to the entrypoint. The docker image's CMD is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell When `null`, the `args` field will be omitted from the resulting object.\n  - `command` (`list`): Entrypoint array. Not executed within a shell. The docker image's ENTRYPOINT is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell When `null`, the `command` field will be omitted from the resulting object.\n  - `image` (`string`): URL of the Container image in Google Container Registry or Google Artifact Registry. More info: https://kubernetes.io/docs/concepts/containers/images\n  - `name` (`string`): Name of the container specified as a DNS_LABEL. When `null`, the `name` field will be omitted from the resulting object.\n  - `working_dir` (`string`): Container's working directory. If not specified, the container runtime's default will be used, which might be configured in the container image. When `null`, the `working_dir` field will be omitted from the resulting object.\n  - `env` (`list[obj]`): List of environment variables to set in the container. When `null`, the `env` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.env.new](#fn-templatetemplatetemplateenvnew) constructor.\n  - `liveness_probe` (`list[obj]`): Periodic probe of container liveness. Container will be restarted if the probe fails. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes\nThis field is not supported in Cloud Run Job currently. When `null`, the `liveness_probe` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.liveness_probe.new](#fn-templatetemplatetemplateliveness_probenew) constructor.\n  - `ports` (`list[obj]`): List of ports to expose from the container. Only a single port can be specified. The specified ports must be listening on all interfaces (0.0.0.0) within the container to be accessible.\n\nIf omitted, a port number will be chosen and passed to the container through the PORT environment variable for the container to listen on When `null`, the `ports` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.ports.new](#fn-templatetemplatetemplateportsnew) constructor.\n  - `resources` (`list[obj]`): Compute Resource requirements by this container. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources When `null`, the `resources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.resources.new](#fn-templatetemplatetemplateresourcesnew) constructor.\n  - `startup_probe` (`list[obj]`): Startup probe of application within the container. All other probes are disabled if a startup probe is provided, until it succeeds. Container will not be added to service endpoints if the probe fails. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes\nThis field is not supported in Cloud Run Job currently. When `null`, the `startup_probe` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.startup_probe.new](#fn-templatetemplatetemplatestartup_probenew) constructor.\n  - `volume_mounts` (`list[obj]`): Volume to mount into the container's filesystem. When `null`, the `volume_mounts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.volume_mounts.new](#fn-templatetemplatetemplatevolume_mountsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `containers` sub block.\n', args=[]),
+        '#new':: d.fn(help='\n`google.cloud_run_v2_job.template.template.containers.new` constructs a new object with attributes and blocks configured for the `containers`\nTerraform sub block.\n\n\n\n**Args**:\n  - `args` (`list`): Arguments to the entrypoint. The docker image's CMD is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell When `null`, the `args` field will be omitted from the resulting object.\n  - `command` (`list`): Entrypoint array. Not executed within a shell. The docker image's ENTRYPOINT is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell When `null`, the `command` field will be omitted from the resulting object.\n  - `image` (`string`): URL of the Container image in Google Container Registry or Google Artifact Registry. More info: https://kubernetes.io/docs/concepts/containers/images\n  - `name` (`string`): Name of the container specified as a DNS_LABEL. When `null`, the `name` field will be omitted from the resulting object.\n  - `working_dir` (`string`): Container's working directory. If not specified, the container runtime's default will be used, which might be configured in the container image. When `null`, the `working_dir` field will be omitted from the resulting object.\n  - `env` (`list[obj]`): List of environment variables to set in the container. When `null`, the `env` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.env.new](#fn-templatetemplatetemplateenvnew) constructor.\n  - `ports` (`list[obj]`): List of ports to expose from the container. Only a single port can be specified. The specified ports must be listening on all interfaces (0.0.0.0) within the container to be accessible.\n\nIf omitted, a port number will be chosen and passed to the container through the PORT environment variable for the container to listen on When `null`, the `ports` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.ports.new](#fn-templatetemplatetemplateportsnew) constructor.\n  - `resources` (`list[obj]`): Compute Resource requirements by this container. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources When `null`, the `resources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.resources.new](#fn-templatetemplatetemplateresourcesnew) constructor.\n  - `volume_mounts` (`list[obj]`): Volume to mount into the container's filesystem. When `null`, the `volume_mounts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.volume_mounts.new](#fn-templatetemplatetemplatevolume_mountsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `containers` sub block.\n', args=[]),
         new(
           image,
           args=null,
           command=null,
           env=null,
-          liveness_probe=null,
           name=null,
           ports=null,
           resources=null,
-          startup_probe=null,
           volume_mounts=null,
           working_dir=null
         ):: std.prune(a={
@@ -182,11 +134,9 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
           command: command,
           env: env,
           image: image,
-          liveness_probe: liveness_probe,
           name: name,
           ports: ports,
           resources: resources,
-          startup_probe: startup_probe,
           volume_mounts: volume_mounts,
           working_dir: working_dir,
         }),
@@ -208,52 +158,6 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
             limits: limits,
           }),
         },
-        startup_probe:: {
-          http_get:: {
-            http_headers:: {
-              '#new':: d.fn(help='\n`google.cloud_run_v2_job.template.template.containers.startup_probe.http_get.http_headers.new` constructs a new object with attributes and blocks configured for the `http_headers`\nTerraform sub block.\n\n\n\n**Args**:\n  - `name` (`string`): The header field name\n  - `value` (`string`): The header field value When `null`, the `value` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `http_headers` sub block.\n', args=[]),
-              new(
-                name,
-                value=null
-              ):: std.prune(a={
-                name: name,
-                value: value,
-              }),
-            },
-            '#new':: d.fn(help='\n`google.cloud_run_v2_job.template.template.containers.startup_probe.http_get.new` constructs a new object with attributes and blocks configured for the `http_get`\nTerraform sub block.\n\n\n\n**Args**:\n  - `path` (`string`): Path to access on the HTTP server. Defaults to '/'. When `null`, the `path` field will be omitted from the resulting object.\n  - `http_headers` (`list[obj]`): Custom headers to set in the request. HTTP allows repeated headers. When `null`, the `http_headers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.startup_probe.http_get.http_headers.new](#fn-templatetemplatetemplatecontainersstartup_probehttp_headersnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `http_get` sub block.\n', args=[]),
-            new(
-              http_headers=null,
-              path=null
-            ):: std.prune(a={
-              http_headers: http_headers,
-              path: path,
-            }),
-          },
-          '#new':: d.fn(help='\n`google.cloud_run_v2_job.template.template.containers.startup_probe.new` constructs a new object with attributes and blocks configured for the `startup_probe`\nTerraform sub block.\n\n\n\n**Args**:\n  - `failure_threshold` (`number`): Minimum consecutive failures for the probe to be considered failed after having succeeded. Defaults to 3. Minimum value is 1. When `null`, the `failure_threshold` field will be omitted from the resulting object.\n  - `initial_delay_seconds` (`number`): Number of seconds after the container has started before the probe is initiated. Defaults to 0 seconds. Minimum value is 0. Maximum value for liveness probe is 3600. Maximum value for startup probe is 240. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes When `null`, the `initial_delay_seconds` field will be omitted from the resulting object.\n  - `period_seconds` (`number`): How often (in seconds) to perform the probe. Default to 10 seconds. Minimum value is 1. Maximum value for liveness probe is 3600. Maximum value for startup probe is 240. Must be greater or equal than timeoutSeconds When `null`, the `period_seconds` field will be omitted from the resulting object.\n  - `timeout_seconds` (`number`): Number of seconds after which the probe times out. Defaults to 1 second. Minimum value is 1. Maximum value is 3600. Must be smaller than periodSeconds. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes When `null`, the `timeout_seconds` field will be omitted from the resulting object.\n  - `http_get` (`list[obj]`): HTTPGet specifies the http request to perform. Exactly one of HTTPGet or TCPSocket must be specified. When `null`, the `http_get` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.startup_probe.http_get.new](#fn-templatetemplatetemplatecontainershttp_getnew) constructor.\n  - `tcp_socket` (`list[obj]`): TCPSocket specifies an action involving a TCP port. Exactly one of HTTPGet or TCPSocket must be specified. When `null`, the `tcp_socket` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.startup_probe.tcp_socket.new](#fn-templatetemplatetemplatecontainerstcp_socketnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `startup_probe` sub block.\n', args=[]),
-          new(
-            failure_threshold=null,
-            http_get=null,
-            initial_delay_seconds=null,
-            period_seconds=null,
-            tcp_socket=null,
-            timeout_seconds=null
-          ):: std.prune(a={
-            failure_threshold: failure_threshold,
-            http_get: http_get,
-            initial_delay_seconds: initial_delay_seconds,
-            period_seconds: period_seconds,
-            tcp_socket: tcp_socket,
-            timeout_seconds: timeout_seconds,
-          }),
-          tcp_socket:: {
-            '#new':: d.fn(help='\n`google.cloud_run_v2_job.template.template.containers.startup_probe.tcp_socket.new` constructs a new object with attributes and blocks configured for the `tcp_socket`\nTerraform sub block.\n\n\n\n**Args**:\n  - `port` (`number`): Port number to access on the container. Must be in the range 1 to 65535. If not specified, defaults to 8080. When `null`, the `port` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `tcp_socket` sub block.\n', args=[]),
-            new(
-              port=null
-            ):: std.prune(a={
-              port: port,
-            }),
-          },
-        },
         volume_mounts:: {
           '#new':: d.fn(help='\n`google.cloud_run_v2_job.template.template.containers.volume_mounts.new` constructs a new object with attributes and blocks configured for the `volume_mounts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `mount_path` (`string`): Path within the container at which the volume should be mounted. Must not contain ':'. For Cloud SQL volumes, it can be left empty, or must otherwise be /cloudsql. All instances defined in the Volume will be available as /cloudsql/[instance]. For more information on Cloud SQL volumes, visit https://cloud.google.com/sql/docs/mysql/connect-run\n  - `name` (`string`): This must match the Name of a Volume.\n\n**Returns**:\n  - An attribute object that represents the `volume_mounts` sub block.\n', args=[]),
           new(
diff --git a/4.x/_gen/resources/cloud_run_v2_service.libsonnet b/4.x/_gen/resources/cloud_run_v2_service.libsonnet
index 38f6cea8..f8734948 100644
--- a/4.x/_gen/resources/cloud_run_v2_service.libsonnet
+++ b/4.x/_gen/resources/cloud_run_v2_service.libsonnet
@@ -12,9 +12,10 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       use_default: use_default,
     }),
   },
-  '#new':: d.fn(help="\n`google.cloud_run_v2_service.new` injects a new `google_cloud_run_v2_service` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloud_run_v2_service.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloud_run_v2_service` using the reference:\n\n    $._ref.google_cloud_run_v2_service.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloud_run_v2_service.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Unstructured key value map that may be set by external tools to store and arbitrary metadata. They are not queryable and should be preserved when modifying objects.\n\nCloud Run API v2 does not support annotations with \u0026#39;run.googleapis.com\u0026#39;, \u0026#39;cloud.googleapis.com\u0026#39;, \u0026#39;serving.knative.dev\u0026#39;, or \u0026#39;autoscaling.knative.dev\u0026#39; namespaces, and they will be rejected in new resources.\nAll system annotations in v1 now have a corresponding field in v2 Service.\n\nThis field follows Kubernetes annotations\u0026#39; namespacing, limits, and rules. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `client` (`string`): Arbitrary identifier for the API client. When `null`, the `client` field will be omitted from the resulting object.\n  - `client_version` (`string`): Arbitrary version identifier for the API client. When `null`, the `client_version` field will be omitted from the resulting object.\n  - `description` (`string`): User-provided description of the Service. This field currently has a 512-character limit. When `null`, the `description` field will be omitted from the resulting object.\n  - `ingress` (`string`): Provides the ingress settings for this Service. On output, returns the currently observed ingress settings, or INGRESS_TRAFFIC_UNSPECIFIED if no revision is active. Possible values: [\u0026#34;INGRESS_TRAFFIC_ALL\u0026#34;, \u0026#34;INGRESS_TRAFFIC_INTERNAL_ONLY\u0026#34;, \u0026#34;INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER\u0026#34;] When `null`, the `ingress` field will be omitted from the resulting object.\n  - `labels` (`obj`): Unstructured key value map that can be used to organize and categorize objects. User-provided labels are shared with Google\u0026#39;s billing system, so they can be used to filter, or break down billing charges by team, component,\nenvironment, state, etc. For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or https://cloud.google.com/run/docs/configuring/labels.\n\nCloud Run API v2 does not support labels with  \u0026#39;run.googleapis.com\u0026#39;, \u0026#39;cloud.googleapis.com\u0026#39;, \u0026#39;serving.knative.dev\u0026#39;, or \u0026#39;autoscaling.knative.dev\u0026#39; namespaces, and they will be rejected.\nAll system labels in v1 now have a corresponding field in v2 Service. When `null`, the `labels` field will be omitted from the resulting object.\n  - `launch_stage` (`string`): The launch stage as defined by [Google Cloud Platform Launch Stages](https://cloud.google.com/products#product-launch-stages). Cloud Run supports ALPHA, BETA, and GA.\nIf no value is specified, GA is assumed. Set the launch stage to a preview stage on input to allow use of preview features in that stage. On read (or output), describes whether the resource uses preview features.\n\nFor example, if ALPHA is provided as input, but only BETA and GA-level features are used, this field will be BETA on output. Possible values: [\u0026#34;UNIMPLEMENTED\u0026#34;, \u0026#34;PRELAUNCH\u0026#34;, \u0026#34;EARLY_ACCESS\u0026#34;, \u0026#34;ALPHA\u0026#34;, \u0026#34;BETA\u0026#34;, \u0026#34;GA\u0026#34;, \u0026#34;DEPRECATED\u0026#34;] When `null`, the `launch_stage` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the cloud run service When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the Service.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `binary_authorization` (`list[obj]`): Settings for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `template` (`list[obj]`): The template used to create revisions for this Service. When `null`, the `template` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.new](#fn-templatenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.timeouts.new](#fn-timeoutsnew) constructor.\n  - `traffic` (`list[obj]`): Specifies how to distribute traffic over a collection of Revisions belonging to the Service. If traffic is empty or not provided, defaults to 100% traffic to the latest Ready Revision. When `null`, the `traffic` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.traffic.new](#fn-trafficnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.cloud_run_v2_service.new` injects a new `google_cloud_run_v2_service` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloud_run_v2_service.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloud_run_v2_service` using the reference:\n\n    $._ref.google_cloud_run_v2_service.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloud_run_v2_service.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Unstructured key value map that may be set by external tools to store and arbitrary metadata. They are not queryable and should be preserved when modifying objects.\n\nCloud Run API v2 does not support annotations with \u0026#39;run.googleapis.com\u0026#39;, \u0026#39;cloud.googleapis.com\u0026#39;, \u0026#39;serving.knative.dev\u0026#39;, or \u0026#39;autoscaling.knative.dev\u0026#39; namespaces, and they will be rejected in new resources.\nAll system annotations in v1 now have a corresponding field in v2 Service.\n\nThis field follows Kubernetes annotations\u0026#39; namespacing, limits, and rules.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field \u0026#39;effective_annotations\u0026#39; for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `client` (`string`): Arbitrary identifier for the API client. When `null`, the `client` field will be omitted from the resulting object.\n  - `client_version` (`string`): Arbitrary version identifier for the API client. When `null`, the `client_version` field will be omitted from the resulting object.\n  - `description` (`string`): User-provided description of the Service. This field currently has a 512-character limit. When `null`, the `description` field will be omitted from the resulting object.\n  - `ingress` (`string`): Provides the ingress settings for this Service. On output, returns the currently observed ingress settings, or INGRESS_TRAFFIC_UNSPECIFIED if no revision is active. Possible values: [\u0026#34;INGRESS_TRAFFIC_ALL\u0026#34;, \u0026#34;INGRESS_TRAFFIC_INTERNAL_ONLY\u0026#34;, \u0026#34;INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER\u0026#34;] When `null`, the `ingress` field will be omitted from the resulting object.\n  - `labels` (`obj`): Unstructured key value map that can be used to organize and categorize objects. User-provided labels are shared with Google\u0026#39;s billing system, so they can be used to filter, or break down billing charges by team, component,\nenvironment, state, etc. For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or https://cloud.google.com/run/docs/configuring/labels.\n\nCloud Run API v2 does not support labels with  \u0026#39;run.googleapis.com\u0026#39;, \u0026#39;cloud.googleapis.com\u0026#39;, \u0026#39;serving.knative.dev\u0026#39;, or \u0026#39;autoscaling.knative.dev\u0026#39; namespaces, and they will be rejected.\nAll system labels in v1 now have a corresponding field in v2 Service.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `launch_stage` (`string`): The launch stage as defined by [Google Cloud Platform Launch Stages](https://cloud.google.com/products#product-launch-stages). Cloud Run supports ALPHA, BETA, and GA.\nIf no value is specified, GA is assumed. Set the launch stage to a preview stage on input to allow use of preview features in that stage. On read (or output), describes whether the resource uses preview features.\n\nFor example, if ALPHA is provided as input, but only BETA and GA-level features are used, this field will be BETA on output. Possible values: [\u0026#34;UNIMPLEMENTED\u0026#34;, \u0026#34;PRELAUNCH\u0026#34;, \u0026#34;EARLY_ACCESS\u0026#34;, \u0026#34;ALPHA\u0026#34;, \u0026#34;BETA\u0026#34;, \u0026#34;GA\u0026#34;, \u0026#34;DEPRECATED\u0026#34;] When `null`, the `launch_stage` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the cloud run service\n  - `name` (`string`): Name of the Service.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `binary_authorization` (`list[obj]`): Settings for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `template` (`list[obj]`): The template used to create revisions for this Service. When `null`, the `template` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.new](#fn-templatenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.timeouts.new](#fn-timeoutsnew) constructor.\n  - `traffic` (`list[obj]`): Specifies how to distribute traffic over a collection of Revisions belonging to the Service. If traffic is empty or not provided, defaults to 100% traffic to the latest Ready Revision. When `null`, the `traffic` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.traffic.new](#fn-trafficnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
+    location,
     name,
     annotations=null,
     binary_authorization=null,
@@ -24,7 +25,6 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ingress=null,
     labels=null,
     launch_stage=null,
-    location=null,
     project=null,
     template=null,
     timeouts=null,
@@ -51,8 +51,9 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.cloud_run_v2_service.newAttrs` constructs a new object with attributes and blocks configured for the `cloud_run_v2_service`\nTerraform resource.\n\nUnlike [google.cloud_run_v2_service.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Unstructured key value map that may be set by external tools to store and arbitrary metadata. They are not queryable and should be preserved when modifying objects.\n\nCloud Run API v2 does not support annotations with 'run.googleapis.com', 'cloud.googleapis.com', 'serving.knative.dev', or 'autoscaling.knative.dev' namespaces, and they will be rejected in new resources.\nAll system annotations in v1 now have a corresponding field in v2 Service.\n\nThis field follows Kubernetes annotations' namespacing, limits, and rules. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `client` (`string`): Arbitrary identifier for the API client. When `null`, the `client` field will be omitted from the resulting object.\n  - `client_version` (`string`): Arbitrary version identifier for the API client. When `null`, the `client_version` field will be omitted from the resulting object.\n  - `description` (`string`): User-provided description of the Service. This field currently has a 512-character limit. When `null`, the `description` field will be omitted from the resulting object.\n  - `ingress` (`string`): Provides the ingress settings for this Service. On output, returns the currently observed ingress settings, or INGRESS_TRAFFIC_UNSPECIFIED if no revision is active. Possible values: ["INGRESS_TRAFFIC_ALL", "INGRESS_TRAFFIC_INTERNAL_ONLY", "INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER"] When `null`, the `ingress` field will be omitted from the resulting object.\n  - `labels` (`obj`): Unstructured key value map that can be used to organize and categorize objects. User-provided labels are shared with Google's billing system, so they can be used to filter, or break down billing charges by team, component,\nenvironment, state, etc. For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or https://cloud.google.com/run/docs/configuring/labels.\n\nCloud Run API v2 does not support labels with  'run.googleapis.com', 'cloud.googleapis.com', 'serving.knative.dev', or 'autoscaling.knative.dev' namespaces, and they will be rejected.\nAll system labels in v1 now have a corresponding field in v2 Service. When `null`, the `labels` field will be omitted from the resulting object.\n  - `launch_stage` (`string`): The launch stage as defined by [Google Cloud Platform Launch Stages](https://cloud.google.com/products#product-launch-stages). Cloud Run supports ALPHA, BETA, and GA.\nIf no value is specified, GA is assumed. Set the launch stage to a preview stage on input to allow use of preview features in that stage. On read (or output), describes whether the resource uses preview features.\n\nFor example, if ALPHA is provided as input, but only BETA and GA-level features are used, this field will be BETA on output. Possible values: ["UNIMPLEMENTED", "PRELAUNCH", "EARLY_ACCESS", "ALPHA", "BETA", "GA", "DEPRECATED"] When `null`, the `launch_stage` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the cloud run service When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the Service.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `binary_authorization` (`list[obj]`): Settings for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `template` (`list[obj]`): The template used to create revisions for this Service. When `null`, the `template` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.new](#fn-templatenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.timeouts.new](#fn-timeoutsnew) constructor.\n  - `traffic` (`list[obj]`): Specifies how to distribute traffic over a collection of Revisions belonging to the Service. If traffic is empty or not provided, defaults to 100% traffic to the latest Ready Revision. When `null`, the `traffic` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.traffic.new](#fn-trafficnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloud_run_v2_service` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.cloud_run_v2_service.newAttrs` constructs a new object with attributes and blocks configured for the `cloud_run_v2_service`\nTerraform resource.\n\nUnlike [google.cloud_run_v2_service.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Unstructured key value map that may be set by external tools to store and arbitrary metadata. They are not queryable and should be preserved when modifying objects.\n\nCloud Run API v2 does not support annotations with 'run.googleapis.com', 'cloud.googleapis.com', 'serving.knative.dev', or 'autoscaling.knative.dev' namespaces, and they will be rejected in new resources.\nAll system annotations in v1 now have a corresponding field in v2 Service.\n\nThis field follows Kubernetes annotations' namespacing, limits, and rules.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `client` (`string`): Arbitrary identifier for the API client. When `null`, the `client` field will be omitted from the resulting object.\n  - `client_version` (`string`): Arbitrary version identifier for the API client. When `null`, the `client_version` field will be omitted from the resulting object.\n  - `description` (`string`): User-provided description of the Service. This field currently has a 512-character limit. When `null`, the `description` field will be omitted from the resulting object.\n  - `ingress` (`string`): Provides the ingress settings for this Service. On output, returns the currently observed ingress settings, or INGRESS_TRAFFIC_UNSPECIFIED if no revision is active. Possible values: ["INGRESS_TRAFFIC_ALL", "INGRESS_TRAFFIC_INTERNAL_ONLY", "INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER"] When `null`, the `ingress` field will be omitted from the resulting object.\n  - `labels` (`obj`): Unstructured key value map that can be used to organize and categorize objects. User-provided labels are shared with Google's billing system, so they can be used to filter, or break down billing charges by team, component,\nenvironment, state, etc. For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or https://cloud.google.com/run/docs/configuring/labels.\n\nCloud Run API v2 does not support labels with  'run.googleapis.com', 'cloud.googleapis.com', 'serving.knative.dev', or 'autoscaling.knative.dev' namespaces, and they will be rejected.\nAll system labels in v1 now have a corresponding field in v2 Service.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `launch_stage` (`string`): The launch stage as defined by [Google Cloud Platform Launch Stages](https://cloud.google.com/products#product-launch-stages). Cloud Run supports ALPHA, BETA, and GA.\nIf no value is specified, GA is assumed. Set the launch stage to a preview stage on input to allow use of preview features in that stage. On read (or output), describes whether the resource uses preview features.\n\nFor example, if ALPHA is provided as input, but only BETA and GA-level features are used, this field will be BETA on output. Possible values: ["UNIMPLEMENTED", "PRELAUNCH", "EARLY_ACCESS", "ALPHA", "BETA", "GA", "DEPRECATED"] When `null`, the `launch_stage` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the cloud run service\n  - `name` (`string`): Name of the Service.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `binary_authorization` (`list[obj]`): Settings for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `template` (`list[obj]`): The template used to create revisions for this Service. When `null`, the `template` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.new](#fn-templatenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.timeouts.new](#fn-timeoutsnew) constructor.\n  - `traffic` (`list[obj]`): Specifies how to distribute traffic over a collection of Revisions belonging to the Service. If traffic is empty or not provided, defaults to 100% traffic to the latest Ready Revision. When `null`, the `traffic` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.traffic.new](#fn-trafficnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloud_run_v2_service` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
+    location,
     name,
     annotations=null,
     binary_authorization=null,
@@ -62,7 +63,6 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ingress=null,
     labels=null,
     launch_stage=null,
-    location=null,
     project=null,
     template=null,
     timeouts=null,
@@ -148,14 +148,13 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
             port: port,
           }),
         },
-        '#new':: d.fn(help='\n`google.cloud_run_v2_service.template.containers.liveness_probe.new` constructs a new object with attributes and blocks configured for the `liveness_probe`\nTerraform sub block.\n\n\n\n**Args**:\n  - `failure_threshold` (`number`): Minimum consecutive failures for the probe to be considered failed after having succeeded. Defaults to 3. Minimum value is 1. When `null`, the `failure_threshold` field will be omitted from the resulting object.\n  - `initial_delay_seconds` (`number`): Number of seconds after the container has started before the probe is initiated. Defaults to 0 seconds. Minimum value is 0. Maximum value for liveness probe is 3600. Maximum value for startup probe is 240. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes When `null`, the `initial_delay_seconds` field will be omitted from the resulting object.\n  - `period_seconds` (`number`): How often (in seconds) to perform the probe. Default to 10 seconds. Minimum value is 1. Maximum value for liveness probe is 3600. Maximum value for startup probe is 240. Must be greater or equal than timeoutSeconds When `null`, the `period_seconds` field will be omitted from the resulting object.\n  - `timeout_seconds` (`number`): Number of seconds after which the probe times out. Defaults to 1 second. Minimum value is 1. Maximum value is 3600. Must be smaller than periodSeconds. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes When `null`, the `timeout_seconds` field will be omitted from the resulting object.\n  - `grpc` (`list[obj]`): GRPC specifies an action involving a GRPC port. When `null`, the `grpc` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.liveness_probe.grpc.new](#fn-templatetemplatecontainersgrpcnew) constructor.\n  - `http_get` (`list[obj]`): HTTPGet specifies the http request to perform. When `null`, the `http_get` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.liveness_probe.http_get.new](#fn-templatetemplatecontainershttp_getnew) constructor.\n  - `tcp_socket` (`list[obj]`): TCPSocket specifies an action involving a TCP port. This field is not supported in liveness probe currently. When `null`, the `tcp_socket` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.liveness_probe.tcp_socket.new](#fn-templatetemplatecontainerstcp_socketnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `liveness_probe` sub block.\n', args=[]),
+        '#new':: d.fn(help='\n`google.cloud_run_v2_service.template.containers.liveness_probe.new` constructs a new object with attributes and blocks configured for the `liveness_probe`\nTerraform sub block.\n\n\n\n**Args**:\n  - `failure_threshold` (`number`): Minimum consecutive failures for the probe to be considered failed after having succeeded. Defaults to 3. Minimum value is 1. When `null`, the `failure_threshold` field will be omitted from the resulting object.\n  - `initial_delay_seconds` (`number`): Number of seconds after the container has started before the probe is initiated. Defaults to 0 seconds. Minimum value is 0. Maximum value for liveness probe is 3600. Maximum value for startup probe is 240. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes When `null`, the `initial_delay_seconds` field will be omitted from the resulting object.\n  - `period_seconds` (`number`): How often (in seconds) to perform the probe. Default to 10 seconds. Minimum value is 1. Maximum value for liveness probe is 3600. Maximum value for startup probe is 240. Must be greater or equal than timeoutSeconds When `null`, the `period_seconds` field will be omitted from the resulting object.\n  - `timeout_seconds` (`number`): Number of seconds after which the probe times out. Defaults to 1 second. Minimum value is 1. Maximum value is 3600. Must be smaller than periodSeconds. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes When `null`, the `timeout_seconds` field will be omitted from the resulting object.\n  - `grpc` (`list[obj]`): GRPC specifies an action involving a GRPC port. When `null`, the `grpc` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.liveness_probe.grpc.new](#fn-templatetemplatecontainersgrpcnew) constructor.\n  - `http_get` (`list[obj]`): HTTPGet specifies the http request to perform. When `null`, the `http_get` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.liveness_probe.http_get.new](#fn-templatetemplatecontainershttp_getnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `liveness_probe` sub block.\n', args=[]),
         new(
           failure_threshold=null,
           grpc=null,
           http_get=null,
           initial_delay_seconds=null,
           period_seconds=null,
-          tcp_socket=null,
           timeout_seconds=null
         ):: std.prune(a={
           failure_threshold: failure_threshold,
@@ -163,17 +162,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
           http_get: http_get,
           initial_delay_seconds: initial_delay_seconds,
           period_seconds: period_seconds,
-          tcp_socket: tcp_socket,
           timeout_seconds: timeout_seconds,
         }),
-        tcp_socket:: {
-          '#new':: d.fn(help='\n`google.cloud_run_v2_service.template.containers.liveness_probe.tcp_socket.new` constructs a new object with attributes and blocks configured for the `tcp_socket`\nTerraform sub block.\n\n\n\n**Args**:\n  - `port` (`number`): Port number to access on the container. Must be in the range 1 to 65535. If not specified, defaults to 8080. When `null`, the `port` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `tcp_socket` sub block.\n', args=[]),
-          new(
-            port=null
-          ):: std.prune(a={
-            port: port,
-          }),
-        },
       },
       '#new':: d.fn(help='\n`google.cloud_run_v2_service.template.containers.new` constructs a new object with attributes and blocks configured for the `containers`\nTerraform sub block.\n\n\n\n**Args**:\n  - `args` (`list`): Arguments to the entrypoint. The docker image's CMD is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell When `null`, the `args` field will be omitted from the resulting object.\n  - `command` (`list`): Entrypoint array. Not executed within a shell. The docker image's ENTRYPOINT is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell When `null`, the `command` field will be omitted from the resulting object.\n  - `image` (`string`): URL of the Container image in Google Container Registry or Google Artifact Registry. More info: https://kubernetes.io/docs/concepts/containers/images\n  - `name` (`string`): Name of the container specified as a DNS_LABEL. When `null`, the `name` field will be omitted from the resulting object.\n  - `working_dir` (`string`): Container's working directory. If not specified, the container runtime's default will be used, which might be configured in the container image. When `null`, the `working_dir` field will be omitted from the resulting object.\n  - `env` (`list[obj]`): List of environment variables to set in the container. When `null`, the `env` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.env.new](#fn-templatetemplateenvnew) constructor.\n  - `liveness_probe` (`list[obj]`): Periodic probe of container liveness. Container will be restarted if the probe fails. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes When `null`, the `liveness_probe` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.liveness_probe.new](#fn-templatetemplateliveness_probenew) constructor.\n  - `ports` (`list[obj]`): List of ports to expose from the container. Only a single port can be specified. The specified ports must be listening on all interfaces (0.0.0.0) within the container to be accessible.\n\nIf omitted, a port number will be chosen and passed to the container through the PORT environment variable for the container to listen on When `null`, the `ports` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.ports.new](#fn-templatetemplateportsnew) constructor.\n  - `resources` (`list[obj]`): Compute Resource requirements by this container. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources When `null`, the `resources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.resources.new](#fn-templatetemplateresourcesnew) constructor.\n  - `startup_probe` (`list[obj]`): Startup probe of application within the container. All other probes are disabled if a startup probe is provided, until it succeeds. Container will not be added to service endpoints if the probe fails. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes When `null`, the `startup_probe` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.startup_probe.new](#fn-templatetemplatestartup_probenew) constructor.\n  - `volume_mounts` (`list[obj]`): Volume to mount into the container's filesystem. When `null`, the `volume_mounts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.volume_mounts.new](#fn-templatetemplatevolume_mountsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `containers` sub block.\n', args=[]),
       new(
diff --git a/4.x/_gen/resources/cloudbuild_worker_pool.libsonnet b/4.x/_gen/resources/cloudbuild_worker_pool.libsonnet
index 54a51ea8..3020491c 100644
--- a/4.x/_gen/resources/cloudbuild_worker_pool.libsonnet
+++ b/4.x/_gen/resources/cloudbuild_worker_pool.libsonnet
@@ -12,7 +12,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       peered_network_ip_range: peered_network_ip_range,
     }),
   },
-  '#new':: d.fn(help="\n`google.cloudbuild_worker_pool.new` injects a new `google_cloudbuild_worker_pool` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloudbuild_worker_pool.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloudbuild_worker_pool` using the reference:\n\n    $._ref.google_cloudbuild_worker_pool.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloudbuild_worker_pool.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): User specified annotations. See https://google.aip.dev/128#annotations for more details such as format and size limitations. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `display_name` (`string`): A user-specified, human-readable name for the `WorkerPool`. If provided, this value must be 1-63 characters. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): User-defined name of the `WorkerPool`.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `network_config` (`list[obj]`): Network configuration for the `WorkerPool`. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuild_worker_pool.network_config.new](#fn-network_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuild_worker_pool.timeouts.new](#fn-timeoutsnew) constructor.\n  - `worker_config` (`list[obj]`): Configuration to be used for a creating workers in the `WorkerPool`. When `null`, the `worker_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuild_worker_pool.worker_config.new](#fn-worker_confignew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.cloudbuild_worker_pool.new` injects a new `google_cloudbuild_worker_pool` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloudbuild_worker_pool.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloudbuild_worker_pool` using the reference:\n\n    $._ref.google_cloudbuild_worker_pool.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloudbuild_worker_pool.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): User specified annotations. See https://google.aip.dev/128#annotations for more details such as format and size limitations.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `display_name` (`string`): A user-specified, human-readable name for the `WorkerPool`. If provided, this value must be 1-63 characters. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): User-defined name of the `WorkerPool`.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `network_config` (`list[obj]`): Network configuration for the `WorkerPool`. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuild_worker_pool.network_config.new](#fn-network_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuild_worker_pool.timeouts.new](#fn-timeoutsnew) constructor.\n  - `worker_config` (`list[obj]`): Configuration to be used for a creating workers in the `WorkerPool`. When `null`, the `worker_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuild_worker_pool.worker_config.new](#fn-worker_confignew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -39,7 +39,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.cloudbuild_worker_pool.newAttrs` constructs a new object with attributes and blocks configured for the `cloudbuild_worker_pool`\nTerraform resource.\n\nUnlike [google.cloudbuild_worker_pool.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): User specified annotations. See https://google.aip.dev/128#annotations for more details such as format and size limitations. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `display_name` (`string`): A user-specified, human-readable name for the `WorkerPool`. If provided, this value must be 1-63 characters. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): User-defined name of the `WorkerPool`.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `network_config` (`list[obj]`): Network configuration for the `WorkerPool`. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuild_worker_pool.network_config.new](#fn-network_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuild_worker_pool.timeouts.new](#fn-timeoutsnew) constructor.\n  - `worker_config` (`list[obj]`): Configuration to be used for a creating workers in the `WorkerPool`. When `null`, the `worker_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuild_worker_pool.worker_config.new](#fn-worker_confignew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudbuild_worker_pool` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.cloudbuild_worker_pool.newAttrs` constructs a new object with attributes and blocks configured for the `cloudbuild_worker_pool`\nTerraform resource.\n\nUnlike [google.cloudbuild_worker_pool.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): User specified annotations. See https://google.aip.dev/128#annotations for more details such as format and size limitations.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `display_name` (`string`): A user-specified, human-readable name for the `WorkerPool`. If provided, this value must be 1-63 characters. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): User-defined name of the `WorkerPool`.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `network_config` (`list[obj]`): Network configuration for the `WorkerPool`. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuild_worker_pool.network_config.new](#fn-network_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuild_worker_pool.timeouts.new](#fn-timeoutsnew) constructor.\n  - `worker_config` (`list[obj]`): Configuration to be used for a creating workers in the `WorkerPool`. When `null`, the `worker_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuild_worker_pool.worker_config.new](#fn-worker_confignew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudbuild_worker_pool` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     name,
diff --git a/4.x/_gen/resources/cloudbuildv2_connection.libsonnet b/4.x/_gen/resources/cloudbuildv2_connection.libsonnet
index 255217d1..d41a523e 100644
--- a/4.x/_gen/resources/cloudbuildv2_connection.libsonnet
+++ b/4.x/_gen/resources/cloudbuildv2_connection.libsonnet
@@ -92,7 +92,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
   },
-  '#new':: d.fn(help="\n`google.cloudbuildv2_connection.new` injects a new `google_cloudbuildv2_connection` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloudbuildv2_connection.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloudbuildv2_connection` using the reference:\n\n    $._ref.google_cloudbuildv2_connection.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloudbuildv2_connection.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Allows clients to store small amounts of arbitrary data. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `disabled` (`bool`): If disabled is set to true, functionality is disabled for this connection. Repository based API methods and webhooks processing for repositories in this connection will be disabled. When `null`, the `disabled` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Immutable. The resource name of the connection, in the format `projects/{project}/locations/{location}/connections/{connection_id}`.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `github_config` (`list[obj]`): Configuration for connections to github.com. When `null`, the `github_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_connection.github_config.new](#fn-github_confignew) constructor.\n  - `github_enterprise_config` (`list[obj]`): Configuration for connections to an instance of GitHub Enterprise. When `null`, the `github_enterprise_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_connection.github_enterprise_config.new](#fn-github_enterprise_confignew) constructor.\n  - `gitlab_config` (`list[obj]`): Configuration for connections to gitlab.com or an instance of GitLab Enterprise. When `null`, the `gitlab_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_connection.gitlab_config.new](#fn-gitlab_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_connection.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.cloudbuildv2_connection.new` injects a new `google_cloudbuildv2_connection` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloudbuildv2_connection.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloudbuildv2_connection` using the reference:\n\n    $._ref.google_cloudbuildv2_connection.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloudbuildv2_connection.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Allows clients to store small amounts of arbitrary data.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `disabled` (`bool`): If disabled is set to true, functionality is disabled for this connection. Repository based API methods and webhooks processing for repositories in this connection will be disabled. When `null`, the `disabled` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Immutable. The resource name of the connection, in the format `projects/{project}/locations/{location}/connections/{connection_id}`.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `github_config` (`list[obj]`): Configuration for connections to github.com. When `null`, the `github_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_connection.github_config.new](#fn-github_confignew) constructor.\n  - `github_enterprise_config` (`list[obj]`): Configuration for connections to an instance of GitHub Enterprise. When `null`, the `github_enterprise_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_connection.github_enterprise_config.new](#fn-github_enterprise_confignew) constructor.\n  - `gitlab_config` (`list[obj]`): Configuration for connections to gitlab.com or an instance of GitLab Enterprise. When `null`, the `gitlab_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_connection.gitlab_config.new](#fn-gitlab_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_connection.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -121,7 +121,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.cloudbuildv2_connection.newAttrs` constructs a new object with attributes and blocks configured for the `cloudbuildv2_connection`\nTerraform resource.\n\nUnlike [google.cloudbuildv2_connection.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Allows clients to store small amounts of arbitrary data. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `disabled` (`bool`): If disabled is set to true, functionality is disabled for this connection. Repository based API methods and webhooks processing for repositories in this connection will be disabled. When `null`, the `disabled` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Immutable. The resource name of the connection, in the format `projects/{project}/locations/{location}/connections/{connection_id}`.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `github_config` (`list[obj]`): Configuration for connections to github.com. When `null`, the `github_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_connection.github_config.new](#fn-github_confignew) constructor.\n  - `github_enterprise_config` (`list[obj]`): Configuration for connections to an instance of GitHub Enterprise. When `null`, the `github_enterprise_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_connection.github_enterprise_config.new](#fn-github_enterprise_confignew) constructor.\n  - `gitlab_config` (`list[obj]`): Configuration for connections to gitlab.com or an instance of GitLab Enterprise. When `null`, the `gitlab_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_connection.gitlab_config.new](#fn-gitlab_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_connection.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudbuildv2_connection` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.cloudbuildv2_connection.newAttrs` constructs a new object with attributes and blocks configured for the `cloudbuildv2_connection`\nTerraform resource.\n\nUnlike [google.cloudbuildv2_connection.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Allows clients to store small amounts of arbitrary data.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `disabled` (`bool`): If disabled is set to true, functionality is disabled for this connection. Repository based API methods and webhooks processing for repositories in this connection will be disabled. When `null`, the `disabled` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Immutable. The resource name of the connection, in the format `projects/{project}/locations/{location}/connections/{connection_id}`.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `github_config` (`list[obj]`): Configuration for connections to github.com. When `null`, the `github_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_connection.github_config.new](#fn-github_confignew) constructor.\n  - `github_enterprise_config` (`list[obj]`): Configuration for connections to an instance of GitHub Enterprise. When `null`, the `github_enterprise_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_connection.github_enterprise_config.new](#fn-github_enterprise_confignew) constructor.\n  - `gitlab_config` (`list[obj]`): Configuration for connections to gitlab.com or an instance of GitLab Enterprise. When `null`, the `gitlab_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_connection.gitlab_config.new](#fn-gitlab_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_connection.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudbuildv2_connection` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     name,
diff --git a/4.x/_gen/resources/cloudbuildv2_repository.libsonnet b/4.x/_gen/resources/cloudbuildv2_repository.libsonnet
index 90d5d533..3566218e 100644
--- a/4.x/_gen/resources/cloudbuildv2_repository.libsonnet
+++ b/4.x/_gen/resources/cloudbuildv2_repository.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='cloudbuildv2_repository', url='', help='`cloudbuildv2_repository` represents the `google_cloudbuildv2_repository` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.cloudbuildv2_repository.new` injects a new `google_cloudbuildv2_repository` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloudbuildv2_repository.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloudbuildv2_repository` using the reference:\n\n    $._ref.google_cloudbuildv2_repository.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloudbuildv2_repository.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Allows clients to store small amounts of arbitrary data. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the repository.\n  - `parent_connection` (`string`): The connection for the resource\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `remote_uri` (`string`): Required. Git Clone HTTPS URI.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_repository.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.cloudbuildv2_repository.new` injects a new `google_cloudbuildv2_repository` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloudbuildv2_repository.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloudbuildv2_repository` using the reference:\n\n    $._ref.google_cloudbuildv2_repository.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloudbuildv2_repository.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Allows clients to store small amounts of arbitrary data.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the repository.\n  - `parent_connection` (`string`): The connection for the resource\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `remote_uri` (`string`): Required. Git Clone HTTPS URI.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_repository.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -27,7 +27,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.cloudbuildv2_repository.newAttrs` constructs a new object with attributes and blocks configured for the `cloudbuildv2_repository`\nTerraform resource.\n\nUnlike [google.cloudbuildv2_repository.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Allows clients to store small amounts of arbitrary data. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the repository.\n  - `parent_connection` (`string`): The connection for the resource\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `remote_uri` (`string`): Required. Git Clone HTTPS URI.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_repository.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudbuildv2_repository` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.cloudbuildv2_repository.newAttrs` constructs a new object with attributes and blocks configured for the `cloudbuildv2_repository`\nTerraform resource.\n\nUnlike [google.cloudbuildv2_repository.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Allows clients to store small amounts of arbitrary data.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the repository.\n  - `parent_connection` (`string`): The connection for the resource\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `remote_uri` (`string`): Required. Git Clone HTTPS URI.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudbuildv2_repository.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudbuildv2_repository` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     parent_connection,
diff --git a/4.x/_gen/resources/clouddeploy_delivery_pipeline.libsonnet b/4.x/_gen/resources/clouddeploy_delivery_pipeline.libsonnet
index 6715aa85..d2776b9a 100644
--- a/4.x/_gen/resources/clouddeploy_delivery_pipeline.libsonnet
+++ b/4.x/_gen/resources/clouddeploy_delivery_pipeline.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='clouddeploy_delivery_pipeline', url='', help='`clouddeploy_delivery_pipeline` represents the `google_clouddeploy_delivery_pipeline` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.clouddeploy_delivery_pipeline.new` injects a new `google_clouddeploy_delivery_pipeline` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.clouddeploy_delivery_pipeline.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.clouddeploy_delivery_pipeline` using the reference:\n\n    $._ref.google_clouddeploy_delivery_pipeline.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_clouddeploy_delivery_pipeline.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): User annotations. These attributes can only be set and used by the user, and not by Google Cloud Deploy. See https://google.aip.dev/128#annotations for more details such as format and size limitations. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `description` (`string`): Description of the `DeliveryPipeline`. Max length is 255 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels are attributes that can be set and used by both the user and by Google Cloud Deploy. Labels must meet the following constraints: * Keys and values can contain only lowercase letters, numeric characters, underscores, and dashes. * All characters must use UTF-8 encoding, and international characters are allowed. * Keys must start with a lowercase letter or international character. * Each resource is limited to a maximum of 64 labels. Both keys and values are additionally constrained to be \u0026lt;= 128 bytes. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Name of the `DeliveryPipeline`. Format is [a-z][a-z0-9\\-]{0,62}.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `suspended` (`bool`): When suspended, no new releases or rollouts can be created, but in-progress ones will complete. When `null`, the `suspended` field will be omitted from the resulting object.\n  - `serial_pipeline` (`list[obj]`): SerialPipeline defines a sequential set of stages for a `DeliveryPipeline`. When `null`, the `serial_pipeline` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_delivery_pipeline.serial_pipeline.new](#fn-serial_pipelinenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_delivery_pipeline.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.clouddeploy_delivery_pipeline.new` injects a new `google_clouddeploy_delivery_pipeline` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.clouddeploy_delivery_pipeline.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.clouddeploy_delivery_pipeline` using the reference:\n\n    $._ref.google_clouddeploy_delivery_pipeline.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_clouddeploy_delivery_pipeline.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): User annotations. These attributes can only be set and used by the user, and not by Google Cloud Deploy. See https://google.aip.dev/128#annotations for more details such as format and size limitations.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `description` (`string`): Description of the `DeliveryPipeline`. Max length is 255 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels are attributes that can be set and used by both the user and by Google Cloud Deploy. Labels must meet the following constraints: * Keys and values can contain only lowercase letters, numeric characters, underscores, and dashes. * All characters must use UTF-8 encoding, and international characters are allowed. * Keys must start with a lowercase letter or international character. * Each resource is limited to a maximum of 64 labels. Both keys and values are additionally constrained to be \u0026lt;= 128 bytes.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Name of the `DeliveryPipeline`. Format is [a-z][a-z0-9\\-]{0,62}.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `suspended` (`bool`): When suspended, no new releases or rollouts can be created, but in-progress ones will complete. When `null`, the `suspended` field will be omitted from the resulting object.\n  - `serial_pipeline` (`list[obj]`): SerialPipeline defines a sequential set of stages for a `DeliveryPipeline`. When `null`, the `serial_pipeline` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_delivery_pipeline.serial_pipeline.new](#fn-serial_pipelinenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_delivery_pipeline.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -31,7 +31,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.clouddeploy_delivery_pipeline.newAttrs` constructs a new object with attributes and blocks configured for the `clouddeploy_delivery_pipeline`\nTerraform resource.\n\nUnlike [google.clouddeploy_delivery_pipeline.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): User annotations. These attributes can only be set and used by the user, and not by Google Cloud Deploy. See https://google.aip.dev/128#annotations for more details such as format and size limitations. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `description` (`string`): Description of the `DeliveryPipeline`. Max length is 255 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels are attributes that can be set and used by both the user and by Google Cloud Deploy. Labels must meet the following constraints: * Keys and values can contain only lowercase letters, numeric characters, underscores, and dashes. * All characters must use UTF-8 encoding, and international characters are allowed. * Keys must start with a lowercase letter or international character. * Each resource is limited to a maximum of 64 labels. Both keys and values are additionally constrained to be <= 128 bytes. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Name of the `DeliveryPipeline`. Format is [a-z][a-z0-9\\-]{0,62}.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `suspended` (`bool`): When suspended, no new releases or rollouts can be created, but in-progress ones will complete. When `null`, the `suspended` field will be omitted from the resulting object.\n  - `serial_pipeline` (`list[obj]`): SerialPipeline defines a sequential set of stages for a `DeliveryPipeline`. When `null`, the `serial_pipeline` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_delivery_pipeline.serial_pipeline.new](#fn-serial_pipelinenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_delivery_pipeline.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `clouddeploy_delivery_pipeline` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.clouddeploy_delivery_pipeline.newAttrs` constructs a new object with attributes and blocks configured for the `clouddeploy_delivery_pipeline`\nTerraform resource.\n\nUnlike [google.clouddeploy_delivery_pipeline.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): User annotations. These attributes can only be set and used by the user, and not by Google Cloud Deploy. See https://google.aip.dev/128#annotations for more details such as format and size limitations.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `description` (`string`): Description of the `DeliveryPipeline`. Max length is 255 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels are attributes that can be set and used by both the user and by Google Cloud Deploy. Labels must meet the following constraints: * Keys and values can contain only lowercase letters, numeric characters, underscores, and dashes. * All characters must use UTF-8 encoding, and international characters are allowed. * Keys must start with a lowercase letter or international character. * Each resource is limited to a maximum of 64 labels. Both keys and values are additionally constrained to be <= 128 bytes.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Name of the `DeliveryPipeline`. Format is [a-z][a-z0-9\\-]{0,62}.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `suspended` (`bool`): When suspended, no new releases or rollouts can be created, but in-progress ones will complete. When `null`, the `suspended` field will be omitted from the resulting object.\n  - `serial_pipeline` (`list[obj]`): SerialPipeline defines a sequential set of stages for a `DeliveryPipeline`. When `null`, the `serial_pipeline` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_delivery_pipeline.serial_pipeline.new](#fn-serial_pipelinenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_delivery_pipeline.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `clouddeploy_delivery_pipeline` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     name,
diff --git a/4.x/_gen/resources/clouddeploy_target.libsonnet b/4.x/_gen/resources/clouddeploy_target.libsonnet
index 3d9364ce..a64a9c9d 100644
--- a/4.x/_gen/resources/clouddeploy_target.libsonnet
+++ b/4.x/_gen/resources/clouddeploy_target.libsonnet
@@ -44,7 +44,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       target_ids: target_ids,
     }),
   },
-  '#new':: d.fn(help="\n`google.clouddeploy_target.new` injects a new `google_clouddeploy_target` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.clouddeploy_target.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.clouddeploy_target` using the reference:\n\n    $._ref.google_clouddeploy_target.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_clouddeploy_target.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Optional. User annotations. These attributes can only be set and used by the user, and not by Google Cloud Deploy. See https://google.aip.dev/128#annotations for more details such as format and size limitations. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `deploy_parameters` (`obj`): Optional. The deploy parameters to use for this target. When `null`, the `deploy_parameters` field will be omitted from the resulting object.\n  - `description` (`string`): Optional. Description of the `Target`. Max length is 255 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. Labels are attributes that can be set and used by both the user and by Google Cloud Deploy. Labels must meet the following constraints: * Keys and values can contain only lowercase letters, numeric characters, underscores, and dashes. * All characters must use UTF-8 encoding, and international characters are allowed. * Keys must start with a lowercase letter or international character. * Each resource is limited to a maximum of 64 labels. Both keys and values are additionally constrained to be \u0026lt;= 128 bytes. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Name of the `Target`. Format is [a-z][a-z0-9\\-]{0,62}.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `require_approval` (`bool`): Optional. Whether or not the `Target` requires approval. When `null`, the `require_approval` field will be omitted from the resulting object.\n  - `anthos_cluster` (`list[obj]`): Information specifying an Anthos Cluster. When `null`, the `anthos_cluster` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.anthos_cluster.new](#fn-anthos_clusternew) constructor.\n  - `execution_configs` (`list[obj]`): Configurations for all execution that relates to this `Target`. Each `ExecutionEnvironmentUsage` value may only be used in a single configuration; using the same value multiple times is an error. When one or more configurations are specified, they must include the `RENDER` and `DEPLOY` `ExecutionEnvironmentUsage` values. When no configurations are specified, execution will use the default specified in `DefaultPool`. When `null`, the `execution_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.execution_configs.new](#fn-execution_configsnew) constructor.\n  - `gke` (`list[obj]`): Information specifying a GKE Cluster. When `null`, the `gke` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.gke.new](#fn-gkenew) constructor.\n  - `multi_target` (`list[obj]`): Information specifying a multiTarget. When `null`, the `multi_target` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.multi_target.new](#fn-multi_targetnew) constructor.\n  - `run` (`list[obj]`): Information specifying a Cloud Run deployment target. When `null`, the `run` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.run.new](#fn-runnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.clouddeploy_target.new` injects a new `google_clouddeploy_target` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.clouddeploy_target.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.clouddeploy_target` using the reference:\n\n    $._ref.google_clouddeploy_target.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_clouddeploy_target.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Optional. User annotations. These attributes can only be set and used by the user, and not by Google Cloud Deploy. See https://google.aip.dev/128#annotations for more details such as format and size limitations.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `deploy_parameters` (`obj`): Optional. The deploy parameters to use for this target. When `null`, the `deploy_parameters` field will be omitted from the resulting object.\n  - `description` (`string`): Optional. Description of the `Target`. Max length is 255 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. Labels are attributes that can be set and used by both the user and by Google Cloud Deploy. Labels must meet the following constraints: * Keys and values can contain only lowercase letters, numeric characters, underscores, and dashes. * All characters must use UTF-8 encoding, and international characters are allowed. * Keys must start with a lowercase letter or international character. * Each resource is limited to a maximum of 64 labels. Both keys and values are additionally constrained to be \u0026lt;= 128 bytes.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Name of the `Target`. Format is [a-z][a-z0-9\\-]{0,62}.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `require_approval` (`bool`): Optional. Whether or not the `Target` requires approval. When `null`, the `require_approval` field will be omitted from the resulting object.\n  - `anthos_cluster` (`list[obj]`): Information specifying an Anthos Cluster. When `null`, the `anthos_cluster` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.anthos_cluster.new](#fn-anthos_clusternew) constructor.\n  - `execution_configs` (`list[obj]`): Configurations for all execution that relates to this `Target`. Each `ExecutionEnvironmentUsage` value may only be used in a single configuration; using the same value multiple times is an error. When one or more configurations are specified, they must include the `RENDER` and `DEPLOY` `ExecutionEnvironmentUsage` values. When no configurations are specified, execution will use the default specified in `DefaultPool`. When `null`, the `execution_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.execution_configs.new](#fn-execution_configsnew) constructor.\n  - `gke` (`list[obj]`): Information specifying a GKE Cluster. When `null`, the `gke` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.gke.new](#fn-gkenew) constructor.\n  - `multi_target` (`list[obj]`): Information specifying a multiTarget. When `null`, the `multi_target` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.multi_target.new](#fn-multi_targetnew) constructor.\n  - `run` (`list[obj]`): Information specifying a Cloud Run deployment target. When `null`, the `run` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.run.new](#fn-runnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -83,7 +83,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.clouddeploy_target.newAttrs` constructs a new object with attributes and blocks configured for the `clouddeploy_target`\nTerraform resource.\n\nUnlike [google.clouddeploy_target.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Optional. User annotations. These attributes can only be set and used by the user, and not by Google Cloud Deploy. See https://google.aip.dev/128#annotations for more details such as format and size limitations. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `deploy_parameters` (`obj`): Optional. The deploy parameters to use for this target. When `null`, the `deploy_parameters` field will be omitted from the resulting object.\n  - `description` (`string`): Optional. Description of the `Target`. Max length is 255 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. Labels are attributes that can be set and used by both the user and by Google Cloud Deploy. Labels must meet the following constraints: * Keys and values can contain only lowercase letters, numeric characters, underscores, and dashes. * All characters must use UTF-8 encoding, and international characters are allowed. * Keys must start with a lowercase letter or international character. * Each resource is limited to a maximum of 64 labels. Both keys and values are additionally constrained to be <= 128 bytes. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Name of the `Target`. Format is [a-z][a-z0-9\\-]{0,62}.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `require_approval` (`bool`): Optional. Whether or not the `Target` requires approval. When `null`, the `require_approval` field will be omitted from the resulting object.\n  - `anthos_cluster` (`list[obj]`): Information specifying an Anthos Cluster. When `null`, the `anthos_cluster` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.anthos_cluster.new](#fn-anthos_clusternew) constructor.\n  - `execution_configs` (`list[obj]`): Configurations for all execution that relates to this `Target`. Each `ExecutionEnvironmentUsage` value may only be used in a single configuration; using the same value multiple times is an error. When one or more configurations are specified, they must include the `RENDER` and `DEPLOY` `ExecutionEnvironmentUsage` values. When no configurations are specified, execution will use the default specified in `DefaultPool`. When `null`, the `execution_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.execution_configs.new](#fn-execution_configsnew) constructor.\n  - `gke` (`list[obj]`): Information specifying a GKE Cluster. When `null`, the `gke` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.gke.new](#fn-gkenew) constructor.\n  - `multi_target` (`list[obj]`): Information specifying a multiTarget. When `null`, the `multi_target` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.multi_target.new](#fn-multi_targetnew) constructor.\n  - `run` (`list[obj]`): Information specifying a Cloud Run deployment target. When `null`, the `run` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.run.new](#fn-runnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `clouddeploy_target` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.clouddeploy_target.newAttrs` constructs a new object with attributes and blocks configured for the `clouddeploy_target`\nTerraform resource.\n\nUnlike [google.clouddeploy_target.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Optional. User annotations. These attributes can only be set and used by the user, and not by Google Cloud Deploy. See https://google.aip.dev/128#annotations for more details such as format and size limitations.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `deploy_parameters` (`obj`): Optional. The deploy parameters to use for this target. When `null`, the `deploy_parameters` field will be omitted from the resulting object.\n  - `description` (`string`): Optional. Description of the `Target`. Max length is 255 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. Labels are attributes that can be set and used by both the user and by Google Cloud Deploy. Labels must meet the following constraints: * Keys and values can contain only lowercase letters, numeric characters, underscores, and dashes. * All characters must use UTF-8 encoding, and international characters are allowed. * Keys must start with a lowercase letter or international character. * Each resource is limited to a maximum of 64 labels. Both keys and values are additionally constrained to be <= 128 bytes.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Name of the `Target`. Format is [a-z][a-z0-9\\-]{0,62}.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `require_approval` (`bool`): Optional. Whether or not the `Target` requires approval. When `null`, the `require_approval` field will be omitted from the resulting object.\n  - `anthos_cluster` (`list[obj]`): Information specifying an Anthos Cluster. When `null`, the `anthos_cluster` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.anthos_cluster.new](#fn-anthos_clusternew) constructor.\n  - `execution_configs` (`list[obj]`): Configurations for all execution that relates to this `Target`. Each `ExecutionEnvironmentUsage` value may only be used in a single configuration; using the same value multiple times is an error. When one or more configurations are specified, they must include the `RENDER` and `DEPLOY` `ExecutionEnvironmentUsage` values. When no configurations are specified, execution will use the default specified in `DefaultPool`. When `null`, the `execution_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.execution_configs.new](#fn-execution_configsnew) constructor.\n  - `gke` (`list[obj]`): Information specifying a GKE Cluster. When `null`, the `gke` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.gke.new](#fn-gkenew) constructor.\n  - `multi_target` (`list[obj]`): Information specifying a multiTarget. When `null`, the `multi_target` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.multi_target.new](#fn-multi_targetnew) constructor.\n  - `run` (`list[obj]`): Information specifying a Cloud Run deployment target. When `null`, the `run` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.run.new](#fn-runnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.clouddeploy_target.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `clouddeploy_target` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     name,
diff --git a/4.x/_gen/resources/cloudfunctions2_function.libsonnet b/4.x/_gen/resources/cloudfunctions2_function.libsonnet
index 51eb75f4..e050c77d 100644
--- a/4.x/_gen/resources/cloudfunctions2_function.libsonnet
+++ b/4.x/_gen/resources/cloudfunctions2_function.libsonnet
@@ -92,16 +92,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       trigger_region: trigger_region,
     }),
   },
-  '#new':: d.fn(help="\n`google.cloudfunctions2_function.new` injects a new `google_cloudfunctions2_function` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloudfunctions2_function.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloudfunctions2_function` using the reference:\n\n    $._ref.google_cloudfunctions2_function.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloudfunctions2_function.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): User-provided description of a function. When `null`, the `description` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources.\nIt must match the pattern projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs associated with this Cloud Function. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of this cloud function. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the function. Function names must\nbe unique globally and match pattern \u0026#39;projects/*/locations/*/functions/*\u0026#39;.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `build_config` (`list[obj]`): Describes the Build step of the function that builds a container\nfrom the given source. When `null`, the `build_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions2_function.build_config.new](#fn-build_confignew) constructor.\n  - `event_trigger` (`list[obj]`): An Eventarc trigger managed by Google Cloud Functions that fires events in\nresponse to a condition in another service. When `null`, the `event_trigger` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions2_function.event_trigger.new](#fn-event_triggernew) constructor.\n  - `service_config` (`list[obj]`): Describes the Service being deployed. When `null`, the `service_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions2_function.service_config.new](#fn-service_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions2_function.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.cloudfunctions2_function.new` injects a new `google_cloudfunctions2_function` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloudfunctions2_function.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloudfunctions2_function` using the reference:\n\n    $._ref.google_cloudfunctions2_function.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloudfunctions2_function.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): User-provided description of a function. When `null`, the `description` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources.\nIt must match the pattern projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs associated with this Cloud Function.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of this cloud function.\n  - `name` (`string`): A user-defined name of the function. Function names must\nbe unique globally and match pattern \u0026#39;projects/*/locations/*/functions/*\u0026#39;.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `build_config` (`list[obj]`): Describes the Build step of the function that builds a container\nfrom the given source. When `null`, the `build_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions2_function.build_config.new](#fn-build_confignew) constructor.\n  - `event_trigger` (`list[obj]`): An Eventarc trigger managed by Google Cloud Functions that fires events in\nresponse to a condition in another service. When `null`, the `event_trigger` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions2_function.event_trigger.new](#fn-event_triggernew) constructor.\n  - `service_config` (`list[obj]`): Describes the Service being deployed. When `null`, the `service_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions2_function.service_config.new](#fn-service_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions2_function.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
+    location,
     name,
     build_config=null,
     description=null,
     event_trigger=null,
     kms_key_name=null,
     labels=null,
-    location=null,
     project=null,
     service_config=null,
     timeouts=null,
@@ -123,15 +123,15 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.cloudfunctions2_function.newAttrs` constructs a new object with attributes and blocks configured for the `cloudfunctions2_function`\nTerraform resource.\n\nUnlike [google.cloudfunctions2_function.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): User-provided description of a function. When `null`, the `description` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources.\nIt must match the pattern projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs associated with this Cloud Function. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of this cloud function. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the function. Function names must\nbe unique globally and match pattern 'projects/*/locations/*/functions/*'.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `build_config` (`list[obj]`): Describes the Build step of the function that builds a container\nfrom the given source. When `null`, the `build_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions2_function.build_config.new](#fn-build_confignew) constructor.\n  - `event_trigger` (`list[obj]`): An Eventarc trigger managed by Google Cloud Functions that fires events in\nresponse to a condition in another service. When `null`, the `event_trigger` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions2_function.event_trigger.new](#fn-event_triggernew) constructor.\n  - `service_config` (`list[obj]`): Describes the Service being deployed. When `null`, the `service_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions2_function.service_config.new](#fn-service_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions2_function.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudfunctions2_function` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.cloudfunctions2_function.newAttrs` constructs a new object with attributes and blocks configured for the `cloudfunctions2_function`\nTerraform resource.\n\nUnlike [google.cloudfunctions2_function.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): User-provided description of a function. When `null`, the `description` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources.\nIt must match the pattern projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs associated with this Cloud Function.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of this cloud function.\n  - `name` (`string`): A user-defined name of the function. Function names must\nbe unique globally and match pattern 'projects/*/locations/*/functions/*'.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `build_config` (`list[obj]`): Describes the Build step of the function that builds a container\nfrom the given source. When `null`, the `build_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions2_function.build_config.new](#fn-build_confignew) constructor.\n  - `event_trigger` (`list[obj]`): An Eventarc trigger managed by Google Cloud Functions that fires events in\nresponse to a condition in another service. When `null`, the `event_trigger` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions2_function.event_trigger.new](#fn-event_triggernew) constructor.\n  - `service_config` (`list[obj]`): Describes the Service being deployed. When `null`, the `service_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions2_function.service_config.new](#fn-service_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions2_function.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudfunctions2_function` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
+    location,
     name,
     build_config=null,
     description=null,
     event_trigger=null,
     kms_key_name=null,
     labels=null,
-    location=null,
     project=null,
     service_config=null,
     timeouts=null
diff --git a/4.x/_gen/resources/cloudfunctions_function.libsonnet b/4.x/_gen/resources/cloudfunctions_function.libsonnet
index 7bfe2f3b..91aa9e29 100644
--- a/4.x/_gen/resources/cloudfunctions_function.libsonnet
+++ b/4.x/_gen/resources/cloudfunctions_function.libsonnet
@@ -22,7 +22,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       resource: resource,
     }),
   },
-  '#new':: d.fn(help="\n`google.cloudfunctions_function.new` injects a new `google_cloudfunctions_function` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloudfunctions_function.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloudfunctions_function` using the reference:\n\n    $._ref.google_cloudfunctions_function.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloudfunctions_function.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `available_memory_mb` (`number`): Memory (in MB), available to the function. Default value is 256. Possible values include 128, 256, 512, 1024, etc. When `null`, the `available_memory_mb` field will be omitted from the resulting object.\n  - `build_environment_variables` (`obj`):  A set of key/value environment variable pairs available during build time. When `null`, the `build_environment_variables` field will be omitted from the resulting object.\n  - `build_worker_pool` (`string`): Name of the Cloud Build Custom Worker Pool that should be used to build the function. When `null`, the `build_worker_pool` field will be omitted from the resulting object.\n  - `description` (`string`): Description of the function. When `null`, the `description` field will be omitted from the resulting object.\n  - `docker_registry` (`string`): Docker Registry to use for storing the function\u0026#39;s Docker images. Allowed values are CONTAINER_REGISTRY (default) and ARTIFACT_REGISTRY. When `null`, the `docker_registry` field will be omitted from the resulting object.\n  - `docker_repository` (`string`): User managed repository created in Artifact Registry optionally with a customer managed encryption key. If specified, deployments will use Artifact Registry for storing images built with Cloud Build. When `null`, the `docker_repository` field will be omitted from the resulting object.\n  - `entry_point` (`string`): Name of the function that will be executed when the Google Cloud Function is triggered. When `null`, the `entry_point` field will be omitted from the resulting object.\n  - `environment_variables` (`obj`): A set of key/value environment variable pairs to assign to the function. When `null`, the `environment_variables` field will be omitted from the resulting object.\n  - `https_trigger_security_level` (`string`): The security level for the function. Defaults to SECURE_OPTIONAL. Valid only if trigger_http is used. When `null`, the `https_trigger_security_level` field will be omitted from the resulting object.\n  - `https_trigger_url` (`string`): URL which triggers function execution. Returned only if trigger_http is used. When `null`, the `https_trigger_url` field will be omitted from the resulting object.\n  - `ingress_settings` (`string`): String value that controls what traffic can reach the function. Allowed values are ALLOW_ALL and ALLOW_INTERNAL_ONLY. Changes to this field will recreate the cloud function. When `null`, the `ingress_settings` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to the function. Label keys must follow the requirements at https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements. When `null`, the `labels` field will be omitted from the resulting object.\n  - `max_instances` (`number`): The limit on the maximum number of function instances that may coexist at a given time. When `null`, the `max_instances` field will be omitted from the resulting object.\n  - `min_instances` (`number`): The limit on the minimum number of function instances that may coexist at a given time. When `null`, the `min_instances` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the function. Function names must be unique globally.\n  - `project` (`string`): Project of the function. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Region of function. If it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `runtime` (`string`): The runtime in which the function is going to run. Eg. \u0026#34;nodejs12\u0026#34;, \u0026#34;nodejs14\u0026#34;, \u0026#34;python37\u0026#34;, \u0026#34;go111\u0026#34;.\n  - `service_account_email` (`string`):  If provided, the self-provided service account to run the function with. When `null`, the `service_account_email` field will be omitted from the resulting object.\n  - `source_archive_bucket` (`string`): The GCS bucket containing the zip archive which contains the function. When `null`, the `source_archive_bucket` field will be omitted from the resulting object.\n  - `source_archive_object` (`string`): The source archive object (file) in archive bucket. When `null`, the `source_archive_object` field will be omitted from the resulting object.\n  - `timeout` (`number`): Timeout (in seconds) for the function. Default value is 60 seconds. Cannot be more than 540 seconds. When `null`, the `timeout` field will be omitted from the resulting object.\n  - `trigger_http` (`bool`): Boolean variable. Any HTTP request (of a supported type) to the endpoint will trigger function execution. Supported HTTP request types are: POST, PUT, GET, DELETE, and OPTIONS. Endpoint is returned as https_trigger_url. Cannot be used with trigger_bucket and trigger_topic. When `null`, the `trigger_http` field will be omitted from the resulting object.\n  - `vpc_connector` (`string`): The VPC Network Connector that this cloud function can connect to. It can be either the fully-qualified URI, or the short name of the network connector resource. The format of this field is projects/*/locations/*/connectors/*. When `null`, the `vpc_connector` field will be omitted from the resulting object.\n  - `vpc_connector_egress_settings` (`string`): The egress settings for the connector, controlling what traffic is diverted through it. Allowed values are ALL_TRAFFIC and PRIVATE_RANGES_ONLY. Defaults to PRIVATE_RANGES_ONLY. If unset, this field preserves the previously set value. When `null`, the `vpc_connector_egress_settings` field will be omitted from the resulting object.\n  - `event_trigger` (`list[obj]`): A source that fires events in response to a condition in another service. Cannot be used with trigger_http. When `null`, the `event_trigger` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.event_trigger.new](#fn-event_triggernew) constructor.\n  - `secret_environment_variables` (`list[obj]`): Secret environment variables configuration When `null`, the `secret_environment_variables` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.secret_environment_variables.new](#fn-secret_environment_variablesnew) constructor.\n  - `secret_volumes` (`list[obj]`): Secret volumes configuration. When `null`, the `secret_volumes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.secret_volumes.new](#fn-secret_volumesnew) constructor.\n  - `source_repository` (`list[obj]`): Represents parameters related to source repository where a function is hosted. Cannot be set alongside source_archive_bucket or source_archive_object. When `null`, the `source_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.source_repository.new](#fn-source_repositorynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.cloudfunctions_function.new` injects a new `google_cloudfunctions_function` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloudfunctions_function.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloudfunctions_function` using the reference:\n\n    $._ref.google_cloudfunctions_function.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloudfunctions_function.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `available_memory_mb` (`number`): Memory (in MB), available to the function. Default value is 256. Possible values include 128, 256, 512, 1024, etc. When `null`, the `available_memory_mb` field will be omitted from the resulting object.\n  - `build_environment_variables` (`obj`):  A set of key/value environment variable pairs available during build time. When `null`, the `build_environment_variables` field will be omitted from the resulting object.\n  - `build_worker_pool` (`string`): Name of the Cloud Build Custom Worker Pool that should be used to build the function. When `null`, the `build_worker_pool` field will be omitted from the resulting object.\n  - `description` (`string`): Description of the function. When `null`, the `description` field will be omitted from the resulting object.\n  - `docker_registry` (`string`): Docker Registry to use for storing the function\u0026#39;s Docker images. Allowed values are CONTAINER_REGISTRY (default) and ARTIFACT_REGISTRY. When `null`, the `docker_registry` field will be omitted from the resulting object.\n  - `docker_repository` (`string`): User managed repository created in Artifact Registry optionally with a customer managed encryption key. If specified, deployments will use Artifact Registry for storing images built with Cloud Build. When `null`, the `docker_repository` field will be omitted from the resulting object.\n  - `entry_point` (`string`): Name of the function that will be executed when the Google Cloud Function is triggered. When `null`, the `entry_point` field will be omitted from the resulting object.\n  - `environment_variables` (`obj`): A set of key/value environment variable pairs to assign to the function. When `null`, the `environment_variables` field will be omitted from the resulting object.\n  - `https_trigger_security_level` (`string`): The security level for the function. Defaults to SECURE_OPTIONAL. Valid only if trigger_http is used. When `null`, the `https_trigger_security_level` field will be omitted from the resulting object.\n  - `https_trigger_url` (`string`): URL which triggers function execution. Returned only if trigger_http is used. When `null`, the `https_trigger_url` field will be omitted from the resulting object.\n  - `ingress_settings` (`string`): String value that controls what traffic can reach the function. Allowed values are ALLOW_ALL and ALLOW_INTERNAL_ONLY. Changes to this field will recreate the cloud function. When `null`, the `ingress_settings` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to the function. Label keys must follow the requirements at https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements.\n\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `max_instances` (`number`): The limit on the maximum number of function instances that may coexist at a given time. When `null`, the `max_instances` field will be omitted from the resulting object.\n  - `min_instances` (`number`): The limit on the minimum number of function instances that may coexist at a given time. When `null`, the `min_instances` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the function. Function names must be unique globally.\n  - `project` (`string`): Project of the function. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Region of function. If it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `runtime` (`string`): The runtime in which the function is going to run. Eg. \u0026#34;nodejs12\u0026#34;, \u0026#34;nodejs14\u0026#34;, \u0026#34;python37\u0026#34;, \u0026#34;go111\u0026#34;.\n  - `service_account_email` (`string`):  If provided, the self-provided service account to run the function with. When `null`, the `service_account_email` field will be omitted from the resulting object.\n  - `source_archive_bucket` (`string`): The GCS bucket containing the zip archive which contains the function. When `null`, the `source_archive_bucket` field will be omitted from the resulting object.\n  - `source_archive_object` (`string`): The source archive object (file) in archive bucket. When `null`, the `source_archive_object` field will be omitted from the resulting object.\n  - `timeout` (`number`): Timeout (in seconds) for the function. Default value is 60 seconds. Cannot be more than 540 seconds. When `null`, the `timeout` field will be omitted from the resulting object.\n  - `trigger_http` (`bool`): Boolean variable. Any HTTP request (of a supported type) to the endpoint will trigger function execution. Supported HTTP request types are: POST, PUT, GET, DELETE, and OPTIONS. Endpoint is returned as https_trigger_url. Cannot be used with trigger_bucket and trigger_topic. When `null`, the `trigger_http` field will be omitted from the resulting object.\n  - `vpc_connector` (`string`): The VPC Network Connector that this cloud function can connect to. It can be either the fully-qualified URI, or the short name of the network connector resource. The format of this field is projects/*/locations/*/connectors/*. When `null`, the `vpc_connector` field will be omitted from the resulting object.\n  - `vpc_connector_egress_settings` (`string`): The egress settings for the connector, controlling what traffic is diverted through it. Allowed values are ALL_TRAFFIC and PRIVATE_RANGES_ONLY. Defaults to PRIVATE_RANGES_ONLY. If unset, this field preserves the previously set value. When `null`, the `vpc_connector_egress_settings` field will be omitted from the resulting object.\n  - `event_trigger` (`list[obj]`): A source that fires events in response to a condition in another service. Cannot be used with trigger_http. When `null`, the `event_trigger` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.event_trigger.new](#fn-event_triggernew) constructor.\n  - `secret_environment_variables` (`list[obj]`): Secret environment variables configuration When `null`, the `secret_environment_variables` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.secret_environment_variables.new](#fn-secret_environment_variablesnew) constructor.\n  - `secret_volumes` (`list[obj]`): Secret volumes configuration. When `null`, the `secret_volumes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.secret_volumes.new](#fn-secret_volumesnew) constructor.\n  - `source_repository` (`list[obj]`): Represents parameters related to source repository where a function is hosted. Cannot be set alongside source_archive_bucket or source_archive_object. When `null`, the `source_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.source_repository.new](#fn-source_repositorynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -95,7 +95,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.cloudfunctions_function.newAttrs` constructs a new object with attributes and blocks configured for the `cloudfunctions_function`\nTerraform resource.\n\nUnlike [google.cloudfunctions_function.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `available_memory_mb` (`number`): Memory (in MB), available to the function. Default value is 256. Possible values include 128, 256, 512, 1024, etc. When `null`, the `available_memory_mb` field will be omitted from the resulting object.\n  - `build_environment_variables` (`obj`):  A set of key/value environment variable pairs available during build time. When `null`, the `build_environment_variables` field will be omitted from the resulting object.\n  - `build_worker_pool` (`string`): Name of the Cloud Build Custom Worker Pool that should be used to build the function. When `null`, the `build_worker_pool` field will be omitted from the resulting object.\n  - `description` (`string`): Description of the function. When `null`, the `description` field will be omitted from the resulting object.\n  - `docker_registry` (`string`): Docker Registry to use for storing the function's Docker images. Allowed values are CONTAINER_REGISTRY (default) and ARTIFACT_REGISTRY. When `null`, the `docker_registry` field will be omitted from the resulting object.\n  - `docker_repository` (`string`): User managed repository created in Artifact Registry optionally with a customer managed encryption key. If specified, deployments will use Artifact Registry for storing images built with Cloud Build. When `null`, the `docker_repository` field will be omitted from the resulting object.\n  - `entry_point` (`string`): Name of the function that will be executed when the Google Cloud Function is triggered. When `null`, the `entry_point` field will be omitted from the resulting object.\n  - `environment_variables` (`obj`): A set of key/value environment variable pairs to assign to the function. When `null`, the `environment_variables` field will be omitted from the resulting object.\n  - `https_trigger_security_level` (`string`): The security level for the function. Defaults to SECURE_OPTIONAL. Valid only if trigger_http is used. When `null`, the `https_trigger_security_level` field will be omitted from the resulting object.\n  - `https_trigger_url` (`string`): URL which triggers function execution. Returned only if trigger_http is used. When `null`, the `https_trigger_url` field will be omitted from the resulting object.\n  - `ingress_settings` (`string`): String value that controls what traffic can reach the function. Allowed values are ALLOW_ALL and ALLOW_INTERNAL_ONLY. Changes to this field will recreate the cloud function. When `null`, the `ingress_settings` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to the function. Label keys must follow the requirements at https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements. When `null`, the `labels` field will be omitted from the resulting object.\n  - `max_instances` (`number`): The limit on the maximum number of function instances that may coexist at a given time. When `null`, the `max_instances` field will be omitted from the resulting object.\n  - `min_instances` (`number`): The limit on the minimum number of function instances that may coexist at a given time. When `null`, the `min_instances` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the function. Function names must be unique globally.\n  - `project` (`string`): Project of the function. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Region of function. If it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `runtime` (`string`): The runtime in which the function is going to run. Eg. "nodejs12", "nodejs14", "python37", "go111".\n  - `service_account_email` (`string`):  If provided, the self-provided service account to run the function with. When `null`, the `service_account_email` field will be omitted from the resulting object.\n  - `source_archive_bucket` (`string`): The GCS bucket containing the zip archive which contains the function. When `null`, the `source_archive_bucket` field will be omitted from the resulting object.\n  - `source_archive_object` (`string`): The source archive object (file) in archive bucket. When `null`, the `source_archive_object` field will be omitted from the resulting object.\n  - `timeout` (`number`): Timeout (in seconds) for the function. Default value is 60 seconds. Cannot be more than 540 seconds. When `null`, the `timeout` field will be omitted from the resulting object.\n  - `trigger_http` (`bool`): Boolean variable. Any HTTP request (of a supported type) to the endpoint will trigger function execution. Supported HTTP request types are: POST, PUT, GET, DELETE, and OPTIONS. Endpoint is returned as https_trigger_url. Cannot be used with trigger_bucket and trigger_topic. When `null`, the `trigger_http` field will be omitted from the resulting object.\n  - `vpc_connector` (`string`): The VPC Network Connector that this cloud function can connect to. It can be either the fully-qualified URI, or the short name of the network connector resource. The format of this field is projects/*/locations/*/connectors/*. When `null`, the `vpc_connector` field will be omitted from the resulting object.\n  - `vpc_connector_egress_settings` (`string`): The egress settings for the connector, controlling what traffic is diverted through it. Allowed values are ALL_TRAFFIC and PRIVATE_RANGES_ONLY. Defaults to PRIVATE_RANGES_ONLY. If unset, this field preserves the previously set value. When `null`, the `vpc_connector_egress_settings` field will be omitted from the resulting object.\n  - `event_trigger` (`list[obj]`): A source that fires events in response to a condition in another service. Cannot be used with trigger_http. When `null`, the `event_trigger` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.event_trigger.new](#fn-event_triggernew) constructor.\n  - `secret_environment_variables` (`list[obj]`): Secret environment variables configuration When `null`, the `secret_environment_variables` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.secret_environment_variables.new](#fn-secret_environment_variablesnew) constructor.\n  - `secret_volumes` (`list[obj]`): Secret volumes configuration. When `null`, the `secret_volumes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.secret_volumes.new](#fn-secret_volumesnew) constructor.\n  - `source_repository` (`list[obj]`): Represents parameters related to source repository where a function is hosted. Cannot be set alongside source_archive_bucket or source_archive_object. When `null`, the `source_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.source_repository.new](#fn-source_repositorynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudfunctions_function` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.cloudfunctions_function.newAttrs` constructs a new object with attributes and blocks configured for the `cloudfunctions_function`\nTerraform resource.\n\nUnlike [google.cloudfunctions_function.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `available_memory_mb` (`number`): Memory (in MB), available to the function. Default value is 256. Possible values include 128, 256, 512, 1024, etc. When `null`, the `available_memory_mb` field will be omitted from the resulting object.\n  - `build_environment_variables` (`obj`):  A set of key/value environment variable pairs available during build time. When `null`, the `build_environment_variables` field will be omitted from the resulting object.\n  - `build_worker_pool` (`string`): Name of the Cloud Build Custom Worker Pool that should be used to build the function. When `null`, the `build_worker_pool` field will be omitted from the resulting object.\n  - `description` (`string`): Description of the function. When `null`, the `description` field will be omitted from the resulting object.\n  - `docker_registry` (`string`): Docker Registry to use for storing the function's Docker images. Allowed values are CONTAINER_REGISTRY (default) and ARTIFACT_REGISTRY. When `null`, the `docker_registry` field will be omitted from the resulting object.\n  - `docker_repository` (`string`): User managed repository created in Artifact Registry optionally with a customer managed encryption key. If specified, deployments will use Artifact Registry for storing images built with Cloud Build. When `null`, the `docker_repository` field will be omitted from the resulting object.\n  - `entry_point` (`string`): Name of the function that will be executed when the Google Cloud Function is triggered. When `null`, the `entry_point` field will be omitted from the resulting object.\n  - `environment_variables` (`obj`): A set of key/value environment variable pairs to assign to the function. When `null`, the `environment_variables` field will be omitted from the resulting object.\n  - `https_trigger_security_level` (`string`): The security level for the function. Defaults to SECURE_OPTIONAL. Valid only if trigger_http is used. When `null`, the `https_trigger_security_level` field will be omitted from the resulting object.\n  - `https_trigger_url` (`string`): URL which triggers function execution. Returned only if trigger_http is used. When `null`, the `https_trigger_url` field will be omitted from the resulting object.\n  - `ingress_settings` (`string`): String value that controls what traffic can reach the function. Allowed values are ALLOW_ALL and ALLOW_INTERNAL_ONLY. Changes to this field will recreate the cloud function. When `null`, the `ingress_settings` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to the function. Label keys must follow the requirements at https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements.\n\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `max_instances` (`number`): The limit on the maximum number of function instances that may coexist at a given time. When `null`, the `max_instances` field will be omitted from the resulting object.\n  - `min_instances` (`number`): The limit on the minimum number of function instances that may coexist at a given time. When `null`, the `min_instances` field will be omitted from the resulting object.\n  - `name` (`string`): A user-defined name of the function. Function names must be unique globally.\n  - `project` (`string`): Project of the function. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Region of function. If it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `runtime` (`string`): The runtime in which the function is going to run. Eg. "nodejs12", "nodejs14", "python37", "go111".\n  - `service_account_email` (`string`):  If provided, the self-provided service account to run the function with. When `null`, the `service_account_email` field will be omitted from the resulting object.\n  - `source_archive_bucket` (`string`): The GCS bucket containing the zip archive which contains the function. When `null`, the `source_archive_bucket` field will be omitted from the resulting object.\n  - `source_archive_object` (`string`): The source archive object (file) in archive bucket. When `null`, the `source_archive_object` field will be omitted from the resulting object.\n  - `timeout` (`number`): Timeout (in seconds) for the function. Default value is 60 seconds. Cannot be more than 540 seconds. When `null`, the `timeout` field will be omitted from the resulting object.\n  - `trigger_http` (`bool`): Boolean variable. Any HTTP request (of a supported type) to the endpoint will trigger function execution. Supported HTTP request types are: POST, PUT, GET, DELETE, and OPTIONS. Endpoint is returned as https_trigger_url. Cannot be used with trigger_bucket and trigger_topic. When `null`, the `trigger_http` field will be omitted from the resulting object.\n  - `vpc_connector` (`string`): The VPC Network Connector that this cloud function can connect to. It can be either the fully-qualified URI, or the short name of the network connector resource. The format of this field is projects/*/locations/*/connectors/*. When `null`, the `vpc_connector` field will be omitted from the resulting object.\n  - `vpc_connector_egress_settings` (`string`): The egress settings for the connector, controlling what traffic is diverted through it. Allowed values are ALL_TRAFFIC and PRIVATE_RANGES_ONLY. Defaults to PRIVATE_RANGES_ONLY. If unset, this field preserves the previously set value. When `null`, the `vpc_connector_egress_settings` field will be omitted from the resulting object.\n  - `event_trigger` (`list[obj]`): A source that fires events in response to a condition in another service. Cannot be used with trigger_http. When `null`, the `event_trigger` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.event_trigger.new](#fn-event_triggernew) constructor.\n  - `secret_environment_variables` (`list[obj]`): Secret environment variables configuration When `null`, the `secret_environment_variables` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.secret_environment_variables.new](#fn-secret_environment_variablesnew) constructor.\n  - `secret_volumes` (`list[obj]`): Secret volumes configuration. When `null`, the `secret_volumes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.secret_volumes.new](#fn-secret_volumesnew) constructor.\n  - `source_repository` (`list[obj]`): Represents parameters related to source repository where a function is hosted. Cannot be set alongside source_archive_bucket or source_archive_object. When `null`, the `source_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.source_repository.new](#fn-source_repositorynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudfunctions_function.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudfunctions_function` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     runtime,
diff --git a/4.x/_gen/resources/cloudiot_device.libsonnet b/4.x/_gen/resources/cloudiot_device.libsonnet
deleted file mode 100644
index dbd34ca3..00000000
--- a/4.x/_gen/resources/cloudiot_device.libsonnet
+++ /dev/null
@@ -1,204 +0,0 @@
-local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
-local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
-{
-  '#':: d.pkg(name='cloudiot_device', url='', help='`cloudiot_device` represents the `google_cloudiot_device` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  credentials:: {
-    '#new':: d.fn(help='\n`google.cloudiot_device.credentials.new` constructs a new object with attributes and blocks configured for the `credentials`\nTerraform sub block.\n\n\n\n**Args**:\n  - `expiration_time` (`string`): The time at which this credential becomes invalid. When `null`, the `expiration_time` field will be omitted from the resulting object.\n  - `public_key` (`list[obj]`): A public key used to verify the signature of JSON Web Tokens (JWTs). When `null`, the `public_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_device.credentials.public_key.new](#fn-credentialspublic_keynew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `credentials` sub block.\n', args=[]),
-    new(
-      expiration_time=null,
-      public_key=null
-    ):: std.prune(a={
-      expiration_time: expiration_time,
-      public_key: public_key,
-    }),
-    public_key:: {
-      '#new':: d.fn(help='\n`google.cloudiot_device.credentials.public_key.new` constructs a new object with attributes and blocks configured for the `public_key`\nTerraform sub block.\n\n\n\n**Args**:\n  - `format` (`string`): The format of the key. Possible values: ["RSA_PEM", "RSA_X509_PEM", "ES256_PEM", "ES256_X509_PEM"]\n  - `key` (`string`): The key data.\n\n**Returns**:\n  - An attribute object that represents the `public_key` sub block.\n', args=[]),
-      new(
-        format,
-        key
-      ):: std.prune(a={
-        format: format,
-        key: key,
-      }),
-    },
-  },
-  gateway_config:: {
-    '#new':: d.fn(help='\n`google.cloudiot_device.gateway_config.new` constructs a new object with attributes and blocks configured for the `gateway_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `gateway_auth_method` (`string`): Indicates whether the device is a gateway. Possible values: ["ASSOCIATION_ONLY", "DEVICE_AUTH_TOKEN_ONLY", "ASSOCIATION_AND_DEVICE_AUTH_TOKEN"] When `null`, the `gateway_auth_method` field will be omitted from the resulting object.\n  - `gateway_type` (`string`): Indicates whether the device is a gateway. Default value: "NON_GATEWAY" Possible values: ["GATEWAY", "NON_GATEWAY"] When `null`, the `gateway_type` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `gateway_config` sub block.\n', args=[]),
-    new(
-      gateway_auth_method=null,
-      gateway_type=null
-    ):: std.prune(a={
-      gateway_auth_method: gateway_auth_method,
-      gateway_type: gateway_type,
-    }),
-  },
-  '#new':: d.fn(help="\n`google.cloudiot_device.new` injects a new `google_cloudiot_device` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloudiot_device.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloudiot_device` using the reference:\n\n    $._ref.google_cloudiot_device.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloudiot_device.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `blocked` (`bool`): If a device is blocked, connections or requests from this device will fail. When `null`, the `blocked` field will be omitted from the resulting object.\n  - `log_level` (`string`): The logging verbosity for device activity. Possible values: [\u0026#34;NONE\u0026#34;, \u0026#34;ERROR\u0026#34;, \u0026#34;INFO\u0026#34;, \u0026#34;DEBUG\u0026#34;] When `null`, the `log_level` field will be omitted from the resulting object.\n  - `metadata` (`obj`): The metadata key-value pairs assigned to the device. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `name` (`string`): A unique name for the resource.\n  - `registry` (`string`): The name of the device registry where this device should be created.\n  - `credentials` (`list[obj]`): The credentials used to authenticate this device. When `null`, the `credentials` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_device.credentials.new](#fn-credentialsnew) constructor.\n  - `gateway_config` (`list[obj]`): Gateway-related configuration and state. When `null`, the `gateway_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_device.gateway_config.new](#fn-gateway_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_device.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
-  new(
-    resourceLabel,
-    name,
-    registry,
-    blocked=null,
-    credentials=null,
-    gateway_config=null,
-    log_level=null,
-    metadata=null,
-    timeouts=null,
-    _meta={}
-  ):: tf.withResource(
-    type='google_cloudiot_device',
-    label=resourceLabel,
-    attrs=self.newAttrs(
-      blocked=blocked,
-      credentials=credentials,
-      gateway_config=gateway_config,
-      log_level=log_level,
-      metadata=metadata,
-      name=name,
-      registry=registry,
-      timeouts=timeouts
-    ),
-    _meta=_meta
-  ),
-  '#newAttrs':: d.fn(help='\n`google.cloudiot_device.newAttrs` constructs a new object with attributes and blocks configured for the `cloudiot_device`\nTerraform resource.\n\nUnlike [google.cloudiot_device.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `blocked` (`bool`): If a device is blocked, connections or requests from this device will fail. When `null`, the `blocked` field will be omitted from the resulting object.\n  - `log_level` (`string`): The logging verbosity for device activity. Possible values: ["NONE", "ERROR", "INFO", "DEBUG"] When `null`, the `log_level` field will be omitted from the resulting object.\n  - `metadata` (`obj`): The metadata key-value pairs assigned to the device. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `name` (`string`): A unique name for the resource.\n  - `registry` (`string`): The name of the device registry where this device should be created.\n  - `credentials` (`list[obj]`): The credentials used to authenticate this device. When `null`, the `credentials` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_device.credentials.new](#fn-credentialsnew) constructor.\n  - `gateway_config` (`list[obj]`): Gateway-related configuration and state. When `null`, the `gateway_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_device.gateway_config.new](#fn-gateway_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_device.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudiot_device` resource into the root Terraform configuration.\n', args=[]),
-  newAttrs(
-    name,
-    registry,
-    blocked=null,
-    credentials=null,
-    gateway_config=null,
-    log_level=null,
-    metadata=null,
-    timeouts=null
-  ):: std.prune(a={
-    blocked: blocked,
-    credentials: credentials,
-    gateway_config: gateway_config,
-    log_level: log_level,
-    metadata: metadata,
-    name: name,
-    registry: registry,
-    timeouts: timeouts,
-  }),
-  timeouts:: {
-    '#new':: d.fn(help='\n`google.cloudiot_device.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
-    new(
-      create=null,
-      delete=null,
-      update=null
-    ):: std.prune(a={
-      create: create,
-      delete: delete,
-      update: update,
-    }),
-  },
-  '#withBlocked':: d.fn(help='`google.bool.withBlocked` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the blocked field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `blocked` field.\n', args=[]),
-  withBlocked(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_device+: {
-        [resourceLabel]+: {
-          blocked: value,
-        },
-      },
-    },
-  },
-  '#withCredentials':: d.fn(help='`google.list[obj].withCredentials` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the credentials field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withCredentialsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `credentials` field.\n', args=[]),
-  withCredentials(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_device+: {
-        [resourceLabel]+: {
-          credentials: value,
-        },
-      },
-    },
-  },
-  '#withCredentialsMixin':: d.fn(help='`google.list[obj].withCredentialsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the credentials field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withCredentials](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `credentials` field.\n', args=[]),
-  withCredentialsMixin(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_device+: {
-        [resourceLabel]+: {
-          credentials+: if std.isArray(v=value) then value else [value],
-        },
-      },
-    },
-  },
-  '#withGatewayConfig':: d.fn(help='`google.list[obj].withGatewayConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the gateway_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withGatewayConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `gateway_config` field.\n', args=[]),
-  withGatewayConfig(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_device+: {
-        [resourceLabel]+: {
-          gateway_config: value,
-        },
-      },
-    },
-  },
-  '#withGatewayConfigMixin':: d.fn(help='`google.list[obj].withGatewayConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the gateway_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withGatewayConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `gateway_config` field.\n', args=[]),
-  withGatewayConfigMixin(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_device+: {
-        [resourceLabel]+: {
-          gateway_config+: if std.isArray(v=value) then value else [value],
-        },
-      },
-    },
-  },
-  '#withLogLevel':: d.fn(help='`google.string.withLogLevel` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the log_level field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `log_level` field.\n', args=[]),
-  withLogLevel(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_device+: {
-        [resourceLabel]+: {
-          log_level: value,
-        },
-      },
-    },
-  },
-  '#withMetadata':: d.fn(help='`google.obj.withMetadata` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the metadata field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `metadata` field.\n', args=[]),
-  withMetadata(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_device+: {
-        [resourceLabel]+: {
-          metadata: value,
-        },
-      },
-    },
-  },
-  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
-  withName(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_device+: {
-        [resourceLabel]+: {
-          name: value,
-        },
-      },
-    },
-  },
-  '#withRegistry':: d.fn(help='`google.string.withRegistry` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the registry field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `registry` field.\n', args=[]),
-  withRegistry(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_device+: {
-        [resourceLabel]+: {
-          registry: value,
-        },
-      },
-    },
-  },
-  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
-  withTimeouts(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_device+: {
-        [resourceLabel]+: {
-          timeouts: value,
-        },
-      },
-    },
-  },
-  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
-  withTimeoutsMixin(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_device+: {
-        [resourceLabel]+: {
-          timeouts+: value,
-        },
-      },
-    },
-  },
-}
diff --git a/4.x/_gen/resources/cloudiot_registry.libsonnet b/4.x/_gen/resources/cloudiot_registry.libsonnet
deleted file mode 100644
index 07348148..00000000
--- a/4.x/_gen/resources/cloudiot_registry.libsonnet
+++ /dev/null
@@ -1,220 +0,0 @@
-local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
-local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
-{
-  '#':: d.pkg(name='cloudiot_registry', url='', help='`cloudiot_registry` represents the `google_cloudiot_registry` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  credentials:: {
-    '#new':: d.fn(help='\n`google.cloudiot_registry.credentials.new` constructs a new object with attributes and blocks configured for the `credentials`\nTerraform sub block.\n\n\n\n**Args**:\n  - `public_key_certificate` (`obj`): A public key certificate format and data.\n\n**Returns**:\n  - An attribute object that represents the `credentials` sub block.\n', args=[]),
-    new(
-      public_key_certificate
-    ):: std.prune(a={
-      public_key_certificate: public_key_certificate,
-    }),
-  },
-  event_notification_configs:: {
-    '#new':: d.fn(help='\n`google.cloudiot_registry.event_notification_configs.new` constructs a new object with attributes and blocks configured for the `event_notification_configs`\nTerraform sub block.\n\n\n\n**Args**:\n  - `pubsub_topic_name` (`string`): PubSub topic name to publish device events.\n  - `subfolder_matches` (`string`): If the subfolder name matches this string exactly, this\nconfiguration will be used. The string must not include the\nleading '/' character. If empty, all strings are matched. Empty\nvalue can only be used for the last 'event_notification_configs'\nitem. When `null`, the `subfolder_matches` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `event_notification_configs` sub block.\n', args=[]),
-    new(
-      pubsub_topic_name,
-      subfolder_matches=null
-    ):: std.prune(a={
-      pubsub_topic_name: pubsub_topic_name,
-      subfolder_matches: subfolder_matches,
-    }),
-  },
-  '#new':: d.fn(help="\n`google.cloudiot_registry.new` injects a new `google_cloudiot_registry` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloudiot_registry.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloudiot_registry` using the reference:\n\n    $._ref.google_cloudiot_registry.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloudiot_registry.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `http_config` (`obj`): Activate or deactivate HTTP. When `null`, the `http_config` field will be omitted from the resulting object.\n  - `log_level` (`string`): The default logging verbosity for activity from devices in this\nregistry. Specifies which events should be written to logs. For\nexample, if the LogLevel is ERROR, only events that terminate in\nerrors will be logged. LogLevel is inclusive; enabling INFO logging\nwill also enable ERROR logging. Default value: \u0026#34;NONE\u0026#34; Possible values: [\u0026#34;NONE\u0026#34;, \u0026#34;ERROR\u0026#34;, \u0026#34;INFO\u0026#34;, \u0026#34;DEBUG\u0026#34;] When `null`, the `log_level` field will be omitted from the resulting object.\n  - `mqtt_config` (`obj`): Activate or deactivate MQTT. When `null`, the `mqtt_config` field will be omitted from the resulting object.\n  - `name` (`string`): A unique name for the resource, required by device registry.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region in which the created registry should reside.\nIf it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `state_notification_config` (`obj`): A PubSub topic to publish device state updates. When `null`, the `state_notification_config` field will be omitted from the resulting object.\n  - `credentials` (`list[obj]`): List of public key certificates to authenticate devices. When `null`, the `credentials` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry.credentials.new](#fn-credentialsnew) constructor.\n  - `event_notification_configs` (`list[obj]`): List of configurations for event notifications, such as PubSub topics\nto publish device events to. When `null`, the `event_notification_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry.event_notification_configs.new](#fn-event_notification_configsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
-  new(
-    resourceLabel,
-    name,
-    credentials=null,
-    event_notification_configs=null,
-    http_config=null,
-    log_level=null,
-    mqtt_config=null,
-    project=null,
-    region=null,
-    state_notification_config=null,
-    timeouts=null,
-    _meta={}
-  ):: tf.withResource(
-    type='google_cloudiot_registry',
-    label=resourceLabel,
-    attrs=self.newAttrs(
-      credentials=credentials,
-      event_notification_configs=event_notification_configs,
-      http_config=http_config,
-      log_level=log_level,
-      mqtt_config=mqtt_config,
-      name=name,
-      project=project,
-      region=region,
-      state_notification_config=state_notification_config,
-      timeouts=timeouts
-    ),
-    _meta=_meta
-  ),
-  '#newAttrs':: d.fn(help='\n`google.cloudiot_registry.newAttrs` constructs a new object with attributes and blocks configured for the `cloudiot_registry`\nTerraform resource.\n\nUnlike [google.cloudiot_registry.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `http_config` (`obj`): Activate or deactivate HTTP. When `null`, the `http_config` field will be omitted from the resulting object.\n  - `log_level` (`string`): The default logging verbosity for activity from devices in this\nregistry. Specifies which events should be written to logs. For\nexample, if the LogLevel is ERROR, only events that terminate in\nerrors will be logged. LogLevel is inclusive; enabling INFO logging\nwill also enable ERROR logging. Default value: "NONE" Possible values: ["NONE", "ERROR", "INFO", "DEBUG"] When `null`, the `log_level` field will be omitted from the resulting object.\n  - `mqtt_config` (`obj`): Activate or deactivate MQTT. When `null`, the `mqtt_config` field will be omitted from the resulting object.\n  - `name` (`string`): A unique name for the resource, required by device registry.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region in which the created registry should reside.\nIf it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `state_notification_config` (`obj`): A PubSub topic to publish device state updates. When `null`, the `state_notification_config` field will be omitted from the resulting object.\n  - `credentials` (`list[obj]`): List of public key certificates to authenticate devices. When `null`, the `credentials` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry.credentials.new](#fn-credentialsnew) constructor.\n  - `event_notification_configs` (`list[obj]`): List of configurations for event notifications, such as PubSub topics\nto publish device events to. When `null`, the `event_notification_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry.event_notification_configs.new](#fn-event_notification_configsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudiot_registry` resource into the root Terraform configuration.\n', args=[]),
-  newAttrs(
-    name,
-    credentials=null,
-    event_notification_configs=null,
-    http_config=null,
-    log_level=null,
-    mqtt_config=null,
-    project=null,
-    region=null,
-    state_notification_config=null,
-    timeouts=null
-  ):: std.prune(a={
-    credentials: credentials,
-    event_notification_configs: event_notification_configs,
-    http_config: http_config,
-    log_level: log_level,
-    mqtt_config: mqtt_config,
-    name: name,
-    project: project,
-    region: region,
-    state_notification_config: state_notification_config,
-    timeouts: timeouts,
-  }),
-  timeouts:: {
-    '#new':: d.fn(help='\n`google.cloudiot_registry.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
-    new(
-      create=null,
-      delete=null,
-      update=null
-    ):: std.prune(a={
-      create: create,
-      delete: delete,
-      update: update,
-    }),
-  },
-  '#withCredentials':: d.fn(help='`google.list[obj].withCredentials` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the credentials field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withCredentialsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `credentials` field.\n', args=[]),
-  withCredentials(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry+: {
-        [resourceLabel]+: {
-          credentials: value,
-        },
-      },
-    },
-  },
-  '#withCredentialsMixin':: d.fn(help='`google.list[obj].withCredentialsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the credentials field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withCredentials](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `credentials` field.\n', args=[]),
-  withCredentialsMixin(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry+: {
-        [resourceLabel]+: {
-          credentials+: if std.isArray(v=value) then value else [value],
-        },
-      },
-    },
-  },
-  '#withEventNotificationConfigs':: d.fn(help='`google.list[obj].withEventNotificationConfigs` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the event_notification_configs field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withEventNotificationConfigsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `event_notification_configs` field.\n', args=[]),
-  withEventNotificationConfigs(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry+: {
-        [resourceLabel]+: {
-          event_notification_configs: value,
-        },
-      },
-    },
-  },
-  '#withEventNotificationConfigsMixin':: d.fn(help='`google.list[obj].withEventNotificationConfigsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the event_notification_configs field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withEventNotificationConfigs](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `event_notification_configs` field.\n', args=[]),
-  withEventNotificationConfigsMixin(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry+: {
-        [resourceLabel]+: {
-          event_notification_configs+: if std.isArray(v=value) then value else [value],
-        },
-      },
-    },
-  },
-  '#withHttpConfig':: d.fn(help='`google.obj.withHttpConfig` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the http_config field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `http_config` field.\n', args=[]),
-  withHttpConfig(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry+: {
-        [resourceLabel]+: {
-          http_config: value,
-        },
-      },
-    },
-  },
-  '#withLogLevel':: d.fn(help='`google.string.withLogLevel` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the log_level field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `log_level` field.\n', args=[]),
-  withLogLevel(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry+: {
-        [resourceLabel]+: {
-          log_level: value,
-        },
-      },
-    },
-  },
-  '#withMqttConfig':: d.fn(help='`google.obj.withMqttConfig` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the mqtt_config field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `mqtt_config` field.\n', args=[]),
-  withMqttConfig(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry+: {
-        [resourceLabel]+: {
-          mqtt_config: value,
-        },
-      },
-    },
-  },
-  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
-  withName(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry+: {
-        [resourceLabel]+: {
-          name: value,
-        },
-      },
-    },
-  },
-  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
-  withProject(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry+: {
-        [resourceLabel]+: {
-          project: value,
-        },
-      },
-    },
-  },
-  '#withRegion':: d.fn(help='`google.string.withRegion` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the region field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `region` field.\n', args=[]),
-  withRegion(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry+: {
-        [resourceLabel]+: {
-          region: value,
-        },
-      },
-    },
-  },
-  '#withStateNotificationConfig':: d.fn(help='`google.obj.withStateNotificationConfig` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the state_notification_config field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `state_notification_config` field.\n', args=[]),
-  withStateNotificationConfig(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry+: {
-        [resourceLabel]+: {
-          state_notification_config: value,
-        },
-      },
-    },
-  },
-  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
-  withTimeouts(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry+: {
-        [resourceLabel]+: {
-          timeouts: value,
-        },
-      },
-    },
-  },
-  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
-  withTimeoutsMixin(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry+: {
-        [resourceLabel]+: {
-          timeouts+: value,
-        },
-      },
-    },
-  },
-}
diff --git a/4.x/_gen/resources/cloudiot_registry_iam_binding.libsonnet b/4.x/_gen/resources/cloudiot_registry_iam_binding.libsonnet
deleted file mode 100644
index af626f2d..00000000
--- a/4.x/_gen/resources/cloudiot_registry_iam_binding.libsonnet
+++ /dev/null
@@ -1,126 +0,0 @@
-local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
-local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
-{
-  '#':: d.pkg(name='cloudiot_registry_iam_binding', url='', help='`cloudiot_registry_iam_binding` represents the `google_cloudiot_registry_iam_binding` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  condition:: {
-    '#new':: d.fn(help='\n`google.cloudiot_registry_iam_binding.condition.new` constructs a new object with attributes and blocks configured for the `condition`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Set the `description` field on the resulting object. When `null`, the `description` field will be omitted from the resulting object.\n  - `expression` (`string`): Set the `expression` field on the resulting object.\n  - `title` (`string`): Set the `title` field on the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `condition` sub block.\n', args=[]),
-    new(
-      expression,
-      title,
-      description=null
-    ):: std.prune(a={
-      description: description,
-      expression: expression,
-      title: title,
-    }),
-  },
-  '#new':: d.fn(help="\n`google.cloudiot_registry_iam_binding.new` injects a new `google_cloudiot_registry_iam_binding` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloudiot_registry_iam_binding.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloudiot_registry_iam_binding` using the reference:\n\n    $._ref.google_cloudiot_registry_iam_binding.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloudiot_registry_iam_binding.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `members` (`list`): Set the `members` field on the resulting resource block.\n  - `name` (`string`): Set the `name` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Set the `region` field on the resulting resource block. When `null`, the `region` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting resource block.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry_iam_binding.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
-  new(
-    resourceLabel,
-    members,
-    name,
-    role,
-    condition=null,
-    project=null,
-    region=null,
-    _meta={}
-  ):: tf.withResource(
-    type='google_cloudiot_registry_iam_binding',
-    label=resourceLabel,
-    attrs=self.newAttrs(
-      condition=condition,
-      members=members,
-      name=name,
-      project=project,
-      region=region,
-      role=role
-    ),
-    _meta=_meta
-  ),
-  '#newAttrs':: d.fn(help='\n`google.cloudiot_registry_iam_binding.newAttrs` constructs a new object with attributes and blocks configured for the `cloudiot_registry_iam_binding`\nTerraform resource.\n\nUnlike [google.cloudiot_registry_iam_binding.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `members` (`list`): Set the `members` field on the resulting object.\n  - `name` (`string`): Set the `name` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Set the `region` field on the resulting object. When `null`, the `region` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting object.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry_iam_binding.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudiot_registry_iam_binding` resource into the root Terraform configuration.\n', args=[]),
-  newAttrs(
-    members,
-    name,
-    role,
-    condition=null,
-    project=null,
-    region=null
-  ):: std.prune(a={
-    condition: condition,
-    members: members,
-    name: name,
-    project: project,
-    region: region,
-    role: role,
-  }),
-  '#withCondition':: d.fn(help='`google.list[obj].withCondition` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the condition field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withConditionMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `condition` field.\n', args=[]),
-  withCondition(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry_iam_binding+: {
-        [resourceLabel]+: {
-          condition: value,
-        },
-      },
-    },
-  },
-  '#withConditionMixin':: d.fn(help='`google.list[obj].withConditionMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the condition field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withCondition](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `condition` field.\n', args=[]),
-  withConditionMixin(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry_iam_binding+: {
-        [resourceLabel]+: {
-          condition+: if std.isArray(v=value) then value else [value],
-        },
-      },
-    },
-  },
-  '#withMembers':: d.fn(help='`google.list.withMembers` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the members field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `members` field.\n', args=[]),
-  withMembers(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry_iam_binding+: {
-        [resourceLabel]+: {
-          members: value,
-        },
-      },
-    },
-  },
-  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
-  withName(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry_iam_binding+: {
-        [resourceLabel]+: {
-          name: value,
-        },
-      },
-    },
-  },
-  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
-  withProject(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry_iam_binding+: {
-        [resourceLabel]+: {
-          project: value,
-        },
-      },
-    },
-  },
-  '#withRegion':: d.fn(help='`google.string.withRegion` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the region field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `region` field.\n', args=[]),
-  withRegion(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry_iam_binding+: {
-        [resourceLabel]+: {
-          region: value,
-        },
-      },
-    },
-  },
-  '#withRole':: d.fn(help='`google.string.withRole` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the role field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `role` field.\n', args=[]),
-  withRole(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry_iam_binding+: {
-        [resourceLabel]+: {
-          role: value,
-        },
-      },
-    },
-  },
-}
diff --git a/4.x/_gen/resources/cloudiot_registry_iam_member.libsonnet b/4.x/_gen/resources/cloudiot_registry_iam_member.libsonnet
deleted file mode 100644
index 18b302ec..00000000
--- a/4.x/_gen/resources/cloudiot_registry_iam_member.libsonnet
+++ /dev/null
@@ -1,126 +0,0 @@
-local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
-local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
-{
-  '#':: d.pkg(name='cloudiot_registry_iam_member', url='', help='`cloudiot_registry_iam_member` represents the `google_cloudiot_registry_iam_member` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  condition:: {
-    '#new':: d.fn(help='\n`google.cloudiot_registry_iam_member.condition.new` constructs a new object with attributes and blocks configured for the `condition`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Set the `description` field on the resulting object. When `null`, the `description` field will be omitted from the resulting object.\n  - `expression` (`string`): Set the `expression` field on the resulting object.\n  - `title` (`string`): Set the `title` field on the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `condition` sub block.\n', args=[]),
-    new(
-      expression,
-      title,
-      description=null
-    ):: std.prune(a={
-      description: description,
-      expression: expression,
-      title: title,
-    }),
-  },
-  '#new':: d.fn(help="\n`google.cloudiot_registry_iam_member.new` injects a new `google_cloudiot_registry_iam_member` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloudiot_registry_iam_member.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloudiot_registry_iam_member` using the reference:\n\n    $._ref.google_cloudiot_registry_iam_member.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloudiot_registry_iam_member.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `member` (`string`): Set the `member` field on the resulting resource block.\n  - `name` (`string`): Set the `name` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Set the `region` field on the resulting resource block. When `null`, the `region` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting resource block.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry_iam_member.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
-  new(
-    resourceLabel,
-    member,
-    name,
-    role,
-    condition=null,
-    project=null,
-    region=null,
-    _meta={}
-  ):: tf.withResource(
-    type='google_cloudiot_registry_iam_member',
-    label=resourceLabel,
-    attrs=self.newAttrs(
-      condition=condition,
-      member=member,
-      name=name,
-      project=project,
-      region=region,
-      role=role
-    ),
-    _meta=_meta
-  ),
-  '#newAttrs':: d.fn(help='\n`google.cloudiot_registry_iam_member.newAttrs` constructs a new object with attributes and blocks configured for the `cloudiot_registry_iam_member`\nTerraform resource.\n\nUnlike [google.cloudiot_registry_iam_member.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `member` (`string`): Set the `member` field on the resulting object.\n  - `name` (`string`): Set the `name` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Set the `region` field on the resulting object. When `null`, the `region` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting object.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry_iam_member.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudiot_registry_iam_member` resource into the root Terraform configuration.\n', args=[]),
-  newAttrs(
-    member,
-    name,
-    role,
-    condition=null,
-    project=null,
-    region=null
-  ):: std.prune(a={
-    condition: condition,
-    member: member,
-    name: name,
-    project: project,
-    region: region,
-    role: role,
-  }),
-  '#withCondition':: d.fn(help='`google.list[obj].withCondition` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the condition field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withConditionMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `condition` field.\n', args=[]),
-  withCondition(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry_iam_member+: {
-        [resourceLabel]+: {
-          condition: value,
-        },
-      },
-    },
-  },
-  '#withConditionMixin':: d.fn(help='`google.list[obj].withConditionMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the condition field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withCondition](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `condition` field.\n', args=[]),
-  withConditionMixin(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry_iam_member+: {
-        [resourceLabel]+: {
-          condition+: if std.isArray(v=value) then value else [value],
-        },
-      },
-    },
-  },
-  '#withMember':: d.fn(help='`google.string.withMember` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the member field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `member` field.\n', args=[]),
-  withMember(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry_iam_member+: {
-        [resourceLabel]+: {
-          member: value,
-        },
-      },
-    },
-  },
-  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
-  withName(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry_iam_member+: {
-        [resourceLabel]+: {
-          name: value,
-        },
-      },
-    },
-  },
-  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
-  withProject(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry_iam_member+: {
-        [resourceLabel]+: {
-          project: value,
-        },
-      },
-    },
-  },
-  '#withRegion':: d.fn(help='`google.string.withRegion` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the region field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `region` field.\n', args=[]),
-  withRegion(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry_iam_member+: {
-        [resourceLabel]+: {
-          region: value,
-        },
-      },
-    },
-  },
-  '#withRole':: d.fn(help='`google.string.withRole` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the role field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `role` field.\n', args=[]),
-  withRole(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry_iam_member+: {
-        [resourceLabel]+: {
-          role: value,
-        },
-      },
-    },
-  },
-}
diff --git a/4.x/_gen/resources/cloudiot_registry_iam_policy.libsonnet b/4.x/_gen/resources/cloudiot_registry_iam_policy.libsonnet
deleted file mode 100644
index 6b09ebae..00000000
--- a/4.x/_gen/resources/cloudiot_registry_iam_policy.libsonnet
+++ /dev/null
@@ -1,76 +0,0 @@
-local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
-local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
-{
-  '#':: d.pkg(name='cloudiot_registry_iam_policy', url='', help='`cloudiot_registry_iam_policy` represents the `google_cloudiot_registry_iam_policy` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.cloudiot_registry_iam_policy.new` injects a new `google_cloudiot_registry_iam_policy` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.cloudiot_registry_iam_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.cloudiot_registry_iam_policy` using the reference:\n\n    $._ref.google_cloudiot_registry_iam_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_cloudiot_registry_iam_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `name` (`string`): Set the `name` field on the resulting resource block.\n  - `policy_data` (`string`): Set the `policy_data` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Set the `region` field on the resulting resource block. When `null`, the `region` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
-  new(
-    resourceLabel,
-    name,
-    policy_data,
-    project=null,
-    region=null,
-    _meta={}
-  ):: tf.withResource(
-    type='google_cloudiot_registry_iam_policy',
-    label=resourceLabel,
-    attrs=self.newAttrs(
-      name=name,
-      policy_data=policy_data,
-      project=project,
-      region=region
-    ),
-    _meta=_meta
-  ),
-  '#newAttrs':: d.fn(help='\n`google.cloudiot_registry_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `cloudiot_registry_iam_policy`\nTerraform resource.\n\nUnlike [google.cloudiot_registry_iam_policy.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `name` (`string`): Set the `name` field on the resulting object.\n  - `policy_data` (`string`): Set the `policy_data` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Set the `region` field on the resulting object. When `null`, the `region` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudiot_registry_iam_policy` resource into the root Terraform configuration.\n', args=[]),
-  newAttrs(
-    name,
-    policy_data,
-    project=null,
-    region=null
-  ):: std.prune(a={
-    name: name,
-    policy_data: policy_data,
-    project: project,
-    region: region,
-  }),
-  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
-  withName(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry_iam_policy+: {
-        [resourceLabel]+: {
-          name: value,
-        },
-      },
-    },
-  },
-  '#withPolicyData':: d.fn(help='`google.string.withPolicyData` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the policy_data field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `policy_data` field.\n', args=[]),
-  withPolicyData(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry_iam_policy+: {
-        [resourceLabel]+: {
-          policy_data: value,
-        },
-      },
-    },
-  },
-  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
-  withProject(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry_iam_policy+: {
-        [resourceLabel]+: {
-          project: value,
-        },
-      },
-    },
-  },
-  '#withRegion':: d.fn(help='`google.string.withRegion` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the region field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `region` field.\n', args=[]),
-  withRegion(resourceLabel, value): {
-    resource+: {
-      google_cloudiot_registry_iam_policy+: {
-        [resourceLabel]+: {
-          region: value,
-        },
-      },
-    },
-  },
-}
diff --git a/4.x/_gen/resources/composer_environment.libsonnet b/4.x/_gen/resources/composer_environment.libsonnet
index 3903cd6a..907c43c2 100644
--- a/4.x/_gen/resources/composer_environment.libsonnet
+++ b/4.x/_gen/resources/composer_environment.libsonnet
@@ -198,13 +198,15 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
     workloads_config:: {
-      '#new':: d.fn(help='\n`google.composer_environment.config.workloads_config.new` constructs a new object with attributes and blocks configured for the `workloads_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `scheduler` (`list[obj]`): Configuration for resources used by Airflow schedulers. When `null`, the `scheduler` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.workloads_config.scheduler.new](#fn-configconfigschedulernew) constructor.\n  - `web_server` (`list[obj]`): Configuration for resources used by Airflow web server. When `null`, the `web_server` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.workloads_config.web_server.new](#fn-configconfigweb_servernew) constructor.\n  - `worker` (`list[obj]`): Configuration for resources used by Airflow workers. When `null`, the `worker` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.workloads_config.worker.new](#fn-configconfigworkernew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `workloads_config` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.composer_environment.config.workloads_config.new` constructs a new object with attributes and blocks configured for the `workloads_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `scheduler` (`list[obj]`): Configuration for resources used by Airflow schedulers. When `null`, the `scheduler` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.workloads_config.scheduler.new](#fn-configconfigschedulernew) constructor.\n  - `triggerer` (`list[obj]`): Configuration for resources used by Airflow triggerers. When `null`, the `triggerer` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.workloads_config.triggerer.new](#fn-configconfigtriggerernew) constructor.\n  - `web_server` (`list[obj]`): Configuration for resources used by Airflow web server. When `null`, the `web_server` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.workloads_config.web_server.new](#fn-configconfigweb_servernew) constructor.\n  - `worker` (`list[obj]`): Configuration for resources used by Airflow workers. When `null`, the `worker` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.workloads_config.worker.new](#fn-configconfigworkernew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `workloads_config` sub block.\n', args=[]),
       new(
         scheduler=null,
+        triggerer=null,
         web_server=null,
         worker=null
       ):: std.prune(a={
         scheduler: scheduler,
+        triggerer: triggerer,
         web_server: web_server,
         worker: worker,
       }),
@@ -222,6 +224,18 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
           storage_gb: storage_gb,
         }),
       },
+      triggerer:: {
+        '#new':: d.fn(help='\n`google.composer_environment.config.workloads_config.triggerer.new` constructs a new object with attributes and blocks configured for the `triggerer`\nTerraform sub block.\n\n\n\n**Args**:\n  - `count` (`number`): The number of triggerers.\n  - `cpu` (`number`): CPU request and limit for a single Airflow triggerer replica.\n  - `memory_gb` (`number`): Memory (GB) request and limit for a single Airflow triggerer replica.\n\n**Returns**:\n  - An attribute object that represents the `triggerer` sub block.\n', args=[]),
+        new(
+          count,
+          cpu,
+          memory_gb
+        ):: std.prune(a={
+          count: count,
+          cpu: cpu,
+          memory_gb: memory_gb,
+        }),
+      },
       web_server:: {
         '#new':: d.fn(help='\n`google.composer_environment.config.workloads_config.web_server.new` constructs a new object with attributes and blocks configured for the `web_server`\nTerraform sub block.\n\n\n\n**Args**:\n  - `cpu` (`number`): CPU request and limit for Airflow web server. When `null`, the `cpu` field will be omitted from the resulting object.\n  - `memory_gb` (`number`): Memory (GB) request and limit for Airflow web server. When `null`, the `memory_gb` field will be omitted from the resulting object.\n  - `storage_gb` (`number`): Storage (GB) request and limit for Airflow web server. When `null`, the `storage_gb` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `web_server` sub block.\n', args=[]),
         new(
@@ -252,7 +266,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
-  '#new':: d.fn(help="\n`google.composer_environment.new` injects a new `google_composer_environment` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.composer_environment.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.composer_environment` using the reference:\n\n    $._ref.google_composer_environment.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_composer_environment.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `labels` (`obj`): User-defined labels for this environment. The labels map can contain no more than 64 entries. Entries of the labels map are UTF8 strings that comply with the following restrictions: Label keys must be between 1 and 63 characters long and must conform to the following regular expression: [a-z]([-a-z0-9]*[a-z0-9])?. Label values must be between 0 and 63 characters long and must conform to the regular expression ([a-z]([-a-z0-9]*[a-z0-9])?)?. No more than 64 labels can be associated with a given environment. Both keys and values must be \u0026lt;= 128 bytes in size. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the environment.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The location or Compute Engine region for the environment. When `null`, the `region` field will be omitted from the resulting object.\n  - `config` (`list[obj]`): Configuration parameters for this environment. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.new](#fn-confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.composer_environment.new` injects a new `google_composer_environment` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.composer_environment.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.composer_environment` using the reference:\n\n    $._ref.google_composer_environment.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_composer_environment.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `labels` (`obj`): User-defined labels for this environment. The labels map can contain no more than 64 entries. Entries of the labels map are UTF8 strings that comply with the following restrictions: Label keys must be between 1 and 63 characters long and must conform to the following regular expression: [a-z]([-a-z0-9]*[a-z0-9])?. Label values must be between 0 and 63 characters long and must conform to the regular expression ([a-z]([-a-z0-9]*[a-z0-9])?)?. No more than 64 labels can be associated with a given environment. Both keys and values must be \u0026lt;= 128 bytes in size.\n\t\t\t\t\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the environment.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The location or Compute Engine region for the environment. When `null`, the `region` field will be omitted from the resulting object.\n  - `config` (`list[obj]`): Configuration parameters for this environment. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.new](#fn-confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -275,7 +289,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.composer_environment.newAttrs` constructs a new object with attributes and blocks configured for the `composer_environment`\nTerraform resource.\n\nUnlike [google.composer_environment.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `labels` (`obj`): User-defined labels for this environment. The labels map can contain no more than 64 entries. Entries of the labels map are UTF8 strings that comply with the following restrictions: Label keys must be between 1 and 63 characters long and must conform to the following regular expression: [a-z]([-a-z0-9]*[a-z0-9])?. Label values must be between 0 and 63 characters long and must conform to the regular expression ([a-z]([-a-z0-9]*[a-z0-9])?)?. No more than 64 labels can be associated with a given environment. Both keys and values must be <= 128 bytes in size. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the environment.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The location or Compute Engine region for the environment. When `null`, the `region` field will be omitted from the resulting object.\n  - `config` (`list[obj]`): Configuration parameters for this environment. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.new](#fn-confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `composer_environment` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.composer_environment.newAttrs` constructs a new object with attributes and blocks configured for the `composer_environment`\nTerraform resource.\n\nUnlike [google.composer_environment.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `labels` (`obj`): User-defined labels for this environment. The labels map can contain no more than 64 entries. Entries of the labels map are UTF8 strings that comply with the following restrictions: Label keys must be between 1 and 63 characters long and must conform to the following regular expression: [a-z]([-a-z0-9]*[a-z0-9])?. Label values must be between 0 and 63 characters long and must conform to the regular expression ([a-z]([-a-z0-9]*[a-z0-9])?)?. No more than 64 labels can be associated with a given environment. Both keys and values must be <= 128 bytes in size.\n\t\t\t\t\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the environment.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The location or Compute Engine region for the environment. When `null`, the `region` field will be omitted from the resulting object.\n  - `config` (`list[obj]`): Configuration parameters for this environment. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.new](#fn-confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `composer_environment` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     config=null,
diff --git a/4.x/_gen/resources/compute_address.libsonnet b/4.x/_gen/resources/compute_address.libsonnet
index c9968423..f6b1be5d 100644
--- a/4.x/_gen/resources/compute_address.libsonnet
+++ b/4.x/_gen/resources/compute_address.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='compute_address', url='', help='`compute_address` represents the `google_compute_address` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.compute_address.new` injects a new `google_compute_address` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_address.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_address` using the reference:\n\n    $._ref.google_compute_address.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_address.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `address` (`string`): The static external IP address represented by this resource.\nThe IP address must be inside the specified subnetwork,\nif any. Set by the API if undefined. When `null`, the `address` field will be omitted from the resulting object.\n  - `address_type` (`string`): The type of address to reserve.\nNote: if you set this argument\u0026#39;s value as \u0026#39;INTERNAL\u0026#39; you need to leave the \u0026#39;network_tier\u0026#39; argument unset in that resource block. Default value: \u0026#34;EXTERNAL\u0026#34; Possible values: [\u0026#34;INTERNAL\u0026#34;, \u0026#34;EXTERNAL\u0026#34;] When `null`, the `address_type` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `ip_version` (`string`): The IP Version that will be used by this address. The default value is \u0026#39;IPV4\u0026#39;. Possible values: [\u0026#34;IPV4\u0026#34;, \u0026#34;IPV6\u0026#34;] When `null`, the `ip_version` field will be omitted from the resulting object.\n  - `ipv6_endpoint_type` (`string`): The endpoint type of this address, which should be VM or NETLB. This is\nused for deciding which type of endpoint this address can be used after\nthe external IPv6 address reservation. Possible values: [\u0026#34;VM\u0026#34;, \u0026#34;NETLB\u0026#34;] When `null`, the `ipv6_endpoint_type` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. The name must be 1-63 characters long, and\ncomply with RFC1035. Specifically, the name must be 1-63 characters\nlong and match the regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39;\nwhich means the first character must be a lowercase letter, and all\nfollowing characters must be a dash, lowercase letter, or digit,\nexcept the last character, which cannot be a dash.\n  - `network` (`string`): The URL of the network in which to reserve the address. This field\ncan only be used with INTERNAL type with the VPC_PEERING and\nIPSEC_INTERCONNECT purposes. When `null`, the `network` field will be omitted from the resulting object.\n  - `network_tier` (`string`): The networking tier used for configuring this address. If this field is not\nspecified, it is assumed to be PREMIUM.\nThis argument should not be used when configuring Internal addresses, because [network tier cannot be set for internal traffic; it\u0026#39;s always Premium](https://cloud.google.com/network-tiers/docs/overview). Possible values: [\u0026#34;PREMIUM\u0026#34;, \u0026#34;STANDARD\u0026#34;] When `null`, the `network_tier` field will be omitted from the resulting object.\n  - `prefix_length` (`number`): The prefix length if the resource represents an IP range. When `null`, the `prefix_length` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `purpose` (`string`): The purpose of this resource, which can be one of the following values.\n\n* GCE_ENDPOINT for addresses that are used by VM instances, alias IP\nranges, load balancers, and similar resources.\n\n* SHARED_LOADBALANCER_VIP for an address that can be used by multiple\ninternal load balancers.\n\n* VPC_PEERING for addresses that are reserved for VPC peer networks.\n\n* IPSEC_INTERCONNECT for addresses created from a private IP range that\nare reserved for a VLAN attachment in an HA VPN over Cloud Interconnect\nconfiguration. These addresses are regional resources.\n\n* PRIVATE_SERVICE_CONNECT for a private network address that is used to\nconfigure Private Service Connect. Only global internal addresses can use\nthis purpose.\n\n\nThis should only be set when using an Internal address. When `null`, the `purpose` field will be omitted from the resulting object.\n  - `region` (`string`): The Region in which the created address should reside.\nIf it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): The URL of the subnetwork in which to reserve the address. If an IP\naddress is specified, it must be within the subnetwork\u0026#39;s IP range.\nThis field can only be used with INTERNAL type with\nGCE_ENDPOINT/DNS_RESOLVER purposes. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_address.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_address.new` injects a new `google_compute_address` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_address.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_address` using the reference:\n\n    $._ref.google_compute_address.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_address.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `address` (`string`): The static external IP address represented by this resource.\nThe IP address must be inside the specified subnetwork,\nif any. Set by the API if undefined. When `null`, the `address` field will be omitted from the resulting object.\n  - `address_type` (`string`): The type of address to reserve.\nNote: if you set this argument\u0026#39;s value as \u0026#39;INTERNAL\u0026#39; you need to leave the \u0026#39;network_tier\u0026#39; argument unset in that resource block. Default value: \u0026#34;EXTERNAL\u0026#34; Possible values: [\u0026#34;INTERNAL\u0026#34;, \u0026#34;EXTERNAL\u0026#34;] When `null`, the `address_type` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `ip_version` (`string`): The IP Version that will be used by this address. The default value is \u0026#39;IPV4\u0026#39;. Possible values: [\u0026#34;IPV4\u0026#34;, \u0026#34;IPV6\u0026#34;] When `null`, the `ip_version` field will be omitted from the resulting object.\n  - `ipv6_endpoint_type` (`string`): The endpoint type of this address, which should be VM or NETLB. This is\nused for deciding which type of endpoint this address can be used after\nthe external IPv6 address reservation. Possible values: [\u0026#34;VM\u0026#34;, \u0026#34;NETLB\u0026#34;] When `null`, the `ipv6_endpoint_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this address.  A list of key-\u0026gt;value pairs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. The name must be 1-63 characters long, and\ncomply with RFC1035. Specifically, the name must be 1-63 characters\nlong and match the regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39;\nwhich means the first character must be a lowercase letter, and all\nfollowing characters must be a dash, lowercase letter, or digit,\nexcept the last character, which cannot be a dash.\n  - `network` (`string`): The URL of the network in which to reserve the address. This field\ncan only be used with INTERNAL type with the VPC_PEERING and\nIPSEC_INTERCONNECT purposes. When `null`, the `network` field will be omitted from the resulting object.\n  - `network_tier` (`string`): The networking tier used for configuring this address. If this field is not\nspecified, it is assumed to be PREMIUM.\nThis argument should not be used when configuring Internal addresses, because [network tier cannot be set for internal traffic; it\u0026#39;s always Premium](https://cloud.google.com/network-tiers/docs/overview). Possible values: [\u0026#34;PREMIUM\u0026#34;, \u0026#34;STANDARD\u0026#34;] When `null`, the `network_tier` field will be omitted from the resulting object.\n  - `prefix_length` (`number`): The prefix length if the resource represents an IP range. When `null`, the `prefix_length` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `purpose` (`string`): The purpose of this resource, which can be one of the following values.\n\n* GCE_ENDPOINT for addresses that are used by VM instances, alias IP\nranges, load balancers, and similar resources.\n\n* SHARED_LOADBALANCER_VIP for an address that can be used by multiple\ninternal load balancers.\n\n* VPC_PEERING for addresses that are reserved for VPC peer networks.\n\n* IPSEC_INTERCONNECT for addresses created from a private IP range that\nare reserved for a VLAN attachment in an HA VPN over Cloud Interconnect\nconfiguration. These addresses are regional resources.\n\n* PRIVATE_SERVICE_CONNECT for a private network address that is used to\nconfigure Private Service Connect. Only global internal addresses can use\nthis purpose.\n\n\nThis should only be set when using an Internal address. When `null`, the `purpose` field will be omitted from the resulting object.\n  - `region` (`string`): The Region in which the created address should reside.\nIf it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): The URL of the subnetwork in which to reserve the address. If an IP\naddress is specified, it must be within the subnetwork\u0026#39;s IP range.\nThis field can only be used with INTERNAL type with\nGCE_ENDPOINT/DNS_RESOLVER purposes. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_address.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -11,6 +11,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     description=null,
     ip_version=null,
     ipv6_endpoint_type=null,
+    labels=null,
     network=null,
     network_tier=null,
     prefix_length=null,
@@ -29,6 +30,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       description=description,
       ip_version=ip_version,
       ipv6_endpoint_type=ipv6_endpoint_type,
+      labels=labels,
       name=name,
       network=network,
       network_tier=network_tier,
@@ -41,7 +43,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_address.newAttrs` constructs a new object with attributes and blocks configured for the `compute_address`\nTerraform resource.\n\nUnlike [google.compute_address.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `address` (`string`): The static external IP address represented by this resource.\nThe IP address must be inside the specified subnetwork,\nif any. Set by the API if undefined. When `null`, the `address` field will be omitted from the resulting object.\n  - `address_type` (`string`): The type of address to reserve.\nNote: if you set this argument's value as 'INTERNAL' you need to leave the 'network_tier' argument unset in that resource block. Default value: "EXTERNAL" Possible values: ["INTERNAL", "EXTERNAL"] When `null`, the `address_type` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `ip_version` (`string`): The IP Version that will be used by this address. The default value is 'IPV4'. Possible values: ["IPV4", "IPV6"] When `null`, the `ip_version` field will be omitted from the resulting object.\n  - `ipv6_endpoint_type` (`string`): The endpoint type of this address, which should be VM or NETLB. This is\nused for deciding which type of endpoint this address can be used after\nthe external IPv6 address reservation. Possible values: ["VM", "NETLB"] When `null`, the `ipv6_endpoint_type` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. The name must be 1-63 characters long, and\ncomply with RFC1035. Specifically, the name must be 1-63 characters\nlong and match the regular expression '[a-z]([-a-z0-9]*[a-z0-9])?'\nwhich means the first character must be a lowercase letter, and all\nfollowing characters must be a dash, lowercase letter, or digit,\nexcept the last character, which cannot be a dash.\n  - `network` (`string`): The URL of the network in which to reserve the address. This field\ncan only be used with INTERNAL type with the VPC_PEERING and\nIPSEC_INTERCONNECT purposes. When `null`, the `network` field will be omitted from the resulting object.\n  - `network_tier` (`string`): The networking tier used for configuring this address. If this field is not\nspecified, it is assumed to be PREMIUM.\nThis argument should not be used when configuring Internal addresses, because [network tier cannot be set for internal traffic; it's always Premium](https://cloud.google.com/network-tiers/docs/overview). Possible values: ["PREMIUM", "STANDARD"] When `null`, the `network_tier` field will be omitted from the resulting object.\n  - `prefix_length` (`number`): The prefix length if the resource represents an IP range. When `null`, the `prefix_length` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `purpose` (`string`): The purpose of this resource, which can be one of the following values.\n\n* GCE_ENDPOINT for addresses that are used by VM instances, alias IP\nranges, load balancers, and similar resources.\n\n* SHARED_LOADBALANCER_VIP for an address that can be used by multiple\ninternal load balancers.\n\n* VPC_PEERING for addresses that are reserved for VPC peer networks.\n\n* IPSEC_INTERCONNECT for addresses created from a private IP range that\nare reserved for a VLAN attachment in an HA VPN over Cloud Interconnect\nconfiguration. These addresses are regional resources.\n\n* PRIVATE_SERVICE_CONNECT for a private network address that is used to\nconfigure Private Service Connect. Only global internal addresses can use\nthis purpose.\n\n\nThis should only be set when using an Internal address. When `null`, the `purpose` field will be omitted from the resulting object.\n  - `region` (`string`): The Region in which the created address should reside.\nIf it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): The URL of the subnetwork in which to reserve the address. If an IP\naddress is specified, it must be within the subnetwork's IP range.\nThis field can only be used with INTERNAL type with\nGCE_ENDPOINT/DNS_RESOLVER purposes. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_address.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_address` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_address.newAttrs` constructs a new object with attributes and blocks configured for the `compute_address`\nTerraform resource.\n\nUnlike [google.compute_address.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `address` (`string`): The static external IP address represented by this resource.\nThe IP address must be inside the specified subnetwork,\nif any. Set by the API if undefined. When `null`, the `address` field will be omitted from the resulting object.\n  - `address_type` (`string`): The type of address to reserve.\nNote: if you set this argument's value as 'INTERNAL' you need to leave the 'network_tier' argument unset in that resource block. Default value: "EXTERNAL" Possible values: ["INTERNAL", "EXTERNAL"] When `null`, the `address_type` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `ip_version` (`string`): The IP Version that will be used by this address. The default value is 'IPV4'. Possible values: ["IPV4", "IPV6"] When `null`, the `ip_version` field will be omitted from the resulting object.\n  - `ipv6_endpoint_type` (`string`): The endpoint type of this address, which should be VM or NETLB. This is\nused for deciding which type of endpoint this address can be used after\nthe external IPv6 address reservation. Possible values: ["VM", "NETLB"] When `null`, the `ipv6_endpoint_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this address.  A list of key->value pairs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. The name must be 1-63 characters long, and\ncomply with RFC1035. Specifically, the name must be 1-63 characters\nlong and match the regular expression '[a-z]([-a-z0-9]*[a-z0-9])?'\nwhich means the first character must be a lowercase letter, and all\nfollowing characters must be a dash, lowercase letter, or digit,\nexcept the last character, which cannot be a dash.\n  - `network` (`string`): The URL of the network in which to reserve the address. This field\ncan only be used with INTERNAL type with the VPC_PEERING and\nIPSEC_INTERCONNECT purposes. When `null`, the `network` field will be omitted from the resulting object.\n  - `network_tier` (`string`): The networking tier used for configuring this address. If this field is not\nspecified, it is assumed to be PREMIUM.\nThis argument should not be used when configuring Internal addresses, because [network tier cannot be set for internal traffic; it's always Premium](https://cloud.google.com/network-tiers/docs/overview). Possible values: ["PREMIUM", "STANDARD"] When `null`, the `network_tier` field will be omitted from the resulting object.\n  - `prefix_length` (`number`): The prefix length if the resource represents an IP range. When `null`, the `prefix_length` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `purpose` (`string`): The purpose of this resource, which can be one of the following values.\n\n* GCE_ENDPOINT for addresses that are used by VM instances, alias IP\nranges, load balancers, and similar resources.\n\n* SHARED_LOADBALANCER_VIP for an address that can be used by multiple\ninternal load balancers.\n\n* VPC_PEERING for addresses that are reserved for VPC peer networks.\n\n* IPSEC_INTERCONNECT for addresses created from a private IP range that\nare reserved for a VLAN attachment in an HA VPN over Cloud Interconnect\nconfiguration. These addresses are regional resources.\n\n* PRIVATE_SERVICE_CONNECT for a private network address that is used to\nconfigure Private Service Connect. Only global internal addresses can use\nthis purpose.\n\n\nThis should only be set when using an Internal address. When `null`, the `purpose` field will be omitted from the resulting object.\n  - `region` (`string`): The Region in which the created address should reside.\nIf it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): The URL of the subnetwork in which to reserve the address. If an IP\naddress is specified, it must be within the subnetwork's IP range.\nThis field can only be used with INTERNAL type with\nGCE_ENDPOINT/DNS_RESOLVER purposes. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_address.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_address` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     address=null,
@@ -49,6 +51,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     description=null,
     ip_version=null,
     ipv6_endpoint_type=null,
+    labels=null,
     network=null,
     network_tier=null,
     prefix_length=null,
@@ -63,6 +66,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     description: description,
     ip_version: ip_version,
     ipv6_endpoint_type: ipv6_endpoint_type,
+    labels: labels,
     name: name,
     network: network,
     network_tier: network_tier,
@@ -74,13 +78,15 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     timeouts: timeouts,
   }),
   timeouts:: {
-    '#new':: d.fn(help='\n`google.compute_address.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.compute_address.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
     new(
       create=null,
-      delete=null
+      delete=null,
+      update=null
     ):: std.prune(a={
       create: create,
       delete: delete,
+      update: update,
     }),
   },
   '#withAddress':: d.fn(help='`google.string.withAddress` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the address field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `address` field.\n', args=[]),
@@ -133,6 +139,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
+  withLabels(resourceLabel, value): {
+    resource+: {
+      google_compute_address+: {
+        [resourceLabel]+: {
+          labels: value,
+        },
+      },
+    },
+  },
   '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
   withName(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/compute_disk.libsonnet b/4.x/_gen/resources/compute_disk.libsonnet
index 72a2ba86..6e896a68 100644
--- a/4.x/_gen/resources/compute_disk.libsonnet
+++ b/4.x/_gen/resources/compute_disk.libsonnet
@@ -32,7 +32,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       type: type,
     }),
   },
-  '#new':: d.fn(help="\n`google.compute_disk.new` injects a new `google_compute_disk` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_disk.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_disk` using the reference:\n\n    $._ref.google_compute_disk.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_disk.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `image` (`string`): The image from which to initialize this disk. This can be\none of: the image\u0026#39;s \u0026#39;self_link\u0026#39;, \u0026#39;projects/{project}/global/images/{image}\u0026#39;,\n\u0026#39;projects/{project}/global/images/family/{family}\u0026#39;, \u0026#39;global/images/{image}\u0026#39;,\n\u0026#39;global/images/family/{family}\u0026#39;, \u0026#39;family/{family}\u0026#39;, \u0026#39;{project}/{family}\u0026#39;,\n\u0026#39;{project}/{image}\u0026#39;, \u0026#39;{family}\u0026#39;, or \u0026#39;{image}\u0026#39;. If referred by family, the\nimages names must include the family name. If they don\u0026#39;t, use the\n[google_compute_image data source](/docs/providers/google/d/compute_image.html).\nFor instance, the image \u0026#39;centos-6-v20180104\u0026#39; includes its family name \u0026#39;centos-6\u0026#39;.\nThese images can be referred by family name here. When `null`, the `image` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this disk.  A list of key-\u0026gt;value pairs. When `null`, the `labels` field will be omitted from the resulting object.\n  - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `physical_block_size_bytes` (`number`): Physical block size of the persistent disk, in bytes. If not present\nin a request, a default value is used. Currently supported sizes\nare 4096 and 16384, other sizes may be added in the future.\nIf an unsupported value is requested, the error message will list\nthe supported values for the caller\u0026#39;s project. When `null`, the `physical_block_size_bytes` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `provisioned_iops` (`number`): Indicates how many IOPS must be provisioned for the disk.\nNote: Updating currently is only supported by hyperdisk skus without the need to delete and recreate the disk, hyperdisk\nallows for an update of IOPS every 4 hours. To update your hyperdisk more frequently, you\u0026#39;ll need to manually delete and recreate it When `null`, the `provisioned_iops` field will be omitted from the resulting object.\n  - `provisioned_throughput` (`number`): Indicates how much Throughput must be provisioned for the disk.\nNote: Updating currently is only supported by hyperdisk skus without the need to delete and recreate the disk, hyperdisk\nallows for an update of Throughput every 4 hours. To update your hyperdisk more frequently, you\u0026#39;ll need to manually delete and recreate it When `null`, the `provisioned_throughput` field will be omitted from the resulting object.\n  - `size` (`number`): Size of the persistent disk, specified in GB. You can specify this\nfield when creating a persistent disk using the \u0026#39;image\u0026#39; or\n\u0026#39;snapshot\u0026#39; parameter, or specify it alone to create an empty\npersistent disk.\n\nIf you specify this field along with \u0026#39;image\u0026#39; or \u0026#39;snapshot\u0026#39;,\nthe value must not be less than the size of the image\nor the size of the snapshot.\n\n~\u0026gt;**NOTE** If you change the size, Terraform updates the disk size\nif upsizing is detected but recreates the disk if downsizing is requested.\nYou can add \u0026#39;lifecycle.prevent_destroy\u0026#39; in the config to prevent destroying\nand recreating. When `null`, the `size` field will be omitted from the resulting object.\n  - `snapshot` (`string`): The source snapshot used to create this disk. You can provide this as\na partial or full URL to the resource. If the snapshot is in another\nproject than this disk, you must supply a full URL. For example, the\nfollowing are valid values:\n\n* \u0026#39;https://www.googleapis.com/compute/v1/projects/project/global/snapshots/snapshot\u0026#39;\n* \u0026#39;projects/project/global/snapshots/snapshot\u0026#39;\n* \u0026#39;global/snapshots/snapshot\u0026#39;\n* \u0026#39;snapshot\u0026#39; When `null`, the `snapshot` field will be omitted from the resulting object.\n  - `source_disk` (`string`): The source disk used to create this disk. You can provide this as a partial or full URL to the resource.\nFor example, the following are valid values:\n\n* https://www.googleapis.com/compute/v1/projects/{project}/zones/{zone}/disks/{disk}\n* https://www.googleapis.com/compute/v1/projects/{project}/regions/{region}/disks/{disk}\n* projects/{project}/zones/{zone}/disks/{disk}\n* projects/{project}/regions/{region}/disks/{disk}\n* zones/{zone}/disks/{disk}\n* regions/{region}/disks/{disk} When `null`, the `source_disk` field will be omitted from the resulting object.\n  - `type` (`string`): URL of the disk type resource describing which disk type to use to\ncreate the disk. Provide this when creating the disk. When `null`, the `type` field will be omitted from the resulting object.\n  - `zone` (`string`): A reference to the zone where the disk resides. When `null`, the `zone` field will be omitted from the resulting object.\n  - `async_primary_disk` (`list[obj]`): A nested object resource When `null`, the `async_primary_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.async_primary_disk.new](#fn-async_primary_disknew) constructor.\n  - `disk_encryption_key` (`list[obj]`): Encrypts the disk using a customer-supplied encryption key.\n\nAfter you encrypt a disk with a customer-supplied key, you must\nprovide the same key if you use the disk later (e.g. to create a disk\nsnapshot or an image, or to attach the disk to a virtual machine).\n\nCustomer-supplied encryption keys do not protect access to metadata of\nthe disk.\n\nIf you do not provide an encryption key when creating the disk, then\nthe disk will be encrypted using an automatically generated key and\nyou do not need to provide a key to use the disk later. When `null`, the `disk_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.disk_encryption_key.new](#fn-disk_encryption_keynew) constructor.\n  - `guest_os_features` (`list[obj]`): A list of features to enable on the guest operating system.\nApplicable only for bootable disks. When `null`, the `guest_os_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.guest_os_features.new](#fn-guest_os_featuresnew) constructor.\n  - `source_image_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source image. Required if\nthe source image is protected by a customer-supplied encryption key. When `null`, the `source_image_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.source_image_encryption_key.new](#fn-source_image_encryption_keynew) constructor.\n  - `source_snapshot_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source snapshot. Required\nif the source snapshot is protected by a customer-supplied encryption\nkey. When `null`, the `source_snapshot_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.source_snapshot_encryption_key.new](#fn-source_snapshot_encryption_keynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_disk.new` injects a new `google_compute_disk` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_disk.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_disk` using the reference:\n\n    $._ref.google_compute_disk.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_disk.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `image` (`string`): The image from which to initialize this disk. This can be\none of: the image\u0026#39;s \u0026#39;self_link\u0026#39;, \u0026#39;projects/{project}/global/images/{image}\u0026#39;,\n\u0026#39;projects/{project}/global/images/family/{family}\u0026#39;, \u0026#39;global/images/{image}\u0026#39;,\n\u0026#39;global/images/family/{family}\u0026#39;, \u0026#39;family/{family}\u0026#39;, \u0026#39;{project}/{family}\u0026#39;,\n\u0026#39;{project}/{image}\u0026#39;, \u0026#39;{family}\u0026#39;, or \u0026#39;{image}\u0026#39;. If referred by family, the\nimages names must include the family name. If they don\u0026#39;t, use the\n[google_compute_image data source](/docs/providers/google/d/compute_image.html).\nFor instance, the image \u0026#39;centos-6-v20180104\u0026#39; includes its family name \u0026#39;centos-6\u0026#39;.\nThese images can be referred by family name here. When `null`, the `image` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this disk.  A list of key-\u0026gt;value pairs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `physical_block_size_bytes` (`number`): Physical block size of the persistent disk, in bytes. If not present\nin a request, a default value is used. Currently supported sizes\nare 4096 and 16384, other sizes may be added in the future.\nIf an unsupported value is requested, the error message will list\nthe supported values for the caller\u0026#39;s project. When `null`, the `physical_block_size_bytes` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `provisioned_iops` (`number`): Indicates how many IOPS must be provisioned for the disk.\nNote: Updating currently is only supported by hyperdisk skus without the need to delete and recreate the disk, hyperdisk\nallows for an update of IOPS every 4 hours. To update your hyperdisk more frequently, you\u0026#39;ll need to manually delete and recreate it When `null`, the `provisioned_iops` field will be omitted from the resulting object.\n  - `provisioned_throughput` (`number`): Indicates how much Throughput must be provisioned for the disk.\nNote: Updating currently is only supported by hyperdisk skus without the need to delete and recreate the disk, hyperdisk\nallows for an update of Throughput every 4 hours. To update your hyperdisk more frequently, you\u0026#39;ll need to manually delete and recreate it When `null`, the `provisioned_throughput` field will be omitted from the resulting object.\n  - `size` (`number`): Size of the persistent disk, specified in GB. You can specify this\nfield when creating a persistent disk using the \u0026#39;image\u0026#39; or\n\u0026#39;snapshot\u0026#39; parameter, or specify it alone to create an empty\npersistent disk.\n\nIf you specify this field along with \u0026#39;image\u0026#39; or \u0026#39;snapshot\u0026#39;,\nthe value must not be less than the size of the image\nor the size of the snapshot.\n\n~\u0026gt;**NOTE** If you change the size, Terraform updates the disk size\nif upsizing is detected but recreates the disk if downsizing is requested.\nYou can add \u0026#39;lifecycle.prevent_destroy\u0026#39; in the config to prevent destroying\nand recreating. When `null`, the `size` field will be omitted from the resulting object.\n  - `snapshot` (`string`): The source snapshot used to create this disk. You can provide this as\na partial or full URL to the resource. If the snapshot is in another\nproject than this disk, you must supply a full URL. For example, the\nfollowing are valid values:\n\n* \u0026#39;https://www.googleapis.com/compute/v1/projects/project/global/snapshots/snapshot\u0026#39;\n* \u0026#39;projects/project/global/snapshots/snapshot\u0026#39;\n* \u0026#39;global/snapshots/snapshot\u0026#39;\n* \u0026#39;snapshot\u0026#39; When `null`, the `snapshot` field will be omitted from the resulting object.\n  - `source_disk` (`string`): The source disk used to create this disk. You can provide this as a partial or full URL to the resource.\nFor example, the following are valid values:\n\n* https://www.googleapis.com/compute/v1/projects/{project}/zones/{zone}/disks/{disk}\n* https://www.googleapis.com/compute/v1/projects/{project}/regions/{region}/disks/{disk}\n* projects/{project}/zones/{zone}/disks/{disk}\n* projects/{project}/regions/{region}/disks/{disk}\n* zones/{zone}/disks/{disk}\n* regions/{region}/disks/{disk} When `null`, the `source_disk` field will be omitted from the resulting object.\n  - `type` (`string`): URL of the disk type resource describing which disk type to use to\ncreate the disk. Provide this when creating the disk. When `null`, the `type` field will be omitted from the resulting object.\n  - `zone` (`string`): A reference to the zone where the disk resides. When `null`, the `zone` field will be omitted from the resulting object.\n  - `async_primary_disk` (`list[obj]`): A nested object resource When `null`, the `async_primary_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.async_primary_disk.new](#fn-async_primary_disknew) constructor.\n  - `disk_encryption_key` (`list[obj]`): Encrypts the disk using a customer-supplied encryption key.\n\nAfter you encrypt a disk with a customer-supplied key, you must\nprovide the same key if you use the disk later (e.g. to create a disk\nsnapshot or an image, or to attach the disk to a virtual machine).\n\nCustomer-supplied encryption keys do not protect access to metadata of\nthe disk.\n\nIf you do not provide an encryption key when creating the disk, then\nthe disk will be encrypted using an automatically generated key and\nyou do not need to provide a key to use the disk later. When `null`, the `disk_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.disk_encryption_key.new](#fn-disk_encryption_keynew) constructor.\n  - `guest_os_features` (`list[obj]`): A list of features to enable on the guest operating system.\nApplicable only for bootable disks. When `null`, the `guest_os_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.guest_os_features.new](#fn-guest_os_featuresnew) constructor.\n  - `source_image_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source image. Required if\nthe source image is protected by a customer-supplied encryption key. When `null`, the `source_image_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.source_image_encryption_key.new](#fn-source_image_encryption_keynew) constructor.\n  - `source_snapshot_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source snapshot. Required\nif the source snapshot is protected by a customer-supplied encryption\nkey. When `null`, the `source_snapshot_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.source_snapshot_encryption_key.new](#fn-source_snapshot_encryption_keynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -83,7 +83,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_disk.newAttrs` constructs a new object with attributes and blocks configured for the `compute_disk`\nTerraform resource.\n\nUnlike [google.compute_disk.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `image` (`string`): The image from which to initialize this disk. This can be\none of: the image's 'self_link', 'projects/{project}/global/images/{image}',\n'projects/{project}/global/images/family/{family}', 'global/images/{image}',\n'global/images/family/{family}', 'family/{family}', '{project}/{family}',\n'{project}/{image}', '{family}', or '{image}'. If referred by family, the\nimages names must include the family name. If they don't, use the\n[google_compute_image data source](/docs/providers/google/d/compute_image.html).\nFor instance, the image 'centos-6-v20180104' includes its family name 'centos-6'.\nThese images can be referred by family name here. When `null`, the `image` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this disk.  A list of key->value pairs. When `null`, the `labels` field will be omitted from the resulting object.\n  - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `physical_block_size_bytes` (`number`): Physical block size of the persistent disk, in bytes. If not present\nin a request, a default value is used. Currently supported sizes\nare 4096 and 16384, other sizes may be added in the future.\nIf an unsupported value is requested, the error message will list\nthe supported values for the caller's project. When `null`, the `physical_block_size_bytes` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `provisioned_iops` (`number`): Indicates how many IOPS must be provisioned for the disk.\nNote: Updating currently is only supported by hyperdisk skus without the need to delete and recreate the disk, hyperdisk\nallows for an update of IOPS every 4 hours. To update your hyperdisk more frequently, you'll need to manually delete and recreate it When `null`, the `provisioned_iops` field will be omitted from the resulting object.\n  - `provisioned_throughput` (`number`): Indicates how much Throughput must be provisioned for the disk.\nNote: Updating currently is only supported by hyperdisk skus without the need to delete and recreate the disk, hyperdisk\nallows for an update of Throughput every 4 hours. To update your hyperdisk more frequently, you'll need to manually delete and recreate it When `null`, the `provisioned_throughput` field will be omitted from the resulting object.\n  - `size` (`number`): Size of the persistent disk, specified in GB. You can specify this\nfield when creating a persistent disk using the 'image' or\n'snapshot' parameter, or specify it alone to create an empty\npersistent disk.\n\nIf you specify this field along with 'image' or 'snapshot',\nthe value must not be less than the size of the image\nor the size of the snapshot.\n\n~>**NOTE** If you change the size, Terraform updates the disk size\nif upsizing is detected but recreates the disk if downsizing is requested.\nYou can add 'lifecycle.prevent_destroy' in the config to prevent destroying\nand recreating. When `null`, the `size` field will be omitted from the resulting object.\n  - `snapshot` (`string`): The source snapshot used to create this disk. You can provide this as\na partial or full URL to the resource. If the snapshot is in another\nproject than this disk, you must supply a full URL. For example, the\nfollowing are valid values:\n\n* 'https://www.googleapis.com/compute/v1/projects/project/global/snapshots/snapshot'\n* 'projects/project/global/snapshots/snapshot'\n* 'global/snapshots/snapshot'\n* 'snapshot' When `null`, the `snapshot` field will be omitted from the resulting object.\n  - `source_disk` (`string`): The source disk used to create this disk. You can provide this as a partial or full URL to the resource.\nFor example, the following are valid values:\n\n* https://www.googleapis.com/compute/v1/projects/{project}/zones/{zone}/disks/{disk}\n* https://www.googleapis.com/compute/v1/projects/{project}/regions/{region}/disks/{disk}\n* projects/{project}/zones/{zone}/disks/{disk}\n* projects/{project}/regions/{region}/disks/{disk}\n* zones/{zone}/disks/{disk}\n* regions/{region}/disks/{disk} When `null`, the `source_disk` field will be omitted from the resulting object.\n  - `type` (`string`): URL of the disk type resource describing which disk type to use to\ncreate the disk. Provide this when creating the disk. When `null`, the `type` field will be omitted from the resulting object.\n  - `zone` (`string`): A reference to the zone where the disk resides. When `null`, the `zone` field will be omitted from the resulting object.\n  - `async_primary_disk` (`list[obj]`): A nested object resource When `null`, the `async_primary_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.async_primary_disk.new](#fn-async_primary_disknew) constructor.\n  - `disk_encryption_key` (`list[obj]`): Encrypts the disk using a customer-supplied encryption key.\n\nAfter you encrypt a disk with a customer-supplied key, you must\nprovide the same key if you use the disk later (e.g. to create a disk\nsnapshot or an image, or to attach the disk to a virtual machine).\n\nCustomer-supplied encryption keys do not protect access to metadata of\nthe disk.\n\nIf you do not provide an encryption key when creating the disk, then\nthe disk will be encrypted using an automatically generated key and\nyou do not need to provide a key to use the disk later. When `null`, the `disk_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.disk_encryption_key.new](#fn-disk_encryption_keynew) constructor.\n  - `guest_os_features` (`list[obj]`): A list of features to enable on the guest operating system.\nApplicable only for bootable disks. When `null`, the `guest_os_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.guest_os_features.new](#fn-guest_os_featuresnew) constructor.\n  - `source_image_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source image. Required if\nthe source image is protected by a customer-supplied encryption key. When `null`, the `source_image_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.source_image_encryption_key.new](#fn-source_image_encryption_keynew) constructor.\n  - `source_snapshot_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source snapshot. Required\nif the source snapshot is protected by a customer-supplied encryption\nkey. When `null`, the `source_snapshot_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.source_snapshot_encryption_key.new](#fn-source_snapshot_encryption_keynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_disk` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_disk.newAttrs` constructs a new object with attributes and blocks configured for the `compute_disk`\nTerraform resource.\n\nUnlike [google.compute_disk.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `image` (`string`): The image from which to initialize this disk. This can be\none of: the image's 'self_link', 'projects/{project}/global/images/{image}',\n'projects/{project}/global/images/family/{family}', 'global/images/{image}',\n'global/images/family/{family}', 'family/{family}', '{project}/{family}',\n'{project}/{image}', '{family}', or '{image}'. If referred by family, the\nimages names must include the family name. If they don't, use the\n[google_compute_image data source](/docs/providers/google/d/compute_image.html).\nFor instance, the image 'centos-6-v20180104' includes its family name 'centos-6'.\nThese images can be referred by family name here. When `null`, the `image` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this disk.  A list of key->value pairs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `physical_block_size_bytes` (`number`): Physical block size of the persistent disk, in bytes. If not present\nin a request, a default value is used. Currently supported sizes\nare 4096 and 16384, other sizes may be added in the future.\nIf an unsupported value is requested, the error message will list\nthe supported values for the caller's project. When `null`, the `physical_block_size_bytes` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `provisioned_iops` (`number`): Indicates how many IOPS must be provisioned for the disk.\nNote: Updating currently is only supported by hyperdisk skus without the need to delete and recreate the disk, hyperdisk\nallows for an update of IOPS every 4 hours. To update your hyperdisk more frequently, you'll need to manually delete and recreate it When `null`, the `provisioned_iops` field will be omitted from the resulting object.\n  - `provisioned_throughput` (`number`): Indicates how much Throughput must be provisioned for the disk.\nNote: Updating currently is only supported by hyperdisk skus without the need to delete and recreate the disk, hyperdisk\nallows for an update of Throughput every 4 hours. To update your hyperdisk more frequently, you'll need to manually delete and recreate it When `null`, the `provisioned_throughput` field will be omitted from the resulting object.\n  - `size` (`number`): Size of the persistent disk, specified in GB. You can specify this\nfield when creating a persistent disk using the 'image' or\n'snapshot' parameter, or specify it alone to create an empty\npersistent disk.\n\nIf you specify this field along with 'image' or 'snapshot',\nthe value must not be less than the size of the image\nor the size of the snapshot.\n\n~>**NOTE** If you change the size, Terraform updates the disk size\nif upsizing is detected but recreates the disk if downsizing is requested.\nYou can add 'lifecycle.prevent_destroy' in the config to prevent destroying\nand recreating. When `null`, the `size` field will be omitted from the resulting object.\n  - `snapshot` (`string`): The source snapshot used to create this disk. You can provide this as\na partial or full URL to the resource. If the snapshot is in another\nproject than this disk, you must supply a full URL. For example, the\nfollowing are valid values:\n\n* 'https://www.googleapis.com/compute/v1/projects/project/global/snapshots/snapshot'\n* 'projects/project/global/snapshots/snapshot'\n* 'global/snapshots/snapshot'\n* 'snapshot' When `null`, the `snapshot` field will be omitted from the resulting object.\n  - `source_disk` (`string`): The source disk used to create this disk. You can provide this as a partial or full URL to the resource.\nFor example, the following are valid values:\n\n* https://www.googleapis.com/compute/v1/projects/{project}/zones/{zone}/disks/{disk}\n* https://www.googleapis.com/compute/v1/projects/{project}/regions/{region}/disks/{disk}\n* projects/{project}/zones/{zone}/disks/{disk}\n* projects/{project}/regions/{region}/disks/{disk}\n* zones/{zone}/disks/{disk}\n* regions/{region}/disks/{disk} When `null`, the `source_disk` field will be omitted from the resulting object.\n  - `type` (`string`): URL of the disk type resource describing which disk type to use to\ncreate the disk. Provide this when creating the disk. When `null`, the `type` field will be omitted from the resulting object.\n  - `zone` (`string`): A reference to the zone where the disk resides. When `null`, the `zone` field will be omitted from the resulting object.\n  - `async_primary_disk` (`list[obj]`): A nested object resource When `null`, the `async_primary_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.async_primary_disk.new](#fn-async_primary_disknew) constructor.\n  - `disk_encryption_key` (`list[obj]`): Encrypts the disk using a customer-supplied encryption key.\n\nAfter you encrypt a disk with a customer-supplied key, you must\nprovide the same key if you use the disk later (e.g. to create a disk\nsnapshot or an image, or to attach the disk to a virtual machine).\n\nCustomer-supplied encryption keys do not protect access to metadata of\nthe disk.\n\nIf you do not provide an encryption key when creating the disk, then\nthe disk will be encrypted using an automatically generated key and\nyou do not need to provide a key to use the disk later. When `null`, the `disk_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.disk_encryption_key.new](#fn-disk_encryption_keynew) constructor.\n  - `guest_os_features` (`list[obj]`): A list of features to enable on the guest operating system.\nApplicable only for bootable disks. When `null`, the `guest_os_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.guest_os_features.new](#fn-guest_os_featuresnew) constructor.\n  - `source_image_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source image. Required if\nthe source image is protected by a customer-supplied encryption key. When `null`, the `source_image_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.source_image_encryption_key.new](#fn-source_image_encryption_keynew) constructor.\n  - `source_snapshot_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source snapshot. Required\nif the source snapshot is protected by a customer-supplied encryption\nkey. When `null`, the `source_snapshot_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.source_snapshot_encryption_key.new](#fn-source_snapshot_encryption_keynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_disk.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_disk` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     async_primary_disk=null,
diff --git a/4.x/_gen/resources/compute_external_vpn_gateway.libsonnet b/4.x/_gen/resources/compute_external_vpn_gateway.libsonnet
index e403f622..24bb4fc0 100644
--- a/4.x/_gen/resources/compute_external_vpn_gateway.libsonnet
+++ b/4.x/_gen/resources/compute_external_vpn_gateway.libsonnet
@@ -10,7 +10,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       ip_address: ip_address,
     }),
   },
-  '#new':: d.fn(help="\n`google.compute_external_vpn_gateway.new` injects a new `google_compute_external_vpn_gateway` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_external_vpn_gateway.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_external_vpn_gateway` using the reference:\n\n    $._ref.google_compute_external_vpn_gateway.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_external_vpn_gateway.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels for the external VPN gateway resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035.  Specifically, the name must be 1-63 characters long and\nmatch the regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means\nthe first character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `redundancy_type` (`string`): Indicates the redundancy type of this external VPN gateway Possible values: [\u0026#34;FOUR_IPS_REDUNDANCY\u0026#34;, \u0026#34;SINGLE_IP_INTERNALLY_REDUNDANT\u0026#34;, \u0026#34;TWO_IPS_REDUNDANCY\u0026#34;] When `null`, the `redundancy_type` field will be omitted from the resulting object.\n  - `interface` (`list[obj]`): A list of interfaces on this external VPN gateway. When `null`, the `interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_external_vpn_gateway.interface.new](#fn-interfacenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_external_vpn_gateway.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_external_vpn_gateway.new` injects a new `google_compute_external_vpn_gateway` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_external_vpn_gateway.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_external_vpn_gateway` using the reference:\n\n    $._ref.google_compute_external_vpn_gateway.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_external_vpn_gateway.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels for the external VPN gateway resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035.  Specifically, the name must be 1-63 characters long and\nmatch the regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means\nthe first character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `redundancy_type` (`string`): Indicates the redundancy type of this external VPN gateway Possible values: [\u0026#34;FOUR_IPS_REDUNDANCY\u0026#34;, \u0026#34;SINGLE_IP_INTERNALLY_REDUNDANT\u0026#34;, \u0026#34;TWO_IPS_REDUNDANCY\u0026#34;] When `null`, the `redundancy_type` field will be omitted from the resulting object.\n  - `interface` (`list[obj]`): A list of interfaces on this external VPN gateway. When `null`, the `interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_external_vpn_gateway.interface.new](#fn-interfacenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_external_vpn_gateway.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -35,7 +35,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_external_vpn_gateway.newAttrs` constructs a new object with attributes and blocks configured for the `compute_external_vpn_gateway`\nTerraform resource.\n\nUnlike [google.compute_external_vpn_gateway.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels for the external VPN gateway resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035.  Specifically, the name must be 1-63 characters long and\nmatch the regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means\nthe first character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `redundancy_type` (`string`): Indicates the redundancy type of this external VPN gateway Possible values: ["FOUR_IPS_REDUNDANCY", "SINGLE_IP_INTERNALLY_REDUNDANT", "TWO_IPS_REDUNDANCY"] When `null`, the `redundancy_type` field will be omitted from the resulting object.\n  - `interface` (`list[obj]`): A list of interfaces on this external VPN gateway. When `null`, the `interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_external_vpn_gateway.interface.new](#fn-interfacenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_external_vpn_gateway.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_external_vpn_gateway` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_external_vpn_gateway.newAttrs` constructs a new object with attributes and blocks configured for the `compute_external_vpn_gateway`\nTerraform resource.\n\nUnlike [google.compute_external_vpn_gateway.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels for the external VPN gateway resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035.  Specifically, the name must be 1-63 characters long and\nmatch the regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means\nthe first character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `redundancy_type` (`string`): Indicates the redundancy type of this external VPN gateway Possible values: ["FOUR_IPS_REDUNDANCY", "SINGLE_IP_INTERNALLY_REDUNDANT", "TWO_IPS_REDUNDANCY"] When `null`, the `redundancy_type` field will be omitted from the resulting object.\n  - `interface` (`list[obj]`): A list of interfaces on this external VPN gateway. When `null`, the `interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_external_vpn_gateway.interface.new](#fn-interfacenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_external_vpn_gateway.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_external_vpn_gateway` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     description=null,
diff --git a/4.x/_gen/resources/compute_forwarding_rule.libsonnet b/4.x/_gen/resources/compute_forwarding_rule.libsonnet
index 6c3c99e0..1d071c1b 100644
--- a/4.x/_gen/resources/compute_forwarding_rule.libsonnet
+++ b/4.x/_gen/resources/compute_forwarding_rule.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='compute_forwarding_rule', url='', help='`compute_forwarding_rule` represents the `google_compute_forwarding_rule` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.compute_forwarding_rule.new` injects a new `google_compute_forwarding_rule` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_forwarding_rule.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_forwarding_rule` using the reference:\n\n    $._ref.google_compute_forwarding_rule.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_forwarding_rule.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `all_ports` (`bool`): This field can only be used:\n* If \u0026#39;IPProtocol\u0026#39; is one of TCP, UDP, or SCTP.\n* By internal TCP/UDP load balancers, backend service-based network load\nbalancers, and internal and external protocol forwarding.\n\nThis option should be set to TRUE when the Forwarding Rule\nIPProtocol is set to L3_DEFAULT.\n\nSet this field to true to allow packets addressed to any port or packets\nlacking destination port information (for example, UDP fragments after the\nfirst fragment) to be forwarded to the backends configured with this\nforwarding rule.\n\nThe \u0026#39;ports\u0026#39;, \u0026#39;port_range\u0026#39;, and\n\u0026#39;allPorts\u0026#39; fields are mutually exclusive. When `null`, the `all_ports` field will be omitted from the resulting object.\n  - `allow_global_access` (`bool`): This field is used along with the \u0026#39;backend_service\u0026#39; field for\ninternal load balancing or with the \u0026#39;target\u0026#39; field for internal\nTargetInstance.\n\nIf the field is set to \u0026#39;TRUE\u0026#39;, clients can access ILB from all\nregions.\n\nOtherwise only allows access from clients in the same region as the\ninternal load balancer. When `null`, the `allow_global_access` field will be omitted from the resulting object.\n  - `allow_psc_global_access` (`bool`): This is used in PSC consumer ForwardingRule to control whether the PSC endpoint can be accessed from another region. When `null`, the `allow_psc_global_access` field will be omitted from the resulting object.\n  - `backend_service` (`string`): Identifies the backend service to which the forwarding rule sends traffic.\n\nRequired for Internal TCP/UDP Load Balancing and Network Load Balancing;\nmust be omitted for all other load balancer types. When `null`, the `backend_service` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `ip_address` (`string`): IP address for which this forwarding rule accepts traffic. When a client\nsends traffic to this IP address, the forwarding rule directs the traffic\nto the referenced \u0026#39;target\u0026#39; or \u0026#39;backendService\u0026#39;.\n\nWhile creating a forwarding rule, specifying an \u0026#39;IPAddress\u0026#39; is\nrequired under the following circumstances:\n\n* When the \u0026#39;target\u0026#39; is set to \u0026#39;targetGrpcProxy\u0026#39; and\n\u0026#39;validateForProxyless\u0026#39; is set to \u0026#39;true\u0026#39;, the\n\u0026#39;IPAddress\u0026#39; should be set to \u0026#39;0.0.0.0\u0026#39;.\n* When the \u0026#39;target\u0026#39; is a Private Service Connect Google APIs\nbundle, you must specify an \u0026#39;IPAddress\u0026#39;.\n\n\nOtherwise, you can optionally specify an IP address that references an\nexisting static (reserved) IP address resource. When omitted, Google Cloud\nassigns an ephemeral IP address.\n\nUse one of the following formats to specify an IP address while creating a\nforwarding rule:\n\n* IP address number, as in \u0026#39;100.1.2.3\u0026#39;\n* IPv6 address range, as in \u0026#39;2600:1234::/96\u0026#39;\n* Full resource URL, as in\n\u0026#39;https://www.googleapis.com/compute/v1/projects/project_id/regions/region/addresses/address-name\u0026#39;\n* Partial URL or by name, as in:\n  * \u0026#39;projects/project_id/regions/region/addresses/address-name\u0026#39;\n  * \u0026#39;regions/region/addresses/address-name\u0026#39;\n  * \u0026#39;global/addresses/address-name\u0026#39;\n  * \u0026#39;address-name\u0026#39;\n\n\nThe forwarding rule\u0026#39;s \u0026#39;target\u0026#39; or \u0026#39;backendService\u0026#39;,\nand in most cases, also the \u0026#39;loadBalancingScheme\u0026#39;, determine the\ntype of IP address that you can use. For detailed information, see\n[IP address\nspecifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#ip_address_specifications).\n\nWhen reading an \u0026#39;IPAddress\u0026#39;, the API always returns the IP\naddress number. When `null`, the `ip_address` field will be omitted from the resulting object.\n  - `ip_protocol` (`string`): The IP protocol to which this rule applies.\n\nFor protocol forwarding, valid\noptions are \u0026#39;TCP\u0026#39;, \u0026#39;UDP\u0026#39;, \u0026#39;ESP\u0026#39;,\n\u0026#39;AH\u0026#39;, \u0026#39;SCTP\u0026#39;, \u0026#39;ICMP\u0026#39; and\n\u0026#39;L3_DEFAULT\u0026#39;.\n\nThe valid IP protocols are different for different load balancing products\nas described in [Load balancing\nfeatures](https://cloud.google.com/load-balancing/docs/features#protocols_from_the_load_balancer_to_the_backends).\n\nA Forwarding Rule with protocol L3_DEFAULT can attach with target instance or\nbackend service with UNSPECIFIED protocol.\nA forwarding rule with \u0026#34;L3_DEFAULT\u0026#34; IPProtocal cannot be attached to a backend service with TCP or UDP. Possible values: [\u0026#34;TCP\u0026#34;, \u0026#34;UDP\u0026#34;, \u0026#34;ESP\u0026#34;, \u0026#34;AH\u0026#34;, \u0026#34;SCTP\u0026#34;, \u0026#34;ICMP\u0026#34;, \u0026#34;L3_DEFAULT\u0026#34;] When `null`, the `ip_protocol` field will be omitted from the resulting object.\n  - `ip_version` (`string`): The IP address version that will be used by this forwarding rule.\nValid options are IPV4 and IPV6.\n\nIf not set, the IPv4 address will be used by default. Possible values: [\u0026#34;IPV4\u0026#34;, \u0026#34;IPV6\u0026#34;] When `null`, the `ip_version` field will be omitted from the resulting object.\n  - `is_mirroring_collector` (`bool`): Indicates whether or not this load balancer can be used as a collector for\npacket mirroring. To prevent mirroring loops, instances behind this\nload balancer will not have their traffic mirrored even if a\n\u0026#39;PacketMirroring\u0026#39; rule applies to them.\n\nThis can only be set to true for load balancers that have their\n\u0026#39;loadBalancingScheme\u0026#39; set to \u0026#39;INTERNAL\u0026#39;. When `null`, the `is_mirroring_collector` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this forwarding rule.  A list of key-\u0026gt;value pairs. When `null`, the `labels` field will be omitted from the resulting object.\n  - `load_balancing_scheme` (`string`): Specifies the forwarding rule type.\n\nFor more information about forwarding rules, refer to\n[Forwarding rule concepts](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts). Default value: \u0026#34;EXTERNAL\u0026#34; Possible values: [\u0026#34;EXTERNAL\u0026#34;, \u0026#34;EXTERNAL_MANAGED\u0026#34;, \u0026#34;INTERNAL\u0026#34;, \u0026#34;INTERNAL_MANAGED\u0026#34;] When `null`, the `load_balancing_scheme` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-63 characters long, and comply with\n[RFC1035](https://www.ietf.org/rfc/rfc1035.txt).\n\nSpecifically, the name must be 1-63 characters long and match the regular\nexpression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the first\ncharacter must be a lowercase letter, and all following characters must\nbe a dash, lowercase letter, or digit, except the last character, which\ncannot be a dash.\n\nFor Private Service Connect forwarding rules that forward traffic to Google\nAPIs, the forwarding rule name must be a 1-20 characters string with\nlowercase letters and numbers and must start with a letter.\n  - `network` (`string`): This field is not used for external load balancing.\n\nFor Internal TCP/UDP Load Balancing, this field identifies the network that\nthe load balanced IP should belong to for this Forwarding Rule.\nIf the subnetwork is specified, the network of the subnetwork will be used.\nIf neither subnetwork nor this field is specified, the default network will\nbe used.\n\nFor Private Service Connect forwarding rules that forward traffic to Google\nAPIs, a network must be provided. When `null`, the `network` field will be omitted from the resulting object.\n  - `network_tier` (`string`): This signifies the networking tier used for configuring\nthis load balancer and can only take the following values:\n\u0026#39;PREMIUM\u0026#39;, \u0026#39;STANDARD\u0026#39;.\n\nFor regional ForwardingRule, the valid values are \u0026#39;PREMIUM\u0026#39; and\n\u0026#39;STANDARD\u0026#39;. For GlobalForwardingRule, the valid value is\n\u0026#39;PREMIUM\u0026#39;.\n\nIf this field is not specified, it is assumed to be \u0026#39;PREMIUM\u0026#39;.\nIf \u0026#39;IPAddress\u0026#39; is specified, this value must be equal to the\nnetworkTier of the Address. Possible values: [\u0026#34;PREMIUM\u0026#34;, \u0026#34;STANDARD\u0026#34;] When `null`, the `network_tier` field will be omitted from the resulting object.\n  - `no_automate_dns_zone` (`bool`): This is used in PSC consumer ForwardingRule to control whether it should try to auto-generate a DNS zone or not. Non-PSC forwarding rules do not use this field. When `null`, the `no_automate_dns_zone` field will be omitted from the resulting object.\n  - `port_range` (`string`): This field can only be used:\n\n* If \u0026#39;IPProtocol\u0026#39; is one of TCP, UDP, or SCTP.\n* By backend service-based network load balancers, target pool-based\nnetwork load balancers, internal proxy load balancers, external proxy load\nbalancers, Traffic Director, external protocol forwarding, and Classic VPN.\nSome products have restrictions on what ports can be used. See\n[port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#port_specifications)\nfor details.\n\n\nOnly packets addressed to ports in the specified range will be forwarded to\nthe backends configured with this forwarding rule.\n\nThe \u0026#39;ports\u0026#39; and \u0026#39;port_range\u0026#39; fields are mutually exclusive.\n\nFor external forwarding rules, two or more forwarding rules cannot use the\nsame \u0026#39;[IPAddress, IPProtocol]\u0026#39; pair, and cannot have\noverlapping \u0026#39;portRange\u0026#39;s.\n\nFor internal forwarding rules within the same VPC network, two or more\nforwarding rules cannot use the same \u0026#39;[IPAddress, IPProtocol]\u0026#39;\npair, and cannot have overlapping \u0026#39;portRange\u0026#39;s. When `null`, the `port_range` field will be omitted from the resulting object.\n  - `ports` (`list`): This field can only be used:\n\n* If \u0026#39;IPProtocol\u0026#39; is one of TCP, UDP, or SCTP.\n* By internal TCP/UDP load balancers, backend service-based network load\nbalancers, internal protocol forwarding and when protocol is not L3_DEFAULT.\n\n\nYou can specify a list of up to five ports by number, separated by commas.\nThe ports can be contiguous or discontiguous. Only packets addressed to\nthese ports will be forwarded to the backends configured with this\nforwarding rule.\n\nFor external forwarding rules, two or more forwarding rules cannot use the\nsame \u0026#39;[IPAddress, IPProtocol]\u0026#39; pair, and cannot share any values\ndefined in \u0026#39;ports\u0026#39;.\n\nFor internal forwarding rules within the same VPC network, two or more\nforwarding rules cannot use the same \u0026#39;[IPAddress, IPProtocol]\u0026#39;\npair, and cannot share any values defined in \u0026#39;ports\u0026#39;.\n\nThe \u0026#39;ports\u0026#39; and \u0026#39;port_range\u0026#39; fields are mutually exclusive. When `null`, the `ports` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): A reference to the region where the regional forwarding rule resides.\n\nThis field is not applicable to global forwarding rules. When `null`, the `region` field will be omitted from the resulting object.\n  - `service_label` (`string`): An optional prefix to the service name for this Forwarding Rule.\nIf specified, will be the first label of the fully qualified service\nname.\n\nThe label must be 1-63 characters long, and comply with RFC1035.\nSpecifically, the label must be 1-63 characters long and match the\nregular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the first\ncharacter must be a lowercase letter, and all following characters\nmust be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n\nThis field is only used for INTERNAL load balancing. When `null`, the `service_label` field will be omitted from the resulting object.\n  - `source_ip_ranges` (`list`): If not empty, this Forwarding Rule will only forward the traffic when the source IP address matches one of the IP addresses or CIDR ranges set here. Note that a Forwarding Rule can only have up to 64 source IP ranges, and this field can only be used with a regional Forwarding Rule whose scheme is EXTERNAL. Each sourceIpRange entry should be either an IP address (for example, 1.2.3.4) or a CIDR range (for example, 1.2.3.0/24). When `null`, the `source_ip_ranges` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): This field identifies the subnetwork that the load balanced IP should\nbelong to for this Forwarding Rule, used in internal load balancing and\nnetwork load balancing with IPv6.\n\nIf the network specified is in auto subnet mode, this field is optional.\nHowever, a subnetwork must be specified if the network is in custom subnet\nmode or when creating external forwarding rule with IPv6. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `target` (`string`): The URL of the target resource to receive the matched traffic.  For\nregional forwarding rules, this target must be in the same region as the\nforwarding rule. For global forwarding rules, this target must be a global\nload balancing resource.\n\nThe forwarded traffic must be of a type appropriate to the target object.\n*  For load balancers, see the \u0026#34;Target\u0026#34; column in [Port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#ip_address_specifications).\n*  For Private Service Connect forwarding rules that forward traffic to Google APIs, provide the name of a supported Google API bundle:\n  *  \u0026#39;vpc-sc\u0026#39; - [ APIs that support VPC Service Controls](https://cloud.google.com/vpc-service-controls/docs/supported-products).\n  *  \u0026#39;all-apis\u0026#39; - [All supported Google APIs](https://cloud.google.com/vpc/docs/private-service-connect#supported-apis).\n\n\nFor Private Service Connect forwarding rules that forward traffic to managed services, the target must be a service attachment. When `null`, the `target` field will be omitted from the resulting object.\n  - `service_directory_registrations` (`list[obj]`): Service Directory resources to register this forwarding rule with.\n\nCurrently, only supports a single Service Directory resource. When `null`, the `service_directory_registrations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_forwarding_rule.service_directory_registrations.new](#fn-service_directory_registrationsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_forwarding_rule.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_forwarding_rule.new` injects a new `google_compute_forwarding_rule` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_forwarding_rule.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_forwarding_rule` using the reference:\n\n    $._ref.google_compute_forwarding_rule.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_forwarding_rule.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `all_ports` (`bool`): The \u0026#39;ports\u0026#39;, \u0026#39;portRange\u0026#39;, and \u0026#39;allPorts\u0026#39; fields are mutually exclusive.\nOnly packets addressed to ports in the specified range will be forwarded\nto the backends configured with this forwarding rule.\n\nThe \u0026#39;allPorts\u0026#39; field has the following limitations:\n* It requires that the forwarding rule \u0026#39;IPProtocol\u0026#39; be TCP, UDP, SCTP, or\nL3_DEFAULT.\n* It\u0026#39;s applicable only to the following products: internal passthrough\nNetwork Load Balancers, backend service-based external passthrough Network\nLoad Balancers, and internal and external protocol forwarding.\n* Set this field to true to allow packets addressed to any port or packets\nlacking destination port information (for example, UDP fragments after the\nfirst fragment) to be forwarded to the backends configured with this\nforwarding rule. The L3_DEFAULT protocol requires \u0026#39;allPorts\u0026#39; be set to\ntrue. When `null`, the `all_ports` field will be omitted from the resulting object.\n  - `allow_global_access` (`bool`): This field is used along with the \u0026#39;backend_service\u0026#39; field for\ninternal load balancing or with the \u0026#39;target\u0026#39; field for internal\nTargetInstance.\n\nIf the field is set to \u0026#39;TRUE\u0026#39;, clients can access ILB from all\nregions.\n\nOtherwise only allows access from clients in the same region as the\ninternal load balancer. When `null`, the `allow_global_access` field will be omitted from the resulting object.\n  - `allow_psc_global_access` (`bool`): This is used in PSC consumer ForwardingRule to control whether the PSC endpoint can be accessed from another region. When `null`, the `allow_psc_global_access` field will be omitted from the resulting object.\n  - `backend_service` (`string`): Identifies the backend service to which the forwarding rule sends traffic.\n\nRequired for Internal TCP/UDP Load Balancing and Network Load Balancing;\nmust be omitted for all other load balancer types. When `null`, the `backend_service` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `ip_address` (`string`): IP address for which this forwarding rule accepts traffic. When a client\nsends traffic to this IP address, the forwarding rule directs the traffic\nto the referenced \u0026#39;target\u0026#39; or \u0026#39;backendService\u0026#39;.\n\nWhile creating a forwarding rule, specifying an \u0026#39;IPAddress\u0026#39; is\nrequired under the following circumstances:\n\n* When the \u0026#39;target\u0026#39; is set to \u0026#39;targetGrpcProxy\u0026#39; and\n\u0026#39;validateForProxyless\u0026#39; is set to \u0026#39;true\u0026#39;, the\n\u0026#39;IPAddress\u0026#39; should be set to \u0026#39;0.0.0.0\u0026#39;.\n* When the \u0026#39;target\u0026#39; is a Private Service Connect Google APIs\nbundle, you must specify an \u0026#39;IPAddress\u0026#39;.\n\n\nOtherwise, you can optionally specify an IP address that references an\nexisting static (reserved) IP address resource. When omitted, Google Cloud\nassigns an ephemeral IP address.\n\nUse one of the following formats to specify an IP address while creating a\nforwarding rule:\n\n* IP address number, as in \u0026#39;100.1.2.3\u0026#39;\n* IPv6 address range, as in \u0026#39;2600:1234::/96\u0026#39;\n* Full resource URL, as in\n\u0026#39;https://www.googleapis.com/compute/v1/projects/project_id/regions/region/addresses/address-name\u0026#39;\n* Partial URL or by name, as in:\n  * \u0026#39;projects/project_id/regions/region/addresses/address-name\u0026#39;\n  * \u0026#39;regions/region/addresses/address-name\u0026#39;\n  * \u0026#39;global/addresses/address-name\u0026#39;\n  * \u0026#39;address-name\u0026#39;\n\n\nThe forwarding rule\u0026#39;s \u0026#39;target\u0026#39; or \u0026#39;backendService\u0026#39;,\nand in most cases, also the \u0026#39;loadBalancingScheme\u0026#39;, determine the\ntype of IP address that you can use. For detailed information, see\n[IP address\nspecifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#ip_address_specifications).\n\nWhen reading an \u0026#39;IPAddress\u0026#39;, the API always returns the IP\naddress number. When `null`, the `ip_address` field will be omitted from the resulting object.\n  - `ip_protocol` (`string`): The IP protocol to which this rule applies.\n\nFor protocol forwarding, valid\noptions are \u0026#39;TCP\u0026#39;, \u0026#39;UDP\u0026#39;, \u0026#39;ESP\u0026#39;,\n\u0026#39;AH\u0026#39;, \u0026#39;SCTP\u0026#39;, \u0026#39;ICMP\u0026#39; and\n\u0026#39;L3_DEFAULT\u0026#39;.\n\nThe valid IP protocols are different for different load balancing products\nas described in [Load balancing\nfeatures](https://cloud.google.com/load-balancing/docs/features#protocols_from_the_load_balancer_to_the_backends).\n\nA Forwarding Rule with protocol L3_DEFAULT can attach with target instance or\nbackend service with UNSPECIFIED protocol.\nA forwarding rule with \u0026#34;L3_DEFAULT\u0026#34; IPProtocal cannot be attached to a backend service with TCP or UDP. Possible values: [\u0026#34;TCP\u0026#34;, \u0026#34;UDP\u0026#34;, \u0026#34;ESP\u0026#34;, \u0026#34;AH\u0026#34;, \u0026#34;SCTP\u0026#34;, \u0026#34;ICMP\u0026#34;, \u0026#34;L3_DEFAULT\u0026#34;] When `null`, the `ip_protocol` field will be omitted from the resulting object.\n  - `ip_version` (`string`): The IP address version that will be used by this forwarding rule.\nValid options are IPV4 and IPV6.\n\nIf not set, the IPv4 address will be used by default. Possible values: [\u0026#34;IPV4\u0026#34;, \u0026#34;IPV6\u0026#34;] When `null`, the `ip_version` field will be omitted from the resulting object.\n  - `is_mirroring_collector` (`bool`): Indicates whether or not this load balancer can be used as a collector for\npacket mirroring. To prevent mirroring loops, instances behind this\nload balancer will not have their traffic mirrored even if a\n\u0026#39;PacketMirroring\u0026#39; rule applies to them.\n\nThis can only be set to true for load balancers that have their\n\u0026#39;loadBalancingScheme\u0026#39; set to \u0026#39;INTERNAL\u0026#39;. When `null`, the `is_mirroring_collector` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this forwarding rule.  A list of key-\u0026gt;value pairs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `load_balancing_scheme` (`string`): Specifies the forwarding rule type.\n\nFor more information about forwarding rules, refer to\n[Forwarding rule concepts](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts). Default value: \u0026#34;EXTERNAL\u0026#34; Possible values: [\u0026#34;EXTERNAL\u0026#34;, \u0026#34;EXTERNAL_MANAGED\u0026#34;, \u0026#34;INTERNAL\u0026#34;, \u0026#34;INTERNAL_MANAGED\u0026#34;] When `null`, the `load_balancing_scheme` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-63 characters long, and comply with\n[RFC1035](https://www.ietf.org/rfc/rfc1035.txt).\n\nSpecifically, the name must be 1-63 characters long and match the regular\nexpression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the first\ncharacter must be a lowercase letter, and all following characters must\nbe a dash, lowercase letter, or digit, except the last character, which\ncannot be a dash.\n\nFor Private Service Connect forwarding rules that forward traffic to Google\nAPIs, the forwarding rule name must be a 1-20 characters string with\nlowercase letters and numbers and must start with a letter.\n  - `network` (`string`): This field is not used for external load balancing.\n\nFor Internal TCP/UDP Load Balancing, this field identifies the network that\nthe load balanced IP should belong to for this Forwarding Rule.\nIf the subnetwork is specified, the network of the subnetwork will be used.\nIf neither subnetwork nor this field is specified, the default network will\nbe used.\n\nFor Private Service Connect forwarding rules that forward traffic to Google\nAPIs, a network must be provided. When `null`, the `network` field will be omitted from the resulting object.\n  - `network_tier` (`string`): This signifies the networking tier used for configuring\nthis load balancer and can only take the following values:\n\u0026#39;PREMIUM\u0026#39;, \u0026#39;STANDARD\u0026#39;.\n\nFor regional ForwardingRule, the valid values are \u0026#39;PREMIUM\u0026#39; and\n\u0026#39;STANDARD\u0026#39;. For GlobalForwardingRule, the valid value is\n\u0026#39;PREMIUM\u0026#39;.\n\nIf this field is not specified, it is assumed to be \u0026#39;PREMIUM\u0026#39;.\nIf \u0026#39;IPAddress\u0026#39; is specified, this value must be equal to the\nnetworkTier of the Address. Possible values: [\u0026#34;PREMIUM\u0026#34;, \u0026#34;STANDARD\u0026#34;] When `null`, the `network_tier` field will be omitted from the resulting object.\n  - `no_automate_dns_zone` (`bool`): This is used in PSC consumer ForwardingRule to control whether it should try to auto-generate a DNS zone or not. Non-PSC forwarding rules do not use this field. When `null`, the `no_automate_dns_zone` field will be omitted from the resulting object.\n  - `port_range` (`string`): The \u0026#39;ports\u0026#39;, \u0026#39;portRange\u0026#39;, and \u0026#39;allPorts\u0026#39; fields are mutually exclusive.\nOnly packets addressed to ports in the specified range will be forwarded\nto the backends configured with this forwarding rule.\n\nThe \u0026#39;portRange\u0026#39; field has the following limitations:\n* It requires that the forwarding rule \u0026#39;IPProtocol\u0026#39; be TCP, UDP, or SCTP,\nand\n* It\u0026#39;s applicable only to the following products: external passthrough\nNetwork Load Balancers, internal and external proxy Network Load\nBalancers, internal and external Application Load Balancers, external\nprotocol forwarding, and Classic VPN.\n* Some products have restrictions on what ports can be used. See\n[port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#port_specifications)\nfor details.\n\nFor external forwarding rules, two or more forwarding rules cannot use the\nsame \u0026#39;[IPAddress, IPProtocol]\u0026#39; pair, and cannot have overlapping\n\u0026#39;portRange\u0026#39;s.\n\nFor internal forwarding rules within the same VPC network, two or more\nforwarding rules cannot use the same \u0026#39;[IPAddress, IPProtocol]\u0026#39; pair, and\ncannot have overlapping \u0026#39;portRange\u0026#39;s.\n\n@pattern: \\d\u0026#43;(?:-\\d\u0026#43;)? When `null`, the `port_range` field will be omitted from the resulting object.\n  - `ports` (`list`): The \u0026#39;ports\u0026#39;, \u0026#39;portRange\u0026#39;, and \u0026#39;allPorts\u0026#39; fields are mutually exclusive.\nOnly packets addressed to ports in the specified range will be forwarded\nto the backends configured with this forwarding rule.\n\nThe \u0026#39;ports\u0026#39; field has the following limitations:\n* It requires that the forwarding rule \u0026#39;IPProtocol\u0026#39; be TCP, UDP, or SCTP,\nand\n* It\u0026#39;s applicable only to the following products: internal passthrough\nNetwork Load Balancers, backend service-based external passthrough Network\nLoad Balancers, and internal protocol forwarding.\n* You can specify a list of up to five ports by number, separated by\ncommas. The ports can be contiguous or discontiguous.\n\nFor external forwarding rules, two or more forwarding rules cannot use the\nsame \u0026#39;[IPAddress, IPProtocol]\u0026#39; pair if they share at least one port\nnumber.\n\nFor internal forwarding rules within the same VPC network, two or more\nforwarding rules cannot use the same \u0026#39;[IPAddress, IPProtocol]\u0026#39; pair if\nthey share at least one port number.\n\n@pattern: \\d\u0026#43;(?:-\\d\u0026#43;)? When `null`, the `ports` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `recreate_closed_psc` (`bool`): This is used in PSC consumer ForwardingRule to make terraform recreate the ForwardingRule when the status is closed When `null`, the `recreate_closed_psc` field will be omitted from the resulting object.\n  - `region` (`string`): A reference to the region where the regional forwarding rule resides.\n\nThis field is not applicable to global forwarding rules. When `null`, the `region` field will be omitted from the resulting object.\n  - `service_label` (`string`): An optional prefix to the service name for this Forwarding Rule.\nIf specified, will be the first label of the fully qualified service\nname.\n\nThe label must be 1-63 characters long, and comply with RFC1035.\nSpecifically, the label must be 1-63 characters long and match the\nregular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the first\ncharacter must be a lowercase letter, and all following characters\nmust be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n\nThis field is only used for INTERNAL load balancing. When `null`, the `service_label` field will be omitted from the resulting object.\n  - `source_ip_ranges` (`list`): If not empty, this Forwarding Rule will only forward the traffic when the source IP address matches one of the IP addresses or CIDR ranges set here. Note that a Forwarding Rule can only have up to 64 source IP ranges, and this field can only be used with a regional Forwarding Rule whose scheme is EXTERNAL. Each sourceIpRange entry should be either an IP address (for example, 1.2.3.4) or a CIDR range (for example, 1.2.3.0/24). When `null`, the `source_ip_ranges` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): This field identifies the subnetwork that the load balanced IP should\nbelong to for this Forwarding Rule, used in internal load balancing and\nnetwork load balancing with IPv6.\n\nIf the network specified is in auto subnet mode, this field is optional.\nHowever, a subnetwork must be specified if the network is in custom subnet\nmode or when creating external forwarding rule with IPv6. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `target` (`string`): The URL of the target resource to receive the matched traffic.  For\nregional forwarding rules, this target must be in the same region as the\nforwarding rule. For global forwarding rules, this target must be a global\nload balancing resource.\n\nThe forwarded traffic must be of a type appropriate to the target object.\n*  For load balancers, see the \u0026#34;Target\u0026#34; column in [Port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#ip_address_specifications).\n*  For Private Service Connect forwarding rules that forward traffic to Google APIs, provide the name of a supported Google API bundle:\n  *  \u0026#39;vpc-sc\u0026#39; - [ APIs that support VPC Service Controls](https://cloud.google.com/vpc-service-controls/docs/supported-products).\n  *  \u0026#39;all-apis\u0026#39; - [All supported Google APIs](https://cloud.google.com/vpc/docs/private-service-connect#supported-apis).\n\n\nFor Private Service Connect forwarding rules that forward traffic to managed services, the target must be a service attachment. When `null`, the `target` field will be omitted from the resulting object.\n  - `service_directory_registrations` (`list[obj]`): Service Directory resources to register this forwarding rule with.\n\nCurrently, only supports a single Service Directory resource. When `null`, the `service_directory_registrations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_forwarding_rule.service_directory_registrations.new](#fn-service_directory_registrationsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_forwarding_rule.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -23,6 +23,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     port_range=null,
     ports=null,
     project=null,
+    recreate_closed_psc=null,
     region=null,
     service_directory_registrations=null,
     service_label=null,
@@ -53,6 +54,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       port_range=port_range,
       ports=ports,
       project=project,
+      recreate_closed_psc=recreate_closed_psc,
       region=region,
       service_directory_registrations=service_directory_registrations,
       service_label=service_label,
@@ -63,7 +65,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_forwarding_rule.newAttrs` constructs a new object with attributes and blocks configured for the `compute_forwarding_rule`\nTerraform resource.\n\nUnlike [google.compute_forwarding_rule.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `all_ports` (`bool`): This field can only be used:\n* If 'IPProtocol' is one of TCP, UDP, or SCTP.\n* By internal TCP/UDP load balancers, backend service-based network load\nbalancers, and internal and external protocol forwarding.\n\nThis option should be set to TRUE when the Forwarding Rule\nIPProtocol is set to L3_DEFAULT.\n\nSet this field to true to allow packets addressed to any port or packets\nlacking destination port information (for example, UDP fragments after the\nfirst fragment) to be forwarded to the backends configured with this\nforwarding rule.\n\nThe 'ports', 'port_range', and\n'allPorts' fields are mutually exclusive. When `null`, the `all_ports` field will be omitted from the resulting object.\n  - `allow_global_access` (`bool`): This field is used along with the 'backend_service' field for\ninternal load balancing or with the 'target' field for internal\nTargetInstance.\n\nIf the field is set to 'TRUE', clients can access ILB from all\nregions.\n\nOtherwise only allows access from clients in the same region as the\ninternal load balancer. When `null`, the `allow_global_access` field will be omitted from the resulting object.\n  - `allow_psc_global_access` (`bool`): This is used in PSC consumer ForwardingRule to control whether the PSC endpoint can be accessed from another region. When `null`, the `allow_psc_global_access` field will be omitted from the resulting object.\n  - `backend_service` (`string`): Identifies the backend service to which the forwarding rule sends traffic.\n\nRequired for Internal TCP/UDP Load Balancing and Network Load Balancing;\nmust be omitted for all other load balancer types. When `null`, the `backend_service` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `ip_address` (`string`): IP address for which this forwarding rule accepts traffic. When a client\nsends traffic to this IP address, the forwarding rule directs the traffic\nto the referenced 'target' or 'backendService'.\n\nWhile creating a forwarding rule, specifying an 'IPAddress' is\nrequired under the following circumstances:\n\n* When the 'target' is set to 'targetGrpcProxy' and\n'validateForProxyless' is set to 'true', the\n'IPAddress' should be set to '0.0.0.0'.\n* When the 'target' is a Private Service Connect Google APIs\nbundle, you must specify an 'IPAddress'.\n\n\nOtherwise, you can optionally specify an IP address that references an\nexisting static (reserved) IP address resource. When omitted, Google Cloud\nassigns an ephemeral IP address.\n\nUse one of the following formats to specify an IP address while creating a\nforwarding rule:\n\n* IP address number, as in '100.1.2.3'\n* IPv6 address range, as in '2600:1234::/96'\n* Full resource URL, as in\n'https://www.googleapis.com/compute/v1/projects/project_id/regions/region/addresses/address-name'\n* Partial URL or by name, as in:\n  * 'projects/project_id/regions/region/addresses/address-name'\n  * 'regions/region/addresses/address-name'\n  * 'global/addresses/address-name'\n  * 'address-name'\n\n\nThe forwarding rule's 'target' or 'backendService',\nand in most cases, also the 'loadBalancingScheme', determine the\ntype of IP address that you can use. For detailed information, see\n[IP address\nspecifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#ip_address_specifications).\n\nWhen reading an 'IPAddress', the API always returns the IP\naddress number. When `null`, the `ip_address` field will be omitted from the resulting object.\n  - `ip_protocol` (`string`): The IP protocol to which this rule applies.\n\nFor protocol forwarding, valid\noptions are 'TCP', 'UDP', 'ESP',\n'AH', 'SCTP', 'ICMP' and\n'L3_DEFAULT'.\n\nThe valid IP protocols are different for different load balancing products\nas described in [Load balancing\nfeatures](https://cloud.google.com/load-balancing/docs/features#protocols_from_the_load_balancer_to_the_backends).\n\nA Forwarding Rule with protocol L3_DEFAULT can attach with target instance or\nbackend service with UNSPECIFIED protocol.\nA forwarding rule with "L3_DEFAULT" IPProtocal cannot be attached to a backend service with TCP or UDP. Possible values: ["TCP", "UDP", "ESP", "AH", "SCTP", "ICMP", "L3_DEFAULT"] When `null`, the `ip_protocol` field will be omitted from the resulting object.\n  - `ip_version` (`string`): The IP address version that will be used by this forwarding rule.\nValid options are IPV4 and IPV6.\n\nIf not set, the IPv4 address will be used by default. Possible values: ["IPV4", "IPV6"] When `null`, the `ip_version` field will be omitted from the resulting object.\n  - `is_mirroring_collector` (`bool`): Indicates whether or not this load balancer can be used as a collector for\npacket mirroring. To prevent mirroring loops, instances behind this\nload balancer will not have their traffic mirrored even if a\n'PacketMirroring' rule applies to them.\n\nThis can only be set to true for load balancers that have their\n'loadBalancingScheme' set to 'INTERNAL'. When `null`, the `is_mirroring_collector` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this forwarding rule.  A list of key->value pairs. When `null`, the `labels` field will be omitted from the resulting object.\n  - `load_balancing_scheme` (`string`): Specifies the forwarding rule type.\n\nFor more information about forwarding rules, refer to\n[Forwarding rule concepts](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts). Default value: "EXTERNAL" Possible values: ["EXTERNAL", "EXTERNAL_MANAGED", "INTERNAL", "INTERNAL_MANAGED"] When `null`, the `load_balancing_scheme` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-63 characters long, and comply with\n[RFC1035](https://www.ietf.org/rfc/rfc1035.txt).\n\nSpecifically, the name must be 1-63 characters long and match the regular\nexpression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the first\ncharacter must be a lowercase letter, and all following characters must\nbe a dash, lowercase letter, or digit, except the last character, which\ncannot be a dash.\n\nFor Private Service Connect forwarding rules that forward traffic to Google\nAPIs, the forwarding rule name must be a 1-20 characters string with\nlowercase letters and numbers and must start with a letter.\n  - `network` (`string`): This field is not used for external load balancing.\n\nFor Internal TCP/UDP Load Balancing, this field identifies the network that\nthe load balanced IP should belong to for this Forwarding Rule.\nIf the subnetwork is specified, the network of the subnetwork will be used.\nIf neither subnetwork nor this field is specified, the default network will\nbe used.\n\nFor Private Service Connect forwarding rules that forward traffic to Google\nAPIs, a network must be provided. When `null`, the `network` field will be omitted from the resulting object.\n  - `network_tier` (`string`): This signifies the networking tier used for configuring\nthis load balancer and can only take the following values:\n'PREMIUM', 'STANDARD'.\n\nFor regional ForwardingRule, the valid values are 'PREMIUM' and\n'STANDARD'. For GlobalForwardingRule, the valid value is\n'PREMIUM'.\n\nIf this field is not specified, it is assumed to be 'PREMIUM'.\nIf 'IPAddress' is specified, this value must be equal to the\nnetworkTier of the Address. Possible values: ["PREMIUM", "STANDARD"] When `null`, the `network_tier` field will be omitted from the resulting object.\n  - `no_automate_dns_zone` (`bool`): This is used in PSC consumer ForwardingRule to control whether it should try to auto-generate a DNS zone or not. Non-PSC forwarding rules do not use this field. When `null`, the `no_automate_dns_zone` field will be omitted from the resulting object.\n  - `port_range` (`string`): This field can only be used:\n\n* If 'IPProtocol' is one of TCP, UDP, or SCTP.\n* By backend service-based network load balancers, target pool-based\nnetwork load balancers, internal proxy load balancers, external proxy load\nbalancers, Traffic Director, external protocol forwarding, and Classic VPN.\nSome products have restrictions on what ports can be used. See\n[port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#port_specifications)\nfor details.\n\n\nOnly packets addressed to ports in the specified range will be forwarded to\nthe backends configured with this forwarding rule.\n\nThe 'ports' and 'port_range' fields are mutually exclusive.\n\nFor external forwarding rules, two or more forwarding rules cannot use the\nsame '[IPAddress, IPProtocol]' pair, and cannot have\noverlapping 'portRange's.\n\nFor internal forwarding rules within the same VPC network, two or more\nforwarding rules cannot use the same '[IPAddress, IPProtocol]'\npair, and cannot have overlapping 'portRange's. When `null`, the `port_range` field will be omitted from the resulting object.\n  - `ports` (`list`): This field can only be used:\n\n* If 'IPProtocol' is one of TCP, UDP, or SCTP.\n* By internal TCP/UDP load balancers, backend service-based network load\nbalancers, internal protocol forwarding and when protocol is not L3_DEFAULT.\n\n\nYou can specify a list of up to five ports by number, separated by commas.\nThe ports can be contiguous or discontiguous. Only packets addressed to\nthese ports will be forwarded to the backends configured with this\nforwarding rule.\n\nFor external forwarding rules, two or more forwarding rules cannot use the\nsame '[IPAddress, IPProtocol]' pair, and cannot share any values\ndefined in 'ports'.\n\nFor internal forwarding rules within the same VPC network, two or more\nforwarding rules cannot use the same '[IPAddress, IPProtocol]'\npair, and cannot share any values defined in 'ports'.\n\nThe 'ports' and 'port_range' fields are mutually exclusive. When `null`, the `ports` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): A reference to the region where the regional forwarding rule resides.\n\nThis field is not applicable to global forwarding rules. When `null`, the `region` field will be omitted from the resulting object.\n  - `service_label` (`string`): An optional prefix to the service name for this Forwarding Rule.\nIf specified, will be the first label of the fully qualified service\nname.\n\nThe label must be 1-63 characters long, and comply with RFC1035.\nSpecifically, the label must be 1-63 characters long and match the\nregular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the first\ncharacter must be a lowercase letter, and all following characters\nmust be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n\nThis field is only used for INTERNAL load balancing. When `null`, the `service_label` field will be omitted from the resulting object.\n  - `source_ip_ranges` (`list`): If not empty, this Forwarding Rule will only forward the traffic when the source IP address matches one of the IP addresses or CIDR ranges set here. Note that a Forwarding Rule can only have up to 64 source IP ranges, and this field can only be used with a regional Forwarding Rule whose scheme is EXTERNAL. Each sourceIpRange entry should be either an IP address (for example, 1.2.3.4) or a CIDR range (for example, 1.2.3.0/24). When `null`, the `source_ip_ranges` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): This field identifies the subnetwork that the load balanced IP should\nbelong to for this Forwarding Rule, used in internal load balancing and\nnetwork load balancing with IPv6.\n\nIf the network specified is in auto subnet mode, this field is optional.\nHowever, a subnetwork must be specified if the network is in custom subnet\nmode or when creating external forwarding rule with IPv6. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `target` (`string`): The URL of the target resource to receive the matched traffic.  For\nregional forwarding rules, this target must be in the same region as the\nforwarding rule. For global forwarding rules, this target must be a global\nload balancing resource.\n\nThe forwarded traffic must be of a type appropriate to the target object.\n*  For load balancers, see the "Target" column in [Port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#ip_address_specifications).\n*  For Private Service Connect forwarding rules that forward traffic to Google APIs, provide the name of a supported Google API bundle:\n  *  'vpc-sc' - [ APIs that support VPC Service Controls](https://cloud.google.com/vpc-service-controls/docs/supported-products).\n  *  'all-apis' - [All supported Google APIs](https://cloud.google.com/vpc/docs/private-service-connect#supported-apis).\n\n\nFor Private Service Connect forwarding rules that forward traffic to managed services, the target must be a service attachment. When `null`, the `target` field will be omitted from the resulting object.\n  - `service_directory_registrations` (`list[obj]`): Service Directory resources to register this forwarding rule with.\n\nCurrently, only supports a single Service Directory resource. When `null`, the `service_directory_registrations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_forwarding_rule.service_directory_registrations.new](#fn-service_directory_registrationsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_forwarding_rule.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_forwarding_rule` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_forwarding_rule.newAttrs` constructs a new object with attributes and blocks configured for the `compute_forwarding_rule`\nTerraform resource.\n\nUnlike [google.compute_forwarding_rule.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `all_ports` (`bool`): The 'ports', 'portRange', and 'allPorts' fields are mutually exclusive.\nOnly packets addressed to ports in the specified range will be forwarded\nto the backends configured with this forwarding rule.\n\nThe 'allPorts' field has the following limitations:\n* It requires that the forwarding rule 'IPProtocol' be TCP, UDP, SCTP, or\nL3_DEFAULT.\n* It's applicable only to the following products: internal passthrough\nNetwork Load Balancers, backend service-based external passthrough Network\nLoad Balancers, and internal and external protocol forwarding.\n* Set this field to true to allow packets addressed to any port or packets\nlacking destination port information (for example, UDP fragments after the\nfirst fragment) to be forwarded to the backends configured with this\nforwarding rule. The L3_DEFAULT protocol requires 'allPorts' be set to\ntrue. When `null`, the `all_ports` field will be omitted from the resulting object.\n  - `allow_global_access` (`bool`): This field is used along with the 'backend_service' field for\ninternal load balancing or with the 'target' field for internal\nTargetInstance.\n\nIf the field is set to 'TRUE', clients can access ILB from all\nregions.\n\nOtherwise only allows access from clients in the same region as the\ninternal load balancer. When `null`, the `allow_global_access` field will be omitted from the resulting object.\n  - `allow_psc_global_access` (`bool`): This is used in PSC consumer ForwardingRule to control whether the PSC endpoint can be accessed from another region. When `null`, the `allow_psc_global_access` field will be omitted from the resulting object.\n  - `backend_service` (`string`): Identifies the backend service to which the forwarding rule sends traffic.\n\nRequired for Internal TCP/UDP Load Balancing and Network Load Balancing;\nmust be omitted for all other load balancer types. When `null`, the `backend_service` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `ip_address` (`string`): IP address for which this forwarding rule accepts traffic. When a client\nsends traffic to this IP address, the forwarding rule directs the traffic\nto the referenced 'target' or 'backendService'.\n\nWhile creating a forwarding rule, specifying an 'IPAddress' is\nrequired under the following circumstances:\n\n* When the 'target' is set to 'targetGrpcProxy' and\n'validateForProxyless' is set to 'true', the\n'IPAddress' should be set to '0.0.0.0'.\n* When the 'target' is a Private Service Connect Google APIs\nbundle, you must specify an 'IPAddress'.\n\n\nOtherwise, you can optionally specify an IP address that references an\nexisting static (reserved) IP address resource. When omitted, Google Cloud\nassigns an ephemeral IP address.\n\nUse one of the following formats to specify an IP address while creating a\nforwarding rule:\n\n* IP address number, as in '100.1.2.3'\n* IPv6 address range, as in '2600:1234::/96'\n* Full resource URL, as in\n'https://www.googleapis.com/compute/v1/projects/project_id/regions/region/addresses/address-name'\n* Partial URL or by name, as in:\n  * 'projects/project_id/regions/region/addresses/address-name'\n  * 'regions/region/addresses/address-name'\n  * 'global/addresses/address-name'\n  * 'address-name'\n\n\nThe forwarding rule's 'target' or 'backendService',\nand in most cases, also the 'loadBalancingScheme', determine the\ntype of IP address that you can use. For detailed information, see\n[IP address\nspecifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#ip_address_specifications).\n\nWhen reading an 'IPAddress', the API always returns the IP\naddress number. When `null`, the `ip_address` field will be omitted from the resulting object.\n  - `ip_protocol` (`string`): The IP protocol to which this rule applies.\n\nFor protocol forwarding, valid\noptions are 'TCP', 'UDP', 'ESP',\n'AH', 'SCTP', 'ICMP' and\n'L3_DEFAULT'.\n\nThe valid IP protocols are different for different load balancing products\nas described in [Load balancing\nfeatures](https://cloud.google.com/load-balancing/docs/features#protocols_from_the_load_balancer_to_the_backends).\n\nA Forwarding Rule with protocol L3_DEFAULT can attach with target instance or\nbackend service with UNSPECIFIED protocol.\nA forwarding rule with "L3_DEFAULT" IPProtocal cannot be attached to a backend service with TCP or UDP. Possible values: ["TCP", "UDP", "ESP", "AH", "SCTP", "ICMP", "L3_DEFAULT"] When `null`, the `ip_protocol` field will be omitted from the resulting object.\n  - `ip_version` (`string`): The IP address version that will be used by this forwarding rule.\nValid options are IPV4 and IPV6.\n\nIf not set, the IPv4 address will be used by default. Possible values: ["IPV4", "IPV6"] When `null`, the `ip_version` field will be omitted from the resulting object.\n  - `is_mirroring_collector` (`bool`): Indicates whether or not this load balancer can be used as a collector for\npacket mirroring. To prevent mirroring loops, instances behind this\nload balancer will not have their traffic mirrored even if a\n'PacketMirroring' rule applies to them.\n\nThis can only be set to true for load balancers that have their\n'loadBalancingScheme' set to 'INTERNAL'. When `null`, the `is_mirroring_collector` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this forwarding rule.  A list of key->value pairs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `load_balancing_scheme` (`string`): Specifies the forwarding rule type.\n\nFor more information about forwarding rules, refer to\n[Forwarding rule concepts](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts). Default value: "EXTERNAL" Possible values: ["EXTERNAL", "EXTERNAL_MANAGED", "INTERNAL", "INTERNAL_MANAGED"] When `null`, the `load_balancing_scheme` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-63 characters long, and comply with\n[RFC1035](https://www.ietf.org/rfc/rfc1035.txt).\n\nSpecifically, the name must be 1-63 characters long and match the regular\nexpression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the first\ncharacter must be a lowercase letter, and all following characters must\nbe a dash, lowercase letter, or digit, except the last character, which\ncannot be a dash.\n\nFor Private Service Connect forwarding rules that forward traffic to Google\nAPIs, the forwarding rule name must be a 1-20 characters string with\nlowercase letters and numbers and must start with a letter.\n  - `network` (`string`): This field is not used for external load balancing.\n\nFor Internal TCP/UDP Load Balancing, this field identifies the network that\nthe load balanced IP should belong to for this Forwarding Rule.\nIf the subnetwork is specified, the network of the subnetwork will be used.\nIf neither subnetwork nor this field is specified, the default network will\nbe used.\n\nFor Private Service Connect forwarding rules that forward traffic to Google\nAPIs, a network must be provided. When `null`, the `network` field will be omitted from the resulting object.\n  - `network_tier` (`string`): This signifies the networking tier used for configuring\nthis load balancer and can only take the following values:\n'PREMIUM', 'STANDARD'.\n\nFor regional ForwardingRule, the valid values are 'PREMIUM' and\n'STANDARD'. For GlobalForwardingRule, the valid value is\n'PREMIUM'.\n\nIf this field is not specified, it is assumed to be 'PREMIUM'.\nIf 'IPAddress' is specified, this value must be equal to the\nnetworkTier of the Address. Possible values: ["PREMIUM", "STANDARD"] When `null`, the `network_tier` field will be omitted from the resulting object.\n  - `no_automate_dns_zone` (`bool`): This is used in PSC consumer ForwardingRule to control whether it should try to auto-generate a DNS zone or not. Non-PSC forwarding rules do not use this field. When `null`, the `no_automate_dns_zone` field will be omitted from the resulting object.\n  - `port_range` (`string`): The 'ports', 'portRange', and 'allPorts' fields are mutually exclusive.\nOnly packets addressed to ports in the specified range will be forwarded\nto the backends configured with this forwarding rule.\n\nThe 'portRange' field has the following limitations:\n* It requires that the forwarding rule 'IPProtocol' be TCP, UDP, or SCTP,\nand\n* It's applicable only to the following products: external passthrough\nNetwork Load Balancers, internal and external proxy Network Load\nBalancers, internal and external Application Load Balancers, external\nprotocol forwarding, and Classic VPN.\n* Some products have restrictions on what ports can be used. See\n[port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#port_specifications)\nfor details.\n\nFor external forwarding rules, two or more forwarding rules cannot use the\nsame '[IPAddress, IPProtocol]' pair, and cannot have overlapping\n'portRange's.\n\nFor internal forwarding rules within the same VPC network, two or more\nforwarding rules cannot use the same '[IPAddress, IPProtocol]' pair, and\ncannot have overlapping 'portRange's.\n\n@pattern: \\d+(?:-\\d+)? When `null`, the `port_range` field will be omitted from the resulting object.\n  - `ports` (`list`): The 'ports', 'portRange', and 'allPorts' fields are mutually exclusive.\nOnly packets addressed to ports in the specified range will be forwarded\nto the backends configured with this forwarding rule.\n\nThe 'ports' field has the following limitations:\n* It requires that the forwarding rule 'IPProtocol' be TCP, UDP, or SCTP,\nand\n* It's applicable only to the following products: internal passthrough\nNetwork Load Balancers, backend service-based external passthrough Network\nLoad Balancers, and internal protocol forwarding.\n* You can specify a list of up to five ports by number, separated by\ncommas. The ports can be contiguous or discontiguous.\n\nFor external forwarding rules, two or more forwarding rules cannot use the\nsame '[IPAddress, IPProtocol]' pair if they share at least one port\nnumber.\n\nFor internal forwarding rules within the same VPC network, two or more\nforwarding rules cannot use the same '[IPAddress, IPProtocol]' pair if\nthey share at least one port number.\n\n@pattern: \\d+(?:-\\d+)? When `null`, the `ports` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `recreate_closed_psc` (`bool`): This is used in PSC consumer ForwardingRule to make terraform recreate the ForwardingRule when the status is closed When `null`, the `recreate_closed_psc` field will be omitted from the resulting object.\n  - `region` (`string`): A reference to the region where the regional forwarding rule resides.\n\nThis field is not applicable to global forwarding rules. When `null`, the `region` field will be omitted from the resulting object.\n  - `service_label` (`string`): An optional prefix to the service name for this Forwarding Rule.\nIf specified, will be the first label of the fully qualified service\nname.\n\nThe label must be 1-63 characters long, and comply with RFC1035.\nSpecifically, the label must be 1-63 characters long and match the\nregular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the first\ncharacter must be a lowercase letter, and all following characters\nmust be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n\nThis field is only used for INTERNAL load balancing. When `null`, the `service_label` field will be omitted from the resulting object.\n  - `source_ip_ranges` (`list`): If not empty, this Forwarding Rule will only forward the traffic when the source IP address matches one of the IP addresses or CIDR ranges set here. Note that a Forwarding Rule can only have up to 64 source IP ranges, and this field can only be used with a regional Forwarding Rule whose scheme is EXTERNAL. Each sourceIpRange entry should be either an IP address (for example, 1.2.3.4) or a CIDR range (for example, 1.2.3.0/24). When `null`, the `source_ip_ranges` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): This field identifies the subnetwork that the load balanced IP should\nbelong to for this Forwarding Rule, used in internal load balancing and\nnetwork load balancing with IPv6.\n\nIf the network specified is in auto subnet mode, this field is optional.\nHowever, a subnetwork must be specified if the network is in custom subnet\nmode or when creating external forwarding rule with IPv6. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `target` (`string`): The URL of the target resource to receive the matched traffic.  For\nregional forwarding rules, this target must be in the same region as the\nforwarding rule. For global forwarding rules, this target must be a global\nload balancing resource.\n\nThe forwarded traffic must be of a type appropriate to the target object.\n*  For load balancers, see the "Target" column in [Port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#ip_address_specifications).\n*  For Private Service Connect forwarding rules that forward traffic to Google APIs, provide the name of a supported Google API bundle:\n  *  'vpc-sc' - [ APIs that support VPC Service Controls](https://cloud.google.com/vpc-service-controls/docs/supported-products).\n  *  'all-apis' - [All supported Google APIs](https://cloud.google.com/vpc/docs/private-service-connect#supported-apis).\n\n\nFor Private Service Connect forwarding rules that forward traffic to managed services, the target must be a service attachment. When `null`, the `target` field will be omitted from the resulting object.\n  - `service_directory_registrations` (`list[obj]`): Service Directory resources to register this forwarding rule with.\n\nCurrently, only supports a single Service Directory resource. When `null`, the `service_directory_registrations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_forwarding_rule.service_directory_registrations.new](#fn-service_directory_registrationsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_forwarding_rule.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_forwarding_rule` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     all_ports=null,
@@ -83,6 +85,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     port_range=null,
     ports=null,
     project=null,
+    recreate_closed_psc=null,
     region=null,
     service_directory_registrations=null,
     service_label=null,
@@ -109,6 +112,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     port_range: port_range,
     ports: ports,
     project: project,
+    recreate_closed_psc: recreate_closed_psc,
     region: region,
     service_directory_registrations: service_directory_registrations,
     service_label: service_label,
@@ -319,6 +323,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withRecreateClosedPsc':: d.fn(help='`google.bool.withRecreateClosedPsc` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the recreate_closed_psc field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `recreate_closed_psc` field.\n', args=[]),
+  withRecreateClosedPsc(resourceLabel, value): {
+    resource+: {
+      google_compute_forwarding_rule+: {
+        [resourceLabel]+: {
+          recreate_closed_psc: value,
+        },
+      },
+    },
+  },
   '#withRegion':: d.fn(help='`google.string.withRegion` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the region field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `region` field.\n', args=[]),
   withRegion(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/compute_global_forwarding_rule.libsonnet b/4.x/_gen/resources/compute_global_forwarding_rule.libsonnet
index 83b592b9..dd202105 100644
--- a/4.x/_gen/resources/compute_global_forwarding_rule.libsonnet
+++ b/4.x/_gen/resources/compute_global_forwarding_rule.libsonnet
@@ -22,7 +22,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       filter_match_criteria: filter_match_criteria,
     }),
   },
-  '#new':: d.fn(help="\n`google.compute_global_forwarding_rule.new` injects a new `google_compute_global_forwarding_rule` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_global_forwarding_rule.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_global_forwarding_rule` using the reference:\n\n    $._ref.google_compute_global_forwarding_rule.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_global_forwarding_rule.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `ip_address` (`string`): IP address for which this forwarding rule accepts traffic. When a client\nsends traffic to this IP address, the forwarding rule directs the traffic\nto the referenced \u0026#39;target\u0026#39;.\n\nWhile creating a forwarding rule, specifying an \u0026#39;IPAddress\u0026#39; is\nrequired under the following circumstances:\n\n* When the \u0026#39;target\u0026#39; is set to \u0026#39;targetGrpcProxy\u0026#39; and\n\u0026#39;validateForProxyless\u0026#39; is set to \u0026#39;true\u0026#39;, the\n\u0026#39;IPAddress\u0026#39; should be set to \u0026#39;0.0.0.0\u0026#39;.\n* When the \u0026#39;target\u0026#39; is a Private Service Connect Google APIs\nbundle, you must specify an \u0026#39;IPAddress\u0026#39;.\n\n\nOtherwise, you can optionally specify an IP address that references an\nexisting static (reserved) IP address resource. When omitted, Google Cloud\nassigns an ephemeral IP address.\n\nUse one of the following formats to specify an IP address while creating a\nforwarding rule:\n\n* IP address number, as in \u0026#39;100.1.2.3\u0026#39;\n* IPv6 address range, as in \u0026#39;2600:1234::/96\u0026#39;\n* Full resource URL, as in\n\u0026#39;https://www.googleapis.com/compute/v1/projects/project_id/regions/region/addresses/address-name\u0026#39;\n* Partial URL or by name, as in:\n  * \u0026#39;projects/project_id/regions/region/addresses/address-name\u0026#39;\n  * \u0026#39;regions/region/addresses/address-name\u0026#39;\n  * \u0026#39;global/addresses/address-name\u0026#39;\n  * \u0026#39;address-name\u0026#39;\n\n\nThe forwarding rule\u0026#39;s \u0026#39;target\u0026#39;,\nand in most cases, also the \u0026#39;loadBalancingScheme\u0026#39;, determine the\ntype of IP address that you can use. For detailed information, see\n[IP address\nspecifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#ip_address_specifications).\n\nWhen reading an \u0026#39;IPAddress\u0026#39;, the API always returns the IP\naddress number. When `null`, the `ip_address` field will be omitted from the resulting object.\n  - `ip_protocol` (`string`): The IP protocol to which this rule applies.\n\nFor protocol forwarding, valid\noptions are \u0026#39;TCP\u0026#39;, \u0026#39;UDP\u0026#39;, \u0026#39;ESP\u0026#39;,\n\u0026#39;AH\u0026#39;, \u0026#39;SCTP\u0026#39;, \u0026#39;ICMP\u0026#39; and\n\u0026#39;L3_DEFAULT\u0026#39;.\n\nThe valid IP protocols are different for different load balancing products\nas described in [Load balancing\nfeatures](https://cloud.google.com/load-balancing/docs/features#protocols_from_the_load_balancer_to_the_backends). Possible values: [\u0026#34;TCP\u0026#34;, \u0026#34;UDP\u0026#34;, \u0026#34;ESP\u0026#34;, \u0026#34;AH\u0026#34;, \u0026#34;SCTP\u0026#34;, \u0026#34;ICMP\u0026#34;] When `null`, the `ip_protocol` field will be omitted from the resulting object.\n  - `ip_version` (`string`): The IP Version that will be used by this global forwarding rule. Possible values: [\u0026#34;IPV4\u0026#34;, \u0026#34;IPV6\u0026#34;] When `null`, the `ip_version` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this forwarding rule.  A list of key-\u0026gt;value pairs. When `null`, the `labels` field will be omitted from the resulting object.\n  - `load_balancing_scheme` (`string`): Specifies the forwarding rule type.\n\nFor more information about forwarding rules, refer to\n[Forwarding rule concepts](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts). Default value: \u0026#34;EXTERNAL\u0026#34; Possible values: [\u0026#34;EXTERNAL\u0026#34;, \u0026#34;EXTERNAL_MANAGED\u0026#34;, \u0026#34;INTERNAL_MANAGED\u0026#34;, \u0026#34;INTERNAL_SELF_MANAGED\u0026#34;] When `null`, the `load_balancing_scheme` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-63 characters long, and comply with\n[RFC1035](https://www.ietf.org/rfc/rfc1035.txt).\n\nSpecifically, the name must be 1-63 characters long and match the regular\nexpression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the first\ncharacter must be a lowercase letter, and all following characters must\nbe a dash, lowercase letter, or digit, except the last character, which\ncannot be a dash.\n\nFor Private Service Connect forwarding rules that forward traffic to Google\nAPIs, the forwarding rule name must be a 1-20 characters string with\nlowercase letters and numbers and must start with a letter.\n  - `network` (`string`): This field is not used for external load balancing.\n\nFor Internal TCP/UDP Load Balancing, this field identifies the network that\nthe load balanced IP should belong to for this Forwarding Rule.\nIf the subnetwork is specified, the network of the subnetwork will be used.\nIf neither subnetwork nor this field is specified, the default network will\nbe used.\n\nFor Private Service Connect forwarding rules that forward traffic to Google\nAPIs, a network must be provided. When `null`, the `network` field will be omitted from the resulting object.\n  - `no_automate_dns_zone` (`bool`): This is used in PSC consumer ForwardingRule to control whether it should try to auto-generate a DNS zone or not. Non-PSC forwarding rules do not use this field. When `null`, the `no_automate_dns_zone` field will be omitted from the resulting object.\n  - `port_range` (`string`): This field can only be used:\n\n* If \u0026#39;IPProtocol\u0026#39; is one of TCP, UDP, or SCTP.\n* By backend service-based network load balancers, target pool-based\nnetwork load balancers, internal proxy load balancers, external proxy load\nbalancers, Traffic Director, external protocol forwarding, and Classic VPN.\nSome products have restrictions on what ports can be used. See\n[port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#port_specifications)\nfor details.\n\n\n* TargetHttpProxy: 80, 8080\n* TargetHttpsProxy: 443\n* TargetTcpProxy: 25, 43, 110, 143, 195, 443, 465, 587, 700, 993, 995,\n                  1883, 5222\n* TargetSslProxy: 25, 43, 110, 143, 195, 443, 465, 587, 700, 993, 995,\n                  1883, 5222\n* TargetVpnGateway: 500, 4500 When `null`, the `port_range` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `source_ip_ranges` (`list`): If not empty, this Forwarding Rule will only forward the traffic when the source IP address matches one of the IP addresses or CIDR ranges set here. Note that a Forwarding Rule can only have up to 64 source IP ranges, and this field can only be used with a regional Forwarding Rule whose scheme is EXTERNAL. Each sourceIpRange entry should be either an IP address (for example, 1.2.3.4) or a CIDR range (for example, 1.2.3.0/24). When `null`, the `source_ip_ranges` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): This field identifies the subnetwork that the load balanced IP should\nbelong to for this Forwarding Rule, used in internal load balancing and\nnetwork load balancing with IPv6.\n\nIf the network specified is in auto subnet mode, this field is optional.\nHowever, a subnetwork must be specified if the network is in custom subnet\nmode or when creating external forwarding rule with IPv6. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `target` (`string`): The URL of the target resource to receive the matched traffic.  For\nregional forwarding rules, this target must be in the same region as the\nforwarding rule. For global forwarding rules, this target must be a global\nload balancing resource.\n\nThe forwarded traffic must be of a type appropriate to the target object.\n*  For load balancers, see the \u0026#34;Target\u0026#34; column in [Port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#ip_address_specifications).\n*  For Private Service Connect forwarding rules that forward traffic to Google APIs, provide the name of a supported Google API bundle:\n  *  \u0026#39;vpc-sc\u0026#39; - [ APIs that support VPC Service Controls](https://cloud.google.com/vpc-service-controls/docs/supported-products).\n  *  \u0026#39;all-apis\u0026#39; - [All supported Google APIs](https://cloud.google.com/vpc/docs/private-service-connect#supported-apis).\n\n\nFor Private Service Connect forwarding rules that forward traffic to managed services, the target must be a service attachment.\n  - `metadata_filters` (`list[obj]`): Opaque filter criteria used by Loadbalancer to restrict routing\nconfiguration to a limited set xDS compliant clients. In their xDS\nrequests to Loadbalancer, xDS clients present node metadata. If a\nmatch takes place, the relevant routing configuration is made available\nto those proxies.\n\nFor each metadataFilter in this list, if its filterMatchCriteria is set\nto MATCH_ANY, at least one of the filterLabels must match the\ncorresponding label provided in the metadata. If its filterMatchCriteria\nis set to MATCH_ALL, then all of its filterLabels must match with\ncorresponding labels in the provided metadata.\n\nmetadataFilters specified here can be overridden by those specified in\nthe UrlMap that this ForwardingRule references.\n\nmetadataFilters only applies to Loadbalancers that have their\nloadBalancingScheme set to INTERNAL_SELF_MANAGED. When `null`, the `metadata_filters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_global_forwarding_rule.metadata_filters.new](#fn-metadata_filtersnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_global_forwarding_rule.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_global_forwarding_rule.new` injects a new `google_compute_global_forwarding_rule` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_global_forwarding_rule.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_global_forwarding_rule` using the reference:\n\n    $._ref.google_compute_global_forwarding_rule.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_global_forwarding_rule.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `ip_address` (`string`): IP address for which this forwarding rule accepts traffic. When a client\nsends traffic to this IP address, the forwarding rule directs the traffic\nto the referenced \u0026#39;target\u0026#39;.\n\nWhile creating a forwarding rule, specifying an \u0026#39;IPAddress\u0026#39; is\nrequired under the following circumstances:\n\n* When the \u0026#39;target\u0026#39; is set to \u0026#39;targetGrpcProxy\u0026#39; and\n\u0026#39;validateForProxyless\u0026#39; is set to \u0026#39;true\u0026#39;, the\n\u0026#39;IPAddress\u0026#39; should be set to \u0026#39;0.0.0.0\u0026#39;.\n* When the \u0026#39;target\u0026#39; is a Private Service Connect Google APIs\nbundle, you must specify an \u0026#39;IPAddress\u0026#39;.\n\n\nOtherwise, you can optionally specify an IP address that references an\nexisting static (reserved) IP address resource. When omitted, Google Cloud\nassigns an ephemeral IP address.\n\nUse one of the following formats to specify an IP address while creating a\nforwarding rule:\n\n* IP address number, as in \u0026#39;100.1.2.3\u0026#39;\n* IPv6 address range, as in \u0026#39;2600:1234::/96\u0026#39;\n* Full resource URL, as in\n\u0026#39;https://www.googleapis.com/compute/v1/projects/project_id/regions/region/addresses/address-name\u0026#39;\n* Partial URL or by name, as in:\n  * \u0026#39;projects/project_id/regions/region/addresses/address-name\u0026#39;\n  * \u0026#39;regions/region/addresses/address-name\u0026#39;\n  * \u0026#39;global/addresses/address-name\u0026#39;\n  * \u0026#39;address-name\u0026#39;\n\n\nThe forwarding rule\u0026#39;s \u0026#39;target\u0026#39;,\nand in most cases, also the \u0026#39;loadBalancingScheme\u0026#39;, determine the\ntype of IP address that you can use. For detailed information, see\n[IP address\nspecifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#ip_address_specifications).\n\nWhen reading an \u0026#39;IPAddress\u0026#39;, the API always returns the IP\naddress number. When `null`, the `ip_address` field will be omitted from the resulting object.\n  - `ip_protocol` (`string`): The IP protocol to which this rule applies.\n\nFor protocol forwarding, valid\noptions are \u0026#39;TCP\u0026#39;, \u0026#39;UDP\u0026#39;, \u0026#39;ESP\u0026#39;,\n\u0026#39;AH\u0026#39;, \u0026#39;SCTP\u0026#39;, \u0026#39;ICMP\u0026#39; and\n\u0026#39;L3_DEFAULT\u0026#39;.\n\nThe valid IP protocols are different for different load balancing products\nas described in [Load balancing\nfeatures](https://cloud.google.com/load-balancing/docs/features#protocols_from_the_load_balancer_to_the_backends). Possible values: [\u0026#34;TCP\u0026#34;, \u0026#34;UDP\u0026#34;, \u0026#34;ESP\u0026#34;, \u0026#34;AH\u0026#34;, \u0026#34;SCTP\u0026#34;, \u0026#34;ICMP\u0026#34;] When `null`, the `ip_protocol` field will be omitted from the resulting object.\n  - `ip_version` (`string`): The IP Version that will be used by this global forwarding rule. Possible values: [\u0026#34;IPV4\u0026#34;, \u0026#34;IPV6\u0026#34;] When `null`, the `ip_version` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this forwarding rule.  A list of key-\u0026gt;value pairs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `load_balancing_scheme` (`string`): Specifies the forwarding rule type.\n\nFor more information about forwarding rules, refer to\n[Forwarding rule concepts](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts). Default value: \u0026#34;EXTERNAL\u0026#34; Possible values: [\u0026#34;EXTERNAL\u0026#34;, \u0026#34;EXTERNAL_MANAGED\u0026#34;, \u0026#34;INTERNAL_MANAGED\u0026#34;, \u0026#34;INTERNAL_SELF_MANAGED\u0026#34;] When `null`, the `load_balancing_scheme` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-63 characters long, and comply with\n[RFC1035](https://www.ietf.org/rfc/rfc1035.txt).\n\nSpecifically, the name must be 1-63 characters long and match the regular\nexpression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the first\ncharacter must be a lowercase letter, and all following characters must\nbe a dash, lowercase letter, or digit, except the last character, which\ncannot be a dash.\n\nFor Private Service Connect forwarding rules that forward traffic to Google\nAPIs, the forwarding rule name must be a 1-20 characters string with\nlowercase letters and numbers and must start with a letter.\n  - `network` (`string`): This field is not used for external load balancing.\n\nFor Internal TCP/UDP Load Balancing, this field identifies the network that\nthe load balanced IP should belong to for this Forwarding Rule.\nIf the subnetwork is specified, the network of the subnetwork will be used.\nIf neither subnetwork nor this field is specified, the default network will\nbe used.\n\nFor Private Service Connect forwarding rules that forward traffic to Google\nAPIs, a network must be provided. When `null`, the `network` field will be omitted from the resulting object.\n  - `no_automate_dns_zone` (`bool`): This is used in PSC consumer ForwardingRule to control whether it should try to auto-generate a DNS zone or not. Non-PSC forwarding rules do not use this field. When `null`, the `no_automate_dns_zone` field will be omitted from the resulting object.\n  - `port_range` (`string`): The \u0026#39;portRange\u0026#39; field has the following limitations:\n* It requires that the forwarding rule \u0026#39;IPProtocol\u0026#39; be TCP, UDP, or SCTP,\nand\n* It\u0026#39;s applicable only to the following products: external passthrough\nNetwork Load Balancers, internal and external proxy Network Load\nBalancers, internal and external Application Load Balancers, external\nprotocol forwarding, and Classic VPN.\n* Some products have restrictions on what ports can be used. See\n[port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#port_specifications)\nfor details.\n\nFor external forwarding rules, two or more forwarding rules cannot use the\nsame \u0026#39;[IPAddress, IPProtocol]\u0026#39; pair, and cannot have overlapping\n\u0026#39;portRange\u0026#39;s.\n\nFor internal forwarding rules within the same VPC network, two or more\nforwarding rules cannot use the same \u0026#39;[IPAddress, IPProtocol]\u0026#39; pair, and\ncannot have overlapping \u0026#39;portRange\u0026#39;s.\n\n@pattern: \\d\u0026#43;(?:-\\d\u0026#43;)? When `null`, the `port_range` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `source_ip_ranges` (`list`): If not empty, this Forwarding Rule will only forward the traffic when the source IP address matches one of the IP addresses or CIDR ranges set here. Note that a Forwarding Rule can only have up to 64 source IP ranges, and this field can only be used with a regional Forwarding Rule whose scheme is EXTERNAL. Each sourceIpRange entry should be either an IP address (for example, 1.2.3.4) or a CIDR range (for example, 1.2.3.0/24). When `null`, the `source_ip_ranges` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): This field identifies the subnetwork that the load balanced IP should\nbelong to for this Forwarding Rule, used in internal load balancing and\nnetwork load balancing with IPv6.\n\nIf the network specified is in auto subnet mode, this field is optional.\nHowever, a subnetwork must be specified if the network is in custom subnet\nmode or when creating external forwarding rule with IPv6. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `target` (`string`): The URL of the target resource to receive the matched traffic.  For\nregional forwarding rules, this target must be in the same region as the\nforwarding rule. For global forwarding rules, this target must be a global\nload balancing resource.\n\nThe forwarded traffic must be of a type appropriate to the target object.\n*  For load balancers, see the \u0026#34;Target\u0026#34; column in [Port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#ip_address_specifications).\n*  For Private Service Connect forwarding rules that forward traffic to Google APIs, provide the name of a supported Google API bundle:\n  *  \u0026#39;vpc-sc\u0026#39; - [ APIs that support VPC Service Controls](https://cloud.google.com/vpc-service-controls/docs/supported-products).\n  *  \u0026#39;all-apis\u0026#39; - [All supported Google APIs](https://cloud.google.com/vpc/docs/private-service-connect#supported-apis).\n\n\nFor Private Service Connect forwarding rules that forward traffic to managed services, the target must be a service attachment.\n  - `metadata_filters` (`list[obj]`): Opaque filter criteria used by Loadbalancer to restrict routing\nconfiguration to a limited set xDS compliant clients. In their xDS\nrequests to Loadbalancer, xDS clients present node metadata. If a\nmatch takes place, the relevant routing configuration is made available\nto those proxies.\n\nFor each metadataFilter in this list, if its filterMatchCriteria is set\nto MATCH_ANY, at least one of the filterLabels must match the\ncorresponding label provided in the metadata. If its filterMatchCriteria\nis set to MATCH_ALL, then all of its filterLabels must match with\ncorresponding labels in the provided metadata.\n\nmetadataFilters specified here can be overridden by those specified in\nthe UrlMap that this ForwardingRule references.\n\nmetadataFilters only applies to Loadbalancers that have their\nloadBalancingScheme set to INTERNAL_SELF_MANAGED. When `null`, the `metadata_filters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_global_forwarding_rule.metadata_filters.new](#fn-metadata_filtersnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_global_forwarding_rule.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -65,7 +65,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_global_forwarding_rule.newAttrs` constructs a new object with attributes and blocks configured for the `compute_global_forwarding_rule`\nTerraform resource.\n\nUnlike [google.compute_global_forwarding_rule.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `ip_address` (`string`): IP address for which this forwarding rule accepts traffic. When a client\nsends traffic to this IP address, the forwarding rule directs the traffic\nto the referenced 'target'.\n\nWhile creating a forwarding rule, specifying an 'IPAddress' is\nrequired under the following circumstances:\n\n* When the 'target' is set to 'targetGrpcProxy' and\n'validateForProxyless' is set to 'true', the\n'IPAddress' should be set to '0.0.0.0'.\n* When the 'target' is a Private Service Connect Google APIs\nbundle, you must specify an 'IPAddress'.\n\n\nOtherwise, you can optionally specify an IP address that references an\nexisting static (reserved) IP address resource. When omitted, Google Cloud\nassigns an ephemeral IP address.\n\nUse one of the following formats to specify an IP address while creating a\nforwarding rule:\n\n* IP address number, as in '100.1.2.3'\n* IPv6 address range, as in '2600:1234::/96'\n* Full resource URL, as in\n'https://www.googleapis.com/compute/v1/projects/project_id/regions/region/addresses/address-name'\n* Partial URL or by name, as in:\n  * 'projects/project_id/regions/region/addresses/address-name'\n  * 'regions/region/addresses/address-name'\n  * 'global/addresses/address-name'\n  * 'address-name'\n\n\nThe forwarding rule's 'target',\nand in most cases, also the 'loadBalancingScheme', determine the\ntype of IP address that you can use. For detailed information, see\n[IP address\nspecifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#ip_address_specifications).\n\nWhen reading an 'IPAddress', the API always returns the IP\naddress number. When `null`, the `ip_address` field will be omitted from the resulting object.\n  - `ip_protocol` (`string`): The IP protocol to which this rule applies.\n\nFor protocol forwarding, valid\noptions are 'TCP', 'UDP', 'ESP',\n'AH', 'SCTP', 'ICMP' and\n'L3_DEFAULT'.\n\nThe valid IP protocols are different for different load balancing products\nas described in [Load balancing\nfeatures](https://cloud.google.com/load-balancing/docs/features#protocols_from_the_load_balancer_to_the_backends). Possible values: ["TCP", "UDP", "ESP", "AH", "SCTP", "ICMP"] When `null`, the `ip_protocol` field will be omitted from the resulting object.\n  - `ip_version` (`string`): The IP Version that will be used by this global forwarding rule. Possible values: ["IPV4", "IPV6"] When `null`, the `ip_version` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this forwarding rule.  A list of key->value pairs. When `null`, the `labels` field will be omitted from the resulting object.\n  - `load_balancing_scheme` (`string`): Specifies the forwarding rule type.\n\nFor more information about forwarding rules, refer to\n[Forwarding rule concepts](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts). Default value: "EXTERNAL" Possible values: ["EXTERNAL", "EXTERNAL_MANAGED", "INTERNAL_MANAGED", "INTERNAL_SELF_MANAGED"] When `null`, the `load_balancing_scheme` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-63 characters long, and comply with\n[RFC1035](https://www.ietf.org/rfc/rfc1035.txt).\n\nSpecifically, the name must be 1-63 characters long and match the regular\nexpression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the first\ncharacter must be a lowercase letter, and all following characters must\nbe a dash, lowercase letter, or digit, except the last character, which\ncannot be a dash.\n\nFor Private Service Connect forwarding rules that forward traffic to Google\nAPIs, the forwarding rule name must be a 1-20 characters string with\nlowercase letters and numbers and must start with a letter.\n  - `network` (`string`): This field is not used for external load balancing.\n\nFor Internal TCP/UDP Load Balancing, this field identifies the network that\nthe load balanced IP should belong to for this Forwarding Rule.\nIf the subnetwork is specified, the network of the subnetwork will be used.\nIf neither subnetwork nor this field is specified, the default network will\nbe used.\n\nFor Private Service Connect forwarding rules that forward traffic to Google\nAPIs, a network must be provided. When `null`, the `network` field will be omitted from the resulting object.\n  - `no_automate_dns_zone` (`bool`): This is used in PSC consumer ForwardingRule to control whether it should try to auto-generate a DNS zone or not. Non-PSC forwarding rules do not use this field. When `null`, the `no_automate_dns_zone` field will be omitted from the resulting object.\n  - `port_range` (`string`): This field can only be used:\n\n* If 'IPProtocol' is one of TCP, UDP, or SCTP.\n* By backend service-based network load balancers, target pool-based\nnetwork load balancers, internal proxy load balancers, external proxy load\nbalancers, Traffic Director, external protocol forwarding, and Classic VPN.\nSome products have restrictions on what ports can be used. See\n[port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#port_specifications)\nfor details.\n\n\n* TargetHttpProxy: 80, 8080\n* TargetHttpsProxy: 443\n* TargetTcpProxy: 25, 43, 110, 143, 195, 443, 465, 587, 700, 993, 995,\n                  1883, 5222\n* TargetSslProxy: 25, 43, 110, 143, 195, 443, 465, 587, 700, 993, 995,\n                  1883, 5222\n* TargetVpnGateway: 500, 4500 When `null`, the `port_range` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `source_ip_ranges` (`list`): If not empty, this Forwarding Rule will only forward the traffic when the source IP address matches one of the IP addresses or CIDR ranges set here. Note that a Forwarding Rule can only have up to 64 source IP ranges, and this field can only be used with a regional Forwarding Rule whose scheme is EXTERNAL. Each sourceIpRange entry should be either an IP address (for example, 1.2.3.4) or a CIDR range (for example, 1.2.3.0/24). When `null`, the `source_ip_ranges` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): This field identifies the subnetwork that the load balanced IP should\nbelong to for this Forwarding Rule, used in internal load balancing and\nnetwork load balancing with IPv6.\n\nIf the network specified is in auto subnet mode, this field is optional.\nHowever, a subnetwork must be specified if the network is in custom subnet\nmode or when creating external forwarding rule with IPv6. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `target` (`string`): The URL of the target resource to receive the matched traffic.  For\nregional forwarding rules, this target must be in the same region as the\nforwarding rule. For global forwarding rules, this target must be a global\nload balancing resource.\n\nThe forwarded traffic must be of a type appropriate to the target object.\n*  For load balancers, see the "Target" column in [Port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#ip_address_specifications).\n*  For Private Service Connect forwarding rules that forward traffic to Google APIs, provide the name of a supported Google API bundle:\n  *  'vpc-sc' - [ APIs that support VPC Service Controls](https://cloud.google.com/vpc-service-controls/docs/supported-products).\n  *  'all-apis' - [All supported Google APIs](https://cloud.google.com/vpc/docs/private-service-connect#supported-apis).\n\n\nFor Private Service Connect forwarding rules that forward traffic to managed services, the target must be a service attachment.\n  - `metadata_filters` (`list[obj]`): Opaque filter criteria used by Loadbalancer to restrict routing\nconfiguration to a limited set xDS compliant clients. In their xDS\nrequests to Loadbalancer, xDS clients present node metadata. If a\nmatch takes place, the relevant routing configuration is made available\nto those proxies.\n\nFor each metadataFilter in this list, if its filterMatchCriteria is set\nto MATCH_ANY, at least one of the filterLabels must match the\ncorresponding label provided in the metadata. If its filterMatchCriteria\nis set to MATCH_ALL, then all of its filterLabels must match with\ncorresponding labels in the provided metadata.\n\nmetadataFilters specified here can be overridden by those specified in\nthe UrlMap that this ForwardingRule references.\n\nmetadataFilters only applies to Loadbalancers that have their\nloadBalancingScheme set to INTERNAL_SELF_MANAGED. When `null`, the `metadata_filters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_global_forwarding_rule.metadata_filters.new](#fn-metadata_filtersnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_global_forwarding_rule.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_global_forwarding_rule` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_global_forwarding_rule.newAttrs` constructs a new object with attributes and blocks configured for the `compute_global_forwarding_rule`\nTerraform resource.\n\nUnlike [google.compute_global_forwarding_rule.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `ip_address` (`string`): IP address for which this forwarding rule accepts traffic. When a client\nsends traffic to this IP address, the forwarding rule directs the traffic\nto the referenced 'target'.\n\nWhile creating a forwarding rule, specifying an 'IPAddress' is\nrequired under the following circumstances:\n\n* When the 'target' is set to 'targetGrpcProxy' and\n'validateForProxyless' is set to 'true', the\n'IPAddress' should be set to '0.0.0.0'.\n* When the 'target' is a Private Service Connect Google APIs\nbundle, you must specify an 'IPAddress'.\n\n\nOtherwise, you can optionally specify an IP address that references an\nexisting static (reserved) IP address resource. When omitted, Google Cloud\nassigns an ephemeral IP address.\n\nUse one of the following formats to specify an IP address while creating a\nforwarding rule:\n\n* IP address number, as in '100.1.2.3'\n* IPv6 address range, as in '2600:1234::/96'\n* Full resource URL, as in\n'https://www.googleapis.com/compute/v1/projects/project_id/regions/region/addresses/address-name'\n* Partial URL or by name, as in:\n  * 'projects/project_id/regions/region/addresses/address-name'\n  * 'regions/region/addresses/address-name'\n  * 'global/addresses/address-name'\n  * 'address-name'\n\n\nThe forwarding rule's 'target',\nand in most cases, also the 'loadBalancingScheme', determine the\ntype of IP address that you can use. For detailed information, see\n[IP address\nspecifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#ip_address_specifications).\n\nWhen reading an 'IPAddress', the API always returns the IP\naddress number. When `null`, the `ip_address` field will be omitted from the resulting object.\n  - `ip_protocol` (`string`): The IP protocol to which this rule applies.\n\nFor protocol forwarding, valid\noptions are 'TCP', 'UDP', 'ESP',\n'AH', 'SCTP', 'ICMP' and\n'L3_DEFAULT'.\n\nThe valid IP protocols are different for different load balancing products\nas described in [Load balancing\nfeatures](https://cloud.google.com/load-balancing/docs/features#protocols_from_the_load_balancer_to_the_backends). Possible values: ["TCP", "UDP", "ESP", "AH", "SCTP", "ICMP"] When `null`, the `ip_protocol` field will be omitted from the resulting object.\n  - `ip_version` (`string`): The IP Version that will be used by this global forwarding rule. Possible values: ["IPV4", "IPV6"] When `null`, the `ip_version` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this forwarding rule.  A list of key->value pairs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `load_balancing_scheme` (`string`): Specifies the forwarding rule type.\n\nFor more information about forwarding rules, refer to\n[Forwarding rule concepts](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts). Default value: "EXTERNAL" Possible values: ["EXTERNAL", "EXTERNAL_MANAGED", "INTERNAL_MANAGED", "INTERNAL_SELF_MANAGED"] When `null`, the `load_balancing_scheme` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-63 characters long, and comply with\n[RFC1035](https://www.ietf.org/rfc/rfc1035.txt).\n\nSpecifically, the name must be 1-63 characters long and match the regular\nexpression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the first\ncharacter must be a lowercase letter, and all following characters must\nbe a dash, lowercase letter, or digit, except the last character, which\ncannot be a dash.\n\nFor Private Service Connect forwarding rules that forward traffic to Google\nAPIs, the forwarding rule name must be a 1-20 characters string with\nlowercase letters and numbers and must start with a letter.\n  - `network` (`string`): This field is not used for external load balancing.\n\nFor Internal TCP/UDP Load Balancing, this field identifies the network that\nthe load balanced IP should belong to for this Forwarding Rule.\nIf the subnetwork is specified, the network of the subnetwork will be used.\nIf neither subnetwork nor this field is specified, the default network will\nbe used.\n\nFor Private Service Connect forwarding rules that forward traffic to Google\nAPIs, a network must be provided. When `null`, the `network` field will be omitted from the resulting object.\n  - `no_automate_dns_zone` (`bool`): This is used in PSC consumer ForwardingRule to control whether it should try to auto-generate a DNS zone or not. Non-PSC forwarding rules do not use this field. When `null`, the `no_automate_dns_zone` field will be omitted from the resulting object.\n  - `port_range` (`string`): The 'portRange' field has the following limitations:\n* It requires that the forwarding rule 'IPProtocol' be TCP, UDP, or SCTP,\nand\n* It's applicable only to the following products: external passthrough\nNetwork Load Balancers, internal and external proxy Network Load\nBalancers, internal and external Application Load Balancers, external\nprotocol forwarding, and Classic VPN.\n* Some products have restrictions on what ports can be used. See\n[port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#port_specifications)\nfor details.\n\nFor external forwarding rules, two or more forwarding rules cannot use the\nsame '[IPAddress, IPProtocol]' pair, and cannot have overlapping\n'portRange's.\n\nFor internal forwarding rules within the same VPC network, two or more\nforwarding rules cannot use the same '[IPAddress, IPProtocol]' pair, and\ncannot have overlapping 'portRange's.\n\n@pattern: \\d+(?:-\\d+)? When `null`, the `port_range` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `source_ip_ranges` (`list`): If not empty, this Forwarding Rule will only forward the traffic when the source IP address matches one of the IP addresses or CIDR ranges set here. Note that a Forwarding Rule can only have up to 64 source IP ranges, and this field can only be used with a regional Forwarding Rule whose scheme is EXTERNAL. Each sourceIpRange entry should be either an IP address (for example, 1.2.3.4) or a CIDR range (for example, 1.2.3.0/24). When `null`, the `source_ip_ranges` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): This field identifies the subnetwork that the load balanced IP should\nbelong to for this Forwarding Rule, used in internal load balancing and\nnetwork load balancing with IPv6.\n\nIf the network specified is in auto subnet mode, this field is optional.\nHowever, a subnetwork must be specified if the network is in custom subnet\nmode or when creating external forwarding rule with IPv6. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `target` (`string`): The URL of the target resource to receive the matched traffic.  For\nregional forwarding rules, this target must be in the same region as the\nforwarding rule. For global forwarding rules, this target must be a global\nload balancing resource.\n\nThe forwarded traffic must be of a type appropriate to the target object.\n*  For load balancers, see the "Target" column in [Port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#ip_address_specifications).\n*  For Private Service Connect forwarding rules that forward traffic to Google APIs, provide the name of a supported Google API bundle:\n  *  'vpc-sc' - [ APIs that support VPC Service Controls](https://cloud.google.com/vpc-service-controls/docs/supported-products).\n  *  'all-apis' - [All supported Google APIs](https://cloud.google.com/vpc/docs/private-service-connect#supported-apis).\n\n\nFor Private Service Connect forwarding rules that forward traffic to managed services, the target must be a service attachment.\n  - `metadata_filters` (`list[obj]`): Opaque filter criteria used by Loadbalancer to restrict routing\nconfiguration to a limited set xDS compliant clients. In their xDS\nrequests to Loadbalancer, xDS clients present node metadata. If a\nmatch takes place, the relevant routing configuration is made available\nto those proxies.\n\nFor each metadataFilter in this list, if its filterMatchCriteria is set\nto MATCH_ANY, at least one of the filterLabels must match the\ncorresponding label provided in the metadata. If its filterMatchCriteria\nis set to MATCH_ALL, then all of its filterLabels must match with\ncorresponding labels in the provided metadata.\n\nmetadataFilters specified here can be overridden by those specified in\nthe UrlMap that this ForwardingRule references.\n\nmetadataFilters only applies to Loadbalancers that have their\nloadBalancingScheme set to INTERNAL_SELF_MANAGED. When `null`, the `metadata_filters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_global_forwarding_rule.metadata_filters.new](#fn-metadata_filtersnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_global_forwarding_rule.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_global_forwarding_rule` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     target,
diff --git a/4.x/_gen/resources/compute_image.libsonnet b/4.x/_gen/resources/compute_image.libsonnet
index 9d2c88e2..52b4ec2a 100644
--- a/4.x/_gen/resources/compute_image.libsonnet
+++ b/4.x/_gen/resources/compute_image.libsonnet
@@ -3,7 +3,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='compute_image', url='', help='`compute_image` represents the `google_compute_image` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
   guest_os_features:: {
-    '#new':: d.fn(help='\n`google.compute_image.guest_os_features.new` constructs a new object with attributes and blocks configured for the `guest_os_features`\nTerraform sub block.\n\n\n\n**Args**:\n  - `type` (`string`): The type of supported feature. Read [Enabling guest operating system features](https://cloud.google.com/compute/docs/images/create-delete-deprecate-private-images#guest-os-features) to see a list of available options. Possible values: ["MULTI_IP_SUBNET", "SECURE_BOOT", "SEV_CAPABLE", "UEFI_COMPATIBLE", "VIRTIO_SCSI_MULTIQUEUE", "WINDOWS", "GVNIC", "SEV_LIVE_MIGRATABLE", "SEV_SNP_CAPABLE", "SUSPEND_RESUME_COMPATIBLE", "TDX_CAPABLE"]\n\n**Returns**:\n  - An attribute object that represents the `guest_os_features` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.compute_image.guest_os_features.new` constructs a new object with attributes and blocks configured for the `guest_os_features`\nTerraform sub block.\n\n\n\n**Args**:\n  - `type` (`string`): The type of supported feature. Read [Enabling guest operating system features](https://cloud.google.com/compute/docs/images/create-delete-deprecate-private-images#guest-os-features) to see a list of available options. Possible values: ["MULTI_IP_SUBNET", "SECURE_BOOT", "SEV_CAPABLE", "UEFI_COMPATIBLE", "VIRTIO_SCSI_MULTIQUEUE", "WINDOWS", "GVNIC", "SEV_LIVE_MIGRATABLE", "SEV_SNP_CAPABLE", "SUSPEND_RESUME_COMPATIBLE", "TDX_CAPABLE", "SEV_LIVE_MIGRATABLE_V2"]\n\n**Returns**:\n  - An attribute object that represents the `guest_os_features` sub block.\n', args=[]),
     new(
       type
     ):: std.prune(a={
@@ -20,7 +20,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       kms_key_service_account: kms_key_service_account,
     }),
   },
-  '#new':: d.fn(help="\n`google.compute_image.new` injects a new `google_compute_image` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_image.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_image` using the reference:\n\n    $._ref.google_compute_image.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_image.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `disk_size_gb` (`number`): Size of the image when restored onto a persistent disk (in GB). When `null`, the `disk_size_gb` field will be omitted from the resulting object.\n  - `family` (`string`): The name of the image family to which this image belongs. You can\ncreate disks by specifying an image family instead of a specific\nimage name. The image family always returns its latest image that is\nnot deprecated. The name of the image family must comply with\nRFC1035. When `null`, the `family` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this Image. When `null`, the `labels` field will be omitted from the resulting object.\n  - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and\nmatch the regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means\nthe first character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the\nlast character, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `source_disk` (`string`): The source disk to create this image based on.\nYou must provide either this property or the\nrawDisk.source property but not both to create an image. When `null`, the `source_disk` field will be omitted from the resulting object.\n  - `source_image` (`string`): URL of the source image used to create this image. In order to create an image, you must provide the full or partial\nURL of one of the following:\n\n* The selfLink URL\n* This property\n* The rawDisk.source URL\n* The sourceDisk URL When `null`, the `source_image` field will be omitted from the resulting object.\n  - `source_snapshot` (`string`): URL of the source snapshot used to create this image.\n\nIn order to create an image, you must provide the full or partial URL of one of the following:\n\n* The selfLink URL\n* This property\n* The sourceImage URL\n* The rawDisk.source URL\n* The sourceDisk URL When `null`, the `source_snapshot` field will be omitted from the resulting object.\n  - `storage_locations` (`list`): Cloud Storage bucket storage location of the image\n(regional or multi-regional).\nReference link: https://cloud.google.com/compute/docs/reference/rest/v1/images When `null`, the `storage_locations` field will be omitted from the resulting object.\n  - `guest_os_features` (`list[obj]`): A list of features to enable on the guest operating system.\nApplicable only for bootable images. When `null`, the `guest_os_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_image.guest_os_features.new](#fn-guest_os_featuresnew) constructor.\n  - `image_encryption_key` (`list[obj]`): Encrypts the image using a customer-supplied encryption key.\n\nAfter you encrypt an image with a customer-supplied key, you must\nprovide the same key if you use the image later (e.g. to create a\ndisk from the image) When `null`, the `image_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_image.image_encryption_key.new](#fn-image_encryption_keynew) constructor.\n  - `raw_disk` (`list[obj]`): The parameters of the raw disk image. When `null`, the `raw_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_image.raw_disk.new](#fn-raw_disknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_image.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_image.new` injects a new `google_compute_image` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_image.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_image` using the reference:\n\n    $._ref.google_compute_image.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_image.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `disk_size_gb` (`number`): Size of the image when restored onto a persistent disk (in GB). When `null`, the `disk_size_gb` field will be omitted from the resulting object.\n  - `family` (`string`): The name of the image family to which this image belongs. You can\ncreate disks by specifying an image family instead of a specific\nimage name. The image family always returns its latest image that is\nnot deprecated. The name of the image family must comply with\nRFC1035. When `null`, the `family` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this Image.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and\nmatch the regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means\nthe first character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the\nlast character, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `source_disk` (`string`): The source disk to create this image based on.\nYou must provide either this property or the\nrawDisk.source property but not both to create an image. When `null`, the `source_disk` field will be omitted from the resulting object.\n  - `source_image` (`string`): URL of the source image used to create this image. In order to create an image, you must provide the full or partial\nURL of one of the following:\n\n* The selfLink URL\n* This property\n* The rawDisk.source URL\n* The sourceDisk URL When `null`, the `source_image` field will be omitted from the resulting object.\n  - `source_snapshot` (`string`): URL of the source snapshot used to create this image.\n\nIn order to create an image, you must provide the full or partial URL of one of the following:\n\n* The selfLink URL\n* This property\n* The sourceImage URL\n* The rawDisk.source URL\n* The sourceDisk URL When `null`, the `source_snapshot` field will be omitted from the resulting object.\n  - `storage_locations` (`list`): Cloud Storage bucket storage location of the image\n(regional or multi-regional).\nReference link: https://cloud.google.com/compute/docs/reference/rest/v1/images When `null`, the `storage_locations` field will be omitted from the resulting object.\n  - `guest_os_features` (`list[obj]`): A list of features to enable on the guest operating system.\nApplicable only for bootable images. When `null`, the `guest_os_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_image.guest_os_features.new](#fn-guest_os_featuresnew) constructor.\n  - `image_encryption_key` (`list[obj]`): Encrypts the image using a customer-supplied encryption key.\n\nAfter you encrypt an image with a customer-supplied key, you must\nprovide the same key if you use the image later (e.g. to create a\ndisk from the image) When `null`, the `image_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_image.image_encryption_key.new](#fn-image_encryption_keynew) constructor.\n  - `raw_disk` (`list[obj]`): The parameters of the raw disk image. When `null`, the `raw_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_image.raw_disk.new](#fn-raw_disknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_image.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -61,7 +61,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_image.newAttrs` constructs a new object with attributes and blocks configured for the `compute_image`\nTerraform resource.\n\nUnlike [google.compute_image.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `disk_size_gb` (`number`): Size of the image when restored onto a persistent disk (in GB). When `null`, the `disk_size_gb` field will be omitted from the resulting object.\n  - `family` (`string`): The name of the image family to which this image belongs. You can\ncreate disks by specifying an image family instead of a specific\nimage name. The image family always returns its latest image that is\nnot deprecated. The name of the image family must comply with\nRFC1035. When `null`, the `family` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this Image. When `null`, the `labels` field will be omitted from the resulting object.\n  - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and\nmatch the regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means\nthe first character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the\nlast character, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `source_disk` (`string`): The source disk to create this image based on.\nYou must provide either this property or the\nrawDisk.source property but not both to create an image. When `null`, the `source_disk` field will be omitted from the resulting object.\n  - `source_image` (`string`): URL of the source image used to create this image. In order to create an image, you must provide the full or partial\nURL of one of the following:\n\n* The selfLink URL\n* This property\n* The rawDisk.source URL\n* The sourceDisk URL When `null`, the `source_image` field will be omitted from the resulting object.\n  - `source_snapshot` (`string`): URL of the source snapshot used to create this image.\n\nIn order to create an image, you must provide the full or partial URL of one of the following:\n\n* The selfLink URL\n* This property\n* The sourceImage URL\n* The rawDisk.source URL\n* The sourceDisk URL When `null`, the `source_snapshot` field will be omitted from the resulting object.\n  - `storage_locations` (`list`): Cloud Storage bucket storage location of the image\n(regional or multi-regional).\nReference link: https://cloud.google.com/compute/docs/reference/rest/v1/images When `null`, the `storage_locations` field will be omitted from the resulting object.\n  - `guest_os_features` (`list[obj]`): A list of features to enable on the guest operating system.\nApplicable only for bootable images. When `null`, the `guest_os_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_image.guest_os_features.new](#fn-guest_os_featuresnew) constructor.\n  - `image_encryption_key` (`list[obj]`): Encrypts the image using a customer-supplied encryption key.\n\nAfter you encrypt an image with a customer-supplied key, you must\nprovide the same key if you use the image later (e.g. to create a\ndisk from the image) When `null`, the `image_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_image.image_encryption_key.new](#fn-image_encryption_keynew) constructor.\n  - `raw_disk` (`list[obj]`): The parameters of the raw disk image. When `null`, the `raw_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_image.raw_disk.new](#fn-raw_disknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_image.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_image` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_image.newAttrs` constructs a new object with attributes and blocks configured for the `compute_image`\nTerraform resource.\n\nUnlike [google.compute_image.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `disk_size_gb` (`number`): Size of the image when restored onto a persistent disk (in GB). When `null`, the `disk_size_gb` field will be omitted from the resulting object.\n  - `family` (`string`): The name of the image family to which this image belongs. You can\ncreate disks by specifying an image family instead of a specific\nimage name. The image family always returns its latest image that is\nnot deprecated. The name of the image family must comply with\nRFC1035. When `null`, the `family` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this Image.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and\nmatch the regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means\nthe first character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the\nlast character, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `source_disk` (`string`): The source disk to create this image based on.\nYou must provide either this property or the\nrawDisk.source property but not both to create an image. When `null`, the `source_disk` field will be omitted from the resulting object.\n  - `source_image` (`string`): URL of the source image used to create this image. In order to create an image, you must provide the full or partial\nURL of one of the following:\n\n* The selfLink URL\n* This property\n* The rawDisk.source URL\n* The sourceDisk URL When `null`, the `source_image` field will be omitted from the resulting object.\n  - `source_snapshot` (`string`): URL of the source snapshot used to create this image.\n\nIn order to create an image, you must provide the full or partial URL of one of the following:\n\n* The selfLink URL\n* This property\n* The sourceImage URL\n* The rawDisk.source URL\n* The sourceDisk URL When `null`, the `source_snapshot` field will be omitted from the resulting object.\n  - `storage_locations` (`list`): Cloud Storage bucket storage location of the image\n(regional or multi-regional).\nReference link: https://cloud.google.com/compute/docs/reference/rest/v1/images When `null`, the `storage_locations` field will be omitted from the resulting object.\n  - `guest_os_features` (`list[obj]`): A list of features to enable on the guest operating system.\nApplicable only for bootable images. When `null`, the `guest_os_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_image.guest_os_features.new](#fn-guest_os_featuresnew) constructor.\n  - `image_encryption_key` (`list[obj]`): Encrypts the image using a customer-supplied encryption key.\n\nAfter you encrypt an image with a customer-supplied key, you must\nprovide the same key if you use the image later (e.g. to create a\ndisk from the image) When `null`, the `image_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_image.image_encryption_key.new](#fn-image_encryption_keynew) constructor.\n  - `raw_disk` (`list[obj]`): The parameters of the raw disk image. When `null`, the `raw_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_image.raw_disk.new](#fn-raw_disknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_image.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_image` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     description=null,
diff --git a/4.x/_gen/resources/compute_instance.libsonnet b/4.x/_gen/resources/compute_instance.libsonnet
index 09a8cba7..d405619f 100644
--- a/4.x/_gen/resources/compute_instance.libsonnet
+++ b/4.x/_gen/resources/compute_instance.libsonnet
@@ -150,7 +150,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       total_egress_bandwidth_tier: total_egress_bandwidth_tier,
     }),
   },
-  '#new':: d.fn(help="\n`google.compute_instance.new` injects a new `google_compute_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_instance` using the reference:\n\n    $._ref.google_compute_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `allow_stopping_for_update` (`bool`): If true, allows Terraform to stop the instance to update its properties. If you try to update a property that requires stopping the instance without setting this field, the update will fail. When `null`, the `allow_stopping_for_update` field will be omitted from the resulting object.\n  - `can_ip_forward` (`bool`): Whether sending and receiving of packets with non-matching source or destination IPs is allowed. When `null`, the `can_ip_forward` field will be omitted from the resulting object.\n  - `deletion_protection` (`bool`): Whether deletion protection is enabled on this instance. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `description` (`string`): A brief description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `desired_status` (`string`): Desired status of the instance. Either \u0026#34;RUNNING\u0026#34; or \u0026#34;TERMINATED\u0026#34;. When `null`, the `desired_status` field will be omitted from the resulting object.\n  - `enable_display` (`bool`): Whether the instance has virtual displays enabled. When `null`, the `enable_display` field will be omitted from the resulting object.\n  - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.\n  - `hostname` (`string`): A custom hostname for the instance. Must be a fully qualified DNS name and RFC-1035-valid. Valid format is a series of labels 1-63 characters long matching the regular expression [a-z]([-a-z0-9]*[a-z0-9]), concatenated with periods. The entire hostname must not exceed 253 characters. Changing this forces a new resource to be created. When `null`, the `hostname` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs assigned to the instance. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to create.\n  - `metadata` (`obj`): Metadata key/value pairs made available within the instance. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `metadata_startup_script` (`string`): Metadata startup scripts made available within the instance. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): The minimum CPU platform specified for the VM instance. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance. One of name or self_link must be provided.\n  - `project` (`string`): The ID of the project in which the resource belongs. If self_link is provided, this value is ignored. If neither self_link nor project are provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `tags` (`list`): The list of tags attached to the instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `zone` (`string`): The zone of the instance. If self_link is provided, this value is ignored. If neither self_link nor zone are provided, the provider zone is used. When `null`, the `zone` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.\n  - `attached_disk` (`list[obj]`): List of disks attached to the instance When `null`, the `attached_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.attached_disk.new](#fn-attached_disknew) constructor.\n  - `boot_disk` (`list[obj]`): The boot disk for the instance. When `null`, the `boot_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.boot_disk.new](#fn-boot_disknew) constructor.\n  - `confidential_instance_config` (`list[obj]`): The Confidential VM config being used by the instance.  on_host_maintenance has to be set to TERMINATE or this will fail to create. When `null`, the `confidential_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.confidential_instance_config.new](#fn-confidential_instance_confignew) constructor.\n  - `network_interface` (`list[obj]`): The networks attached to the instance. When `null`, the `network_interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.network_interface.new](#fn-network_interfacenew) constructor.\n  - `network_performance_config` (`list[obj]`): Configures network performance settings for the instance. If not specified, the instance will be created with its default network performance configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.network_performance_config.new](#fn-network_performance_confignew) constructor.\n  - `params` (`list[obj]`): Stores additional params passed with the request, but not persisted as part of resource payload. When `null`, the `params` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.params.new](#fn-paramsnew) constructor.\n  - `reservation_affinity` (`list[obj]`): Specifies the reservations that this instance can consume from. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `scheduling` (`list[obj]`): The scheduling strategy being used by the instance. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.scheduling.new](#fn-schedulingnew) constructor.\n  - `scratch_disk` (`list[obj]`): The scratch disks attached to the instance. When `null`, the `scratch_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.scratch_disk.new](#fn-scratch_disknew) constructor.\n  - `service_account` (`list[obj]`): The service account to attach to the instance. When `null`, the `service_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.service_account.new](#fn-service_accountnew) constructor.\n  - `shielded_instance_config` (`list[obj]`): The shielded vm config being used by the instance. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_instance.new` injects a new `google_compute_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_instance` using the reference:\n\n    $._ref.google_compute_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `allow_stopping_for_update` (`bool`): If true, allows Terraform to stop the instance to update its properties. If you try to update a property that requires stopping the instance without setting this field, the update will fail. When `null`, the `allow_stopping_for_update` field will be omitted from the resulting object.\n  - `can_ip_forward` (`bool`): Whether sending and receiving of packets with non-matching source or destination IPs is allowed. When `null`, the `can_ip_forward` field will be omitted from the resulting object.\n  - `deletion_protection` (`bool`): Whether deletion protection is enabled on this instance. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `description` (`string`): A brief description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `desired_status` (`string`): Desired status of the instance. Either \u0026#34;RUNNING\u0026#34; or \u0026#34;TERMINATED\u0026#34;. When `null`, the `desired_status` field will be omitted from the resulting object.\n  - `enable_display` (`bool`): Whether the instance has virtual displays enabled. When `null`, the `enable_display` field will be omitted from the resulting object.\n  - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.\n  - `hostname` (`string`): A custom hostname for the instance. Must be a fully qualified DNS name and RFC-1035-valid. Valid format is a series of labels 1-63 characters long matching the regular expression [a-z]([-a-z0-9]*[a-z0-9]), concatenated with periods. The entire hostname must not exceed 253 characters. Changing this forces a new resource to be created. When `null`, the `hostname` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs assigned to the instance.\n\t\t\t\t\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to create.\n  - `metadata` (`obj`): Metadata key/value pairs made available within the instance. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `metadata_startup_script` (`string`): Metadata startup scripts made available within the instance. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): The minimum CPU platform specified for the VM instance. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance. One of name or self_link must be provided.\n  - `project` (`string`): The ID of the project in which the resource belongs. If self_link is provided, this value is ignored. If neither self_link nor project are provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `tags` (`list`): The list of tags attached to the instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `zone` (`string`): The zone of the instance. If self_link is provided, this value is ignored. If neither self_link nor zone are provided, the provider zone is used. When `null`, the `zone` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.\n  - `attached_disk` (`list[obj]`): List of disks attached to the instance When `null`, the `attached_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.attached_disk.new](#fn-attached_disknew) constructor.\n  - `boot_disk` (`list[obj]`): The boot disk for the instance. When `null`, the `boot_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.boot_disk.new](#fn-boot_disknew) constructor.\n  - `confidential_instance_config` (`list[obj]`): The Confidential VM config being used by the instance.  on_host_maintenance has to be set to TERMINATE or this will fail to create. When `null`, the `confidential_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.confidential_instance_config.new](#fn-confidential_instance_confignew) constructor.\n  - `network_interface` (`list[obj]`): The networks attached to the instance. When `null`, the `network_interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.network_interface.new](#fn-network_interfacenew) constructor.\n  - `network_performance_config` (`list[obj]`): Configures network performance settings for the instance. If not specified, the instance will be created with its default network performance configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.network_performance_config.new](#fn-network_performance_confignew) constructor.\n  - `params` (`list[obj]`): Stores additional params passed with the request, but not persisted as part of resource payload. When `null`, the `params` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.params.new](#fn-paramsnew) constructor.\n  - `reservation_affinity` (`list[obj]`): Specifies the reservations that this instance can consume from. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `scheduling` (`list[obj]`): The scheduling strategy being used by the instance. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.scheduling.new](#fn-schedulingnew) constructor.\n  - `scratch_disk` (`list[obj]`): The scratch disks attached to the instance. When `null`, the `scratch_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.scratch_disk.new](#fn-scratch_disknew) constructor.\n  - `service_account` (`list[obj]`): The service account to attach to the instance. When `null`, the `service_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.service_account.new](#fn-service_accountnew) constructor.\n  - `shielded_instance_config` (`list[obj]`): The shielded vm config being used by the instance. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     machine_type,
@@ -223,7 +223,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_instance.newAttrs` constructs a new object with attributes and blocks configured for the `compute_instance`\nTerraform resource.\n\nUnlike [google.compute_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `allow_stopping_for_update` (`bool`): If true, allows Terraform to stop the instance to update its properties. If you try to update a property that requires stopping the instance without setting this field, the update will fail. When `null`, the `allow_stopping_for_update` field will be omitted from the resulting object.\n  - `can_ip_forward` (`bool`): Whether sending and receiving of packets with non-matching source or destination IPs is allowed. When `null`, the `can_ip_forward` field will be omitted from the resulting object.\n  - `deletion_protection` (`bool`): Whether deletion protection is enabled on this instance. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `description` (`string`): A brief description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `desired_status` (`string`): Desired status of the instance. Either "RUNNING" or "TERMINATED". When `null`, the `desired_status` field will be omitted from the resulting object.\n  - `enable_display` (`bool`): Whether the instance has virtual displays enabled. When `null`, the `enable_display` field will be omitted from the resulting object.\n  - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.\n  - `hostname` (`string`): A custom hostname for the instance. Must be a fully qualified DNS name and RFC-1035-valid. Valid format is a series of labels 1-63 characters long matching the regular expression [a-z]([-a-z0-9]*[a-z0-9]), concatenated with periods. The entire hostname must not exceed 253 characters. Changing this forces a new resource to be created. When `null`, the `hostname` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs assigned to the instance. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to create.\n  - `metadata` (`obj`): Metadata key/value pairs made available within the instance. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `metadata_startup_script` (`string`): Metadata startup scripts made available within the instance. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): The minimum CPU platform specified for the VM instance. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance. One of name or self_link must be provided.\n  - `project` (`string`): The ID of the project in which the resource belongs. If self_link is provided, this value is ignored. If neither self_link nor project are provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `tags` (`list`): The list of tags attached to the instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `zone` (`string`): The zone of the instance. If self_link is provided, this value is ignored. If neither self_link nor zone are provided, the provider zone is used. When `null`, the `zone` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.\n  - `attached_disk` (`list[obj]`): List of disks attached to the instance When `null`, the `attached_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.attached_disk.new](#fn-attached_disknew) constructor.\n  - `boot_disk` (`list[obj]`): The boot disk for the instance. When `null`, the `boot_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.boot_disk.new](#fn-boot_disknew) constructor.\n  - `confidential_instance_config` (`list[obj]`): The Confidential VM config being used by the instance.  on_host_maintenance has to be set to TERMINATE or this will fail to create. When `null`, the `confidential_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.confidential_instance_config.new](#fn-confidential_instance_confignew) constructor.\n  - `network_interface` (`list[obj]`): The networks attached to the instance. When `null`, the `network_interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.network_interface.new](#fn-network_interfacenew) constructor.\n  - `network_performance_config` (`list[obj]`): Configures network performance settings for the instance. If not specified, the instance will be created with its default network performance configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.network_performance_config.new](#fn-network_performance_confignew) constructor.\n  - `params` (`list[obj]`): Stores additional params passed with the request, but not persisted as part of resource payload. When `null`, the `params` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.params.new](#fn-paramsnew) constructor.\n  - `reservation_affinity` (`list[obj]`): Specifies the reservations that this instance can consume from. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `scheduling` (`list[obj]`): The scheduling strategy being used by the instance. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.scheduling.new](#fn-schedulingnew) constructor.\n  - `scratch_disk` (`list[obj]`): The scratch disks attached to the instance. When `null`, the `scratch_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.scratch_disk.new](#fn-scratch_disknew) constructor.\n  - `service_account` (`list[obj]`): The service account to attach to the instance. When `null`, the `service_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.service_account.new](#fn-service_accountnew) constructor.\n  - `shielded_instance_config` (`list[obj]`): The shielded vm config being used by the instance. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_instance` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_instance.newAttrs` constructs a new object with attributes and blocks configured for the `compute_instance`\nTerraform resource.\n\nUnlike [google.compute_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `allow_stopping_for_update` (`bool`): If true, allows Terraform to stop the instance to update its properties. If you try to update a property that requires stopping the instance without setting this field, the update will fail. When `null`, the `allow_stopping_for_update` field will be omitted from the resulting object.\n  - `can_ip_forward` (`bool`): Whether sending and receiving of packets with non-matching source or destination IPs is allowed. When `null`, the `can_ip_forward` field will be omitted from the resulting object.\n  - `deletion_protection` (`bool`): Whether deletion protection is enabled on this instance. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `description` (`string`): A brief description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `desired_status` (`string`): Desired status of the instance. Either "RUNNING" or "TERMINATED". When `null`, the `desired_status` field will be omitted from the resulting object.\n  - `enable_display` (`bool`): Whether the instance has virtual displays enabled. When `null`, the `enable_display` field will be omitted from the resulting object.\n  - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.\n  - `hostname` (`string`): A custom hostname for the instance. Must be a fully qualified DNS name and RFC-1035-valid. Valid format is a series of labels 1-63 characters long matching the regular expression [a-z]([-a-z0-9]*[a-z0-9]), concatenated with periods. The entire hostname must not exceed 253 characters. Changing this forces a new resource to be created. When `null`, the `hostname` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs assigned to the instance.\n\t\t\t\t\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to create.\n  - `metadata` (`obj`): Metadata key/value pairs made available within the instance. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `metadata_startup_script` (`string`): Metadata startup scripts made available within the instance. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): The minimum CPU platform specified for the VM instance. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance. One of name or self_link must be provided.\n  - `project` (`string`): The ID of the project in which the resource belongs. If self_link is provided, this value is ignored. If neither self_link nor project are provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `tags` (`list`): The list of tags attached to the instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `zone` (`string`): The zone of the instance. If self_link is provided, this value is ignored. If neither self_link nor zone are provided, the provider zone is used. When `null`, the `zone` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.\n  - `attached_disk` (`list[obj]`): List of disks attached to the instance When `null`, the `attached_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.attached_disk.new](#fn-attached_disknew) constructor.\n  - `boot_disk` (`list[obj]`): The boot disk for the instance. When `null`, the `boot_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.boot_disk.new](#fn-boot_disknew) constructor.\n  - `confidential_instance_config` (`list[obj]`): The Confidential VM config being used by the instance.  on_host_maintenance has to be set to TERMINATE or this will fail to create. When `null`, the `confidential_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.confidential_instance_config.new](#fn-confidential_instance_confignew) constructor.\n  - `network_interface` (`list[obj]`): The networks attached to the instance. When `null`, the `network_interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.network_interface.new](#fn-network_interfacenew) constructor.\n  - `network_performance_config` (`list[obj]`): Configures network performance settings for the instance. If not specified, the instance will be created with its default network performance configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.network_performance_config.new](#fn-network_performance_confignew) constructor.\n  - `params` (`list[obj]`): Stores additional params passed with the request, but not persisted as part of resource payload. When `null`, the `params` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.params.new](#fn-paramsnew) constructor.\n  - `reservation_affinity` (`list[obj]`): Specifies the reservations that this instance can consume from. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `scheduling` (`list[obj]`): The scheduling strategy being used by the instance. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.scheduling.new](#fn-schedulingnew) constructor.\n  - `scratch_disk` (`list[obj]`): The scratch disks attached to the instance. When `null`, the `scratch_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.scratch_disk.new](#fn-scratch_disknew) constructor.\n  - `service_account` (`list[obj]`): The service account to attach to the instance. When `null`, the `service_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.service_account.new](#fn-service_accountnew) constructor.\n  - `shielded_instance_config` (`list[obj]`): The shielded vm config being used by the instance. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_instance` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     machine_type,
     name,
@@ -362,11 +362,13 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     },
   },
   scratch_disk:: {
-    '#new':: d.fn(help='\n`google.compute_instance.scratch_disk.new` constructs a new object with attributes and blocks configured for the `scratch_disk`\nTerraform sub block.\n\n\n\n**Args**:\n  - `interface` (`string`): The disk interface used for attaching this disk. One of SCSI or NVME.\n  - `size` (`number`): The size of the disk in gigabytes. One of 375 or 3000. When `null`, the `size` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `scratch_disk` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.compute_instance.scratch_disk.new` constructs a new object with attributes and blocks configured for the `scratch_disk`\nTerraform sub block.\n\n\n\n**Args**:\n  - `device_name` (`string`): Name with which the attached disk is accessible under /dev/disk/by-id/ When `null`, the `device_name` field will be omitted from the resulting object.\n  - `interface` (`string`): The disk interface used for attaching this disk. One of SCSI or NVME.\n  - `size` (`number`): The size of the disk in gigabytes. One of 375 or 3000. When `null`, the `size` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `scratch_disk` sub block.\n', args=[]),
     new(
       interface,
+      device_name=null,
       size=null
     ):: std.prune(a={
+      device_name: device_name,
       interface: interface,
       size: size,
     }),
diff --git a/4.x/_gen/resources/compute_instance_from_template.libsonnet b/4.x/_gen/resources/compute_instance_from_template.libsonnet
index 7135d229..da643895 100644
--- a/4.x/_gen/resources/compute_instance_from_template.libsonnet
+++ b/4.x/_gen/resources/compute_instance_from_template.libsonnet
@@ -112,7 +112,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       total_egress_bandwidth_tier: total_egress_bandwidth_tier,
     }),
   },
-  '#new':: d.fn(help="\n`google.compute_instance_from_template.new` injects a new `google_compute_instance_from_template` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_instance_from_template.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_instance_from_template` using the reference:\n\n    $._ref.google_compute_instance_from_template.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_instance_from_template.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `allow_stopping_for_update` (`bool`): If true, allows Terraform to stop the instance to update its properties. If you try to update a property that requires stopping the instance without setting this field, the update will fail. When `null`, the `allow_stopping_for_update` field will be omitted from the resulting object.\n  - `attached_disk` (`list`): List of disks attached to the instance When `null`, the `attached_disk` field will be omitted from the resulting object.\n  - `can_ip_forward` (`bool`): Whether sending and receiving of packets with non-matching source or destination IPs is allowed. When `null`, the `can_ip_forward` field will be omitted from the resulting object.\n  - `deletion_protection` (`bool`): Whether deletion protection is enabled on this instance. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `description` (`string`): A brief description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `desired_status` (`string`): Desired status of the instance. Either \u0026#34;RUNNING\u0026#34; or \u0026#34;TERMINATED\u0026#34;. When `null`, the `desired_status` field will be omitted from the resulting object.\n  - `enable_display` (`bool`): Whether the instance has virtual displays enabled. When `null`, the `enable_display` field will be omitted from the resulting object.\n  - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.\n  - `hostname` (`string`): A custom hostname for the instance. Must be a fully qualified DNS name and RFC-1035-valid. Valid format is a series of labels 1-63 characters long matching the regular expression [a-z]([-a-z0-9]*[a-z0-9]), concatenated with periods. The entire hostname must not exceed 253 characters. Changing this forces a new resource to be created. When `null`, the `hostname` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs assigned to the instance. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to create. When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `metadata` (`obj`): Metadata key/value pairs made available within the instance. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `metadata_startup_script` (`string`): Metadata startup scripts made available within the instance. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): The minimum CPU platform specified for the VM instance. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance. One of name or self_link must be provided.\n  - `project` (`string`): The ID of the project in which the resource belongs. If self_link is provided, this value is ignored. If neither self_link nor project are provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `scratch_disk` (`list`): The scratch disks attached to the instance. When `null`, the `scratch_disk` field will be omitted from the resulting object.\n  - `service_account` (`list`): The service account to attach to the instance. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `source_instance_template` (`string`): Name or self link of an instance template to create the instance based on.\n  - `tags` (`list`): The list of tags attached to the instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `zone` (`string`): The zone of the instance. If self_link is provided, this value is ignored. If neither self_link nor zone are provided, the provider zone is used. When `null`, the `zone` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.\n  - `boot_disk` (`list[obj]`): The boot disk for the instance. When `null`, the `boot_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.boot_disk.new](#fn-boot_disknew) constructor.\n  - `confidential_instance_config` (`list[obj]`): The Confidential VM config being used by the instance.  on_host_maintenance has to be set to TERMINATE or this will fail to create. When `null`, the `confidential_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.confidential_instance_config.new](#fn-confidential_instance_confignew) constructor.\n  - `network_interface` (`list[obj]`): The networks attached to the instance. When `null`, the `network_interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.network_interface.new](#fn-network_interfacenew) constructor.\n  - `network_performance_config` (`list[obj]`): Configures network performance settings for the instance. If not specified, the instance will be created with its default network performance configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.network_performance_config.new](#fn-network_performance_confignew) constructor.\n  - `params` (`list[obj]`): Stores additional params passed with the request, but not persisted as part of resource payload. When `null`, the `params` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.params.new](#fn-paramsnew) constructor.\n  - `reservation_affinity` (`list[obj]`): Specifies the reservations that this instance can consume from. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `scheduling` (`list[obj]`): The scheduling strategy being used by the instance. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.scheduling.new](#fn-schedulingnew) constructor.\n  - `shielded_instance_config` (`list[obj]`): The shielded vm config being used by the instance. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_instance_from_template.new` injects a new `google_compute_instance_from_template` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_instance_from_template.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_instance_from_template` using the reference:\n\n    $._ref.google_compute_instance_from_template.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_instance_from_template.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `allow_stopping_for_update` (`bool`): If true, allows Terraform to stop the instance to update its properties. If you try to update a property that requires stopping the instance without setting this field, the update will fail. When `null`, the `allow_stopping_for_update` field will be omitted from the resulting object.\n  - `attached_disk` (`list`): List of disks attached to the instance When `null`, the `attached_disk` field will be omitted from the resulting object.\n  - `can_ip_forward` (`bool`): Whether sending and receiving of packets with non-matching source or destination IPs is allowed. When `null`, the `can_ip_forward` field will be omitted from the resulting object.\n  - `deletion_protection` (`bool`): Whether deletion protection is enabled on this instance. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `description` (`string`): A brief description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `desired_status` (`string`): Desired status of the instance. Either \u0026#34;RUNNING\u0026#34; or \u0026#34;TERMINATED\u0026#34;. When `null`, the `desired_status` field will be omitted from the resulting object.\n  - `enable_display` (`bool`): Whether the instance has virtual displays enabled. When `null`, the `enable_display` field will be omitted from the resulting object.\n  - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.\n  - `hostname` (`string`): A custom hostname for the instance. Must be a fully qualified DNS name and RFC-1035-valid. Valid format is a series of labels 1-63 characters long matching the regular expression [a-z]([-a-z0-9]*[a-z0-9]), concatenated with periods. The entire hostname must not exceed 253 characters. Changing this forces a new resource to be created. When `null`, the `hostname` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs assigned to the instance.\n\t\t\t\t\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to create. When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `metadata` (`obj`): Metadata key/value pairs made available within the instance. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `metadata_startup_script` (`string`): Metadata startup scripts made available within the instance. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): The minimum CPU platform specified for the VM instance. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance. One of name or self_link must be provided.\n  - `project` (`string`): The ID of the project in which the resource belongs. If self_link is provided, this value is ignored. If neither self_link nor project are provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `scratch_disk` (`list`): The scratch disks attached to the instance. When `null`, the `scratch_disk` field will be omitted from the resulting object.\n  - `service_account` (`list`): The service account to attach to the instance. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `source_instance_template` (`string`): Name or self link of an instance template to create the instance based on.\n  - `tags` (`list`): The list of tags attached to the instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `zone` (`string`): The zone of the instance. If self_link is provided, this value is ignored. If neither self_link nor zone are provided, the provider zone is used. When `null`, the `zone` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.\n  - `boot_disk` (`list[obj]`): The boot disk for the instance. When `null`, the `boot_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.boot_disk.new](#fn-boot_disknew) constructor.\n  - `confidential_instance_config` (`list[obj]`): The Confidential VM config being used by the instance.  on_host_maintenance has to be set to TERMINATE or this will fail to create. When `null`, the `confidential_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.confidential_instance_config.new](#fn-confidential_instance_confignew) constructor.\n  - `network_interface` (`list[obj]`): The networks attached to the instance. When `null`, the `network_interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.network_interface.new](#fn-network_interfacenew) constructor.\n  - `network_performance_config` (`list[obj]`): Configures network performance settings for the instance. If not specified, the instance will be created with its default network performance configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.network_performance_config.new](#fn-network_performance_confignew) constructor.\n  - `params` (`list[obj]`): Stores additional params passed with the request, but not persisted as part of resource payload. When `null`, the `params` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.params.new](#fn-paramsnew) constructor.\n  - `reservation_affinity` (`list[obj]`): Specifies the reservations that this instance can consume from. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `scheduling` (`list[obj]`): The scheduling strategy being used by the instance. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.scheduling.new](#fn-schedulingnew) constructor.\n  - `shielded_instance_config` (`list[obj]`): The shielded vm config being used by the instance. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -187,7 +187,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_instance_from_template.newAttrs` constructs a new object with attributes and blocks configured for the `compute_instance_from_template`\nTerraform resource.\n\nUnlike [google.compute_instance_from_template.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `allow_stopping_for_update` (`bool`): If true, allows Terraform to stop the instance to update its properties. If you try to update a property that requires stopping the instance without setting this field, the update will fail. When `null`, the `allow_stopping_for_update` field will be omitted from the resulting object.\n  - `attached_disk` (`list`): List of disks attached to the instance When `null`, the `attached_disk` field will be omitted from the resulting object.\n  - `can_ip_forward` (`bool`): Whether sending and receiving of packets with non-matching source or destination IPs is allowed. When `null`, the `can_ip_forward` field will be omitted from the resulting object.\n  - `deletion_protection` (`bool`): Whether deletion protection is enabled on this instance. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `description` (`string`): A brief description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `desired_status` (`string`): Desired status of the instance. Either "RUNNING" or "TERMINATED". When `null`, the `desired_status` field will be omitted from the resulting object.\n  - `enable_display` (`bool`): Whether the instance has virtual displays enabled. When `null`, the `enable_display` field will be omitted from the resulting object.\n  - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.\n  - `hostname` (`string`): A custom hostname for the instance. Must be a fully qualified DNS name and RFC-1035-valid. Valid format is a series of labels 1-63 characters long matching the regular expression [a-z]([-a-z0-9]*[a-z0-9]), concatenated with periods. The entire hostname must not exceed 253 characters. Changing this forces a new resource to be created. When `null`, the `hostname` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs assigned to the instance. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to create. When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `metadata` (`obj`): Metadata key/value pairs made available within the instance. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `metadata_startup_script` (`string`): Metadata startup scripts made available within the instance. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): The minimum CPU platform specified for the VM instance. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance. One of name or self_link must be provided.\n  - `project` (`string`): The ID of the project in which the resource belongs. If self_link is provided, this value is ignored. If neither self_link nor project are provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `scratch_disk` (`list`): The scratch disks attached to the instance. When `null`, the `scratch_disk` field will be omitted from the resulting object.\n  - `service_account` (`list`): The service account to attach to the instance. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `source_instance_template` (`string`): Name or self link of an instance template to create the instance based on.\n  - `tags` (`list`): The list of tags attached to the instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `zone` (`string`): The zone of the instance. If self_link is provided, this value is ignored. If neither self_link nor zone are provided, the provider zone is used. When `null`, the `zone` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.\n  - `boot_disk` (`list[obj]`): The boot disk for the instance. When `null`, the `boot_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.boot_disk.new](#fn-boot_disknew) constructor.\n  - `confidential_instance_config` (`list[obj]`): The Confidential VM config being used by the instance.  on_host_maintenance has to be set to TERMINATE or this will fail to create. When `null`, the `confidential_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.confidential_instance_config.new](#fn-confidential_instance_confignew) constructor.\n  - `network_interface` (`list[obj]`): The networks attached to the instance. When `null`, the `network_interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.network_interface.new](#fn-network_interfacenew) constructor.\n  - `network_performance_config` (`list[obj]`): Configures network performance settings for the instance. If not specified, the instance will be created with its default network performance configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.network_performance_config.new](#fn-network_performance_confignew) constructor.\n  - `params` (`list[obj]`): Stores additional params passed with the request, but not persisted as part of resource payload. When `null`, the `params` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.params.new](#fn-paramsnew) constructor.\n  - `reservation_affinity` (`list[obj]`): Specifies the reservations that this instance can consume from. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `scheduling` (`list[obj]`): The scheduling strategy being used by the instance. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.scheduling.new](#fn-schedulingnew) constructor.\n  - `shielded_instance_config` (`list[obj]`): The shielded vm config being used by the instance. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_instance_from_template` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_instance_from_template.newAttrs` constructs a new object with attributes and blocks configured for the `compute_instance_from_template`\nTerraform resource.\n\nUnlike [google.compute_instance_from_template.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `allow_stopping_for_update` (`bool`): If true, allows Terraform to stop the instance to update its properties. If you try to update a property that requires stopping the instance without setting this field, the update will fail. When `null`, the `allow_stopping_for_update` field will be omitted from the resulting object.\n  - `attached_disk` (`list`): List of disks attached to the instance When `null`, the `attached_disk` field will be omitted from the resulting object.\n  - `can_ip_forward` (`bool`): Whether sending and receiving of packets with non-matching source or destination IPs is allowed. When `null`, the `can_ip_forward` field will be omitted from the resulting object.\n  - `deletion_protection` (`bool`): Whether deletion protection is enabled on this instance. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `description` (`string`): A brief description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `desired_status` (`string`): Desired status of the instance. Either "RUNNING" or "TERMINATED". When `null`, the `desired_status` field will be omitted from the resulting object.\n  - `enable_display` (`bool`): Whether the instance has virtual displays enabled. When `null`, the `enable_display` field will be omitted from the resulting object.\n  - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.\n  - `hostname` (`string`): A custom hostname for the instance. Must be a fully qualified DNS name and RFC-1035-valid. Valid format is a series of labels 1-63 characters long matching the regular expression [a-z]([-a-z0-9]*[a-z0-9]), concatenated with periods. The entire hostname must not exceed 253 characters. Changing this forces a new resource to be created. When `null`, the `hostname` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs assigned to the instance.\n\t\t\t\t\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to create. When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `metadata` (`obj`): Metadata key/value pairs made available within the instance. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `metadata_startup_script` (`string`): Metadata startup scripts made available within the instance. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): The minimum CPU platform specified for the VM instance. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance. One of name or self_link must be provided.\n  - `project` (`string`): The ID of the project in which the resource belongs. If self_link is provided, this value is ignored. If neither self_link nor project are provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `scratch_disk` (`list`): The scratch disks attached to the instance. When `null`, the `scratch_disk` field will be omitted from the resulting object.\n  - `service_account` (`list`): The service account to attach to the instance. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `source_instance_template` (`string`): Name or self link of an instance template to create the instance based on.\n  - `tags` (`list`): The list of tags attached to the instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `zone` (`string`): The zone of the instance. If self_link is provided, this value is ignored. If neither self_link nor zone are provided, the provider zone is used. When `null`, the `zone` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.\n  - `boot_disk` (`list[obj]`): The boot disk for the instance. When `null`, the `boot_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.boot_disk.new](#fn-boot_disknew) constructor.\n  - `confidential_instance_config` (`list[obj]`): The Confidential VM config being used by the instance.  on_host_maintenance has to be set to TERMINATE or this will fail to create. When `null`, the `confidential_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.confidential_instance_config.new](#fn-confidential_instance_confignew) constructor.\n  - `network_interface` (`list[obj]`): The networks attached to the instance. When `null`, the `network_interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.network_interface.new](#fn-network_interfacenew) constructor.\n  - `network_performance_config` (`list[obj]`): Configures network performance settings for the instance. If not specified, the instance will be created with its default network performance configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.network_performance_config.new](#fn-network_performance_confignew) constructor.\n  - `params` (`list[obj]`): Stores additional params passed with the request, but not persisted as part of resource payload. When `null`, the `params` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.params.new](#fn-paramsnew) constructor.\n  - `reservation_affinity` (`list[obj]`): Specifies the reservations that this instance can consume from. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `scheduling` (`list[obj]`): The scheduling strategy being used by the instance. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.scheduling.new](#fn-schedulingnew) constructor.\n  - `shielded_instance_config` (`list[obj]`): The shielded vm config being used by the instance. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_from_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_instance_from_template` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     source_instance_template,
diff --git a/4.x/_gen/resources/compute_instance_group_manager.libsonnet b/4.x/_gen/resources/compute_instance_group_manager.libsonnet
index a9d81bd4..92f623e2 100644
--- a/4.x/_gen/resources/compute_instance_group_manager.libsonnet
+++ b/4.x/_gen/resources/compute_instance_group_manager.libsonnet
@@ -30,7 +30,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       port: port,
     }),
   },
-  '#new':: d.fn(help="\n`google.compute_instance_group_manager.new` injects a new `google_compute_instance_group_manager` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_instance_group_manager.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_instance_group_manager` using the reference:\n\n    $._ref.google_compute_instance_group_manager.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_instance_group_manager.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `base_instance_name` (`string`): The base instance name to use for instances in this group. The value must be a valid RFC1035 name. Supported characters are lowercase letters, numbers, and hyphens (-). Instances are named by appending a hyphen and a random four-character string to the base instance name.\n  - `description` (`string`): An optional textual description of the instance group manager. When `null`, the `description` field will be omitted from the resulting object.\n  - `list_managed_instances_results` (`string`): Pagination behavior of the listManagedInstances API method for this managed instance group. Valid values are: \u0026#34;PAGELESS\u0026#34;, \u0026#34;PAGINATED\u0026#34;. If PAGELESS (default), Pagination is disabled for the group\u0026#39;s listManagedInstances API method. maxResults and pageToken query parameters are ignored and all instances are returned in a single response. If PAGINATED, pagination is enabled, maxResults and pageToken query parameters are respected. When `null`, the `list_managed_instances_results` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance group manager. Must be 1-63 characters long and comply with RFC1035. Supported characters include lowercase letters, numbers, and hyphens.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `target_pools` (`list`): The full URL of all target pools to which new instances in the group are added. Updating the target pools attribute does not affect existing instances. When `null`, the `target_pools` field will be omitted from the resulting object.\n  - `target_size` (`number`): The target number of running instances for this managed instance group. This value should always be explicitly set unless this resource is attached to an autoscaler, in which case it should never be set. Defaults to 0. When `null`, the `target_size` field will be omitted from the resulting object.\n  - `wait_for_instances` (`bool`): Whether to wait for all instances to be created/updated before returning. Note that if this is set to true and the operation does not succeed, Terraform will continue trying until it times out. When `null`, the `wait_for_instances` field will be omitted from the resulting object.\n  - `wait_for_instances_status` (`string`): When used with wait_for_instances specifies the status to wait for. When STABLE is specified this resource will wait until the instances are stable before returning. When UPDATED is set, it will wait for the version target to be reached and any per instance configs to be effective as well as all instances to be stable before returning. When `null`, the `wait_for_instances_status` field will be omitted from the resulting object.\n  - `zone` (`string`): The zone that instances in this group should be created in. When `null`, the `zone` field will be omitted from the resulting object.\n  - `auto_healing_policies` (`list[obj]`): The autohealing policies for this managed instance group. You can specify only one value. When `null`, the `auto_healing_policies` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.auto_healing_policies.new](#fn-auto_healing_policiesnew) constructor.\n  - `instance_lifecycle_policy` (`list[obj]`): The instance lifecycle policy for this managed instance group. When `null`, the `instance_lifecycle_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.instance_lifecycle_policy.new](#fn-instance_lifecycle_policynew) constructor.\n  - `named_port` (`list[obj]`): The named port configuration. When `null`, the `named_port` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.named_port.new](#fn-named_portnew) constructor.\n  - `stateful_disk` (`list[obj]`): Disks created on the instances that will be preserved on instance delete, update, etc. When `null`, the `stateful_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.stateful_disk.new](#fn-stateful_disknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.timeouts.new](#fn-timeoutsnew) constructor.\n  - `update_policy` (`list[obj]`): The update policy for this managed instance group. When `null`, the `update_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.update_policy.new](#fn-update_policynew) constructor.\n  - `version` (`list[obj]`): Application versions managed by this instance group. Each version deals with a specific instance template, allowing canary release scenarios. When `null`, the `version` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.version.new](#fn-versionnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_instance_group_manager.new` injects a new `google_compute_instance_group_manager` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_instance_group_manager.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_instance_group_manager` using the reference:\n\n    $._ref.google_compute_instance_group_manager.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_instance_group_manager.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `base_instance_name` (`string`): The base instance name to use for instances in this group. The value must be a valid RFC1035 name. Supported characters are lowercase letters, numbers, and hyphens (-). Instances are named by appending a hyphen and a random four-character string to the base instance name.\n  - `description` (`string`): An optional textual description of the instance group manager. When `null`, the `description` field will be omitted from the resulting object.\n  - `list_managed_instances_results` (`string`): Pagination behavior of the listManagedInstances API method for this managed instance group. Valid values are: \u0026#34;PAGELESS\u0026#34;, \u0026#34;PAGINATED\u0026#34;. If PAGELESS (default), Pagination is disabled for the group\u0026#39;s listManagedInstances API method. maxResults and pageToken query parameters are ignored and all instances are returned in a single response. If PAGINATED, pagination is enabled, maxResults and pageToken query parameters are respected. When `null`, the `list_managed_instances_results` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance group manager. Must be 1-63 characters long and comply with RFC1035. Supported characters include lowercase letters, numbers, and hyphens.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `target_pools` (`list`): The full URL of all target pools to which new instances in the group are added. Updating the target pools attribute does not affect existing instances. When `null`, the `target_pools` field will be omitted from the resulting object.\n  - `target_size` (`number`): The target number of running instances for this managed instance group. This value should always be explicitly set unless this resource is attached to an autoscaler, in which case it should never be set. Defaults to 0. When `null`, the `target_size` field will be omitted from the resulting object.\n  - `wait_for_instances` (`bool`): Whether to wait for all instances to be created/updated before returning. Note that if this is set to true and the operation does not succeed, Terraform will continue trying until it times out. When `null`, the `wait_for_instances` field will be omitted from the resulting object.\n  - `wait_for_instances_status` (`string`): When used with wait_for_instances specifies the status to wait for. When STABLE is specified this resource will wait until the instances are stable before returning. When UPDATED is set, it will wait for the version target to be reached and any per instance configs to be effective as well as all instances to be stable before returning. When `null`, the `wait_for_instances_status` field will be omitted from the resulting object.\n  - `zone` (`string`): The zone that instances in this group should be created in. When `null`, the `zone` field will be omitted from the resulting object.\n  - `auto_healing_policies` (`list[obj]`): The autohealing policies for this managed instance group. You can specify only one value. When `null`, the `auto_healing_policies` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.auto_healing_policies.new](#fn-auto_healing_policiesnew) constructor.\n  - `instance_lifecycle_policy` (`list[obj]`): The instance lifecycle policy for this managed instance group. When `null`, the `instance_lifecycle_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.instance_lifecycle_policy.new](#fn-instance_lifecycle_policynew) constructor.\n  - `named_port` (`list[obj]`): The named port configuration. When `null`, the `named_port` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.named_port.new](#fn-named_portnew) constructor.\n  - `stateful_disk` (`list[obj]`): Disks created on the instances that will be preserved on instance delete, update, etc. When `null`, the `stateful_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.stateful_disk.new](#fn-stateful_disknew) constructor.\n  - `stateful_external_ip` (`list[obj]`): External IPs considered stateful by the instance group.  When `null`, the `stateful_external_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.stateful_external_ip.new](#fn-stateful_external_ipnew) constructor.\n  - `stateful_internal_ip` (`list[obj]`): External IPs considered stateful by the instance group.  When `null`, the `stateful_internal_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.stateful_internal_ip.new](#fn-stateful_internal_ipnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.timeouts.new](#fn-timeoutsnew) constructor.\n  - `update_policy` (`list[obj]`): The update policy for this managed instance group. When `null`, the `update_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.update_policy.new](#fn-update_policynew) constructor.\n  - `version` (`list[obj]`): Application versions managed by this instance group. Each version deals with a specific instance template, allowing canary release scenarios. When `null`, the `version` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.version.new](#fn-versionnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     base_instance_name,
@@ -42,6 +42,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     named_port=null,
     project=null,
     stateful_disk=null,
+    stateful_external_ip=null,
+    stateful_internal_ip=null,
     target_pools=null,
     target_size=null,
     timeouts=null,
@@ -64,6 +66,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       named_port=named_port,
       project=project,
       stateful_disk=stateful_disk,
+      stateful_external_ip=stateful_external_ip,
+      stateful_internal_ip=stateful_internal_ip,
       target_pools=target_pools,
       target_size=target_size,
       timeouts=timeouts,
@@ -75,7 +79,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_instance_group_manager.newAttrs` constructs a new object with attributes and blocks configured for the `compute_instance_group_manager`\nTerraform resource.\n\nUnlike [google.compute_instance_group_manager.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `base_instance_name` (`string`): The base instance name to use for instances in this group. The value must be a valid RFC1035 name. Supported characters are lowercase letters, numbers, and hyphens (-). Instances are named by appending a hyphen and a random four-character string to the base instance name.\n  - `description` (`string`): An optional textual description of the instance group manager. When `null`, the `description` field will be omitted from the resulting object.\n  - `list_managed_instances_results` (`string`): Pagination behavior of the listManagedInstances API method for this managed instance group. Valid values are: "PAGELESS", "PAGINATED". If PAGELESS (default), Pagination is disabled for the group's listManagedInstances API method. maxResults and pageToken query parameters are ignored and all instances are returned in a single response. If PAGINATED, pagination is enabled, maxResults and pageToken query parameters are respected. When `null`, the `list_managed_instances_results` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance group manager. Must be 1-63 characters long and comply with RFC1035. Supported characters include lowercase letters, numbers, and hyphens.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `target_pools` (`list`): The full URL of all target pools to which new instances in the group are added. Updating the target pools attribute does not affect existing instances. When `null`, the `target_pools` field will be omitted from the resulting object.\n  - `target_size` (`number`): The target number of running instances for this managed instance group. This value should always be explicitly set unless this resource is attached to an autoscaler, in which case it should never be set. Defaults to 0. When `null`, the `target_size` field will be omitted from the resulting object.\n  - `wait_for_instances` (`bool`): Whether to wait for all instances to be created/updated before returning. Note that if this is set to true and the operation does not succeed, Terraform will continue trying until it times out. When `null`, the `wait_for_instances` field will be omitted from the resulting object.\n  - `wait_for_instances_status` (`string`): When used with wait_for_instances specifies the status to wait for. When STABLE is specified this resource will wait until the instances are stable before returning. When UPDATED is set, it will wait for the version target to be reached and any per instance configs to be effective as well as all instances to be stable before returning. When `null`, the `wait_for_instances_status` field will be omitted from the resulting object.\n  - `zone` (`string`): The zone that instances in this group should be created in. When `null`, the `zone` field will be omitted from the resulting object.\n  - `auto_healing_policies` (`list[obj]`): The autohealing policies for this managed instance group. You can specify only one value. When `null`, the `auto_healing_policies` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.auto_healing_policies.new](#fn-auto_healing_policiesnew) constructor.\n  - `instance_lifecycle_policy` (`list[obj]`): The instance lifecycle policy for this managed instance group. When `null`, the `instance_lifecycle_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.instance_lifecycle_policy.new](#fn-instance_lifecycle_policynew) constructor.\n  - `named_port` (`list[obj]`): The named port configuration. When `null`, the `named_port` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.named_port.new](#fn-named_portnew) constructor.\n  - `stateful_disk` (`list[obj]`): Disks created on the instances that will be preserved on instance delete, update, etc. When `null`, the `stateful_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.stateful_disk.new](#fn-stateful_disknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.timeouts.new](#fn-timeoutsnew) constructor.\n  - `update_policy` (`list[obj]`): The update policy for this managed instance group. When `null`, the `update_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.update_policy.new](#fn-update_policynew) constructor.\n  - `version` (`list[obj]`): Application versions managed by this instance group. Each version deals with a specific instance template, allowing canary release scenarios. When `null`, the `version` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.version.new](#fn-versionnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_instance_group_manager` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_instance_group_manager.newAttrs` constructs a new object with attributes and blocks configured for the `compute_instance_group_manager`\nTerraform resource.\n\nUnlike [google.compute_instance_group_manager.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `base_instance_name` (`string`): The base instance name to use for instances in this group. The value must be a valid RFC1035 name. Supported characters are lowercase letters, numbers, and hyphens (-). Instances are named by appending a hyphen and a random four-character string to the base instance name.\n  - `description` (`string`): An optional textual description of the instance group manager. When `null`, the `description` field will be omitted from the resulting object.\n  - `list_managed_instances_results` (`string`): Pagination behavior of the listManagedInstances API method for this managed instance group. Valid values are: "PAGELESS", "PAGINATED". If PAGELESS (default), Pagination is disabled for the group's listManagedInstances API method. maxResults and pageToken query parameters are ignored and all instances are returned in a single response. If PAGINATED, pagination is enabled, maxResults and pageToken query parameters are respected. When `null`, the `list_managed_instances_results` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance group manager. Must be 1-63 characters long and comply with RFC1035. Supported characters include lowercase letters, numbers, and hyphens.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `target_pools` (`list`): The full URL of all target pools to which new instances in the group are added. Updating the target pools attribute does not affect existing instances. When `null`, the `target_pools` field will be omitted from the resulting object.\n  - `target_size` (`number`): The target number of running instances for this managed instance group. This value should always be explicitly set unless this resource is attached to an autoscaler, in which case it should never be set. Defaults to 0. When `null`, the `target_size` field will be omitted from the resulting object.\n  - `wait_for_instances` (`bool`): Whether to wait for all instances to be created/updated before returning. Note that if this is set to true and the operation does not succeed, Terraform will continue trying until it times out. When `null`, the `wait_for_instances` field will be omitted from the resulting object.\n  - `wait_for_instances_status` (`string`): When used with wait_for_instances specifies the status to wait for. When STABLE is specified this resource will wait until the instances are stable before returning. When UPDATED is set, it will wait for the version target to be reached and any per instance configs to be effective as well as all instances to be stable before returning. When `null`, the `wait_for_instances_status` field will be omitted from the resulting object.\n  - `zone` (`string`): The zone that instances in this group should be created in. When `null`, the `zone` field will be omitted from the resulting object.\n  - `auto_healing_policies` (`list[obj]`): The autohealing policies for this managed instance group. You can specify only one value. When `null`, the `auto_healing_policies` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.auto_healing_policies.new](#fn-auto_healing_policiesnew) constructor.\n  - `instance_lifecycle_policy` (`list[obj]`): The instance lifecycle policy for this managed instance group. When `null`, the `instance_lifecycle_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.instance_lifecycle_policy.new](#fn-instance_lifecycle_policynew) constructor.\n  - `named_port` (`list[obj]`): The named port configuration. When `null`, the `named_port` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.named_port.new](#fn-named_portnew) constructor.\n  - `stateful_disk` (`list[obj]`): Disks created on the instances that will be preserved on instance delete, update, etc. When `null`, the `stateful_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.stateful_disk.new](#fn-stateful_disknew) constructor.\n  - `stateful_external_ip` (`list[obj]`): External IPs considered stateful by the instance group.  When `null`, the `stateful_external_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.stateful_external_ip.new](#fn-stateful_external_ipnew) constructor.\n  - `stateful_internal_ip` (`list[obj]`): External IPs considered stateful by the instance group.  When `null`, the `stateful_internal_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.stateful_internal_ip.new](#fn-stateful_internal_ipnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.timeouts.new](#fn-timeoutsnew) constructor.\n  - `update_policy` (`list[obj]`): The update policy for this managed instance group. When `null`, the `update_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.update_policy.new](#fn-update_policynew) constructor.\n  - `version` (`list[obj]`): Application versions managed by this instance group. Each version deals with a specific instance template, allowing canary release scenarios. When `null`, the `version` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.version.new](#fn-versionnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_instance_group_manager` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     base_instance_name,
     name,
@@ -86,6 +90,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     named_port=null,
     project=null,
     stateful_disk=null,
+    stateful_external_ip=null,
+    stateful_internal_ip=null,
     target_pools=null,
     target_size=null,
     timeouts=null,
@@ -104,6 +110,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     named_port: named_port,
     project: project,
     stateful_disk: stateful_disk,
+    stateful_external_ip: stateful_external_ip,
+    stateful_internal_ip: stateful_internal_ip,
     target_pools: target_pools,
     target_size: target_size,
     timeouts: timeouts,
@@ -123,6 +131,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       device_name: device_name,
     }),
   },
+  stateful_external_ip:: {
+    '#new':: d.fn(help='\n`google.compute_instance_group_manager.stateful_external_ip.new` constructs a new object with attributes and blocks configured for the `stateful_external_ip`\nTerraform sub block.\n\n\n\n**Args**:\n  - `delete_rule` (`string`): A value that prescribes what should happen to an associated static Address resource when a VM instance is permanently deleted. The available options are NEVER and ON_PERMANENT_INSTANCE_DELETION. NEVER - detach the IP when the VM is deleted, but do not delete the address resource. ON_PERMANENT_INSTANCE_DELETION will delete the stateful address when the VM is permanently deleted from the instance group. The default is NEVER. When `null`, the `delete_rule` field will be omitted from the resulting object.\n  - `interface_name` (`string`): The network interface name When `null`, the `interface_name` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `stateful_external_ip` sub block.\n', args=[]),
+    new(
+      delete_rule=null,
+      interface_name=null
+    ):: std.prune(a={
+      delete_rule: delete_rule,
+      interface_name: interface_name,
+    }),
+  },
+  stateful_internal_ip:: {
+    '#new':: d.fn(help='\n`google.compute_instance_group_manager.stateful_internal_ip.new` constructs a new object with attributes and blocks configured for the `stateful_internal_ip`\nTerraform sub block.\n\n\n\n**Args**:\n  - `delete_rule` (`string`): A value that prescribes what should happen to an associated static Address resource when a VM instance is permanently deleted. The available options are NEVER and ON_PERMANENT_INSTANCE_DELETION. NEVER - detach the IP when the VM is deleted, but do not delete the address resource. ON_PERMANENT_INSTANCE_DELETION will delete the stateful address when the VM is permanently deleted from the instance group. The default is NEVER. When `null`, the `delete_rule` field will be omitted from the resulting object.\n  - `interface_name` (`string`): The network interface name When `null`, the `interface_name` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `stateful_internal_ip` sub block.\n', args=[]),
+    new(
+      delete_rule=null,
+      interface_name=null
+    ):: std.prune(a={
+      delete_rule: delete_rule,
+      interface_name: interface_name,
+    }),
+  },
   timeouts:: {
     '#new':: d.fn(help='\n`google.compute_instance_group_manager.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
     new(
@@ -309,6 +337,46 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withStatefulExternalIp':: d.fn(help='`google.list[obj].withStatefulExternalIp` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the stateful_external_ip field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withStatefulExternalIpMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `stateful_external_ip` field.\n', args=[]),
+  withStatefulExternalIp(resourceLabel, value): {
+    resource+: {
+      google_compute_instance_group_manager+: {
+        [resourceLabel]+: {
+          stateful_external_ip: value,
+        },
+      },
+    },
+  },
+  '#withStatefulExternalIpMixin':: d.fn(help='`google.list[obj].withStatefulExternalIpMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the stateful_external_ip field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withStatefulExternalIp](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `stateful_external_ip` field.\n', args=[]),
+  withStatefulExternalIpMixin(resourceLabel, value): {
+    resource+: {
+      google_compute_instance_group_manager+: {
+        [resourceLabel]+: {
+          stateful_external_ip+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withStatefulInternalIp':: d.fn(help='`google.list[obj].withStatefulInternalIp` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the stateful_internal_ip field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withStatefulInternalIpMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `stateful_internal_ip` field.\n', args=[]),
+  withStatefulInternalIp(resourceLabel, value): {
+    resource+: {
+      google_compute_instance_group_manager+: {
+        [resourceLabel]+: {
+          stateful_internal_ip: value,
+        },
+      },
+    },
+  },
+  '#withStatefulInternalIpMixin':: d.fn(help='`google.list[obj].withStatefulInternalIpMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the stateful_internal_ip field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withStatefulInternalIp](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `stateful_internal_ip` field.\n', args=[]),
+  withStatefulInternalIpMixin(resourceLabel, value): {
+    resource+: {
+      google_compute_instance_group_manager+: {
+        [resourceLabel]+: {
+          stateful_internal_ip+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withTargetPools':: d.fn(help='`google.list.withTargetPools` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the target_pools field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `target_pools` field.\n', args=[]),
   withTargetPools(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/compute_instance_template.libsonnet b/4.x/_gen/resources/compute_instance_template.libsonnet
index 1fffedac..19a06f9d 100644
--- a/4.x/_gen/resources/compute_instance_template.libsonnet
+++ b/4.x/_gen/resources/compute_instance_template.libsonnet
@@ -168,7 +168,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       total_egress_bandwidth_tier: total_egress_bandwidth_tier,
     }),
   },
-  '#new':: d.fn(help="\n`google.compute_instance_template.new` injects a new `google_compute_instance_template` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_instance_template.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_instance_template` using the reference:\n\n    $._ref.google_compute_instance_template.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_instance_template.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `can_ip_forward` (`bool`): Whether to allow sending and receiving of packets with non-matching source or destination IPs. This defaults to false. When `null`, the `can_ip_forward` field will be omitted from the resulting object.\n  - `description` (`string`): A brief description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `instance_description` (`string`): A description of the instance. When `null`, the `instance_description` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to instances created from this template, When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to create. To create a machine with a custom type (such as extended memory), format the value like custom-VCPUS-MEM_IN_MB like custom-6-20480 for 6 vCPU and 20GB of RAM.\n  - `metadata` (`obj`): Metadata key/value pairs to make available from within instances created from this template. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `metadata_startup_script` (`string`): An alternative to using the startup-script metadata key, mostly to match the compute_instance resource. This replaces the startup-script metadata key on the created instance and thus the two mechanisms are not allowed to be used simultaneously. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): Specifies a minimum CPU platform. Applicable values are the friendly names of CPU platforms, such as Intel Haswell or Intel Skylake. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance template. If you leave this blank, Terraform will auto-generate a unique name. When `null`, the `name` field will be omitted from the resulting object.\n  - `name_prefix` (`string`): Creates a unique name beginning with the specified prefix. Conflicts with name. When `null`, the `name_prefix` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): An instance template is a global resource that is not bound to a zone or a region. However, you can still specify some regional resources in an instance template, which restricts the template to the region where that resource resides. For example, a custom subnetwork resource is tied to a specific region. Defaults to the region of the Provider if no value is given. When `null`, the `region` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `tags` (`list`): Tags to attach to the instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.\n  - `confidential_instance_config` (`list[obj]`): The Confidential VM config being used by the instance. on_host_maintenance has to be set to TERMINATE or this will fail to create. When `null`, the `confidential_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.confidential_instance_config.new](#fn-confidential_instance_confignew) constructor.\n  - `disk` (`list[obj]`): Disks to attach to instances created from this template. This can be specified multiple times for multiple disks. When `null`, the `disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.disk.new](#fn-disknew) constructor.\n  - `guest_accelerator` (`list[obj]`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.guest_accelerator.new](#fn-guest_acceleratornew) constructor.\n  - `network_interface` (`list[obj]`): Networks to attach to instances created from this template. This can be specified multiple times for multiple networks. When `null`, the `network_interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.network_interface.new](#fn-network_interfacenew) constructor.\n  - `network_performance_config` (`list[obj]`): Configures network performance settings for the instance. If not specified, the instance will be created with its default network performance configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.network_performance_config.new](#fn-network_performance_confignew) constructor.\n  - `reservation_affinity` (`list[obj]`): Specifies the reservations that this instance can consume from. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `scheduling` (`list[obj]`): The scheduling strategy to use. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.scheduling.new](#fn-schedulingnew) constructor.\n  - `service_account` (`list[obj]`): Service account to attach to the instance. When `null`, the `service_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.service_account.new](#fn-service_accountnew) constructor.\n  - `shielded_instance_config` (`list[obj]`): Enable Shielded VM on this instance. Shielded VM provides verifiable integrity to prevent against malware and rootkits. Defaults to disabled. Note: shielded_instance_config can only be used with boot images with shielded vm support. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_instance_template.new` injects a new `google_compute_instance_template` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_instance_template.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_instance_template` using the reference:\n\n    $._ref.google_compute_instance_template.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_instance_template.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `can_ip_forward` (`bool`): Whether to allow sending and receiving of packets with non-matching source or destination IPs. This defaults to false. When `null`, the `can_ip_forward` field will be omitted from the resulting object.\n  - `description` (`string`): A brief description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `instance_description` (`string`): A description of the instance. When `null`, the `instance_description` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to instances created from this template.\n\t\t\t\t\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to create. To create a machine with a custom type (such as extended memory), format the value like custom-VCPUS-MEM_IN_MB like custom-6-20480 for 6 vCPU and 20GB of RAM.\n  - `metadata` (`obj`): Metadata key/value pairs to make available from within instances created from this template. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `metadata_startup_script` (`string`): An alternative to using the startup-script metadata key, mostly to match the compute_instance resource. This replaces the startup-script metadata key on the created instance and thus the two mechanisms are not allowed to be used simultaneously. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): Specifies a minimum CPU platform. Applicable values are the friendly names of CPU platforms, such as Intel Haswell or Intel Skylake. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance template. If you leave this blank, Terraform will auto-generate a unique name. When `null`, the `name` field will be omitted from the resulting object.\n  - `name_prefix` (`string`): Creates a unique name beginning with the specified prefix. Conflicts with name. When `null`, the `name_prefix` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): An instance template is a global resource that is not bound to a zone or a region. However, you can still specify some regional resources in an instance template, which restricts the template to the region where that resource resides. For example, a custom subnetwork resource is tied to a specific region. Defaults to the region of the Provider if no value is given. When `null`, the `region` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `tags` (`list`): Tags to attach to the instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.\n  - `confidential_instance_config` (`list[obj]`): The Confidential VM config being used by the instance. on_host_maintenance has to be set to TERMINATE or this will fail to create. When `null`, the `confidential_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.confidential_instance_config.new](#fn-confidential_instance_confignew) constructor.\n  - `disk` (`list[obj]`): Disks to attach to instances created from this template. This can be specified multiple times for multiple disks. When `null`, the `disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.disk.new](#fn-disknew) constructor.\n  - `guest_accelerator` (`list[obj]`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.guest_accelerator.new](#fn-guest_acceleratornew) constructor.\n  - `network_interface` (`list[obj]`): Networks to attach to instances created from this template. This can be specified multiple times for multiple networks. When `null`, the `network_interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.network_interface.new](#fn-network_interfacenew) constructor.\n  - `network_performance_config` (`list[obj]`): Configures network performance settings for the instance. If not specified, the instance will be created with its default network performance configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.network_performance_config.new](#fn-network_performance_confignew) constructor.\n  - `reservation_affinity` (`list[obj]`): Specifies the reservations that this instance can consume from. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `scheduling` (`list[obj]`): The scheduling strategy to use. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.scheduling.new](#fn-schedulingnew) constructor.\n  - `service_account` (`list[obj]`): Service account to attach to the instance. When `null`, the `service_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.service_account.new](#fn-service_accountnew) constructor.\n  - `shielded_instance_config` (`list[obj]`): Enable Shielded VM on this instance. Shielded VM provides verifiable integrity to prevent against malware and rootkits. Defaults to disabled. Note: shielded_instance_config can only be used with boot images with shielded vm support. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     machine_type,
@@ -229,7 +229,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_instance_template.newAttrs` constructs a new object with attributes and blocks configured for the `compute_instance_template`\nTerraform resource.\n\nUnlike [google.compute_instance_template.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `can_ip_forward` (`bool`): Whether to allow sending and receiving of packets with non-matching source or destination IPs. This defaults to false. When `null`, the `can_ip_forward` field will be omitted from the resulting object.\n  - `description` (`string`): A brief description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `instance_description` (`string`): A description of the instance. When `null`, the `instance_description` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to instances created from this template, When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to create. To create a machine with a custom type (such as extended memory), format the value like custom-VCPUS-MEM_IN_MB like custom-6-20480 for 6 vCPU and 20GB of RAM.\n  - `metadata` (`obj`): Metadata key/value pairs to make available from within instances created from this template. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `metadata_startup_script` (`string`): An alternative to using the startup-script metadata key, mostly to match the compute_instance resource. This replaces the startup-script metadata key on the created instance and thus the two mechanisms are not allowed to be used simultaneously. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): Specifies a minimum CPU platform. Applicable values are the friendly names of CPU platforms, such as Intel Haswell or Intel Skylake. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance template. If you leave this blank, Terraform will auto-generate a unique name. When `null`, the `name` field will be omitted from the resulting object.\n  - `name_prefix` (`string`): Creates a unique name beginning with the specified prefix. Conflicts with name. When `null`, the `name_prefix` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): An instance template is a global resource that is not bound to a zone or a region. However, you can still specify some regional resources in an instance template, which restricts the template to the region where that resource resides. For example, a custom subnetwork resource is tied to a specific region. Defaults to the region of the Provider if no value is given. When `null`, the `region` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `tags` (`list`): Tags to attach to the instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.\n  - `confidential_instance_config` (`list[obj]`): The Confidential VM config being used by the instance. on_host_maintenance has to be set to TERMINATE or this will fail to create. When `null`, the `confidential_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.confidential_instance_config.new](#fn-confidential_instance_confignew) constructor.\n  - `disk` (`list[obj]`): Disks to attach to instances created from this template. This can be specified multiple times for multiple disks. When `null`, the `disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.disk.new](#fn-disknew) constructor.\n  - `guest_accelerator` (`list[obj]`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.guest_accelerator.new](#fn-guest_acceleratornew) constructor.\n  - `network_interface` (`list[obj]`): Networks to attach to instances created from this template. This can be specified multiple times for multiple networks. When `null`, the `network_interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.network_interface.new](#fn-network_interfacenew) constructor.\n  - `network_performance_config` (`list[obj]`): Configures network performance settings for the instance. If not specified, the instance will be created with its default network performance configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.network_performance_config.new](#fn-network_performance_confignew) constructor.\n  - `reservation_affinity` (`list[obj]`): Specifies the reservations that this instance can consume from. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `scheduling` (`list[obj]`): The scheduling strategy to use. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.scheduling.new](#fn-schedulingnew) constructor.\n  - `service_account` (`list[obj]`): Service account to attach to the instance. When `null`, the `service_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.service_account.new](#fn-service_accountnew) constructor.\n  - `shielded_instance_config` (`list[obj]`): Enable Shielded VM on this instance. Shielded VM provides verifiable integrity to prevent against malware and rootkits. Defaults to disabled. Note: shielded_instance_config can only be used with boot images with shielded vm support. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_instance_template` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_instance_template.newAttrs` constructs a new object with attributes and blocks configured for the `compute_instance_template`\nTerraform resource.\n\nUnlike [google.compute_instance_template.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `can_ip_forward` (`bool`): Whether to allow sending and receiving of packets with non-matching source or destination IPs. This defaults to false. When `null`, the `can_ip_forward` field will be omitted from the resulting object.\n  - `description` (`string`): A brief description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `instance_description` (`string`): A description of the instance. When `null`, the `instance_description` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to instances created from this template.\n\t\t\t\t\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to create. To create a machine with a custom type (such as extended memory), format the value like custom-VCPUS-MEM_IN_MB like custom-6-20480 for 6 vCPU and 20GB of RAM.\n  - `metadata` (`obj`): Metadata key/value pairs to make available from within instances created from this template. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `metadata_startup_script` (`string`): An alternative to using the startup-script metadata key, mostly to match the compute_instance resource. This replaces the startup-script metadata key on the created instance and thus the two mechanisms are not allowed to be used simultaneously. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): Specifies a minimum CPU platform. Applicable values are the friendly names of CPU platforms, such as Intel Haswell or Intel Skylake. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance template. If you leave this blank, Terraform will auto-generate a unique name. When `null`, the `name` field will be omitted from the resulting object.\n  - `name_prefix` (`string`): Creates a unique name beginning with the specified prefix. Conflicts with name. When `null`, the `name_prefix` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): An instance template is a global resource that is not bound to a zone or a region. However, you can still specify some regional resources in an instance template, which restricts the template to the region where that resource resides. For example, a custom subnetwork resource is tied to a specific region. Defaults to the region of the Provider if no value is given. When `null`, the `region` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `tags` (`list`): Tags to attach to the instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.\n  - `confidential_instance_config` (`list[obj]`): The Confidential VM config being used by the instance. on_host_maintenance has to be set to TERMINATE or this will fail to create. When `null`, the `confidential_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.confidential_instance_config.new](#fn-confidential_instance_confignew) constructor.\n  - `disk` (`list[obj]`): Disks to attach to instances created from this template. This can be specified multiple times for multiple disks. When `null`, the `disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.disk.new](#fn-disknew) constructor.\n  - `guest_accelerator` (`list[obj]`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.guest_accelerator.new](#fn-guest_acceleratornew) constructor.\n  - `network_interface` (`list[obj]`): Networks to attach to instances created from this template. This can be specified multiple times for multiple networks. When `null`, the `network_interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.network_interface.new](#fn-network_interfacenew) constructor.\n  - `network_performance_config` (`list[obj]`): Configures network performance settings for the instance. If not specified, the instance will be created with its default network performance configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.network_performance_config.new](#fn-network_performance_confignew) constructor.\n  - `reservation_affinity` (`list[obj]`): Specifies the reservations that this instance can consume from. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `scheduling` (`list[obj]`): The scheduling strategy to use. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.scheduling.new](#fn-schedulingnew) constructor.\n  - `service_account` (`list[obj]`): Service account to attach to the instance. When `null`, the `service_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.service_account.new](#fn-service_accountnew) constructor.\n  - `shielded_instance_config` (`list[obj]`): Enable Shielded VM on this instance. Shielded VM provides verifiable integrity to prevent against malware and rootkits. Defaults to disabled. Note: shielded_instance_config can only be used with boot images with shielded vm support. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_instance_template` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     machine_type,
     advanced_machine_features=null,
diff --git a/4.x/_gen/resources/compute_network_endpoint_group.libsonnet b/4.x/_gen/resources/compute_network_endpoint_group.libsonnet
index 588c3e8f..d793f55d 100644
--- a/4.x/_gen/resources/compute_network_endpoint_group.libsonnet
+++ b/4.x/_gen/resources/compute_network_endpoint_group.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='compute_network_endpoint_group', url='', help='`compute_network_endpoint_group` represents the `google_compute_network_endpoint_group` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.compute_network_endpoint_group.new` injects a new `google_compute_network_endpoint_group` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_network_endpoint_group.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_network_endpoint_group` using the reference:\n\n    $._ref.google_compute_network_endpoint_group.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_network_endpoint_group.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `default_port` (`number`): The default port used if the port number is not specified in the\nnetwork endpoint. When `null`, the `default_port` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `network` (`string`): The network to which all network endpoints in the NEG belong.\nUses \u0026#34;default\u0026#34; project network if unspecified.\n  - `network_endpoint_type` (`string`): Type of network endpoints in this network endpoint group.\nNON_GCP_PRIVATE_IP_PORT is used for hybrid connectivity network\nendpoint groups (see https://cloud.google.com/load-balancing/docs/hybrid).\nNote that NON_GCP_PRIVATE_IP_PORT can only be used with Backend Services\nthat 1) have the following load balancing schemes: EXTERNAL, EXTERNAL_MANAGED,\nINTERNAL_MANAGED, and INTERNAL_SELF_MANAGED and 2) support the RATE or\nCONNECTION balancing modes.\n\nPossible values include: GCE_VM_IP, GCE_VM_IP_PORT, and NON_GCP_PRIVATE_IP_PORT. Default value: \u0026#34;GCE_VM_IP_PORT\u0026#34; Possible values: [\u0026#34;GCE_VM_IP\u0026#34;, \u0026#34;GCE_VM_IP_PORT\u0026#34;, \u0026#34;NON_GCP_PRIVATE_IP_PORT\u0026#34;] When `null`, the `network_endpoint_type` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): Optional subnetwork to which all network endpoints in the NEG belong. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `zone` (`string`): Zone where the network endpoint group is located. When `null`, the `zone` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_network_endpoint_group.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_network_endpoint_group.new` injects a new `google_compute_network_endpoint_group` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_network_endpoint_group.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_network_endpoint_group` using the reference:\n\n    $._ref.google_compute_network_endpoint_group.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_network_endpoint_group.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `default_port` (`number`): The default port used if the port number is not specified in the\nnetwork endpoint. When `null`, the `default_port` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `network` (`string`): The network to which all network endpoints in the NEG belong.\nUses \u0026#34;default\u0026#34; project network if unspecified.\n  - `network_endpoint_type` (`string`): Type of network endpoints in this network endpoint group.\nNON_GCP_PRIVATE_IP_PORT is used for hybrid connectivity network\nendpoint groups (see https://cloud.google.com/load-balancing/docs/hybrid).\nNote that NON_GCP_PRIVATE_IP_PORT can only be used with Backend Services\nthat 1) have the following load balancing schemes: EXTERNAL, EXTERNAL_MANAGED,\nINTERNAL_MANAGED, and INTERNAL_SELF_MANAGED and 2) support the RATE or\nCONNECTION balancing modes.\n\nPossible values include: GCE_VM_IP, GCE_VM_IP_PORT, NON_GCP_PRIVATE_IP_PORT, INTERNET_IP_PORT, INTERNET_FQDN_PORT, SERVERLESS, and PRIVATE_SERVICE_CONNECT. Default value: \u0026#34;GCE_VM_IP_PORT\u0026#34; Possible values: [\u0026#34;GCE_VM_IP\u0026#34;, \u0026#34;GCE_VM_IP_PORT\u0026#34;, \u0026#34;NON_GCP_PRIVATE_IP_PORT\u0026#34;, \u0026#34;INTERNET_IP_PORT\u0026#34;, \u0026#34;INTERNET_FQDN_PORT\u0026#34;, \u0026#34;SERVERLESS\u0026#34;, \u0026#34;PRIVATE_SERVICE_CONNECT\u0026#34;] When `null`, the `network_endpoint_type` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): Optional subnetwork to which all network endpoints in the NEG belong. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `zone` (`string`): Zone where the network endpoint group is located. When `null`, the `zone` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_network_endpoint_group.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -31,7 +31,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_network_endpoint_group.newAttrs` constructs a new object with attributes and blocks configured for the `compute_network_endpoint_group`\nTerraform resource.\n\nUnlike [google.compute_network_endpoint_group.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `default_port` (`number`): The default port used if the port number is not specified in the\nnetwork endpoint. When `null`, the `default_port` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `network` (`string`): The network to which all network endpoints in the NEG belong.\nUses "default" project network if unspecified.\n  - `network_endpoint_type` (`string`): Type of network endpoints in this network endpoint group.\nNON_GCP_PRIVATE_IP_PORT is used for hybrid connectivity network\nendpoint groups (see https://cloud.google.com/load-balancing/docs/hybrid).\nNote that NON_GCP_PRIVATE_IP_PORT can only be used with Backend Services\nthat 1) have the following load balancing schemes: EXTERNAL, EXTERNAL_MANAGED,\nINTERNAL_MANAGED, and INTERNAL_SELF_MANAGED and 2) support the RATE or\nCONNECTION balancing modes.\n\nPossible values include: GCE_VM_IP, GCE_VM_IP_PORT, and NON_GCP_PRIVATE_IP_PORT. Default value: "GCE_VM_IP_PORT" Possible values: ["GCE_VM_IP", "GCE_VM_IP_PORT", "NON_GCP_PRIVATE_IP_PORT"] When `null`, the `network_endpoint_type` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): Optional subnetwork to which all network endpoints in the NEG belong. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `zone` (`string`): Zone where the network endpoint group is located. When `null`, the `zone` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_network_endpoint_group.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_network_endpoint_group` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_network_endpoint_group.newAttrs` constructs a new object with attributes and blocks configured for the `compute_network_endpoint_group`\nTerraform resource.\n\nUnlike [google.compute_network_endpoint_group.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `default_port` (`number`): The default port used if the port number is not specified in the\nnetwork endpoint. When `null`, the `default_port` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `network` (`string`): The network to which all network endpoints in the NEG belong.\nUses "default" project network if unspecified.\n  - `network_endpoint_type` (`string`): Type of network endpoints in this network endpoint group.\nNON_GCP_PRIVATE_IP_PORT is used for hybrid connectivity network\nendpoint groups (see https://cloud.google.com/load-balancing/docs/hybrid).\nNote that NON_GCP_PRIVATE_IP_PORT can only be used with Backend Services\nthat 1) have the following load balancing schemes: EXTERNAL, EXTERNAL_MANAGED,\nINTERNAL_MANAGED, and INTERNAL_SELF_MANAGED and 2) support the RATE or\nCONNECTION balancing modes.\n\nPossible values include: GCE_VM_IP, GCE_VM_IP_PORT, NON_GCP_PRIVATE_IP_PORT, INTERNET_IP_PORT, INTERNET_FQDN_PORT, SERVERLESS, and PRIVATE_SERVICE_CONNECT. Default value: "GCE_VM_IP_PORT" Possible values: ["GCE_VM_IP", "GCE_VM_IP_PORT", "NON_GCP_PRIVATE_IP_PORT", "INTERNET_IP_PORT", "INTERNET_FQDN_PORT", "SERVERLESS", "PRIVATE_SERVICE_CONNECT"] When `null`, the `network_endpoint_type` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): Optional subnetwork to which all network endpoints in the NEG belong. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `zone` (`string`): Zone where the network endpoint group is located. When `null`, the `zone` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_network_endpoint_group.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_network_endpoint_group` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     network,
diff --git a/4.x/_gen/resources/compute_node_group.libsonnet b/4.x/_gen/resources/compute_node_group.libsonnet
index b6c0d95b..ae37c5ee 100644
--- a/4.x/_gen/resources/compute_node_group.libsonnet
+++ b/4.x/_gen/resources/compute_node_group.libsonnet
@@ -22,7 +22,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       start_time: start_time,
     }),
   },
-  '#new':: d.fn(help="\n`google.compute_node_group.new` injects a new `google_compute_node_group` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_node_group.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_node_group` using the reference:\n\n    $._ref.google_compute_node_group.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_node_group.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional textual description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `initial_size` (`number`): The initial number of nodes in the node group. One of \u0026#39;initial_size\u0026#39; or \u0026#39;size\u0026#39; must be specified. When `null`, the `initial_size` field will be omitted from the resulting object.\n  - `maintenance_policy` (`string`): Specifies how to handle instances when a node in the group undergoes maintenance. Set to one of: DEFAULT, RESTART_IN_PLACE, or MIGRATE_WITHIN_NODE_GROUP. The default value is DEFAULT. When `null`, the `maintenance_policy` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. When `null`, the `name` field will be omitted from the resulting object.\n  - `node_template` (`string`): The URL of the node template to which this node group belongs.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `size` (`number`): The total number of nodes in the node group. One of \u0026#39;initial_size\u0026#39; or \u0026#39;size\u0026#39; must be specified. When `null`, the `size` field will be omitted from the resulting object.\n  - `zone` (`string`): Zone where this node group is located When `null`, the `zone` field will be omitted from the resulting object.\n  - `autoscaling_policy` (`list[obj]`): If you use sole-tenant nodes for your workloads, you can use the node\ngroup autoscaler to automatically manage the sizes of your node groups. When `null`, the `autoscaling_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.autoscaling_policy.new](#fn-autoscaling_policynew) constructor.\n  - `maintenance_window` (`list[obj]`): contains properties for the timeframe of maintenance When `null`, the `maintenance_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.maintenance_window.new](#fn-maintenance_windownew) constructor.\n  - `share_settings` (`list[obj]`): Share settings for the node group. When `null`, the `share_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.share_settings.new](#fn-share_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_node_group.new` injects a new `google_compute_node_group` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_node_group.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_node_group` using the reference:\n\n    $._ref.google_compute_node_group.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_node_group.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional textual description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `initial_size` (`number`): The initial number of nodes in the node group. One of \u0026#39;initial_size\u0026#39; or \u0026#39;autoscaling_policy\u0026#39; must be configured on resource creation. When `null`, the `initial_size` field will be omitted from the resulting object.\n  - `maintenance_policy` (`string`): Specifies how to handle instances when a node in the group undergoes maintenance. Set to one of: DEFAULT, RESTART_IN_PLACE, or MIGRATE_WITHIN_NODE_GROUP. The default value is DEFAULT. When `null`, the `maintenance_policy` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. When `null`, the `name` field will be omitted from the resulting object.\n  - `node_template` (`string`): The URL of the node template to which this node group belongs.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `zone` (`string`): Zone where this node group is located When `null`, the `zone` field will be omitted from the resulting object.\n  - `autoscaling_policy` (`list[obj]`): If you use sole-tenant nodes for your workloads, you can use the node\ngroup autoscaler to automatically manage the sizes of your node groups.\n\nOne of \u0026#39;initial_size\u0026#39; or \u0026#39;autoscaling_policy\u0026#39; must be configured on resource creation. When `null`, the `autoscaling_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.autoscaling_policy.new](#fn-autoscaling_policynew) constructor.\n  - `maintenance_window` (`list[obj]`): contains properties for the timeframe of maintenance When `null`, the `maintenance_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.maintenance_window.new](#fn-maintenance_windownew) constructor.\n  - `share_settings` (`list[obj]`): Share settings for the node group. When `null`, the `share_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.share_settings.new](#fn-share_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     node_template,
@@ -34,7 +34,6 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     name=null,
     project=null,
     share_settings=null,
-    size=null,
     timeouts=null,
     zone=null,
     _meta={}
@@ -51,13 +50,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       node_template=node_template,
       project=project,
       share_settings=share_settings,
-      size=size,
       timeouts=timeouts,
       zone=zone
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_node_group.newAttrs` constructs a new object with attributes and blocks configured for the `compute_node_group`\nTerraform resource.\n\nUnlike [google.compute_node_group.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional textual description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `initial_size` (`number`): The initial number of nodes in the node group. One of 'initial_size' or 'size' must be specified. When `null`, the `initial_size` field will be omitted from the resulting object.\n  - `maintenance_policy` (`string`): Specifies how to handle instances when a node in the group undergoes maintenance. Set to one of: DEFAULT, RESTART_IN_PLACE, or MIGRATE_WITHIN_NODE_GROUP. The default value is DEFAULT. When `null`, the `maintenance_policy` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. When `null`, the `name` field will be omitted from the resulting object.\n  - `node_template` (`string`): The URL of the node template to which this node group belongs.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `size` (`number`): The total number of nodes in the node group. One of 'initial_size' or 'size' must be specified. When `null`, the `size` field will be omitted from the resulting object.\n  - `zone` (`string`): Zone where this node group is located When `null`, the `zone` field will be omitted from the resulting object.\n  - `autoscaling_policy` (`list[obj]`): If you use sole-tenant nodes for your workloads, you can use the node\ngroup autoscaler to automatically manage the sizes of your node groups. When `null`, the `autoscaling_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.autoscaling_policy.new](#fn-autoscaling_policynew) constructor.\n  - `maintenance_window` (`list[obj]`): contains properties for the timeframe of maintenance When `null`, the `maintenance_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.maintenance_window.new](#fn-maintenance_windownew) constructor.\n  - `share_settings` (`list[obj]`): Share settings for the node group. When `null`, the `share_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.share_settings.new](#fn-share_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_node_group` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_node_group.newAttrs` constructs a new object with attributes and blocks configured for the `compute_node_group`\nTerraform resource.\n\nUnlike [google.compute_node_group.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional textual description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `initial_size` (`number`): The initial number of nodes in the node group. One of 'initial_size' or 'autoscaling_policy' must be configured on resource creation. When `null`, the `initial_size` field will be omitted from the resulting object.\n  - `maintenance_policy` (`string`): Specifies how to handle instances when a node in the group undergoes maintenance. Set to one of: DEFAULT, RESTART_IN_PLACE, or MIGRATE_WITHIN_NODE_GROUP. The default value is DEFAULT. When `null`, the `maintenance_policy` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. When `null`, the `name` field will be omitted from the resulting object.\n  - `node_template` (`string`): The URL of the node template to which this node group belongs.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `zone` (`string`): Zone where this node group is located When `null`, the `zone` field will be omitted from the resulting object.\n  - `autoscaling_policy` (`list[obj]`): If you use sole-tenant nodes for your workloads, you can use the node\ngroup autoscaler to automatically manage the sizes of your node groups.\n\nOne of 'initial_size' or 'autoscaling_policy' must be configured on resource creation. When `null`, the `autoscaling_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.autoscaling_policy.new](#fn-autoscaling_policynew) constructor.\n  - `maintenance_window` (`list[obj]`): contains properties for the timeframe of maintenance When `null`, the `maintenance_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.maintenance_window.new](#fn-maintenance_windownew) constructor.\n  - `share_settings` (`list[obj]`): Share settings for the node group. When `null`, the `share_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.share_settings.new](#fn-share_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_node_group` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     node_template,
     autoscaling_policy=null,
@@ -68,7 +66,6 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     name=null,
     project=null,
     share_settings=null,
-    size=null,
     timeouts=null,
     zone=null
   ):: std.prune(a={
@@ -81,7 +78,6 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     node_template: node_template,
     project: project,
     share_settings: share_settings,
-    size: size,
     timeouts: timeouts,
     zone: zone,
   }),
@@ -235,16 +231,6 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
-  '#withSize':: d.fn(help='`google.number.withSize` constructs a mixin object that can be merged into the `number`\nTerraform resource block to set or update the size field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`number`): The value to set for the `size` field.\n', args=[]),
-  withSize(resourceLabel, value): {
-    resource+: {
-      google_compute_node_group+: {
-        [resourceLabel]+: {
-          size: value,
-        },
-      },
-    },
-  },
   '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
   withTimeouts(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/compute_per_instance_config.libsonnet b/4.x/_gen/resources/compute_per_instance_config.libsonnet
index fa0eb867..11932710 100644
--- a/4.x/_gen/resources/compute_per_instance_config.libsonnet
+++ b/4.x/_gen/resources/compute_per_instance_config.libsonnet
@@ -68,12 +68,56 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         source: source,
       }),
     },
-    '#new':: d.fn(help='\n`google.compute_per_instance_config.preserved_state.new` constructs a new object with attributes and blocks configured for the `preserved_state`\nTerraform sub block.\n\n\n\n**Args**:\n  - `metadata` (`obj`): Preserved metadata defined for this instance. This is a list of key->value pairs. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `disk` (`list[obj]`): Stateful disks for the instance. When `null`, the `disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_per_instance_config.preserved_state.disk.new](#fn-preserved_statedisknew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `preserved_state` sub block.\n', args=[]),
+    external_ip:: {
+      ip_address:: {
+        '#new':: d.fn(help='\n`google.compute_per_instance_config.preserved_state.external_ip.ip_address.new` constructs a new object with attributes and blocks configured for the `ip_address`\nTerraform sub block.\n\n\n\n**Args**:\n  - `address` (`string`): The URL of the reservation for this IP address. When `null`, the `address` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `ip_address` sub block.\n', args=[]),
+        new(
+          address=null
+        ):: std.prune(a={
+          address: address,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.compute_per_instance_config.preserved_state.external_ip.new` constructs a new object with attributes and blocks configured for the `external_ip`\nTerraform sub block.\n\n\n\n**Args**:\n  - `auto_delete` (`string`): These stateful IPs will never be released during autohealing, update or VM instance recreate operations. This flag is used to configure if the IP reservation should be deleted after it is no longer used by the group, e.g. when the given instance or the whole group is deleted. Default value: "NEVER" Possible values: ["NEVER", "ON_PERMANENT_INSTANCE_DELETION"] When `null`, the `auto_delete` field will be omitted from the resulting object.\n  - `interface_name` (`string`): Set the `interface_name` field on the resulting object.\n  - `ip_address` (`list[obj]`): Ip address representation When `null`, the `ip_address` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_per_instance_config.preserved_state.external_ip.ip_address.new](#fn-preserved_statepreserved_stateip_addressnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `external_ip` sub block.\n', args=[]),
+      new(
+        interface_name,
+        auto_delete=null,
+        ip_address=null
+      ):: std.prune(a={
+        auto_delete: auto_delete,
+        interface_name: interface_name,
+        ip_address: ip_address,
+      }),
+    },
+    internal_ip:: {
+      ip_address:: {
+        '#new':: d.fn(help='\n`google.compute_per_instance_config.preserved_state.internal_ip.ip_address.new` constructs a new object with attributes and blocks configured for the `ip_address`\nTerraform sub block.\n\n\n\n**Args**:\n  - `address` (`string`): The URL of the reservation for this IP address. When `null`, the `address` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `ip_address` sub block.\n', args=[]),
+        new(
+          address=null
+        ):: std.prune(a={
+          address: address,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.compute_per_instance_config.preserved_state.internal_ip.new` constructs a new object with attributes and blocks configured for the `internal_ip`\nTerraform sub block.\n\n\n\n**Args**:\n  - `auto_delete` (`string`): These stateful IPs will never be released during autohealing, update or VM instance recreate operations. This flag is used to configure if the IP reservation should be deleted after it is no longer used by the group, e.g. when the given instance or the whole group is deleted. Default value: "NEVER" Possible values: ["NEVER", "ON_PERMANENT_INSTANCE_DELETION"] When `null`, the `auto_delete` field will be omitted from the resulting object.\n  - `interface_name` (`string`): Set the `interface_name` field on the resulting object.\n  - `ip_address` (`list[obj]`): Ip address representation When `null`, the `ip_address` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_per_instance_config.preserved_state.internal_ip.ip_address.new](#fn-preserved_statepreserved_stateip_addressnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `internal_ip` sub block.\n', args=[]),
+      new(
+        interface_name,
+        auto_delete=null,
+        ip_address=null
+      ):: std.prune(a={
+        auto_delete: auto_delete,
+        interface_name: interface_name,
+        ip_address: ip_address,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.compute_per_instance_config.preserved_state.new` constructs a new object with attributes and blocks configured for the `preserved_state`\nTerraform sub block.\n\n\n\n**Args**:\n  - `metadata` (`obj`): Preserved metadata defined for this instance. This is a list of key->value pairs. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `disk` (`list[obj]`): Stateful disks for the instance. When `null`, the `disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_per_instance_config.preserved_state.disk.new](#fn-preserved_statedisknew) constructor.\n  - `external_ip` (`list[obj]`): Preserved external IPs defined for this instance. This map is keyed with the name of the network interface. When `null`, the `external_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_per_instance_config.preserved_state.external_ip.new](#fn-preserved_stateexternal_ipnew) constructor.\n  - `internal_ip` (`list[obj]`): Preserved internal IPs defined for this instance. This map is keyed with the name of the network interface. When `null`, the `internal_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_per_instance_config.preserved_state.internal_ip.new](#fn-preserved_stateinternal_ipnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `preserved_state` sub block.\n', args=[]),
     new(
       disk=null,
+      external_ip=null,
+      internal_ip=null,
       metadata=null
     ):: std.prune(a={
       disk: disk,
+      external_ip: external_ip,
+      internal_ip: internal_ip,
       metadata: metadata,
     }),
   },
diff --git a/4.x/_gen/resources/compute_region_disk.libsonnet b/4.x/_gen/resources/compute_region_disk.libsonnet
index 22275681..696239ff 100644
--- a/4.x/_gen/resources/compute_region_disk.libsonnet
+++ b/4.x/_gen/resources/compute_region_disk.libsonnet
@@ -28,7 +28,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       type: type,
     }),
   },
-  '#new':: d.fn(help="\n`google.compute_region_disk.new` injects a new `google_compute_region_disk` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_region_disk.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_region_disk` using the reference:\n\n    $._ref.google_compute_region_disk.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_region_disk.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this disk.  A list of key-\u0026gt;value pairs. When `null`, the `labels` field will be omitted from the resulting object.\n  - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `physical_block_size_bytes` (`number`): Physical block size of the persistent disk, in bytes. If not present\nin a request, a default value is used. Currently supported sizes\nare 4096 and 16384, other sizes may be added in the future.\nIf an unsupported value is requested, the error message will list\nthe supported values for the caller\u0026#39;s project. When `null`, the `physical_block_size_bytes` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): A reference to the region where the disk resides. When `null`, the `region` field will be omitted from the resulting object.\n  - `replica_zones` (`list`): URLs of the zones where the disk should be replicated to.\n  - `size` (`number`): Size of the persistent disk, specified in GB. You can specify this\nfield when creating a persistent disk using the sourceImage or\nsourceSnapshot parameter, or specify it alone to create an empty\npersistent disk.\n\nIf you specify this field along with sourceImage or sourceSnapshot,\nthe value of sizeGb must not be less than the size of the sourceImage\nor the size of the snapshot. When `null`, the `size` field will be omitted from the resulting object.\n  - `snapshot` (`string`): The source snapshot used to create this disk. You can provide this as\na partial or full URL to the resource. For example, the following are\nvalid values:\n\n* \u0026#39;https://www.googleapis.com/compute/v1/projects/project/global/snapshots/snapshot\u0026#39;\n* \u0026#39;projects/project/global/snapshots/snapshot\u0026#39;\n* \u0026#39;global/snapshots/snapshot\u0026#39;\n* \u0026#39;snapshot\u0026#39; When `null`, the `snapshot` field will be omitted from the resulting object.\n  - `source_disk` (`string`): The source disk used to create this disk. You can provide this as a partial or full URL to the resource.\nFor example, the following are valid values:\n\n* https://www.googleapis.com/compute/v1/projects/{project}/zones/{zone}/disks/{disk}\n* https://www.googleapis.com/compute/v1/projects/{project}/regions/{region}/disks/{disk}\n* projects/{project}/zones/{zone}/disks/{disk}\n* projects/{project}/regions/{region}/disks/{disk}\n* zones/{zone}/disks/{disk}\n* regions/{region}/disks/{disk} When `null`, the `source_disk` field will be omitted from the resulting object.\n  - `type` (`string`): URL of the disk type resource describing which disk type to use to\ncreate the disk. Provide this when creating the disk. When `null`, the `type` field will be omitted from the resulting object.\n  - `async_primary_disk` (`list[obj]`): A nested object resource When `null`, the `async_primary_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.async_primary_disk.new](#fn-async_primary_disknew) constructor.\n  - `disk_encryption_key` (`list[obj]`): Encrypts the disk using a customer-supplied encryption key.\n\nAfter you encrypt a disk with a customer-supplied key, you must\nprovide the same key if you use the disk later (e.g. to create a disk\nsnapshot or an image, or to attach the disk to a virtual machine).\n\nCustomer-supplied encryption keys do not protect access to metadata of\nthe disk.\n\nIf you do not provide an encryption key when creating the disk, then\nthe disk will be encrypted using an automatically generated key and\nyou do not need to provide a key to use the disk later. When `null`, the `disk_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.disk_encryption_key.new](#fn-disk_encryption_keynew) constructor.\n  - `guest_os_features` (`list[obj]`): A list of features to enable on the guest operating system.\nApplicable only for bootable disks. When `null`, the `guest_os_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.guest_os_features.new](#fn-guest_os_featuresnew) constructor.\n  - `source_snapshot_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source snapshot. Required\nif the source snapshot is protected by a customer-supplied encryption\nkey. When `null`, the `source_snapshot_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.source_snapshot_encryption_key.new](#fn-source_snapshot_encryption_keynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_region_disk.new` injects a new `google_compute_region_disk` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_region_disk.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_region_disk` using the reference:\n\n    $._ref.google_compute_region_disk.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_region_disk.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this disk.  A list of key-\u0026gt;value pairs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `physical_block_size_bytes` (`number`): Physical block size of the persistent disk, in bytes. If not present\nin a request, a default value is used. Currently supported sizes\nare 4096 and 16384, other sizes may be added in the future.\nIf an unsupported value is requested, the error message will list\nthe supported values for the caller\u0026#39;s project. When `null`, the `physical_block_size_bytes` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): A reference to the region where the disk resides. When `null`, the `region` field will be omitted from the resulting object.\n  - `replica_zones` (`list`): URLs of the zones where the disk should be replicated to.\n  - `size` (`number`): Size of the persistent disk, specified in GB. You can specify this\nfield when creating a persistent disk using the sourceImage or\nsourceSnapshot parameter, or specify it alone to create an empty\npersistent disk.\n\nIf you specify this field along with sourceImage or sourceSnapshot,\nthe value of sizeGb must not be less than the size of the sourceImage\nor the size of the snapshot. When `null`, the `size` field will be omitted from the resulting object.\n  - `snapshot` (`string`): The source snapshot used to create this disk. You can provide this as\na partial or full URL to the resource. For example, the following are\nvalid values:\n\n* \u0026#39;https://www.googleapis.com/compute/v1/projects/project/global/snapshots/snapshot\u0026#39;\n* \u0026#39;projects/project/global/snapshots/snapshot\u0026#39;\n* \u0026#39;global/snapshots/snapshot\u0026#39;\n* \u0026#39;snapshot\u0026#39; When `null`, the `snapshot` field will be omitted from the resulting object.\n  - `source_disk` (`string`): The source disk used to create this disk. You can provide this as a partial or full URL to the resource.\nFor example, the following are valid values:\n\n* https://www.googleapis.com/compute/v1/projects/{project}/zones/{zone}/disks/{disk}\n* https://www.googleapis.com/compute/v1/projects/{project}/regions/{region}/disks/{disk}\n* projects/{project}/zones/{zone}/disks/{disk}\n* projects/{project}/regions/{region}/disks/{disk}\n* zones/{zone}/disks/{disk}\n* regions/{region}/disks/{disk} When `null`, the `source_disk` field will be omitted from the resulting object.\n  - `type` (`string`): URL of the disk type resource describing which disk type to use to\ncreate the disk. Provide this when creating the disk. When `null`, the `type` field will be omitted from the resulting object.\n  - `async_primary_disk` (`list[obj]`): A nested object resource When `null`, the `async_primary_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.async_primary_disk.new](#fn-async_primary_disknew) constructor.\n  - `disk_encryption_key` (`list[obj]`): Encrypts the disk using a customer-supplied encryption key.\n\nAfter you encrypt a disk with a customer-supplied key, you must\nprovide the same key if you use the disk later (e.g. to create a disk\nsnapshot or an image, or to attach the disk to a virtual machine).\n\nCustomer-supplied encryption keys do not protect access to metadata of\nthe disk.\n\nIf you do not provide an encryption key when creating the disk, then\nthe disk will be encrypted using an automatically generated key and\nyou do not need to provide a key to use the disk later. When `null`, the `disk_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.disk_encryption_key.new](#fn-disk_encryption_keynew) constructor.\n  - `guest_os_features` (`list[obj]`): A list of features to enable on the guest operating system.\nApplicable only for bootable disks. When `null`, the `guest_os_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.guest_os_features.new](#fn-guest_os_featuresnew) constructor.\n  - `source_snapshot_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source snapshot. Required\nif the source snapshot is protected by a customer-supplied encryption\nkey. When `null`, the `source_snapshot_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.source_snapshot_encryption_key.new](#fn-source_snapshot_encryption_keynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -73,7 +73,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_region_disk.newAttrs` constructs a new object with attributes and blocks configured for the `compute_region_disk`\nTerraform resource.\n\nUnlike [google.compute_region_disk.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this disk.  A list of key->value pairs. When `null`, the `labels` field will be omitted from the resulting object.\n  - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `physical_block_size_bytes` (`number`): Physical block size of the persistent disk, in bytes. If not present\nin a request, a default value is used. Currently supported sizes\nare 4096 and 16384, other sizes may be added in the future.\nIf an unsupported value is requested, the error message will list\nthe supported values for the caller's project. When `null`, the `physical_block_size_bytes` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): A reference to the region where the disk resides. When `null`, the `region` field will be omitted from the resulting object.\n  - `replica_zones` (`list`): URLs of the zones where the disk should be replicated to.\n  - `size` (`number`): Size of the persistent disk, specified in GB. You can specify this\nfield when creating a persistent disk using the sourceImage or\nsourceSnapshot parameter, or specify it alone to create an empty\npersistent disk.\n\nIf you specify this field along with sourceImage or sourceSnapshot,\nthe value of sizeGb must not be less than the size of the sourceImage\nor the size of the snapshot. When `null`, the `size` field will be omitted from the resulting object.\n  - `snapshot` (`string`): The source snapshot used to create this disk. You can provide this as\na partial or full URL to the resource. For example, the following are\nvalid values:\n\n* 'https://www.googleapis.com/compute/v1/projects/project/global/snapshots/snapshot'\n* 'projects/project/global/snapshots/snapshot'\n* 'global/snapshots/snapshot'\n* 'snapshot' When `null`, the `snapshot` field will be omitted from the resulting object.\n  - `source_disk` (`string`): The source disk used to create this disk. You can provide this as a partial or full URL to the resource.\nFor example, the following are valid values:\n\n* https://www.googleapis.com/compute/v1/projects/{project}/zones/{zone}/disks/{disk}\n* https://www.googleapis.com/compute/v1/projects/{project}/regions/{region}/disks/{disk}\n* projects/{project}/zones/{zone}/disks/{disk}\n* projects/{project}/regions/{region}/disks/{disk}\n* zones/{zone}/disks/{disk}\n* regions/{region}/disks/{disk} When `null`, the `source_disk` field will be omitted from the resulting object.\n  - `type` (`string`): URL of the disk type resource describing which disk type to use to\ncreate the disk. Provide this when creating the disk. When `null`, the `type` field will be omitted from the resulting object.\n  - `async_primary_disk` (`list[obj]`): A nested object resource When `null`, the `async_primary_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.async_primary_disk.new](#fn-async_primary_disknew) constructor.\n  - `disk_encryption_key` (`list[obj]`): Encrypts the disk using a customer-supplied encryption key.\n\nAfter you encrypt a disk with a customer-supplied key, you must\nprovide the same key if you use the disk later (e.g. to create a disk\nsnapshot or an image, or to attach the disk to a virtual machine).\n\nCustomer-supplied encryption keys do not protect access to metadata of\nthe disk.\n\nIf you do not provide an encryption key when creating the disk, then\nthe disk will be encrypted using an automatically generated key and\nyou do not need to provide a key to use the disk later. When `null`, the `disk_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.disk_encryption_key.new](#fn-disk_encryption_keynew) constructor.\n  - `guest_os_features` (`list[obj]`): A list of features to enable on the guest operating system.\nApplicable only for bootable disks. When `null`, the `guest_os_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.guest_os_features.new](#fn-guest_os_featuresnew) constructor.\n  - `source_snapshot_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source snapshot. Required\nif the source snapshot is protected by a customer-supplied encryption\nkey. When `null`, the `source_snapshot_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.source_snapshot_encryption_key.new](#fn-source_snapshot_encryption_keynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_region_disk` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_region_disk.newAttrs` constructs a new object with attributes and blocks configured for the `compute_region_disk`\nTerraform resource.\n\nUnlike [google.compute_region_disk.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this disk.  A list of key->value pairs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `physical_block_size_bytes` (`number`): Physical block size of the persistent disk, in bytes. If not present\nin a request, a default value is used. Currently supported sizes\nare 4096 and 16384, other sizes may be added in the future.\nIf an unsupported value is requested, the error message will list\nthe supported values for the caller's project. When `null`, the `physical_block_size_bytes` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): A reference to the region where the disk resides. When `null`, the `region` field will be omitted from the resulting object.\n  - `replica_zones` (`list`): URLs of the zones where the disk should be replicated to.\n  - `size` (`number`): Size of the persistent disk, specified in GB. You can specify this\nfield when creating a persistent disk using the sourceImage or\nsourceSnapshot parameter, or specify it alone to create an empty\npersistent disk.\n\nIf you specify this field along with sourceImage or sourceSnapshot,\nthe value of sizeGb must not be less than the size of the sourceImage\nor the size of the snapshot. When `null`, the `size` field will be omitted from the resulting object.\n  - `snapshot` (`string`): The source snapshot used to create this disk. You can provide this as\na partial or full URL to the resource. For example, the following are\nvalid values:\n\n* 'https://www.googleapis.com/compute/v1/projects/project/global/snapshots/snapshot'\n* 'projects/project/global/snapshots/snapshot'\n* 'global/snapshots/snapshot'\n* 'snapshot' When `null`, the `snapshot` field will be omitted from the resulting object.\n  - `source_disk` (`string`): The source disk used to create this disk. You can provide this as a partial or full URL to the resource.\nFor example, the following are valid values:\n\n* https://www.googleapis.com/compute/v1/projects/{project}/zones/{zone}/disks/{disk}\n* https://www.googleapis.com/compute/v1/projects/{project}/regions/{region}/disks/{disk}\n* projects/{project}/zones/{zone}/disks/{disk}\n* projects/{project}/regions/{region}/disks/{disk}\n* zones/{zone}/disks/{disk}\n* regions/{region}/disks/{disk} When `null`, the `source_disk` field will be omitted from the resulting object.\n  - `type` (`string`): URL of the disk type resource describing which disk type to use to\ncreate the disk. Provide this when creating the disk. When `null`, the `type` field will be omitted from the resulting object.\n  - `async_primary_disk` (`list[obj]`): A nested object resource When `null`, the `async_primary_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.async_primary_disk.new](#fn-async_primary_disknew) constructor.\n  - `disk_encryption_key` (`list[obj]`): Encrypts the disk using a customer-supplied encryption key.\n\nAfter you encrypt a disk with a customer-supplied key, you must\nprovide the same key if you use the disk later (e.g. to create a disk\nsnapshot or an image, or to attach the disk to a virtual machine).\n\nCustomer-supplied encryption keys do not protect access to metadata of\nthe disk.\n\nIf you do not provide an encryption key when creating the disk, then\nthe disk will be encrypted using an automatically generated key and\nyou do not need to provide a key to use the disk later. When `null`, the `disk_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.disk_encryption_key.new](#fn-disk_encryption_keynew) constructor.\n  - `guest_os_features` (`list[obj]`): A list of features to enable on the guest operating system.\nApplicable only for bootable disks. When `null`, the `guest_os_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.guest_os_features.new](#fn-guest_os_featuresnew) constructor.\n  - `source_snapshot_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source snapshot. Required\nif the source snapshot is protected by a customer-supplied encryption\nkey. When `null`, the `source_snapshot_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.source_snapshot_encryption_key.new](#fn-source_snapshot_encryption_keynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_disk.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_region_disk` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     replica_zones,
diff --git a/4.x/_gen/resources/compute_region_instance_group_manager.libsonnet b/4.x/_gen/resources/compute_region_instance_group_manager.libsonnet
index 68f3d34a..fa17558a 100644
--- a/4.x/_gen/resources/compute_region_instance_group_manager.libsonnet
+++ b/4.x/_gen/resources/compute_region_instance_group_manager.libsonnet
@@ -30,7 +30,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       port: port,
     }),
   },
-  '#new':: d.fn(help="\n`google.compute_region_instance_group_manager.new` injects a new `google_compute_region_instance_group_manager` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_region_instance_group_manager.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_region_instance_group_manager` using the reference:\n\n    $._ref.google_compute_region_instance_group_manager.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_region_instance_group_manager.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `base_instance_name` (`string`): The base instance name to use for instances in this group. The value must be a valid RFC1035 name. Supported characters are lowercase letters, numbers, and hyphens (-). Instances are named by appending a hyphen and a random four-character string to the base instance name.\n  - `description` (`string`): An optional textual description of the instance group manager. When `null`, the `description` field will be omitted from the resulting object.\n  - `distribution_policy_target_shape` (`string`): The shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType). When `null`, the `distribution_policy_target_shape` field will be omitted from the resulting object.\n  - `distribution_policy_zones` (`list`): The distribution policy for this managed instance group. You can specify one or more values. When `null`, the `distribution_policy_zones` field will be omitted from the resulting object.\n  - `list_managed_instances_results` (`string`): Pagination behavior of the listManagedInstances API method for this managed instance group. Valid values are: \u0026#34;PAGELESS\u0026#34;, \u0026#34;PAGINATED\u0026#34;. If PAGELESS (default), Pagination is disabled for the group\u0026#39;s listManagedInstances API method. maxResults and pageToken query parameters are ignored and all instances are returned in a single response. If PAGINATED, pagination is enabled, maxResults and pageToken query parameters are respected. When `null`, the `list_managed_instances_results` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance group manager. Must be 1-63 characters long and comply with RFC1035. Supported characters include lowercase letters, numbers, and hyphens.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region where the managed instance group resides. When `null`, the `region` field will be omitted from the resulting object.\n  - `target_pools` (`list`): The full URL of all target pools to which new instances in the group are added. Updating the target pools attribute does not affect existing instances. When `null`, the `target_pools` field will be omitted from the resulting object.\n  - `target_size` (`number`): The target number of running instances for this managed instance group. This value should always be explicitly set unless this resource is attached to an autoscaler, in which case it should never be set. Defaults to 0. When `null`, the `target_size` field will be omitted from the resulting object.\n  - `wait_for_instances` (`bool`): Whether to wait for all instances to be created/updated before returning. Note that if this is set to true and the operation does not succeed, Terraform will continue trying until it times out. When `null`, the `wait_for_instances` field will be omitted from the resulting object.\n  - `wait_for_instances_status` (`string`): When used with wait_for_instances specifies the status to wait for. When STABLE is specified this resource will wait until the instances are stable before returning. When UPDATED is set, it will wait for the version target to be reached and any per instance configs to be effective as well as all instances to be stable before returning. When `null`, the `wait_for_instances_status` field will be omitted from the resulting object.\n  - `auto_healing_policies` (`list[obj]`): The autohealing policies for this managed instance group. You can specify only one value. When `null`, the `auto_healing_policies` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.auto_healing_policies.new](#fn-auto_healing_policiesnew) constructor.\n  - `instance_lifecycle_policy` (`list[obj]`): The instance lifecycle policy for this managed instance group. When `null`, the `instance_lifecycle_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.instance_lifecycle_policy.new](#fn-instance_lifecycle_policynew) constructor.\n  - `named_port` (`list[obj]`): The named port configuration. When `null`, the `named_port` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.named_port.new](#fn-named_portnew) constructor.\n  - `stateful_disk` (`list[obj]`): Disks created on the instances that will be preserved on instance delete, update, etc. Structure is documented below. For more information see the official documentation. Proactive cross zone instance redistribution must be disabled before you can update stateful disks on existing instance group managers. This can be controlled via the update_policy. When `null`, the `stateful_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.stateful_disk.new](#fn-stateful_disknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.timeouts.new](#fn-timeoutsnew) constructor.\n  - `update_policy` (`list[obj]`): The update policy for this managed instance group. When `null`, the `update_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.update_policy.new](#fn-update_policynew) constructor.\n  - `version` (`list[obj]`): Application versions managed by this instance group. Each version deals with a specific instance template, allowing canary release scenarios. When `null`, the `version` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.version.new](#fn-versionnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_region_instance_group_manager.new` injects a new `google_compute_region_instance_group_manager` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_region_instance_group_manager.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_region_instance_group_manager` using the reference:\n\n    $._ref.google_compute_region_instance_group_manager.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_region_instance_group_manager.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `base_instance_name` (`string`): The base instance name to use for instances in this group. The value must be a valid RFC1035 name. Supported characters are lowercase letters, numbers, and hyphens (-). Instances are named by appending a hyphen and a random four-character string to the base instance name.\n  - `description` (`string`): An optional textual description of the instance group manager. When `null`, the `description` field will be omitted from the resulting object.\n  - `distribution_policy_target_shape` (`string`): The shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType). When `null`, the `distribution_policy_target_shape` field will be omitted from the resulting object.\n  - `distribution_policy_zones` (`list`): The distribution policy for this managed instance group. You can specify one or more values. When `null`, the `distribution_policy_zones` field will be omitted from the resulting object.\n  - `list_managed_instances_results` (`string`): Pagination behavior of the listManagedInstances API method for this managed instance group. Valid values are: \u0026#34;PAGELESS\u0026#34;, \u0026#34;PAGINATED\u0026#34;. If PAGELESS (default), Pagination is disabled for the group\u0026#39;s listManagedInstances API method. maxResults and pageToken query parameters are ignored and all instances are returned in a single response. If PAGINATED, pagination is enabled, maxResults and pageToken query parameters are respected. When `null`, the `list_managed_instances_results` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance group manager. Must be 1-63 characters long and comply with RFC1035. Supported characters include lowercase letters, numbers, and hyphens.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region where the managed instance group resides. When `null`, the `region` field will be omitted from the resulting object.\n  - `target_pools` (`list`): The full URL of all target pools to which new instances in the group are added. Updating the target pools attribute does not affect existing instances. When `null`, the `target_pools` field will be omitted from the resulting object.\n  - `target_size` (`number`): The target number of running instances for this managed instance group. This value should always be explicitly set unless this resource is attached to an autoscaler, in which case it should never be set. Defaults to 0. When `null`, the `target_size` field will be omitted from the resulting object.\n  - `wait_for_instances` (`bool`): Whether to wait for all instances to be created/updated before returning. Note that if this is set to true and the operation does not succeed, Terraform will continue trying until it times out. When `null`, the `wait_for_instances` field will be omitted from the resulting object.\n  - `wait_for_instances_status` (`string`): When used with wait_for_instances specifies the status to wait for. When STABLE is specified this resource will wait until the instances are stable before returning. When UPDATED is set, it will wait for the version target to be reached and any per instance configs to be effective as well as all instances to be stable before returning. When `null`, the `wait_for_instances_status` field will be omitted from the resulting object.\n  - `auto_healing_policies` (`list[obj]`): The autohealing policies for this managed instance group. You can specify only one value. When `null`, the `auto_healing_policies` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.auto_healing_policies.new](#fn-auto_healing_policiesnew) constructor.\n  - `instance_lifecycle_policy` (`list[obj]`): The instance lifecycle policy for this managed instance group. When `null`, the `instance_lifecycle_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.instance_lifecycle_policy.new](#fn-instance_lifecycle_policynew) constructor.\n  - `named_port` (`list[obj]`): The named port configuration. When `null`, the `named_port` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.named_port.new](#fn-named_portnew) constructor.\n  - `stateful_disk` (`list[obj]`): Disks created on the instances that will be preserved on instance delete, update, etc. Structure is documented below. For more information see the official documentation. Proactive cross zone instance redistribution must be disabled before you can update stateful disks on existing instance group managers. This can be controlled via the update_policy. When `null`, the `stateful_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.stateful_disk.new](#fn-stateful_disknew) constructor.\n  - `stateful_external_ip` (`list[obj]`): External IPs considered stateful by the instance group.  When `null`, the `stateful_external_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.stateful_external_ip.new](#fn-stateful_external_ipnew) constructor.\n  - `stateful_internal_ip` (`list[obj]`): External IPs considered stateful by the instance group.  When `null`, the `stateful_internal_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.stateful_internal_ip.new](#fn-stateful_internal_ipnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.timeouts.new](#fn-timeoutsnew) constructor.\n  - `update_policy` (`list[obj]`): The update policy for this managed instance group. When `null`, the `update_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.update_policy.new](#fn-update_policynew) constructor.\n  - `version` (`list[obj]`): Application versions managed by this instance group. Each version deals with a specific instance template, allowing canary release scenarios. When `null`, the `version` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.version.new](#fn-versionnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     base_instance_name,
@@ -45,6 +45,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project=null,
     region=null,
     stateful_disk=null,
+    stateful_external_ip=null,
+    stateful_internal_ip=null,
     target_pools=null,
     target_size=null,
     timeouts=null,
@@ -69,6 +71,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       project=project,
       region=region,
       stateful_disk=stateful_disk,
+      stateful_external_ip=stateful_external_ip,
+      stateful_internal_ip=stateful_internal_ip,
       target_pools=target_pools,
       target_size=target_size,
       timeouts=timeouts,
@@ -79,7 +83,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_region_instance_group_manager.newAttrs` constructs a new object with attributes and blocks configured for the `compute_region_instance_group_manager`\nTerraform resource.\n\nUnlike [google.compute_region_instance_group_manager.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `base_instance_name` (`string`): The base instance name to use for instances in this group. The value must be a valid RFC1035 name. Supported characters are lowercase letters, numbers, and hyphens (-). Instances are named by appending a hyphen and a random four-character string to the base instance name.\n  - `description` (`string`): An optional textual description of the instance group manager. When `null`, the `description` field will be omitted from the resulting object.\n  - `distribution_policy_target_shape` (`string`): The shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType). When `null`, the `distribution_policy_target_shape` field will be omitted from the resulting object.\n  - `distribution_policy_zones` (`list`): The distribution policy for this managed instance group. You can specify one or more values. When `null`, the `distribution_policy_zones` field will be omitted from the resulting object.\n  - `list_managed_instances_results` (`string`): Pagination behavior of the listManagedInstances API method for this managed instance group. Valid values are: "PAGELESS", "PAGINATED". If PAGELESS (default), Pagination is disabled for the group's listManagedInstances API method. maxResults and pageToken query parameters are ignored and all instances are returned in a single response. If PAGINATED, pagination is enabled, maxResults and pageToken query parameters are respected. When `null`, the `list_managed_instances_results` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance group manager. Must be 1-63 characters long and comply with RFC1035. Supported characters include lowercase letters, numbers, and hyphens.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region where the managed instance group resides. When `null`, the `region` field will be omitted from the resulting object.\n  - `target_pools` (`list`): The full URL of all target pools to which new instances in the group are added. Updating the target pools attribute does not affect existing instances. When `null`, the `target_pools` field will be omitted from the resulting object.\n  - `target_size` (`number`): The target number of running instances for this managed instance group. This value should always be explicitly set unless this resource is attached to an autoscaler, in which case it should never be set. Defaults to 0. When `null`, the `target_size` field will be omitted from the resulting object.\n  - `wait_for_instances` (`bool`): Whether to wait for all instances to be created/updated before returning. Note that if this is set to true and the operation does not succeed, Terraform will continue trying until it times out. When `null`, the `wait_for_instances` field will be omitted from the resulting object.\n  - `wait_for_instances_status` (`string`): When used with wait_for_instances specifies the status to wait for. When STABLE is specified this resource will wait until the instances are stable before returning. When UPDATED is set, it will wait for the version target to be reached and any per instance configs to be effective as well as all instances to be stable before returning. When `null`, the `wait_for_instances_status` field will be omitted from the resulting object.\n  - `auto_healing_policies` (`list[obj]`): The autohealing policies for this managed instance group. You can specify only one value. When `null`, the `auto_healing_policies` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.auto_healing_policies.new](#fn-auto_healing_policiesnew) constructor.\n  - `instance_lifecycle_policy` (`list[obj]`): The instance lifecycle policy for this managed instance group. When `null`, the `instance_lifecycle_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.instance_lifecycle_policy.new](#fn-instance_lifecycle_policynew) constructor.\n  - `named_port` (`list[obj]`): The named port configuration. When `null`, the `named_port` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.named_port.new](#fn-named_portnew) constructor.\n  - `stateful_disk` (`list[obj]`): Disks created on the instances that will be preserved on instance delete, update, etc. Structure is documented below. For more information see the official documentation. Proactive cross zone instance redistribution must be disabled before you can update stateful disks on existing instance group managers. This can be controlled via the update_policy. When `null`, the `stateful_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.stateful_disk.new](#fn-stateful_disknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.timeouts.new](#fn-timeoutsnew) constructor.\n  - `update_policy` (`list[obj]`): The update policy for this managed instance group. When `null`, the `update_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.update_policy.new](#fn-update_policynew) constructor.\n  - `version` (`list[obj]`): Application versions managed by this instance group. Each version deals with a specific instance template, allowing canary release scenarios. When `null`, the `version` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.version.new](#fn-versionnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_region_instance_group_manager` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_region_instance_group_manager.newAttrs` constructs a new object with attributes and blocks configured for the `compute_region_instance_group_manager`\nTerraform resource.\n\nUnlike [google.compute_region_instance_group_manager.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `base_instance_name` (`string`): The base instance name to use for instances in this group. The value must be a valid RFC1035 name. Supported characters are lowercase letters, numbers, and hyphens (-). Instances are named by appending a hyphen and a random four-character string to the base instance name.\n  - `description` (`string`): An optional textual description of the instance group manager. When `null`, the `description` field will be omitted from the resulting object.\n  - `distribution_policy_target_shape` (`string`): The shape to which the group converges either proactively or on resize events (depending on the value set in updatePolicy.instanceRedistributionType). When `null`, the `distribution_policy_target_shape` field will be omitted from the resulting object.\n  - `distribution_policy_zones` (`list`): The distribution policy for this managed instance group. You can specify one or more values. When `null`, the `distribution_policy_zones` field will be omitted from the resulting object.\n  - `list_managed_instances_results` (`string`): Pagination behavior of the listManagedInstances API method for this managed instance group. Valid values are: "PAGELESS", "PAGINATED". If PAGELESS (default), Pagination is disabled for the group's listManagedInstances API method. maxResults and pageToken query parameters are ignored and all instances are returned in a single response. If PAGINATED, pagination is enabled, maxResults and pageToken query parameters are respected. When `null`, the `list_managed_instances_results` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance group manager. Must be 1-63 characters long and comply with RFC1035. Supported characters include lowercase letters, numbers, and hyphens.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region where the managed instance group resides. When `null`, the `region` field will be omitted from the resulting object.\n  - `target_pools` (`list`): The full URL of all target pools to which new instances in the group are added. Updating the target pools attribute does not affect existing instances. When `null`, the `target_pools` field will be omitted from the resulting object.\n  - `target_size` (`number`): The target number of running instances for this managed instance group. This value should always be explicitly set unless this resource is attached to an autoscaler, in which case it should never be set. Defaults to 0. When `null`, the `target_size` field will be omitted from the resulting object.\n  - `wait_for_instances` (`bool`): Whether to wait for all instances to be created/updated before returning. Note that if this is set to true and the operation does not succeed, Terraform will continue trying until it times out. When `null`, the `wait_for_instances` field will be omitted from the resulting object.\n  - `wait_for_instances_status` (`string`): When used with wait_for_instances specifies the status to wait for. When STABLE is specified this resource will wait until the instances are stable before returning. When UPDATED is set, it will wait for the version target to be reached and any per instance configs to be effective as well as all instances to be stable before returning. When `null`, the `wait_for_instances_status` field will be omitted from the resulting object.\n  - `auto_healing_policies` (`list[obj]`): The autohealing policies for this managed instance group. You can specify only one value. When `null`, the `auto_healing_policies` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.auto_healing_policies.new](#fn-auto_healing_policiesnew) constructor.\n  - `instance_lifecycle_policy` (`list[obj]`): The instance lifecycle policy for this managed instance group. When `null`, the `instance_lifecycle_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.instance_lifecycle_policy.new](#fn-instance_lifecycle_policynew) constructor.\n  - `named_port` (`list[obj]`): The named port configuration. When `null`, the `named_port` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.named_port.new](#fn-named_portnew) constructor.\n  - `stateful_disk` (`list[obj]`): Disks created on the instances that will be preserved on instance delete, update, etc. Structure is documented below. For more information see the official documentation. Proactive cross zone instance redistribution must be disabled before you can update stateful disks on existing instance group managers. This can be controlled via the update_policy. When `null`, the `stateful_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.stateful_disk.new](#fn-stateful_disknew) constructor.\n  - `stateful_external_ip` (`list[obj]`): External IPs considered stateful by the instance group.  When `null`, the `stateful_external_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.stateful_external_ip.new](#fn-stateful_external_ipnew) constructor.\n  - `stateful_internal_ip` (`list[obj]`): External IPs considered stateful by the instance group.  When `null`, the `stateful_internal_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.stateful_internal_ip.new](#fn-stateful_internal_ipnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.timeouts.new](#fn-timeoutsnew) constructor.\n  - `update_policy` (`list[obj]`): The update policy for this managed instance group. When `null`, the `update_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.update_policy.new](#fn-update_policynew) constructor.\n  - `version` (`list[obj]`): Application versions managed by this instance group. Each version deals with a specific instance template, allowing canary release scenarios. When `null`, the `version` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.version.new](#fn-versionnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_region_instance_group_manager` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     base_instance_name,
     name,
@@ -93,6 +97,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project=null,
     region=null,
     stateful_disk=null,
+    stateful_external_ip=null,
+    stateful_internal_ip=null,
     target_pools=null,
     target_size=null,
     timeouts=null,
@@ -113,6 +119,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project: project,
     region: region,
     stateful_disk: stateful_disk,
+    stateful_external_ip: stateful_external_ip,
+    stateful_internal_ip: stateful_internal_ip,
     target_pools: target_pools,
     target_size: target_size,
     timeouts: timeouts,
@@ -131,6 +139,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       device_name: device_name,
     }),
   },
+  stateful_external_ip:: {
+    '#new':: d.fn(help='\n`google.compute_region_instance_group_manager.stateful_external_ip.new` constructs a new object with attributes and blocks configured for the `stateful_external_ip`\nTerraform sub block.\n\n\n\n**Args**:\n  - `delete_rule` (`string`): A value that prescribes what should happen to an associated static Address resource when a VM instance is permanently deleted. The available options are NEVER and ON_PERMANENT_INSTANCE_DELETION. NEVER - detach the IP when the VM is deleted, but do not delete the address resource. ON_PERMANENT_INSTANCE_DELETION will delete the stateful address when the VM is permanently deleted from the instance group. The default is NEVER. When `null`, the `delete_rule` field will be omitted from the resulting object.\n  - `interface_name` (`string`): The network interface name When `null`, the `interface_name` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `stateful_external_ip` sub block.\n', args=[]),
+    new(
+      delete_rule=null,
+      interface_name=null
+    ):: std.prune(a={
+      delete_rule: delete_rule,
+      interface_name: interface_name,
+    }),
+  },
+  stateful_internal_ip:: {
+    '#new':: d.fn(help='\n`google.compute_region_instance_group_manager.stateful_internal_ip.new` constructs a new object with attributes and blocks configured for the `stateful_internal_ip`\nTerraform sub block.\n\n\n\n**Args**:\n  - `delete_rule` (`string`): A value that prescribes what should happen to an associated static Address resource when a VM instance is permanently deleted. The available options are NEVER and ON_PERMANENT_INSTANCE_DELETION. NEVER - detach the IP when the VM is deleted, but do not delete the address resource. ON_PERMANENT_INSTANCE_DELETION will delete the stateful address when the VM is permanently deleted from the instance group. The default is NEVER. When `null`, the `delete_rule` field will be omitted from the resulting object.\n  - `interface_name` (`string`): The network interface name When `null`, the `interface_name` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `stateful_internal_ip` sub block.\n', args=[]),
+    new(
+      delete_rule=null,
+      interface_name=null
+    ):: std.prune(a={
+      delete_rule: delete_rule,
+      interface_name: interface_name,
+    }),
+  },
   timeouts:: {
     '#new':: d.fn(help='\n`google.compute_region_instance_group_manager.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
     new(
@@ -349,6 +377,46 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withStatefulExternalIp':: d.fn(help='`google.list[obj].withStatefulExternalIp` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the stateful_external_ip field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withStatefulExternalIpMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `stateful_external_ip` field.\n', args=[]),
+  withStatefulExternalIp(resourceLabel, value): {
+    resource+: {
+      google_compute_region_instance_group_manager+: {
+        [resourceLabel]+: {
+          stateful_external_ip: value,
+        },
+      },
+    },
+  },
+  '#withStatefulExternalIpMixin':: d.fn(help='`google.list[obj].withStatefulExternalIpMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the stateful_external_ip field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withStatefulExternalIp](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `stateful_external_ip` field.\n', args=[]),
+  withStatefulExternalIpMixin(resourceLabel, value): {
+    resource+: {
+      google_compute_region_instance_group_manager+: {
+        [resourceLabel]+: {
+          stateful_external_ip+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withStatefulInternalIp':: d.fn(help='`google.list[obj].withStatefulInternalIp` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the stateful_internal_ip field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withStatefulInternalIpMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `stateful_internal_ip` field.\n', args=[]),
+  withStatefulInternalIp(resourceLabel, value): {
+    resource+: {
+      google_compute_region_instance_group_manager+: {
+        [resourceLabel]+: {
+          stateful_internal_ip: value,
+        },
+      },
+    },
+  },
+  '#withStatefulInternalIpMixin':: d.fn(help='`google.list[obj].withStatefulInternalIpMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the stateful_internal_ip field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withStatefulInternalIp](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `stateful_internal_ip` field.\n', args=[]),
+  withStatefulInternalIpMixin(resourceLabel, value): {
+    resource+: {
+      google_compute_region_instance_group_manager+: {
+        [resourceLabel]+: {
+          stateful_internal_ip+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withTargetPools':: d.fn(help='`google.list.withTargetPools` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the target_pools field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `target_pools` field.\n', args=[]),
   withTargetPools(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/compute_region_instance_template.libsonnet b/4.x/_gen/resources/compute_region_instance_template.libsonnet
index 0cfcb904..14a419c0 100644
--- a/4.x/_gen/resources/compute_region_instance_template.libsonnet
+++ b/4.x/_gen/resources/compute_region_instance_template.libsonnet
@@ -168,7 +168,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       total_egress_bandwidth_tier: total_egress_bandwidth_tier,
     }),
   },
-  '#new':: d.fn(help="\n`google.compute_region_instance_template.new` injects a new `google_compute_region_instance_template` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_region_instance_template.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_region_instance_template` using the reference:\n\n    $._ref.google_compute_region_instance_template.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_region_instance_template.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `can_ip_forward` (`bool`): Whether to allow sending and receiving of packets with non-matching source or destination IPs. This defaults to false. When `null`, the `can_ip_forward` field will be omitted from the resulting object.\n  - `description` (`string`): A brief description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `instance_description` (`string`): A description of the instance. When `null`, the `instance_description` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to instances created from this template, When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to create. To create a machine with a custom type (such as extended memory), format the value like custom-VCPUS-MEM_IN_MB like custom-6-20480 for 6 vCPU and 20GB of RAM.\n  - `metadata` (`obj`): Metadata key/value pairs to make available from within instances created from this template. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `metadata_startup_script` (`string`): An alternative to using the startup-script metadata key, mostly to match the compute_instance resource. This replaces the startup-script metadata key on the created instance and thus the two mechanisms are not allowed to be used simultaneously. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): Specifies a minimum CPU platform. Applicable values are the friendly names of CPU platforms, such as Intel Haswell or Intel Skylake. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance template. If you leave this blank, Terraform will auto-generate a unique name. When `null`, the `name` field will be omitted from the resulting object.\n  - `name_prefix` (`string`): Creates a unique name beginning with the specified prefix. Conflicts with name. When `null`, the `name_prefix` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region in which the instance template is located. If it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `tags` (`list`): Tags to attach to the instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.\n  - `confidential_instance_config` (`list[obj]`): The Confidential VM config being used by the instance. on_host_maintenance has to be set to TERMINATE or this will fail to create. When `null`, the `confidential_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.confidential_instance_config.new](#fn-confidential_instance_confignew) constructor.\n  - `disk` (`list[obj]`): Disks to attach to instances created from this template. This can be specified multiple times for multiple disks. When `null`, the `disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.disk.new](#fn-disknew) constructor.\n  - `guest_accelerator` (`list[obj]`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.guest_accelerator.new](#fn-guest_acceleratornew) constructor.\n  - `network_interface` (`list[obj]`): Networks to attach to instances created from this template. This can be specified multiple times for multiple networks. When `null`, the `network_interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.network_interface.new](#fn-network_interfacenew) constructor.\n  - `network_performance_config` (`list[obj]`): Configures network performance settings for the instance. If not specified, the instance will be created with its default network performance configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.network_performance_config.new](#fn-network_performance_confignew) constructor.\n  - `reservation_affinity` (`list[obj]`): Specifies the reservations that this instance can consume from. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `scheduling` (`list[obj]`): The scheduling strategy to use. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.scheduling.new](#fn-schedulingnew) constructor.\n  - `service_account` (`list[obj]`): Service account to attach to the instance. When `null`, the `service_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.service_account.new](#fn-service_accountnew) constructor.\n  - `shielded_instance_config` (`list[obj]`): Enable Shielded VM on this instance. Shielded VM provides verifiable integrity to prevent against malware and rootkits. Defaults to disabled. Note: shielded_instance_config can only be used with boot images with shielded vm support. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_region_instance_template.new` injects a new `google_compute_region_instance_template` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_region_instance_template.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_region_instance_template` using the reference:\n\n    $._ref.google_compute_region_instance_template.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_region_instance_template.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `can_ip_forward` (`bool`): Whether to allow sending and receiving of packets with non-matching source or destination IPs. This defaults to false. When `null`, the `can_ip_forward` field will be omitted from the resulting object.\n  - `description` (`string`): A brief description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `instance_description` (`string`): A description of the instance. When `null`, the `instance_description` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to instances created from this template,\n\t\t\t\t\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to create. To create a machine with a custom type (such as extended memory), format the value like custom-VCPUS-MEM_IN_MB like custom-6-20480 for 6 vCPU and 20GB of RAM.\n  - `metadata` (`obj`): Metadata key/value pairs to make available from within instances created from this template. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `metadata_startup_script` (`string`): An alternative to using the startup-script metadata key, mostly to match the compute_instance resource. This replaces the startup-script metadata key on the created instance and thus the two mechanisms are not allowed to be used simultaneously. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): Specifies a minimum CPU platform. Applicable values are the friendly names of CPU platforms, such as Intel Haswell or Intel Skylake. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance template. If you leave this blank, Terraform will auto-generate a unique name. When `null`, the `name` field will be omitted from the resulting object.\n  - `name_prefix` (`string`): Creates a unique name beginning with the specified prefix. Conflicts with name. When `null`, the `name_prefix` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region in which the instance template is located. If it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `tags` (`list`): Tags to attach to the instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.\n  - `confidential_instance_config` (`list[obj]`): The Confidential VM config being used by the instance. on_host_maintenance has to be set to TERMINATE or this will fail to create. When `null`, the `confidential_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.confidential_instance_config.new](#fn-confidential_instance_confignew) constructor.\n  - `disk` (`list[obj]`): Disks to attach to instances created from this template. This can be specified multiple times for multiple disks. When `null`, the `disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.disk.new](#fn-disknew) constructor.\n  - `guest_accelerator` (`list[obj]`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.guest_accelerator.new](#fn-guest_acceleratornew) constructor.\n  - `network_interface` (`list[obj]`): Networks to attach to instances created from this template. This can be specified multiple times for multiple networks. When `null`, the `network_interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.network_interface.new](#fn-network_interfacenew) constructor.\n  - `network_performance_config` (`list[obj]`): Configures network performance settings for the instance. If not specified, the instance will be created with its default network performance configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.network_performance_config.new](#fn-network_performance_confignew) constructor.\n  - `reservation_affinity` (`list[obj]`): Specifies the reservations that this instance can consume from. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `scheduling` (`list[obj]`): The scheduling strategy to use. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.scheduling.new](#fn-schedulingnew) constructor.\n  - `service_account` (`list[obj]`): Service account to attach to the instance. When `null`, the `service_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.service_account.new](#fn-service_accountnew) constructor.\n  - `shielded_instance_config` (`list[obj]`): Enable Shielded VM on this instance. Shielded VM provides verifiable integrity to prevent against malware and rootkits. Defaults to disabled. Note: shielded_instance_config can only be used with boot images with shielded vm support. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     machine_type,
@@ -229,7 +229,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_region_instance_template.newAttrs` constructs a new object with attributes and blocks configured for the `compute_region_instance_template`\nTerraform resource.\n\nUnlike [google.compute_region_instance_template.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `can_ip_forward` (`bool`): Whether to allow sending and receiving of packets with non-matching source or destination IPs. This defaults to false. When `null`, the `can_ip_forward` field will be omitted from the resulting object.\n  - `description` (`string`): A brief description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `instance_description` (`string`): A description of the instance. When `null`, the `instance_description` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to instances created from this template, When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to create. To create a machine with a custom type (such as extended memory), format the value like custom-VCPUS-MEM_IN_MB like custom-6-20480 for 6 vCPU and 20GB of RAM.\n  - `metadata` (`obj`): Metadata key/value pairs to make available from within instances created from this template. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `metadata_startup_script` (`string`): An alternative to using the startup-script metadata key, mostly to match the compute_instance resource. This replaces the startup-script metadata key on the created instance and thus the two mechanisms are not allowed to be used simultaneously. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): Specifies a minimum CPU platform. Applicable values are the friendly names of CPU platforms, such as Intel Haswell or Intel Skylake. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance template. If you leave this blank, Terraform will auto-generate a unique name. When `null`, the `name` field will be omitted from the resulting object.\n  - `name_prefix` (`string`): Creates a unique name beginning with the specified prefix. Conflicts with name. When `null`, the `name_prefix` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region in which the instance template is located. If it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `tags` (`list`): Tags to attach to the instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.\n  - `confidential_instance_config` (`list[obj]`): The Confidential VM config being used by the instance. on_host_maintenance has to be set to TERMINATE or this will fail to create. When `null`, the `confidential_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.confidential_instance_config.new](#fn-confidential_instance_confignew) constructor.\n  - `disk` (`list[obj]`): Disks to attach to instances created from this template. This can be specified multiple times for multiple disks. When `null`, the `disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.disk.new](#fn-disknew) constructor.\n  - `guest_accelerator` (`list[obj]`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.guest_accelerator.new](#fn-guest_acceleratornew) constructor.\n  - `network_interface` (`list[obj]`): Networks to attach to instances created from this template. This can be specified multiple times for multiple networks. When `null`, the `network_interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.network_interface.new](#fn-network_interfacenew) constructor.\n  - `network_performance_config` (`list[obj]`): Configures network performance settings for the instance. If not specified, the instance will be created with its default network performance configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.network_performance_config.new](#fn-network_performance_confignew) constructor.\n  - `reservation_affinity` (`list[obj]`): Specifies the reservations that this instance can consume from. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `scheduling` (`list[obj]`): The scheduling strategy to use. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.scheduling.new](#fn-schedulingnew) constructor.\n  - `service_account` (`list[obj]`): Service account to attach to the instance. When `null`, the `service_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.service_account.new](#fn-service_accountnew) constructor.\n  - `shielded_instance_config` (`list[obj]`): Enable Shielded VM on this instance. Shielded VM provides verifiable integrity to prevent against malware and rootkits. Defaults to disabled. Note: shielded_instance_config can only be used with boot images with shielded vm support. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_region_instance_template` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_region_instance_template.newAttrs` constructs a new object with attributes and blocks configured for the `compute_region_instance_template`\nTerraform resource.\n\nUnlike [google.compute_region_instance_template.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `can_ip_forward` (`bool`): Whether to allow sending and receiving of packets with non-matching source or destination IPs. This defaults to false. When `null`, the `can_ip_forward` field will be omitted from the resulting object.\n  - `description` (`string`): A brief description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `instance_description` (`string`): A description of the instance. When `null`, the `instance_description` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to instances created from this template,\n\t\t\t\t\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to create. To create a machine with a custom type (such as extended memory), format the value like custom-VCPUS-MEM_IN_MB like custom-6-20480 for 6 vCPU and 20GB of RAM.\n  - `metadata` (`obj`): Metadata key/value pairs to make available from within instances created from this template. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `metadata_startup_script` (`string`): An alternative to using the startup-script metadata key, mostly to match the compute_instance resource. This replaces the startup-script metadata key on the created instance and thus the two mechanisms are not allowed to be used simultaneously. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): Specifies a minimum CPU platform. Applicable values are the friendly names of CPU platforms, such as Intel Haswell or Intel Skylake. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the instance template. If you leave this blank, Terraform will auto-generate a unique name. When `null`, the `name` field will be omitted from the resulting object.\n  - `name_prefix` (`string`): Creates a unique name beginning with the specified prefix. Conflicts with name. When `null`, the `name_prefix` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region in which the instance template is located. If it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `resource_policies` (`list`): A list of self_links of resource policies to attach to the instance. Currently a max of 1 resource policy is supported. When `null`, the `resource_policies` field will be omitted from the resulting object.\n  - `tags` (`list`): Tags to attach to the instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Controls for advanced machine-related behavior features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.advanced_machine_features.new](#fn-advanced_machine_featuresnew) constructor.\n  - `confidential_instance_config` (`list[obj]`): The Confidential VM config being used by the instance. on_host_maintenance has to be set to TERMINATE or this will fail to create. When `null`, the `confidential_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.confidential_instance_config.new](#fn-confidential_instance_confignew) constructor.\n  - `disk` (`list[obj]`): Disks to attach to instances created from this template. This can be specified multiple times for multiple disks. When `null`, the `disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.disk.new](#fn-disknew) constructor.\n  - `guest_accelerator` (`list[obj]`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.guest_accelerator.new](#fn-guest_acceleratornew) constructor.\n  - `network_interface` (`list[obj]`): Networks to attach to instances created from this template. This can be specified multiple times for multiple networks. When `null`, the `network_interface` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.network_interface.new](#fn-network_interfacenew) constructor.\n  - `network_performance_config` (`list[obj]`): Configures network performance settings for the instance. If not specified, the instance will be created with its default network performance configuration. When `null`, the `network_performance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.network_performance_config.new](#fn-network_performance_confignew) constructor.\n  - `reservation_affinity` (`list[obj]`): Specifies the reservations that this instance can consume from. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `scheduling` (`list[obj]`): The scheduling strategy to use. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.scheduling.new](#fn-schedulingnew) constructor.\n  - `service_account` (`list[obj]`): Service account to attach to the instance. When `null`, the `service_account` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.service_account.new](#fn-service_accountnew) constructor.\n  - `shielded_instance_config` (`list[obj]`): Enable Shielded VM on this instance. Shielded VM provides verifiable integrity to prevent against malware and rootkits. Defaults to disabled. Note: shielded_instance_config can only be used with boot images with shielded vm support. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_region_instance_template` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     machine_type,
     advanced_machine_features=null,
diff --git a/4.x/_gen/resources/compute_region_per_instance_config.libsonnet b/4.x/_gen/resources/compute_region_per_instance_config.libsonnet
index 7d9d73e7..e2292849 100644
--- a/4.x/_gen/resources/compute_region_per_instance_config.libsonnet
+++ b/4.x/_gen/resources/compute_region_per_instance_config.libsonnet
@@ -68,12 +68,56 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         source: source,
       }),
     },
-    '#new':: d.fn(help='\n`google.compute_region_per_instance_config.preserved_state.new` constructs a new object with attributes and blocks configured for the `preserved_state`\nTerraform sub block.\n\n\n\n**Args**:\n  - `metadata` (`obj`): Preserved metadata defined for this instance. This is a list of key->value pairs. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `disk` (`list[obj]`): Stateful disks for the instance. When `null`, the `disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_per_instance_config.preserved_state.disk.new](#fn-preserved_statedisknew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `preserved_state` sub block.\n', args=[]),
+    external_ip:: {
+      ip_address:: {
+        '#new':: d.fn(help='\n`google.compute_region_per_instance_config.preserved_state.external_ip.ip_address.new` constructs a new object with attributes and blocks configured for the `ip_address`\nTerraform sub block.\n\n\n\n**Args**:\n  - `address` (`string`): The URL of the reservation for this IP address. When `null`, the `address` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `ip_address` sub block.\n', args=[]),
+        new(
+          address=null
+        ):: std.prune(a={
+          address: address,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.compute_region_per_instance_config.preserved_state.external_ip.new` constructs a new object with attributes and blocks configured for the `external_ip`\nTerraform sub block.\n\n\n\n**Args**:\n  - `auto_delete` (`string`): These stateful IPs will never be released during autohealing, update or VM instance recreate operations. This flag is used to configure if the IP reservation should be deleted after it is no longer used by the group, e.g. when the given instance or the whole group is deleted. Default value: "NEVER" Possible values: ["NEVER", "ON_PERMANENT_INSTANCE_DELETION"] When `null`, the `auto_delete` field will be omitted from the resulting object.\n  - `interface_name` (`string`): Set the `interface_name` field on the resulting object.\n  - `ip_address` (`list[obj]`): Ip address representation When `null`, the `ip_address` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_per_instance_config.preserved_state.external_ip.ip_address.new](#fn-preserved_statepreserved_stateip_addressnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `external_ip` sub block.\n', args=[]),
+      new(
+        interface_name,
+        auto_delete=null,
+        ip_address=null
+      ):: std.prune(a={
+        auto_delete: auto_delete,
+        interface_name: interface_name,
+        ip_address: ip_address,
+      }),
+    },
+    internal_ip:: {
+      ip_address:: {
+        '#new':: d.fn(help='\n`google.compute_region_per_instance_config.preserved_state.internal_ip.ip_address.new` constructs a new object with attributes and blocks configured for the `ip_address`\nTerraform sub block.\n\n\n\n**Args**:\n  - `address` (`string`): The URL of the reservation for this IP address. When `null`, the `address` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `ip_address` sub block.\n', args=[]),
+        new(
+          address=null
+        ):: std.prune(a={
+          address: address,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.compute_region_per_instance_config.preserved_state.internal_ip.new` constructs a new object with attributes and blocks configured for the `internal_ip`\nTerraform sub block.\n\n\n\n**Args**:\n  - `auto_delete` (`string`): These stateful IPs will never be released during autohealing, update or VM instance recreate operations. This flag is used to configure if the IP reservation should be deleted after it is no longer used by the group, e.g. when the given instance or the whole group is deleted. Default value: "NEVER" Possible values: ["NEVER", "ON_PERMANENT_INSTANCE_DELETION"] When `null`, the `auto_delete` field will be omitted from the resulting object.\n  - `interface_name` (`string`): Set the `interface_name` field on the resulting object.\n  - `ip_address` (`list[obj]`): Ip address representation When `null`, the `ip_address` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_per_instance_config.preserved_state.internal_ip.ip_address.new](#fn-preserved_statepreserved_stateip_addressnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `internal_ip` sub block.\n', args=[]),
+      new(
+        interface_name,
+        auto_delete=null,
+        ip_address=null
+      ):: std.prune(a={
+        auto_delete: auto_delete,
+        interface_name: interface_name,
+        ip_address: ip_address,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.compute_region_per_instance_config.preserved_state.new` constructs a new object with attributes and blocks configured for the `preserved_state`\nTerraform sub block.\n\n\n\n**Args**:\n  - `metadata` (`obj`): Preserved metadata defined for this instance. This is a list of key->value pairs. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `disk` (`list[obj]`): Stateful disks for the instance. When `null`, the `disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_per_instance_config.preserved_state.disk.new](#fn-preserved_statedisknew) constructor.\n  - `external_ip` (`list[obj]`): Preserved external IPs defined for this instance. This map is keyed with the name of the network interface. When `null`, the `external_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_per_instance_config.preserved_state.external_ip.new](#fn-preserved_stateexternal_ipnew) constructor.\n  - `internal_ip` (`list[obj]`): Preserved internal IPs defined for this instance. This map is keyed with the name of the network interface. When `null`, the `internal_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_per_instance_config.preserved_state.internal_ip.new](#fn-preserved_stateinternal_ipnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `preserved_state` sub block.\n', args=[]),
     new(
       disk=null,
+      external_ip=null,
+      internal_ip=null,
       metadata=null
     ):: std.prune(a={
       disk: disk,
+      external_ip: external_ip,
+      internal_ip: internal_ip,
       metadata: metadata,
     }),
   },
diff --git a/4.x/_gen/resources/compute_router_nat.libsonnet b/4.x/_gen/resources/compute_router_nat.libsonnet
index 78d4bc68..e6c49189 100644
--- a/4.x/_gen/resources/compute_router_nat.libsonnet
+++ b/4.x/_gen/resources/compute_router_nat.libsonnet
@@ -12,11 +12,10 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       filter: filter,
     }),
   },
-  '#new':: d.fn(help="\n`google.compute_router_nat.new` injects a new `google_compute_router_nat` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_router_nat.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_router_nat` using the reference:\n\n    $._ref.google_compute_router_nat.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_router_nat.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `drain_nat_ips` (`list`): A list of URLs of the IP resources to be drained. These IPs must be\nvalid static external IPs that have been assigned to the NAT. When `null`, the `drain_nat_ips` field will be omitted from the resulting object.\n  - `enable_dynamic_port_allocation` (`bool`): Enable Dynamic Port Allocation.\nIf minPortsPerVm is set, minPortsPerVm must be set to a power of two greater than or equal to 32.\nIf minPortsPerVm is not set, a minimum of 32 ports will be allocated to a VM from this NAT config.\nIf maxPortsPerVm is set, maxPortsPerVm must be set to a power of two greater than minPortsPerVm.\nIf maxPortsPerVm is not set, a maximum of 65536 ports will be allocated to a VM from this NAT config.\n\nMutually exclusive with enableEndpointIndependentMapping. When `null`, the `enable_dynamic_port_allocation` field will be omitted from the resulting object.\n  - `enable_endpoint_independent_mapping` (`bool`): Specifies if endpoint independent mapping is enabled. This is enabled by default. For more information\nsee the [official documentation](https://cloud.google.com/nat/docs/overview#specs-rfcs). When `null`, the `enable_endpoint_independent_mapping` field will be omitted from the resulting object.\n  - `icmp_idle_timeout_sec` (`number`): Timeout (in seconds) for ICMP connections. Defaults to 30s if not set. When `null`, the `icmp_idle_timeout_sec` field will be omitted from the resulting object.\n  - `max_ports_per_vm` (`number`): Maximum number of ports allocated to a VM from this NAT.\nThis field can only be set when enableDynamicPortAllocation is enabled. When `null`, the `max_ports_per_vm` field will be omitted from the resulting object.\n  - `min_ports_per_vm` (`number`): Minimum number of ports allocated to a VM from this NAT. When `null`, the `min_ports_per_vm` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the NAT service. The name must be 1-63 characters long and\ncomply with RFC1035.\n  - `nat_ip_allocate_option` (`string`): How external IPs should be allocated for this NAT. Valid values are\n\u0026#39;AUTO_ONLY\u0026#39; for only allowing NAT IPs allocated by Google Cloud\nPlatform, or \u0026#39;MANUAL_ONLY\u0026#39; for only user-allocated NAT IP addresses. Possible values: [\u0026#34;MANUAL_ONLY\u0026#34;, \u0026#34;AUTO_ONLY\u0026#34;]\n  - `nat_ips` (`list`): Self-links of NAT IPs. Only valid if natIpAllocateOption\nis set to MANUAL_ONLY. When `null`, the `nat_ips` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Region where the router and NAT reside. When `null`, the `region` field will be omitted from the resulting object.\n  - `router` (`string`): The name of the Cloud Router in which this NAT will be configured.\n  - `source_subnetwork_ip_ranges_to_nat` (`string`): How NAT should be configured per Subnetwork.\nIf \u0026#39;ALL_SUBNETWORKS_ALL_IP_RANGES\u0026#39;, all of the\nIP ranges in every Subnetwork are allowed to Nat.\nIf \u0026#39;ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES\u0026#39;, all of the primary IP\nranges in every Subnetwork are allowed to Nat.\n\u0026#39;LIST_OF_SUBNETWORKS\u0026#39;: A list of Subnetworks are allowed to Nat\n(specified in the field subnetwork below). Note that if this field\ncontains ALL_SUBNETWORKS_ALL_IP_RANGES or\nALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES, then there should not be any\nother RouterNat section in any Router for this network in this region. Possible values: [\u0026#34;ALL_SUBNETWORKS_ALL_IP_RANGES\u0026#34;, \u0026#34;ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES\u0026#34;, \u0026#34;LIST_OF_SUBNETWORKS\u0026#34;]\n  - `tcp_established_idle_timeout_sec` (`number`): Timeout (in seconds) for TCP established connections.\nDefaults to 1200s if not set. When `null`, the `tcp_established_idle_timeout_sec` field will be omitted from the resulting object.\n  - `tcp_time_wait_timeout_sec` (`number`): Timeout (in seconds) for TCP connections that are in TIME_WAIT state.\nDefaults to 120s if not set. When `null`, the `tcp_time_wait_timeout_sec` field will be omitted from the resulting object.\n  - `tcp_transitory_idle_timeout_sec` (`number`): Timeout (in seconds) for TCP transitory connections.\nDefaults to 30s if not set. When `null`, the `tcp_transitory_idle_timeout_sec` field will be omitted from the resulting object.\n  - `udp_idle_timeout_sec` (`number`): Timeout (in seconds) for UDP connections. Defaults to 30s if not set. When `null`, the `udp_idle_timeout_sec` field will be omitted from the resulting object.\n  - `log_config` (`list[obj]`): Configuration for logging on NAT When `null`, the `log_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_nat.log_config.new](#fn-log_confignew) constructor.\n  - `rules` (`list[obj]`): A list of rules associated with this NAT. When `null`, the `rules` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_nat.rules.new](#fn-rulesnew) constructor.\n  - `subnetwork` (`list[obj]`): One or more subnetwork NAT configurations. Only used if\n\u0026#39;source_subnetwork_ip_ranges_to_nat\u0026#39; is set to \u0026#39;LIST_OF_SUBNETWORKS\u0026#39; When `null`, the `subnetwork` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_nat.subnetwork.new](#fn-subnetworknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_nat.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_router_nat.new` injects a new `google_compute_router_nat` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_router_nat.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_router_nat` using the reference:\n\n    $._ref.google_compute_router_nat.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_router_nat.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `drain_nat_ips` (`list`): A list of URLs of the IP resources to be drained. These IPs must be\nvalid static external IPs that have been assigned to the NAT. When `null`, the `drain_nat_ips` field will be omitted from the resulting object.\n  - `enable_dynamic_port_allocation` (`bool`): Enable Dynamic Port Allocation.\nIf minPortsPerVm is set, minPortsPerVm must be set to a power of two greater than or equal to 32.\nIf minPortsPerVm is not set, a minimum of 32 ports will be allocated to a VM from this NAT config.\nIf maxPortsPerVm is set, maxPortsPerVm must be set to a power of two greater than minPortsPerVm.\nIf maxPortsPerVm is not set, a maximum of 65536 ports will be allocated to a VM from this NAT config.\n\nMutually exclusive with enableEndpointIndependentMapping. When `null`, the `enable_dynamic_port_allocation` field will be omitted from the resulting object.\n  - `enable_endpoint_independent_mapping` (`bool`): Enable endpoint independent mapping.\nFor more information see the [official documentation](https://cloud.google.com/nat/docs/overview#specs-rfcs). When `null`, the `enable_endpoint_independent_mapping` field will be omitted from the resulting object.\n  - `icmp_idle_timeout_sec` (`number`): Timeout (in seconds) for ICMP connections. Defaults to 30s if not set. When `null`, the `icmp_idle_timeout_sec` field will be omitted from the resulting object.\n  - `max_ports_per_vm` (`number`): Maximum number of ports allocated to a VM from this NAT.\nThis field can only be set when enableDynamicPortAllocation is enabled. When `null`, the `max_ports_per_vm` field will be omitted from the resulting object.\n  - `min_ports_per_vm` (`number`): Minimum number of ports allocated to a VM from this NAT. When `null`, the `min_ports_per_vm` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the NAT service. The name must be 1-63 characters long and\ncomply with RFC1035.\n  - `nat_ip_allocate_option` (`string`): How external IPs should be allocated for this NAT. Valid values are\n\u0026#39;AUTO_ONLY\u0026#39; for only allowing NAT IPs allocated by Google Cloud\nPlatform, or \u0026#39;MANUAL_ONLY\u0026#39; for only user-allocated NAT IP addresses. Possible values: [\u0026#34;MANUAL_ONLY\u0026#34;, \u0026#34;AUTO_ONLY\u0026#34;] When `null`, the `nat_ip_allocate_option` field will be omitted from the resulting object.\n  - `nat_ips` (`list`): Self-links of NAT IPs. Only valid if natIpAllocateOption\nis set to MANUAL_ONLY. When `null`, the `nat_ips` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Region where the router and NAT reside. When `null`, the `region` field will be omitted from the resulting object.\n  - `router` (`string`): The name of the Cloud Router in which this NAT will be configured.\n  - `source_subnetwork_ip_ranges_to_nat` (`string`): How NAT should be configured per Subnetwork.\nIf \u0026#39;ALL_SUBNETWORKS_ALL_IP_RANGES\u0026#39;, all of the\nIP ranges in every Subnetwork are allowed to Nat.\nIf \u0026#39;ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES\u0026#39;, all of the primary IP\nranges in every Subnetwork are allowed to Nat.\n\u0026#39;LIST_OF_SUBNETWORKS\u0026#39;: A list of Subnetworks are allowed to Nat\n(specified in the field subnetwork below). Note that if this field\ncontains ALL_SUBNETWORKS_ALL_IP_RANGES or\nALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES, then there should not be any\nother RouterNat section in any Router for this network in this region. Possible values: [\u0026#34;ALL_SUBNETWORKS_ALL_IP_RANGES\u0026#34;, \u0026#34;ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES\u0026#34;, \u0026#34;LIST_OF_SUBNETWORKS\u0026#34;]\n  - `tcp_established_idle_timeout_sec` (`number`): Timeout (in seconds) for TCP established connections.\nDefaults to 1200s if not set. When `null`, the `tcp_established_idle_timeout_sec` field will be omitted from the resulting object.\n  - `tcp_time_wait_timeout_sec` (`number`): Timeout (in seconds) for TCP connections that are in TIME_WAIT state.\nDefaults to 120s if not set. When `null`, the `tcp_time_wait_timeout_sec` field will be omitted from the resulting object.\n  - `tcp_transitory_idle_timeout_sec` (`number`): Timeout (in seconds) for TCP transitory connections.\nDefaults to 30s if not set. When `null`, the `tcp_transitory_idle_timeout_sec` field will be omitted from the resulting object.\n  - `udp_idle_timeout_sec` (`number`): Timeout (in seconds) for UDP connections. Defaults to 30s if not set. When `null`, the `udp_idle_timeout_sec` field will be omitted from the resulting object.\n  - `log_config` (`list[obj]`): Configuration for logging on NAT When `null`, the `log_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_nat.log_config.new](#fn-log_confignew) constructor.\n  - `rules` (`list[obj]`): A list of rules associated with this NAT. When `null`, the `rules` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_nat.rules.new](#fn-rulesnew) constructor.\n  - `subnetwork` (`list[obj]`): One or more subnetwork NAT configurations. Only used if\n\u0026#39;source_subnetwork_ip_ranges_to_nat\u0026#39; is set to \u0026#39;LIST_OF_SUBNETWORKS\u0026#39; When `null`, the `subnetwork` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_nat.subnetwork.new](#fn-subnetworknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_nat.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
-    nat_ip_allocate_option,
     router,
     source_subnetwork_ip_ranges_to_nat,
     drain_nat_ips=null,
@@ -26,6 +25,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     log_config=null,
     max_ports_per_vm=null,
     min_ports_per_vm=null,
+    nat_ip_allocate_option=null,
     nat_ips=null,
     project=null,
     region=null,
@@ -65,10 +65,9 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_router_nat.newAttrs` constructs a new object with attributes and blocks configured for the `compute_router_nat`\nTerraform resource.\n\nUnlike [google.compute_router_nat.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `drain_nat_ips` (`list`): A list of URLs of the IP resources to be drained. These IPs must be\nvalid static external IPs that have been assigned to the NAT. When `null`, the `drain_nat_ips` field will be omitted from the resulting object.\n  - `enable_dynamic_port_allocation` (`bool`): Enable Dynamic Port Allocation.\nIf minPortsPerVm is set, minPortsPerVm must be set to a power of two greater than or equal to 32.\nIf minPortsPerVm is not set, a minimum of 32 ports will be allocated to a VM from this NAT config.\nIf maxPortsPerVm is set, maxPortsPerVm must be set to a power of two greater than minPortsPerVm.\nIf maxPortsPerVm is not set, a maximum of 65536 ports will be allocated to a VM from this NAT config.\n\nMutually exclusive with enableEndpointIndependentMapping. When `null`, the `enable_dynamic_port_allocation` field will be omitted from the resulting object.\n  - `enable_endpoint_independent_mapping` (`bool`): Specifies if endpoint independent mapping is enabled. This is enabled by default. For more information\nsee the [official documentation](https://cloud.google.com/nat/docs/overview#specs-rfcs). When `null`, the `enable_endpoint_independent_mapping` field will be omitted from the resulting object.\n  - `icmp_idle_timeout_sec` (`number`): Timeout (in seconds) for ICMP connections. Defaults to 30s if not set. When `null`, the `icmp_idle_timeout_sec` field will be omitted from the resulting object.\n  - `max_ports_per_vm` (`number`): Maximum number of ports allocated to a VM from this NAT.\nThis field can only be set when enableDynamicPortAllocation is enabled. When `null`, the `max_ports_per_vm` field will be omitted from the resulting object.\n  - `min_ports_per_vm` (`number`): Minimum number of ports allocated to a VM from this NAT. When `null`, the `min_ports_per_vm` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the NAT service. The name must be 1-63 characters long and\ncomply with RFC1035.\n  - `nat_ip_allocate_option` (`string`): How external IPs should be allocated for this NAT. Valid values are\n'AUTO_ONLY' for only allowing NAT IPs allocated by Google Cloud\nPlatform, or 'MANUAL_ONLY' for only user-allocated NAT IP addresses. Possible values: ["MANUAL_ONLY", "AUTO_ONLY"]\n  - `nat_ips` (`list`): Self-links of NAT IPs. Only valid if natIpAllocateOption\nis set to MANUAL_ONLY. When `null`, the `nat_ips` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Region where the router and NAT reside. When `null`, the `region` field will be omitted from the resulting object.\n  - `router` (`string`): The name of the Cloud Router in which this NAT will be configured.\n  - `source_subnetwork_ip_ranges_to_nat` (`string`): How NAT should be configured per Subnetwork.\nIf 'ALL_SUBNETWORKS_ALL_IP_RANGES', all of the\nIP ranges in every Subnetwork are allowed to Nat.\nIf 'ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES', all of the primary IP\nranges in every Subnetwork are allowed to Nat.\n'LIST_OF_SUBNETWORKS': A list of Subnetworks are allowed to Nat\n(specified in the field subnetwork below). Note that if this field\ncontains ALL_SUBNETWORKS_ALL_IP_RANGES or\nALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES, then there should not be any\nother RouterNat section in any Router for this network in this region. Possible values: ["ALL_SUBNETWORKS_ALL_IP_RANGES", "ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES", "LIST_OF_SUBNETWORKS"]\n  - `tcp_established_idle_timeout_sec` (`number`): Timeout (in seconds) for TCP established connections.\nDefaults to 1200s if not set. When `null`, the `tcp_established_idle_timeout_sec` field will be omitted from the resulting object.\n  - `tcp_time_wait_timeout_sec` (`number`): Timeout (in seconds) for TCP connections that are in TIME_WAIT state.\nDefaults to 120s if not set. When `null`, the `tcp_time_wait_timeout_sec` field will be omitted from the resulting object.\n  - `tcp_transitory_idle_timeout_sec` (`number`): Timeout (in seconds) for TCP transitory connections.\nDefaults to 30s if not set. When `null`, the `tcp_transitory_idle_timeout_sec` field will be omitted from the resulting object.\n  - `udp_idle_timeout_sec` (`number`): Timeout (in seconds) for UDP connections. Defaults to 30s if not set. When `null`, the `udp_idle_timeout_sec` field will be omitted from the resulting object.\n  - `log_config` (`list[obj]`): Configuration for logging on NAT When `null`, the `log_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_nat.log_config.new](#fn-log_confignew) constructor.\n  - `rules` (`list[obj]`): A list of rules associated with this NAT. When `null`, the `rules` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_nat.rules.new](#fn-rulesnew) constructor.\n  - `subnetwork` (`list[obj]`): One or more subnetwork NAT configurations. Only used if\n'source_subnetwork_ip_ranges_to_nat' is set to 'LIST_OF_SUBNETWORKS' When `null`, the `subnetwork` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_nat.subnetwork.new](#fn-subnetworknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_nat.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_router_nat` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_router_nat.newAttrs` constructs a new object with attributes and blocks configured for the `compute_router_nat`\nTerraform resource.\n\nUnlike [google.compute_router_nat.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `drain_nat_ips` (`list`): A list of URLs of the IP resources to be drained. These IPs must be\nvalid static external IPs that have been assigned to the NAT. When `null`, the `drain_nat_ips` field will be omitted from the resulting object.\n  - `enable_dynamic_port_allocation` (`bool`): Enable Dynamic Port Allocation.\nIf minPortsPerVm is set, minPortsPerVm must be set to a power of two greater than or equal to 32.\nIf minPortsPerVm is not set, a minimum of 32 ports will be allocated to a VM from this NAT config.\nIf maxPortsPerVm is set, maxPortsPerVm must be set to a power of two greater than minPortsPerVm.\nIf maxPortsPerVm is not set, a maximum of 65536 ports will be allocated to a VM from this NAT config.\n\nMutually exclusive with enableEndpointIndependentMapping. When `null`, the `enable_dynamic_port_allocation` field will be omitted from the resulting object.\n  - `enable_endpoint_independent_mapping` (`bool`): Enable endpoint independent mapping.\nFor more information see the [official documentation](https://cloud.google.com/nat/docs/overview#specs-rfcs). When `null`, the `enable_endpoint_independent_mapping` field will be omitted from the resulting object.\n  - `icmp_idle_timeout_sec` (`number`): Timeout (in seconds) for ICMP connections. Defaults to 30s if not set. When `null`, the `icmp_idle_timeout_sec` field will be omitted from the resulting object.\n  - `max_ports_per_vm` (`number`): Maximum number of ports allocated to a VM from this NAT.\nThis field can only be set when enableDynamicPortAllocation is enabled. When `null`, the `max_ports_per_vm` field will be omitted from the resulting object.\n  - `min_ports_per_vm` (`number`): Minimum number of ports allocated to a VM from this NAT. When `null`, the `min_ports_per_vm` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the NAT service. The name must be 1-63 characters long and\ncomply with RFC1035.\n  - `nat_ip_allocate_option` (`string`): How external IPs should be allocated for this NAT. Valid values are\n'AUTO_ONLY' for only allowing NAT IPs allocated by Google Cloud\nPlatform, or 'MANUAL_ONLY' for only user-allocated NAT IP addresses. Possible values: ["MANUAL_ONLY", "AUTO_ONLY"] When `null`, the `nat_ip_allocate_option` field will be omitted from the resulting object.\n  - `nat_ips` (`list`): Self-links of NAT IPs. Only valid if natIpAllocateOption\nis set to MANUAL_ONLY. When `null`, the `nat_ips` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): Region where the router and NAT reside. When `null`, the `region` field will be omitted from the resulting object.\n  - `router` (`string`): The name of the Cloud Router in which this NAT will be configured.\n  - `source_subnetwork_ip_ranges_to_nat` (`string`): How NAT should be configured per Subnetwork.\nIf 'ALL_SUBNETWORKS_ALL_IP_RANGES', all of the\nIP ranges in every Subnetwork are allowed to Nat.\nIf 'ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES', all of the primary IP\nranges in every Subnetwork are allowed to Nat.\n'LIST_OF_SUBNETWORKS': A list of Subnetworks are allowed to Nat\n(specified in the field subnetwork below). Note that if this field\ncontains ALL_SUBNETWORKS_ALL_IP_RANGES or\nALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES, then there should not be any\nother RouterNat section in any Router for this network in this region. Possible values: ["ALL_SUBNETWORKS_ALL_IP_RANGES", "ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES", "LIST_OF_SUBNETWORKS"]\n  - `tcp_established_idle_timeout_sec` (`number`): Timeout (in seconds) for TCP established connections.\nDefaults to 1200s if not set. When `null`, the `tcp_established_idle_timeout_sec` field will be omitted from the resulting object.\n  - `tcp_time_wait_timeout_sec` (`number`): Timeout (in seconds) for TCP connections that are in TIME_WAIT state.\nDefaults to 120s if not set. When `null`, the `tcp_time_wait_timeout_sec` field will be omitted from the resulting object.\n  - `tcp_transitory_idle_timeout_sec` (`number`): Timeout (in seconds) for TCP transitory connections.\nDefaults to 30s if not set. When `null`, the `tcp_transitory_idle_timeout_sec` field will be omitted from the resulting object.\n  - `udp_idle_timeout_sec` (`number`): Timeout (in seconds) for UDP connections. Defaults to 30s if not set. When `null`, the `udp_idle_timeout_sec` field will be omitted from the resulting object.\n  - `log_config` (`list[obj]`): Configuration for logging on NAT When `null`, the `log_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_nat.log_config.new](#fn-log_confignew) constructor.\n  - `rules` (`list[obj]`): A list of rules associated with this NAT. When `null`, the `rules` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_nat.rules.new](#fn-rulesnew) constructor.\n  - `subnetwork` (`list[obj]`): One or more subnetwork NAT configurations. Only used if\n'source_subnetwork_ip_ranges_to_nat' is set to 'LIST_OF_SUBNETWORKS' When `null`, the `subnetwork` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_nat.subnetwork.new](#fn-subnetworknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_router_nat.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_router_nat` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
-    nat_ip_allocate_option,
     router,
     source_subnetwork_ip_ranges_to_nat,
     drain_nat_ips=null,
@@ -78,6 +77,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     log_config=null,
     max_ports_per_vm=null,
     min_ports_per_vm=null,
+    nat_ip_allocate_option=null,
     nat_ips=null,
     project=null,
     region=null,
diff --git a/4.x/_gen/resources/compute_service_attachment.libsonnet b/4.x/_gen/resources/compute_service_attachment.libsonnet
index 47169e7b..35452b0b 100644
--- a/4.x/_gen/resources/compute_service_attachment.libsonnet
+++ b/4.x/_gen/resources/compute_service_attachment.libsonnet
@@ -12,7 +12,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       project_id_or_num: project_id_or_num,
     }),
   },
-  '#new':: d.fn(help="\n`google.compute_service_attachment.new` injects a new `google_compute_service_attachment` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_service_attachment.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_service_attachment` using the reference:\n\n    $._ref.google_compute_service_attachment.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_service_attachment.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `connection_preference` (`string`): The connection preference to use for this service attachment. Valid\nvalues include \u0026#34;ACCEPT_AUTOMATIC\u0026#34;, \u0026#34;ACCEPT_MANUAL\u0026#34;.\n  - `consumer_reject_lists` (`list`): An array of projects that are not allowed to connect to this service\nattachment. When `null`, the `consumer_reject_lists` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `domain_names` (`list`): If specified, the domain name will be used during the integration between\nthe PSC connected endpoints and the Cloud DNS. For example, this is a\nvalid domain name: \u0026#34;p.mycompany.com.\u0026#34;. Current max number of domain names\nsupported is 1. When `null`, the `domain_names` field will be omitted from the resulting object.\n  - `enable_proxy_protocol` (`bool`): If true, enable the proxy protocol which is for supplying client TCP/IP\naddress data in TCP connections that traverse proxies on their way to\ndestination servers.\n  - `name` (`string`): Name of the resource. The name must be 1-63 characters long, and\ncomply with RFC1035. Specifically, the name must be 1-63 characters\nlong and match the regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39;\nwhich means the first character must be a lowercase letter, and all\nfollowing characters must be a dash, lowercase letter, or digit,\nexcept the last character, which cannot be a dash.\n  - `nat_subnets` (`list`): An array of subnets that is provided for NAT in this service attachment.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `reconcile_connections` (`bool`): This flag determines whether a consumer accept/reject list change can reconcile the statuses of existing ACCEPTED or REJECTED PSC endpoints.\n\nIf false, connection policy update will only affect existing PENDING PSC endpoints. Existing ACCEPTED/REJECTED endpoints will remain untouched regardless how the connection policy is modified .\nIf true, update will affect both PENDING and ACCEPTED/REJECTED PSC endpoints. For example, an ACCEPTED PSC endpoint will be moved to REJECTED if its project is added to the reject list.\n\nFor newly created service attachment, this boolean defaults to true. When `null`, the `reconcile_connections` field will be omitted from the resulting object.\n  - `region` (`string`): URL of the region where the resource resides. When `null`, the `region` field will be omitted from the resulting object.\n  - `target_service` (`string`): The URL of a forwarding rule that represents the service identified by\nthis service attachment.\n  - `consumer_accept_lists` (`list[obj]`): An array of projects that are allowed to connect to this service\nattachment. When `null`, the `consumer_accept_lists` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_service_attachment.consumer_accept_lists.new](#fn-consumer_accept_listsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_service_attachment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_service_attachment.new` injects a new `google_compute_service_attachment` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_service_attachment.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_service_attachment` using the reference:\n\n    $._ref.google_compute_service_attachment.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_service_attachment.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `connection_preference` (`string`): The connection preference to use for this service attachment. Valid\nvalues include \u0026#34;ACCEPT_AUTOMATIC\u0026#34;, \u0026#34;ACCEPT_MANUAL\u0026#34;.\n  - `consumer_reject_lists` (`list`): An array of projects that are not allowed to connect to this service\nattachment. When `null`, the `consumer_reject_lists` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `domain_names` (`list`): If specified, the domain name will be used during the integration between\nthe PSC connected endpoints and the Cloud DNS. For example, this is a\nvalid domain name: \u0026#34;p.mycompany.com.\u0026#34;. Current max number of domain names\nsupported is 1. When `null`, the `domain_names` field will be omitted from the resulting object.\n  - `enable_proxy_protocol` (`bool`): If true, enable the proxy protocol which is for supplying client TCP/IP\naddress data in TCP connections that traverse proxies on their way to\ndestination servers.\n  - `name` (`string`): Name of the resource. The name must be 1-63 characters long, and\ncomply with RFC1035. Specifically, the name must be 1-63 characters\nlong and match the regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39;\nwhich means the first character must be a lowercase letter, and all\nfollowing characters must be a dash, lowercase letter, or digit,\nexcept the last character, which cannot be a dash.\n  - `nat_subnets` (`list`): An array of subnets that is provided for NAT in this service attachment.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `reconcile_connections` (`bool`): This flag determines whether a consumer accept/reject list change can reconcile the statuses of existing ACCEPTED or REJECTED PSC endpoints.\n\nIf false, connection policy update will only affect existing PENDING PSC endpoints. Existing ACCEPTED/REJECTED endpoints will remain untouched regardless how the connection policy is modified .\nIf true, update will affect both PENDING and ACCEPTED/REJECTED PSC endpoints. For example, an ACCEPTED PSC endpoint will be moved to REJECTED if its project is added to the reject list. When `null`, the `reconcile_connections` field will be omitted from the resulting object.\n  - `region` (`string`): URL of the region where the resource resides. When `null`, the `region` field will be omitted from the resulting object.\n  - `target_service` (`string`): The URL of a forwarding rule that represents the service identified by\nthis service attachment.\n  - `consumer_accept_lists` (`list[obj]`): An array of projects that are allowed to connect to this service\nattachment. When `null`, the `consumer_accept_lists` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_service_attachment.consumer_accept_lists.new](#fn-consumer_accept_listsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_service_attachment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     connection_preference,
@@ -49,7 +49,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_service_attachment.newAttrs` constructs a new object with attributes and blocks configured for the `compute_service_attachment`\nTerraform resource.\n\nUnlike [google.compute_service_attachment.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `connection_preference` (`string`): The connection preference to use for this service attachment. Valid\nvalues include "ACCEPT_AUTOMATIC", "ACCEPT_MANUAL".\n  - `consumer_reject_lists` (`list`): An array of projects that are not allowed to connect to this service\nattachment. When `null`, the `consumer_reject_lists` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `domain_names` (`list`): If specified, the domain name will be used during the integration between\nthe PSC connected endpoints and the Cloud DNS. For example, this is a\nvalid domain name: "p.mycompany.com.". Current max number of domain names\nsupported is 1. When `null`, the `domain_names` field will be omitted from the resulting object.\n  - `enable_proxy_protocol` (`bool`): If true, enable the proxy protocol which is for supplying client TCP/IP\naddress data in TCP connections that traverse proxies on their way to\ndestination servers.\n  - `name` (`string`): Name of the resource. The name must be 1-63 characters long, and\ncomply with RFC1035. Specifically, the name must be 1-63 characters\nlong and match the regular expression '[a-z]([-a-z0-9]*[a-z0-9])?'\nwhich means the first character must be a lowercase letter, and all\nfollowing characters must be a dash, lowercase letter, or digit,\nexcept the last character, which cannot be a dash.\n  - `nat_subnets` (`list`): An array of subnets that is provided for NAT in this service attachment.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `reconcile_connections` (`bool`): This flag determines whether a consumer accept/reject list change can reconcile the statuses of existing ACCEPTED or REJECTED PSC endpoints.\n\nIf false, connection policy update will only affect existing PENDING PSC endpoints. Existing ACCEPTED/REJECTED endpoints will remain untouched regardless how the connection policy is modified .\nIf true, update will affect both PENDING and ACCEPTED/REJECTED PSC endpoints. For example, an ACCEPTED PSC endpoint will be moved to REJECTED if its project is added to the reject list.\n\nFor newly created service attachment, this boolean defaults to true. When `null`, the `reconcile_connections` field will be omitted from the resulting object.\n  - `region` (`string`): URL of the region where the resource resides. When `null`, the `region` field will be omitted from the resulting object.\n  - `target_service` (`string`): The URL of a forwarding rule that represents the service identified by\nthis service attachment.\n  - `consumer_accept_lists` (`list[obj]`): An array of projects that are allowed to connect to this service\nattachment. When `null`, the `consumer_accept_lists` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_service_attachment.consumer_accept_lists.new](#fn-consumer_accept_listsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_service_attachment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_service_attachment` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_service_attachment.newAttrs` constructs a new object with attributes and blocks configured for the `compute_service_attachment`\nTerraform resource.\n\nUnlike [google.compute_service_attachment.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `connection_preference` (`string`): The connection preference to use for this service attachment. Valid\nvalues include "ACCEPT_AUTOMATIC", "ACCEPT_MANUAL".\n  - `consumer_reject_lists` (`list`): An array of projects that are not allowed to connect to this service\nattachment. When `null`, the `consumer_reject_lists` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `domain_names` (`list`): If specified, the domain name will be used during the integration between\nthe PSC connected endpoints and the Cloud DNS. For example, this is a\nvalid domain name: "p.mycompany.com.". Current max number of domain names\nsupported is 1. When `null`, the `domain_names` field will be omitted from the resulting object.\n  - `enable_proxy_protocol` (`bool`): If true, enable the proxy protocol which is for supplying client TCP/IP\naddress data in TCP connections that traverse proxies on their way to\ndestination servers.\n  - `name` (`string`): Name of the resource. The name must be 1-63 characters long, and\ncomply with RFC1035. Specifically, the name must be 1-63 characters\nlong and match the regular expression '[a-z]([-a-z0-9]*[a-z0-9])?'\nwhich means the first character must be a lowercase letter, and all\nfollowing characters must be a dash, lowercase letter, or digit,\nexcept the last character, which cannot be a dash.\n  - `nat_subnets` (`list`): An array of subnets that is provided for NAT in this service attachment.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `reconcile_connections` (`bool`): This flag determines whether a consumer accept/reject list change can reconcile the statuses of existing ACCEPTED or REJECTED PSC endpoints.\n\nIf false, connection policy update will only affect existing PENDING PSC endpoints. Existing ACCEPTED/REJECTED endpoints will remain untouched regardless how the connection policy is modified .\nIf true, update will affect both PENDING and ACCEPTED/REJECTED PSC endpoints. For example, an ACCEPTED PSC endpoint will be moved to REJECTED if its project is added to the reject list. When `null`, the `reconcile_connections` field will be omitted from the resulting object.\n  - `region` (`string`): URL of the region where the resource resides. When `null`, the `region` field will be omitted from the resulting object.\n  - `target_service` (`string`): The URL of a forwarding rule that represents the service identified by\nthis service attachment.\n  - `consumer_accept_lists` (`list[obj]`): An array of projects that are allowed to connect to this service\nattachment. When `null`, the `consumer_accept_lists` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_service_attachment.consumer_accept_lists.new](#fn-consumer_accept_listsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_service_attachment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_service_attachment` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     connection_preference,
     enable_proxy_protocol,
diff --git a/4.x/_gen/resources/compute_snapshot.libsonnet b/4.x/_gen/resources/compute_snapshot.libsonnet
index 0a29fb57..ffa377dc 100644
--- a/4.x/_gen/resources/compute_snapshot.libsonnet
+++ b/4.x/_gen/resources/compute_snapshot.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='compute_snapshot', url='', help='`compute_snapshot` represents the `google_compute_snapshot` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.compute_snapshot.new` injects a new `google_compute_snapshot` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_snapshot.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_snapshot` using the reference:\n\n    $._ref.google_compute_snapshot.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_snapshot.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `chain_name` (`string`): Creates the new snapshot in the snapshot chain labeled with the\nspecified name. The chain name must be 1-63 characters long and\ncomply with RFC1035. This is an uncommon option only for advanced\nservice owners who needs to create separate snapshot chains, for\nexample, for chargeback tracking.  When you describe your snapshot\nresource, this field is visible only if it has a non-empty value. When `null`, the `chain_name` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this Snapshot. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `source_disk` (`string`): A reference to the disk used to create this snapshot.\n  - `storage_locations` (`list`): Cloud Storage bucket storage location of the snapshot (regional or multi-regional). When `null`, the `storage_locations` field will be omitted from the resulting object.\n  - `zone` (`string`): A reference to the zone where the disk is hosted. When `null`, the `zone` field will be omitted from the resulting object.\n  - `snapshot_encryption_key` (`list[obj]`): Encrypts the snapshot using a customer-supplied encryption key.\n\nAfter you encrypt a snapshot using a customer-supplied key, you must\nprovide the same key if you use the snapshot later. For example, you\nmust provide the encryption key when you create a disk from the\nencrypted snapshot in a future request.\n\nCustomer-supplied encryption keys do not protect access to metadata of\nthe snapshot.\n\nIf you do not provide an encryption key when creating the snapshot,\nthen the snapshot will be encrypted using an automatically generated\nkey and you do not need to provide a key to use the snapshot later. When `null`, the `snapshot_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_snapshot.snapshot_encryption_key.new](#fn-snapshot_encryption_keynew) constructor.\n  - `source_disk_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source snapshot. Required\nif the source snapshot is protected by a customer-supplied encryption\nkey. When `null`, the `source_disk_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_snapshot.source_disk_encryption_key.new](#fn-source_disk_encryption_keynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_snapshot.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_snapshot.new` injects a new `google_compute_snapshot` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_snapshot.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_snapshot` using the reference:\n\n    $._ref.google_compute_snapshot.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_snapshot.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `chain_name` (`string`): Creates the new snapshot in the snapshot chain labeled with the\nspecified name. The chain name must be 1-63 characters long and\ncomply with RFC1035. This is an uncommon option only for advanced\nservice owners who needs to create separate snapshot chains, for\nexample, for chargeback tracking.  When you describe your snapshot\nresource, this field is visible only if it has a non-empty value. When `null`, the `chain_name` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this Snapshot.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `source_disk` (`string`): A reference to the disk used to create this snapshot.\n  - `storage_locations` (`list`): Cloud Storage bucket storage location of the snapshot (regional or multi-regional). When `null`, the `storage_locations` field will be omitted from the resulting object.\n  - `zone` (`string`): A reference to the zone where the disk is hosted. When `null`, the `zone` field will be omitted from the resulting object.\n  - `snapshot_encryption_key` (`list[obj]`): Encrypts the snapshot using a customer-supplied encryption key.\n\nAfter you encrypt a snapshot using a customer-supplied key, you must\nprovide the same key if you use the snapshot later. For example, you\nmust provide the encryption key when you create a disk from the\nencrypted snapshot in a future request.\n\nCustomer-supplied encryption keys do not protect access to metadata of\nthe snapshot.\n\nIf you do not provide an encryption key when creating the snapshot,\nthen the snapshot will be encrypted using an automatically generated\nkey and you do not need to provide a key to use the snapshot later. When `null`, the `snapshot_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_snapshot.snapshot_encryption_key.new](#fn-snapshot_encryption_keynew) constructor.\n  - `source_disk_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source snapshot. Required\nif the source snapshot is protected by a customer-supplied encryption\nkey. When `null`, the `source_disk_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_snapshot.source_disk_encryption_key.new](#fn-source_disk_encryption_keynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_snapshot.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -35,7 +35,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_snapshot.newAttrs` constructs a new object with attributes and blocks configured for the `compute_snapshot`\nTerraform resource.\n\nUnlike [google.compute_snapshot.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `chain_name` (`string`): Creates the new snapshot in the snapshot chain labeled with the\nspecified name. The chain name must be 1-63 characters long and\ncomply with RFC1035. This is an uncommon option only for advanced\nservice owners who needs to create separate snapshot chains, for\nexample, for chargeback tracking.  When you describe your snapshot\nresource, this field is visible only if it has a non-empty value. When `null`, the `chain_name` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this Snapshot. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `source_disk` (`string`): A reference to the disk used to create this snapshot.\n  - `storage_locations` (`list`): Cloud Storage bucket storage location of the snapshot (regional or multi-regional). When `null`, the `storage_locations` field will be omitted from the resulting object.\n  - `zone` (`string`): A reference to the zone where the disk is hosted. When `null`, the `zone` field will be omitted from the resulting object.\n  - `snapshot_encryption_key` (`list[obj]`): Encrypts the snapshot using a customer-supplied encryption key.\n\nAfter you encrypt a snapshot using a customer-supplied key, you must\nprovide the same key if you use the snapshot later. For example, you\nmust provide the encryption key when you create a disk from the\nencrypted snapshot in a future request.\n\nCustomer-supplied encryption keys do not protect access to metadata of\nthe snapshot.\n\nIf you do not provide an encryption key when creating the snapshot,\nthen the snapshot will be encrypted using an automatically generated\nkey and you do not need to provide a key to use the snapshot later. When `null`, the `snapshot_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_snapshot.snapshot_encryption_key.new](#fn-snapshot_encryption_keynew) constructor.\n  - `source_disk_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source snapshot. Required\nif the source snapshot is protected by a customer-supplied encryption\nkey. When `null`, the `source_disk_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_snapshot.source_disk_encryption_key.new](#fn-source_disk_encryption_keynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_snapshot.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_snapshot` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_snapshot.newAttrs` constructs a new object with attributes and blocks configured for the `compute_snapshot`\nTerraform resource.\n\nUnlike [google.compute_snapshot.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `chain_name` (`string`): Creates the new snapshot in the snapshot chain labeled with the\nspecified name. The chain name must be 1-63 characters long and\ncomply with RFC1035. This is an uncommon option only for advanced\nservice owners who needs to create separate snapshot chains, for\nexample, for chargeback tracking.  When you describe your snapshot\nresource, this field is visible only if it has a non-empty value. When `null`, the `chain_name` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this Snapshot.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `source_disk` (`string`): A reference to the disk used to create this snapshot.\n  - `storage_locations` (`list`): Cloud Storage bucket storage location of the snapshot (regional or multi-regional). When `null`, the `storage_locations` field will be omitted from the resulting object.\n  - `zone` (`string`): A reference to the zone where the disk is hosted. When `null`, the `zone` field will be omitted from the resulting object.\n  - `snapshot_encryption_key` (`list[obj]`): Encrypts the snapshot using a customer-supplied encryption key.\n\nAfter you encrypt a snapshot using a customer-supplied key, you must\nprovide the same key if you use the snapshot later. For example, you\nmust provide the encryption key when you create a disk from the\nencrypted snapshot in a future request.\n\nCustomer-supplied encryption keys do not protect access to metadata of\nthe snapshot.\n\nIf you do not provide an encryption key when creating the snapshot,\nthen the snapshot will be encrypted using an automatically generated\nkey and you do not need to provide a key to use the snapshot later. When `null`, the `snapshot_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_snapshot.snapshot_encryption_key.new](#fn-snapshot_encryption_keynew) constructor.\n  - `source_disk_encryption_key` (`list[obj]`): The customer-supplied encryption key of the source snapshot. Required\nif the source snapshot is protected by a customer-supplied encryption\nkey. When `null`, the `source_disk_encryption_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_snapshot.source_disk_encryption_key.new](#fn-source_disk_encryption_keynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_snapshot.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_snapshot` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     source_disk,
diff --git a/4.x/_gen/resources/compute_subnetwork.libsonnet b/4.x/_gen/resources/compute_subnetwork.libsonnet
index 9abf15df..2d451113 100644
--- a/4.x/_gen/resources/compute_subnetwork.libsonnet
+++ b/4.x/_gen/resources/compute_subnetwork.libsonnet
@@ -18,7 +18,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       metadata_fields: metadata_fields,
     }),
   },
-  '#new':: d.fn(help="\n`google.compute_subnetwork.new` injects a new `google_compute_subnetwork` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_subnetwork.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_subnetwork` using the reference:\n\n    $._ref.google_compute_subnetwork.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_subnetwork.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. This field can be set only at resource\ncreation time. When `null`, the `description` field will be omitted from the resulting object.\n  - `ip_cidr_range` (`string`): The range of internal addresses that are owned by this subnetwork.\nProvide this property when you create the subnetwork. For example,\n10.0.0.0/8 or 192.168.0.0/16. Ranges must be unique and\nnon-overlapping within a network. Only IPv4 is supported.\n  - `ipv6_access_type` (`string`): The access type of IPv6 address this subnet holds. It\u0026#39;s immutable and can only be specified during creation\nor the first time the subnet is updated into IPV4_IPV6 dual stack. If the ipv6_type is EXTERNAL then this subnet\ncannot enable direct path. Possible values: [\u0026#34;EXTERNAL\u0026#34;, \u0026#34;INTERNAL\u0026#34;] When `null`, the `ipv6_access_type` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the resource, provided by the client when initially\ncreating the resource. The name must be 1-63 characters long, and\ncomply with RFC1035. Specifically, the name must be 1-63 characters\nlong and match the regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which\nmeans the first character must be a lowercase letter, and all\nfollowing characters must be a dash, lowercase letter, or digit,\nexcept the last character, which cannot be a dash.\n  - `network` (`string`): The network this subnet belongs to.\nOnly networks that are in the distributed mode can have subnetworks.\n  - `private_ip_google_access` (`bool`): When enabled, VMs in this subnetwork without external IP addresses can\naccess Google APIs and services by using Private Google Access. When `null`, the `private_ip_google_access` field will be omitted from the resulting object.\n  - `private_ipv6_google_access` (`string`): The private IPv6 google access type for the VMs in this subnet. When `null`, the `private_ipv6_google_access` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `purpose` (`string`): The purpose of the resource. This field can be either \u0026#39;PRIVATE_RFC_1918\u0026#39;, \u0026#39;REGIONAL_MANAGED_PROXY\u0026#39;, \u0026#39;GLOBAL_MANAGED_PROXY\u0026#39;, or \u0026#39;PRIVATE_SERVICE_CONNECT\u0026#39;.\nA subnet with purpose set to \u0026#39;REGIONAL_MANAGED_PROXY\u0026#39; is a user-created subnetwork that is reserved for regional Envoy-based load balancers.\nA subnetwork in a given region with purpose set to \u0026#39;GLOBAL_MANAGED_PROXY\u0026#39; is a proxy-only subnet and is shared between all the cross-regional Envoy-based load balancers.\nA subnetwork with purpose set to \u0026#39;PRIVATE_SERVICE_CONNECT\u0026#39; reserves the subnet for hosting a Private Service Connect published service.\nNote that \u0026#39;REGIONAL_MANAGED_PROXY\u0026#39; is the preferred setting for all regional Envoy load balancers.\nIf unspecified, the purpose defaults to \u0026#39;PRIVATE_RFC_1918\u0026#39;. When `null`, the `purpose` field will be omitted from the resulting object.\n  - `region` (`string`): The GCP region for this subnetwork. When `null`, the `region` field will be omitted from the resulting object.\n  - `role` (`string`): The role of subnetwork.\nCurrently, this field is only used when \u0026#39;purpose\u0026#39; is \u0026#39;REGIONAL_MANAGED_PROXY\u0026#39;.\nThe value can be set to \u0026#39;ACTIVE\u0026#39; or \u0026#39;BACKUP\u0026#39;.\nAn \u0026#39;ACTIVE\u0026#39; subnetwork is one that is currently being used for Envoy-based load balancers in a region.\nA \u0026#39;BACKUP\u0026#39; subnetwork is one that is ready to be promoted to \u0026#39;ACTIVE\u0026#39; or is currently draining. Possible values: [\u0026#34;ACTIVE\u0026#34;, \u0026#34;BACKUP\u0026#34;] When `null`, the `role` field will be omitted from the resulting object.\n  - `secondary_ip_range` (`list`): An array of configurations for secondary IP ranges for VM instances\ncontained in this subnetwork. The primary IP of such VM must belong\nto the primary ipCidrRange of the subnetwork. The alias IPs may belong\nto either primary or secondary ranges.\n\n**Note**: This field uses [attr-as-block mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html) to avoid\nbreaking users during the 0.12 upgrade. To explicitly send a list\nof zero objects you must use the following syntax:\n\u0026#39;example=[]\u0026#39;\nFor more details about this behavior, see [this section](https://www.terraform.io/docs/configuration/attr-as-blocks.html#defining-a-fixed-object-collection-value). When `null`, the `secondary_ip_range` field will be omitted from the resulting object.\n  - `stack_type` (`string`): The stack type for this subnet to identify whether the IPv6 feature is enabled or not.\nIf not specified IPV4_ONLY will be used. Possible values: [\u0026#34;IPV4_ONLY\u0026#34;, \u0026#34;IPV4_IPV6\u0026#34;] When `null`, the `stack_type` field will be omitted from the resulting object.\n  - `log_config` (`list[obj]`): This field denotes the VPC flow logging options for this subnetwork. If\nlogging is enabled, logs are exported to Cloud Logging. Flow logging\nisn\u0026#39;t supported if the subnet \u0026#39;purpose\u0026#39; field is set to subnetwork is\n\u0026#39;REGIONAL_MANAGED_PROXY\u0026#39; or \u0026#39;GLOBAL_MANAGED_PROXY\u0026#39;. When `null`, the `log_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_subnetwork.log_config.new](#fn-log_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_subnetwork.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_subnetwork.new` injects a new `google_compute_subnetwork` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_subnetwork.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_subnetwork` using the reference:\n\n    $._ref.google_compute_subnetwork.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_subnetwork.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. This field can be set only at resource\ncreation time. When `null`, the `description` field will be omitted from the resulting object.\n  - `ip_cidr_range` (`string`): The range of internal addresses that are owned by this subnetwork.\nProvide this property when you create the subnetwork. For example,\n10.0.0.0/8 or 192.168.0.0/16. Ranges must be unique and\nnon-overlapping within a network. Only IPv4 is supported.\n  - `ipv6_access_type` (`string`): The access type of IPv6 address this subnet holds. It\u0026#39;s immutable and can only be specified during creation\nor the first time the subnet is updated into IPV4_IPV6 dual stack. If the ipv6_type is EXTERNAL then this subnet\ncannot enable direct path. Possible values: [\u0026#34;EXTERNAL\u0026#34;, \u0026#34;INTERNAL\u0026#34;] When `null`, the `ipv6_access_type` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the resource, provided by the client when initially\ncreating the resource. The name must be 1-63 characters long, and\ncomply with RFC1035. Specifically, the name must be 1-63 characters\nlong and match the regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which\nmeans the first character must be a lowercase letter, and all\nfollowing characters must be a dash, lowercase letter, or digit,\nexcept the last character, which cannot be a dash.\n  - `network` (`string`): The network this subnet belongs to.\nOnly networks that are in the distributed mode can have subnetworks.\n  - `private_ip_google_access` (`bool`): When enabled, VMs in this subnetwork without external IP addresses can\naccess Google APIs and services by using Private Google Access. When `null`, the `private_ip_google_access` field will be omitted from the resulting object.\n  - `private_ipv6_google_access` (`string`): The private IPv6 google access type for the VMs in this subnet. When `null`, the `private_ipv6_google_access` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `purpose` (`string`): The purpose of the resource. This field can be either \u0026#39;PRIVATE_RFC_1918\u0026#39;, \u0026#39;REGIONAL_MANAGED_PROXY\u0026#39;, \u0026#39;GLOBAL_MANAGED_PROXY\u0026#39;, \u0026#39;PRIVATE_SERVICE_CONNECT\u0026#39; or \u0026#39;PRIVATE_NAT\u0026#39;([Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html)).\nA subnet with purpose set to \u0026#39;REGIONAL_MANAGED_PROXY\u0026#39; is a user-created subnetwork that is reserved for regional Envoy-based load balancers.\nA subnetwork in a given region with purpose set to \u0026#39;GLOBAL_MANAGED_PROXY\u0026#39; is a proxy-only subnet and is shared between all the cross-regional Envoy-based load balancers.\nA subnetwork with purpose set to \u0026#39;PRIVATE_SERVICE_CONNECT\u0026#39; reserves the subnet for hosting a Private Service Connect published service.\nA subnetwork with purpose set to \u0026#39;PRIVATE_NAT\u0026#39; is used as source range for Private NAT gateways.\nNote that \u0026#39;REGIONAL_MANAGED_PROXY\u0026#39; is the preferred setting for all regional Envoy load balancers.\nIf unspecified, the purpose defaults to \u0026#39;PRIVATE_RFC_1918\u0026#39;. When `null`, the `purpose` field will be omitted from the resulting object.\n  - `region` (`string`): The GCP region for this subnetwork. When `null`, the `region` field will be omitted from the resulting object.\n  - `role` (`string`): The role of subnetwork.\nCurrently, this field is only used when \u0026#39;purpose\u0026#39; is \u0026#39;REGIONAL_MANAGED_PROXY\u0026#39;.\nThe value can be set to \u0026#39;ACTIVE\u0026#39; or \u0026#39;BACKUP\u0026#39;.\nAn \u0026#39;ACTIVE\u0026#39; subnetwork is one that is currently being used for Envoy-based load balancers in a region.\nA \u0026#39;BACKUP\u0026#39; subnetwork is one that is ready to be promoted to \u0026#39;ACTIVE\u0026#39; or is currently draining. Possible values: [\u0026#34;ACTIVE\u0026#34;, \u0026#34;BACKUP\u0026#34;] When `null`, the `role` field will be omitted from the resulting object.\n  - `secondary_ip_range` (`list`): An array of configurations for secondary IP ranges for VM instances\ncontained in this subnetwork. The primary IP of such VM must belong\nto the primary ipCidrRange of the subnetwork. The alias IPs may belong\nto either primary or secondary ranges.\n\n**Note**: This field uses [attr-as-block mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html) to avoid\nbreaking users during the 0.12 upgrade. To explicitly send a list\nof zero objects you must use the following syntax:\n\u0026#39;example=[]\u0026#39;\nFor more details about this behavior, see [this section](https://www.terraform.io/docs/configuration/attr-as-blocks.html#defining-a-fixed-object-collection-value). When `null`, the `secondary_ip_range` field will be omitted from the resulting object.\n  - `stack_type` (`string`): The stack type for this subnet to identify whether the IPv6 feature is enabled or not.\nIf not specified IPV4_ONLY will be used. Possible values: [\u0026#34;IPV4_ONLY\u0026#34;, \u0026#34;IPV4_IPV6\u0026#34;] When `null`, the `stack_type` field will be omitted from the resulting object.\n  - `log_config` (`list[obj]`): This field denotes the VPC flow logging options for this subnetwork. If\nlogging is enabled, logs are exported to Cloud Logging. Flow logging\nisn\u0026#39;t supported if the subnet \u0026#39;purpose\u0026#39; field is set to subnetwork is\n\u0026#39;REGIONAL_MANAGED_PROXY\u0026#39; or \u0026#39;GLOBAL_MANAGED_PROXY\u0026#39;. When `null`, the `log_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_subnetwork.log_config.new](#fn-log_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_subnetwork.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     ip_cidr_range,
@@ -59,7 +59,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_subnetwork.newAttrs` constructs a new object with attributes and blocks configured for the `compute_subnetwork`\nTerraform resource.\n\nUnlike [google.compute_subnetwork.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. This field can be set only at resource\ncreation time. When `null`, the `description` field will be omitted from the resulting object.\n  - `ip_cidr_range` (`string`): The range of internal addresses that are owned by this subnetwork.\nProvide this property when you create the subnetwork. For example,\n10.0.0.0/8 or 192.168.0.0/16. Ranges must be unique and\nnon-overlapping within a network. Only IPv4 is supported.\n  - `ipv6_access_type` (`string`): The access type of IPv6 address this subnet holds. It's immutable and can only be specified during creation\nor the first time the subnet is updated into IPV4_IPV6 dual stack. If the ipv6_type is EXTERNAL then this subnet\ncannot enable direct path. Possible values: ["EXTERNAL", "INTERNAL"] When `null`, the `ipv6_access_type` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the resource, provided by the client when initially\ncreating the resource. The name must be 1-63 characters long, and\ncomply with RFC1035. Specifically, the name must be 1-63 characters\nlong and match the regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which\nmeans the first character must be a lowercase letter, and all\nfollowing characters must be a dash, lowercase letter, or digit,\nexcept the last character, which cannot be a dash.\n  - `network` (`string`): The network this subnet belongs to.\nOnly networks that are in the distributed mode can have subnetworks.\n  - `private_ip_google_access` (`bool`): When enabled, VMs in this subnetwork without external IP addresses can\naccess Google APIs and services by using Private Google Access. When `null`, the `private_ip_google_access` field will be omitted from the resulting object.\n  - `private_ipv6_google_access` (`string`): The private IPv6 google access type for the VMs in this subnet. When `null`, the `private_ipv6_google_access` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `purpose` (`string`): The purpose of the resource. This field can be either 'PRIVATE_RFC_1918', 'REGIONAL_MANAGED_PROXY', 'GLOBAL_MANAGED_PROXY', or 'PRIVATE_SERVICE_CONNECT'.\nA subnet with purpose set to 'REGIONAL_MANAGED_PROXY' is a user-created subnetwork that is reserved for regional Envoy-based load balancers.\nA subnetwork in a given region with purpose set to 'GLOBAL_MANAGED_PROXY' is a proxy-only subnet and is shared between all the cross-regional Envoy-based load balancers.\nA subnetwork with purpose set to 'PRIVATE_SERVICE_CONNECT' reserves the subnet for hosting a Private Service Connect published service.\nNote that 'REGIONAL_MANAGED_PROXY' is the preferred setting for all regional Envoy load balancers.\nIf unspecified, the purpose defaults to 'PRIVATE_RFC_1918'. When `null`, the `purpose` field will be omitted from the resulting object.\n  - `region` (`string`): The GCP region for this subnetwork. When `null`, the `region` field will be omitted from the resulting object.\n  - `role` (`string`): The role of subnetwork.\nCurrently, this field is only used when 'purpose' is 'REGIONAL_MANAGED_PROXY'.\nThe value can be set to 'ACTIVE' or 'BACKUP'.\nAn 'ACTIVE' subnetwork is one that is currently being used for Envoy-based load balancers in a region.\nA 'BACKUP' subnetwork is one that is ready to be promoted to 'ACTIVE' or is currently draining. Possible values: ["ACTIVE", "BACKUP"] When `null`, the `role` field will be omitted from the resulting object.\n  - `secondary_ip_range` (`list`): An array of configurations for secondary IP ranges for VM instances\ncontained in this subnetwork. The primary IP of such VM must belong\nto the primary ipCidrRange of the subnetwork. The alias IPs may belong\nto either primary or secondary ranges.\n\n**Note**: This field uses [attr-as-block mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html) to avoid\nbreaking users during the 0.12 upgrade. To explicitly send a list\nof zero objects you must use the following syntax:\n'example=[]'\nFor more details about this behavior, see [this section](https://www.terraform.io/docs/configuration/attr-as-blocks.html#defining-a-fixed-object-collection-value). When `null`, the `secondary_ip_range` field will be omitted from the resulting object.\n  - `stack_type` (`string`): The stack type for this subnet to identify whether the IPv6 feature is enabled or not.\nIf not specified IPV4_ONLY will be used. Possible values: ["IPV4_ONLY", "IPV4_IPV6"] When `null`, the `stack_type` field will be omitted from the resulting object.\n  - `log_config` (`list[obj]`): This field denotes the VPC flow logging options for this subnetwork. If\nlogging is enabled, logs are exported to Cloud Logging. Flow logging\nisn't supported if the subnet 'purpose' field is set to subnetwork is\n'REGIONAL_MANAGED_PROXY' or 'GLOBAL_MANAGED_PROXY'. When `null`, the `log_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_subnetwork.log_config.new](#fn-log_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_subnetwork.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_subnetwork` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_subnetwork.newAttrs` constructs a new object with attributes and blocks configured for the `compute_subnetwork`\nTerraform resource.\n\nUnlike [google.compute_subnetwork.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of this resource. Provide this property when\nyou create the resource. This field can be set only at resource\ncreation time. When `null`, the `description` field will be omitted from the resulting object.\n  - `ip_cidr_range` (`string`): The range of internal addresses that are owned by this subnetwork.\nProvide this property when you create the subnetwork. For example,\n10.0.0.0/8 or 192.168.0.0/16. Ranges must be unique and\nnon-overlapping within a network. Only IPv4 is supported.\n  - `ipv6_access_type` (`string`): The access type of IPv6 address this subnet holds. It's immutable and can only be specified during creation\nor the first time the subnet is updated into IPV4_IPV6 dual stack. If the ipv6_type is EXTERNAL then this subnet\ncannot enable direct path. Possible values: ["EXTERNAL", "INTERNAL"] When `null`, the `ipv6_access_type` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the resource, provided by the client when initially\ncreating the resource. The name must be 1-63 characters long, and\ncomply with RFC1035. Specifically, the name must be 1-63 characters\nlong and match the regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which\nmeans the first character must be a lowercase letter, and all\nfollowing characters must be a dash, lowercase letter, or digit,\nexcept the last character, which cannot be a dash.\n  - `network` (`string`): The network this subnet belongs to.\nOnly networks that are in the distributed mode can have subnetworks.\n  - `private_ip_google_access` (`bool`): When enabled, VMs in this subnetwork without external IP addresses can\naccess Google APIs and services by using Private Google Access. When `null`, the `private_ip_google_access` field will be omitted from the resulting object.\n  - `private_ipv6_google_access` (`string`): The private IPv6 google access type for the VMs in this subnet. When `null`, the `private_ipv6_google_access` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `purpose` (`string`): The purpose of the resource. This field can be either 'PRIVATE_RFC_1918', 'REGIONAL_MANAGED_PROXY', 'GLOBAL_MANAGED_PROXY', 'PRIVATE_SERVICE_CONNECT' or 'PRIVATE_NAT'([Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html)).\nA subnet with purpose set to 'REGIONAL_MANAGED_PROXY' is a user-created subnetwork that is reserved for regional Envoy-based load balancers.\nA subnetwork in a given region with purpose set to 'GLOBAL_MANAGED_PROXY' is a proxy-only subnet and is shared between all the cross-regional Envoy-based load balancers.\nA subnetwork with purpose set to 'PRIVATE_SERVICE_CONNECT' reserves the subnet for hosting a Private Service Connect published service.\nA subnetwork with purpose set to 'PRIVATE_NAT' is used as source range for Private NAT gateways.\nNote that 'REGIONAL_MANAGED_PROXY' is the preferred setting for all regional Envoy load balancers.\nIf unspecified, the purpose defaults to 'PRIVATE_RFC_1918'. When `null`, the `purpose` field will be omitted from the resulting object.\n  - `region` (`string`): The GCP region for this subnetwork. When `null`, the `region` field will be omitted from the resulting object.\n  - `role` (`string`): The role of subnetwork.\nCurrently, this field is only used when 'purpose' is 'REGIONAL_MANAGED_PROXY'.\nThe value can be set to 'ACTIVE' or 'BACKUP'.\nAn 'ACTIVE' subnetwork is one that is currently being used for Envoy-based load balancers in a region.\nA 'BACKUP' subnetwork is one that is ready to be promoted to 'ACTIVE' or is currently draining. Possible values: ["ACTIVE", "BACKUP"] When `null`, the `role` field will be omitted from the resulting object.\n  - `secondary_ip_range` (`list`): An array of configurations for secondary IP ranges for VM instances\ncontained in this subnetwork. The primary IP of such VM must belong\nto the primary ipCidrRange of the subnetwork. The alias IPs may belong\nto either primary or secondary ranges.\n\n**Note**: This field uses [attr-as-block mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html) to avoid\nbreaking users during the 0.12 upgrade. To explicitly send a list\nof zero objects you must use the following syntax:\n'example=[]'\nFor more details about this behavior, see [this section](https://www.terraform.io/docs/configuration/attr-as-blocks.html#defining-a-fixed-object-collection-value). When `null`, the `secondary_ip_range` field will be omitted from the resulting object.\n  - `stack_type` (`string`): The stack type for this subnet to identify whether the IPv6 feature is enabled or not.\nIf not specified IPV4_ONLY will be used. Possible values: ["IPV4_ONLY", "IPV4_IPV6"] When `null`, the `stack_type` field will be omitted from the resulting object.\n  - `log_config` (`list[obj]`): This field denotes the VPC flow logging options for this subnetwork. If\nlogging is enabled, logs are exported to Cloud Logging. Flow logging\nisn't supported if the subnet 'purpose' field is set to subnetwork is\n'REGIONAL_MANAGED_PROXY' or 'GLOBAL_MANAGED_PROXY'. When `null`, the `log_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_subnetwork.log_config.new](#fn-log_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_subnetwork.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_subnetwork` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     ip_cidr_range,
     name,
diff --git a/4.x/_gen/resources/compute_target_https_proxy.libsonnet b/4.x/_gen/resources/compute_target_https_proxy.libsonnet
index f296f12f..e00c966b 100644
--- a/4.x/_gen/resources/compute_target_https_proxy.libsonnet
+++ b/4.x/_gen/resources/compute_target_https_proxy.libsonnet
@@ -2,11 +2,12 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='compute_target_https_proxy', url='', help='`compute_target_https_proxy` represents the `google_compute_target_https_proxy` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.compute_target_https_proxy.new` injects a new `google_compute_target_https_proxy` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_target_https_proxy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_target_https_proxy` using the reference:\n\n    $._ref.google_compute_target_https_proxy.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_target_https_proxy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `certificate_map` (`string`): A reference to the CertificateMap resource uri that identifies a certificate map\nassociated with the given target proxy. This field can only be set for global target proxies.\nAccepted format is \u0026#39;//certificatemanager.googleapis.com/projects/{project}/locations/{location}/certificateMaps/{resourceName}\u0026#39;. When `null`, the `certificate_map` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `http_keep_alive_timeout_sec` (`number`): Specifies how long to keep a connection open, after completing a response,\nwhile there is no matching traffic (in seconds). If an HTTP keepalive is\nnot specified, a default value (610 seconds) will be used. For Global\nexternal HTTP(S) load balancer, the minimum allowed value is 5 seconds and\nthe maximum allowed value is 1200 seconds. For Global external HTTP(S)\nload balancer (classic), this option is not available publicly. When `null`, the `http_keep_alive_timeout_sec` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `proxy_bind` (`bool`): This field only applies when the forwarding rule that references\nthis target proxy has a loadBalancingScheme set to INTERNAL_SELF_MANAGED. When `null`, the `proxy_bind` field will be omitted from the resulting object.\n  - `quic_override` (`string`): Specifies the QUIC override policy for this resource. This determines\nwhether the load balancer will attempt to negotiate QUIC with clients\nor not. Can specify one of NONE, ENABLE, or DISABLE. If NONE is\nspecified, Google manages whether QUIC is used. Default value: \u0026#34;NONE\u0026#34; Possible values: [\u0026#34;NONE\u0026#34;, \u0026#34;ENABLE\u0026#34;, \u0026#34;DISABLE\u0026#34;] When `null`, the `quic_override` field will be omitted from the resulting object.\n  - `server_tls_policy` (`string`): A URL referring to a networksecurity.ServerTlsPolicy\nresource that describes how the proxy should authenticate inbound\ntraffic. serverTlsPolicy only applies to a global TargetHttpsProxy\nattached to globalForwardingRules with the loadBalancingScheme\nset to INTERNAL_SELF_MANAGED or EXTERNAL or EXTERNAL_MANAGED.\nFor details which ServerTlsPolicy resources are accepted with\nINTERNAL_SELF_MANAGED and which with EXTERNAL, EXTERNAL_MANAGED\nloadBalancingScheme consult ServerTlsPolicy documentation.\nIf left blank, communications are not encrypted. When `null`, the `server_tls_policy` field will be omitted from the resulting object.\n  - `ssl_certificates` (`list`): A list of SslCertificate resource URLs or Certificate Manager certificate URLs that are used to authenticate\nconnections between users and the load balancer. At least one resource must be specified. When `null`, the `ssl_certificates` field will be omitted from the resulting object.\n  - `ssl_policy` (`string`): A reference to the SslPolicy resource that will be associated with\nthe TargetHttpsProxy resource. If not set, the TargetHttpsProxy\nresource will not have any SSL policy configured. When `null`, the `ssl_policy` field will be omitted from the resulting object.\n  - `url_map` (`string`): A reference to the UrlMap resource that defines the mapping from URL\nto the BackendService.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_target_https_proxy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.compute_target_https_proxy.new` injects a new `google_compute_target_https_proxy` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.compute_target_https_proxy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.compute_target_https_proxy` using the reference:\n\n    $._ref.google_compute_target_https_proxy.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_compute_target_https_proxy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `certificate_manager_certificates` (`list`): URLs to certificate manager certificate resources that are used to authenticate connections between users and the load balancer.\nCurrently, you may specify up to 15 certificates. Certificate manager certificates do not apply when the load balancing scheme is set to INTERNAL_SELF_MANAGED.\nsslCertificates and certificateManagerCertificates fields can not be defined together.\nAccepted format is \u0026#39;//certificatemanager.googleapis.com/projects/{project}/locations/{location}/certificates/{resourceName}\u0026#39; or just the self_link \u0026#39;projects/{project}/locations/{location}/certificates/{resourceName}\u0026#39; When `null`, the `certificate_manager_certificates` field will be omitted from the resulting object.\n  - `certificate_map` (`string`): A reference to the CertificateMap resource uri that identifies a certificate map\nassociated with the given target proxy. This field can only be set for global target proxies.\nAccepted format is \u0026#39;//certificatemanager.googleapis.com/projects/{project}/locations/{location}/certificateMaps/{resourceName}\u0026#39;. When `null`, the `certificate_map` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `http_keep_alive_timeout_sec` (`number`): Specifies how long to keep a connection open, after completing a response,\nwhile there is no matching traffic (in seconds). If an HTTP keepalive is\nnot specified, a default value (610 seconds) will be used. For Global\nexternal HTTP(S) load balancer, the minimum allowed value is 5 seconds and\nthe maximum allowed value is 1200 seconds. For Global external HTTP(S)\nload balancer (classic), this option is not available publicly. When `null`, the `http_keep_alive_timeout_sec` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `proxy_bind` (`bool`): This field only applies when the forwarding rule that references\nthis target proxy has a loadBalancingScheme set to INTERNAL_SELF_MANAGED. When `null`, the `proxy_bind` field will be omitted from the resulting object.\n  - `quic_override` (`string`): Specifies the QUIC override policy for this resource. This determines\nwhether the load balancer will attempt to negotiate QUIC with clients\nor not. Can specify one of NONE, ENABLE, or DISABLE. If NONE is\nspecified, Google manages whether QUIC is used. Default value: \u0026#34;NONE\u0026#34; Possible values: [\u0026#34;NONE\u0026#34;, \u0026#34;ENABLE\u0026#34;, \u0026#34;DISABLE\u0026#34;] When `null`, the `quic_override` field will be omitted from the resulting object.\n  - `server_tls_policy` (`string`): A URL referring to a networksecurity.ServerTlsPolicy\nresource that describes how the proxy should authenticate inbound\ntraffic. serverTlsPolicy only applies to a global TargetHttpsProxy\nattached to globalForwardingRules with the loadBalancingScheme\nset to INTERNAL_SELF_MANAGED or EXTERNAL or EXTERNAL_MANAGED.\nFor details which ServerTlsPolicy resources are accepted with\nINTERNAL_SELF_MANAGED and which with EXTERNAL, EXTERNAL_MANAGED\nloadBalancingScheme consult ServerTlsPolicy documentation.\nIf left blank, communications are not encrypted. When `null`, the `server_tls_policy` field will be omitted from the resulting object.\n  - `ssl_certificates` (`list`): URLs to SslCertificate resources that are used to authenticate connections between users and the load balancer.\nCurrently, you may specify up to 15 SSL certificates. sslCertificates do not apply when the load balancing scheme is set to INTERNAL_SELF_MANAGED.\nsslCertificates and certificateManagerCertificates can not be defined together. When `null`, the `ssl_certificates` field will be omitted from the resulting object.\n  - `ssl_policy` (`string`): A reference to the SslPolicy resource that will be associated with\nthe TargetHttpsProxy resource. If not set, the TargetHttpsProxy\nresource will not have any SSL policy configured. When `null`, the `ssl_policy` field will be omitted from the resulting object.\n  - `url_map` (`string`): A reference to the UrlMap resource that defines the mapping from URL\nto the BackendService.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_target_https_proxy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
     url_map,
+    certificate_manager_certificates=null,
     certificate_map=null,
     description=null,
     http_keep_alive_timeout_sec=null,
@@ -22,6 +23,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     type='google_compute_target_https_proxy',
     label=resourceLabel,
     attrs=self.newAttrs(
+      certificate_manager_certificates=certificate_manager_certificates,
       certificate_map=certificate_map,
       description=description,
       http_keep_alive_timeout_sec=http_keep_alive_timeout_sec,
@@ -37,10 +39,11 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.compute_target_https_proxy.newAttrs` constructs a new object with attributes and blocks configured for the `compute_target_https_proxy`\nTerraform resource.\n\nUnlike [google.compute_target_https_proxy.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `certificate_map` (`string`): A reference to the CertificateMap resource uri that identifies a certificate map\nassociated with the given target proxy. This field can only be set for global target proxies.\nAccepted format is '//certificatemanager.googleapis.com/projects/{project}/locations/{location}/certificateMaps/{resourceName}'. When `null`, the `certificate_map` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `http_keep_alive_timeout_sec` (`number`): Specifies how long to keep a connection open, after completing a response,\nwhile there is no matching traffic (in seconds). If an HTTP keepalive is\nnot specified, a default value (610 seconds) will be used. For Global\nexternal HTTP(S) load balancer, the minimum allowed value is 5 seconds and\nthe maximum allowed value is 1200 seconds. For Global external HTTP(S)\nload balancer (classic), this option is not available publicly. When `null`, the `http_keep_alive_timeout_sec` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `proxy_bind` (`bool`): This field only applies when the forwarding rule that references\nthis target proxy has a loadBalancingScheme set to INTERNAL_SELF_MANAGED. When `null`, the `proxy_bind` field will be omitted from the resulting object.\n  - `quic_override` (`string`): Specifies the QUIC override policy for this resource. This determines\nwhether the load balancer will attempt to negotiate QUIC with clients\nor not. Can specify one of NONE, ENABLE, or DISABLE. If NONE is\nspecified, Google manages whether QUIC is used. Default value: "NONE" Possible values: ["NONE", "ENABLE", "DISABLE"] When `null`, the `quic_override` field will be omitted from the resulting object.\n  - `server_tls_policy` (`string`): A URL referring to a networksecurity.ServerTlsPolicy\nresource that describes how the proxy should authenticate inbound\ntraffic. serverTlsPolicy only applies to a global TargetHttpsProxy\nattached to globalForwardingRules with the loadBalancingScheme\nset to INTERNAL_SELF_MANAGED or EXTERNAL or EXTERNAL_MANAGED.\nFor details which ServerTlsPolicy resources are accepted with\nINTERNAL_SELF_MANAGED and which with EXTERNAL, EXTERNAL_MANAGED\nloadBalancingScheme consult ServerTlsPolicy documentation.\nIf left blank, communications are not encrypted. When `null`, the `server_tls_policy` field will be omitted from the resulting object.\n  - `ssl_certificates` (`list`): A list of SslCertificate resource URLs or Certificate Manager certificate URLs that are used to authenticate\nconnections between users and the load balancer. At least one resource must be specified. When `null`, the `ssl_certificates` field will be omitted from the resulting object.\n  - `ssl_policy` (`string`): A reference to the SslPolicy resource that will be associated with\nthe TargetHttpsProxy resource. If not set, the TargetHttpsProxy\nresource will not have any SSL policy configured. When `null`, the `ssl_policy` field will be omitted from the resulting object.\n  - `url_map` (`string`): A reference to the UrlMap resource that defines the mapping from URL\nto the BackendService.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_target_https_proxy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_target_https_proxy` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.compute_target_https_proxy.newAttrs` constructs a new object with attributes and blocks configured for the `compute_target_https_proxy`\nTerraform resource.\n\nUnlike [google.compute_target_https_proxy.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `certificate_manager_certificates` (`list`): URLs to certificate manager certificate resources that are used to authenticate connections between users and the load balancer.\nCurrently, you may specify up to 15 certificates. Certificate manager certificates do not apply when the load balancing scheme is set to INTERNAL_SELF_MANAGED.\nsslCertificates and certificateManagerCertificates fields can not be defined together.\nAccepted format is '//certificatemanager.googleapis.com/projects/{project}/locations/{location}/certificates/{resourceName}' or just the self_link 'projects/{project}/locations/{location}/certificates/{resourceName}' When `null`, the `certificate_manager_certificates` field will be omitted from the resulting object.\n  - `certificate_map` (`string`): A reference to the CertificateMap resource uri that identifies a certificate map\nassociated with the given target proxy. This field can only be set for global target proxies.\nAccepted format is '//certificatemanager.googleapis.com/projects/{project}/locations/{location}/certificateMaps/{resourceName}'. When `null`, the `certificate_map` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `http_keep_alive_timeout_sec` (`number`): Specifies how long to keep a connection open, after completing a response,\nwhile there is no matching traffic (in seconds). If an HTTP keepalive is\nnot specified, a default value (610 seconds) will be used. For Global\nexternal HTTP(S) load balancer, the minimum allowed value is 5 seconds and\nthe maximum allowed value is 1200 seconds. For Global external HTTP(S)\nload balancer (classic), this option is not available publicly. When `null`, the `http_keep_alive_timeout_sec` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource. Provided by the client when the resource is\ncreated. The name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `proxy_bind` (`bool`): This field only applies when the forwarding rule that references\nthis target proxy has a loadBalancingScheme set to INTERNAL_SELF_MANAGED. When `null`, the `proxy_bind` field will be omitted from the resulting object.\n  - `quic_override` (`string`): Specifies the QUIC override policy for this resource. This determines\nwhether the load balancer will attempt to negotiate QUIC with clients\nor not. Can specify one of NONE, ENABLE, or DISABLE. If NONE is\nspecified, Google manages whether QUIC is used. Default value: "NONE" Possible values: ["NONE", "ENABLE", "DISABLE"] When `null`, the `quic_override` field will be omitted from the resulting object.\n  - `server_tls_policy` (`string`): A URL referring to a networksecurity.ServerTlsPolicy\nresource that describes how the proxy should authenticate inbound\ntraffic. serverTlsPolicy only applies to a global TargetHttpsProxy\nattached to globalForwardingRules with the loadBalancingScheme\nset to INTERNAL_SELF_MANAGED or EXTERNAL or EXTERNAL_MANAGED.\nFor details which ServerTlsPolicy resources are accepted with\nINTERNAL_SELF_MANAGED and which with EXTERNAL, EXTERNAL_MANAGED\nloadBalancingScheme consult ServerTlsPolicy documentation.\nIf left blank, communications are not encrypted. When `null`, the `server_tls_policy` field will be omitted from the resulting object.\n  - `ssl_certificates` (`list`): URLs to SslCertificate resources that are used to authenticate connections between users and the load balancer.\nCurrently, you may specify up to 15 SSL certificates. sslCertificates do not apply when the load balancing scheme is set to INTERNAL_SELF_MANAGED.\nsslCertificates and certificateManagerCertificates can not be defined together. When `null`, the `ssl_certificates` field will be omitted from the resulting object.\n  - `ssl_policy` (`string`): A reference to the SslPolicy resource that will be associated with\nthe TargetHttpsProxy resource. If not set, the TargetHttpsProxy\nresource will not have any SSL policy configured. When `null`, the `ssl_policy` field will be omitted from the resulting object.\n  - `url_map` (`string`): A reference to the UrlMap resource that defines the mapping from URL\nto the BackendService.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_target_https_proxy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_target_https_proxy` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     url_map,
+    certificate_manager_certificates=null,
     certificate_map=null,
     description=null,
     http_keep_alive_timeout_sec=null,
@@ -52,6 +55,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ssl_policy=null,
     timeouts=null
   ):: std.prune(a={
+    certificate_manager_certificates: certificate_manager_certificates,
     certificate_map: certificate_map,
     description: description,
     http_keep_alive_timeout_sec: http_keep_alive_timeout_sec,
@@ -77,6 +81,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       update: update,
     }),
   },
+  '#withCertificateManagerCertificates':: d.fn(help='`google.list.withCertificateManagerCertificates` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the certificate_manager_certificates field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `certificate_manager_certificates` field.\n', args=[]),
+  withCertificateManagerCertificates(resourceLabel, value): {
+    resource+: {
+      google_compute_target_https_proxy+: {
+        [resourceLabel]+: {
+          certificate_manager_certificates: value,
+        },
+      },
+    },
+  },
   '#withCertificateMap':: d.fn(help='`google.string.withCertificateMap` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the certificate_map field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `certificate_map` field.\n', args=[]),
   withCertificateMap(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/container_attached_cluster.libsonnet b/4.x/_gen/resources/container_attached_cluster.libsonnet
index 8bb53877..16d5511f 100644
--- a/4.x/_gen/resources/container_attached_cluster.libsonnet
+++ b/4.x/_gen/resources/container_attached_cluster.libsonnet
@@ -3,10 +3,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='container_attached_cluster', url='', help='`container_attached_cluster` represents the `google_container_attached_cluster` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
   authorization:: {
-    '#new':: d.fn(help='\n`google.container_attached_cluster.authorization.new` constructs a new object with attributes and blocks configured for the `authorization`\nTerraform sub block.\n\n\n\n**Args**:\n  - `admin_users` (`list`): Users that can perform operations as a cluster admin. A managed\nClusterRoleBinding will be created to grant the 'cluster-admin' ClusterRole\nto the users. Up to ten admin users can be provided.\n\nFor more info on RBAC, see\nhttps://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles When `null`, the `admin_users` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `authorization` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.container_attached_cluster.authorization.new` constructs a new object with attributes and blocks configured for the `authorization`\nTerraform sub block.\n\n\n\n**Args**:\n  - `admin_groups` (`list`): Groups that can perform operations as a cluster admin. A managed\nClusterRoleBinding will be created to grant the 'cluster-admin' ClusterRole\nto the groups. Up to ten admin groups can be provided.\n\nFor more info on RBAC, see\nhttps://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles When `null`, the `admin_groups` field will be omitted from the resulting object.\n  - `admin_users` (`list`): Users that can perform operations as a cluster admin. A managed\nClusterRoleBinding will be created to grant the 'cluster-admin' ClusterRole\nto the users. Up to ten admin users can be provided.\n\nFor more info on RBAC, see\nhttps://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles When `null`, the `admin_users` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `authorization` sub block.\n', args=[]),
     new(
+      admin_groups=null,
       admin_users=null
     ):: std.prune(a={
+      admin_groups: admin_groups,
       admin_users: admin_users,
     }),
   },
@@ -58,7 +60,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       managed_prometheus_config: managed_prometheus_config,
     }),
   },
-  '#new':: d.fn(help="\n`google.container_attached_cluster.new` injects a new `google_container_attached_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.container_attached_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.container_attached_cluster` using the reference:\n\n    $._ref.google_container_attached_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_container_attached_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same\nrestrictions as Kubernetes annotations. The total size of all keys and\nvalues combined is limited to 256k. Key can have 2 segments: prefix (optional)\nand name (required), separated by a slash (/). Prefix must be a DNS subdomain.\nName must be 63 characters or less, begin and end with alphanumerics,\nwith dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `deletion_policy` (`string`): Policy to determine what flags to send on delete. When `null`, the `deletion_policy` field will be omitted from the resulting object.\n  - `description` (`string`): A human readable description of this attached cluster. Cannot be longer\nthan 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.\n  - `distribution` (`string`): The Kubernetes distribution of the underlying attached cluster. Supported values:\n\u0026#34;eks\u0026#34;, \u0026#34;aks\u0026#34;.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `platform_version` (`string`): The platform version for the cluster (e.g. \u0026#39;1.23.0-gke.1\u0026#39;).\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `authorization` (`list[obj]`): Configuration related to the cluster RBAC settings. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.authorization.new](#fn-authorizationnew) constructor.\n  - `binary_authorization` (`list[obj]`): Binary Authorization configuration. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `fleet` (`list[obj]`): Fleet configuration. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.fleet.new](#fn-fleetnew) constructor.\n  - `logging_config` (`list[obj]`): Logging configuration. When `null`, the `logging_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.logging_config.new](#fn-logging_confignew) constructor.\n  - `monitoring_config` (`list[obj]`): Monitoring configuration. When `null`, the `monitoring_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.monitoring_config.new](#fn-monitoring_confignew) constructor.\n  - `oidc_config` (`list[obj]`): OIDC discovery information of the target cluster.\n\nKubernetes Service Account (KSA) tokens are JWT tokens signed by the cluster\nAPI server. This fields indicates how GCP services\nvalidate KSA tokens in order to allow system workloads (such as GKE Connect\nand telemetry agents) to authenticate back to GCP.\n\nBoth clusters with public and private issuer URLs are supported.\nClusters with public issuers only need to specify the \u0026#39;issuer_url\u0026#39; field\nwhile clusters with private issuers need to provide both\n\u0026#39;issuer_url\u0026#39; and \u0026#39;jwks\u0026#39;. When `null`, the `oidc_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.oidc_config.new](#fn-oidc_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.container_attached_cluster.new` injects a new `google_container_attached_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.container_attached_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.container_attached_cluster` using the reference:\n\n    $._ref.google_container_attached_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_container_attached_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same\nrestrictions as Kubernetes annotations. The total size of all keys and\nvalues combined is limited to 256k. Key can have 2 segments: prefix (optional)\nand name (required), separated by a slash (/). Prefix must be a DNS subdomain.\nName must be 63 characters or less, begin and end with alphanumerics,\nwith dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field \u0026#39;effective_annotations\u0026#39; for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `deletion_policy` (`string`): Policy to determine what flags to send on delete. When `null`, the `deletion_policy` field will be omitted from the resulting object.\n  - `description` (`string`): A human readable description of this attached cluster. Cannot be longer\nthan 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.\n  - `distribution` (`string`): The Kubernetes distribution of the underlying attached cluster. Supported values:\n\u0026#34;eks\u0026#34;, \u0026#34;aks\u0026#34;.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `platform_version` (`string`): The platform version for the cluster (e.g. \u0026#39;1.23.0-gke.1\u0026#39;).\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `authorization` (`list[obj]`): Configuration related to the cluster RBAC settings. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.authorization.new](#fn-authorizationnew) constructor.\n  - `binary_authorization` (`list[obj]`): Binary Authorization configuration. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `fleet` (`list[obj]`): Fleet configuration. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.fleet.new](#fn-fleetnew) constructor.\n  - `logging_config` (`list[obj]`): Logging configuration. When `null`, the `logging_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.logging_config.new](#fn-logging_confignew) constructor.\n  - `monitoring_config` (`list[obj]`): Monitoring configuration. When `null`, the `monitoring_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.monitoring_config.new](#fn-monitoring_confignew) constructor.\n  - `oidc_config` (`list[obj]`): OIDC discovery information of the target cluster.\n\nKubernetes Service Account (KSA) tokens are JWT tokens signed by the cluster\nAPI server. This fields indicates how GCP services\nvalidate KSA tokens in order to allow system workloads (such as GKE Connect\nand telemetry agents) to authenticate back to GCP.\n\nBoth clusters with public and private issuer URLs are supported.\nClusters with public issuers only need to specify the \u0026#39;issuer_url\u0026#39; field\nwhile clusters with private issuers need to provide both\n\u0026#39;issuer_url\u0026#39; and \u0026#39;jwks\u0026#39;. When `null`, the `oidc_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.oidc_config.new](#fn-oidc_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     distribution,
@@ -99,7 +101,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.container_attached_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `container_attached_cluster`\nTerraform resource.\n\nUnlike [google.container_attached_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same\nrestrictions as Kubernetes annotations. The total size of all keys and\nvalues combined is limited to 256k. Key can have 2 segments: prefix (optional)\nand name (required), separated by a slash (/). Prefix must be a DNS subdomain.\nName must be 63 characters or less, begin and end with alphanumerics,\nwith dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `deletion_policy` (`string`): Policy to determine what flags to send on delete. When `null`, the `deletion_policy` field will be omitted from the resulting object.\n  - `description` (`string`): A human readable description of this attached cluster. Cannot be longer\nthan 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.\n  - `distribution` (`string`): The Kubernetes distribution of the underlying attached cluster. Supported values:\n"eks", "aks".\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `platform_version` (`string`): The platform version for the cluster (e.g. '1.23.0-gke.1').\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `authorization` (`list[obj]`): Configuration related to the cluster RBAC settings. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.authorization.new](#fn-authorizationnew) constructor.\n  - `binary_authorization` (`list[obj]`): Binary Authorization configuration. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `fleet` (`list[obj]`): Fleet configuration. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.fleet.new](#fn-fleetnew) constructor.\n  - `logging_config` (`list[obj]`): Logging configuration. When `null`, the `logging_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.logging_config.new](#fn-logging_confignew) constructor.\n  - `monitoring_config` (`list[obj]`): Monitoring configuration. When `null`, the `monitoring_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.monitoring_config.new](#fn-monitoring_confignew) constructor.\n  - `oidc_config` (`list[obj]`): OIDC discovery information of the target cluster.\n\nKubernetes Service Account (KSA) tokens are JWT tokens signed by the cluster\nAPI server. This fields indicates how GCP services\nvalidate KSA tokens in order to allow system workloads (such as GKE Connect\nand telemetry agents) to authenticate back to GCP.\n\nBoth clusters with public and private issuer URLs are supported.\nClusters with public issuers only need to specify the 'issuer_url' field\nwhile clusters with private issuers need to provide both\n'issuer_url' and 'jwks'. When `null`, the `oidc_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.oidc_config.new](#fn-oidc_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `container_attached_cluster` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.container_attached_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `container_attached_cluster`\nTerraform resource.\n\nUnlike [google.container_attached_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same\nrestrictions as Kubernetes annotations. The total size of all keys and\nvalues combined is limited to 256k. Key can have 2 segments: prefix (optional)\nand name (required), separated by a slash (/). Prefix must be a DNS subdomain.\nName must be 63 characters or less, begin and end with alphanumerics,\nwith dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `deletion_policy` (`string`): Policy to determine what flags to send on delete. When `null`, the `deletion_policy` field will be omitted from the resulting object.\n  - `description` (`string`): A human readable description of this attached cluster. Cannot be longer\nthan 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.\n  - `distribution` (`string`): The Kubernetes distribution of the underlying attached cluster. Supported values:\n"eks", "aks".\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `platform_version` (`string`): The platform version for the cluster (e.g. '1.23.0-gke.1').\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `authorization` (`list[obj]`): Configuration related to the cluster RBAC settings. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.authorization.new](#fn-authorizationnew) constructor.\n  - `binary_authorization` (`list[obj]`): Binary Authorization configuration. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `fleet` (`list[obj]`): Fleet configuration. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.fleet.new](#fn-fleetnew) constructor.\n  - `logging_config` (`list[obj]`): Logging configuration. When `null`, the `logging_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.logging_config.new](#fn-logging_confignew) constructor.\n  - `monitoring_config` (`list[obj]`): Monitoring configuration. When `null`, the `monitoring_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.monitoring_config.new](#fn-monitoring_confignew) constructor.\n  - `oidc_config` (`list[obj]`): OIDC discovery information of the target cluster.\n\nKubernetes Service Account (KSA) tokens are JWT tokens signed by the cluster\nAPI server. This fields indicates how GCP services\nvalidate KSA tokens in order to allow system workloads (such as GKE Connect\nand telemetry agents) to authenticate back to GCP.\n\nBoth clusters with public and private issuer URLs are supported.\nClusters with public issuers only need to specify the 'issuer_url' field\nwhile clusters with private issuers need to provide both\n'issuer_url' and 'jwks'. When `null`, the `oidc_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.oidc_config.new](#fn-oidc_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_attached_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `container_attached_cluster` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     distribution,
     location,
diff --git a/4.x/_gen/resources/container_aws_cluster.libsonnet b/4.x/_gen/resources/container_aws_cluster.libsonnet
index 5681ea45..64e2999f 100644
--- a/4.x/_gen/resources/container_aws_cluster.libsonnet
+++ b/4.x/_gen/resources/container_aws_cluster.libsonnet
@@ -18,6 +18,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       admin_users: admin_users,
     }),
   },
+  binary_authorization:: {
+    '#new':: d.fn(help='\n`google.container_aws_cluster.binary_authorization.new` constructs a new object with attributes and blocks configured for the `binary_authorization`\nTerraform sub block.\n\n\n\n**Args**:\n  - `evaluation_mode` (`string`): Mode of operation for Binary Authorization policy evaluation. Possible values: DISABLED, PROJECT_SINGLETON_POLICY_ENFORCE When `null`, the `evaluation_mode` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `binary_authorization` sub block.\n', args=[]),
+    new(
+      evaluation_mode=null
+    ):: std.prune(a={
+      evaluation_mode: evaluation_mode,
+    }),
+  },
   control_plane:: {
     aws_services_authentication:: {
       '#new':: d.fn(help='\n`google.container_aws_cluster.control_plane.aws_services_authentication.new` constructs a new object with attributes and blocks configured for the `aws_services_authentication`\nTerraform sub block.\n\n\n\n**Args**:\n  - `role_arn` (`string`): The Amazon Resource Name (ARN) of the role that the Anthos Multi-Cloud API will assume when managing AWS resources on your account.\n  - `role_session_name` (`string`): Optional. An identifier for the assumed role session. When unspecified, it defaults to `multicloud-service-agent`. When `null`, the `role_session_name` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `aws_services_authentication` sub block.\n', args=[]),
@@ -148,7 +156,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       vpc_id: vpc_id,
     }),
   },
-  '#new':: d.fn(help="\n`google.container_aws_cluster.new` injects a new `google_container_aws_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.container_aws_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.container_aws_cluster` using the reference:\n\n    $._ref.google_container_aws_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_container_aws_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `aws_region` (`string`): The AWS region where the cluster runs. Each Google Cloud region supports a subset of nearby AWS regions. You can call to list all supported AWS regions within a given Google Cloud region.\n  - `description` (`string`): Optional. A human readable description of this cluster. Cannot be longer than 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `authorization` (`list[obj]`): Configuration related to the cluster RBAC settings. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.authorization.new](#fn-authorizationnew) constructor.\n  - `control_plane` (`list[obj]`): Configuration related to the cluster control plane. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.control_plane.new](#fn-control_planenew) constructor.\n  - `fleet` (`list[obj]`): Fleet configuration. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.fleet.new](#fn-fleetnew) constructor.\n  - `networking` (`list[obj]`): Cluster-wide networking configuration. When `null`, the `networking` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.networking.new](#fn-networkingnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.container_aws_cluster.new` injects a new `google_container_aws_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.container_aws_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.container_aws_cluster` using the reference:\n\n    $._ref.google_container_aws_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_container_aws_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `aws_region` (`string`): The AWS region where the cluster runs. Each Google Cloud region supports a subset of nearby AWS regions. You can call to list all supported AWS regions within a given Google Cloud region.\n  - `description` (`string`): Optional. A human readable description of this cluster. Cannot be longer than 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `authorization` (`list[obj]`): Configuration related to the cluster RBAC settings. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.authorization.new](#fn-authorizationnew) constructor.\n  - `binary_authorization` (`list[obj]`): Configuration options for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `control_plane` (`list[obj]`): Configuration related to the cluster control plane. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.control_plane.new](#fn-control_planenew) constructor.\n  - `fleet` (`list[obj]`): Fleet configuration. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.fleet.new](#fn-fleetnew) constructor.\n  - `networking` (`list[obj]`): Cluster-wide networking configuration. When `null`, the `networking` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.networking.new](#fn-networkingnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     aws_region,
@@ -156,6 +164,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     name,
     annotations=null,
     authorization=null,
+    binary_authorization=null,
     control_plane=null,
     description=null,
     fleet=null,
@@ -170,6 +179,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       annotations=annotations,
       authorization=authorization,
       aws_region=aws_region,
+      binary_authorization=binary_authorization,
       control_plane=control_plane,
       description=description,
       fleet=fleet,
@@ -181,13 +191,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.container_aws_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `container_aws_cluster`\nTerraform resource.\n\nUnlike [google.container_aws_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `aws_region` (`string`): The AWS region where the cluster runs. Each Google Cloud region supports a subset of nearby AWS regions. You can call to list all supported AWS regions within a given Google Cloud region.\n  - `description` (`string`): Optional. A human readable description of this cluster. Cannot be longer than 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `authorization` (`list[obj]`): Configuration related to the cluster RBAC settings. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.authorization.new](#fn-authorizationnew) constructor.\n  - `control_plane` (`list[obj]`): Configuration related to the cluster control plane. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.control_plane.new](#fn-control_planenew) constructor.\n  - `fleet` (`list[obj]`): Fleet configuration. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.fleet.new](#fn-fleetnew) constructor.\n  - `networking` (`list[obj]`): Cluster-wide networking configuration. When `null`, the `networking` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.networking.new](#fn-networkingnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `container_aws_cluster` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.container_aws_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `container_aws_cluster`\nTerraform resource.\n\nUnlike [google.container_aws_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `aws_region` (`string`): The AWS region where the cluster runs. Each Google Cloud region supports a subset of nearby AWS regions. You can call to list all supported AWS regions within a given Google Cloud region.\n  - `description` (`string`): Optional. A human readable description of this cluster. Cannot be longer than 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `authorization` (`list[obj]`): Configuration related to the cluster RBAC settings. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.authorization.new](#fn-authorizationnew) constructor.\n  - `binary_authorization` (`list[obj]`): Configuration options for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `control_plane` (`list[obj]`): Configuration related to the cluster control plane. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.control_plane.new](#fn-control_planenew) constructor.\n  - `fleet` (`list[obj]`): Fleet configuration. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.fleet.new](#fn-fleetnew) constructor.\n  - `networking` (`list[obj]`): Cluster-wide networking configuration. When `null`, the `networking` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.networking.new](#fn-networkingnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `container_aws_cluster` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     aws_region,
     location,
     name,
     annotations=null,
     authorization=null,
+    binary_authorization=null,
     control_plane=null,
     description=null,
     fleet=null,
@@ -198,6 +209,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     annotations: annotations,
     authorization: authorization,
     aws_region: aws_region,
+    binary_authorization: binary_authorization,
     control_plane: control_plane,
     description: description,
     fleet: fleet,
@@ -259,6 +271,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withBinaryAuthorization':: d.fn(help='`google.list[obj].withBinaryAuthorization` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the binary_authorization field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withBinaryAuthorizationMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `binary_authorization` field.\n', args=[]),
+  withBinaryAuthorization(resourceLabel, value): {
+    resource+: {
+      google_container_aws_cluster+: {
+        [resourceLabel]+: {
+          binary_authorization: value,
+        },
+      },
+    },
+  },
+  '#withBinaryAuthorizationMixin':: d.fn(help='`google.list[obj].withBinaryAuthorizationMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the binary_authorization field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withBinaryAuthorization](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `binary_authorization` field.\n', args=[]),
+  withBinaryAuthorizationMixin(resourceLabel, value): {
+    resource+: {
+      google_container_aws_cluster+: {
+        [resourceLabel]+: {
+          binary_authorization+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withControlPlane':: d.fn(help='`google.list[obj].withControlPlane` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the control_plane field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withControlPlaneMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `control_plane` field.\n', args=[]),
   withControlPlane(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/container_aws_node_pool.libsonnet b/4.x/_gen/resources/container_aws_node_pool.libsonnet
index bf7815fe..6a1e73c5 100644
--- a/4.x/_gen/resources/container_aws_node_pool.libsonnet
+++ b/4.x/_gen/resources/container_aws_node_pool.libsonnet
@@ -120,7 +120,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       max_pods_per_node: max_pods_per_node,
     }),
   },
-  '#new':: d.fn(help="\n`google.container_aws_node_pool.new` injects a new `google_container_aws_node_pool` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.container_aws_node_pool.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.container_aws_node_pool` using the reference:\n\n    $._ref.google_container_aws_node_pool.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_container_aws_node_pool.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `cluster` (`string`): The awsCluster for the resource\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `subnet_id` (`string`): The subnet where the node pool node run.\n  - `version` (`string`): The Kubernetes version to run on this node pool (e.g. `1.19.10-gke.1000`). You can list all supported versions on a given Google Cloud region by calling GetAwsServerConfig.\n  - `autoscaling` (`list[obj]`): Autoscaler configuration for this node pool. When `null`, the `autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.autoscaling.new](#fn-autoscalingnew) constructor.\n  - `config` (`list[obj]`): The configuration of the node pool. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.config.new](#fn-confignew) constructor.\n  - `management` (`list[obj]`): The Management configuration for this node pool. When `null`, the `management` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.management.new](#fn-managementnew) constructor.\n  - `max_pods_constraint` (`list[obj]`): The constraint on the maximum number of pods that can be run simultaneously on a node in the node pool. When `null`, the `max_pods_constraint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.max_pods_constraint.new](#fn-max_pods_constraintnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.container_aws_node_pool.new` injects a new `google_container_aws_node_pool` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.container_aws_node_pool.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.container_aws_node_pool` using the reference:\n\n    $._ref.google_container_aws_node_pool.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_container_aws_node_pool.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `cluster` (`string`): The awsCluster for the resource\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `subnet_id` (`string`): The subnet where the node pool node run.\n  - `version` (`string`): The Kubernetes version to run on this node pool (e.g. `1.19.10-gke.1000`). You can list all supported versions on a given Google Cloud region by calling GetAwsServerConfig.\n  - `autoscaling` (`list[obj]`): Autoscaler configuration for this node pool. When `null`, the `autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.autoscaling.new](#fn-autoscalingnew) constructor.\n  - `config` (`list[obj]`): The configuration of the node pool. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.config.new](#fn-confignew) constructor.\n  - `management` (`list[obj]`): The Management configuration for this node pool. When `null`, the `management` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.management.new](#fn-managementnew) constructor.\n  - `max_pods_constraint` (`list[obj]`): The constraint on the maximum number of pods that can be run simultaneously on a node in the node pool. When `null`, the `max_pods_constraint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.max_pods_constraint.new](#fn-max_pods_constraintnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     cluster,
@@ -155,7 +155,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.container_aws_node_pool.newAttrs` constructs a new object with attributes and blocks configured for the `container_aws_node_pool`\nTerraform resource.\n\nUnlike [google.container_aws_node_pool.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `cluster` (`string`): The awsCluster for the resource\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `subnet_id` (`string`): The subnet where the node pool node run.\n  - `version` (`string`): The Kubernetes version to run on this node pool (e.g. `1.19.10-gke.1000`). You can list all supported versions on a given Google Cloud region by calling GetAwsServerConfig.\n  - `autoscaling` (`list[obj]`): Autoscaler configuration for this node pool. When `null`, the `autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.autoscaling.new](#fn-autoscalingnew) constructor.\n  - `config` (`list[obj]`): The configuration of the node pool. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.config.new](#fn-confignew) constructor.\n  - `management` (`list[obj]`): The Management configuration for this node pool. When `null`, the `management` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.management.new](#fn-managementnew) constructor.\n  - `max_pods_constraint` (`list[obj]`): The constraint on the maximum number of pods that can be run simultaneously on a node in the node pool. When `null`, the `max_pods_constraint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.max_pods_constraint.new](#fn-max_pods_constraintnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `container_aws_node_pool` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.container_aws_node_pool.newAttrs` constructs a new object with attributes and blocks configured for the `container_aws_node_pool`\nTerraform resource.\n\nUnlike [google.container_aws_node_pool.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `cluster` (`string`): The awsCluster for the resource\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `subnet_id` (`string`): The subnet where the node pool node run.\n  - `version` (`string`): The Kubernetes version to run on this node pool (e.g. `1.19.10-gke.1000`). You can list all supported versions on a given Google Cloud region by calling GetAwsServerConfig.\n  - `autoscaling` (`list[obj]`): Autoscaler configuration for this node pool. When `null`, the `autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.autoscaling.new](#fn-autoscalingnew) constructor.\n  - `config` (`list[obj]`): The configuration of the node pool. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.config.new](#fn-confignew) constructor.\n  - `management` (`list[obj]`): The Management configuration for this node pool. When `null`, the `management` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.management.new](#fn-managementnew) constructor.\n  - `max_pods_constraint` (`list[obj]`): The constraint on the maximum number of pods that can be run simultaneously on a node in the node pool. When `null`, the `max_pods_constraint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.max_pods_constraint.new](#fn-max_pods_constraintnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_node_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `container_aws_node_pool` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     cluster,
     location,
diff --git a/4.x/_gen/resources/container_azure_cluster.libsonnet b/4.x/_gen/resources/container_azure_cluster.libsonnet
index 9d05996f..264ed8ad 100644
--- a/4.x/_gen/resources/container_azure_cluster.libsonnet
+++ b/4.x/_gen/resources/container_azure_cluster.libsonnet
@@ -126,7 +126,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       virtual_network_id: virtual_network_id,
     }),
   },
-  '#new':: d.fn(help="\n`google.container_azure_cluster.new` injects a new `google_container_azure_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.container_azure_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.container_azure_cluster` using the reference:\n\n    $._ref.google_container_azure_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_container_azure_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `azure_region` (`string`): The Azure region where the cluster runs. Each Google Cloud region supports a subset of nearby Azure regions. You can call to list all supported Azure regions within a given Google Cloud region.\n  - `client` (`string`): Name of the AzureClient. The `AzureClient` resource must reside on the same GCP project and region as the `AzureCluster`. `AzureClient` names are formatted as `projects/\u0026lt;project-number\u0026gt;/locations/\u0026lt;region\u0026gt;/azureClients/\u0026lt;client-id\u0026gt;`. See Resource Names (https:cloud.google.com/apis/design/resource_names) for more details on Google Cloud resource names. When `null`, the `client` field will be omitted from the resulting object.\n  - `description` (`string`): Optional. A human readable description of this cluster. Cannot be longer than 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `resource_group_id` (`string`): The ARM ID of the resource group where the cluster resources are deployed. For example: `/subscriptions/*/resourceGroups/*`\n  - `authorization` (`list[obj]`): Configuration related to the cluster RBAC settings. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.authorization.new](#fn-authorizationnew) constructor.\n  - `azure_services_authentication` (`list[obj]`): Azure authentication configuration for management of Azure resources When `null`, the `azure_services_authentication` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.azure_services_authentication.new](#fn-azure_services_authenticationnew) constructor.\n  - `control_plane` (`list[obj]`): Configuration related to the cluster control plane. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.control_plane.new](#fn-control_planenew) constructor.\n  - `fleet` (`list[obj]`): Fleet configuration. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.fleet.new](#fn-fleetnew) constructor.\n  - `networking` (`list[obj]`): Cluster-wide networking configuration. When `null`, the `networking` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.networking.new](#fn-networkingnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.container_azure_cluster.new` injects a new `google_container_azure_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.container_azure_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.container_azure_cluster` using the reference:\n\n    $._ref.google_container_azure_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_container_azure_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `azure_region` (`string`): The Azure region where the cluster runs. Each Google Cloud region supports a subset of nearby Azure regions. You can call to list all supported Azure regions within a given Google Cloud region.\n  - `client` (`string`): Name of the AzureClient. The `AzureClient` resource must reside on the same GCP project and region as the `AzureCluster`. `AzureClient` names are formatted as `projects/\u0026lt;project-number\u0026gt;/locations/\u0026lt;region\u0026gt;/azureClients/\u0026lt;client-id\u0026gt;`. See Resource Names (https:cloud.google.com/apis/design/resource_names) for more details on Google Cloud resource names. When `null`, the `client` field will be omitted from the resulting object.\n  - `description` (`string`): Optional. A human readable description of this cluster. Cannot be longer than 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `resource_group_id` (`string`): The ARM ID of the resource group where the cluster resources are deployed. For example: `/subscriptions/*/resourceGroups/*`\n  - `authorization` (`list[obj]`): Configuration related to the cluster RBAC settings. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.authorization.new](#fn-authorizationnew) constructor.\n  - `azure_services_authentication` (`list[obj]`): Azure authentication configuration for management of Azure resources When `null`, the `azure_services_authentication` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.azure_services_authentication.new](#fn-azure_services_authenticationnew) constructor.\n  - `control_plane` (`list[obj]`): Configuration related to the cluster control plane. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.control_plane.new](#fn-control_planenew) constructor.\n  - `fleet` (`list[obj]`): Fleet configuration. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.fleet.new](#fn-fleetnew) constructor.\n  - `networking` (`list[obj]`): Cluster-wide networking configuration. When `null`, the `networking` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.networking.new](#fn-networkingnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     azure_region,
@@ -165,7 +165,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.container_azure_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `container_azure_cluster`\nTerraform resource.\n\nUnlike [google.container_azure_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `azure_region` (`string`): The Azure region where the cluster runs. Each Google Cloud region supports a subset of nearby Azure regions. You can call to list all supported Azure regions within a given Google Cloud region.\n  - `client` (`string`): Name of the AzureClient. The `AzureClient` resource must reside on the same GCP project and region as the `AzureCluster`. `AzureClient` names are formatted as `projects/<project-number>/locations/<region>/azureClients/<client-id>`. See Resource Names (https:cloud.google.com/apis/design/resource_names) for more details on Google Cloud resource names. When `null`, the `client` field will be omitted from the resulting object.\n  - `description` (`string`): Optional. A human readable description of this cluster. Cannot be longer than 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `resource_group_id` (`string`): The ARM ID of the resource group where the cluster resources are deployed. For example: `/subscriptions/*/resourceGroups/*`\n  - `authorization` (`list[obj]`): Configuration related to the cluster RBAC settings. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.authorization.new](#fn-authorizationnew) constructor.\n  - `azure_services_authentication` (`list[obj]`): Azure authentication configuration for management of Azure resources When `null`, the `azure_services_authentication` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.azure_services_authentication.new](#fn-azure_services_authenticationnew) constructor.\n  - `control_plane` (`list[obj]`): Configuration related to the cluster control plane. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.control_plane.new](#fn-control_planenew) constructor.\n  - `fleet` (`list[obj]`): Fleet configuration. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.fleet.new](#fn-fleetnew) constructor.\n  - `networking` (`list[obj]`): Cluster-wide networking configuration. When `null`, the `networking` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.networking.new](#fn-networkingnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `container_azure_cluster` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.container_azure_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `container_azure_cluster`\nTerraform resource.\n\nUnlike [google.container_azure_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `azure_region` (`string`): The Azure region where the cluster runs. Each Google Cloud region supports a subset of nearby Azure regions. You can call to list all supported Azure regions within a given Google Cloud region.\n  - `client` (`string`): Name of the AzureClient. The `AzureClient` resource must reside on the same GCP project and region as the `AzureCluster`. `AzureClient` names are formatted as `projects/<project-number>/locations/<region>/azureClients/<client-id>`. See Resource Names (https:cloud.google.com/apis/design/resource_names) for more details on Google Cloud resource names. When `null`, the `client` field will be omitted from the resulting object.\n  - `description` (`string`): Optional. A human readable description of this cluster. Cannot be longer than 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `resource_group_id` (`string`): The ARM ID of the resource group where the cluster resources are deployed. For example: `/subscriptions/*/resourceGroups/*`\n  - `authorization` (`list[obj]`): Configuration related to the cluster RBAC settings. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.authorization.new](#fn-authorizationnew) constructor.\n  - `azure_services_authentication` (`list[obj]`): Azure authentication configuration for management of Azure resources When `null`, the `azure_services_authentication` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.azure_services_authentication.new](#fn-azure_services_authenticationnew) constructor.\n  - `control_plane` (`list[obj]`): Configuration related to the cluster control plane. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.control_plane.new](#fn-control_planenew) constructor.\n  - `fleet` (`list[obj]`): Fleet configuration. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.fleet.new](#fn-fleetnew) constructor.\n  - `networking` (`list[obj]`): Cluster-wide networking configuration. When `null`, the `networking` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.networking.new](#fn-networkingnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `container_azure_cluster` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     azure_region,
     location,
diff --git a/4.x/_gen/resources/container_azure_node_pool.libsonnet b/4.x/_gen/resources/container_azure_node_pool.libsonnet
index c4fd5985..379a5ba6 100644
--- a/4.x/_gen/resources/container_azure_node_pool.libsonnet
+++ b/4.x/_gen/resources/container_azure_node_pool.libsonnet
@@ -70,7 +70,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       max_pods_per_node: max_pods_per_node,
     }),
   },
-  '#new':: d.fn(help="\n`google.container_azure_node_pool.new` injects a new `google_container_azure_node_pool` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.container_azure_node_pool.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.container_azure_node_pool` using the reference:\n\n    $._ref.google_container_azure_node_pool.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_container_azure_node_pool.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `azure_availability_zone` (`string`): Optional. The Azure availability zone of the nodes in this nodepool. When unspecified, it defaults to `1`. When `null`, the `azure_availability_zone` field will be omitted from the resulting object.\n  - `cluster` (`string`): The azureCluster for the resource\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `subnet_id` (`string`): The ARM ID of the subnet where the node pool VMs run. Make sure it\u0026#39;s a subnet under the virtual network in the cluster configuration.\n  - `version` (`string`): The Kubernetes version (e.g. `1.19.10-gke.1000`) running on this node pool.\n  - `autoscaling` (`list[obj]`): Autoscaler configuration for this node pool. When `null`, the `autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.autoscaling.new](#fn-autoscalingnew) constructor.\n  - `config` (`list[obj]`): The node configuration of the node pool. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.config.new](#fn-confignew) constructor.\n  - `management` (`list[obj]`): The Management configuration for this node pool. When `null`, the `management` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.management.new](#fn-managementnew) constructor.\n  - `max_pods_constraint` (`list[obj]`): The constraint on the maximum number of pods that can be run simultaneously on a node in the node pool. When `null`, the `max_pods_constraint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.max_pods_constraint.new](#fn-max_pods_constraintnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.container_azure_node_pool.new` injects a new `google_container_azure_node_pool` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.container_azure_node_pool.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.container_azure_node_pool` using the reference:\n\n    $._ref.google_container_azure_node_pool.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_container_azure_node_pool.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `azure_availability_zone` (`string`): Optional. The Azure availability zone of the nodes in this nodepool. When unspecified, it defaults to `1`. When `null`, the `azure_availability_zone` field will be omitted from the resulting object.\n  - `cluster` (`string`): The azureCluster for the resource\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `subnet_id` (`string`): The ARM ID of the subnet where the node pool VMs run. Make sure it\u0026#39;s a subnet under the virtual network in the cluster configuration.\n  - `version` (`string`): The Kubernetes version (e.g. `1.19.10-gke.1000`) running on this node pool.\n  - `autoscaling` (`list[obj]`): Autoscaler configuration for this node pool. When `null`, the `autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.autoscaling.new](#fn-autoscalingnew) constructor.\n  - `config` (`list[obj]`): The node configuration of the node pool. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.config.new](#fn-confignew) constructor.\n  - `management` (`list[obj]`): The Management configuration for this node pool. When `null`, the `management` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.management.new](#fn-managementnew) constructor.\n  - `max_pods_constraint` (`list[obj]`): The constraint on the maximum number of pods that can be run simultaneously on a node in the node pool. When `null`, the `max_pods_constraint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.max_pods_constraint.new](#fn-max_pods_constraintnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     cluster,
@@ -107,7 +107,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.container_azure_node_pool.newAttrs` constructs a new object with attributes and blocks configured for the `container_azure_node_pool`\nTerraform resource.\n\nUnlike [google.container_azure_node_pool.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `azure_availability_zone` (`string`): Optional. The Azure availability zone of the nodes in this nodepool. When unspecified, it defaults to `1`. When `null`, the `azure_availability_zone` field will be omitted from the resulting object.\n  - `cluster` (`string`): The azureCluster for the resource\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `subnet_id` (`string`): The ARM ID of the subnet where the node pool VMs run. Make sure it's a subnet under the virtual network in the cluster configuration.\n  - `version` (`string`): The Kubernetes version (e.g. `1.19.10-gke.1000`) running on this node pool.\n  - `autoscaling` (`list[obj]`): Autoscaler configuration for this node pool. When `null`, the `autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.autoscaling.new](#fn-autoscalingnew) constructor.\n  - `config` (`list[obj]`): The node configuration of the node pool. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.config.new](#fn-confignew) constructor.\n  - `management` (`list[obj]`): The Management configuration for this node pool. When `null`, the `management` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.management.new](#fn-managementnew) constructor.\n  - `max_pods_constraint` (`list[obj]`): The constraint on the maximum number of pods that can be run simultaneously on a node in the node pool. When `null`, the `max_pods_constraint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.max_pods_constraint.new](#fn-max_pods_constraintnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `container_azure_node_pool` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.container_azure_node_pool.newAttrs` constructs a new object with attributes and blocks configured for the `container_azure_node_pool`\nTerraform resource.\n\nUnlike [google.container_azure_node_pool.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `azure_availability_zone` (`string`): Optional. The Azure availability zone of the nodes in this nodepool. When unspecified, it defaults to `1`. When `null`, the `azure_availability_zone` field will be omitted from the resulting object.\n  - `cluster` (`string`): The azureCluster for the resource\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of this resource.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `subnet_id` (`string`): The ARM ID of the subnet where the node pool VMs run. Make sure it's a subnet under the virtual network in the cluster configuration.\n  - `version` (`string`): The Kubernetes version (e.g. `1.19.10-gke.1000`) running on this node pool.\n  - `autoscaling` (`list[obj]`): Autoscaler configuration for this node pool. When `null`, the `autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.autoscaling.new](#fn-autoscalingnew) constructor.\n  - `config` (`list[obj]`): The node configuration of the node pool. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.config.new](#fn-confignew) constructor.\n  - `management` (`list[obj]`): The Management configuration for this node pool. When `null`, the `management` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.management.new](#fn-managementnew) constructor.\n  - `max_pods_constraint` (`list[obj]`): The constraint on the maximum number of pods that can be run simultaneously on a node in the node pool. When `null`, the `max_pods_constraint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.max_pods_constraint.new](#fn-max_pods_constraintnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_azure_node_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `container_azure_node_pool` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     cluster,
     location,
diff --git a/4.x/_gen/resources/container_cluster.libsonnet b/4.x/_gen/resources/container_cluster.libsonnet
index 06807bdc..303bdb09 100644
--- a/4.x/_gen/resources/container_cluster.libsonnet
+++ b/4.x/_gen/resources/container_cluster.libsonnet
@@ -296,6 +296,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       channel: channel,
     }),
   },
+  identity_service_config:: {
+    '#new':: d.fn(help='\n`google.container_cluster.identity_service_config.new` constructs a new object with attributes and blocks configured for the `identity_service_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): Whether to enable the Identity Service component. When `null`, the `enabled` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `identity_service_config` sub block.\n', args=[]),
+    new(
+      enabled=null
+    ):: std.prune(a={
+      enabled: enabled,
+    }),
+  },
   ip_allocation_policy:: {
     additional_pod_ranges_config:: {
       '#new':: d.fn(help='\n`google.container_cluster.ip_allocation_policy.additional_pod_ranges_config.new` constructs a new object with attributes and blocks configured for the `additional_pod_ranges_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `pod_range_names` (`list`): Name for pod secondary ipv4 range which has the actual range defined ahead.\n\n**Returns**:\n  - An attribute object that represents the `additional_pod_ranges_config` sub block.\n', args=[]),
@@ -469,7 +477,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     }),
   },
   network_policy:: {
-    '#new':: d.fn(help='\n`google.container_cluster.network_policy.new` constructs a new object with attributes and blocks configured for the `network_policy`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): Whether network policy is enabled on the cluster.\n  - `provider` (`string`): The selected network policy provider. Defaults to PROVIDER_UNSPECIFIED. When `null`, the `provider` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `network_policy` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.container_cluster.network_policy.new` constructs a new object with attributes and blocks configured for the `network_policy`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): Whether network policy is enabled on the cluster.\n  - `provider` (`string`): The selected network policy provider. When `null`, the `provider` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `network_policy` sub block.\n', args=[]),
     new(
       enabled,
       provider=null
@@ -478,7 +486,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       provider: provider,
     }),
   },
-  '#new':: d.fn(help="\n`google.container_cluster.new` injects a new `google_container_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.container_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.container_cluster` using the reference:\n\n    $._ref.google_container_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_container_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `allow_net_admin` (`bool`): Enable NET_ADMIN for this cluster. When `null`, the `allow_net_admin` field will be omitted from the resulting object.\n  - `cluster_ipv4_cidr` (`string`): The IP address range of the Kubernetes pods in this cluster in CIDR notation (e.g. 10.96.0.0/14). Leave blank to have one automatically chosen or specify a /14 block in 10.0.0.0/8. This field will only work for routes-based clusters, where ip_allocation_policy is not defined. When `null`, the `cluster_ipv4_cidr` field will be omitted from the resulting object.\n  - `datapath_provider` (`string`): The desired datapath provider for this cluster. By default, uses the IPTables-based kube-proxy implementation. When `null`, the `datapath_provider` field will be omitted from the resulting object.\n  - `default_max_pods_per_node` (`number`): The default maximum number of pods per node in this cluster. This doesn\u0026#39;t work on \u0026#34;routes-based\u0026#34; clusters, clusters that don\u0026#39;t have IP Aliasing enabled. When `null`, the `default_max_pods_per_node` field will be omitted from the resulting object.\n  - `description` (`string`):  Description of the cluster. When `null`, the `description` field will be omitted from the resulting object.\n  - `enable_autopilot` (`bool`): Enable Autopilot for this cluster. When `null`, the `enable_autopilot` field will be omitted from the resulting object.\n  - `enable_binary_authorization` (`bool`): Enable Binary Authorization for this cluster. If enabled, all container images will be validated by Google Binary Authorization. When `null`, the `enable_binary_authorization` field will be omitted from the resulting object.\n  - `enable_intranode_visibility` (`bool`): Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network. When `null`, the `enable_intranode_visibility` field will be omitted from the resulting object.\n  - `enable_kubernetes_alpha` (`bool`): Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. When `null`, the `enable_kubernetes_alpha` field will be omitted from the resulting object.\n  - `enable_l4_ilb_subsetting` (`bool`): Whether L4ILB Subsetting is enabled for this cluster. When `null`, the `enable_l4_ilb_subsetting` field will be omitted from the resulting object.\n  - `enable_legacy_abac` (`bool`): Whether the ABAC authorizer is enabled for this cluster. When enabled, identities in the system, including service accounts, nodes, and controllers, will have statically granted permissions beyond those provided by the RBAC configuration or IAM. Defaults to false. When `null`, the `enable_legacy_abac` field will be omitted from the resulting object.\n  - `enable_shielded_nodes` (`bool`): Enable Shielded Nodes features on all nodes in this cluster. Defaults to true. When `null`, the `enable_shielded_nodes` field will be omitted from the resulting object.\n  - `enable_tpu` (`bool`): Whether to enable Cloud TPU resources in this cluster. When `null`, the `enable_tpu` field will be omitted from the resulting object.\n  - `initial_node_count` (`number`): The number of nodes to create in this cluster\u0026#39;s default node pool. In regional or multi-zonal clusters, this is the number of nodes per zone. Must be set if node_pool is not set. If you\u0026#39;re using google_container_node_pool objects with no default node pool, you\u0026#39;ll need to set this to a value of at least 1, alongside setting remove_default_node_pool to true. When `null`, the `initial_node_count` field will be omitted from the resulting object.\n  - `location` (`string`): The location (region or zone) in which the cluster master will be created, as well as the default node location. If you specify a zone (such as us-central1-a), the cluster will be a zonal cluster with a single cluster master. If you specify a region (such as us-west1), the cluster will be a regional cluster with multiple masters spread across zones in the region, and with default node locations in those zones as well. When `null`, the `location` field will be omitted from the resulting object.\n  - `logging_service` (`string`): The logging service that the cluster should write logs to. Available options include logging.googleapis.com(Legacy Stackdriver), logging.googleapis.com/kubernetes(Stackdriver Kubernetes Engine Logging), and none. Defaults to logging.googleapis.com/kubernetes. When `null`, the `logging_service` field will be omitted from the resulting object.\n  - `min_master_version` (`string`): The minimum version of the master. GKE will auto-update the master to new versions, so this does not guarantee the current master version--use the read-only master_version field to obtain that. If unset, the cluster\u0026#39;s version will be set by GKE to the version of the most recent official release (which is not necessarily the latest version). When `null`, the `min_master_version` field will be omitted from the resulting object.\n  - `monitoring_service` (`string`): The monitoring service that the cluster should write metrics to. Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API. VM metrics will be collected by Google Compute Engine regardless of this setting Available options include monitoring.googleapis.com(Legacy Stackdriver), monitoring.googleapis.com/kubernetes(Stackdriver Kubernetes Engine Monitoring), and none. Defaults to monitoring.googleapis.com/kubernetes. When `null`, the `monitoring_service` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the cluster, unique within the project and location.\n  - `network` (`string`): The name or self_link of the Google Compute Engine network to which the cluster is connected. For Shared VPC, set this to the self link of the shared network. When `null`, the `network` field will be omitted from the resulting object.\n  - `networking_mode` (`string`): Determines whether alias IPs or routes will be used for pod IPs in the cluster. When `null`, the `networking_mode` field will be omitted from the resulting object.\n  - `node_locations` (`list`): The list of zones in which the cluster\u0026#39;s nodes are located. Nodes must be in the region of their regional cluster or in the same region as their cluster\u0026#39;s zone for zonal clusters. If this is specified for a zonal cluster, omit the cluster\u0026#39;s zone. When `null`, the `node_locations` field will be omitted from the resulting object.\n  - `node_version` (`string`): The Kubernetes version on the nodes. Must either be unset or set to the same value as min_master_version on create. Defaults to the default version set by GKE which is not necessarily the latest version. This only affects nodes in the default node pool. While a fuzzy version can be specified, it\u0026#39;s recommended that you specify explicit versions as Terraform will see spurious diffs when fuzzy versions are used. See the google_container_engine_versions data source\u0026#39;s version_prefix field to approximate fuzzy versions in a Terraform-compatible way. To update nodes in other node pools, use the version attribute on the node pool. When `null`, the `node_version` field will be omitted from the resulting object.\n  - `private_ipv6_google_access` (`string`): The desired state of IPv6 connectivity to Google Services. By default, no private IPv6 access to or from Google Services (all access will be via IPv4). When `null`, the `private_ipv6_google_access` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `remove_default_node_pool` (`bool`): If true, deletes the default node pool upon cluster creation. If you\u0026#39;re using google_container_node_pool resources with no default node pool, this should be set to true, alongside setting initial_node_count to at least 1. When `null`, the `remove_default_node_pool` field will be omitted from the resulting object.\n  - `resource_labels` (`obj`): The GCE resource labels (a map of key/value pairs) to be applied to the cluster. When `null`, the `resource_labels` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): The name or self_link of the Google Compute Engine subnetwork in which the cluster\u0026#39;s instances are launched. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `addons_config` (`list[obj]`): The configuration for addons supported by GKE. When `null`, the `addons_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.addons_config.new](#fn-addons_confignew) constructor.\n  - `authenticator_groups_config` (`list[obj]`): Configuration for the Google Groups for GKE feature. When `null`, the `authenticator_groups_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.authenticator_groups_config.new](#fn-authenticator_groups_confignew) constructor.\n  - `binary_authorization` (`list[obj]`): Configuration options for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `cluster_autoscaling` (`list[obj]`): Per-cluster configuration of Node Auto-Provisioning with Cluster Autoscaler to automatically adjust the size of the cluster and create/delete node pools based on the current needs of the cluster\u0026#39;s workload. See the guide to using Node Auto-Provisioning for more details. When `null`, the `cluster_autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.cluster_autoscaling.new](#fn-cluster_autoscalingnew) constructor.\n  - `confidential_nodes` (`list[obj]`): Configuration for the confidential nodes feature, which makes nodes run on confidential VMs. Warning: This configuration can\u0026#39;t be changed (or added/removed) after cluster creation without deleting and recreating the entire cluster. When `null`, the `confidential_nodes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.confidential_nodes.new](#fn-confidential_nodesnew) constructor.\n  - `cost_management_config` (`list[obj]`): Cost management configuration for the cluster. When `null`, the `cost_management_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.cost_management_config.new](#fn-cost_management_confignew) constructor.\n  - `database_encryption` (`list[obj]`): Application-layer Secrets Encryption settings. The object format is {state = string, key_name = string}. Valid values of state are: \u0026#34;ENCRYPTED\u0026#34;; \u0026#34;DECRYPTED\u0026#34;. key_name is the name of a CloudKMS key. When `null`, the `database_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.database_encryption.new](#fn-database_encryptionnew) constructor.\n  - `default_snat_status` (`list[obj]`): Whether the cluster disables default in-node sNAT rules. In-node sNAT rules will be disabled when defaultSnatStatus is disabled. When `null`, the `default_snat_status` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.default_snat_status.new](#fn-default_snat_statusnew) constructor.\n  - `dns_config` (`list[obj]`): Configuration for Cloud DNS for Kubernetes Engine. When `null`, the `dns_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.dns_config.new](#fn-dns_confignew) constructor.\n  - `enable_k8s_beta_apis` (`list[obj]`): Configuration for Kubernetes Beta APIs. When `null`, the `enable_k8s_beta_apis` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.enable_k8s_beta_apis.new](#fn-enable_k8s_beta_apisnew) constructor.\n  - `gateway_api_config` (`list[obj]`): Configuration for GKE Gateway API controller. When `null`, the `gateway_api_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.gateway_api_config.new](#fn-gateway_api_confignew) constructor.\n  - `ip_allocation_policy` (`list[obj]`): Configuration of cluster IP allocation for VPC-native clusters. Adding this block enables IP aliasing, making the cluster VPC-native instead of routes-based. When `null`, the `ip_allocation_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.ip_allocation_policy.new](#fn-ip_allocation_policynew) constructor.\n  - `logging_config` (`list[obj]`): Logging configuration for the cluster. When `null`, the `logging_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.logging_config.new](#fn-logging_confignew) constructor.\n  - `maintenance_policy` (`list[obj]`): The maintenance policy to use for the cluster. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.maintenance_policy.new](#fn-maintenance_policynew) constructor.\n  - `master_auth` (`list[obj]`): The authentication information for accessing the Kubernetes master. Some values in this block are only returned by the API if your service account has permission to get credentials for your GKE cluster. If you see an unexpected diff unsetting your client cert, ensure you have the container.clusters.getCredentials permission. When `null`, the `master_auth` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.master_auth.new](#fn-master_authnew) constructor.\n  - `master_authorized_networks_config` (`list[obj]`): The desired configuration options for master authorized networks. Omit the nested cidr_blocks attribute to disallow external access (except the cluster node IPs, which GKE automatically whitelists). When `null`, the `master_authorized_networks_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.master_authorized_networks_config.new](#fn-master_authorized_networks_confignew) constructor.\n  - `mesh_certificates` (`list[obj]`): If set, and enable_certificates=true, the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. When `null`, the `mesh_certificates` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.mesh_certificates.new](#fn-mesh_certificatesnew) constructor.\n  - `monitoring_config` (`list[obj]`): Monitoring configuration for the cluster. When `null`, the `monitoring_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.monitoring_config.new](#fn-monitoring_confignew) constructor.\n  - `network_policy` (`list[obj]`): Configuration options for the NetworkPolicy feature. When `null`, the `network_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.network_policy.new](#fn-network_policynew) constructor.\n  - `node_config` (`list[obj]`): The configuration of the nodepool When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.new](#fn-node_confignew) constructor.\n  - `node_pool` (`list[obj]`): List of node pools associated with this cluster. See google_container_node_pool for schema. Warning: node pools defined inside a cluster can\u0026#39;t be changed (or added/removed) after cluster creation without deleting and recreating the entire cluster. Unless you absolutely need the ability to say \u0026#34;these are the only node pools associated with this cluster\u0026#34;, use the google_container_node_pool resource instead of this property. When `null`, the `node_pool` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.new](#fn-node_poolnew) constructor.\n  - `node_pool_auto_config` (`list[obj]`): Node pool configs that apply to all auto-provisioned node pools in autopilot clusters and node auto-provisioning enabled clusters. When `null`, the `node_pool_auto_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool_auto_config.new](#fn-node_pool_auto_confignew) constructor.\n  - `node_pool_defaults` (`list[obj]`): The default nodel pool settings for the entire cluster. When `null`, the `node_pool_defaults` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool_defaults.new](#fn-node_pool_defaultsnew) constructor.\n  - `notification_config` (`list[obj]`): The notification config for sending cluster upgrade notifications When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.notification_config.new](#fn-notification_confignew) constructor.\n  - `private_cluster_config` (`list[obj]`): Configuration for private clusters, clusters with private nodes. When `null`, the `private_cluster_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.private_cluster_config.new](#fn-private_cluster_confignew) constructor.\n  - `release_channel` (`list[obj]`): Configuration options for the Release channel feature, which provide more control over automatic upgrades of your GKE clusters. Note that removing this field from your config will not unenroll it. Instead, use the \u0026#34;UNSPECIFIED\u0026#34; channel. When `null`, the `release_channel` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.release_channel.new](#fn-release_channelnew) constructor.\n  - `resource_usage_export_config` (`list[obj]`): Configuration for the ResourceUsageExportConfig feature. When `null`, the `resource_usage_export_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.resource_usage_export_config.new](#fn-resource_usage_export_confignew) constructor.\n  - `security_posture_config` (`list[obj]`): Defines the config needed to enable/disable features for the Security Posture API When `null`, the `security_posture_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.security_posture_config.new](#fn-security_posture_confignew) constructor.\n  - `service_external_ips_config` (`list[obj]`): If set, and enabled=true, services with external ips field will not be blocked When `null`, the `service_external_ips_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.service_external_ips_config.new](#fn-service_external_ips_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vertical_pod_autoscaling` (`list[obj]`): Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it. When `null`, the `vertical_pod_autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.vertical_pod_autoscaling.new](#fn-vertical_pod_autoscalingnew) constructor.\n  - `workload_identity_config` (`list[obj]`): Configuration for the use of Kubernetes Service Accounts in GCP IAM policies. When `null`, the `workload_identity_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.workload_identity_config.new](#fn-workload_identity_confignew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.container_cluster.new` injects a new `google_container_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.container_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.container_cluster` using the reference:\n\n    $._ref.google_container_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_container_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `allow_net_admin` (`bool`): Enable NET_ADMIN for this cluster. When `null`, the `allow_net_admin` field will be omitted from the resulting object.\n  - `cluster_ipv4_cidr` (`string`): The IP address range of the Kubernetes pods in this cluster in CIDR notation (e.g. 10.96.0.0/14). Leave blank to have one automatically chosen or specify a /14 block in 10.0.0.0/8. This field will only work for routes-based clusters, where ip_allocation_policy is not defined. When `null`, the `cluster_ipv4_cidr` field will be omitted from the resulting object.\n  - `datapath_provider` (`string`): The desired datapath provider for this cluster. By default, uses the IPTables-based kube-proxy implementation. When `null`, the `datapath_provider` field will be omitted from the resulting object.\n  - `default_max_pods_per_node` (`number`): The default maximum number of pods per node in this cluster. This doesn\u0026#39;t work on \u0026#34;routes-based\u0026#34; clusters, clusters that don\u0026#39;t have IP Aliasing enabled. When `null`, the `default_max_pods_per_node` field will be omitted from the resulting object.\n  - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the instance. Defaults to true. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the cluster will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `description` (`string`):  Description of the cluster. When `null`, the `description` field will be omitted from the resulting object.\n  - `enable_autopilot` (`bool`): Enable Autopilot for this cluster. When `null`, the `enable_autopilot` field will be omitted from the resulting object.\n  - `enable_intranode_visibility` (`bool`): Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network. When `null`, the `enable_intranode_visibility` field will be omitted from the resulting object.\n  - `enable_kubernetes_alpha` (`bool`): Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. When `null`, the `enable_kubernetes_alpha` field will be omitted from the resulting object.\n  - `enable_l4_ilb_subsetting` (`bool`): Whether L4ILB Subsetting is enabled for this cluster. When `null`, the `enable_l4_ilb_subsetting` field will be omitted from the resulting object.\n  - `enable_legacy_abac` (`bool`): Whether the ABAC authorizer is enabled for this cluster. When enabled, identities in the system, including service accounts, nodes, and controllers, will have statically granted permissions beyond those provided by the RBAC configuration or IAM. Defaults to false. When `null`, the `enable_legacy_abac` field will be omitted from the resulting object.\n  - `enable_shielded_nodes` (`bool`): Enable Shielded Nodes features on all nodes in this cluster. Defaults to true. When `null`, the `enable_shielded_nodes` field will be omitted from the resulting object.\n  - `enable_tpu` (`bool`): Whether to enable Cloud TPU resources in this cluster. When `null`, the `enable_tpu` field will be omitted from the resulting object.\n  - `initial_node_count` (`number`): The number of nodes to create in this cluster\u0026#39;s default node pool. In regional or multi-zonal clusters, this is the number of nodes per zone. Must be set if node_pool is not set. If you\u0026#39;re using google_container_node_pool objects with no default node pool, you\u0026#39;ll need to set this to a value of at least 1, alongside setting remove_default_node_pool to true. When `null`, the `initial_node_count` field will be omitted from the resulting object.\n  - `location` (`string`): The location (region or zone) in which the cluster master will be created, as well as the default node location. If you specify a zone (such as us-central1-a), the cluster will be a zonal cluster with a single cluster master. If you specify a region (such as us-west1), the cluster will be a regional cluster with multiple masters spread across zones in the region, and with default node locations in those zones as well. When `null`, the `location` field will be omitted from the resulting object.\n  - `logging_service` (`string`): The logging service that the cluster should write logs to. Available options include logging.googleapis.com(Legacy Stackdriver), logging.googleapis.com/kubernetes(Stackdriver Kubernetes Engine Logging), and none. Defaults to logging.googleapis.com/kubernetes. When `null`, the `logging_service` field will be omitted from the resulting object.\n  - `min_master_version` (`string`): The minimum version of the master. GKE will auto-update the master to new versions, so this does not guarantee the current master version--use the read-only master_version field to obtain that. If unset, the cluster\u0026#39;s version will be set by GKE to the version of the most recent official release (which is not necessarily the latest version). When `null`, the `min_master_version` field will be omitted from the resulting object.\n  - `monitoring_service` (`string`): The monitoring service that the cluster should write metrics to. Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API. VM metrics will be collected by Google Compute Engine regardless of this setting Available options include monitoring.googleapis.com(Legacy Stackdriver), monitoring.googleapis.com/kubernetes(Stackdriver Kubernetes Engine Monitoring), and none. Defaults to monitoring.googleapis.com/kubernetes. When `null`, the `monitoring_service` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the cluster, unique within the project and location.\n  - `network` (`string`): The name or self_link of the Google Compute Engine network to which the cluster is connected. For Shared VPC, set this to the self link of the shared network. When `null`, the `network` field will be omitted from the resulting object.\n  - `networking_mode` (`string`): Determines whether alias IPs or routes will be used for pod IPs in the cluster. Defaults to VPC_NATIVE for new clusters. When `null`, the `networking_mode` field will be omitted from the resulting object.\n  - `node_locations` (`list`): The list of zones in which the cluster\u0026#39;s nodes are located. Nodes must be in the region of their regional cluster or in the same region as their cluster\u0026#39;s zone for zonal clusters. If this is specified for a zonal cluster, omit the cluster\u0026#39;s zone. When `null`, the `node_locations` field will be omitted from the resulting object.\n  - `node_version` (`string`): The Kubernetes version on the nodes. Must either be unset or set to the same value as min_master_version on create. Defaults to the default version set by GKE which is not necessarily the latest version. This only affects nodes in the default node pool. While a fuzzy version can be specified, it\u0026#39;s recommended that you specify explicit versions as Terraform will see spurious diffs when fuzzy versions are used. See the google_container_engine_versions data source\u0026#39;s version_prefix field to approximate fuzzy versions in a Terraform-compatible way. To update nodes in other node pools, use the version attribute on the node pool. When `null`, the `node_version` field will be omitted from the resulting object.\n  - `private_ipv6_google_access` (`string`): The desired state of IPv6 connectivity to Google Services. By default, no private IPv6 access to or from Google Services (all access will be via IPv4). When `null`, the `private_ipv6_google_access` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `remove_default_node_pool` (`bool`): If true, deletes the default node pool upon cluster creation. If you\u0026#39;re using google_container_node_pool resources with no default node pool, this should be set to true, alongside setting initial_node_count to at least 1. When `null`, the `remove_default_node_pool` field will be omitted from the resulting object.\n  - `resource_labels` (`obj`): The GCE resource labels (a map of key/value pairs) to be applied to the cluster. When `null`, the `resource_labels` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): The name or self_link of the Google Compute Engine subnetwork in which the cluster\u0026#39;s instances are launched. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `addons_config` (`list[obj]`): The configuration for addons supported by GKE. When `null`, the `addons_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.addons_config.new](#fn-addons_confignew) constructor.\n  - `authenticator_groups_config` (`list[obj]`): Configuration for the Google Groups for GKE feature. When `null`, the `authenticator_groups_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.authenticator_groups_config.new](#fn-authenticator_groups_confignew) constructor.\n  - `binary_authorization` (`list[obj]`): Configuration options for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `cluster_autoscaling` (`list[obj]`): Per-cluster configuration of Node Auto-Provisioning with Cluster Autoscaler to automatically adjust the size of the cluster and create/delete node pools based on the current needs of the cluster\u0026#39;s workload. See the guide to using Node Auto-Provisioning for more details. When `null`, the `cluster_autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.cluster_autoscaling.new](#fn-cluster_autoscalingnew) constructor.\n  - `confidential_nodes` (`list[obj]`): Configuration for the confidential nodes feature, which makes nodes run on confidential VMs. Warning: This configuration can\u0026#39;t be changed (or added/removed) after cluster creation without deleting and recreating the entire cluster. When `null`, the `confidential_nodes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.confidential_nodes.new](#fn-confidential_nodesnew) constructor.\n  - `cost_management_config` (`list[obj]`): Cost management configuration for the cluster. When `null`, the `cost_management_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.cost_management_config.new](#fn-cost_management_confignew) constructor.\n  - `database_encryption` (`list[obj]`): Application-layer Secrets Encryption settings. The object format is {state = string, key_name = string}. Valid values of state are: \u0026#34;ENCRYPTED\u0026#34;; \u0026#34;DECRYPTED\u0026#34;. key_name is the name of a CloudKMS key. When `null`, the `database_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.database_encryption.new](#fn-database_encryptionnew) constructor.\n  - `default_snat_status` (`list[obj]`): Whether the cluster disables default in-node sNAT rules. In-node sNAT rules will be disabled when defaultSnatStatus is disabled. When `null`, the `default_snat_status` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.default_snat_status.new](#fn-default_snat_statusnew) constructor.\n  - `dns_config` (`list[obj]`): Configuration for Cloud DNS for Kubernetes Engine. When `null`, the `dns_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.dns_config.new](#fn-dns_confignew) constructor.\n  - `enable_k8s_beta_apis` (`list[obj]`): Configuration for Kubernetes Beta APIs. When `null`, the `enable_k8s_beta_apis` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.enable_k8s_beta_apis.new](#fn-enable_k8s_beta_apisnew) constructor.\n  - `gateway_api_config` (`list[obj]`): Configuration for GKE Gateway API controller. When `null`, the `gateway_api_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.gateway_api_config.new](#fn-gateway_api_confignew) constructor.\n  - `identity_service_config` (`list[obj]`): Configuration for Identity Service which allows customers to use external identity providers with the K8S API. When `null`, the `identity_service_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.identity_service_config.new](#fn-identity_service_confignew) constructor.\n  - `ip_allocation_policy` (`list[obj]`): Configuration of cluster IP allocation for VPC-native clusters. Adding this block enables IP aliasing, making the cluster VPC-native instead of routes-based. When `null`, the `ip_allocation_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.ip_allocation_policy.new](#fn-ip_allocation_policynew) constructor.\n  - `logging_config` (`list[obj]`): Logging configuration for the cluster. When `null`, the `logging_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.logging_config.new](#fn-logging_confignew) constructor.\n  - `maintenance_policy` (`list[obj]`): The maintenance policy to use for the cluster. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.maintenance_policy.new](#fn-maintenance_policynew) constructor.\n  - `master_auth` (`list[obj]`): The authentication information for accessing the Kubernetes master. Some values in this block are only returned by the API if your service account has permission to get credentials for your GKE cluster. If you see an unexpected diff unsetting your client cert, ensure you have the container.clusters.getCredentials permission. When `null`, the `master_auth` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.master_auth.new](#fn-master_authnew) constructor.\n  - `master_authorized_networks_config` (`list[obj]`): The desired configuration options for master authorized networks. Omit the nested cidr_blocks attribute to disallow external access (except the cluster node IPs, which GKE automatically whitelists). When `null`, the `master_authorized_networks_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.master_authorized_networks_config.new](#fn-master_authorized_networks_confignew) constructor.\n  - `mesh_certificates` (`list[obj]`): If set, and enable_certificates=true, the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. When `null`, the `mesh_certificates` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.mesh_certificates.new](#fn-mesh_certificatesnew) constructor.\n  - `monitoring_config` (`list[obj]`): Monitoring configuration for the cluster. When `null`, the `monitoring_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.monitoring_config.new](#fn-monitoring_confignew) constructor.\n  - `network_policy` (`list[obj]`): Configuration options for the NetworkPolicy feature. When `null`, the `network_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.network_policy.new](#fn-network_policynew) constructor.\n  - `node_config` (`list[obj]`): The configuration of the nodepool When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.new](#fn-node_confignew) constructor.\n  - `node_pool` (`list[obj]`): List of node pools associated with this cluster. See google_container_node_pool for schema. Warning: node pools defined inside a cluster can\u0026#39;t be changed (or added/removed) after cluster creation without deleting and recreating the entire cluster. Unless you absolutely need the ability to say \u0026#34;these are the only node pools associated with this cluster\u0026#34;, use the google_container_node_pool resource instead of this property. When `null`, the `node_pool` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.new](#fn-node_poolnew) constructor.\n  - `node_pool_auto_config` (`list[obj]`): Node pool configs that apply to all auto-provisioned node pools in autopilot clusters and node auto-provisioning enabled clusters. When `null`, the `node_pool_auto_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool_auto_config.new](#fn-node_pool_auto_confignew) constructor.\n  - `node_pool_defaults` (`list[obj]`): The default nodel pool settings for the entire cluster. When `null`, the `node_pool_defaults` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool_defaults.new](#fn-node_pool_defaultsnew) constructor.\n  - `notification_config` (`list[obj]`): The notification config for sending cluster upgrade notifications When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.notification_config.new](#fn-notification_confignew) constructor.\n  - `private_cluster_config` (`list[obj]`): Configuration for private clusters, clusters with private nodes. When `null`, the `private_cluster_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.private_cluster_config.new](#fn-private_cluster_confignew) constructor.\n  - `release_channel` (`list[obj]`): Configuration options for the Release channel feature, which provide more control over automatic upgrades of your GKE clusters. Note that removing this field from your config will not unenroll it. Instead, use the \u0026#34;UNSPECIFIED\u0026#34; channel. When `null`, the `release_channel` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.release_channel.new](#fn-release_channelnew) constructor.\n  - `resource_usage_export_config` (`list[obj]`): Configuration for the ResourceUsageExportConfig feature. When `null`, the `resource_usage_export_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.resource_usage_export_config.new](#fn-resource_usage_export_confignew) constructor.\n  - `security_posture_config` (`list[obj]`): Defines the config needed to enable/disable features for the Security Posture API When `null`, the `security_posture_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.security_posture_config.new](#fn-security_posture_confignew) constructor.\n  - `service_external_ips_config` (`list[obj]`): If set, and enabled=true, services with external ips field will not be blocked When `null`, the `service_external_ips_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.service_external_ips_config.new](#fn-service_external_ips_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vertical_pod_autoscaling` (`list[obj]`): Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it. When `null`, the `vertical_pod_autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.vertical_pod_autoscaling.new](#fn-vertical_pod_autoscalingnew) constructor.\n  - `workload_identity_config` (`list[obj]`): Configuration for the use of Kubernetes Service Accounts in GCP IAM policies. When `null`, the `workload_identity_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.workload_identity_config.new](#fn-workload_identity_confignew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -494,10 +502,10 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     datapath_provider=null,
     default_max_pods_per_node=null,
     default_snat_status=null,
+    deletion_protection=null,
     description=null,
     dns_config=null,
     enable_autopilot=null,
-    enable_binary_authorization=null,
     enable_intranode_visibility=null,
     enable_k8s_beta_apis=null,
     enable_kubernetes_alpha=null,
@@ -506,6 +514,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     enable_shielded_nodes=null,
     enable_tpu=null,
     gateway_api_config=null,
+    identity_service_config=null,
     initial_node_count=null,
     ip_allocation_policy=null,
     location=null,
@@ -558,10 +567,10 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       datapath_provider=datapath_provider,
       default_max_pods_per_node=default_max_pods_per_node,
       default_snat_status=default_snat_status,
+      deletion_protection=deletion_protection,
       description=description,
       dns_config=dns_config,
       enable_autopilot=enable_autopilot,
-      enable_binary_authorization=enable_binary_authorization,
       enable_intranode_visibility=enable_intranode_visibility,
       enable_k8s_beta_apis=enable_k8s_beta_apis,
       enable_kubernetes_alpha=enable_kubernetes_alpha,
@@ -570,6 +579,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       enable_shielded_nodes=enable_shielded_nodes,
       enable_tpu=enable_tpu,
       gateway_api_config=gateway_api_config,
+      identity_service_config=identity_service_config,
       initial_node_count=initial_node_count,
       ip_allocation_policy=ip_allocation_policy,
       location=location,
@@ -609,7 +619,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.container_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `container_cluster`\nTerraform resource.\n\nUnlike [google.container_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `allow_net_admin` (`bool`): Enable NET_ADMIN for this cluster. When `null`, the `allow_net_admin` field will be omitted from the resulting object.\n  - `cluster_ipv4_cidr` (`string`): The IP address range of the Kubernetes pods in this cluster in CIDR notation (e.g. 10.96.0.0/14). Leave blank to have one automatically chosen or specify a /14 block in 10.0.0.0/8. This field will only work for routes-based clusters, where ip_allocation_policy is not defined. When `null`, the `cluster_ipv4_cidr` field will be omitted from the resulting object.\n  - `datapath_provider` (`string`): The desired datapath provider for this cluster. By default, uses the IPTables-based kube-proxy implementation. When `null`, the `datapath_provider` field will be omitted from the resulting object.\n  - `default_max_pods_per_node` (`number`): The default maximum number of pods per node in this cluster. This doesn't work on "routes-based" clusters, clusters that don't have IP Aliasing enabled. When `null`, the `default_max_pods_per_node` field will be omitted from the resulting object.\n  - `description` (`string`):  Description of the cluster. When `null`, the `description` field will be omitted from the resulting object.\n  - `enable_autopilot` (`bool`): Enable Autopilot for this cluster. When `null`, the `enable_autopilot` field will be omitted from the resulting object.\n  - `enable_binary_authorization` (`bool`): Enable Binary Authorization for this cluster. If enabled, all container images will be validated by Google Binary Authorization. When `null`, the `enable_binary_authorization` field will be omitted from the resulting object.\n  - `enable_intranode_visibility` (`bool`): Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network. When `null`, the `enable_intranode_visibility` field will be omitted from the resulting object.\n  - `enable_kubernetes_alpha` (`bool`): Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. When `null`, the `enable_kubernetes_alpha` field will be omitted from the resulting object.\n  - `enable_l4_ilb_subsetting` (`bool`): Whether L4ILB Subsetting is enabled for this cluster. When `null`, the `enable_l4_ilb_subsetting` field will be omitted from the resulting object.\n  - `enable_legacy_abac` (`bool`): Whether the ABAC authorizer is enabled for this cluster. When enabled, identities in the system, including service accounts, nodes, and controllers, will have statically granted permissions beyond those provided by the RBAC configuration or IAM. Defaults to false. When `null`, the `enable_legacy_abac` field will be omitted from the resulting object.\n  - `enable_shielded_nodes` (`bool`): Enable Shielded Nodes features on all nodes in this cluster. Defaults to true. When `null`, the `enable_shielded_nodes` field will be omitted from the resulting object.\n  - `enable_tpu` (`bool`): Whether to enable Cloud TPU resources in this cluster. When `null`, the `enable_tpu` field will be omitted from the resulting object.\n  - `initial_node_count` (`number`): The number of nodes to create in this cluster's default node pool. In regional or multi-zonal clusters, this is the number of nodes per zone. Must be set if node_pool is not set. If you're using google_container_node_pool objects with no default node pool, you'll need to set this to a value of at least 1, alongside setting remove_default_node_pool to true. When `null`, the `initial_node_count` field will be omitted from the resulting object.\n  - `location` (`string`): The location (region or zone) in which the cluster master will be created, as well as the default node location. If you specify a zone (such as us-central1-a), the cluster will be a zonal cluster with a single cluster master. If you specify a region (such as us-west1), the cluster will be a regional cluster with multiple masters spread across zones in the region, and with default node locations in those zones as well. When `null`, the `location` field will be omitted from the resulting object.\n  - `logging_service` (`string`): The logging service that the cluster should write logs to. Available options include logging.googleapis.com(Legacy Stackdriver), logging.googleapis.com/kubernetes(Stackdriver Kubernetes Engine Logging), and none. Defaults to logging.googleapis.com/kubernetes. When `null`, the `logging_service` field will be omitted from the resulting object.\n  - `min_master_version` (`string`): The minimum version of the master. GKE will auto-update the master to new versions, so this does not guarantee the current master version--use the read-only master_version field to obtain that. If unset, the cluster's version will be set by GKE to the version of the most recent official release (which is not necessarily the latest version). When `null`, the `min_master_version` field will be omitted from the resulting object.\n  - `monitoring_service` (`string`): The monitoring service that the cluster should write metrics to. Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API. VM metrics will be collected by Google Compute Engine regardless of this setting Available options include monitoring.googleapis.com(Legacy Stackdriver), monitoring.googleapis.com/kubernetes(Stackdriver Kubernetes Engine Monitoring), and none. Defaults to monitoring.googleapis.com/kubernetes. When `null`, the `monitoring_service` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the cluster, unique within the project and location.\n  - `network` (`string`): The name or self_link of the Google Compute Engine network to which the cluster is connected. For Shared VPC, set this to the self link of the shared network. When `null`, the `network` field will be omitted from the resulting object.\n  - `networking_mode` (`string`): Determines whether alias IPs or routes will be used for pod IPs in the cluster. When `null`, the `networking_mode` field will be omitted from the resulting object.\n  - `node_locations` (`list`): The list of zones in which the cluster's nodes are located. Nodes must be in the region of their regional cluster or in the same region as their cluster's zone for zonal clusters. If this is specified for a zonal cluster, omit the cluster's zone. When `null`, the `node_locations` field will be omitted from the resulting object.\n  - `node_version` (`string`): The Kubernetes version on the nodes. Must either be unset or set to the same value as min_master_version on create. Defaults to the default version set by GKE which is not necessarily the latest version. This only affects nodes in the default node pool. While a fuzzy version can be specified, it's recommended that you specify explicit versions as Terraform will see spurious diffs when fuzzy versions are used. See the google_container_engine_versions data source's version_prefix field to approximate fuzzy versions in a Terraform-compatible way. To update nodes in other node pools, use the version attribute on the node pool. When `null`, the `node_version` field will be omitted from the resulting object.\n  - `private_ipv6_google_access` (`string`): The desired state of IPv6 connectivity to Google Services. By default, no private IPv6 access to or from Google Services (all access will be via IPv4). When `null`, the `private_ipv6_google_access` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `remove_default_node_pool` (`bool`): If true, deletes the default node pool upon cluster creation. If you're using google_container_node_pool resources with no default node pool, this should be set to true, alongside setting initial_node_count to at least 1. When `null`, the `remove_default_node_pool` field will be omitted from the resulting object.\n  - `resource_labels` (`obj`): The GCE resource labels (a map of key/value pairs) to be applied to the cluster. When `null`, the `resource_labels` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): The name or self_link of the Google Compute Engine subnetwork in which the cluster's instances are launched. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `addons_config` (`list[obj]`): The configuration for addons supported by GKE. When `null`, the `addons_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.addons_config.new](#fn-addons_confignew) constructor.\n  - `authenticator_groups_config` (`list[obj]`): Configuration for the Google Groups for GKE feature. When `null`, the `authenticator_groups_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.authenticator_groups_config.new](#fn-authenticator_groups_confignew) constructor.\n  - `binary_authorization` (`list[obj]`): Configuration options for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `cluster_autoscaling` (`list[obj]`): Per-cluster configuration of Node Auto-Provisioning with Cluster Autoscaler to automatically adjust the size of the cluster and create/delete node pools based on the current needs of the cluster's workload. See the guide to using Node Auto-Provisioning for more details. When `null`, the `cluster_autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.cluster_autoscaling.new](#fn-cluster_autoscalingnew) constructor.\n  - `confidential_nodes` (`list[obj]`): Configuration for the confidential nodes feature, which makes nodes run on confidential VMs. Warning: This configuration can't be changed (or added/removed) after cluster creation without deleting and recreating the entire cluster. When `null`, the `confidential_nodes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.confidential_nodes.new](#fn-confidential_nodesnew) constructor.\n  - `cost_management_config` (`list[obj]`): Cost management configuration for the cluster. When `null`, the `cost_management_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.cost_management_config.new](#fn-cost_management_confignew) constructor.\n  - `database_encryption` (`list[obj]`): Application-layer Secrets Encryption settings. The object format is {state = string, key_name = string}. Valid values of state are: "ENCRYPTED"; "DECRYPTED". key_name is the name of a CloudKMS key. When `null`, the `database_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.database_encryption.new](#fn-database_encryptionnew) constructor.\n  - `default_snat_status` (`list[obj]`): Whether the cluster disables default in-node sNAT rules. In-node sNAT rules will be disabled when defaultSnatStatus is disabled. When `null`, the `default_snat_status` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.default_snat_status.new](#fn-default_snat_statusnew) constructor.\n  - `dns_config` (`list[obj]`): Configuration for Cloud DNS for Kubernetes Engine. When `null`, the `dns_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.dns_config.new](#fn-dns_confignew) constructor.\n  - `enable_k8s_beta_apis` (`list[obj]`): Configuration for Kubernetes Beta APIs. When `null`, the `enable_k8s_beta_apis` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.enable_k8s_beta_apis.new](#fn-enable_k8s_beta_apisnew) constructor.\n  - `gateway_api_config` (`list[obj]`): Configuration for GKE Gateway API controller. When `null`, the `gateway_api_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.gateway_api_config.new](#fn-gateway_api_confignew) constructor.\n  - `ip_allocation_policy` (`list[obj]`): Configuration of cluster IP allocation for VPC-native clusters. Adding this block enables IP aliasing, making the cluster VPC-native instead of routes-based. When `null`, the `ip_allocation_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.ip_allocation_policy.new](#fn-ip_allocation_policynew) constructor.\n  - `logging_config` (`list[obj]`): Logging configuration for the cluster. When `null`, the `logging_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.logging_config.new](#fn-logging_confignew) constructor.\n  - `maintenance_policy` (`list[obj]`): The maintenance policy to use for the cluster. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.maintenance_policy.new](#fn-maintenance_policynew) constructor.\n  - `master_auth` (`list[obj]`): The authentication information for accessing the Kubernetes master. Some values in this block are only returned by the API if your service account has permission to get credentials for your GKE cluster. If you see an unexpected diff unsetting your client cert, ensure you have the container.clusters.getCredentials permission. When `null`, the `master_auth` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.master_auth.new](#fn-master_authnew) constructor.\n  - `master_authorized_networks_config` (`list[obj]`): The desired configuration options for master authorized networks. Omit the nested cidr_blocks attribute to disallow external access (except the cluster node IPs, which GKE automatically whitelists). When `null`, the `master_authorized_networks_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.master_authorized_networks_config.new](#fn-master_authorized_networks_confignew) constructor.\n  - `mesh_certificates` (`list[obj]`): If set, and enable_certificates=true, the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. When `null`, the `mesh_certificates` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.mesh_certificates.new](#fn-mesh_certificatesnew) constructor.\n  - `monitoring_config` (`list[obj]`): Monitoring configuration for the cluster. When `null`, the `monitoring_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.monitoring_config.new](#fn-monitoring_confignew) constructor.\n  - `network_policy` (`list[obj]`): Configuration options for the NetworkPolicy feature. When `null`, the `network_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.network_policy.new](#fn-network_policynew) constructor.\n  - `node_config` (`list[obj]`): The configuration of the nodepool When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.new](#fn-node_confignew) constructor.\n  - `node_pool` (`list[obj]`): List of node pools associated with this cluster. See google_container_node_pool for schema. Warning: node pools defined inside a cluster can't be changed (or added/removed) after cluster creation without deleting and recreating the entire cluster. Unless you absolutely need the ability to say "these are the only node pools associated with this cluster", use the google_container_node_pool resource instead of this property. When `null`, the `node_pool` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.new](#fn-node_poolnew) constructor.\n  - `node_pool_auto_config` (`list[obj]`): Node pool configs that apply to all auto-provisioned node pools in autopilot clusters and node auto-provisioning enabled clusters. When `null`, the `node_pool_auto_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool_auto_config.new](#fn-node_pool_auto_confignew) constructor.\n  - `node_pool_defaults` (`list[obj]`): The default nodel pool settings for the entire cluster. When `null`, the `node_pool_defaults` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool_defaults.new](#fn-node_pool_defaultsnew) constructor.\n  - `notification_config` (`list[obj]`): The notification config for sending cluster upgrade notifications When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.notification_config.new](#fn-notification_confignew) constructor.\n  - `private_cluster_config` (`list[obj]`): Configuration for private clusters, clusters with private nodes. When `null`, the `private_cluster_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.private_cluster_config.new](#fn-private_cluster_confignew) constructor.\n  - `release_channel` (`list[obj]`): Configuration options for the Release channel feature, which provide more control over automatic upgrades of your GKE clusters. Note that removing this field from your config will not unenroll it. Instead, use the "UNSPECIFIED" channel. When `null`, the `release_channel` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.release_channel.new](#fn-release_channelnew) constructor.\n  - `resource_usage_export_config` (`list[obj]`): Configuration for the ResourceUsageExportConfig feature. When `null`, the `resource_usage_export_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.resource_usage_export_config.new](#fn-resource_usage_export_confignew) constructor.\n  - `security_posture_config` (`list[obj]`): Defines the config needed to enable/disable features for the Security Posture API When `null`, the `security_posture_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.security_posture_config.new](#fn-security_posture_confignew) constructor.\n  - `service_external_ips_config` (`list[obj]`): If set, and enabled=true, services with external ips field will not be blocked When `null`, the `service_external_ips_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.service_external_ips_config.new](#fn-service_external_ips_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vertical_pod_autoscaling` (`list[obj]`): Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it. When `null`, the `vertical_pod_autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.vertical_pod_autoscaling.new](#fn-vertical_pod_autoscalingnew) constructor.\n  - `workload_identity_config` (`list[obj]`): Configuration for the use of Kubernetes Service Accounts in GCP IAM policies. When `null`, the `workload_identity_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.workload_identity_config.new](#fn-workload_identity_confignew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `container_cluster` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.container_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `container_cluster`\nTerraform resource.\n\nUnlike [google.container_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `allow_net_admin` (`bool`): Enable NET_ADMIN for this cluster. When `null`, the `allow_net_admin` field will be omitted from the resulting object.\n  - `cluster_ipv4_cidr` (`string`): The IP address range of the Kubernetes pods in this cluster in CIDR notation (e.g. 10.96.0.0/14). Leave blank to have one automatically chosen or specify a /14 block in 10.0.0.0/8. This field will only work for routes-based clusters, where ip_allocation_policy is not defined. When `null`, the `cluster_ipv4_cidr` field will be omitted from the resulting object.\n  - `datapath_provider` (`string`): The desired datapath provider for this cluster. By default, uses the IPTables-based kube-proxy implementation. When `null`, the `datapath_provider` field will be omitted from the resulting object.\n  - `default_max_pods_per_node` (`number`): The default maximum number of pods per node in this cluster. This doesn't work on "routes-based" clusters, clusters that don't have IP Aliasing enabled. When `null`, the `default_max_pods_per_node` field will be omitted from the resulting object.\n  - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the instance. Defaults to true. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the cluster will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `description` (`string`):  Description of the cluster. When `null`, the `description` field will be omitted from the resulting object.\n  - `enable_autopilot` (`bool`): Enable Autopilot for this cluster. When `null`, the `enable_autopilot` field will be omitted from the resulting object.\n  - `enable_intranode_visibility` (`bool`): Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network. When `null`, the `enable_intranode_visibility` field will be omitted from the resulting object.\n  - `enable_kubernetes_alpha` (`bool`): Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. When `null`, the `enable_kubernetes_alpha` field will be omitted from the resulting object.\n  - `enable_l4_ilb_subsetting` (`bool`): Whether L4ILB Subsetting is enabled for this cluster. When `null`, the `enable_l4_ilb_subsetting` field will be omitted from the resulting object.\n  - `enable_legacy_abac` (`bool`): Whether the ABAC authorizer is enabled for this cluster. When enabled, identities in the system, including service accounts, nodes, and controllers, will have statically granted permissions beyond those provided by the RBAC configuration or IAM. Defaults to false. When `null`, the `enable_legacy_abac` field will be omitted from the resulting object.\n  - `enable_shielded_nodes` (`bool`): Enable Shielded Nodes features on all nodes in this cluster. Defaults to true. When `null`, the `enable_shielded_nodes` field will be omitted from the resulting object.\n  - `enable_tpu` (`bool`): Whether to enable Cloud TPU resources in this cluster. When `null`, the `enable_tpu` field will be omitted from the resulting object.\n  - `initial_node_count` (`number`): The number of nodes to create in this cluster's default node pool. In regional or multi-zonal clusters, this is the number of nodes per zone. Must be set if node_pool is not set. If you're using google_container_node_pool objects with no default node pool, you'll need to set this to a value of at least 1, alongside setting remove_default_node_pool to true. When `null`, the `initial_node_count` field will be omitted from the resulting object.\n  - `location` (`string`): The location (region or zone) in which the cluster master will be created, as well as the default node location. If you specify a zone (such as us-central1-a), the cluster will be a zonal cluster with a single cluster master. If you specify a region (such as us-west1), the cluster will be a regional cluster with multiple masters spread across zones in the region, and with default node locations in those zones as well. When `null`, the `location` field will be omitted from the resulting object.\n  - `logging_service` (`string`): The logging service that the cluster should write logs to. Available options include logging.googleapis.com(Legacy Stackdriver), logging.googleapis.com/kubernetes(Stackdriver Kubernetes Engine Logging), and none. Defaults to logging.googleapis.com/kubernetes. When `null`, the `logging_service` field will be omitted from the resulting object.\n  - `min_master_version` (`string`): The minimum version of the master. GKE will auto-update the master to new versions, so this does not guarantee the current master version--use the read-only master_version field to obtain that. If unset, the cluster's version will be set by GKE to the version of the most recent official release (which is not necessarily the latest version). When `null`, the `min_master_version` field will be omitted from the resulting object.\n  - `monitoring_service` (`string`): The monitoring service that the cluster should write metrics to. Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API. VM metrics will be collected by Google Compute Engine regardless of this setting Available options include monitoring.googleapis.com(Legacy Stackdriver), monitoring.googleapis.com/kubernetes(Stackdriver Kubernetes Engine Monitoring), and none. Defaults to monitoring.googleapis.com/kubernetes. When `null`, the `monitoring_service` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the cluster, unique within the project and location.\n  - `network` (`string`): The name or self_link of the Google Compute Engine network to which the cluster is connected. For Shared VPC, set this to the self link of the shared network. When `null`, the `network` field will be omitted from the resulting object.\n  - `networking_mode` (`string`): Determines whether alias IPs or routes will be used for pod IPs in the cluster. Defaults to VPC_NATIVE for new clusters. When `null`, the `networking_mode` field will be omitted from the resulting object.\n  - `node_locations` (`list`): The list of zones in which the cluster's nodes are located. Nodes must be in the region of their regional cluster or in the same region as their cluster's zone for zonal clusters. If this is specified for a zonal cluster, omit the cluster's zone. When `null`, the `node_locations` field will be omitted from the resulting object.\n  - `node_version` (`string`): The Kubernetes version on the nodes. Must either be unset or set to the same value as min_master_version on create. Defaults to the default version set by GKE which is not necessarily the latest version. This only affects nodes in the default node pool. While a fuzzy version can be specified, it's recommended that you specify explicit versions as Terraform will see spurious diffs when fuzzy versions are used. See the google_container_engine_versions data source's version_prefix field to approximate fuzzy versions in a Terraform-compatible way. To update nodes in other node pools, use the version attribute on the node pool. When `null`, the `node_version` field will be omitted from the resulting object.\n  - `private_ipv6_google_access` (`string`): The desired state of IPv6 connectivity to Google Services. By default, no private IPv6 access to or from Google Services (all access will be via IPv4). When `null`, the `private_ipv6_google_access` field will be omitted from the resulting object.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `remove_default_node_pool` (`bool`): If true, deletes the default node pool upon cluster creation. If you're using google_container_node_pool resources with no default node pool, this should be set to true, alongside setting initial_node_count to at least 1. When `null`, the `remove_default_node_pool` field will be omitted from the resulting object.\n  - `resource_labels` (`obj`): The GCE resource labels (a map of key/value pairs) to be applied to the cluster. When `null`, the `resource_labels` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): The name or self_link of the Google Compute Engine subnetwork in which the cluster's instances are launched. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `addons_config` (`list[obj]`): The configuration for addons supported by GKE. When `null`, the `addons_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.addons_config.new](#fn-addons_confignew) constructor.\n  - `authenticator_groups_config` (`list[obj]`): Configuration for the Google Groups for GKE feature. When `null`, the `authenticator_groups_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.authenticator_groups_config.new](#fn-authenticator_groups_confignew) constructor.\n  - `binary_authorization` (`list[obj]`): Configuration options for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `cluster_autoscaling` (`list[obj]`): Per-cluster configuration of Node Auto-Provisioning with Cluster Autoscaler to automatically adjust the size of the cluster and create/delete node pools based on the current needs of the cluster's workload. See the guide to using Node Auto-Provisioning for more details. When `null`, the `cluster_autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.cluster_autoscaling.new](#fn-cluster_autoscalingnew) constructor.\n  - `confidential_nodes` (`list[obj]`): Configuration for the confidential nodes feature, which makes nodes run on confidential VMs. Warning: This configuration can't be changed (or added/removed) after cluster creation without deleting and recreating the entire cluster. When `null`, the `confidential_nodes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.confidential_nodes.new](#fn-confidential_nodesnew) constructor.\n  - `cost_management_config` (`list[obj]`): Cost management configuration for the cluster. When `null`, the `cost_management_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.cost_management_config.new](#fn-cost_management_confignew) constructor.\n  - `database_encryption` (`list[obj]`): Application-layer Secrets Encryption settings. The object format is {state = string, key_name = string}. Valid values of state are: "ENCRYPTED"; "DECRYPTED". key_name is the name of a CloudKMS key. When `null`, the `database_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.database_encryption.new](#fn-database_encryptionnew) constructor.\n  - `default_snat_status` (`list[obj]`): Whether the cluster disables default in-node sNAT rules. In-node sNAT rules will be disabled when defaultSnatStatus is disabled. When `null`, the `default_snat_status` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.default_snat_status.new](#fn-default_snat_statusnew) constructor.\n  - `dns_config` (`list[obj]`): Configuration for Cloud DNS for Kubernetes Engine. When `null`, the `dns_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.dns_config.new](#fn-dns_confignew) constructor.\n  - `enable_k8s_beta_apis` (`list[obj]`): Configuration for Kubernetes Beta APIs. When `null`, the `enable_k8s_beta_apis` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.enable_k8s_beta_apis.new](#fn-enable_k8s_beta_apisnew) constructor.\n  - `gateway_api_config` (`list[obj]`): Configuration for GKE Gateway API controller. When `null`, the `gateway_api_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.gateway_api_config.new](#fn-gateway_api_confignew) constructor.\n  - `identity_service_config` (`list[obj]`): Configuration for Identity Service which allows customers to use external identity providers with the K8S API. When `null`, the `identity_service_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.identity_service_config.new](#fn-identity_service_confignew) constructor.\n  - `ip_allocation_policy` (`list[obj]`): Configuration of cluster IP allocation for VPC-native clusters. Adding this block enables IP aliasing, making the cluster VPC-native instead of routes-based. When `null`, the `ip_allocation_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.ip_allocation_policy.new](#fn-ip_allocation_policynew) constructor.\n  - `logging_config` (`list[obj]`): Logging configuration for the cluster. When `null`, the `logging_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.logging_config.new](#fn-logging_confignew) constructor.\n  - `maintenance_policy` (`list[obj]`): The maintenance policy to use for the cluster. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.maintenance_policy.new](#fn-maintenance_policynew) constructor.\n  - `master_auth` (`list[obj]`): The authentication information for accessing the Kubernetes master. Some values in this block are only returned by the API if your service account has permission to get credentials for your GKE cluster. If you see an unexpected diff unsetting your client cert, ensure you have the container.clusters.getCredentials permission. When `null`, the `master_auth` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.master_auth.new](#fn-master_authnew) constructor.\n  - `master_authorized_networks_config` (`list[obj]`): The desired configuration options for master authorized networks. Omit the nested cidr_blocks attribute to disallow external access (except the cluster node IPs, which GKE automatically whitelists). When `null`, the `master_authorized_networks_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.master_authorized_networks_config.new](#fn-master_authorized_networks_confignew) constructor.\n  - `mesh_certificates` (`list[obj]`): If set, and enable_certificates=true, the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. When `null`, the `mesh_certificates` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.mesh_certificates.new](#fn-mesh_certificatesnew) constructor.\n  - `monitoring_config` (`list[obj]`): Monitoring configuration for the cluster. When `null`, the `monitoring_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.monitoring_config.new](#fn-monitoring_confignew) constructor.\n  - `network_policy` (`list[obj]`): Configuration options for the NetworkPolicy feature. When `null`, the `network_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.network_policy.new](#fn-network_policynew) constructor.\n  - `node_config` (`list[obj]`): The configuration of the nodepool When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.new](#fn-node_confignew) constructor.\n  - `node_pool` (`list[obj]`): List of node pools associated with this cluster. See google_container_node_pool for schema. Warning: node pools defined inside a cluster can't be changed (or added/removed) after cluster creation without deleting and recreating the entire cluster. Unless you absolutely need the ability to say "these are the only node pools associated with this cluster", use the google_container_node_pool resource instead of this property. When `null`, the `node_pool` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.new](#fn-node_poolnew) constructor.\n  - `node_pool_auto_config` (`list[obj]`): Node pool configs that apply to all auto-provisioned node pools in autopilot clusters and node auto-provisioning enabled clusters. When `null`, the `node_pool_auto_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool_auto_config.new](#fn-node_pool_auto_confignew) constructor.\n  - `node_pool_defaults` (`list[obj]`): The default nodel pool settings for the entire cluster. When `null`, the `node_pool_defaults` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool_defaults.new](#fn-node_pool_defaultsnew) constructor.\n  - `notification_config` (`list[obj]`): The notification config for sending cluster upgrade notifications When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.notification_config.new](#fn-notification_confignew) constructor.\n  - `private_cluster_config` (`list[obj]`): Configuration for private clusters, clusters with private nodes. When `null`, the `private_cluster_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.private_cluster_config.new](#fn-private_cluster_confignew) constructor.\n  - `release_channel` (`list[obj]`): Configuration options for the Release channel feature, which provide more control over automatic upgrades of your GKE clusters. Note that removing this field from your config will not unenroll it. Instead, use the "UNSPECIFIED" channel. When `null`, the `release_channel` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.release_channel.new](#fn-release_channelnew) constructor.\n  - `resource_usage_export_config` (`list[obj]`): Configuration for the ResourceUsageExportConfig feature. When `null`, the `resource_usage_export_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.resource_usage_export_config.new](#fn-resource_usage_export_confignew) constructor.\n  - `security_posture_config` (`list[obj]`): Defines the config needed to enable/disable features for the Security Posture API When `null`, the `security_posture_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.security_posture_config.new](#fn-security_posture_confignew) constructor.\n  - `service_external_ips_config` (`list[obj]`): If set, and enabled=true, services with external ips field will not be blocked When `null`, the `service_external_ips_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.service_external_ips_config.new](#fn-service_external_ips_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vertical_pod_autoscaling` (`list[obj]`): Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it. When `null`, the `vertical_pod_autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.vertical_pod_autoscaling.new](#fn-vertical_pod_autoscalingnew) constructor.\n  - `workload_identity_config` (`list[obj]`): Configuration for the use of Kubernetes Service Accounts in GCP IAM policies. When `null`, the `workload_identity_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.workload_identity_config.new](#fn-workload_identity_confignew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `container_cluster` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     addons_config=null,
@@ -624,10 +634,10 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     datapath_provider=null,
     default_max_pods_per_node=null,
     default_snat_status=null,
+    deletion_protection=null,
     description=null,
     dns_config=null,
     enable_autopilot=null,
-    enable_binary_authorization=null,
     enable_intranode_visibility=null,
     enable_k8s_beta_apis=null,
     enable_kubernetes_alpha=null,
@@ -636,6 +646,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     enable_shielded_nodes=null,
     enable_tpu=null,
     gateway_api_config=null,
+    identity_service_config=null,
     initial_node_count=null,
     ip_allocation_policy=null,
     location=null,
@@ -684,10 +695,10 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     datapath_provider: datapath_provider,
     default_max_pods_per_node: default_max_pods_per_node,
     default_snat_status: default_snat_status,
+    deletion_protection: deletion_protection,
     description: description,
     dns_config: dns_config,
     enable_autopilot: enable_autopilot,
-    enable_binary_authorization: enable_binary_authorization,
     enable_intranode_visibility: enable_intranode_visibility,
     enable_k8s_beta_apis: enable_k8s_beta_apis,
     enable_kubernetes_alpha: enable_kubernetes_alpha,
@@ -696,6 +707,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     enable_shielded_nodes: enable_shielded_nodes,
     enable_tpu: enable_tpu,
     gateway_api_config: gateway_api_config,
+    identity_service_config: identity_service_config,
     initial_node_count: initial_node_count,
     ip_allocation_policy: ip_allocation_policy,
     location: location,
@@ -805,10 +817,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
     linux_node_config:: {
-      '#new':: d.fn(help='\n`google.container_cluster.node_config.linux_node_config.new` constructs a new object with attributes and blocks configured for the `linux_node_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `sysctls` (`obj`): The Linux kernel parameters to be applied to the nodes and all pods running on the nodes.\n\n**Returns**:\n  - An attribute object that represents the `linux_node_config` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.container_cluster.node_config.linux_node_config.new` constructs a new object with attributes and blocks configured for the `linux_node_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `cgroup_mode` (`string`): cgroupMode specifies the cgroup mode to be used on the node. When `null`, the `cgroup_mode` field will be omitted from the resulting object.\n  - `sysctls` (`obj`): The Linux kernel parameters to be applied to the nodes and all pods running on the nodes. When `null`, the `sysctls` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `linux_node_config` sub block.\n', args=[]),
       new(
-        sysctls
+        cgroup_mode=null,
+        sysctls=null
       ):: std.prune(a={
+        cgroup_mode: cgroup_mode,
         sysctls: sysctls,
       }),
     },
@@ -820,7 +834,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         local_ssd_count: local_ssd_count,
       }),
     },
-    '#new':: d.fn(help='\n`google.container_cluster.node_config.new` constructs a new object with attributes and blocks configured for the `node_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `boot_disk_kms_key` (`string`): The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. When `null`, the `boot_disk_kms_key` field will be omitted from the resulting object.\n  - `disk_size_gb` (`number`): Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. When `null`, the `disk_size_gb` field will be omitted from the resulting object.\n  - `disk_type` (`string`): Type of the disk attached to each node. Such as pd-standard, pd-balanced or pd-ssd When `null`, the `disk_type` field will be omitted from the resulting object.\n  - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.\n  - `image_type` (`string`): The image type to use for this node. Note that for a given image type, the latest version of it will be used. When `null`, the `image_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to each node. These will added in addition to any default label(s) that Kubernetes may apply to the node. When `null`, the `labels` field will be omitted from the resulting object.\n  - `local_ssd_count` (`number`): The number of local SSD disks to be attached to the node. When `null`, the `local_ssd_count` field will be omitted from the resulting object.\n  - `logging_variant` (`string`): Type of logging agent that is used as the default value for node pools in the cluster. Valid values include DEFAULT and MAX_THROUGHPUT. When `null`, the `logging_variant` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The name of a Google Compute Engine machine type. When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `metadata` (`obj`): The metadata key/value pairs assigned to instances in the cluster. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): Minimum CPU platform to be used by this instance. The instance may be scheduled on the specified or newer CPU platform. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `node_group` (`string`): Setting this field will assign instances of this pool to run on the specified node group. This is useful for running workloads on sole tenant nodes. When `null`, the `node_group` field will be omitted from the resulting object.\n  - `oauth_scopes` (`list`): The set of Google API scopes to be made available on all of the node VMs. When `null`, the `oauth_scopes` field will be omitted from the resulting object.\n  - `preemptible` (`bool`): Whether the nodes are created as preemptible VM instances. When `null`, the `preemptible` field will be omitted from the resulting object.\n  - `resource_labels` (`obj`): The GCE resource labels (a map of key/value pairs) to be applied to the node pool. When `null`, the `resource_labels` field will be omitted from the resulting object.\n  - `service_account` (`string`): The Google Cloud Platform Service Account to be used by the node VMs. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `spot` (`bool`): Whether the nodes are created as spot VM instances. When `null`, the `spot` field will be omitted from the resulting object.\n  - `tags` (`list`): The list of instance tags applied to all nodes. When `null`, the `tags` field will be omitted from the resulting object.\n  - `taint` (`list`): List of Kubernetes taints to be applied to each node. When `null`, the `taint` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Specifies options for controlling advanced machine features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.advanced_machine_features.new](#fn-node_configadvanced_machine_featuresnew) constructor.\n  - `confidential_nodes` (`list[obj]`): Configuration for the confidential nodes feature, which makes nodes run on confidential VMs. Warning: This configuration can't be changed (or added/removed) after pool creation without deleting and recreating the entire pool. When `null`, the `confidential_nodes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.confidential_nodes.new](#fn-node_configconfidential_nodesnew) constructor.\n  - `ephemeral_storage_local_ssd_config` (`list[obj]`): Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk. When `null`, the `ephemeral_storage_local_ssd_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.ephemeral_storage_local_ssd_config.new](#fn-node_configephemeral_storage_local_ssd_confignew) constructor.\n  - `fast_socket` (`list[obj]`): Enable or disable NCCL Fast Socket in the node pool. When `null`, the `fast_socket` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.fast_socket.new](#fn-node_configfast_socketnew) constructor.\n  - `gcfs_config` (`list[obj]`): GCFS configuration for this node. When `null`, the `gcfs_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.gcfs_config.new](#fn-node_configgcfs_confignew) constructor.\n  - `gvnic` (`list[obj]`): Enable or disable gvnic in the node pool. When `null`, the `gvnic` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.gvnic.new](#fn-node_configgvnicnew) constructor.\n  - `host_maintenance_policy` (`list[obj]`): The maintenance policy for the hosts on which the GKE VMs run on. When `null`, the `host_maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.host_maintenance_policy.new](#fn-node_confighost_maintenance_policynew) constructor.\n  - `kubelet_config` (`list[obj]`): Node kubelet configs. When `null`, the `kubelet_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.kubelet_config.new](#fn-node_configkubelet_confignew) constructor.\n  - `linux_node_config` (`list[obj]`): Parameters that can be configured on Linux nodes. When `null`, the `linux_node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.linux_node_config.new](#fn-node_configlinux_node_confignew) constructor.\n  - `local_nvme_ssd_block_config` (`list[obj]`): Parameters for raw-block local NVMe SSDs. When `null`, the `local_nvme_ssd_block_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.local_nvme_ssd_block_config.new](#fn-node_configlocal_nvme_ssd_block_confignew) constructor.\n  - `reservation_affinity` (`list[obj]`): The reservation affinity configuration for the node pool. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.reservation_affinity.new](#fn-node_configreservation_affinitynew) constructor.\n  - `shielded_instance_config` (`list[obj]`): Shielded Instance options. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.shielded_instance_config.new](#fn-node_configshielded_instance_confignew) constructor.\n  - `sole_tenant_config` (`list[obj]`): Node affinity options for sole tenant node pools. When `null`, the `sole_tenant_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.sole_tenant_config.new](#fn-node_configsole_tenant_confignew) constructor.\n  - `workload_metadata_config` (`list[obj]`): The workload metadata configuration for this node. When `null`, the `workload_metadata_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.workload_metadata_config.new](#fn-node_configworkload_metadata_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `node_config` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.container_cluster.node_config.new` constructs a new object with attributes and blocks configured for the `node_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `boot_disk_kms_key` (`string`): The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. When `null`, the `boot_disk_kms_key` field will be omitted from the resulting object.\n  - `disk_size_gb` (`number`): Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. When `null`, the `disk_size_gb` field will be omitted from the resulting object.\n  - `disk_type` (`string`): Type of the disk attached to each node. Such as pd-standard, pd-balanced or pd-ssd When `null`, the `disk_type` field will be omitted from the resulting object.\n  - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.\n  - `image_type` (`string`): The image type to use for this node. Note that for a given image type, the latest version of it will be used. When `null`, the `image_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to each node. These will added in addition to any default label(s) that Kubernetes may apply to the node. When `null`, the `labels` field will be omitted from the resulting object.\n  - `local_ssd_count` (`number`): The number of local SSD disks to be attached to the node. When `null`, the `local_ssd_count` field will be omitted from the resulting object.\n  - `logging_variant` (`string`): Type of logging agent that is used as the default value for node pools in the cluster. Valid values include DEFAULT and MAX_THROUGHPUT. When `null`, the `logging_variant` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The name of a Google Compute Engine machine type. When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `metadata` (`obj`): The metadata key/value pairs assigned to instances in the cluster. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): Minimum CPU platform to be used by this instance. The instance may be scheduled on the specified or newer CPU platform. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `node_group` (`string`): Setting this field will assign instances of this pool to run on the specified node group. This is useful for running workloads on sole tenant nodes. When `null`, the `node_group` field will be omitted from the resulting object.\n  - `oauth_scopes` (`list`): The set of Google API scopes to be made available on all of the node VMs. When `null`, the `oauth_scopes` field will be omitted from the resulting object.\n  - `preemptible` (`bool`): Whether the nodes are created as preemptible VM instances. When `null`, the `preemptible` field will be omitted from the resulting object.\n  - `resource_labels` (`obj`): The GCE resource labels (a map of key/value pairs) to be applied to the node pool. When `null`, the `resource_labels` field will be omitted from the resulting object.\n  - `service_account` (`string`): The Google Cloud Platform Service Account to be used by the node VMs. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `spot` (`bool`): Whether the nodes are created as spot VM instances. When `null`, the `spot` field will be omitted from the resulting object.\n  - `tags` (`list`): The list of instance tags applied to all nodes. When `null`, the `tags` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Specifies options for controlling advanced machine features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.advanced_machine_features.new](#fn-node_configadvanced_machine_featuresnew) constructor.\n  - `confidential_nodes` (`list[obj]`): Configuration for the confidential nodes feature, which makes nodes run on confidential VMs. Warning: This configuration can't be changed (or added/removed) after pool creation without deleting and recreating the entire pool. When `null`, the `confidential_nodes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.confidential_nodes.new](#fn-node_configconfidential_nodesnew) constructor.\n  - `ephemeral_storage_local_ssd_config` (`list[obj]`): Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk. When `null`, the `ephemeral_storage_local_ssd_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.ephemeral_storage_local_ssd_config.new](#fn-node_configephemeral_storage_local_ssd_confignew) constructor.\n  - `fast_socket` (`list[obj]`): Enable or disable NCCL Fast Socket in the node pool. When `null`, the `fast_socket` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.fast_socket.new](#fn-node_configfast_socketnew) constructor.\n  - `gcfs_config` (`list[obj]`): GCFS configuration for this node. When `null`, the `gcfs_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.gcfs_config.new](#fn-node_configgcfs_confignew) constructor.\n  - `gvnic` (`list[obj]`): Enable or disable gvnic in the node pool. When `null`, the `gvnic` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.gvnic.new](#fn-node_configgvnicnew) constructor.\n  - `host_maintenance_policy` (`list[obj]`): The maintenance policy for the hosts on which the GKE VMs run on. When `null`, the `host_maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.host_maintenance_policy.new](#fn-node_confighost_maintenance_policynew) constructor.\n  - `kubelet_config` (`list[obj]`): Node kubelet configs. When `null`, the `kubelet_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.kubelet_config.new](#fn-node_configkubelet_confignew) constructor.\n  - `linux_node_config` (`list[obj]`): Parameters that can be configured on Linux nodes. When `null`, the `linux_node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.linux_node_config.new](#fn-node_configlinux_node_confignew) constructor.\n  - `local_nvme_ssd_block_config` (`list[obj]`): Parameters for raw-block local NVMe SSDs. When `null`, the `local_nvme_ssd_block_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.local_nvme_ssd_block_config.new](#fn-node_configlocal_nvme_ssd_block_confignew) constructor.\n  - `reservation_affinity` (`list[obj]`): The reservation affinity configuration for the node pool. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.reservation_affinity.new](#fn-node_configreservation_affinitynew) constructor.\n  - `shielded_instance_config` (`list[obj]`): Shielded Instance options. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.shielded_instance_config.new](#fn-node_configshielded_instance_confignew) constructor.\n  - `sole_tenant_config` (`list[obj]`): Node affinity options for sole tenant node pools. When `null`, the `sole_tenant_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.sole_tenant_config.new](#fn-node_configsole_tenant_confignew) constructor.\n  - `taint` (`list[obj]`): List of Kubernetes taints to be applied to each node. When `null`, the `taint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.taint.new](#fn-node_configtaintnew) constructor.\n  - `workload_metadata_config` (`list[obj]`): The workload metadata configuration for this node. When `null`, the `workload_metadata_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.workload_metadata_config.new](#fn-node_configworkload_metadata_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `node_config` sub block.\n', args=[]),
     new(
       advanced_machine_features=null,
       boot_disk_kms_key=null,
@@ -932,6 +946,18 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         }),
       },
     },
+    taint:: {
+      '#new':: d.fn(help='\n`google.container_cluster.node_config.taint.new` constructs a new object with attributes and blocks configured for the `taint`\nTerraform sub block.\n\n\n\n**Args**:\n  - `effect` (`string`): Effect for taint.\n  - `key` (`string`): Key for taint.\n  - `value` (`string`): Value for taint.\n\n**Returns**:\n  - An attribute object that represents the `taint` sub block.\n', args=[]),
+      new(
+        effect,
+        key,
+        value
+      ):: std.prune(a={
+        effect: effect,
+        key: key,
+        value: value,
+      }),
+    },
     workload_metadata_config:: {
       '#new':: d.fn(help='\n`google.container_cluster.node_config.workload_metadata_config.new` constructs a new object with attributes and blocks configured for the `workload_metadata_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `mode` (`string`): Mode is the configuration for how to expose metadata to workloads running on the node.\n\n**Returns**:\n  - An attribute object that represents the `workload_metadata_config` sub block.\n', args=[]),
       new(
@@ -959,7 +985,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
     management:: {
-      '#new':: d.fn(help='\n`google.container_cluster.node_pool.management.new` constructs a new object with attributes and blocks configured for the `management`\nTerraform sub block.\n\n\n\n**Args**:\n  - `auto_repair` (`bool`): Whether the nodes will be automatically repaired. When `null`, the `auto_repair` field will be omitted from the resulting object.\n  - `auto_upgrade` (`bool`): Whether the nodes will be automatically upgraded. When `null`, the `auto_upgrade` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `management` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.container_cluster.node_pool.management.new` constructs a new object with attributes and blocks configured for the `management`\nTerraform sub block.\n\n\n\n**Args**:\n  - `auto_repair` (`bool`): Whether the nodes will be automatically repaired. Enabled by default. When `null`, the `auto_repair` field will be omitted from the resulting object.\n  - `auto_upgrade` (`bool`): Whether the nodes will be automatically upgraded. Enabled by default. When `null`, the `auto_upgrade` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `management` sub block.\n', args=[]),
       new(
         auto_repair=null,
         auto_upgrade=null
@@ -1094,10 +1120,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         }),
       },
       linux_node_config:: {
-        '#new':: d.fn(help='\n`google.container_cluster.node_pool.node_config.linux_node_config.new` constructs a new object with attributes and blocks configured for the `linux_node_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `sysctls` (`obj`): The Linux kernel parameters to be applied to the nodes and all pods running on the nodes.\n\n**Returns**:\n  - An attribute object that represents the `linux_node_config` sub block.\n', args=[]),
+        '#new':: d.fn(help='\n`google.container_cluster.node_pool.node_config.linux_node_config.new` constructs a new object with attributes and blocks configured for the `linux_node_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `cgroup_mode` (`string`): cgroupMode specifies the cgroup mode to be used on the node. When `null`, the `cgroup_mode` field will be omitted from the resulting object.\n  - `sysctls` (`obj`): The Linux kernel parameters to be applied to the nodes and all pods running on the nodes. When `null`, the `sysctls` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `linux_node_config` sub block.\n', args=[]),
         new(
-          sysctls
+          cgroup_mode=null,
+          sysctls=null
         ):: std.prune(a={
+          cgroup_mode: cgroup_mode,
           sysctls: sysctls,
         }),
       },
@@ -1109,7 +1137,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
           local_ssd_count: local_ssd_count,
         }),
       },
-      '#new':: d.fn(help='\n`google.container_cluster.node_pool.node_config.new` constructs a new object with attributes and blocks configured for the `node_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `boot_disk_kms_key` (`string`): The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. When `null`, the `boot_disk_kms_key` field will be omitted from the resulting object.\n  - `disk_size_gb` (`number`): Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. When `null`, the `disk_size_gb` field will be omitted from the resulting object.\n  - `disk_type` (`string`): Type of the disk attached to each node. Such as pd-standard, pd-balanced or pd-ssd When `null`, the `disk_type` field will be omitted from the resulting object.\n  - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.\n  - `image_type` (`string`): The image type to use for this node. Note that for a given image type, the latest version of it will be used. When `null`, the `image_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to each node. These will added in addition to any default label(s) that Kubernetes may apply to the node. When `null`, the `labels` field will be omitted from the resulting object.\n  - `local_ssd_count` (`number`): The number of local SSD disks to be attached to the node. When `null`, the `local_ssd_count` field will be omitted from the resulting object.\n  - `logging_variant` (`string`): Type of logging agent that is used as the default value for node pools in the cluster. Valid values include DEFAULT and MAX_THROUGHPUT. When `null`, the `logging_variant` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The name of a Google Compute Engine machine type. When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `metadata` (`obj`): The metadata key/value pairs assigned to instances in the cluster. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): Minimum CPU platform to be used by this instance. The instance may be scheduled on the specified or newer CPU platform. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `node_group` (`string`): Setting this field will assign instances of this pool to run on the specified node group. This is useful for running workloads on sole tenant nodes. When `null`, the `node_group` field will be omitted from the resulting object.\n  - `oauth_scopes` (`list`): The set of Google API scopes to be made available on all of the node VMs. When `null`, the `oauth_scopes` field will be omitted from the resulting object.\n  - `preemptible` (`bool`): Whether the nodes are created as preemptible VM instances. When `null`, the `preemptible` field will be omitted from the resulting object.\n  - `resource_labels` (`obj`): The GCE resource labels (a map of key/value pairs) to be applied to the node pool. When `null`, the `resource_labels` field will be omitted from the resulting object.\n  - `service_account` (`string`): The Google Cloud Platform Service Account to be used by the node VMs. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `spot` (`bool`): Whether the nodes are created as spot VM instances. When `null`, the `spot` field will be omitted from the resulting object.\n  - `tags` (`list`): The list of instance tags applied to all nodes. When `null`, the `tags` field will be omitted from the resulting object.\n  - `taint` (`list`): List of Kubernetes taints to be applied to each node. When `null`, the `taint` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Specifies options for controlling advanced machine features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.advanced_machine_features.new](#fn-node_poolnode_pooladvanced_machine_featuresnew) constructor.\n  - `confidential_nodes` (`list[obj]`): Configuration for the confidential nodes feature, which makes nodes run on confidential VMs. Warning: This configuration can't be changed (or added/removed) after pool creation without deleting and recreating the entire pool. When `null`, the `confidential_nodes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.confidential_nodes.new](#fn-node_poolnode_poolconfidential_nodesnew) constructor.\n  - `ephemeral_storage_local_ssd_config` (`list[obj]`): Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk. When `null`, the `ephemeral_storage_local_ssd_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.ephemeral_storage_local_ssd_config.new](#fn-node_poolnode_poolephemeral_storage_local_ssd_confignew) constructor.\n  - `fast_socket` (`list[obj]`): Enable or disable NCCL Fast Socket in the node pool. When `null`, the `fast_socket` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.fast_socket.new](#fn-node_poolnode_poolfast_socketnew) constructor.\n  - `gcfs_config` (`list[obj]`): GCFS configuration for this node. When `null`, the `gcfs_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.gcfs_config.new](#fn-node_poolnode_poolgcfs_confignew) constructor.\n  - `gvnic` (`list[obj]`): Enable or disable gvnic in the node pool. When `null`, the `gvnic` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.gvnic.new](#fn-node_poolnode_poolgvnicnew) constructor.\n  - `host_maintenance_policy` (`list[obj]`): The maintenance policy for the hosts on which the GKE VMs run on. When `null`, the `host_maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.host_maintenance_policy.new](#fn-node_poolnode_poolhost_maintenance_policynew) constructor.\n  - `kubelet_config` (`list[obj]`): Node kubelet configs. When `null`, the `kubelet_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.kubelet_config.new](#fn-node_poolnode_poolkubelet_confignew) constructor.\n  - `linux_node_config` (`list[obj]`): Parameters that can be configured on Linux nodes. When `null`, the `linux_node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.linux_node_config.new](#fn-node_poolnode_poollinux_node_confignew) constructor.\n  - `local_nvme_ssd_block_config` (`list[obj]`): Parameters for raw-block local NVMe SSDs. When `null`, the `local_nvme_ssd_block_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.local_nvme_ssd_block_config.new](#fn-node_poolnode_poollocal_nvme_ssd_block_confignew) constructor.\n  - `reservation_affinity` (`list[obj]`): The reservation affinity configuration for the node pool. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.reservation_affinity.new](#fn-node_poolnode_poolreservation_affinitynew) constructor.\n  - `shielded_instance_config` (`list[obj]`): Shielded Instance options. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.shielded_instance_config.new](#fn-node_poolnode_poolshielded_instance_confignew) constructor.\n  - `sole_tenant_config` (`list[obj]`): Node affinity options for sole tenant node pools. When `null`, the `sole_tenant_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.sole_tenant_config.new](#fn-node_poolnode_poolsole_tenant_confignew) constructor.\n  - `workload_metadata_config` (`list[obj]`): The workload metadata configuration for this node. When `null`, the `workload_metadata_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.workload_metadata_config.new](#fn-node_poolnode_poolworkload_metadata_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `node_config` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.container_cluster.node_pool.node_config.new` constructs a new object with attributes and blocks configured for the `node_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `boot_disk_kms_key` (`string`): The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. When `null`, the `boot_disk_kms_key` field will be omitted from the resulting object.\n  - `disk_size_gb` (`number`): Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. When `null`, the `disk_size_gb` field will be omitted from the resulting object.\n  - `disk_type` (`string`): Type of the disk attached to each node. Such as pd-standard, pd-balanced or pd-ssd When `null`, the `disk_type` field will be omitted from the resulting object.\n  - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.\n  - `image_type` (`string`): The image type to use for this node. Note that for a given image type, the latest version of it will be used. When `null`, the `image_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to each node. These will added in addition to any default label(s) that Kubernetes may apply to the node. When `null`, the `labels` field will be omitted from the resulting object.\n  - `local_ssd_count` (`number`): The number of local SSD disks to be attached to the node. When `null`, the `local_ssd_count` field will be omitted from the resulting object.\n  - `logging_variant` (`string`): Type of logging agent that is used as the default value for node pools in the cluster. Valid values include DEFAULT and MAX_THROUGHPUT. When `null`, the `logging_variant` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The name of a Google Compute Engine machine type. When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `metadata` (`obj`): The metadata key/value pairs assigned to instances in the cluster. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): Minimum CPU platform to be used by this instance. The instance may be scheduled on the specified or newer CPU platform. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `node_group` (`string`): Setting this field will assign instances of this pool to run on the specified node group. This is useful for running workloads on sole tenant nodes. When `null`, the `node_group` field will be omitted from the resulting object.\n  - `oauth_scopes` (`list`): The set of Google API scopes to be made available on all of the node VMs. When `null`, the `oauth_scopes` field will be omitted from the resulting object.\n  - `preemptible` (`bool`): Whether the nodes are created as preemptible VM instances. When `null`, the `preemptible` field will be omitted from the resulting object.\n  - `resource_labels` (`obj`): The GCE resource labels (a map of key/value pairs) to be applied to the node pool. When `null`, the `resource_labels` field will be omitted from the resulting object.\n  - `service_account` (`string`): The Google Cloud Platform Service Account to be used by the node VMs. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `spot` (`bool`): Whether the nodes are created as spot VM instances. When `null`, the `spot` field will be omitted from the resulting object.\n  - `tags` (`list`): The list of instance tags applied to all nodes. When `null`, the `tags` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Specifies options for controlling advanced machine features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.advanced_machine_features.new](#fn-node_poolnode_pooladvanced_machine_featuresnew) constructor.\n  - `confidential_nodes` (`list[obj]`): Configuration for the confidential nodes feature, which makes nodes run on confidential VMs. Warning: This configuration can't be changed (or added/removed) after pool creation without deleting and recreating the entire pool. When `null`, the `confidential_nodes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.confidential_nodes.new](#fn-node_poolnode_poolconfidential_nodesnew) constructor.\n  - `ephemeral_storage_local_ssd_config` (`list[obj]`): Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk. When `null`, the `ephemeral_storage_local_ssd_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.ephemeral_storage_local_ssd_config.new](#fn-node_poolnode_poolephemeral_storage_local_ssd_confignew) constructor.\n  - `fast_socket` (`list[obj]`): Enable or disable NCCL Fast Socket in the node pool. When `null`, the `fast_socket` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.fast_socket.new](#fn-node_poolnode_poolfast_socketnew) constructor.\n  - `gcfs_config` (`list[obj]`): GCFS configuration for this node. When `null`, the `gcfs_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.gcfs_config.new](#fn-node_poolnode_poolgcfs_confignew) constructor.\n  - `gvnic` (`list[obj]`): Enable or disable gvnic in the node pool. When `null`, the `gvnic` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.gvnic.new](#fn-node_poolnode_poolgvnicnew) constructor.\n  - `host_maintenance_policy` (`list[obj]`): The maintenance policy for the hosts on which the GKE VMs run on. When `null`, the `host_maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.host_maintenance_policy.new](#fn-node_poolnode_poolhost_maintenance_policynew) constructor.\n  - `kubelet_config` (`list[obj]`): Node kubelet configs. When `null`, the `kubelet_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.kubelet_config.new](#fn-node_poolnode_poolkubelet_confignew) constructor.\n  - `linux_node_config` (`list[obj]`): Parameters that can be configured on Linux nodes. When `null`, the `linux_node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.linux_node_config.new](#fn-node_poolnode_poollinux_node_confignew) constructor.\n  - `local_nvme_ssd_block_config` (`list[obj]`): Parameters for raw-block local NVMe SSDs. When `null`, the `local_nvme_ssd_block_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.local_nvme_ssd_block_config.new](#fn-node_poolnode_poollocal_nvme_ssd_block_confignew) constructor.\n  - `reservation_affinity` (`list[obj]`): The reservation affinity configuration for the node pool. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.reservation_affinity.new](#fn-node_poolnode_poolreservation_affinitynew) constructor.\n  - `shielded_instance_config` (`list[obj]`): Shielded Instance options. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.shielded_instance_config.new](#fn-node_poolnode_poolshielded_instance_confignew) constructor.\n  - `sole_tenant_config` (`list[obj]`): Node affinity options for sole tenant node pools. When `null`, the `sole_tenant_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.sole_tenant_config.new](#fn-node_poolnode_poolsole_tenant_confignew) constructor.\n  - `taint` (`list[obj]`): List of Kubernetes taints to be applied to each node. When `null`, the `taint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.taint.new](#fn-node_poolnode_pooltaintnew) constructor.\n  - `workload_metadata_config` (`list[obj]`): The workload metadata configuration for this node. When `null`, the `workload_metadata_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.workload_metadata_config.new](#fn-node_poolnode_poolworkload_metadata_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `node_config` sub block.\n', args=[]),
       new(
         advanced_machine_features=null,
         boot_disk_kms_key=null,
@@ -1221,6 +1249,18 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
           }),
         },
       },
+      taint:: {
+        '#new':: d.fn(help='\n`google.container_cluster.node_pool.node_config.taint.new` constructs a new object with attributes and blocks configured for the `taint`\nTerraform sub block.\n\n\n\n**Args**:\n  - `effect` (`string`): Effect for taint.\n  - `key` (`string`): Key for taint.\n  - `value` (`string`): Value for taint.\n\n**Returns**:\n  - An attribute object that represents the `taint` sub block.\n', args=[]),
+        new(
+          effect,
+          key,
+          value
+        ):: std.prune(a={
+          effect: effect,
+          key: key,
+          value: value,
+        }),
+      },
       workload_metadata_config:: {
         '#new':: d.fn(help='\n`google.container_cluster.node_pool.node_config.workload_metadata_config.new` constructs a new object with attributes and blocks configured for the `workload_metadata_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `mode` (`string`): Mode is the configuration for how to expose metadata to workloads running on the node.\n\n**Returns**:\n  - An attribute object that represents the `workload_metadata_config` sub block.\n', args=[]),
         new(
@@ -1392,7 +1432,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     }),
   },
   security_posture_config:: {
-    '#new':: d.fn(help='\n`google.container_cluster.security_posture_config.new` constructs a new object with attributes and blocks configured for the `security_posture_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `mode` (`string`): Sets the mode of the Kubernetes security posture API's off-cluster features. Available options include DISABLED and BASIC. When `null`, the `mode` field will be omitted from the resulting object.\n  - `vulnerability_mode` (`string`): Sets the mode of the Kubernetes security posture API's workload vulnerability scanning. Available options include VULNERABILITY_DISABLED and VULNERABILITY_BASIC. When `null`, the `vulnerability_mode` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `security_posture_config` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.container_cluster.security_posture_config.new` constructs a new object with attributes and blocks configured for the `security_posture_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `mode` (`string`): Sets the mode of the Kubernetes security posture API's off-cluster features. Available options include DISABLED and BASIC. When `null`, the `mode` field will be omitted from the resulting object.\n  - `vulnerability_mode` (`string`): Sets the mode of the Kubernetes security posture API's workload vulnerability scanning. Available options include VULNERABILITY_DISABLED, VULNERABILITY_BASIC and VULNERABILITY_ENTERPRISE. When `null`, the `vulnerability_mode` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `security_posture_config` sub block.\n', args=[]),
     new(
       mode=null,
       vulnerability_mode=null
@@ -1631,6 +1671,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withDeletionProtection':: d.fn(help='`google.bool.withDeletionProtection` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the deletion_protection field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `deletion_protection` field.\n', args=[]),
+  withDeletionProtection(resourceLabel, value): {
+    resource+: {
+      google_container_cluster+: {
+        [resourceLabel]+: {
+          deletion_protection: value,
+        },
+      },
+    },
+  },
   '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
   withDescription(resourceLabel, value): {
     resource+: {
@@ -1671,16 +1721,6 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
-  '#withEnableBinaryAuthorization':: d.fn(help='`google.bool.withEnableBinaryAuthorization` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the enable_binary_authorization field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `enable_binary_authorization` field.\n', args=[]),
-  withEnableBinaryAuthorization(resourceLabel, value): {
-    resource+: {
-      google_container_cluster+: {
-        [resourceLabel]+: {
-          enable_binary_authorization: value,
-        },
-      },
-    },
-  },
   '#withEnableIntranodeVisibility':: d.fn(help='`google.bool.withEnableIntranodeVisibility` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the enable_intranode_visibility field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `enable_intranode_visibility` field.\n', args=[]),
   withEnableIntranodeVisibility(resourceLabel, value): {
     resource+: {
@@ -1781,6 +1821,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withIdentityServiceConfig':: d.fn(help='`google.list[obj].withIdentityServiceConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the identity_service_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withIdentityServiceConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `identity_service_config` field.\n', args=[]),
+  withIdentityServiceConfig(resourceLabel, value): {
+    resource+: {
+      google_container_cluster+: {
+        [resourceLabel]+: {
+          identity_service_config: value,
+        },
+      },
+    },
+  },
+  '#withIdentityServiceConfigMixin':: d.fn(help='`google.list[obj].withIdentityServiceConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the identity_service_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withIdentityServiceConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `identity_service_config` field.\n', args=[]),
+  withIdentityServiceConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_container_cluster+: {
+        [resourceLabel]+: {
+          identity_service_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withInitialNodeCount':: d.fn(help='`google.number.withInitialNodeCount` constructs a mixin object that can be merged into the `number`\nTerraform resource block to set or update the initial_node_count field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`number`): The value to set for the `initial_node_count` field.\n', args=[]),
   withInitialNodeCount(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/container_node_pool.libsonnet b/4.x/_gen/resources/container_node_pool.libsonnet
index 606793c4..960ef8bb 100644
--- a/4.x/_gen/resources/container_node_pool.libsonnet
+++ b/4.x/_gen/resources/container_node_pool.libsonnet
@@ -19,7 +19,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     }),
   },
   management:: {
-    '#new':: d.fn(help='\n`google.container_node_pool.management.new` constructs a new object with attributes and blocks configured for the `management`\nTerraform sub block.\n\n\n\n**Args**:\n  - `auto_repair` (`bool`): Whether the nodes will be automatically repaired. When `null`, the `auto_repair` field will be omitted from the resulting object.\n  - `auto_upgrade` (`bool`): Whether the nodes will be automatically upgraded. When `null`, the `auto_upgrade` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `management` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.container_node_pool.management.new` constructs a new object with attributes and blocks configured for the `management`\nTerraform sub block.\n\n\n\n**Args**:\n  - `auto_repair` (`bool`): Whether the nodes will be automatically repaired. Enabled by default. When `null`, the `auto_repair` field will be omitted from the resulting object.\n  - `auto_upgrade` (`bool`): Whether the nodes will be automatically upgraded. Enabled by default. When `null`, the `auto_upgrade` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `management` sub block.\n', args=[]),
     new(
       auto_repair=null,
       auto_upgrade=null
@@ -207,10 +207,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
     linux_node_config:: {
-      '#new':: d.fn(help='\n`google.container_node_pool.node_config.linux_node_config.new` constructs a new object with attributes and blocks configured for the `linux_node_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `sysctls` (`obj`): The Linux kernel parameters to be applied to the nodes and all pods running on the nodes.\n\n**Returns**:\n  - An attribute object that represents the `linux_node_config` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.container_node_pool.node_config.linux_node_config.new` constructs a new object with attributes and blocks configured for the `linux_node_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `cgroup_mode` (`string`): cgroupMode specifies the cgroup mode to be used on the node. When `null`, the `cgroup_mode` field will be omitted from the resulting object.\n  - `sysctls` (`obj`): The Linux kernel parameters to be applied to the nodes and all pods running on the nodes. When `null`, the `sysctls` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `linux_node_config` sub block.\n', args=[]),
       new(
-        sysctls
+        cgroup_mode=null,
+        sysctls=null
       ):: std.prune(a={
+        cgroup_mode: cgroup_mode,
         sysctls: sysctls,
       }),
     },
@@ -222,7 +224,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         local_ssd_count: local_ssd_count,
       }),
     },
-    '#new':: d.fn(help='\n`google.container_node_pool.node_config.new` constructs a new object with attributes and blocks configured for the `node_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `boot_disk_kms_key` (`string`): The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. When `null`, the `boot_disk_kms_key` field will be omitted from the resulting object.\n  - `disk_size_gb` (`number`): Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. When `null`, the `disk_size_gb` field will be omitted from the resulting object.\n  - `disk_type` (`string`): Type of the disk attached to each node. Such as pd-standard, pd-balanced or pd-ssd When `null`, the `disk_type` field will be omitted from the resulting object.\n  - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.\n  - `image_type` (`string`): The image type to use for this node. Note that for a given image type, the latest version of it will be used. When `null`, the `image_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to each node. These will added in addition to any default label(s) that Kubernetes may apply to the node. When `null`, the `labels` field will be omitted from the resulting object.\n  - `local_ssd_count` (`number`): The number of local SSD disks to be attached to the node. When `null`, the `local_ssd_count` field will be omitted from the resulting object.\n  - `logging_variant` (`string`): Type of logging agent that is used as the default value for node pools in the cluster. Valid values include DEFAULT and MAX_THROUGHPUT. When `null`, the `logging_variant` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The name of a Google Compute Engine machine type. When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `metadata` (`obj`): The metadata key/value pairs assigned to instances in the cluster. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): Minimum CPU platform to be used by this instance. The instance may be scheduled on the specified or newer CPU platform. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `node_group` (`string`): Setting this field will assign instances of this pool to run on the specified node group. This is useful for running workloads on sole tenant nodes. When `null`, the `node_group` field will be omitted from the resulting object.\n  - `oauth_scopes` (`list`): The set of Google API scopes to be made available on all of the node VMs. When `null`, the `oauth_scopes` field will be omitted from the resulting object.\n  - `preemptible` (`bool`): Whether the nodes are created as preemptible VM instances. When `null`, the `preemptible` field will be omitted from the resulting object.\n  - `resource_labels` (`obj`): The GCE resource labels (a map of key/value pairs) to be applied to the node pool. When `null`, the `resource_labels` field will be omitted from the resulting object.\n  - `service_account` (`string`): The Google Cloud Platform Service Account to be used by the node VMs. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `spot` (`bool`): Whether the nodes are created as spot VM instances. When `null`, the `spot` field will be omitted from the resulting object.\n  - `tags` (`list`): The list of instance tags applied to all nodes. When `null`, the `tags` field will be omitted from the resulting object.\n  - `taint` (`list`): List of Kubernetes taints to be applied to each node. When `null`, the `taint` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Specifies options for controlling advanced machine features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.advanced_machine_features.new](#fn-node_configadvanced_machine_featuresnew) constructor.\n  - `confidential_nodes` (`list[obj]`): Configuration for the confidential nodes feature, which makes nodes run on confidential VMs. Warning: This configuration can't be changed (or added/removed) after pool creation without deleting and recreating the entire pool. When `null`, the `confidential_nodes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.confidential_nodes.new](#fn-node_configconfidential_nodesnew) constructor.\n  - `ephemeral_storage_local_ssd_config` (`list[obj]`): Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk. When `null`, the `ephemeral_storage_local_ssd_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.ephemeral_storage_local_ssd_config.new](#fn-node_configephemeral_storage_local_ssd_confignew) constructor.\n  - `fast_socket` (`list[obj]`): Enable or disable NCCL Fast Socket in the node pool. When `null`, the `fast_socket` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.fast_socket.new](#fn-node_configfast_socketnew) constructor.\n  - `gcfs_config` (`list[obj]`): GCFS configuration for this node. When `null`, the `gcfs_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.gcfs_config.new](#fn-node_configgcfs_confignew) constructor.\n  - `gvnic` (`list[obj]`): Enable or disable gvnic in the node pool. When `null`, the `gvnic` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.gvnic.new](#fn-node_configgvnicnew) constructor.\n  - `host_maintenance_policy` (`list[obj]`): The maintenance policy for the hosts on which the GKE VMs run on. When `null`, the `host_maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.host_maintenance_policy.new](#fn-node_confighost_maintenance_policynew) constructor.\n  - `kubelet_config` (`list[obj]`): Node kubelet configs. When `null`, the `kubelet_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.kubelet_config.new](#fn-node_configkubelet_confignew) constructor.\n  - `linux_node_config` (`list[obj]`): Parameters that can be configured on Linux nodes. When `null`, the `linux_node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.linux_node_config.new](#fn-node_configlinux_node_confignew) constructor.\n  - `local_nvme_ssd_block_config` (`list[obj]`): Parameters for raw-block local NVMe SSDs. When `null`, the `local_nvme_ssd_block_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.local_nvme_ssd_block_config.new](#fn-node_configlocal_nvme_ssd_block_confignew) constructor.\n  - `reservation_affinity` (`list[obj]`): The reservation affinity configuration for the node pool. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.reservation_affinity.new](#fn-node_configreservation_affinitynew) constructor.\n  - `shielded_instance_config` (`list[obj]`): Shielded Instance options. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.shielded_instance_config.new](#fn-node_configshielded_instance_confignew) constructor.\n  - `sole_tenant_config` (`list[obj]`): Node affinity options for sole tenant node pools. When `null`, the `sole_tenant_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.sole_tenant_config.new](#fn-node_configsole_tenant_confignew) constructor.\n  - `workload_metadata_config` (`list[obj]`): The workload metadata configuration for this node. When `null`, the `workload_metadata_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.workload_metadata_config.new](#fn-node_configworkload_metadata_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `node_config` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.container_node_pool.node_config.new` constructs a new object with attributes and blocks configured for the `node_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `boot_disk_kms_key` (`string`): The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. When `null`, the `boot_disk_kms_key` field will be omitted from the resulting object.\n  - `disk_size_gb` (`number`): Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. When `null`, the `disk_size_gb` field will be omitted from the resulting object.\n  - `disk_type` (`string`): Type of the disk attached to each node. Such as pd-standard, pd-balanced or pd-ssd When `null`, the `disk_type` field will be omitted from the resulting object.\n  - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.\n  - `image_type` (`string`): The image type to use for this node. Note that for a given image type, the latest version of it will be used. When `null`, the `image_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to each node. These will added in addition to any default label(s) that Kubernetes may apply to the node. When `null`, the `labels` field will be omitted from the resulting object.\n  - `local_ssd_count` (`number`): The number of local SSD disks to be attached to the node. When `null`, the `local_ssd_count` field will be omitted from the resulting object.\n  - `logging_variant` (`string`): Type of logging agent that is used as the default value for node pools in the cluster. Valid values include DEFAULT and MAX_THROUGHPUT. When `null`, the `logging_variant` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The name of a Google Compute Engine machine type. When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `metadata` (`obj`): The metadata key/value pairs assigned to instances in the cluster. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): Minimum CPU platform to be used by this instance. The instance may be scheduled on the specified or newer CPU platform. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `node_group` (`string`): Setting this field will assign instances of this pool to run on the specified node group. This is useful for running workloads on sole tenant nodes. When `null`, the `node_group` field will be omitted from the resulting object.\n  - `oauth_scopes` (`list`): The set of Google API scopes to be made available on all of the node VMs. When `null`, the `oauth_scopes` field will be omitted from the resulting object.\n  - `preemptible` (`bool`): Whether the nodes are created as preemptible VM instances. When `null`, the `preemptible` field will be omitted from the resulting object.\n  - `resource_labels` (`obj`): The GCE resource labels (a map of key/value pairs) to be applied to the node pool. When `null`, the `resource_labels` field will be omitted from the resulting object.\n  - `service_account` (`string`): The Google Cloud Platform Service Account to be used by the node VMs. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `spot` (`bool`): Whether the nodes are created as spot VM instances. When `null`, the `spot` field will be omitted from the resulting object.\n  - `tags` (`list`): The list of instance tags applied to all nodes. When `null`, the `tags` field will be omitted from the resulting object.\n  - `advanced_machine_features` (`list[obj]`): Specifies options for controlling advanced machine features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.advanced_machine_features.new](#fn-node_configadvanced_machine_featuresnew) constructor.\n  - `confidential_nodes` (`list[obj]`): Configuration for the confidential nodes feature, which makes nodes run on confidential VMs. Warning: This configuration can't be changed (or added/removed) after pool creation without deleting and recreating the entire pool. When `null`, the `confidential_nodes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.confidential_nodes.new](#fn-node_configconfidential_nodesnew) constructor.\n  - `ephemeral_storage_local_ssd_config` (`list[obj]`): Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk. When `null`, the `ephemeral_storage_local_ssd_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.ephemeral_storage_local_ssd_config.new](#fn-node_configephemeral_storage_local_ssd_confignew) constructor.\n  - `fast_socket` (`list[obj]`): Enable or disable NCCL Fast Socket in the node pool. When `null`, the `fast_socket` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.fast_socket.new](#fn-node_configfast_socketnew) constructor.\n  - `gcfs_config` (`list[obj]`): GCFS configuration for this node. When `null`, the `gcfs_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.gcfs_config.new](#fn-node_configgcfs_confignew) constructor.\n  - `gvnic` (`list[obj]`): Enable or disable gvnic in the node pool. When `null`, the `gvnic` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.gvnic.new](#fn-node_configgvnicnew) constructor.\n  - `host_maintenance_policy` (`list[obj]`): The maintenance policy for the hosts on which the GKE VMs run on. When `null`, the `host_maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.host_maintenance_policy.new](#fn-node_confighost_maintenance_policynew) constructor.\n  - `kubelet_config` (`list[obj]`): Node kubelet configs. When `null`, the `kubelet_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.kubelet_config.new](#fn-node_configkubelet_confignew) constructor.\n  - `linux_node_config` (`list[obj]`): Parameters that can be configured on Linux nodes. When `null`, the `linux_node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.linux_node_config.new](#fn-node_configlinux_node_confignew) constructor.\n  - `local_nvme_ssd_block_config` (`list[obj]`): Parameters for raw-block local NVMe SSDs. When `null`, the `local_nvme_ssd_block_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.local_nvme_ssd_block_config.new](#fn-node_configlocal_nvme_ssd_block_confignew) constructor.\n  - `reservation_affinity` (`list[obj]`): The reservation affinity configuration for the node pool. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.reservation_affinity.new](#fn-node_configreservation_affinitynew) constructor.\n  - `shielded_instance_config` (`list[obj]`): Shielded Instance options. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.shielded_instance_config.new](#fn-node_configshielded_instance_confignew) constructor.\n  - `sole_tenant_config` (`list[obj]`): Node affinity options for sole tenant node pools. When `null`, the `sole_tenant_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.sole_tenant_config.new](#fn-node_configsole_tenant_confignew) constructor.\n  - `taint` (`list[obj]`): List of Kubernetes taints to be applied to each node. When `null`, the `taint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.taint.new](#fn-node_configtaintnew) constructor.\n  - `workload_metadata_config` (`list[obj]`): The workload metadata configuration for this node. When `null`, the `workload_metadata_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.workload_metadata_config.new](#fn-node_configworkload_metadata_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `node_config` sub block.\n', args=[]),
     new(
       advanced_machine_features=null,
       boot_disk_kms_key=null,
@@ -334,6 +336,18 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         }),
       },
     },
+    taint:: {
+      '#new':: d.fn(help='\n`google.container_node_pool.node_config.taint.new` constructs a new object with attributes and blocks configured for the `taint`\nTerraform sub block.\n\n\n\n**Args**:\n  - `effect` (`string`): Effect for taint.\n  - `key` (`string`): Key for taint.\n  - `value` (`string`): Value for taint.\n\n**Returns**:\n  - An attribute object that represents the `taint` sub block.\n', args=[]),
+      new(
+        effect,
+        key,
+        value
+      ):: std.prune(a={
+        effect: effect,
+        key: key,
+        value: value,
+      }),
+    },
     workload_metadata_config:: {
       '#new':: d.fn(help='\n`google.container_node_pool.node_config.workload_metadata_config.new` constructs a new object with attributes and blocks configured for the `workload_metadata_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `mode` (`string`): Mode is the configuration for how to expose metadata to workloads running on the node.\n\n**Returns**:\n  - An attribute object that represents the `workload_metadata_config` sub block.\n', args=[]),
       new(
diff --git a/4.x/_gen/resources/data_fusion_instance.libsonnet b/4.x/_gen/resources/data_fusion_instance.libsonnet
index cc535cb0..6420f7bb 100644
--- a/4.x/_gen/resources/data_fusion_instance.libsonnet
+++ b/4.x/_gen/resources/data_fusion_instance.libsonnet
@@ -40,7 +40,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       network: network,
     }),
   },
-  '#new':: d.fn(help="\n`google.data_fusion_instance.new` injects a new `google_data_fusion_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data_fusion_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data_fusion_instance` using the reference:\n\n    $._ref.google_data_fusion_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_data_fusion_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `dataproc_service_account` (`string`): User-managed service account to set on Dataproc when Cloud Data Fusion creates Dataproc to run data processing pipelines. When `null`, the `dataproc_service_account` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of the instance. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Display name for an instance. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `enable_rbac` (`bool`): Option to enable granular role-based access control. When `null`, the `enable_rbac` field will be omitted from the resulting object.\n  - `enable_stackdriver_logging` (`bool`): Option to enable Stackdriver Logging. When `null`, the `enable_stackdriver_logging` field will be omitted from the resulting object.\n  - `enable_stackdriver_monitoring` (`bool`): Option to enable Stackdriver Monitoring. When `null`, the `enable_stackdriver_monitoring` field will be omitted from the resulting object.\n  - `labels` (`obj`): The resource labels for instance to use to annotate any related underlying resources,\nsuch as Compute Engine VMs. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The ID of the instance or a fully qualified identifier for the instance.\n  - `options` (`obj`): Map of additional options used to configure the behavior of Data Fusion instance. When `null`, the `options` field will be omitted from the resulting object.\n  - `private_instance` (`bool`): Specifies whether the Data Fusion instance should be private. If set to\ntrue, all Data Fusion nodes will have private IP addresses and will not be\nable to access the public internet. When `null`, the `private_instance` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the Data Fusion instance. When `null`, the `region` field will be omitted from the resulting object.\n  - `type` (`string`): Represents the type of Data Fusion instance. Each type is configured with\nthe default settings for processing and memory.\n- BASIC: Basic Data Fusion instance. In Basic type, the user will be able to create data pipelines\nusing point and click UI. However, there are certain limitations, such as fewer number\nof concurrent pipelines, no support for streaming pipelines, etc.\n- ENTERPRISE: Enterprise Data Fusion instance. In Enterprise type, the user will have more features\navailable, such as support for streaming pipelines, higher number of concurrent pipelines, etc.\n- DEVELOPER: Developer Data Fusion instance. In Developer type, the user will have all features available but\nwith restrictive capabilities. This is to help enterprises design and develop their data ingestion and integration\npipelines at low cost. Possible values: [\u0026#34;BASIC\u0026#34;, \u0026#34;ENTERPRISE\u0026#34;, \u0026#34;DEVELOPER\u0026#34;]\n  - `version` (`string`): Current version of the Data Fusion. When `null`, the `version` field will be omitted from the resulting object.\n  - `zone` (`string`): Name of the zone in which the Data Fusion instance will be created. Only DEVELOPER instances use this field. When `null`, the `zone` field will be omitted from the resulting object.\n  - `accelerators` (`list[obj]`): List of accelerators enabled for this CDF instance.\n\nIf accelerators are enabled it is possible a permadiff will be created with the Options field.\nUsers will need to either manually update their state file to include these diffed options, or include the field in a [lifecycle ignore changes block](https://developer.hashicorp.com/terraform/language/meta-arguments/lifecycle#ignore_changes). When `null`, the `accelerators` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.accelerators.new](#fn-acceleratorsnew) constructor.\n  - `crypto_key_config` (`list[obj]`): The crypto key configuration. This field is used by the Customer-Managed Encryption Keys (CMEK) feature. When `null`, the `crypto_key_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.crypto_key_config.new](#fn-crypto_key_confignew) constructor.\n  - `event_publish_config` (`list[obj]`): Option to enable and pass metadata for event publishing. When `null`, the `event_publish_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.event_publish_config.new](#fn-event_publish_confignew) constructor.\n  - `network_config` (`list[obj]`): Network configuration options. These are required when a private Data Fusion instance is to be created. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.network_config.new](#fn-network_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.data_fusion_instance.new` injects a new `google_data_fusion_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.data_fusion_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.data_fusion_instance` using the reference:\n\n    $._ref.google_data_fusion_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_data_fusion_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `dataproc_service_account` (`string`): User-managed service account to set on Dataproc when Cloud Data Fusion creates Dataproc to run data processing pipelines. When `null`, the `dataproc_service_account` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of the instance. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Display name for an instance. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `enable_rbac` (`bool`): Option to enable granular role-based access control. When `null`, the `enable_rbac` field will be omitted from the resulting object.\n  - `enable_stackdriver_logging` (`bool`): Option to enable Stackdriver Logging. When `null`, the `enable_stackdriver_logging` field will be omitted from the resulting object.\n  - `enable_stackdriver_monitoring` (`bool`): Option to enable Stackdriver Monitoring. When `null`, the `enable_stackdriver_monitoring` field will be omitted from the resulting object.\n  - `labels` (`obj`): The resource labels for instance to use to annotate any related underlying resources,\nsuch as Compute Engine VMs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The ID of the instance or a fully qualified identifier for the instance.\n  - `options` (`obj`): Map of additional options used to configure the behavior of Data Fusion instance. When `null`, the `options` field will be omitted from the resulting object.\n  - `private_instance` (`bool`): Specifies whether the Data Fusion instance should be private. If set to\ntrue, all Data Fusion nodes will have private IP addresses and will not be\nable to access the public internet. When `null`, the `private_instance` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the Data Fusion instance. When `null`, the `region` field will be omitted from the resulting object.\n  - `type` (`string`): Represents the type of Data Fusion instance. Each type is configured with\nthe default settings for processing and memory.\n- BASIC: Basic Data Fusion instance. In Basic type, the user will be able to create data pipelines\nusing point and click UI. However, there are certain limitations, such as fewer number\nof concurrent pipelines, no support for streaming pipelines, etc.\n- ENTERPRISE: Enterprise Data Fusion instance. In Enterprise type, the user will have more features\navailable, such as support for streaming pipelines, higher number of concurrent pipelines, etc.\n- DEVELOPER: Developer Data Fusion instance. In Developer type, the user will have all features available but\nwith restrictive capabilities. This is to help enterprises design and develop their data ingestion and integration\npipelines at low cost. Possible values: [\u0026#34;BASIC\u0026#34;, \u0026#34;ENTERPRISE\u0026#34;, \u0026#34;DEVELOPER\u0026#34;]\n  - `version` (`string`): Current version of the Data Fusion. When `null`, the `version` field will be omitted from the resulting object.\n  - `zone` (`string`): Name of the zone in which the Data Fusion instance will be created. Only DEVELOPER instances use this field. When `null`, the `zone` field will be omitted from the resulting object.\n  - `accelerators` (`list[obj]`): List of accelerators enabled for this CDF instance.\n\nIf accelerators are enabled it is possible a permadiff will be created with the Options field.\nUsers will need to either manually update their state file to include these diffed options, or include the field in a [lifecycle ignore changes block](https://developer.hashicorp.com/terraform/language/meta-arguments/lifecycle#ignore_changes). When `null`, the `accelerators` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.accelerators.new](#fn-acceleratorsnew) constructor.\n  - `crypto_key_config` (`list[obj]`): The crypto key configuration. This field is used by the Customer-Managed Encryption Keys (CMEK) feature. When `null`, the `crypto_key_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.crypto_key_config.new](#fn-crypto_key_confignew) constructor.\n  - `event_publish_config` (`list[obj]`): Option to enable and pass metadata for event publishing. When `null`, the `event_publish_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.event_publish_config.new](#fn-event_publish_confignew) constructor.\n  - `network_config` (`list[obj]`): Network configuration options. These are required when a private Data Fusion instance is to be created. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.network_config.new](#fn-network_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -91,7 +91,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.data_fusion_instance.newAttrs` constructs a new object with attributes and blocks configured for the `data_fusion_instance`\nTerraform resource.\n\nUnlike [google.data_fusion_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `dataproc_service_account` (`string`): User-managed service account to set on Dataproc when Cloud Data Fusion creates Dataproc to run data processing pipelines. When `null`, the `dataproc_service_account` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of the instance. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Display name for an instance. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `enable_rbac` (`bool`): Option to enable granular role-based access control. When `null`, the `enable_rbac` field will be omitted from the resulting object.\n  - `enable_stackdriver_logging` (`bool`): Option to enable Stackdriver Logging. When `null`, the `enable_stackdriver_logging` field will be omitted from the resulting object.\n  - `enable_stackdriver_monitoring` (`bool`): Option to enable Stackdriver Monitoring. When `null`, the `enable_stackdriver_monitoring` field will be omitted from the resulting object.\n  - `labels` (`obj`): The resource labels for instance to use to annotate any related underlying resources,\nsuch as Compute Engine VMs. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The ID of the instance or a fully qualified identifier for the instance.\n  - `options` (`obj`): Map of additional options used to configure the behavior of Data Fusion instance. When `null`, the `options` field will be omitted from the resulting object.\n  - `private_instance` (`bool`): Specifies whether the Data Fusion instance should be private. If set to\ntrue, all Data Fusion nodes will have private IP addresses and will not be\nable to access the public internet. When `null`, the `private_instance` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the Data Fusion instance. When `null`, the `region` field will be omitted from the resulting object.\n  - `type` (`string`): Represents the type of Data Fusion instance. Each type is configured with\nthe default settings for processing and memory.\n- BASIC: Basic Data Fusion instance. In Basic type, the user will be able to create data pipelines\nusing point and click UI. However, there are certain limitations, such as fewer number\nof concurrent pipelines, no support for streaming pipelines, etc.\n- ENTERPRISE: Enterprise Data Fusion instance. In Enterprise type, the user will have more features\navailable, such as support for streaming pipelines, higher number of concurrent pipelines, etc.\n- DEVELOPER: Developer Data Fusion instance. In Developer type, the user will have all features available but\nwith restrictive capabilities. This is to help enterprises design and develop their data ingestion and integration\npipelines at low cost. Possible values: ["BASIC", "ENTERPRISE", "DEVELOPER"]\n  - `version` (`string`): Current version of the Data Fusion. When `null`, the `version` field will be omitted from the resulting object.\n  - `zone` (`string`): Name of the zone in which the Data Fusion instance will be created. Only DEVELOPER instances use this field. When `null`, the `zone` field will be omitted from the resulting object.\n  - `accelerators` (`list[obj]`): List of accelerators enabled for this CDF instance.\n\nIf accelerators are enabled it is possible a permadiff will be created with the Options field.\nUsers will need to either manually update their state file to include these diffed options, or include the field in a [lifecycle ignore changes block](https://developer.hashicorp.com/terraform/language/meta-arguments/lifecycle#ignore_changes). When `null`, the `accelerators` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.accelerators.new](#fn-acceleratorsnew) constructor.\n  - `crypto_key_config` (`list[obj]`): The crypto key configuration. This field is used by the Customer-Managed Encryption Keys (CMEK) feature. When `null`, the `crypto_key_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.crypto_key_config.new](#fn-crypto_key_confignew) constructor.\n  - `event_publish_config` (`list[obj]`): Option to enable and pass metadata for event publishing. When `null`, the `event_publish_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.event_publish_config.new](#fn-event_publish_confignew) constructor.\n  - `network_config` (`list[obj]`): Network configuration options. These are required when a private Data Fusion instance is to be created. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.network_config.new](#fn-network_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `data_fusion_instance` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.data_fusion_instance.newAttrs` constructs a new object with attributes and blocks configured for the `data_fusion_instance`\nTerraform resource.\n\nUnlike [google.data_fusion_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `dataproc_service_account` (`string`): User-managed service account to set on Dataproc when Cloud Data Fusion creates Dataproc to run data processing pipelines. When `null`, the `dataproc_service_account` field will be omitted from the resulting object.\n  - `description` (`string`): An optional description of the instance. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Display name for an instance. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `enable_rbac` (`bool`): Option to enable granular role-based access control. When `null`, the `enable_rbac` field will be omitted from the resulting object.\n  - `enable_stackdriver_logging` (`bool`): Option to enable Stackdriver Logging. When `null`, the `enable_stackdriver_logging` field will be omitted from the resulting object.\n  - `enable_stackdriver_monitoring` (`bool`): Option to enable Stackdriver Monitoring. When `null`, the `enable_stackdriver_monitoring` field will be omitted from the resulting object.\n  - `labels` (`obj`): The resource labels for instance to use to annotate any related underlying resources,\nsuch as Compute Engine VMs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The ID of the instance or a fully qualified identifier for the instance.\n  - `options` (`obj`): Map of additional options used to configure the behavior of Data Fusion instance. When `null`, the `options` field will be omitted from the resulting object.\n  - `private_instance` (`bool`): Specifies whether the Data Fusion instance should be private. If set to\ntrue, all Data Fusion nodes will have private IP addresses and will not be\nable to access the public internet. When `null`, the `private_instance` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the Data Fusion instance. When `null`, the `region` field will be omitted from the resulting object.\n  - `type` (`string`): Represents the type of Data Fusion instance. Each type is configured with\nthe default settings for processing and memory.\n- BASIC: Basic Data Fusion instance. In Basic type, the user will be able to create data pipelines\nusing point and click UI. However, there are certain limitations, such as fewer number\nof concurrent pipelines, no support for streaming pipelines, etc.\n- ENTERPRISE: Enterprise Data Fusion instance. In Enterprise type, the user will have more features\navailable, such as support for streaming pipelines, higher number of concurrent pipelines, etc.\n- DEVELOPER: Developer Data Fusion instance. In Developer type, the user will have all features available but\nwith restrictive capabilities. This is to help enterprises design and develop their data ingestion and integration\npipelines at low cost. Possible values: ["BASIC", "ENTERPRISE", "DEVELOPER"]\n  - `version` (`string`): Current version of the Data Fusion. When `null`, the `version` field will be omitted from the resulting object.\n  - `zone` (`string`): Name of the zone in which the Data Fusion instance will be created. Only DEVELOPER instances use this field. When `null`, the `zone` field will be omitted from the resulting object.\n  - `accelerators` (`list[obj]`): List of accelerators enabled for this CDF instance.\n\nIf accelerators are enabled it is possible a permadiff will be created with the Options field.\nUsers will need to either manually update their state file to include these diffed options, or include the field in a [lifecycle ignore changes block](https://developer.hashicorp.com/terraform/language/meta-arguments/lifecycle#ignore_changes). When `null`, the `accelerators` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.accelerators.new](#fn-acceleratorsnew) constructor.\n  - `crypto_key_config` (`list[obj]`): The crypto key configuration. This field is used by the Customer-Managed Encryption Keys (CMEK) feature. When `null`, the `crypto_key_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.crypto_key_config.new](#fn-crypto_key_confignew) constructor.\n  - `event_publish_config` (`list[obj]`): Option to enable and pass metadata for event publishing. When `null`, the `event_publish_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.event_publish_config.new](#fn-event_publish_confignew) constructor.\n  - `network_config` (`list[obj]`): Network configuration options. These are required when a private Data Fusion instance is to be created. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.network_config.new](#fn-network_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data_fusion_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `data_fusion_instance` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     type,
diff --git a/4.x/_gen/resources/database_migration_service_connection_profile.libsonnet b/4.x/_gen/resources/database_migration_service_connection_profile.libsonnet
index d636b2ab..7117ec7e 100644
--- a/4.x/_gen/resources/database_migration_service_connection_profile.libsonnet
+++ b/4.x/_gen/resources/database_migration_service_connection_profile.libsonnet
@@ -160,7 +160,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
   },
-  '#new':: d.fn(help="\n`google.database_migration_service_connection_profile.new` injects a new `google_database_migration_service_connection_profile` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.database_migration_service_connection_profile.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.database_migration_service_connection_profile` using the reference:\n\n    $._ref.google_database_migration_service_connection_profile.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_database_migration_service_connection_profile.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `connection_profile_id` (`string`): The ID of the connection profile.\n  - `display_name` (`string`): The connection profile display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): The resource labels for connection profile to use to annotate any related underlying resources such as Compute Engine VMs. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the connection profile should reside. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `alloydb` (`list[obj]`): Specifies required connection parameters, and the parameters required to create an AlloyDB destination cluster. When `null`, the `alloydb` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.alloydb.new](#fn-alloydbnew) constructor.\n  - `cloudsql` (`list[obj]`): Specifies required connection parameters, and, optionally, the parameters required to create a Cloud SQL destination database instance. When `null`, the `cloudsql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.cloudsql.new](#fn-cloudsqlnew) constructor.\n  - `mysql` (`list[obj]`): Specifies connection parameters required specifically for MySQL databases. When `null`, the `mysql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.mysql.new](#fn-mysqlnew) constructor.\n  - `postgresql` (`list[obj]`): Specifies connection parameters required specifically for PostgreSQL databases. When `null`, the `postgresql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.postgresql.new](#fn-postgresqlnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.database_migration_service_connection_profile.new` injects a new `google_database_migration_service_connection_profile` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.database_migration_service_connection_profile.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.database_migration_service_connection_profile` using the reference:\n\n    $._ref.google_database_migration_service_connection_profile.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_database_migration_service_connection_profile.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `connection_profile_id` (`string`): The ID of the connection profile.\n  - `display_name` (`string`): The connection profile display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): The resource labels for connection profile to use to annotate any related underlying resources such as Compute Engine VMs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the connection profile should reside. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `alloydb` (`list[obj]`): Specifies required connection parameters, and the parameters required to create an AlloyDB destination cluster. When `null`, the `alloydb` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.alloydb.new](#fn-alloydbnew) constructor.\n  - `cloudsql` (`list[obj]`): Specifies required connection parameters, and, optionally, the parameters required to create a Cloud SQL destination database instance. When `null`, the `cloudsql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.cloudsql.new](#fn-cloudsqlnew) constructor.\n  - `mysql` (`list[obj]`): Specifies connection parameters required specifically for MySQL databases. When `null`, the `mysql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.mysql.new](#fn-mysqlnew) constructor.\n  - `oracle` (`list[obj]`): Specifies connection parameters required specifically for Oracle databases. When `null`, the `oracle` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.oracle.new](#fn-oraclenew) constructor.\n  - `postgresql` (`list[obj]`): Specifies connection parameters required specifically for PostgreSQL databases. When `null`, the `postgresql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.postgresql.new](#fn-postgresqlnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     connection_profile_id,
@@ -170,6 +170,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     labels=null,
     location=null,
     mysql=null,
+    oracle=null,
     postgresql=null,
     project=null,
     timeouts=null,
@@ -185,13 +186,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       labels=labels,
       location=location,
       mysql=mysql,
+      oracle=oracle,
       postgresql=postgresql,
       project=project,
       timeouts=timeouts
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.database_migration_service_connection_profile.newAttrs` constructs a new object with attributes and blocks configured for the `database_migration_service_connection_profile`\nTerraform resource.\n\nUnlike [google.database_migration_service_connection_profile.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `connection_profile_id` (`string`): The ID of the connection profile.\n  - `display_name` (`string`): The connection profile display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): The resource labels for connection profile to use to annotate any related underlying resources such as Compute Engine VMs. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the connection profile should reside. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `alloydb` (`list[obj]`): Specifies required connection parameters, and the parameters required to create an AlloyDB destination cluster. When `null`, the `alloydb` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.alloydb.new](#fn-alloydbnew) constructor.\n  - `cloudsql` (`list[obj]`): Specifies required connection parameters, and, optionally, the parameters required to create a Cloud SQL destination database instance. When `null`, the `cloudsql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.cloudsql.new](#fn-cloudsqlnew) constructor.\n  - `mysql` (`list[obj]`): Specifies connection parameters required specifically for MySQL databases. When `null`, the `mysql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.mysql.new](#fn-mysqlnew) constructor.\n  - `postgresql` (`list[obj]`): Specifies connection parameters required specifically for PostgreSQL databases. When `null`, the `postgresql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.postgresql.new](#fn-postgresqlnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `database_migration_service_connection_profile` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.database_migration_service_connection_profile.newAttrs` constructs a new object with attributes and blocks configured for the `database_migration_service_connection_profile`\nTerraform resource.\n\nUnlike [google.database_migration_service_connection_profile.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `connection_profile_id` (`string`): The ID of the connection profile.\n  - `display_name` (`string`): The connection profile display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): The resource labels for connection profile to use to annotate any related underlying resources such as Compute Engine VMs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the connection profile should reside. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `alloydb` (`list[obj]`): Specifies required connection parameters, and the parameters required to create an AlloyDB destination cluster. When `null`, the `alloydb` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.alloydb.new](#fn-alloydbnew) constructor.\n  - `cloudsql` (`list[obj]`): Specifies required connection parameters, and, optionally, the parameters required to create a Cloud SQL destination database instance. When `null`, the `cloudsql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.cloudsql.new](#fn-cloudsqlnew) constructor.\n  - `mysql` (`list[obj]`): Specifies connection parameters required specifically for MySQL databases. When `null`, the `mysql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.mysql.new](#fn-mysqlnew) constructor.\n  - `oracle` (`list[obj]`): Specifies connection parameters required specifically for Oracle databases. When `null`, the `oracle` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.oracle.new](#fn-oraclenew) constructor.\n  - `postgresql` (`list[obj]`): Specifies connection parameters required specifically for PostgreSQL databases. When `null`, the `postgresql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.postgresql.new](#fn-postgresqlnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `database_migration_service_connection_profile` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     connection_profile_id,
     alloydb=null,
@@ -200,6 +202,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     labels=null,
     location=null,
     mysql=null,
+    oracle=null,
     postgresql=null,
     project=null,
     timeouts=null
@@ -211,10 +214,77 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     labels: labels,
     location: location,
     mysql: mysql,
+    oracle: oracle,
     postgresql: postgresql,
     project: project,
     timeouts: timeouts,
   }),
+  oracle:: {
+    forward_ssh_connectivity:: {
+      '#new':: d.fn(help='\n`google.database_migration_service_connection_profile.oracle.forward_ssh_connectivity.new` constructs a new object with attributes and blocks configured for the `forward_ssh_connectivity`\nTerraform sub block.\n\n\n\n**Args**:\n  - `hostname` (`string`): Required. Hostname for the SSH tunnel.\n  - `password` (`string`): Input only. SSH password. Only one of 'password' and 'private_key' can be configured. When `null`, the `password` field will be omitted from the resulting object.\n  - `port` (`number`): Port for the SSH tunnel, default value is 22.\n  - `private_key` (`string`): Input only. SSH private key. Only one of 'password' and 'private_key' can be configured. When `null`, the `private_key` field will be omitted from the resulting object.\n  - `username` (`string`): Required. Username for the SSH tunnel.\n\n**Returns**:\n  - An attribute object that represents the `forward_ssh_connectivity` sub block.\n', args=[]),
+      new(
+        hostname,
+        port,
+        username,
+        password=null,
+        private_key=null
+      ):: std.prune(a={
+        hostname: hostname,
+        password: password,
+        port: port,
+        private_key: private_key,
+        username: username,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.database_migration_service_connection_profile.oracle.new` constructs a new object with attributes and blocks configured for the `oracle`\nTerraform sub block.\n\n\n\n**Args**:\n  - `database_service` (`string`): Required. Database service for the Oracle connection.\n  - `host` (`string`): Required. The IP or hostname of the source Oracle database.\n  - `password` (`string`): Required. Input only. The password for the user that Database Migration Service will be using to connect to the database.\nThis field is not returned on request, and the value is encrypted when stored in Database Migration Service.\n  - `port` (`number`): Required. The network port of the source Oracle database.\n  - `username` (`string`): Required. The username that Database Migration Service will use to connect to the database. The value is encrypted when stored in Database Migration Service.\n  - `forward_ssh_connectivity` (`list[obj]`): SSL configuration for the destination to connect to the source database. When `null`, the `forward_ssh_connectivity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.oracle.forward_ssh_connectivity.new](#fn-oracleforward_ssh_connectivitynew) constructor.\n  - `private_connectivity` (`list[obj]`): Configuration for using a private network to communicate with the source database When `null`, the `private_connectivity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.oracle.private_connectivity.new](#fn-oracleprivate_connectivitynew) constructor.\n  - `ssl` (`list[obj]`): SSL configuration for the destination to connect to the source database. When `null`, the `ssl` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.oracle.ssl.new](#fn-oraclesslnew) constructor.\n  - `static_service_ip_connectivity` (`list[obj]`): This object has no nested fields.\n\nStatic IP address connectivity configured on service project. When `null`, the `static_service_ip_connectivity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.oracle.static_service_ip_connectivity.new](#fn-oraclestatic_service_ip_connectivitynew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `oracle` sub block.\n', args=[]),
+    new(
+      database_service,
+      host,
+      password,
+      port,
+      username,
+      forward_ssh_connectivity=null,
+      private_connectivity=null,
+      ssl=null,
+      static_service_ip_connectivity=null
+    ):: std.prune(a={
+      database_service: database_service,
+      forward_ssh_connectivity: forward_ssh_connectivity,
+      host: host,
+      password: password,
+      port: port,
+      private_connectivity: private_connectivity,
+      ssl: ssl,
+      static_service_ip_connectivity: static_service_ip_connectivity,
+      username: username,
+    }),
+    private_connectivity:: {
+      '#new':: d.fn(help='\n`google.database_migration_service_connection_profile.oracle.private_connectivity.new` constructs a new object with attributes and blocks configured for the `private_connectivity`\nTerraform sub block.\n\n\n\n**Args**:\n  - `private_connection` (`string`): Required. The resource name (URI) of the private connection.\n\n**Returns**:\n  - An attribute object that represents the `private_connectivity` sub block.\n', args=[]),
+      new(
+        private_connection
+      ):: std.prune(a={
+        private_connection: private_connection,
+      }),
+    },
+    ssl:: {
+      '#new':: d.fn(help='\n`google.database_migration_service_connection_profile.oracle.ssl.new` constructs a new object with attributes and blocks configured for the `ssl`\nTerraform sub block.\n\n\n\n**Args**:\n  - `ca_certificate` (`string`): Required. Input only. The x509 PEM-encoded certificate of the CA that signed the source database server's certificate.\nThe replica will use this certificate to verify it's connecting to the right host.\n  - `client_certificate` (`string`): Input only. The x509 PEM-encoded certificate that will be used by the replica to authenticate against the source database server.\nIf this field is used then the 'clientKey' field is mandatory When `null`, the `client_certificate` field will be omitted from the resulting object.\n  - `client_key` (`string`): Input only. The unencrypted PKCS#1 or PKCS#8 PEM-encoded private key associated with the Client Certificate.\nIf this field is used then the 'clientCertificate' field is mandatory. When `null`, the `client_key` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `ssl` sub block.\n', args=[]),
+      new(
+        ca_certificate,
+        client_certificate=null,
+        client_key=null
+      ):: std.prune(a={
+        ca_certificate: ca_certificate,
+        client_certificate: client_certificate,
+        client_key: client_key,
+      }),
+    },
+    static_service_ip_connectivity:: {
+      '#new':: d.fn(help='\n`google.database_migration_service_connection_profile.oracle.static_service_ip_connectivity.new` constructs a new object with attributes and blocks configured for the `static_service_ip_connectivity`\nTerraform sub block.\n\n\n\n**Returns**:\n  - An attribute object that represents the `static_service_ip_connectivity` sub block.\n', args=[]),
+      new(
+
+      ):: std.prune(a={}),
+    },
+  },
   postgresql:: {
     '#new':: d.fn(help='\n`google.database_migration_service_connection_profile.postgresql.new` constructs a new object with attributes and blocks configured for the `postgresql`\nTerraform sub block.\n\n\n\n**Args**:\n  - `cloud_sql_id` (`string`): If the source is a Cloud SQL database, use this field to provide the Cloud SQL instance ID of the source. When `null`, the `cloud_sql_id` field will be omitted from the resulting object.\n  - `host` (`string`): Required. The IP or hostname of the source MySQL database.\n  - `password` (`string`): Required. Input only. The password for the user that Database Migration Service will be using to connect to the database.\nThis field is not returned on request, and the value is encrypted when stored in Database Migration Service.\n  - `port` (`number`): Required. The network port of the source MySQL database.\n  - `username` (`string`): Required. The username that Database Migration Service will use to connect to the database. The value is encrypted when stored in Database Migration Service.\n  - `ssl` (`list[obj]`): SSL configuration for the destination to connect to the source database. When `null`, the `ssl` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.postgresql.ssl.new](#fn-postgresqlsslnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `postgresql` sub block.\n', args=[]),
     new(
@@ -357,6 +427,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withOracle':: d.fn(help='`google.list[obj].withOracle` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the oracle field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withOracleMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `oracle` field.\n', args=[]),
+  withOracle(resourceLabel, value): {
+    resource+: {
+      google_database_migration_service_connection_profile+: {
+        [resourceLabel]+: {
+          oracle: value,
+        },
+      },
+    },
+  },
+  '#withOracleMixin':: d.fn(help='`google.list[obj].withOracleMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the oracle field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withOracle](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `oracle` field.\n', args=[]),
+  withOracleMixin(resourceLabel, value): {
+    resource+: {
+      google_database_migration_service_connection_profile+: {
+        [resourceLabel]+: {
+          oracle+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withPostgresql':: d.fn(help='`google.list[obj].withPostgresql` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the postgresql field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withPostgresqlMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `postgresql` field.\n', args=[]),
   withPostgresql(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/database_migration_service_private_connection.libsonnet b/4.x/_gen/resources/database_migration_service_private_connection.libsonnet
new file mode 100644
index 00000000..745a5beb
--- /dev/null
+++ b/4.x/_gen/resources/database_migration_service_private_connection.libsonnet
@@ -0,0 +1,158 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='database_migration_service_private_connection', url='', help='`database_migration_service_private_connection` represents the `google_database_migration_service_private_connection` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.database_migration_service_private_connection.new` injects a new `google_database_migration_service_private_connection` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.database_migration_service_private_connection.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.database_migration_service_private_connection` using the reference:\n\n    $._ref.google_database_migration_service_private_connection.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_database_migration_service_private_connection.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `display_name` (`string`): Display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this private connection is located in.\n  - `private_connection_id` (`string`): The private connectivity identifier.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_private_connection.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vpc_peering_config` (`list[obj]`): The VPC Peering configuration is used to create VPC peering\nbetween databasemigrationservice and the consumer\u0026#39;s VPC. When `null`, the `vpc_peering_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_private_connection.vpc_peering_config.new](#fn-vpc_peering_confignew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    location,
+    private_connection_id,
+    display_name=null,
+    labels=null,
+    project=null,
+    timeouts=null,
+    vpc_peering_config=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_database_migration_service_private_connection',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      display_name=display_name,
+      labels=labels,
+      location=location,
+      private_connection_id=private_connection_id,
+      project=project,
+      timeouts=timeouts,
+      vpc_peering_config=vpc_peering_config
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.database_migration_service_private_connection.newAttrs` constructs a new object with attributes and blocks configured for the `database_migration_service_private_connection`\nTerraform resource.\n\nUnlike [google.database_migration_service_private_connection.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `display_name` (`string`): Display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this private connection is located in.\n  - `private_connection_id` (`string`): The private connectivity identifier.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_private_connection.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vpc_peering_config` (`list[obj]`): The VPC Peering configuration is used to create VPC peering\nbetween databasemigrationservice and the consumer's VPC. When `null`, the `vpc_peering_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_private_connection.vpc_peering_config.new](#fn-vpc_peering_confignew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `database_migration_service_private_connection` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    location,
+    private_connection_id,
+    display_name=null,
+    labels=null,
+    project=null,
+    timeouts=null,
+    vpc_peering_config=null
+  ):: std.prune(a={
+    display_name: display_name,
+    labels: labels,
+    location: location,
+    private_connection_id: private_connection_id,
+    project: project,
+    timeouts: timeouts,
+    vpc_peering_config: vpc_peering_config,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.database_migration_service_private_connection.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+    }),
+  },
+  vpc_peering_config:: {
+    '#new':: d.fn(help='\n`google.database_migration_service_private_connection.vpc_peering_config.new` constructs a new object with attributes and blocks configured for the `vpc_peering_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `subnet` (`string`): A free subnet for peering. (CIDR of /29)\n  - `vpc_name` (`string`): Fully qualified name of the VPC that Database Migration Service will peer to.\nFormat: projects/{project}/global/{networks}/{name}\n\n**Returns**:\n  - An attribute object that represents the `vpc_peering_config` sub block.\n', args=[]),
+    new(
+      subnet,
+      vpc_name
+    ):: std.prune(a={
+      subnet: subnet,
+      vpc_name: vpc_name,
+    }),
+  },
+  '#withDisplayName':: d.fn(help='`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the display_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `display_name` field.\n', args=[]),
+  withDisplayName(resourceLabel, value): {
+    resource+: {
+      google_database_migration_service_private_connection+: {
+        [resourceLabel]+: {
+          display_name: value,
+        },
+      },
+    },
+  },
+  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
+  withLabels(resourceLabel, value): {
+    resource+: {
+      google_database_migration_service_private_connection+: {
+        [resourceLabel]+: {
+          labels: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_database_migration_service_private_connection+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withPrivateConnectionId':: d.fn(help='`google.string.withPrivateConnectionId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the private_connection_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `private_connection_id` field.\n', args=[]),
+  withPrivateConnectionId(resourceLabel, value): {
+    resource+: {
+      google_database_migration_service_private_connection+: {
+        [resourceLabel]+: {
+          private_connection_id: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_database_migration_service_private_connection+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_database_migration_service_private_connection+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_database_migration_service_private_connection+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+  '#withVpcPeeringConfig':: d.fn(help='`google.list[obj].withVpcPeeringConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the vpc_peering_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withVpcPeeringConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `vpc_peering_config` field.\n', args=[]),
+  withVpcPeeringConfig(resourceLabel, value): {
+    resource+: {
+      google_database_migration_service_private_connection+: {
+        [resourceLabel]+: {
+          vpc_peering_config: value,
+        },
+      },
+    },
+  },
+  '#withVpcPeeringConfigMixin':: d.fn(help='`google.list[obj].withVpcPeeringConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the vpc_peering_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withVpcPeeringConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `vpc_peering_config` field.\n', args=[]),
+  withVpcPeeringConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_database_migration_service_private_connection+: {
+        [resourceLabel]+: {
+          vpc_peering_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/dataflow_job.libsonnet b/4.x/_gen/resources/dataflow_job.libsonnet
index 264d9413..3bc69ccd 100644
--- a/4.x/_gen/resources/dataflow_job.libsonnet
+++ b/4.x/_gen/resources/dataflow_job.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='dataflow_job', url='', help='`dataflow_job` represents the `google_dataflow_job` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.dataflow_job.new` injects a new `google_dataflow_job` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataflow_job.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataflow_job` using the reference:\n\n    $._ref.google_dataflow_job.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataflow_job.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `additional_experiments` (`list`): List of experiments that should be used by the job. An example value is [\u0026#34;enable_stackdriver_agent_metrics\u0026#34;]. When `null`, the `additional_experiments` field will be omitted from the resulting object.\n  - `enable_streaming_engine` (`bool`): Indicates if the job should use the streaming engine feature. When `null`, the `enable_streaming_engine` field will be omitted from the resulting object.\n  - `ip_configuration` (`string`): The configuration for VM IPs. Options are \u0026#34;WORKER_IP_PUBLIC\u0026#34; or \u0026#34;WORKER_IP_PRIVATE\u0026#34;. When `null`, the `ip_configuration` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): The name for the Cloud KMS key for the job. Key format is: projects/PROJECT_ID/locations/LOCATION/keyRings/KEY_RING/cryptoKeys/KEY When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): User labels to be specified for the job. Keys and values should follow the restrictions specified in the labeling restrictions page. NOTE: Google-provided Dataflow templates often provide default labels that begin with goog-dataflow-provided. Unless explicitly set in config, these labels will be ignored to prevent diffs on re-apply. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to use for the job. When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `max_workers` (`number`): The number of workers permitted to work on the job. More workers may improve processing speed at additional cost. When `null`, the `max_workers` field will be omitted from the resulting object.\n  - `name` (`string`): A unique name for the resource, required by Dataflow.\n  - `network` (`string`): The network to which VMs will be assigned. If it is not provided, \u0026#34;default\u0026#34; will be used. When `null`, the `network` field will be omitted from the resulting object.\n  - `on_delete` (`string`): One of \u0026#34;drain\u0026#34; or \u0026#34;cancel\u0026#34;. Specifies behavior of deletion during terraform destroy. When `null`, the `on_delete` field will be omitted from the resulting object.\n  - `parameters` (`obj`): Key/Value pairs to be passed to the Dataflow job (as used in the template). When `null`, the `parameters` field will be omitted from the resulting object.\n  - `project` (`string`): The project in which the resource belongs. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region in which the created job should run. When `null`, the `region` field will be omitted from the resulting object.\n  - `service_account_email` (`string`): The Service Account email used to create the job. When `null`, the `service_account_email` field will be omitted from the resulting object.\n  - `skip_wait_on_job_termination` (`bool`): If true, treat DRAINING and CANCELLING as terminal job states and do not wait for further changes before removing from terraform state and moving on. WARNING: this will lead to job name conflicts if you do not ensure that the job names are different, e.g. by embedding a release ID or by using a random_id. When `null`, the `skip_wait_on_job_termination` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): The subnetwork to which VMs will be assigned. Should be of the form \u0026#34;regions/REGION/subnetworks/SUBNETWORK\u0026#34;. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `temp_gcs_location` (`string`): A writeable location on Google Cloud Storage for the Dataflow job to dump its temporary data.\n  - `template_gcs_path` (`string`): The Google Cloud Storage path to the Dataflow job template.\n  - `transform_name_mapping` (`obj`): Only applicable when updating a pipeline. Map of transform name prefixes of the job to be replaced with the corresponding name prefixes of the new job. When `null`, the `transform_name_mapping` field will be omitted from the resulting object.\n  - `zone` (`string`): The zone in which the created job should run. If it is not provided, the provider zone is used. When `null`, the `zone` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataflow_job.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.dataflow_job.new` injects a new `google_dataflow_job` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataflow_job.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataflow_job` using the reference:\n\n    $._ref.google_dataflow_job.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataflow_job.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `additional_experiments` (`list`): List of experiments that should be used by the job. An example value is [\u0026#34;enable_stackdriver_agent_metrics\u0026#34;]. When `null`, the `additional_experiments` field will be omitted from the resulting object.\n  - `enable_streaming_engine` (`bool`): Indicates if the job should use the streaming engine feature. When `null`, the `enable_streaming_engine` field will be omitted from the resulting object.\n  - `ip_configuration` (`string`): The configuration for VM IPs. Options are \u0026#34;WORKER_IP_PUBLIC\u0026#34; or \u0026#34;WORKER_IP_PRIVATE\u0026#34;. When `null`, the `ip_configuration` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): The name for the Cloud KMS key for the job. Key format is: projects/PROJECT_ID/locations/LOCATION/keyRings/KEY_RING/cryptoKeys/KEY When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): User labels to be specified for the job. Keys and values should follow the restrictions specified in the labeling restrictions page. NOTE: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to use for the job. When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `max_workers` (`number`): The number of workers permitted to work on the job. More workers may improve processing speed at additional cost. When `null`, the `max_workers` field will be omitted from the resulting object.\n  - `name` (`string`): A unique name for the resource, required by Dataflow.\n  - `network` (`string`): The network to which VMs will be assigned. If it is not provided, \u0026#34;default\u0026#34; will be used. When `null`, the `network` field will be omitted from the resulting object.\n  - `on_delete` (`string`): One of \u0026#34;drain\u0026#34; or \u0026#34;cancel\u0026#34;. Specifies behavior of deletion during terraform destroy. When `null`, the `on_delete` field will be omitted from the resulting object.\n  - `parameters` (`obj`): Key/Value pairs to be passed to the Dataflow job (as used in the template). When `null`, the `parameters` field will be omitted from the resulting object.\n  - `project` (`string`): The project in which the resource belongs. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region in which the created job should run. When `null`, the `region` field will be omitted from the resulting object.\n  - `service_account_email` (`string`): The Service Account email used to create the job. When `null`, the `service_account_email` field will be omitted from the resulting object.\n  - `skip_wait_on_job_termination` (`bool`): If true, treat DRAINING and CANCELLING as terminal job states and do not wait for further changes before removing from terraform state and moving on. WARNING: this will lead to job name conflicts if you do not ensure that the job names are different, e.g. by embedding a release ID or by using a random_id. When `null`, the `skip_wait_on_job_termination` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): The subnetwork to which VMs will be assigned. Should be of the form \u0026#34;regions/REGION/subnetworks/SUBNETWORK\u0026#34;. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `temp_gcs_location` (`string`): A writeable location on Google Cloud Storage for the Dataflow job to dump its temporary data.\n  - `template_gcs_path` (`string`): The Google Cloud Storage path to the Dataflow job template.\n  - `transform_name_mapping` (`obj`): Only applicable when updating a pipeline. Map of transform name prefixes of the job to be replaced with the corresponding name prefixes of the new job. When `null`, the `transform_name_mapping` field will be omitted from the resulting object.\n  - `zone` (`string`): The zone in which the created job should run. If it is not provided, the provider zone is used. When `null`, the `zone` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataflow_job.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -55,7 +55,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.dataflow_job.newAttrs` constructs a new object with attributes and blocks configured for the `dataflow_job`\nTerraform resource.\n\nUnlike [google.dataflow_job.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `additional_experiments` (`list`): List of experiments that should be used by the job. An example value is ["enable_stackdriver_agent_metrics"]. When `null`, the `additional_experiments` field will be omitted from the resulting object.\n  - `enable_streaming_engine` (`bool`): Indicates if the job should use the streaming engine feature. When `null`, the `enable_streaming_engine` field will be omitted from the resulting object.\n  - `ip_configuration` (`string`): The configuration for VM IPs. Options are "WORKER_IP_PUBLIC" or "WORKER_IP_PRIVATE". When `null`, the `ip_configuration` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): The name for the Cloud KMS key for the job. Key format is: projects/PROJECT_ID/locations/LOCATION/keyRings/KEY_RING/cryptoKeys/KEY When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): User labels to be specified for the job. Keys and values should follow the restrictions specified in the labeling restrictions page. NOTE: Google-provided Dataflow templates often provide default labels that begin with goog-dataflow-provided. Unless explicitly set in config, these labels will be ignored to prevent diffs on re-apply. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to use for the job. When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `max_workers` (`number`): The number of workers permitted to work on the job. More workers may improve processing speed at additional cost. When `null`, the `max_workers` field will be omitted from the resulting object.\n  - `name` (`string`): A unique name for the resource, required by Dataflow.\n  - `network` (`string`): The network to which VMs will be assigned. If it is not provided, "default" will be used. When `null`, the `network` field will be omitted from the resulting object.\n  - `on_delete` (`string`): One of "drain" or "cancel". Specifies behavior of deletion during terraform destroy. When `null`, the `on_delete` field will be omitted from the resulting object.\n  - `parameters` (`obj`): Key/Value pairs to be passed to the Dataflow job (as used in the template). When `null`, the `parameters` field will be omitted from the resulting object.\n  - `project` (`string`): The project in which the resource belongs. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region in which the created job should run. When `null`, the `region` field will be omitted from the resulting object.\n  - `service_account_email` (`string`): The Service Account email used to create the job. When `null`, the `service_account_email` field will be omitted from the resulting object.\n  - `skip_wait_on_job_termination` (`bool`): If true, treat DRAINING and CANCELLING as terminal job states and do not wait for further changes before removing from terraform state and moving on. WARNING: this will lead to job name conflicts if you do not ensure that the job names are different, e.g. by embedding a release ID or by using a random_id. When `null`, the `skip_wait_on_job_termination` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): The subnetwork to which VMs will be assigned. Should be of the form "regions/REGION/subnetworks/SUBNETWORK". When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `temp_gcs_location` (`string`): A writeable location on Google Cloud Storage for the Dataflow job to dump its temporary data.\n  - `template_gcs_path` (`string`): The Google Cloud Storage path to the Dataflow job template.\n  - `transform_name_mapping` (`obj`): Only applicable when updating a pipeline. Map of transform name prefixes of the job to be replaced with the corresponding name prefixes of the new job. When `null`, the `transform_name_mapping` field will be omitted from the resulting object.\n  - `zone` (`string`): The zone in which the created job should run. If it is not provided, the provider zone is used. When `null`, the `zone` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataflow_job.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataflow_job` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.dataflow_job.newAttrs` constructs a new object with attributes and blocks configured for the `dataflow_job`\nTerraform resource.\n\nUnlike [google.dataflow_job.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `additional_experiments` (`list`): List of experiments that should be used by the job. An example value is ["enable_stackdriver_agent_metrics"]. When `null`, the `additional_experiments` field will be omitted from the resulting object.\n  - `enable_streaming_engine` (`bool`): Indicates if the job should use the streaming engine feature. When `null`, the `enable_streaming_engine` field will be omitted from the resulting object.\n  - `ip_configuration` (`string`): The configuration for VM IPs. Options are "WORKER_IP_PUBLIC" or "WORKER_IP_PRIVATE". When `null`, the `ip_configuration` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): The name for the Cloud KMS key for the job. Key format is: projects/PROJECT_ID/locations/LOCATION/keyRings/KEY_RING/cryptoKeys/KEY When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): User labels to be specified for the job. Keys and values should follow the restrictions specified in the labeling restrictions page. NOTE: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The machine type to use for the job. When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `max_workers` (`number`): The number of workers permitted to work on the job. More workers may improve processing speed at additional cost. When `null`, the `max_workers` field will be omitted from the resulting object.\n  - `name` (`string`): A unique name for the resource, required by Dataflow.\n  - `network` (`string`): The network to which VMs will be assigned. If it is not provided, "default" will be used. When `null`, the `network` field will be omitted from the resulting object.\n  - `on_delete` (`string`): One of "drain" or "cancel". Specifies behavior of deletion during terraform destroy. When `null`, the `on_delete` field will be omitted from the resulting object.\n  - `parameters` (`obj`): Key/Value pairs to be passed to the Dataflow job (as used in the template). When `null`, the `parameters` field will be omitted from the resulting object.\n  - `project` (`string`): The project in which the resource belongs. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region in which the created job should run. When `null`, the `region` field will be omitted from the resulting object.\n  - `service_account_email` (`string`): The Service Account email used to create the job. When `null`, the `service_account_email` field will be omitted from the resulting object.\n  - `skip_wait_on_job_termination` (`bool`): If true, treat DRAINING and CANCELLING as terminal job states and do not wait for further changes before removing from terraform state and moving on. WARNING: this will lead to job name conflicts if you do not ensure that the job names are different, e.g. by embedding a release ID or by using a random_id. When `null`, the `skip_wait_on_job_termination` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): The subnetwork to which VMs will be assigned. Should be of the form "regions/REGION/subnetworks/SUBNETWORK". When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `temp_gcs_location` (`string`): A writeable location on Google Cloud Storage for the Dataflow job to dump its temporary data.\n  - `template_gcs_path` (`string`): The Google Cloud Storage path to the Dataflow job template.\n  - `transform_name_mapping` (`obj`): Only applicable when updating a pipeline. Map of transform name prefixes of the job to be replaced with the corresponding name prefixes of the new job. When `null`, the `transform_name_mapping` field will be omitted from the resulting object.\n  - `zone` (`string`): The zone in which the created job should run. If it is not provided, the provider zone is used. When `null`, the `zone` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataflow_job.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataflow_job` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     temp_gcs_location,
diff --git a/4.x/_gen/resources/dataplex_asset.libsonnet b/4.x/_gen/resources/dataplex_asset.libsonnet
index e4cc4e31..62704c05 100644
--- a/4.x/_gen/resources/dataplex_asset.libsonnet
+++ b/4.x/_gen/resources/dataplex_asset.libsonnet
@@ -44,7 +44,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       schedule: schedule,
     }),
   },
-  '#new':: d.fn(help="\n`google.dataplex_asset.new` injects a new `google_dataplex_asset` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataplex_asset.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataplex_asset` using the reference:\n\n    $._ref.google_dataplex_asset.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataplex_asset.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `dataplex_zone` (`string`): The zone for the resource\n  - `description` (`string`): Optional. Description of the asset. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. User defined labels for the asset. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lake` (`string`): The lake for the resource\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of the asset.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `discovery_spec` (`list[obj]`): Required. Specification of the discovery feature applied to data referenced by this asset. When this spec is left unset, the asset will use the spec set on the parent zone. When `null`, the `discovery_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_asset.discovery_spec.new](#fn-discovery_specnew) constructor.\n  - `resource_spec` (`list[obj]`): Required. Immutable. Specification of the resource that is referenced by this asset. When `null`, the `resource_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_asset.resource_spec.new](#fn-resource_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_asset.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.dataplex_asset.new` injects a new `google_dataplex_asset` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataplex_asset.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataplex_asset` using the reference:\n\n    $._ref.google_dataplex_asset.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataplex_asset.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `dataplex_zone` (`string`): The zone for the resource\n  - `description` (`string`): Optional. Description of the asset. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. User defined labels for the asset.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lake` (`string`): The lake for the resource\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of the asset.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `discovery_spec` (`list[obj]`): Required. Specification of the discovery feature applied to data referenced by this asset. When this spec is left unset, the asset will use the spec set on the parent zone. When `null`, the `discovery_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_asset.discovery_spec.new](#fn-discovery_specnew) constructor.\n  - `resource_spec` (`list[obj]`): Required. Immutable. Specification of the resource that is referenced by this asset. When `null`, the `resource_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_asset.resource_spec.new](#fn-resource_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_asset.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     dataplex_zone,
@@ -77,7 +77,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.dataplex_asset.newAttrs` constructs a new object with attributes and blocks configured for the `dataplex_asset`\nTerraform resource.\n\nUnlike [google.dataplex_asset.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `dataplex_zone` (`string`): The zone for the resource\n  - `description` (`string`): Optional. Description of the asset. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. User defined labels for the asset. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lake` (`string`): The lake for the resource\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of the asset.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `discovery_spec` (`list[obj]`): Required. Specification of the discovery feature applied to data referenced by this asset. When this spec is left unset, the asset will use the spec set on the parent zone. When `null`, the `discovery_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_asset.discovery_spec.new](#fn-discovery_specnew) constructor.\n  - `resource_spec` (`list[obj]`): Required. Immutable. Specification of the resource that is referenced by this asset. When `null`, the `resource_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_asset.resource_spec.new](#fn-resource_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_asset.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataplex_asset` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.dataplex_asset.newAttrs` constructs a new object with attributes and blocks configured for the `dataplex_asset`\nTerraform resource.\n\nUnlike [google.dataplex_asset.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `dataplex_zone` (`string`): The zone for the resource\n  - `description` (`string`): Optional. Description of the asset. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. User defined labels for the asset.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lake` (`string`): The lake for the resource\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of the asset.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `discovery_spec` (`list[obj]`): Required. Specification of the discovery feature applied to data referenced by this asset. When this spec is left unset, the asset will use the spec set on the parent zone. When `null`, the `discovery_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_asset.discovery_spec.new](#fn-discovery_specnew) constructor.\n  - `resource_spec` (`list[obj]`): Required. Immutable. Specification of the resource that is referenced by this asset. When `null`, the `resource_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_asset.resource_spec.new](#fn-resource_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_asset.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataplex_asset` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     dataplex_zone,
     lake,
diff --git a/4.x/_gen/resources/dataplex_datascan.libsonnet b/4.x/_gen/resources/dataplex_datascan.libsonnet
index 60ee5e3a..ac8fd773 100644
--- a/4.x/_gen/resources/dataplex_datascan.libsonnet
+++ b/4.x/_gen/resources/dataplex_datascan.libsonnet
@@ -232,7 +232,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
-  '#new':: d.fn(help="\n`google.dataplex_datascan.new` injects a new `google_dataplex_datascan` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataplex_datascan.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataplex_datascan` using the reference:\n\n    $._ref.google_dataplex_datascan.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataplex_datascan.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `data_scan_id` (`string`): DataScan identifier. Must contain only lowercase letters, numbers and hyphens. Must start with a letter. Must end with a number or a letter.\n  - `description` (`string`): Description of the scan. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the scan. A list of key-\u0026gt;value pairs. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the data scan should reside.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `data` (`list[obj]`): The data source for DataScan. When `null`, the `data` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data.new](#fn-datanew) constructor.\n  - `data_profile_spec` (`list[obj]`): DataProfileScan related setting. When `null`, the `data_profile_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_profile_spec.new](#fn-data_profile_specnew) constructor.\n  - `data_quality_spec` (`list[obj]`): DataQualityScan related setting. When `null`, the `data_quality_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_quality_spec.new](#fn-data_quality_specnew) constructor.\n  - `execution_spec` (`list[obj]`): DataScan execution settings. When `null`, the `execution_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.execution_spec.new](#fn-execution_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.dataplex_datascan.new` injects a new `google_dataplex_datascan` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataplex_datascan.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataplex_datascan` using the reference:\n\n    $._ref.google_dataplex_datascan.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataplex_datascan.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `data_scan_id` (`string`): DataScan identifier. Must contain only lowercase letters, numbers and hyphens. Must start with a letter. Must end with a number or a letter.\n  - `description` (`string`): Description of the scan. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the scan. A list of key-\u0026gt;value pairs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the data scan should reside.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `data` (`list[obj]`): The data source for DataScan. When `null`, the `data` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data.new](#fn-datanew) constructor.\n  - `data_profile_spec` (`list[obj]`): DataProfileScan related setting. When `null`, the `data_profile_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_profile_spec.new](#fn-data_profile_specnew) constructor.\n  - `data_quality_spec` (`list[obj]`): DataQualityScan related setting. When `null`, the `data_quality_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_quality_spec.new](#fn-data_quality_specnew) constructor.\n  - `execution_spec` (`list[obj]`): DataScan execution settings. When `null`, the `execution_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.execution_spec.new](#fn-execution_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     data_scan_id,
@@ -265,7 +265,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.dataplex_datascan.newAttrs` constructs a new object with attributes and blocks configured for the `dataplex_datascan`\nTerraform resource.\n\nUnlike [google.dataplex_datascan.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `data_scan_id` (`string`): DataScan identifier. Must contain only lowercase letters, numbers and hyphens. Must start with a letter. Must end with a number or a letter.\n  - `description` (`string`): Description of the scan. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the scan. A list of key->value pairs. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the data scan should reside.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `data` (`list[obj]`): The data source for DataScan. When `null`, the `data` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data.new](#fn-datanew) constructor.\n  - `data_profile_spec` (`list[obj]`): DataProfileScan related setting. When `null`, the `data_profile_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_profile_spec.new](#fn-data_profile_specnew) constructor.\n  - `data_quality_spec` (`list[obj]`): DataQualityScan related setting. When `null`, the `data_quality_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_quality_spec.new](#fn-data_quality_specnew) constructor.\n  - `execution_spec` (`list[obj]`): DataScan execution settings. When `null`, the `execution_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.execution_spec.new](#fn-execution_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataplex_datascan` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.dataplex_datascan.newAttrs` constructs a new object with attributes and blocks configured for the `dataplex_datascan`\nTerraform resource.\n\nUnlike [google.dataplex_datascan.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `data_scan_id` (`string`): DataScan identifier. Must contain only lowercase letters, numbers and hyphens. Must start with a letter. Must end with a number or a letter.\n  - `description` (`string`): Description of the scan. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the scan. A list of key->value pairs.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the data scan should reside.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `data` (`list[obj]`): The data source for DataScan. When `null`, the `data` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data.new](#fn-datanew) constructor.\n  - `data_profile_spec` (`list[obj]`): DataProfileScan related setting. When `null`, the `data_profile_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_profile_spec.new](#fn-data_profile_specnew) constructor.\n  - `data_quality_spec` (`list[obj]`): DataQualityScan related setting. When `null`, the `data_quality_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data_quality_spec.new](#fn-data_quality_specnew) constructor.\n  - `execution_spec` (`list[obj]`): DataScan execution settings. When `null`, the `execution_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.execution_spec.new](#fn-execution_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataplex_datascan` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     data_scan_id,
     location,
diff --git a/4.x/_gen/resources/dataplex_lake.libsonnet b/4.x/_gen/resources/dataplex_lake.libsonnet
index c5c8c53b..8d41b08c 100644
--- a/4.x/_gen/resources/dataplex_lake.libsonnet
+++ b/4.x/_gen/resources/dataplex_lake.libsonnet
@@ -10,7 +10,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       service: service,
     }),
   },
-  '#new':: d.fn(help="\n`google.dataplex_lake.new` injects a new `google_dataplex_lake` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataplex_lake.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataplex_lake` using the reference:\n\n    $._ref.google_dataplex_lake.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataplex_lake.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Optional. Description of the lake. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. User-defined labels for the lake. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of the lake.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `metastore` (`list[obj]`): Optional. Settings to manage lake and Dataproc Metastore service instance association. When `null`, the `metastore` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_lake.metastore.new](#fn-metastorenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_lake.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.dataplex_lake.new` injects a new `google_dataplex_lake` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataplex_lake.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataplex_lake` using the reference:\n\n    $._ref.google_dataplex_lake.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataplex_lake.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Optional. Description of the lake. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. User-defined labels for the lake.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of the lake.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `metastore` (`list[obj]`): Optional. Settings to manage lake and Dataproc Metastore service instance association. When `null`, the `metastore` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_lake.metastore.new](#fn-metastorenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_lake.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -37,7 +37,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.dataplex_lake.newAttrs` constructs a new object with attributes and blocks configured for the `dataplex_lake`\nTerraform resource.\n\nUnlike [google.dataplex_lake.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Optional. Description of the lake. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. User-defined labels for the lake. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of the lake.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `metastore` (`list[obj]`): Optional. Settings to manage lake and Dataproc Metastore service instance association. When `null`, the `metastore` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_lake.metastore.new](#fn-metastorenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_lake.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataplex_lake` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.dataplex_lake.newAttrs` constructs a new object with attributes and blocks configured for the `dataplex_lake`\nTerraform resource.\n\nUnlike [google.dataplex_lake.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Optional. Description of the lake. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. User-defined labels for the lake.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of the lake.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `metastore` (`list[obj]`): Optional. Settings to manage lake and Dataproc Metastore service instance association. When `null`, the `metastore` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_lake.metastore.new](#fn-metastorenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_lake.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataplex_lake` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     name,
diff --git a/4.x/_gen/resources/dataplex_task.libsonnet b/4.x/_gen/resources/dataplex_task.libsonnet
index abc79f26..d4edbf58 100644
--- a/4.x/_gen/resources/dataplex_task.libsonnet
+++ b/4.x/_gen/resources/dataplex_task.libsonnet
@@ -18,7 +18,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       service_account: service_account,
     }),
   },
-  '#new':: d.fn(help="\n`google.dataplex_task.new` injects a new `google_dataplex_task` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataplex_task.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataplex_task` using the reference:\n\n    $._ref.google_dataplex_task.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataplex_task.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): User-provided description of the task. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the task. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lake` (`string`): The lake in which the task will be created in. When `null`, the `lake` field will be omitted from the resulting object.\n  - `location` (`string`): The location in which the task will be created in. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `task_id` (`string`): The task Id of the task. When `null`, the `task_id` field will be omitted from the resulting object.\n  - `execution_spec` (`list[obj]`): Configuration for the cluster When `null`, the `execution_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.execution_spec.new](#fn-execution_specnew) constructor.\n  - `notebook` (`list[obj]`): A service with manual scaling runs continuously, allowing you to perform complex initialization and rely on the state of its memory over time. When `null`, the `notebook` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.notebook.new](#fn-notebooknew) constructor.\n  - `spark` (`list[obj]`): A service with manual scaling runs continuously, allowing you to perform complex initialization and rely on the state of its memory over time. When `null`, the `spark` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.spark.new](#fn-sparknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.timeouts.new](#fn-timeoutsnew) constructor.\n  - `trigger_spec` (`list[obj]`): Configuration for the cluster When `null`, the `trigger_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.trigger_spec.new](#fn-trigger_specnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.dataplex_task.new` injects a new `google_dataplex_task` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataplex_task.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataplex_task` using the reference:\n\n    $._ref.google_dataplex_task.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataplex_task.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): User-provided description of the task. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the task.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lake` (`string`): The lake in which the task will be created in. When `null`, the `lake` field will be omitted from the resulting object.\n  - `location` (`string`): The location in which the task will be created in. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `task_id` (`string`): The task Id of the task. When `null`, the `task_id` field will be omitted from the resulting object.\n  - `execution_spec` (`list[obj]`): Configuration for the cluster When `null`, the `execution_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.execution_spec.new](#fn-execution_specnew) constructor.\n  - `notebook` (`list[obj]`): A service with manual scaling runs continuously, allowing you to perform complex initialization and rely on the state of its memory over time. When `null`, the `notebook` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.notebook.new](#fn-notebooknew) constructor.\n  - `spark` (`list[obj]`): A service with manual scaling runs continuously, allowing you to perform complex initialization and rely on the state of its memory over time. When `null`, the `spark` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.spark.new](#fn-sparknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.timeouts.new](#fn-timeoutsnew) constructor.\n  - `trigger_spec` (`list[obj]`): Configuration for the cluster When `null`, the `trigger_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.trigger_spec.new](#fn-trigger_specnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     description=null,
@@ -53,7 +53,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.dataplex_task.newAttrs` constructs a new object with attributes and blocks configured for the `dataplex_task`\nTerraform resource.\n\nUnlike [google.dataplex_task.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): User-provided description of the task. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the task. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lake` (`string`): The lake in which the task will be created in. When `null`, the `lake` field will be omitted from the resulting object.\n  - `location` (`string`): The location in which the task will be created in. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `task_id` (`string`): The task Id of the task. When `null`, the `task_id` field will be omitted from the resulting object.\n  - `execution_spec` (`list[obj]`): Configuration for the cluster When `null`, the `execution_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.execution_spec.new](#fn-execution_specnew) constructor.\n  - `notebook` (`list[obj]`): A service with manual scaling runs continuously, allowing you to perform complex initialization and rely on the state of its memory over time. When `null`, the `notebook` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.notebook.new](#fn-notebooknew) constructor.\n  - `spark` (`list[obj]`): A service with manual scaling runs continuously, allowing you to perform complex initialization and rely on the state of its memory over time. When `null`, the `spark` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.spark.new](#fn-sparknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.timeouts.new](#fn-timeoutsnew) constructor.\n  - `trigger_spec` (`list[obj]`): Configuration for the cluster When `null`, the `trigger_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.trigger_spec.new](#fn-trigger_specnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataplex_task` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.dataplex_task.newAttrs` constructs a new object with attributes and blocks configured for the `dataplex_task`\nTerraform resource.\n\nUnlike [google.dataplex_task.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): User-provided description of the task. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the task.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lake` (`string`): The lake in which the task will be created in. When `null`, the `lake` field will be omitted from the resulting object.\n  - `location` (`string`): The location in which the task will be created in. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `task_id` (`string`): The task Id of the task. When `null`, the `task_id` field will be omitted from the resulting object.\n  - `execution_spec` (`list[obj]`): Configuration for the cluster When `null`, the `execution_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.execution_spec.new](#fn-execution_specnew) constructor.\n  - `notebook` (`list[obj]`): A service with manual scaling runs continuously, allowing you to perform complex initialization and rely on the state of its memory over time. When `null`, the `notebook` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.notebook.new](#fn-notebooknew) constructor.\n  - `spark` (`list[obj]`): A service with manual scaling runs continuously, allowing you to perform complex initialization and rely on the state of its memory over time. When `null`, the `spark` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.spark.new](#fn-sparknew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.timeouts.new](#fn-timeoutsnew) constructor.\n  - `trigger_spec` (`list[obj]`): Configuration for the cluster When `null`, the `trigger_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_task.trigger_spec.new](#fn-trigger_specnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataplex_task` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     description=null,
     display_name=null,
diff --git a/4.x/_gen/resources/dataplex_zone.libsonnet b/4.x/_gen/resources/dataplex_zone.libsonnet
index 35760ae7..39418e42 100644
--- a/4.x/_gen/resources/dataplex_zone.libsonnet
+++ b/4.x/_gen/resources/dataplex_zone.libsonnet
@@ -44,7 +44,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       schedule: schedule,
     }),
   },
-  '#new':: d.fn(help="\n`google.dataplex_zone.new` injects a new `google_dataplex_zone` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataplex_zone.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataplex_zone` using the reference:\n\n    $._ref.google_dataplex_zone.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataplex_zone.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Optional. Description of the zone. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. User defined labels for the zone. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lake` (`string`): The lake for the resource\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of the zone.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `type` (`string`): Required. Immutable. The type of the zone. Possible values: TYPE_UNSPECIFIED, RAW, CURATED\n  - `discovery_spec` (`list[obj]`): Required. Specification of the discovery feature applied to data in this zone. When `null`, the `discovery_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_zone.discovery_spec.new](#fn-discovery_specnew) constructor.\n  - `resource_spec` (`list[obj]`): Required. Immutable. Specification of the resources that are referenced by the assets within this zone. When `null`, the `resource_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_zone.resource_spec.new](#fn-resource_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_zone.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.dataplex_zone.new` injects a new `google_dataplex_zone` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataplex_zone.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataplex_zone` using the reference:\n\n    $._ref.google_dataplex_zone.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataplex_zone.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Optional. Description of the zone. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. User defined labels for the zone.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lake` (`string`): The lake for the resource\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of the zone.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `type` (`string`): Required. Immutable. The type of the zone. Possible values: TYPE_UNSPECIFIED, RAW, CURATED\n  - `discovery_spec` (`list[obj]`): Required. Specification of the discovery feature applied to data in this zone. When `null`, the `discovery_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_zone.discovery_spec.new](#fn-discovery_specnew) constructor.\n  - `resource_spec` (`list[obj]`): Required. Immutable. Specification of the resources that are referenced by the assets within this zone. When `null`, the `resource_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_zone.resource_spec.new](#fn-resource_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_zone.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     lake,
@@ -77,7 +77,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.dataplex_zone.newAttrs` constructs a new object with attributes and blocks configured for the `dataplex_zone`\nTerraform resource.\n\nUnlike [google.dataplex_zone.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Optional. Description of the zone. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. User defined labels for the zone. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lake` (`string`): The lake for the resource\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of the zone.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `type` (`string`): Required. Immutable. The type of the zone. Possible values: TYPE_UNSPECIFIED, RAW, CURATED\n  - `discovery_spec` (`list[obj]`): Required. Specification of the discovery feature applied to data in this zone. When `null`, the `discovery_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_zone.discovery_spec.new](#fn-discovery_specnew) constructor.\n  - `resource_spec` (`list[obj]`): Required. Immutable. Specification of the resources that are referenced by the assets within this zone. When `null`, the `resource_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_zone.resource_spec.new](#fn-resource_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_zone.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataplex_zone` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.dataplex_zone.newAttrs` constructs a new object with attributes and blocks configured for the `dataplex_zone`\nTerraform resource.\n\nUnlike [google.dataplex_zone.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Optional. Description of the zone. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. User defined labels for the zone.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lake` (`string`): The lake for the resource\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The name of the zone.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `type` (`string`): Required. Immutable. The type of the zone. Possible values: TYPE_UNSPECIFIED, RAW, CURATED\n  - `discovery_spec` (`list[obj]`): Required. Specification of the discovery feature applied to data in this zone. When `null`, the `discovery_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_zone.discovery_spec.new](#fn-discovery_specnew) constructor.\n  - `resource_spec` (`list[obj]`): Required. Immutable. Specification of the resources that are referenced by the assets within this zone. When `null`, the `resource_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_zone.resource_spec.new](#fn-resource_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_zone.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataplex_zone` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     lake,
     location,
diff --git a/4.x/_gen/resources/dataproc_cluster.libsonnet b/4.x/_gen/resources/dataproc_cluster.libsonnet
index 8bfbf4eb..15355bb7 100644
--- a/4.x/_gen/resources/dataproc_cluster.libsonnet
+++ b/4.x/_gen/resources/dataproc_cluster.libsonnet
@@ -148,7 +148,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
           num_local_ssds: num_local_ssds,
         }),
       },
-      '#new':: d.fn(help='\n`google.dataproc_cluster.cluster_config.master_config.new` constructs a new object with attributes and blocks configured for the `master_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `image_uri` (`string`): The URI for the image to use for this master/worker When `null`, the `image_uri` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The name of a Google Compute Engine machine type to create for the master/worker When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): The name of a minimum generation of CPU family for the master/worker. If not specified, GCP will default to a predetermined computed value for each zone. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `num_instances` (`number`): Specifies the number of master/worker nodes to create. If not specified, GCP will default to a predetermined computed value. When `null`, the `num_instances` field will be omitted from the resulting object.\n  - `accelerators` (`list[obj]`): The Compute Engine accelerator (GPU) configuration for these instances. Can be specified multiple times. When `null`, the `accelerators` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.master_config.accelerators.new](#fn-cluster_configcluster_configacceleratorsnew) constructor.\n  - `disk_config` (`list[obj]`): Disk Config When `null`, the `disk_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.master_config.disk_config.new](#fn-cluster_configcluster_configdisk_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `master_config` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.dataproc_cluster.cluster_config.master_config.new` constructs a new object with attributes and blocks configured for the `master_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `image_uri` (`string`): The URI for the image to use for this master When `null`, the `image_uri` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The name of a Google Compute Engine machine type to create for the master When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): The name of a minimum generation of CPU family for the master. If not specified, GCP will default to a predetermined computed value for each zone. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `num_instances` (`number`): Specifies the number of master nodes to create. If not specified, GCP will default to a predetermined computed value. When `null`, the `num_instances` field will be omitted from the resulting object.\n  - `accelerators` (`list[obj]`): The Compute Engine accelerator (GPU) configuration for these instances. Can be specified multiple times. When `null`, the `accelerators` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.master_config.accelerators.new](#fn-cluster_configcluster_configacceleratorsnew) constructor.\n  - `disk_config` (`list[obj]`): Disk Config When `null`, the `disk_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.master_config.disk_config.new](#fn-cluster_configcluster_configdisk_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `master_config` sub block.\n', args=[]),
       new(
         accelerators=null,
         disk_config=null,
@@ -173,7 +173,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         dataproc_metastore_service: dataproc_metastore_service,
       }),
     },
-    '#new':: d.fn(help='\n`google.dataproc_cluster.cluster_config.new` constructs a new object with attributes and blocks configured for the `cluster_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `staging_bucket` (`string`): The Cloud Storage staging bucket used to stage files, such as Hadoop jars, between client machines and the cluster. Note: If you don't explicitly specify a staging_bucket then GCP will auto create / assign one for you. However, you are not guaranteed an auto generated bucket which is solely dedicated to your cluster; it may be shared with other clusters in the same region/zone also choosing to use the auto generation option. When `null`, the `staging_bucket` field will be omitted from the resulting object.\n  - `temp_bucket` (`string`): The Cloud Storage temp bucket used to store ephemeral cluster and jobs data, such as Spark and MapReduce history files. Note: If you don't explicitly specify a temp_bucket then GCP will auto create / assign one for you. When `null`, the `temp_bucket` field will be omitted from the resulting object.\n  - `autoscaling_config` (`list[obj]`): The autoscaling policy config associated with the cluster. When `null`, the `autoscaling_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.autoscaling_config.new](#fn-cluster_configautoscaling_confignew) constructor.\n  - `dataproc_metric_config` (`list[obj]`): The config for Dataproc metrics. When `null`, the `dataproc_metric_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.dataproc_metric_config.new](#fn-cluster_configdataproc_metric_confignew) constructor.\n  - `encryption_config` (`list[obj]`): The Customer managed encryption keys settings for the cluster. When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.encryption_config.new](#fn-cluster_configencryption_confignew) constructor.\n  - `endpoint_config` (`list[obj]`): The config settings for port access on the cluster. Structure defined below. When `null`, the `endpoint_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.endpoint_config.new](#fn-cluster_configendpoint_confignew) constructor.\n  - `gce_cluster_config` (`list[obj]`): Common config settings for resources of Google Compute Engine cluster instances, applicable to all instances in the cluster. When `null`, the `gce_cluster_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.gce_cluster_config.new](#fn-cluster_configgce_cluster_confignew) constructor.\n  - `initialization_action` (`list[obj]`): Commands to execute on each node after config is completed. You can specify multiple versions of these. When `null`, the `initialization_action` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.initialization_action.new](#fn-cluster_configinitialization_actionnew) constructor.\n  - `lifecycle_config` (`list[obj]`): The settings for auto deletion cluster schedule. When `null`, the `lifecycle_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.lifecycle_config.new](#fn-cluster_configlifecycle_confignew) constructor.\n  - `master_config` (`list[obj]`): The Google Compute Engine config settings for the master/worker instances in a cluster. When `null`, the `master_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.master_config.new](#fn-cluster_configmaster_confignew) constructor.\n  - `metastore_config` (`list[obj]`): Specifies a Metastore configuration. When `null`, the `metastore_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.metastore_config.new](#fn-cluster_configmetastore_confignew) constructor.\n  - `preemptible_worker_config` (`list[obj]`): The Google Compute Engine config settings for the additional (aka preemptible) instances in a cluster. When `null`, the `preemptible_worker_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.preemptible_worker_config.new](#fn-cluster_configpreemptible_worker_confignew) constructor.\n  - `security_config` (`list[obj]`): Security related configuration. When `null`, the `security_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.security_config.new](#fn-cluster_configsecurity_confignew) constructor.\n  - `software_config` (`list[obj]`): The config settings for software inside the cluster. When `null`, the `software_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.software_config.new](#fn-cluster_configsoftware_confignew) constructor.\n  - `worker_config` (`list[obj]`): The Google Compute Engine config settings for the master/worker instances in a cluster. When `null`, the `worker_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.worker_config.new](#fn-cluster_configworker_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `cluster_config` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.dataproc_cluster.cluster_config.new` constructs a new object with attributes and blocks configured for the `cluster_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `staging_bucket` (`string`): The Cloud Storage staging bucket used to stage files, such as Hadoop jars, between client machines and the cluster. Note: If you don't explicitly specify a staging_bucket then GCP will auto create / assign one for you. However, you are not guaranteed an auto generated bucket which is solely dedicated to your cluster; it may be shared with other clusters in the same region/zone also choosing to use the auto generation option. When `null`, the `staging_bucket` field will be omitted from the resulting object.\n  - `temp_bucket` (`string`): The Cloud Storage temp bucket used to store ephemeral cluster and jobs data, such as Spark and MapReduce history files. Note: If you don't explicitly specify a temp_bucket then GCP will auto create / assign one for you. When `null`, the `temp_bucket` field will be omitted from the resulting object.\n  - `autoscaling_config` (`list[obj]`): The autoscaling policy config associated with the cluster. When `null`, the `autoscaling_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.autoscaling_config.new](#fn-cluster_configautoscaling_confignew) constructor.\n  - `dataproc_metric_config` (`list[obj]`): The config for Dataproc metrics. When `null`, the `dataproc_metric_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.dataproc_metric_config.new](#fn-cluster_configdataproc_metric_confignew) constructor.\n  - `encryption_config` (`list[obj]`): The Customer managed encryption keys settings for the cluster. When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.encryption_config.new](#fn-cluster_configencryption_confignew) constructor.\n  - `endpoint_config` (`list[obj]`): The config settings for port access on the cluster. Structure defined below. When `null`, the `endpoint_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.endpoint_config.new](#fn-cluster_configendpoint_confignew) constructor.\n  - `gce_cluster_config` (`list[obj]`): Common config settings for resources of Google Compute Engine cluster instances, applicable to all instances in the cluster. When `null`, the `gce_cluster_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.gce_cluster_config.new](#fn-cluster_configgce_cluster_confignew) constructor.\n  - `initialization_action` (`list[obj]`): Commands to execute on each node after config is completed. You can specify multiple versions of these. When `null`, the `initialization_action` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.initialization_action.new](#fn-cluster_configinitialization_actionnew) constructor.\n  - `lifecycle_config` (`list[obj]`): The settings for auto deletion cluster schedule. When `null`, the `lifecycle_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.lifecycle_config.new](#fn-cluster_configlifecycle_confignew) constructor.\n  - `master_config` (`list[obj]`): The Compute Engine config settings for the cluster's master instance. When `null`, the `master_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.master_config.new](#fn-cluster_configmaster_confignew) constructor.\n  - `metastore_config` (`list[obj]`): Specifies a Metastore configuration. When `null`, the `metastore_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.metastore_config.new](#fn-cluster_configmetastore_confignew) constructor.\n  - `preemptible_worker_config` (`list[obj]`): The Google Compute Engine config settings for the additional (aka preemptible) instances in a cluster. When `null`, the `preemptible_worker_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.preemptible_worker_config.new](#fn-cluster_configpreemptible_worker_confignew) constructor.\n  - `security_config` (`list[obj]`): Security related configuration. When `null`, the `security_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.security_config.new](#fn-cluster_configsecurity_confignew) constructor.\n  - `software_config` (`list[obj]`): The config settings for software inside the cluster. When `null`, the `software_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.software_config.new](#fn-cluster_configsoftware_confignew) constructor.\n  - `worker_config` (`list[obj]`): The Compute Engine config settings for the cluster's worker instances. When `null`, the `worker_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.worker_config.new](#fn-cluster_configworker_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `cluster_config` sub block.\n', args=[]),
     new(
       autoscaling_config=null,
       dataproc_metric_config=null,
@@ -220,13 +220,33 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
           num_local_ssds: num_local_ssds,
         }),
       },
-      '#new':: d.fn(help='\n`google.dataproc_cluster.cluster_config.preemptible_worker_config.new` constructs a new object with attributes and blocks configured for the `preemptible_worker_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `num_instances` (`number`): Specifies the number of preemptible nodes to create. Defaults to 0. When `null`, the `num_instances` field will be omitted from the resulting object.\n  - `preemptibility` (`string`): Specifies the preemptibility of the secondary nodes. Defaults to PREEMPTIBLE. When `null`, the `preemptibility` field will be omitted from the resulting object.\n  - `disk_config` (`list[obj]`): Disk Config When `null`, the `disk_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.preemptible_worker_config.disk_config.new](#fn-cluster_configcluster_configdisk_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `preemptible_worker_config` sub block.\n', args=[]),
+      instance_flexibility_policy:: {
+        instance_selection_list:: {
+          '#new':: d.fn(help='\n`google.dataproc_cluster.cluster_config.preemptible_worker_config.instance_flexibility_policy.instance_selection_list.new` constructs a new object with attributes and blocks configured for the `instance_selection_list`\nTerraform sub block.\n\n\n\n**Args**:\n  - `machine_types` (`list`): Full machine-type names, e.g. "n1-standard-16". When `null`, the `machine_types` field will be omitted from the resulting object.\n  - `rank` (`number`): Preference of this instance selection. Lower number means higher preference. Dataproc will first try to create a VM based on the machine-type with priority rank and fallback to next rank based on availability. Machine types and instance selections with the same priority have the same preference. When `null`, the `rank` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `instance_selection_list` sub block.\n', args=[]),
+          new(
+            machine_types=null,
+            rank=null
+          ):: std.prune(a={
+            machine_types: machine_types,
+            rank: rank,
+          }),
+        },
+        '#new':: d.fn(help='\n`google.dataproc_cluster.cluster_config.preemptible_worker_config.instance_flexibility_policy.new` constructs a new object with attributes and blocks configured for the `instance_flexibility_policy`\nTerraform sub block.\n\n\n\n**Args**:\n  - `instance_selection_list` (`list[obj]`): List of instance selection options that the group will use when creating new VMs. When `null`, the `instance_selection_list` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.preemptible_worker_config.instance_flexibility_policy.instance_selection_list.new](#fn-cluster_configcluster_configpreemptible_worker_configinstance_selection_listnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `instance_flexibility_policy` sub block.\n', args=[]),
+        new(
+          instance_selection_list=null
+        ):: std.prune(a={
+          instance_selection_list: instance_selection_list,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.dataproc_cluster.cluster_config.preemptible_worker_config.new` constructs a new object with attributes and blocks configured for the `preemptible_worker_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `num_instances` (`number`): Specifies the number of preemptible nodes to create. Defaults to 0. When `null`, the `num_instances` field will be omitted from the resulting object.\n  - `preemptibility` (`string`): Specifies the preemptibility of the secondary nodes. Defaults to PREEMPTIBLE. When `null`, the `preemptibility` field will be omitted from the resulting object.\n  - `disk_config` (`list[obj]`): Disk Config When `null`, the `disk_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.preemptible_worker_config.disk_config.new](#fn-cluster_configcluster_configdisk_confignew) constructor.\n  - `instance_flexibility_policy` (`list[obj]`): Instance flexibility Policy allowing a mixture of VM shapes and provisioning models. When `null`, the `instance_flexibility_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.preemptible_worker_config.instance_flexibility_policy.new](#fn-cluster_configcluster_configinstance_flexibility_policynew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `preemptible_worker_config` sub block.\n', args=[]),
       new(
         disk_config=null,
+        instance_flexibility_policy=null,
         num_instances=null,
         preemptibility=null
       ):: std.prune(a={
         disk_config: disk_config,
+        instance_flexibility_policy: instance_flexibility_policy,
         num_instances: num_instances,
         preemptibility: preemptibility,
       }),
@@ -310,13 +330,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
           num_local_ssds: num_local_ssds,
         }),
       },
-      '#new':: d.fn(help='\n`google.dataproc_cluster.cluster_config.worker_config.new` constructs a new object with attributes and blocks configured for the `worker_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `image_uri` (`string`): The URI for the image to use for this master/worker When `null`, the `image_uri` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The name of a Google Compute Engine machine type to create for the master/worker When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): The name of a minimum generation of CPU family for the master/worker. If not specified, GCP will default to a predetermined computed value for each zone. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `num_instances` (`number`): Specifies the number of master/worker nodes to create. If not specified, GCP will default to a predetermined computed value. When `null`, the `num_instances` field will be omitted from the resulting object.\n  - `accelerators` (`list[obj]`): The Compute Engine accelerator (GPU) configuration for these instances. Can be specified multiple times. When `null`, the `accelerators` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.worker_config.accelerators.new](#fn-cluster_configcluster_configacceleratorsnew) constructor.\n  - `disk_config` (`list[obj]`): Disk Config When `null`, the `disk_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.worker_config.disk_config.new](#fn-cluster_configcluster_configdisk_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `worker_config` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.dataproc_cluster.cluster_config.worker_config.new` constructs a new object with attributes and blocks configured for the `worker_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `image_uri` (`string`): The URI for the image to use for this master/worker When `null`, the `image_uri` field will be omitted from the resulting object.\n  - `machine_type` (`string`): The name of a Google Compute Engine machine type to create for the master/worker When `null`, the `machine_type` field will be omitted from the resulting object.\n  - `min_cpu_platform` (`string`): The name of a minimum generation of CPU family for the master/worker. If not specified, GCP will default to a predetermined computed value for each zone. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.\n  - `min_num_instances` (`number`): The minimum number of primary worker instances to create. When `null`, the `min_num_instances` field will be omitted from the resulting object.\n  - `num_instances` (`number`): Specifies the number of worker nodes to create. If not specified, GCP will default to a predetermined computed value. When `null`, the `num_instances` field will be omitted from the resulting object.\n  - `accelerators` (`list[obj]`): The Compute Engine accelerator (GPU) configuration for these instances. Can be specified multiple times. When `null`, the `accelerators` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.worker_config.accelerators.new](#fn-cluster_configcluster_configacceleratorsnew) constructor.\n  - `disk_config` (`list[obj]`): Disk Config When `null`, the `disk_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.worker_config.disk_config.new](#fn-cluster_configcluster_configdisk_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `worker_config` sub block.\n', args=[]),
       new(
         accelerators=null,
         disk_config=null,
         image_uri=null,
         machine_type=null,
         min_cpu_platform=null,
+        min_num_instances=null,
         num_instances=null
       ):: std.prune(a={
         accelerators: accelerators,
@@ -324,11 +345,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         image_uri: image_uri,
         machine_type: machine_type,
         min_cpu_platform: min_cpu_platform,
+        min_num_instances: min_num_instances,
         num_instances: num_instances,
       }),
     },
   },
-  '#new':: d.fn(help="\n`google.dataproc_cluster.new` injects a new `google_dataproc_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataproc_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataproc_cluster` using the reference:\n\n    $._ref.google_dataproc_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataproc_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `graceful_decommission_timeout` (`string`): The timeout duration which allows graceful decomissioning when you change the number of worker nodes directly through a terraform apply When `null`, the `graceful_decommission_timeout` field will be omitted from the resulting object.\n  - `labels` (`obj`): The list of labels (key/value pairs) to be applied to instances in the cluster. GCP generates some itself including goog-dataproc-cluster-name which is the name of the cluster. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the cluster, unique within the project and zone.\n  - `project` (`string`): The ID of the project in which the cluster will exist. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region in which the cluster and associated nodes will be created in. Defaults to global. When `null`, the `region` field will be omitted from the resulting object.\n  - `cluster_config` (`list[obj]`): Allows you to configure various aspects of the cluster. When `null`, the `cluster_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.new](#fn-cluster_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n  - `virtual_cluster_config` (`list[obj]`): The virtual cluster config is used when creating a Dataproc cluster that does not directly control the underlying compute resources, for example, when creating a Dataproc-on-GKE cluster. Dataproc may set default values, and values may change when clusters are updated. Exactly one of config or virtualClusterConfig must be specified. When `null`, the `virtual_cluster_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.virtual_cluster_config.new](#fn-virtual_cluster_confignew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.dataproc_cluster.new` injects a new `google_dataproc_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataproc_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataproc_cluster` using the reference:\n\n    $._ref.google_dataproc_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataproc_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `graceful_decommission_timeout` (`string`): The timeout duration which allows graceful decomissioning when you change the number of worker nodes directly through a terraform apply When `null`, the `graceful_decommission_timeout` field will be omitted from the resulting object.\n  - `labels` (`obj`): The list of the labels (key/value pairs) configured on the resource and to be applied to instances in the cluster.\n\t\t\t\t\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the cluster, unique within the project and zone.\n  - `project` (`string`): The ID of the project in which the cluster will exist. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region in which the cluster and associated nodes will be created in. Defaults to global. When `null`, the `region` field will be omitted from the resulting object.\n  - `cluster_config` (`list[obj]`): Allows you to configure various aspects of the cluster. When `null`, the `cluster_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.new](#fn-cluster_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n  - `virtual_cluster_config` (`list[obj]`): The virtual cluster config is used when creating a Dataproc cluster that does not directly control the underlying compute resources, for example, when creating a Dataproc-on-GKE cluster. Dataproc may set default values, and values may change when clusters are updated. Exactly one of config or virtualClusterConfig must be specified. When `null`, the `virtual_cluster_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.virtual_cluster_config.new](#fn-virtual_cluster_confignew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -355,7 +377,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.dataproc_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `dataproc_cluster`\nTerraform resource.\n\nUnlike [google.dataproc_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `graceful_decommission_timeout` (`string`): The timeout duration which allows graceful decomissioning when you change the number of worker nodes directly through a terraform apply When `null`, the `graceful_decommission_timeout` field will be omitted from the resulting object.\n  - `labels` (`obj`): The list of labels (key/value pairs) to be applied to instances in the cluster. GCP generates some itself including goog-dataproc-cluster-name which is the name of the cluster. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the cluster, unique within the project and zone.\n  - `project` (`string`): The ID of the project in which the cluster will exist. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region in which the cluster and associated nodes will be created in. Defaults to global. When `null`, the `region` field will be omitted from the resulting object.\n  - `cluster_config` (`list[obj]`): Allows you to configure various aspects of the cluster. When `null`, the `cluster_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.new](#fn-cluster_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n  - `virtual_cluster_config` (`list[obj]`): The virtual cluster config is used when creating a Dataproc cluster that does not directly control the underlying compute resources, for example, when creating a Dataproc-on-GKE cluster. Dataproc may set default values, and values may change when clusters are updated. Exactly one of config or virtualClusterConfig must be specified. When `null`, the `virtual_cluster_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.virtual_cluster_config.new](#fn-virtual_cluster_confignew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataproc_cluster` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.dataproc_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `dataproc_cluster`\nTerraform resource.\n\nUnlike [google.dataproc_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `graceful_decommission_timeout` (`string`): The timeout duration which allows graceful decomissioning when you change the number of worker nodes directly through a terraform apply When `null`, the `graceful_decommission_timeout` field will be omitted from the resulting object.\n  - `labels` (`obj`): The list of the labels (key/value pairs) configured on the resource and to be applied to instances in the cluster.\n\t\t\t\t\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the cluster, unique within the project and zone.\n  - `project` (`string`): The ID of the project in which the cluster will exist. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region in which the cluster and associated nodes will be created in. Defaults to global. When `null`, the `region` field will be omitted from the resulting object.\n  - `cluster_config` (`list[obj]`): Allows you to configure various aspects of the cluster. When `null`, the `cluster_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.new](#fn-cluster_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n  - `virtual_cluster_config` (`list[obj]`): The virtual cluster config is used when creating a Dataproc cluster that does not directly control the underlying compute resources, for example, when creating a Dataproc-on-GKE cluster. Dataproc may set default values, and values may change when clusters are updated. Exactly one of config or virtualClusterConfig must be specified. When `null`, the `virtual_cluster_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.virtual_cluster_config.new](#fn-virtual_cluster_confignew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataproc_cluster` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     cluster_config=null,
diff --git a/4.x/_gen/resources/dataproc_job.libsonnet b/4.x/_gen/resources/dataproc_job.libsonnet
index 0b16f451..858545b7 100644
--- a/4.x/_gen/resources/dataproc_job.libsonnet
+++ b/4.x/_gen/resources/dataproc_job.libsonnet
@@ -50,7 +50,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       script_variables: script_variables,
     }),
   },
-  '#new':: d.fn(help="\n`google.dataproc_job.new` injects a new `google_dataproc_job` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataproc_job.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataproc_job` using the reference:\n\n    $._ref.google_dataproc_job.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataproc_job.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `force_delete` (`bool`): By default, you can only delete inactive jobs within Dataproc. Setting this to true, and calling destroy, will ensure that the job is first cancelled before issuing the delete. When `null`, the `force_delete` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. The labels to associate with this job. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): The project in which the cluster can be found and jobs subsequently run against. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The Cloud Dataproc region. This essentially determines which clusters are available for this job to be submitted to. If not specified, defaults to global. When `null`, the `region` field will be omitted from the resulting object.\n  - `hadoop_config` (`list[obj]`): The config of Hadoop job When `null`, the `hadoop_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.hadoop_config.new](#fn-hadoop_confignew) constructor.\n  - `hive_config` (`list[obj]`): The config of hive job When `null`, the `hive_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.hive_config.new](#fn-hive_confignew) constructor.\n  - `pig_config` (`list[obj]`): The config of pag job. When `null`, the `pig_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.pig_config.new](#fn-pig_confignew) constructor.\n  - `placement` (`list[obj]`): The config of job placement. When `null`, the `placement` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.placement.new](#fn-placementnew) constructor.\n  - `presto_config` (`list[obj]`): The config of presto job When `null`, the `presto_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.presto_config.new](#fn-presto_confignew) constructor.\n  - `pyspark_config` (`list[obj]`): The config of pySpark job. When `null`, the `pyspark_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.pyspark_config.new](#fn-pyspark_confignew) constructor.\n  - `reference` (`list[obj]`): The reference of the job When `null`, the `reference` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.reference.new](#fn-referencenew) constructor.\n  - `scheduling` (`list[obj]`): Optional. Job scheduling configuration. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.scheduling.new](#fn-schedulingnew) constructor.\n  - `spark_config` (`list[obj]`): The config of the Spark job. When `null`, the `spark_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.spark_config.new](#fn-spark_confignew) constructor.\n  - `sparksql_config` (`list[obj]`): The config of SparkSql job When `null`, the `sparksql_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.sparksql_config.new](#fn-sparksql_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.dataproc_job.new` injects a new `google_dataproc_job` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataproc_job.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataproc_job` using the reference:\n\n    $._ref.google_dataproc_job.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataproc_job.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `force_delete` (`bool`): By default, you can only delete inactive jobs within Dataproc. Setting this to true, and calling destroy, will ensure that the job is first cancelled before issuing the delete. When `null`, the `force_delete` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. The labels to associate with this job.\n\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): The project in which the cluster can be found and jobs subsequently run against. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The Cloud Dataproc region. This essentially determines which clusters are available for this job to be submitted to. If not specified, defaults to global. When `null`, the `region` field will be omitted from the resulting object.\n  - `hadoop_config` (`list[obj]`): The config of Hadoop job When `null`, the `hadoop_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.hadoop_config.new](#fn-hadoop_confignew) constructor.\n  - `hive_config` (`list[obj]`): The config of hive job When `null`, the `hive_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.hive_config.new](#fn-hive_confignew) constructor.\n  - `pig_config` (`list[obj]`): The config of pag job. When `null`, the `pig_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.pig_config.new](#fn-pig_confignew) constructor.\n  - `placement` (`list[obj]`): The config of job placement. When `null`, the `placement` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.placement.new](#fn-placementnew) constructor.\n  - `presto_config` (`list[obj]`): The config of presto job When `null`, the `presto_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.presto_config.new](#fn-presto_confignew) constructor.\n  - `pyspark_config` (`list[obj]`): The config of pySpark job. When `null`, the `pyspark_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.pyspark_config.new](#fn-pyspark_confignew) constructor.\n  - `reference` (`list[obj]`): The reference of the job When `null`, the `reference` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.reference.new](#fn-referencenew) constructor.\n  - `scheduling` (`list[obj]`): Optional. Job scheduling configuration. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.scheduling.new](#fn-schedulingnew) constructor.\n  - `spark_config` (`list[obj]`): The config of the Spark job. When `null`, the `spark_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.spark_config.new](#fn-spark_confignew) constructor.\n  - `sparksql_config` (`list[obj]`): The config of SparkSql job When `null`, the `sparksql_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.sparksql_config.new](#fn-sparksql_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     force_delete=null,
@@ -91,7 +91,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.dataproc_job.newAttrs` constructs a new object with attributes and blocks configured for the `dataproc_job`\nTerraform resource.\n\nUnlike [google.dataproc_job.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `force_delete` (`bool`): By default, you can only delete inactive jobs within Dataproc. Setting this to true, and calling destroy, will ensure that the job is first cancelled before issuing the delete. When `null`, the `force_delete` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. The labels to associate with this job. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): The project in which the cluster can be found and jobs subsequently run against. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The Cloud Dataproc region. This essentially determines which clusters are available for this job to be submitted to. If not specified, defaults to global. When `null`, the `region` field will be omitted from the resulting object.\n  - `hadoop_config` (`list[obj]`): The config of Hadoop job When `null`, the `hadoop_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.hadoop_config.new](#fn-hadoop_confignew) constructor.\n  - `hive_config` (`list[obj]`): The config of hive job When `null`, the `hive_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.hive_config.new](#fn-hive_confignew) constructor.\n  - `pig_config` (`list[obj]`): The config of pag job. When `null`, the `pig_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.pig_config.new](#fn-pig_confignew) constructor.\n  - `placement` (`list[obj]`): The config of job placement. When `null`, the `placement` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.placement.new](#fn-placementnew) constructor.\n  - `presto_config` (`list[obj]`): The config of presto job When `null`, the `presto_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.presto_config.new](#fn-presto_confignew) constructor.\n  - `pyspark_config` (`list[obj]`): The config of pySpark job. When `null`, the `pyspark_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.pyspark_config.new](#fn-pyspark_confignew) constructor.\n  - `reference` (`list[obj]`): The reference of the job When `null`, the `reference` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.reference.new](#fn-referencenew) constructor.\n  - `scheduling` (`list[obj]`): Optional. Job scheduling configuration. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.scheduling.new](#fn-schedulingnew) constructor.\n  - `spark_config` (`list[obj]`): The config of the Spark job. When `null`, the `spark_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.spark_config.new](#fn-spark_confignew) constructor.\n  - `sparksql_config` (`list[obj]`): The config of SparkSql job When `null`, the `sparksql_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.sparksql_config.new](#fn-sparksql_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataproc_job` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.dataproc_job.newAttrs` constructs a new object with attributes and blocks configured for the `dataproc_job`\nTerraform resource.\n\nUnlike [google.dataproc_job.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `force_delete` (`bool`): By default, you can only delete inactive jobs within Dataproc. Setting this to true, and calling destroy, will ensure that the job is first cancelled before issuing the delete. When `null`, the `force_delete` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. The labels to associate with this job.\n\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): The project in which the cluster can be found and jobs subsequently run against. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The Cloud Dataproc region. This essentially determines which clusters are available for this job to be submitted to. If not specified, defaults to global. When `null`, the `region` field will be omitted from the resulting object.\n  - `hadoop_config` (`list[obj]`): The config of Hadoop job When `null`, the `hadoop_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.hadoop_config.new](#fn-hadoop_confignew) constructor.\n  - `hive_config` (`list[obj]`): The config of hive job When `null`, the `hive_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.hive_config.new](#fn-hive_confignew) constructor.\n  - `pig_config` (`list[obj]`): The config of pag job. When `null`, the `pig_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.pig_config.new](#fn-pig_confignew) constructor.\n  - `placement` (`list[obj]`): The config of job placement. When `null`, the `placement` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.placement.new](#fn-placementnew) constructor.\n  - `presto_config` (`list[obj]`): The config of presto job When `null`, the `presto_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.presto_config.new](#fn-presto_confignew) constructor.\n  - `pyspark_config` (`list[obj]`): The config of pySpark job. When `null`, the `pyspark_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.pyspark_config.new](#fn-pyspark_confignew) constructor.\n  - `reference` (`list[obj]`): The reference of the job When `null`, the `reference` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.reference.new](#fn-referencenew) constructor.\n  - `scheduling` (`list[obj]`): Optional. Job scheduling configuration. When `null`, the `scheduling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.scheduling.new](#fn-schedulingnew) constructor.\n  - `spark_config` (`list[obj]`): The config of the Spark job. When `null`, the `spark_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.spark_config.new](#fn-spark_confignew) constructor.\n  - `sparksql_config` (`list[obj]`): The config of SparkSql job When `null`, the `sparksql_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.sparksql_config.new](#fn-sparksql_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataproc_job` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     force_delete=null,
     hadoop_config=null,
diff --git a/4.x/_gen/resources/dataproc_metastore_service.libsonnet b/4.x/_gen/resources/dataproc_metastore_service.libsonnet
index 23e35d52..a4cf4d22 100644
--- a/4.x/_gen/resources/dataproc_metastore_service.libsonnet
+++ b/4.x/_gen/resources/dataproc_metastore_service.libsonnet
@@ -68,7 +68,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       consumers: consumers,
     }),
   },
-  '#new':: d.fn(help="\n`google.dataproc_metastore_service.new` injects a new `google_dataproc_metastore_service` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataproc_metastore_service.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataproc_metastore_service` using the reference:\n\n    $._ref.google_dataproc_metastore_service.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataproc_metastore_service.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `database_type` (`string`): The database type that the Metastore service stores its data. Default value: \u0026#34;MYSQL\u0026#34; Possible values: [\u0026#34;MYSQL\u0026#34;, \u0026#34;SPANNER\u0026#34;] When `null`, the `database_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the metastore service. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the metastore service should reside.\nThe default value is \u0026#39;global\u0026#39;. When `null`, the `location` field will be omitted from the resulting object.\n  - `network` (`string`): The relative resource name of the VPC network on which the instance can be accessed. It is specified in the following form:\n\n\u0026#34;projects/{projectNumber}/global/networks/{network_id}\u0026#34;. When `null`, the `network` field will be omitted from the resulting object.\n  - `port` (`number`): The TCP port at which the metastore service is reached. Default: 9083. When `null`, the `port` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `release_channel` (`string`): The release channel of the service. If unspecified, defaults to \u0026#39;STABLE\u0026#39;. Default value: \u0026#34;STABLE\u0026#34; Possible values: [\u0026#34;CANARY\u0026#34;, \u0026#34;STABLE\u0026#34;] When `null`, the `release_channel` field will be omitted from the resulting object.\n  - `service_id` (`string`): The ID of the metastore service. The id must contain only letters (a-z, A-Z), numbers (0-9), underscores (_),\nand hyphens (-). Cannot begin or end with underscore or hyphen. Must consist of between\n3 and 63 characters.\n  - `tier` (`string`): The tier of the service. Possible values: [\u0026#34;DEVELOPER\u0026#34;, \u0026#34;ENTERPRISE\u0026#34;] When `null`, the `tier` field will be omitted from the resulting object.\n  - `encryption_config` (`list[obj]`): Information used to configure the Dataproc Metastore service to encrypt\ncustomer data at rest. When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.encryption_config.new](#fn-encryption_confignew) constructor.\n  - `hive_metastore_config` (`list[obj]`): Configuration information specific to running Hive metastore software as the metastore service. When `null`, the `hive_metastore_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.hive_metastore_config.new](#fn-hive_metastore_confignew) constructor.\n  - `maintenance_window` (`list[obj]`): The one hour maintenance window of the metastore service.\nThis specifies when the service can be restarted for maintenance purposes in UTC time.\nMaintenance window is not needed for services with the \u0026#39;SPANNER\u0026#39; database type. When `null`, the `maintenance_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.maintenance_window.new](#fn-maintenance_windownew) constructor.\n  - `network_config` (`list[obj]`): The configuration specifying the network settings for the Dataproc Metastore service. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.network_config.new](#fn-network_confignew) constructor.\n  - `scaling_config` (`list[obj]`): Represents the scaling configuration of a metastore service. When `null`, the `scaling_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.scaling_config.new](#fn-scaling_confignew) constructor.\n  - `telemetry_config` (`list[obj]`): The configuration specifying telemetry settings for the Dataproc Metastore service. If unspecified defaults to JSON. When `null`, the `telemetry_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.telemetry_config.new](#fn-telemetry_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.dataproc_metastore_service.new` injects a new `google_dataproc_metastore_service` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataproc_metastore_service.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataproc_metastore_service` using the reference:\n\n    $._ref.google_dataproc_metastore_service.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataproc_metastore_service.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `database_type` (`string`): The database type that the Metastore service stores its data. Default value: \u0026#34;MYSQL\u0026#34; Possible values: [\u0026#34;MYSQL\u0026#34;, \u0026#34;SPANNER\u0026#34;] When `null`, the `database_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the metastore service.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the metastore service should reside.\nThe default value is \u0026#39;global\u0026#39;. When `null`, the `location` field will be omitted from the resulting object.\n  - `network` (`string`): The relative resource name of the VPC network on which the instance can be accessed. It is specified in the following form:\n\n\u0026#34;projects/{projectNumber}/global/networks/{network_id}\u0026#34;. When `null`, the `network` field will be omitted from the resulting object.\n  - `port` (`number`): The TCP port at which the metastore service is reached. Default: 9083. When `null`, the `port` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `release_channel` (`string`): The release channel of the service. If unspecified, defaults to \u0026#39;STABLE\u0026#39;. Default value: \u0026#34;STABLE\u0026#34; Possible values: [\u0026#34;CANARY\u0026#34;, \u0026#34;STABLE\u0026#34;] When `null`, the `release_channel` field will be omitted from the resulting object.\n  - `service_id` (`string`): The ID of the metastore service. The id must contain only letters (a-z, A-Z), numbers (0-9), underscores (_),\nand hyphens (-). Cannot begin or end with underscore or hyphen. Must consist of between\n3 and 63 characters.\n  - `tier` (`string`): The tier of the service. Possible values: [\u0026#34;DEVELOPER\u0026#34;, \u0026#34;ENTERPRISE\u0026#34;] When `null`, the `tier` field will be omitted from the resulting object.\n  - `encryption_config` (`list[obj]`): Information used to configure the Dataproc Metastore service to encrypt\ncustomer data at rest. When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.encryption_config.new](#fn-encryption_confignew) constructor.\n  - `hive_metastore_config` (`list[obj]`): Configuration information specific to running Hive metastore software as the metastore service. When `null`, the `hive_metastore_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.hive_metastore_config.new](#fn-hive_metastore_confignew) constructor.\n  - `maintenance_window` (`list[obj]`): The one hour maintenance window of the metastore service.\nThis specifies when the service can be restarted for maintenance purposes in UTC time.\nMaintenance window is not needed for services with the \u0026#39;SPANNER\u0026#39; database type. When `null`, the `maintenance_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.maintenance_window.new](#fn-maintenance_windownew) constructor.\n  - `network_config` (`list[obj]`): The configuration specifying the network settings for the Dataproc Metastore service. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.network_config.new](#fn-network_confignew) constructor.\n  - `scaling_config` (`list[obj]`): Represents the scaling configuration of a metastore service. When `null`, the `scaling_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.scaling_config.new](#fn-scaling_confignew) constructor.\n  - `telemetry_config` (`list[obj]`): The configuration specifying telemetry settings for the Dataproc Metastore service. If unspecified defaults to JSON. When `null`, the `telemetry_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.telemetry_config.new](#fn-telemetry_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     service_id,
@@ -111,7 +111,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.dataproc_metastore_service.newAttrs` constructs a new object with attributes and blocks configured for the `dataproc_metastore_service`\nTerraform resource.\n\nUnlike [google.dataproc_metastore_service.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `database_type` (`string`): The database type that the Metastore service stores its data. Default value: "MYSQL" Possible values: ["MYSQL", "SPANNER"] When `null`, the `database_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the metastore service. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the metastore service should reside.\nThe default value is 'global'. When `null`, the `location` field will be omitted from the resulting object.\n  - `network` (`string`): The relative resource name of the VPC network on which the instance can be accessed. It is specified in the following form:\n\n"projects/{projectNumber}/global/networks/{network_id}". When `null`, the `network` field will be omitted from the resulting object.\n  - `port` (`number`): The TCP port at which the metastore service is reached. Default: 9083. When `null`, the `port` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `release_channel` (`string`): The release channel of the service. If unspecified, defaults to 'STABLE'. Default value: "STABLE" Possible values: ["CANARY", "STABLE"] When `null`, the `release_channel` field will be omitted from the resulting object.\n  - `service_id` (`string`): The ID of the metastore service. The id must contain only letters (a-z, A-Z), numbers (0-9), underscores (_),\nand hyphens (-). Cannot begin or end with underscore or hyphen. Must consist of between\n3 and 63 characters.\n  - `tier` (`string`): The tier of the service. Possible values: ["DEVELOPER", "ENTERPRISE"] When `null`, the `tier` field will be omitted from the resulting object.\n  - `encryption_config` (`list[obj]`): Information used to configure the Dataproc Metastore service to encrypt\ncustomer data at rest. When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.encryption_config.new](#fn-encryption_confignew) constructor.\n  - `hive_metastore_config` (`list[obj]`): Configuration information specific to running Hive metastore software as the metastore service. When `null`, the `hive_metastore_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.hive_metastore_config.new](#fn-hive_metastore_confignew) constructor.\n  - `maintenance_window` (`list[obj]`): The one hour maintenance window of the metastore service.\nThis specifies when the service can be restarted for maintenance purposes in UTC time.\nMaintenance window is not needed for services with the 'SPANNER' database type. When `null`, the `maintenance_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.maintenance_window.new](#fn-maintenance_windownew) constructor.\n  - `network_config` (`list[obj]`): The configuration specifying the network settings for the Dataproc Metastore service. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.network_config.new](#fn-network_confignew) constructor.\n  - `scaling_config` (`list[obj]`): Represents the scaling configuration of a metastore service. When `null`, the `scaling_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.scaling_config.new](#fn-scaling_confignew) constructor.\n  - `telemetry_config` (`list[obj]`): The configuration specifying telemetry settings for the Dataproc Metastore service. If unspecified defaults to JSON. When `null`, the `telemetry_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.telemetry_config.new](#fn-telemetry_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataproc_metastore_service` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.dataproc_metastore_service.newAttrs` constructs a new object with attributes and blocks configured for the `dataproc_metastore_service`\nTerraform resource.\n\nUnlike [google.dataproc_metastore_service.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `database_type` (`string`): The database type that the Metastore service stores its data. Default value: "MYSQL" Possible values: ["MYSQL", "SPANNER"] When `null`, the `database_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the metastore service.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location where the metastore service should reside.\nThe default value is 'global'. When `null`, the `location` field will be omitted from the resulting object.\n  - `network` (`string`): The relative resource name of the VPC network on which the instance can be accessed. It is specified in the following form:\n\n"projects/{projectNumber}/global/networks/{network_id}". When `null`, the `network` field will be omitted from the resulting object.\n  - `port` (`number`): The TCP port at which the metastore service is reached. Default: 9083. When `null`, the `port` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `release_channel` (`string`): The release channel of the service. If unspecified, defaults to 'STABLE'. Default value: "STABLE" Possible values: ["CANARY", "STABLE"] When `null`, the `release_channel` field will be omitted from the resulting object.\n  - `service_id` (`string`): The ID of the metastore service. The id must contain only letters (a-z, A-Z), numbers (0-9), underscores (_),\nand hyphens (-). Cannot begin or end with underscore or hyphen. Must consist of between\n3 and 63 characters.\n  - `tier` (`string`): The tier of the service. Possible values: ["DEVELOPER", "ENTERPRISE"] When `null`, the `tier` field will be omitted from the resulting object.\n  - `encryption_config` (`list[obj]`): Information used to configure the Dataproc Metastore service to encrypt\ncustomer data at rest. When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.encryption_config.new](#fn-encryption_confignew) constructor.\n  - `hive_metastore_config` (`list[obj]`): Configuration information specific to running Hive metastore software as the metastore service. When `null`, the `hive_metastore_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.hive_metastore_config.new](#fn-hive_metastore_confignew) constructor.\n  - `maintenance_window` (`list[obj]`): The one hour maintenance window of the metastore service.\nThis specifies when the service can be restarted for maintenance purposes in UTC time.\nMaintenance window is not needed for services with the 'SPANNER' database type. When `null`, the `maintenance_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.maintenance_window.new](#fn-maintenance_windownew) constructor.\n  - `network_config` (`list[obj]`): The configuration specifying the network settings for the Dataproc Metastore service. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.network_config.new](#fn-network_confignew) constructor.\n  - `scaling_config` (`list[obj]`): Represents the scaling configuration of a metastore service. When `null`, the `scaling_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.scaling_config.new](#fn-scaling_confignew) constructor.\n  - `telemetry_config` (`list[obj]`): The configuration specifying telemetry settings for the Dataproc Metastore service. If unspecified defaults to JSON. When `null`, the `telemetry_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.telemetry_config.new](#fn-telemetry_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_metastore_service.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataproc_metastore_service` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     service_id,
     database_type=null,
diff --git a/4.x/_gen/resources/dataproc_workflow_template.libsonnet b/4.x/_gen/resources/dataproc_workflow_template.libsonnet
index 3200ec9f..d51da642 100644
--- a/4.x/_gen/resources/dataproc_workflow_template.libsonnet
+++ b/4.x/_gen/resources/dataproc_workflow_template.libsonnet
@@ -290,7 +290,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
-  '#new':: d.fn(help="\n`google.dataproc_workflow_template.new` injects a new `google_dataproc_workflow_template` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataproc_workflow_template.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataproc_workflow_template` using the reference:\n\n    $._ref.google_dataproc_workflow_template.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataproc_workflow_template.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `dag_timeout` (`string`): Optional. Timeout duration for the DAG of jobs, expressed in seconds (see [JSON representation of duration](https://developers.google.com/protocol-buffers/docs/proto3#json)). The timeout duration must be from 10 minutes (\u0026#34;600s\u0026#34;) to 24 hours (\u0026#34;86400s\u0026#34;). The timer begins when the first job is submitted. If the workflow is running at the end of the timeout period, any remaining jobs are cancelled, the workflow is ended, and if the workflow was running on a [managed cluster](/dataproc/docs/concepts/workflows/using-workflows#configuring_or_selecting_a_cluster), the cluster is deleted. When `null`, the `dag_timeout` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. The labels to associate with this template. These labels will be propagated to all jobs and clusters created by the workflow instance. Label **keys** must contain 1 to 63 characters, and must conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). Label **values** may be empty, but, if present, must contain 1 to 63 characters, and must conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). No more than 32 labels can be associated with a template. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Output only. The resource name of the workflow template, as described in https://cloud.google.com/apis/design/resource_names. * For `projects.regions.workflowTemplates`, the resource name of the template has the following format: `projects/{project_id}/regions/{region}/workflowTemplates/{template_id}` * For `projects.locations.workflowTemplates`, the resource name of the template has the following format: `projects/{project_id}/locations/{location}/workflowTemplates/{template_id}`\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `version` (`number`): Output only. The current version of this workflow template. When `null`, the `version` field will be omitted from the resulting object.\n  - `jobs` (`list[obj]`): Required. The Directed Acyclic Graph of Jobs to submit. When `null`, the `jobs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_workflow_template.jobs.new](#fn-jobsnew) constructor.\n  - `parameters` (`list[obj]`): Optional. Template parameters whose values are substituted into the template. Values for parameters must be provided when the template is instantiated. When `null`, the `parameters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_workflow_template.parameters.new](#fn-parametersnew) constructor.\n  - `placement` (`list[obj]`): Required. WorkflowTemplate scheduling information. When `null`, the `placement` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_workflow_template.placement.new](#fn-placementnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_workflow_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.dataproc_workflow_template.new` injects a new `google_dataproc_workflow_template` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dataproc_workflow_template.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dataproc_workflow_template` using the reference:\n\n    $._ref.google_dataproc_workflow_template.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dataproc_workflow_template.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `dag_timeout` (`string`): Optional. Timeout duration for the DAG of jobs, expressed in seconds (see [JSON representation of duration](https://developers.google.com/protocol-buffers/docs/proto3#json)). The timeout duration must be from 10 minutes (\u0026#34;600s\u0026#34;) to 24 hours (\u0026#34;86400s\u0026#34;). The timer begins when the first job is submitted. If the workflow is running at the end of the timeout period, any remaining jobs are cancelled, the workflow is ended, and if the workflow was running on a [managed cluster](/dataproc/docs/concepts/workflows/using-workflows#configuring_or_selecting_a_cluster), the cluster is deleted. When `null`, the `dag_timeout` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. The labels to associate with this template. These labels will be propagated to all jobs and clusters created by the workflow instance. Label **keys** must contain 1 to 63 characters, and must conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). Label **values** may be empty, but, if present, must contain 1 to 63 characters, and must conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). No more than 32 labels can be associated with a template.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Output only. The resource name of the workflow template, as described in https://cloud.google.com/apis/design/resource_names. * For `projects.regions.workflowTemplates`, the resource name of the template has the following format: `projects/{project_id}/regions/{region}/workflowTemplates/{template_id}` * For `projects.locations.workflowTemplates`, the resource name of the template has the following format: `projects/{project_id}/locations/{location}/workflowTemplates/{template_id}`\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `version` (`number`): Output only. The current version of this workflow template. When `null`, the `version` field will be omitted from the resulting object.\n  - `jobs` (`list[obj]`): Required. The Directed Acyclic Graph of Jobs to submit. When `null`, the `jobs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_workflow_template.jobs.new](#fn-jobsnew) constructor.\n  - `parameters` (`list[obj]`): Optional. Template parameters whose values are substituted into the template. Values for parameters must be provided when the template is instantiated. When `null`, the `parameters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_workflow_template.parameters.new](#fn-parametersnew) constructor.\n  - `placement` (`list[obj]`): Required. WorkflowTemplate scheduling information. When `null`, the `placement` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_workflow_template.placement.new](#fn-placementnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_workflow_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -321,7 +321,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.dataproc_workflow_template.newAttrs` constructs a new object with attributes and blocks configured for the `dataproc_workflow_template`\nTerraform resource.\n\nUnlike [google.dataproc_workflow_template.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `dag_timeout` (`string`): Optional. Timeout duration for the DAG of jobs, expressed in seconds (see [JSON representation of duration](https://developers.google.com/protocol-buffers/docs/proto3#json)). The timeout duration must be from 10 minutes ("600s") to 24 hours ("86400s"). The timer begins when the first job is submitted. If the workflow is running at the end of the timeout period, any remaining jobs are cancelled, the workflow is ended, and if the workflow was running on a [managed cluster](/dataproc/docs/concepts/workflows/using-workflows#configuring_or_selecting_a_cluster), the cluster is deleted. When `null`, the `dag_timeout` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. The labels to associate with this template. These labels will be propagated to all jobs and clusters created by the workflow instance. Label **keys** must contain 1 to 63 characters, and must conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). Label **values** may be empty, but, if present, must contain 1 to 63 characters, and must conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). No more than 32 labels can be associated with a template. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Output only. The resource name of the workflow template, as described in https://cloud.google.com/apis/design/resource_names. * For `projects.regions.workflowTemplates`, the resource name of the template has the following format: `projects/{project_id}/regions/{region}/workflowTemplates/{template_id}` * For `projects.locations.workflowTemplates`, the resource name of the template has the following format: `projects/{project_id}/locations/{location}/workflowTemplates/{template_id}`\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `version` (`number`): Output only. The current version of this workflow template. When `null`, the `version` field will be omitted from the resulting object.\n  - `jobs` (`list[obj]`): Required. The Directed Acyclic Graph of Jobs to submit. When `null`, the `jobs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_workflow_template.jobs.new](#fn-jobsnew) constructor.\n  - `parameters` (`list[obj]`): Optional. Template parameters whose values are substituted into the template. Values for parameters must be provided when the template is instantiated. When `null`, the `parameters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_workflow_template.parameters.new](#fn-parametersnew) constructor.\n  - `placement` (`list[obj]`): Required. WorkflowTemplate scheduling information. When `null`, the `placement` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_workflow_template.placement.new](#fn-placementnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_workflow_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataproc_workflow_template` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.dataproc_workflow_template.newAttrs` constructs a new object with attributes and blocks configured for the `dataproc_workflow_template`\nTerraform resource.\n\nUnlike [google.dataproc_workflow_template.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `dag_timeout` (`string`): Optional. Timeout duration for the DAG of jobs, expressed in seconds (see [JSON representation of duration](https://developers.google.com/protocol-buffers/docs/proto3#json)). The timeout duration must be from 10 minutes ("600s") to 24 hours ("86400s"). The timer begins when the first job is submitted. If the workflow is running at the end of the timeout period, any remaining jobs are cancelled, the workflow is ended, and if the workflow was running on a [managed cluster](/dataproc/docs/concepts/workflows/using-workflows#configuring_or_selecting_a_cluster), the cluster is deleted. When `null`, the `dag_timeout` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. The labels to associate with this template. These labels will be propagated to all jobs and clusters created by the workflow instance. Label **keys** must contain 1 to 63 characters, and must conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). Label **values** may be empty, but, if present, must contain 1 to 63 characters, and must conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). No more than 32 labels can be associated with a template.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Output only. The resource name of the workflow template, as described in https://cloud.google.com/apis/design/resource_names. * For `projects.regions.workflowTemplates`, the resource name of the template has the following format: `projects/{project_id}/regions/{region}/workflowTemplates/{template_id}` * For `projects.locations.workflowTemplates`, the resource name of the template has the following format: `projects/{project_id}/locations/{location}/workflowTemplates/{template_id}`\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `version` (`number`): Output only. The current version of this workflow template. When `null`, the `version` field will be omitted from the resulting object.\n  - `jobs` (`list[obj]`): Required. The Directed Acyclic Graph of Jobs to submit. When `null`, the `jobs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_workflow_template.jobs.new](#fn-jobsnew) constructor.\n  - `parameters` (`list[obj]`): Optional. Template parameters whose values are substituted into the template. Values for parameters must be provided when the template is instantiated. When `null`, the `parameters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_workflow_template.parameters.new](#fn-parametersnew) constructor.\n  - `placement` (`list[obj]`): Required. WorkflowTemplate scheduling information. When `null`, the `placement` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_workflow_template.placement.new](#fn-placementnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_workflow_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dataproc_workflow_template` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     name,
diff --git a/4.x/_gen/resources/datastream_connection_profile.libsonnet b/4.x/_gen/resources/datastream_connection_profile.libsonnet
index 79e05847..9a6a446a 100644
--- a/4.x/_gen/resources/datastream_connection_profile.libsonnet
+++ b/4.x/_gen/resources/datastream_connection_profile.libsonnet
@@ -62,7 +62,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
   },
-  '#new':: d.fn(help="\n`google.datastream_connection_profile.new` injects a new `google_datastream_connection_profile` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.datastream_connection_profile.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.datastream_connection_profile` using the reference:\n\n    $._ref.google_datastream_connection_profile.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_datastream_connection_profile.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `connection_profile_id` (`string`): The connection profile identifier.\n  - `display_name` (`string`): Display name.\n  - `labels` (`obj`): Labels. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this connection profile is located in.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `bigquery_profile` (`list[obj]`): BigQuery warehouse profile. When `null`, the `bigquery_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.bigquery_profile.new](#fn-bigquery_profilenew) constructor.\n  - `forward_ssh_connectivity` (`list[obj]`): Forward SSH tunnel connectivity. When `null`, the `forward_ssh_connectivity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.forward_ssh_connectivity.new](#fn-forward_ssh_connectivitynew) constructor.\n  - `gcs_profile` (`list[obj]`): Cloud Storage bucket profile. When `null`, the `gcs_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.gcs_profile.new](#fn-gcs_profilenew) constructor.\n  - `mysql_profile` (`list[obj]`): MySQL database profile. When `null`, the `mysql_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.mysql_profile.new](#fn-mysql_profilenew) constructor.\n  - `oracle_profile` (`list[obj]`): Oracle database profile. When `null`, the `oracle_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.oracle_profile.new](#fn-oracle_profilenew) constructor.\n  - `postgresql_profile` (`list[obj]`): PostgreSQL database profile. When `null`, the `postgresql_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.postgresql_profile.new](#fn-postgresql_profilenew) constructor.\n  - `private_connectivity` (`list[obj]`): Private connectivity. When `null`, the `private_connectivity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.private_connectivity.new](#fn-private_connectivitynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.datastream_connection_profile.new` injects a new `google_datastream_connection_profile` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.datastream_connection_profile.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.datastream_connection_profile` using the reference:\n\n    $._ref.google_datastream_connection_profile.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_datastream_connection_profile.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `connection_profile_id` (`string`): The connection profile identifier.\n  - `display_name` (`string`): Display name.\n  - `labels` (`obj`): Labels.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this connection profile is located in.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `bigquery_profile` (`list[obj]`): BigQuery warehouse profile. When `null`, the `bigquery_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.bigquery_profile.new](#fn-bigquery_profilenew) constructor.\n  - `forward_ssh_connectivity` (`list[obj]`): Forward SSH tunnel connectivity. When `null`, the `forward_ssh_connectivity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.forward_ssh_connectivity.new](#fn-forward_ssh_connectivitynew) constructor.\n  - `gcs_profile` (`list[obj]`): Cloud Storage bucket profile. When `null`, the `gcs_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.gcs_profile.new](#fn-gcs_profilenew) constructor.\n  - `mysql_profile` (`list[obj]`): MySQL database profile. When `null`, the `mysql_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.mysql_profile.new](#fn-mysql_profilenew) constructor.\n  - `oracle_profile` (`list[obj]`): Oracle database profile. When `null`, the `oracle_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.oracle_profile.new](#fn-oracle_profilenew) constructor.\n  - `postgresql_profile` (`list[obj]`): PostgreSQL database profile. When `null`, the `postgresql_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.postgresql_profile.new](#fn-postgresql_profilenew) constructor.\n  - `private_connectivity` (`list[obj]`): Private connectivity. When `null`, the `private_connectivity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.private_connectivity.new](#fn-private_connectivitynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     connection_profile_id,
@@ -99,7 +99,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.datastream_connection_profile.newAttrs` constructs a new object with attributes and blocks configured for the `datastream_connection_profile`\nTerraform resource.\n\nUnlike [google.datastream_connection_profile.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `connection_profile_id` (`string`): The connection profile identifier.\n  - `display_name` (`string`): Display name.\n  - `labels` (`obj`): Labels. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this connection profile is located in.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `bigquery_profile` (`list[obj]`): BigQuery warehouse profile. When `null`, the `bigquery_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.bigquery_profile.new](#fn-bigquery_profilenew) constructor.\n  - `forward_ssh_connectivity` (`list[obj]`): Forward SSH tunnel connectivity. When `null`, the `forward_ssh_connectivity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.forward_ssh_connectivity.new](#fn-forward_ssh_connectivitynew) constructor.\n  - `gcs_profile` (`list[obj]`): Cloud Storage bucket profile. When `null`, the `gcs_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.gcs_profile.new](#fn-gcs_profilenew) constructor.\n  - `mysql_profile` (`list[obj]`): MySQL database profile. When `null`, the `mysql_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.mysql_profile.new](#fn-mysql_profilenew) constructor.\n  - `oracle_profile` (`list[obj]`): Oracle database profile. When `null`, the `oracle_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.oracle_profile.new](#fn-oracle_profilenew) constructor.\n  - `postgresql_profile` (`list[obj]`): PostgreSQL database profile. When `null`, the `postgresql_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.postgresql_profile.new](#fn-postgresql_profilenew) constructor.\n  - `private_connectivity` (`list[obj]`): Private connectivity. When `null`, the `private_connectivity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.private_connectivity.new](#fn-private_connectivitynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `datastream_connection_profile` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.datastream_connection_profile.newAttrs` constructs a new object with attributes and blocks configured for the `datastream_connection_profile`\nTerraform resource.\n\nUnlike [google.datastream_connection_profile.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `connection_profile_id` (`string`): The connection profile identifier.\n  - `display_name` (`string`): Display name.\n  - `labels` (`obj`): Labels.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this connection profile is located in.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `bigquery_profile` (`list[obj]`): BigQuery warehouse profile. When `null`, the `bigquery_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.bigquery_profile.new](#fn-bigquery_profilenew) constructor.\n  - `forward_ssh_connectivity` (`list[obj]`): Forward SSH tunnel connectivity. When `null`, the `forward_ssh_connectivity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.forward_ssh_connectivity.new](#fn-forward_ssh_connectivitynew) constructor.\n  - `gcs_profile` (`list[obj]`): Cloud Storage bucket profile. When `null`, the `gcs_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.gcs_profile.new](#fn-gcs_profilenew) constructor.\n  - `mysql_profile` (`list[obj]`): MySQL database profile. When `null`, the `mysql_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.mysql_profile.new](#fn-mysql_profilenew) constructor.\n  - `oracle_profile` (`list[obj]`): Oracle database profile. When `null`, the `oracle_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.oracle_profile.new](#fn-oracle_profilenew) constructor.\n  - `postgresql_profile` (`list[obj]`): PostgreSQL database profile. When `null`, the `postgresql_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.postgresql_profile.new](#fn-postgresql_profilenew) constructor.\n  - `private_connectivity` (`list[obj]`): Private connectivity. When `null`, the `private_connectivity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.private_connectivity.new](#fn-private_connectivitynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `datastream_connection_profile` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     connection_profile_id,
     display_name,
diff --git a/4.x/_gen/resources/datastream_private_connection.libsonnet b/4.x/_gen/resources/datastream_private_connection.libsonnet
index 01f5a870..bda9f002 100644
--- a/4.x/_gen/resources/datastream_private_connection.libsonnet
+++ b/4.x/_gen/resources/datastream_private_connection.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='datastream_private_connection', url='', help='`datastream_private_connection` represents the `google_datastream_private_connection` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.datastream_private_connection.new` injects a new `google_datastream_private_connection` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.datastream_private_connection.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.datastream_private_connection` using the reference:\n\n    $._ref.google_datastream_private_connection.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_datastream_private_connection.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `display_name` (`string`): Display name.\n  - `labels` (`obj`): Labels. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this private connection is located in.\n  - `private_connection_id` (`string`): The private connectivity identifier.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_private_connection.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vpc_peering_config` (`list[obj]`): The VPC Peering configuration is used to create VPC peering\nbetween Datastream and the consumer\u0026#39;s VPC. When `null`, the `vpc_peering_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_private_connection.vpc_peering_config.new](#fn-vpc_peering_confignew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.datastream_private_connection.new` injects a new `google_datastream_private_connection` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.datastream_private_connection.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.datastream_private_connection` using the reference:\n\n    $._ref.google_datastream_private_connection.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_datastream_private_connection.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `display_name` (`string`): Display name.\n  - `labels` (`obj`): Labels.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this private connection is located in.\n  - `private_connection_id` (`string`): The private connectivity identifier.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_private_connection.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vpc_peering_config` (`list[obj]`): The VPC Peering configuration is used to create VPC peering\nbetween Datastream and the consumer\u0026#39;s VPC. When `null`, the `vpc_peering_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_private_connection.vpc_peering_config.new](#fn-vpc_peering_confignew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     display_name,
@@ -27,7 +27,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.datastream_private_connection.newAttrs` constructs a new object with attributes and blocks configured for the `datastream_private_connection`\nTerraform resource.\n\nUnlike [google.datastream_private_connection.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `display_name` (`string`): Display name.\n  - `labels` (`obj`): Labels. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this private connection is located in.\n  - `private_connection_id` (`string`): The private connectivity identifier.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_private_connection.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vpc_peering_config` (`list[obj]`): The VPC Peering configuration is used to create VPC peering\nbetween Datastream and the consumer's VPC. When `null`, the `vpc_peering_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_private_connection.vpc_peering_config.new](#fn-vpc_peering_confignew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `datastream_private_connection` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.datastream_private_connection.newAttrs` constructs a new object with attributes and blocks configured for the `datastream_private_connection`\nTerraform resource.\n\nUnlike [google.datastream_private_connection.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `display_name` (`string`): Display name.\n  - `labels` (`obj`): Labels.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this private connection is located in.\n  - `private_connection_id` (`string`): The private connectivity identifier.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_private_connection.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vpc_peering_config` (`list[obj]`): The VPC Peering configuration is used to create VPC peering\nbetween Datastream and the consumer's VPC. When `null`, the `vpc_peering_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_private_connection.vpc_peering_config.new](#fn-vpc_peering_confignew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `datastream_private_connection` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     display_name,
     location,
diff --git a/4.x/_gen/resources/datastream_stream.libsonnet b/4.x/_gen/resources/datastream_stream.libsonnet
index 8b5f1a6a..e9d70e41 100644
--- a/4.x/_gen/resources/datastream_stream.libsonnet
+++ b/4.x/_gen/resources/datastream_stream.libsonnet
@@ -232,7 +232,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       gcs_destination_config: gcs_destination_config,
     }),
   },
-  '#new':: d.fn(help="\n`google.datastream_stream.new` injects a new `google_datastream_stream` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.datastream_stream.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.datastream_stream` using the reference:\n\n    $._ref.google_datastream_stream.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_datastream_stream.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `customer_managed_encryption_key` (`string`): A reference to a KMS encryption key. If provided, it will be used to encrypt the data. If left blank, data\nwill be encrypted using an internal Stream-specific encryption key provisioned through KMS. When `null`, the `customer_managed_encryption_key` field will be omitted from the resulting object.\n  - `desired_state` (`string`): Desired state of the Stream. Set this field to \u0026#39;RUNNING\u0026#39; to start the stream, and \u0026#39;PAUSED\u0026#39; to pause the stream. When `null`, the `desired_state` field will be omitted from the resulting object.\n  - `display_name` (`string`): Display name.\n  - `labels` (`obj`): Labels. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this stream is located in.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `stream_id` (`string`): The stream identifier.\n  - `backfill_all` (`list[obj]`): Backfill strategy to automatically backfill the Stream\u0026#39;s objects. Specific objects can be excluded. When `null`, the `backfill_all` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.backfill_all.new](#fn-backfill_allnew) constructor.\n  - `backfill_none` (`list[obj]`): Backfill strategy to disable automatic backfill for the Stream\u0026#39;s objects. When `null`, the `backfill_none` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.backfill_none.new](#fn-backfill_nonenew) constructor.\n  - `destination_config` (`list[obj]`): Destination connection profile configuration. When `null`, the `destination_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.destination_config.new](#fn-destination_confignew) constructor.\n  - `source_config` (`list[obj]`): Source connection profile configuration. When `null`, the `source_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.source_config.new](#fn-source_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.datastream_stream.new` injects a new `google_datastream_stream` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.datastream_stream.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.datastream_stream` using the reference:\n\n    $._ref.google_datastream_stream.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_datastream_stream.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `customer_managed_encryption_key` (`string`): A reference to a KMS encryption key. If provided, it will be used to encrypt the data. If left blank, data\nwill be encrypted using an internal Stream-specific encryption key provisioned through KMS. When `null`, the `customer_managed_encryption_key` field will be omitted from the resulting object.\n  - `desired_state` (`string`): Desired state of the Stream. Set this field to \u0026#39;RUNNING\u0026#39; to start the stream, and \u0026#39;PAUSED\u0026#39; to pause the stream. When `null`, the `desired_state` field will be omitted from the resulting object.\n  - `display_name` (`string`): Display name.\n  - `labels` (`obj`): Labels.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this stream is located in.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `stream_id` (`string`): The stream identifier.\n  - `backfill_all` (`list[obj]`): Backfill strategy to automatically backfill the Stream\u0026#39;s objects. Specific objects can be excluded. When `null`, the `backfill_all` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.backfill_all.new](#fn-backfill_allnew) constructor.\n  - `backfill_none` (`list[obj]`): Backfill strategy to disable automatic backfill for the Stream\u0026#39;s objects. When `null`, the `backfill_none` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.backfill_none.new](#fn-backfill_nonenew) constructor.\n  - `destination_config` (`list[obj]`): Destination connection profile configuration. When `null`, the `destination_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.destination_config.new](#fn-destination_confignew) constructor.\n  - `source_config` (`list[obj]`): Source connection profile configuration. When `null`, the `source_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.source_config.new](#fn-source_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     display_name,
@@ -267,7 +267,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.datastream_stream.newAttrs` constructs a new object with attributes and blocks configured for the `datastream_stream`\nTerraform resource.\n\nUnlike [google.datastream_stream.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `customer_managed_encryption_key` (`string`): A reference to a KMS encryption key. If provided, it will be used to encrypt the data. If left blank, data\nwill be encrypted using an internal Stream-specific encryption key provisioned through KMS. When `null`, the `customer_managed_encryption_key` field will be omitted from the resulting object.\n  - `desired_state` (`string`): Desired state of the Stream. Set this field to 'RUNNING' to start the stream, and 'PAUSED' to pause the stream. When `null`, the `desired_state` field will be omitted from the resulting object.\n  - `display_name` (`string`): Display name.\n  - `labels` (`obj`): Labels. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this stream is located in.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `stream_id` (`string`): The stream identifier.\n  - `backfill_all` (`list[obj]`): Backfill strategy to automatically backfill the Stream's objects. Specific objects can be excluded. When `null`, the `backfill_all` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.backfill_all.new](#fn-backfill_allnew) constructor.\n  - `backfill_none` (`list[obj]`): Backfill strategy to disable automatic backfill for the Stream's objects. When `null`, the `backfill_none` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.backfill_none.new](#fn-backfill_nonenew) constructor.\n  - `destination_config` (`list[obj]`): Destination connection profile configuration. When `null`, the `destination_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.destination_config.new](#fn-destination_confignew) constructor.\n  - `source_config` (`list[obj]`): Source connection profile configuration. When `null`, the `source_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.source_config.new](#fn-source_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `datastream_stream` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.datastream_stream.newAttrs` constructs a new object with attributes and blocks configured for the `datastream_stream`\nTerraform resource.\n\nUnlike [google.datastream_stream.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `customer_managed_encryption_key` (`string`): A reference to a KMS encryption key. If provided, it will be used to encrypt the data. If left blank, data\nwill be encrypted using an internal Stream-specific encryption key provisioned through KMS. When `null`, the `customer_managed_encryption_key` field will be omitted from the resulting object.\n  - `desired_state` (`string`): Desired state of the Stream. Set this field to 'RUNNING' to start the stream, and 'PAUSED' to pause the stream. When `null`, the `desired_state` field will be omitted from the resulting object.\n  - `display_name` (`string`): Display name.\n  - `labels` (`obj`): Labels.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this stream is located in.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `stream_id` (`string`): The stream identifier.\n  - `backfill_all` (`list[obj]`): Backfill strategy to automatically backfill the Stream's objects. Specific objects can be excluded. When `null`, the `backfill_all` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.backfill_all.new](#fn-backfill_allnew) constructor.\n  - `backfill_none` (`list[obj]`): Backfill strategy to disable automatic backfill for the Stream's objects. When `null`, the `backfill_none` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.backfill_none.new](#fn-backfill_nonenew) constructor.\n  - `destination_config` (`list[obj]`): Destination connection profile configuration. When `null`, the `destination_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.destination_config.new](#fn-destination_confignew) constructor.\n  - `source_config` (`list[obj]`): Source connection profile configuration. When `null`, the `source_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.source_config.new](#fn-source_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_stream.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `datastream_stream` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     display_name,
     location,
diff --git a/4.x/_gen/resources/dialogflow_cx_agent.libsonnet b/4.x/_gen/resources/dialogflow_cx_agent.libsonnet
index 04cb0fca..df947c2a 100644
--- a/4.x/_gen/resources/dialogflow_cx_agent.libsonnet
+++ b/4.x/_gen/resources/dialogflow_cx_agent.libsonnet
@@ -2,70 +2,136 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='dialogflow_cx_agent', url='', help='`dialogflow_cx_agent` represents the `google_dialogflow_cx_agent` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.dialogflow_cx_agent.new` injects a new `google_dialogflow_cx_agent` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dialogflow_cx_agent.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dialogflow_cx_agent` using the reference:\n\n    $._ref.google_dialogflow_cx_agent.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dialogflow_cx_agent.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `avatar_uri` (`string`): The URI of the agent\u0026#39;s avatar. Avatars are used throughout the Dialogflow console and in the self-hosted Web Demo integration. When `null`, the `avatar_uri` field will be omitted from the resulting object.\n  - `default_language_code` (`string`): The default language of the agent as a language tag. [See Language Support](https://cloud.google.com/dialogflow/cx/docs/reference/language)\nfor a list of the currently supported language codes. This field cannot be updated after creation.\n  - `description` (`string`): The description of this agent. The maximum length is 500 characters. If exceeded, the request is rejected. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable name of the agent, unique within the location.\n  - `enable_spell_correction` (`bool`): Indicates if automatic spell correction is enabled in detect intent requests. When `null`, the `enable_spell_correction` field will be omitted from the resulting object.\n  - `enable_stackdriver_logging` (`bool`): Determines whether this agent should log conversation queries. When `null`, the `enable_stackdriver_logging` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this agent is located in.\n\n~\u0026gt; **Note:** The first time you are deploying an Agent in your project you must configure location settings.\n This is a one time step but at the moment you can only [configure location settings](https://cloud.google.com/dialogflow/cx/docs/concept/region#location-settings) via the Dialogflow CX console.\n Another options is to use global location so you don\u0026#39;t need to manually configure location settings.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `security_settings` (`string`): Name of the SecuritySettings reference for the agent. Format: projects/\u0026lt;Project ID\u0026gt;/locations/\u0026lt;Location ID\u0026gt;/securitySettings/\u0026lt;Security Settings ID\u0026gt;. When `null`, the `security_settings` field will be omitted from the resulting object.\n  - `supported_language_codes` (`list`): The list of all languages supported by this agent (except for the default_language_code). When `null`, the `supported_language_codes` field will be omitted from the resulting object.\n  - `time_zone` (`string`): The time zone of this agent from the [time zone database](https://www.iana.org/time-zones), e.g., America/New_York,\nEurope/Paris.\n  - `speech_to_text_settings` (`list[obj]`): Settings related to speech recognition. When `null`, the `speech_to_text_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.speech_to_text_settings.new](#fn-speech_to_text_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  advanced_settings:: {
+    audio_export_gcs_destination:: {
+      '#new':: d.fn(help='\n`google.dialogflow_cx_agent.advanced_settings.audio_export_gcs_destination.new` constructs a new object with attributes and blocks configured for the `audio_export_gcs_destination`\nTerraform sub block.\n\n\n\n**Args**:\n  - `uri` (`string`): The Google Cloud Storage URI for the exported objects. Whether a full object name, or just a prefix, its usage depends on the Dialogflow operation.\nFormat: gs://bucket/object-name-or-prefix When `null`, the `uri` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `audio_export_gcs_destination` sub block.\n', args=[]),
+      new(
+        uri=null
+      ):: std.prune(a={
+        uri: uri,
+      }),
+    },
+    dtmf_settings:: {
+      '#new':: d.fn(help='\n`google.dialogflow_cx_agent.advanced_settings.dtmf_settings.new` constructs a new object with attributes and blocks configured for the `dtmf_settings`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): If true, incoming audio is processed for DTMF (dual tone multi frequency) events. For example, if the caller presses a button on their telephone keypad and DTMF processing is enabled, Dialogflow will detect the event (e.g. a "3" was pressed) in the incoming audio and pass the event to the bot to drive business logic (e.g. when 3 is pressed, return the account balance). When `null`, the `enabled` field will be omitted from the resulting object.\n  - `finish_digit` (`string`): The digit that terminates a DTMF digit sequence. When `null`, the `finish_digit` field will be omitted from the resulting object.\n  - `max_digits` (`number`): Max length of DTMF digits. When `null`, the `max_digits` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `dtmf_settings` sub block.\n', args=[]),
+      new(
+        enabled=null,
+        finish_digit=null,
+        max_digits=null
+      ):: std.prune(a={
+        enabled: enabled,
+        finish_digit: finish_digit,
+        max_digits: max_digits,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.dialogflow_cx_agent.advanced_settings.new` constructs a new object with attributes and blocks configured for the `advanced_settings`\nTerraform sub block.\n\n\n\n**Args**:\n  - `audio_export_gcs_destination` (`list[obj]`): If present, incoming audio is exported by Dialogflow to the configured Google Cloud Storage destination. Exposed at the following levels:\n* Agent level\n* Flow level When `null`, the `audio_export_gcs_destination` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.advanced_settings.audio_export_gcs_destination.new](#fn-advanced_settingsaudio_export_gcs_destinationnew) constructor.\n  - `dtmf_settings` (`list[obj]`): Define behaviors for DTMF (dual tone multi frequency). DTMF settings does not override each other. DTMF settings set at different levels define DTMF detections running in parallel. Exposed at the following levels:\n* Agent level\n* Flow level\n* Page level\n* Parameter level When `null`, the `dtmf_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.advanced_settings.dtmf_settings.new](#fn-advanced_settingsdtmf_settingsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `advanced_settings` sub block.\n', args=[]),
+    new(
+      audio_export_gcs_destination=null,
+      dtmf_settings=null
+    ):: std.prune(a={
+      audio_export_gcs_destination: audio_export_gcs_destination,
+      dtmf_settings: dtmf_settings,
+    }),
+  },
+  git_integration_settings:: {
+    github_settings:: {
+      '#new':: d.fn(help='\n`google.dialogflow_cx_agent.git_integration_settings.github_settings.new` constructs a new object with attributes and blocks configured for the `github_settings`\nTerraform sub block.\n\n\n\n**Args**:\n  - `access_token` (`string`): The access token used to authenticate the access to the GitHub repository. When `null`, the `access_token` field will be omitted from the resulting object.\n  - `branches` (`list`): A list of branches configured to be used from Dialogflow. When `null`, the `branches` field will be omitted from the resulting object.\n  - `display_name` (`string`): The unique repository display name for the GitHub repository. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `repository_uri` (`string`): The GitHub repository URI related to the agent. When `null`, the `repository_uri` field will be omitted from the resulting object.\n  - `tracking_branch` (`string`): The branch of the GitHub repository tracked for this agent. When `null`, the `tracking_branch` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `github_settings` sub block.\n', args=[]),
+      new(
+        access_token=null,
+        branches=null,
+        display_name=null,
+        repository_uri=null,
+        tracking_branch=null
+      ):: std.prune(a={
+        access_token: access_token,
+        branches: branches,
+        display_name: display_name,
+        repository_uri: repository_uri,
+        tracking_branch: tracking_branch,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.dialogflow_cx_agent.git_integration_settings.new` constructs a new object with attributes and blocks configured for the `git_integration_settings`\nTerraform sub block.\n\n\n\n**Args**:\n  - `github_settings` (`list[obj]`): Settings of integration with GitHub. When `null`, the `github_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.git_integration_settings.github_settings.new](#fn-git_integration_settingsgithub_settingsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `git_integration_settings` sub block.\n', args=[]),
+    new(
+      github_settings=null
+    ):: std.prune(a={
+      github_settings: github_settings,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.dialogflow_cx_agent.new` injects a new `google_dialogflow_cx_agent` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dialogflow_cx_agent.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dialogflow_cx_agent` using the reference:\n\n    $._ref.google_dialogflow_cx_agent.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dialogflow_cx_agent.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `avatar_uri` (`string`): The URI of the agent\u0026#39;s avatar. Avatars are used throughout the Dialogflow console and in the self-hosted Web Demo integration. When `null`, the `avatar_uri` field will be omitted from the resulting object.\n  - `default_language_code` (`string`): The default language of the agent as a language tag. [See Language Support](https://cloud.google.com/dialogflow/cx/docs/reference/language)\nfor a list of the currently supported language codes. This field cannot be updated after creation.\n  - `description` (`string`): The description of this agent. The maximum length is 500 characters. If exceeded, the request is rejected. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable name of the agent, unique within the location.\n  - `enable_spell_correction` (`bool`): Indicates if automatic spell correction is enabled in detect intent requests. When `null`, the `enable_spell_correction` field will be omitted from the resulting object.\n  - `enable_stackdriver_logging` (`bool`): Determines whether this agent should log conversation queries. When `null`, the `enable_stackdriver_logging` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this agent is located in.\n\n~\u0026gt; **Note:** The first time you are deploying an Agent in your project you must configure location settings.\n This is a one time step but at the moment you can only [configure location settings](https://cloud.google.com/dialogflow/cx/docs/concept/region#location-settings) via the Dialogflow CX console.\n Another options is to use global location so you don\u0026#39;t need to manually configure location settings.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `security_settings` (`string`): Name of the SecuritySettings reference for the agent. Format: projects/\u0026lt;Project ID\u0026gt;/locations/\u0026lt;Location ID\u0026gt;/securitySettings/\u0026lt;Security Settings ID\u0026gt;. When `null`, the `security_settings` field will be omitted from the resulting object.\n  - `supported_language_codes` (`list`): The list of all languages supported by this agent (except for the default_language_code). When `null`, the `supported_language_codes` field will be omitted from the resulting object.\n  - `time_zone` (`string`): The time zone of this agent from the [time zone database](https://www.iana.org/time-zones), e.g., America/New_York,\nEurope/Paris.\n  - `advanced_settings` (`list[obj]`): Hierarchical advanced settings for this agent. The settings exposed at the lower level overrides the settings exposed at the higher level.\nHierarchy: Agent-\u0026gt;Flow-\u0026gt;Page-\u0026gt;Fulfillment/Parameter. When `null`, the `advanced_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.advanced_settings.new](#fn-advanced_settingsnew) constructor.\n  - `git_integration_settings` (`list[obj]`): Git integration settings for this agent. When `null`, the `git_integration_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.git_integration_settings.new](#fn-git_integration_settingsnew) constructor.\n  - `speech_to_text_settings` (`list[obj]`): Settings related to speech recognition. When `null`, the `speech_to_text_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.speech_to_text_settings.new](#fn-speech_to_text_settingsnew) constructor.\n  - `text_to_speech_settings` (`list[obj]`): Settings related to speech synthesizing. When `null`, the `text_to_speech_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.text_to_speech_settings.new](#fn-text_to_speech_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     default_language_code,
     display_name,
     location,
     time_zone,
+    advanced_settings=null,
     avatar_uri=null,
     description=null,
     enable_spell_correction=null,
     enable_stackdriver_logging=null,
+    git_integration_settings=null,
     project=null,
     security_settings=null,
     speech_to_text_settings=null,
     supported_language_codes=null,
+    text_to_speech_settings=null,
     timeouts=null,
     _meta={}
   ):: tf.withResource(
     type='google_dialogflow_cx_agent',
     label=resourceLabel,
     attrs=self.newAttrs(
+      advanced_settings=advanced_settings,
       avatar_uri=avatar_uri,
       default_language_code=default_language_code,
       description=description,
       display_name=display_name,
       enable_spell_correction=enable_spell_correction,
       enable_stackdriver_logging=enable_stackdriver_logging,
+      git_integration_settings=git_integration_settings,
       location=location,
       project=project,
       security_settings=security_settings,
       speech_to_text_settings=speech_to_text_settings,
       supported_language_codes=supported_language_codes,
+      text_to_speech_settings=text_to_speech_settings,
       time_zone=time_zone,
       timeouts=timeouts
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.dialogflow_cx_agent.newAttrs` constructs a new object with attributes and blocks configured for the `dialogflow_cx_agent`\nTerraform resource.\n\nUnlike [google.dialogflow_cx_agent.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `avatar_uri` (`string`): The URI of the agent's avatar. Avatars are used throughout the Dialogflow console and in the self-hosted Web Demo integration. When `null`, the `avatar_uri` field will be omitted from the resulting object.\n  - `default_language_code` (`string`): The default language of the agent as a language tag. [See Language Support](https://cloud.google.com/dialogflow/cx/docs/reference/language)\nfor a list of the currently supported language codes. This field cannot be updated after creation.\n  - `description` (`string`): The description of this agent. The maximum length is 500 characters. If exceeded, the request is rejected. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable name of the agent, unique within the location.\n  - `enable_spell_correction` (`bool`): Indicates if automatic spell correction is enabled in detect intent requests. When `null`, the `enable_spell_correction` field will be omitted from the resulting object.\n  - `enable_stackdriver_logging` (`bool`): Determines whether this agent should log conversation queries. When `null`, the `enable_stackdriver_logging` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this agent is located in.\n\n~> **Note:** The first time you are deploying an Agent in your project you must configure location settings.\n This is a one time step but at the moment you can only [configure location settings](https://cloud.google.com/dialogflow/cx/docs/concept/region#location-settings) via the Dialogflow CX console.\n Another options is to use global location so you don't need to manually configure location settings.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `security_settings` (`string`): Name of the SecuritySettings reference for the agent. Format: projects/<Project ID>/locations/<Location ID>/securitySettings/<Security Settings ID>. When `null`, the `security_settings` field will be omitted from the resulting object.\n  - `supported_language_codes` (`list`): The list of all languages supported by this agent (except for the default_language_code). When `null`, the `supported_language_codes` field will be omitted from the resulting object.\n  - `time_zone` (`string`): The time zone of this agent from the [time zone database](https://www.iana.org/time-zones), e.g., America/New_York,\nEurope/Paris.\n  - `speech_to_text_settings` (`list[obj]`): Settings related to speech recognition. When `null`, the `speech_to_text_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.speech_to_text_settings.new](#fn-speech_to_text_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dialogflow_cx_agent` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.dialogflow_cx_agent.newAttrs` constructs a new object with attributes and blocks configured for the `dialogflow_cx_agent`\nTerraform resource.\n\nUnlike [google.dialogflow_cx_agent.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `avatar_uri` (`string`): The URI of the agent's avatar. Avatars are used throughout the Dialogflow console and in the self-hosted Web Demo integration. When `null`, the `avatar_uri` field will be omitted from the resulting object.\n  - `default_language_code` (`string`): The default language of the agent as a language tag. [See Language Support](https://cloud.google.com/dialogflow/cx/docs/reference/language)\nfor a list of the currently supported language codes. This field cannot be updated after creation.\n  - `description` (`string`): The description of this agent. The maximum length is 500 characters. If exceeded, the request is rejected. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable name of the agent, unique within the location.\n  - `enable_spell_correction` (`bool`): Indicates if automatic spell correction is enabled in detect intent requests. When `null`, the `enable_spell_correction` field will be omitted from the resulting object.\n  - `enable_stackdriver_logging` (`bool`): Determines whether this agent should log conversation queries. When `null`, the `enable_stackdriver_logging` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location this agent is located in.\n\n~> **Note:** The first time you are deploying an Agent in your project you must configure location settings.\n This is a one time step but at the moment you can only [configure location settings](https://cloud.google.com/dialogflow/cx/docs/concept/region#location-settings) via the Dialogflow CX console.\n Another options is to use global location so you don't need to manually configure location settings.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `security_settings` (`string`): Name of the SecuritySettings reference for the agent. Format: projects/<Project ID>/locations/<Location ID>/securitySettings/<Security Settings ID>. When `null`, the `security_settings` field will be omitted from the resulting object.\n  - `supported_language_codes` (`list`): The list of all languages supported by this agent (except for the default_language_code). When `null`, the `supported_language_codes` field will be omitted from the resulting object.\n  - `time_zone` (`string`): The time zone of this agent from the [time zone database](https://www.iana.org/time-zones), e.g., America/New_York,\nEurope/Paris.\n  - `advanced_settings` (`list[obj]`): Hierarchical advanced settings for this agent. The settings exposed at the lower level overrides the settings exposed at the higher level.\nHierarchy: Agent->Flow->Page->Fulfillment/Parameter. When `null`, the `advanced_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.advanced_settings.new](#fn-advanced_settingsnew) constructor.\n  - `git_integration_settings` (`list[obj]`): Git integration settings for this agent. When `null`, the `git_integration_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.git_integration_settings.new](#fn-git_integration_settingsnew) constructor.\n  - `speech_to_text_settings` (`list[obj]`): Settings related to speech recognition. When `null`, the `speech_to_text_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.speech_to_text_settings.new](#fn-speech_to_text_settingsnew) constructor.\n  - `text_to_speech_settings` (`list[obj]`): Settings related to speech synthesizing. When `null`, the `text_to_speech_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.text_to_speech_settings.new](#fn-text_to_speech_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dialogflow_cx_agent` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     default_language_code,
     display_name,
     location,
     time_zone,
+    advanced_settings=null,
     avatar_uri=null,
     description=null,
     enable_spell_correction=null,
     enable_stackdriver_logging=null,
+    git_integration_settings=null,
     project=null,
     security_settings=null,
     speech_to_text_settings=null,
     supported_language_codes=null,
+    text_to_speech_settings=null,
     timeouts=null
   ):: std.prune(a={
+    advanced_settings: advanced_settings,
     avatar_uri: avatar_uri,
     default_language_code: default_language_code,
     description: description,
     display_name: display_name,
     enable_spell_correction: enable_spell_correction,
     enable_stackdriver_logging: enable_stackdriver_logging,
+    git_integration_settings: git_integration_settings,
     location: location,
     project: project,
     security_settings: security_settings,
     speech_to_text_settings: speech_to_text_settings,
     supported_language_codes: supported_language_codes,
+    text_to_speech_settings: text_to_speech_settings,
     time_zone: time_zone,
     timeouts: timeouts,
   }),
@@ -77,6 +143,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       enable_speech_adaptation: enable_speech_adaptation,
     }),
   },
+  text_to_speech_settings:: {
+    '#new':: d.fn(help='\n`google.dialogflow_cx_agent.text_to_speech_settings.new` constructs a new object with attributes and blocks configured for the `text_to_speech_settings`\nTerraform sub block.\n\n\n\n**Args**:\n  - `synthesize_speech_configs` (`string`): Configuration of how speech should be synthesized, mapping from [language](https://cloud.google.com/dialogflow/cx/docs/reference/language) to [SynthesizeSpeechConfig](https://cloud.google.com/dialogflow/cx/docs/reference/rest/v3/projects.locations.agents#synthesizespeechconfig).\nThese settings affect:\n* The phone gateway synthesize configuration set via Agent.text_to_speech_settings.\n* How speech is synthesized when invoking session APIs. 'Agent.text_to_speech_settings' only applies if 'OutputAudioConfig.synthesize_speech_config' is not specified. When `null`, the `synthesize_speech_configs` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `text_to_speech_settings` sub block.\n', args=[]),
+    new(
+      synthesize_speech_configs=null
+    ):: std.prune(a={
+      synthesize_speech_configs: synthesize_speech_configs,
+    }),
+  },
   timeouts:: {
     '#new':: d.fn(help='\n`google.dialogflow_cx_agent.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
     new(
@@ -89,6 +163,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       update: update,
     }),
   },
+  '#withAdvancedSettings':: d.fn(help='`google.list[obj].withAdvancedSettings` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the advanced_settings field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withAdvancedSettingsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `advanced_settings` field.\n', args=[]),
+  withAdvancedSettings(resourceLabel, value): {
+    resource+: {
+      google_dialogflow_cx_agent+: {
+        [resourceLabel]+: {
+          advanced_settings: value,
+        },
+      },
+    },
+  },
+  '#withAdvancedSettingsMixin':: d.fn(help='`google.list[obj].withAdvancedSettingsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the advanced_settings field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withAdvancedSettings](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `advanced_settings` field.\n', args=[]),
+  withAdvancedSettingsMixin(resourceLabel, value): {
+    resource+: {
+      google_dialogflow_cx_agent+: {
+        [resourceLabel]+: {
+          advanced_settings+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withAvatarUri':: d.fn(help='`google.string.withAvatarUri` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the avatar_uri field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `avatar_uri` field.\n', args=[]),
   withAvatarUri(resourceLabel, value): {
     resource+: {
@@ -149,6 +243,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withGitIntegrationSettings':: d.fn(help='`google.list[obj].withGitIntegrationSettings` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the git_integration_settings field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withGitIntegrationSettingsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `git_integration_settings` field.\n', args=[]),
+  withGitIntegrationSettings(resourceLabel, value): {
+    resource+: {
+      google_dialogflow_cx_agent+: {
+        [resourceLabel]+: {
+          git_integration_settings: value,
+        },
+      },
+    },
+  },
+  '#withGitIntegrationSettingsMixin':: d.fn(help='`google.list[obj].withGitIntegrationSettingsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the git_integration_settings field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withGitIntegrationSettings](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `git_integration_settings` field.\n', args=[]),
+  withGitIntegrationSettingsMixin(resourceLabel, value): {
+    resource+: {
+      google_dialogflow_cx_agent+: {
+        [resourceLabel]+: {
+          git_integration_settings+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
   withLocation(resourceLabel, value): {
     resource+: {
@@ -209,6 +323,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withTextToSpeechSettings':: d.fn(help='`google.list[obj].withTextToSpeechSettings` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the text_to_speech_settings field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withTextToSpeechSettingsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `text_to_speech_settings` field.\n', args=[]),
+  withTextToSpeechSettings(resourceLabel, value): {
+    resource+: {
+      google_dialogflow_cx_agent+: {
+        [resourceLabel]+: {
+          text_to_speech_settings: value,
+        },
+      },
+    },
+  },
+  '#withTextToSpeechSettingsMixin':: d.fn(help='`google.list[obj].withTextToSpeechSettingsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the text_to_speech_settings field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withTextToSpeechSettings](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `text_to_speech_settings` field.\n', args=[]),
+  withTextToSpeechSettingsMixin(resourceLabel, value): {
+    resource+: {
+      google_dialogflow_cx_agent+: {
+        [resourceLabel]+: {
+          text_to_speech_settings+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withTimeZone':: d.fn(help='`google.string.withTimeZone` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the time_zone field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `time_zone` field.\n', args=[]),
   withTimeZone(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/dialogflow_cx_flow.libsonnet b/4.x/_gen/resources/dialogflow_cx_flow.libsonnet
index e5ea92ec..ec7fc894 100644
--- a/4.x/_gen/resources/dialogflow_cx_flow.libsonnet
+++ b/4.x/_gen/resources/dialogflow_cx_flow.libsonnet
@@ -2,6 +2,36 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='dialogflow_cx_flow', url='', help='`dialogflow_cx_flow` represents the `google_dialogflow_cx_flow` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  advanced_settings:: {
+    audio_export_gcs_destination:: {
+      '#new':: d.fn(help='\n`google.dialogflow_cx_flow.advanced_settings.audio_export_gcs_destination.new` constructs a new object with attributes and blocks configured for the `audio_export_gcs_destination`\nTerraform sub block.\n\n\n\n**Args**:\n  - `uri` (`string`): The Google Cloud Storage URI for the exported objects. Whether a full object name, or just a prefix, its usage depends on the Dialogflow operation.\nFormat: gs://bucket/object-name-or-prefix When `null`, the `uri` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `audio_export_gcs_destination` sub block.\n', args=[]),
+      new(
+        uri=null
+      ):: std.prune(a={
+        uri: uri,
+      }),
+    },
+    dtmf_settings:: {
+      '#new':: d.fn(help='\n`google.dialogflow_cx_flow.advanced_settings.dtmf_settings.new` constructs a new object with attributes and blocks configured for the `dtmf_settings`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): If true, incoming audio is processed for DTMF (dual tone multi frequency) events. For example, if the caller presses a button on their telephone keypad and DTMF processing is enabled, Dialogflow will detect the event (e.g. a "3" was pressed) in the incoming audio and pass the event to the bot to drive business logic (e.g. when 3 is pressed, return the account balance). When `null`, the `enabled` field will be omitted from the resulting object.\n  - `finish_digit` (`string`): The digit that terminates a DTMF digit sequence. When `null`, the `finish_digit` field will be omitted from the resulting object.\n  - `max_digits` (`number`): Max length of DTMF digits. When `null`, the `max_digits` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `dtmf_settings` sub block.\n', args=[]),
+      new(
+        enabled=null,
+        finish_digit=null,
+        max_digits=null
+      ):: std.prune(a={
+        enabled: enabled,
+        finish_digit: finish_digit,
+        max_digits: max_digits,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.dialogflow_cx_flow.advanced_settings.new` constructs a new object with attributes and blocks configured for the `advanced_settings`\nTerraform sub block.\n\n\n\n**Args**:\n  - `audio_export_gcs_destination` (`list[obj]`): If present, incoming audio is exported by Dialogflow to the configured Google Cloud Storage destination. Exposed at the following levels:\n* Agent level\n* Flow level When `null`, the `audio_export_gcs_destination` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.advanced_settings.audio_export_gcs_destination.new](#fn-advanced_settingsaudio_export_gcs_destinationnew) constructor.\n  - `dtmf_settings` (`list[obj]`): Define behaviors for DTMF (dual tone multi frequency). DTMF settings does not override each other. DTMF settings set at different levels define DTMF detections running in parallel. Exposed at the following levels:\n* Agent level\n* Flow level\n* Page level\n* Parameter level When `null`, the `dtmf_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.advanced_settings.dtmf_settings.new](#fn-advanced_settingsdtmf_settingsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `advanced_settings` sub block.\n', args=[]),
+    new(
+      audio_export_gcs_destination=null,
+      dtmf_settings=null
+    ):: std.prune(a={
+      audio_export_gcs_destination: audio_export_gcs_destination,
+      dtmf_settings: dtmf_settings,
+    }),
+  },
   event_handlers:: {
     '#new':: d.fn(help='\n`google.dialogflow_cx_flow.event_handlers.new` constructs a new object with attributes and blocks configured for the `event_handlers`\nTerraform sub block.\n\n\n\n**Args**:\n  - `event` (`string`): The name of the event to handle. When `null`, the `event` field will be omitted from the resulting object.\n  - `target_flow` (`string`): The target flow to transition to.\nFormat: projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/flows/<Flow ID>. When `null`, the `target_flow` field will be omitted from the resulting object.\n  - `target_page` (`string`): The target page to transition to.\nFormat: projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/flows/<Flow ID>/pages/<Page ID>. When `null`, the `target_page` field will be omitted from the resulting object.\n  - `trigger_fulfillment` (`list[obj]`): The fulfillment to call when the event occurs. Handling webhook errors with a fulfillment enabled with webhook could cause infinite loop. It is invalid to specify such fulfillment for a handler handling webhooks. When `null`, the `trigger_fulfillment` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.event_handlers.trigger_fulfillment.new](#fn-event_handlerstrigger_fulfillmentnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `event_handlers` sub block.\n', args=[]),
     new(
@@ -124,10 +154,11 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
-  '#new':: d.fn(help="\n`google.dialogflow_cx_flow.new` injects a new `google_dialogflow_cx_flow` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dialogflow_cx_flow.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dialogflow_cx_flow` using the reference:\n\n    $._ref.google_dialogflow_cx_flow.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dialogflow_cx_flow.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): The description of the flow. The maximum length is 500 characters. If exceeded, the request is rejected. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable name of the flow.\n  - `language_code` (`string`): The language of the following fields in flow:\nFlow.event_handlers.trigger_fulfillment.messages\nFlow.event_handlers.trigger_fulfillment.conditional_cases\nFlow.transition_routes.trigger_fulfillment.messages\nFlow.transition_routes.trigger_fulfillment.conditional_cases\nIf not specified, the agent\u0026#39;s default language is used. Many languages are supported. Note: languages must be enabled in the agent before they can be used. When `null`, the `language_code` field will be omitted from the resulting object.\n  - `parent` (`string`): The agent to create a flow for.\nFormat: projects/\u0026lt;Project ID\u0026gt;/locations/\u0026lt;Location ID\u0026gt;/agents/\u0026lt;Agent ID\u0026gt;. When `null`, the `parent` field will be omitted from the resulting object.\n  - `transition_route_groups` (`list`): A flow\u0026#39;s transition route group serve two purposes:\nThey are responsible for matching the user\u0026#39;s first utterances in the flow.\nThey are inherited by every page\u0026#39;s [transition route groups][Page.transition_route_groups]. Transition route groups defined in the page have higher priority than those defined in the flow.\nFormat:projects/\u0026lt;Project ID\u0026gt;/locations/\u0026lt;Location ID\u0026gt;/agents/\u0026lt;Agent ID\u0026gt;/flows/\u0026lt;Flow ID\u0026gt;/transitionRouteGroups/\u0026lt;TransitionRouteGroup ID\u0026gt;. When `null`, the `transition_route_groups` field will be omitted from the resulting object.\n  - `event_handlers` (`list[obj]`): A flow\u0026#39;s event handlers serve two purposes:\nThey are responsible for handling events (e.g. no match, webhook errors) in the flow.\nThey are inherited by every page\u0026#39;s [event handlers][Page.event_handlers], which can be used to handle common events regardless of the current page. Event handlers defined in the page have higher priority than those defined in the flow.\nUnlike transitionRoutes, these handlers are evaluated on a first-match basis. The first one that matches the event get executed, with the rest being ignored. When `null`, the `event_handlers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.event_handlers.new](#fn-event_handlersnew) constructor.\n  - `nlu_settings` (`list[obj]`): NLU related settings of the flow. When `null`, the `nlu_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.nlu_settings.new](#fn-nlu_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.timeouts.new](#fn-timeoutsnew) constructor.\n  - `transition_routes` (`list[obj]`): A flow\u0026#39;s transition routes serve two purposes:\nThey are responsible for matching the user\u0026#39;s first utterances in the flow.\nThey are inherited by every page\u0026#39;s [transition routes][Page.transition_routes] and can support use cases such as the user saying \u0026#34;help\u0026#34; or \u0026#34;can I talk to a human?\u0026#34;, which can be handled in a common way regardless of the current page. Transition routes defined in the page have higher priority than those defined in the flow.\n\nTransitionRoutes are evalauted in the following order:\n  TransitionRoutes with intent specified.\n  TransitionRoutes with only condition specified.\n  TransitionRoutes with intent specified are inherited by pages in the flow. When `null`, the `transition_routes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.transition_routes.new](#fn-transition_routesnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.dialogflow_cx_flow.new` injects a new `google_dialogflow_cx_flow` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dialogflow_cx_flow.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dialogflow_cx_flow` using the reference:\n\n    $._ref.google_dialogflow_cx_flow.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dialogflow_cx_flow.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): The description of the flow. The maximum length is 500 characters. If exceeded, the request is rejected. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable name of the flow.\n  - `language_code` (`string`): The language of the following fields in flow:\nFlow.event_handlers.trigger_fulfillment.messages\nFlow.event_handlers.trigger_fulfillment.conditional_cases\nFlow.transition_routes.trigger_fulfillment.messages\nFlow.transition_routes.trigger_fulfillment.conditional_cases\nIf not specified, the agent\u0026#39;s default language is used. Many languages are supported. Note: languages must be enabled in the agent before they can be used. When `null`, the `language_code` field will be omitted from the resulting object.\n  - `parent` (`string`): The agent to create a flow for.\nFormat: projects/\u0026lt;Project ID\u0026gt;/locations/\u0026lt;Location ID\u0026gt;/agents/\u0026lt;Agent ID\u0026gt;. When `null`, the `parent` field will be omitted from the resulting object.\n  - `transition_route_groups` (`list`): A flow\u0026#39;s transition route group serve two purposes:\nThey are responsible for matching the user\u0026#39;s first utterances in the flow.\nThey are inherited by every page\u0026#39;s [transition route groups][Page.transition_route_groups]. Transition route groups defined in the page have higher priority than those defined in the flow.\nFormat:projects/\u0026lt;Project ID\u0026gt;/locations/\u0026lt;Location ID\u0026gt;/agents/\u0026lt;Agent ID\u0026gt;/flows/\u0026lt;Flow ID\u0026gt;/transitionRouteGroups/\u0026lt;TransitionRouteGroup ID\u0026gt;. When `null`, the `transition_route_groups` field will be omitted from the resulting object.\n  - `advanced_settings` (`list[obj]`): Hierarchical advanced settings for this flow. The settings exposed at the lower level overrides the settings exposed at the higher level.\nHierarchy: Agent-\u0026gt;Flow-\u0026gt;Page-\u0026gt;Fulfillment/Parameter. When `null`, the `advanced_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.advanced_settings.new](#fn-advanced_settingsnew) constructor.\n  - `event_handlers` (`list[obj]`): A flow\u0026#39;s event handlers serve two purposes:\nThey are responsible for handling events (e.g. no match, webhook errors) in the flow.\nThey are inherited by every page\u0026#39;s [event handlers][Page.event_handlers], which can be used to handle common events regardless of the current page. Event handlers defined in the page have higher priority than those defined in the flow.\nUnlike transitionRoutes, these handlers are evaluated on a first-match basis. The first one that matches the event get executed, with the rest being ignored. When `null`, the `event_handlers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.event_handlers.new](#fn-event_handlersnew) constructor.\n  - `nlu_settings` (`list[obj]`): NLU related settings of the flow. When `null`, the `nlu_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.nlu_settings.new](#fn-nlu_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.timeouts.new](#fn-timeoutsnew) constructor.\n  - `transition_routes` (`list[obj]`): A flow\u0026#39;s transition routes serve two purposes:\nThey are responsible for matching the user\u0026#39;s first utterances in the flow.\nThey are inherited by every page\u0026#39;s [transition routes][Page.transition_routes] and can support use cases such as the user saying \u0026#34;help\u0026#34; or \u0026#34;can I talk to a human?\u0026#34;, which can be handled in a common way regardless of the current page. Transition routes defined in the page have higher priority than those defined in the flow.\n\nTransitionRoutes are evalauted in the following order:\n  TransitionRoutes with intent specified.\n  TransitionRoutes with only condition specified.\n  TransitionRoutes with intent specified are inherited by pages in the flow. When `null`, the `transition_routes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.transition_routes.new](#fn-transition_routesnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     display_name,
+    advanced_settings=null,
     description=null,
     event_handlers=null,
     language_code=null,
@@ -141,6 +172,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     type='google_dialogflow_cx_flow',
     label=resourceLabel,
     attrs=self.newAttrs(
+      advanced_settings=advanced_settings,
       description=description,
       display_name=display_name,
       event_handlers=event_handlers,
@@ -153,9 +185,10 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.dialogflow_cx_flow.newAttrs` constructs a new object with attributes and blocks configured for the `dialogflow_cx_flow`\nTerraform resource.\n\nUnlike [google.dialogflow_cx_flow.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): The description of the flow. The maximum length is 500 characters. If exceeded, the request is rejected. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable name of the flow.\n  - `language_code` (`string`): The language of the following fields in flow:\nFlow.event_handlers.trigger_fulfillment.messages\nFlow.event_handlers.trigger_fulfillment.conditional_cases\nFlow.transition_routes.trigger_fulfillment.messages\nFlow.transition_routes.trigger_fulfillment.conditional_cases\nIf not specified, the agent's default language is used. Many languages are supported. Note: languages must be enabled in the agent before they can be used. When `null`, the `language_code` field will be omitted from the resulting object.\n  - `parent` (`string`): The agent to create a flow for.\nFormat: projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>. When `null`, the `parent` field will be omitted from the resulting object.\n  - `transition_route_groups` (`list`): A flow's transition route group serve two purposes:\nThey are responsible for matching the user's first utterances in the flow.\nThey are inherited by every page's [transition route groups][Page.transition_route_groups]. Transition route groups defined in the page have higher priority than those defined in the flow.\nFormat:projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/flows/<Flow ID>/transitionRouteGroups/<TransitionRouteGroup ID>. When `null`, the `transition_route_groups` field will be omitted from the resulting object.\n  - `event_handlers` (`list[obj]`): A flow's event handlers serve two purposes:\nThey are responsible for handling events (e.g. no match, webhook errors) in the flow.\nThey are inherited by every page's [event handlers][Page.event_handlers], which can be used to handle common events regardless of the current page. Event handlers defined in the page have higher priority than those defined in the flow.\nUnlike transitionRoutes, these handlers are evaluated on a first-match basis. The first one that matches the event get executed, with the rest being ignored. When `null`, the `event_handlers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.event_handlers.new](#fn-event_handlersnew) constructor.\n  - `nlu_settings` (`list[obj]`): NLU related settings of the flow. When `null`, the `nlu_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.nlu_settings.new](#fn-nlu_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.timeouts.new](#fn-timeoutsnew) constructor.\n  - `transition_routes` (`list[obj]`): A flow's transition routes serve two purposes:\nThey are responsible for matching the user's first utterances in the flow.\nThey are inherited by every page's [transition routes][Page.transition_routes] and can support use cases such as the user saying "help" or "can I talk to a human?", which can be handled in a common way regardless of the current page. Transition routes defined in the page have higher priority than those defined in the flow.\n\nTransitionRoutes are evalauted in the following order:\n  TransitionRoutes with intent specified.\n  TransitionRoutes with only condition specified.\n  TransitionRoutes with intent specified are inherited by pages in the flow. When `null`, the `transition_routes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.transition_routes.new](#fn-transition_routesnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dialogflow_cx_flow` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.dialogflow_cx_flow.newAttrs` constructs a new object with attributes and blocks configured for the `dialogflow_cx_flow`\nTerraform resource.\n\nUnlike [google.dialogflow_cx_flow.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): The description of the flow. The maximum length is 500 characters. If exceeded, the request is rejected. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable name of the flow.\n  - `language_code` (`string`): The language of the following fields in flow:\nFlow.event_handlers.trigger_fulfillment.messages\nFlow.event_handlers.trigger_fulfillment.conditional_cases\nFlow.transition_routes.trigger_fulfillment.messages\nFlow.transition_routes.trigger_fulfillment.conditional_cases\nIf not specified, the agent's default language is used. Many languages are supported. Note: languages must be enabled in the agent before they can be used. When `null`, the `language_code` field will be omitted from the resulting object.\n  - `parent` (`string`): The agent to create a flow for.\nFormat: projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>. When `null`, the `parent` field will be omitted from the resulting object.\n  - `transition_route_groups` (`list`): A flow's transition route group serve two purposes:\nThey are responsible for matching the user's first utterances in the flow.\nThey are inherited by every page's [transition route groups][Page.transition_route_groups]. Transition route groups defined in the page have higher priority than those defined in the flow.\nFormat:projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/flows/<Flow ID>/transitionRouteGroups/<TransitionRouteGroup ID>. When `null`, the `transition_route_groups` field will be omitted from the resulting object.\n  - `advanced_settings` (`list[obj]`): Hierarchical advanced settings for this flow. The settings exposed at the lower level overrides the settings exposed at the higher level.\nHierarchy: Agent->Flow->Page->Fulfillment/Parameter. When `null`, the `advanced_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.advanced_settings.new](#fn-advanced_settingsnew) constructor.\n  - `event_handlers` (`list[obj]`): A flow's event handlers serve two purposes:\nThey are responsible for handling events (e.g. no match, webhook errors) in the flow.\nThey are inherited by every page's [event handlers][Page.event_handlers], which can be used to handle common events regardless of the current page. Event handlers defined in the page have higher priority than those defined in the flow.\nUnlike transitionRoutes, these handlers are evaluated on a first-match basis. The first one that matches the event get executed, with the rest being ignored. When `null`, the `event_handlers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.event_handlers.new](#fn-event_handlersnew) constructor.\n  - `nlu_settings` (`list[obj]`): NLU related settings of the flow. When `null`, the `nlu_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.nlu_settings.new](#fn-nlu_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.timeouts.new](#fn-timeoutsnew) constructor.\n  - `transition_routes` (`list[obj]`): A flow's transition routes serve two purposes:\nThey are responsible for matching the user's first utterances in the flow.\nThey are inherited by every page's [transition routes][Page.transition_routes] and can support use cases such as the user saying "help" or "can I talk to a human?", which can be handled in a common way regardless of the current page. Transition routes defined in the page have higher priority than those defined in the flow.\n\nTransitionRoutes are evalauted in the following order:\n  TransitionRoutes with intent specified.\n  TransitionRoutes with only condition specified.\n  TransitionRoutes with intent specified are inherited by pages in the flow. When `null`, the `transition_routes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.transition_routes.new](#fn-transition_routesnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dialogflow_cx_flow` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     display_name,
+    advanced_settings=null,
     description=null,
     event_handlers=null,
     language_code=null,
@@ -165,6 +198,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     transition_route_groups=null,
     transition_routes=null
   ):: std.prune(a={
+    advanced_settings: advanced_settings,
     description: description,
     display_name: display_name,
     event_handlers: event_handlers,
@@ -323,6 +357,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withAdvancedSettings':: d.fn(help='`google.list[obj].withAdvancedSettings` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the advanced_settings field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withAdvancedSettingsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `advanced_settings` field.\n', args=[]),
+  withAdvancedSettings(resourceLabel, value): {
+    resource+: {
+      google_dialogflow_cx_flow+: {
+        [resourceLabel]+: {
+          advanced_settings: value,
+        },
+      },
+    },
+  },
+  '#withAdvancedSettingsMixin':: d.fn(help='`google.list[obj].withAdvancedSettingsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the advanced_settings field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withAdvancedSettings](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `advanced_settings` field.\n', args=[]),
+  withAdvancedSettingsMixin(resourceLabel, value): {
+    resource+: {
+      google_dialogflow_cx_flow+: {
+        [resourceLabel]+: {
+          advanced_settings+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
   withDescription(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/dialogflow_cx_intent.libsonnet b/4.x/_gen/resources/dialogflow_cx_intent.libsonnet
index d98b4465..0fb789b6 100644
--- a/4.x/_gen/resources/dialogflow_cx_intent.libsonnet
+++ b/4.x/_gen/resources/dialogflow_cx_intent.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='dialogflow_cx_intent', url='', help='`dialogflow_cx_intent` represents the `google_dialogflow_cx_intent` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.dialogflow_cx_intent.new` injects a new `google_dialogflow_cx_intent` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dialogflow_cx_intent.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dialogflow_cx_intent` using the reference:\n\n    $._ref.google_dialogflow_cx_intent.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dialogflow_cx_intent.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Human readable description for better understanding an intent like its scope, content, result etc. Maximum character limit: 140 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable name of the intent, unique within the agent.\n  - `is_fallback` (`bool`): Indicates whether this is a fallback intent. Currently only default fallback intent is allowed in the agent, which is added upon agent creation.\nAdding training phrases to fallback intent is useful in the case of requests that are mistakenly matched, since training phrases assigned to fallback intents act as negative examples that triggers no-match event. When `null`, the `is_fallback` field will be omitted from the resulting object.\n  - `labels` (`obj`): The key/value metadata to label an intent. Labels can contain lowercase letters, digits and the symbols \u0026#39;-\u0026#39; and \u0026#39;_\u0026#39;. International characters are allowed, including letters from unicase alphabets. Keys must start with a letter. Keys and values can be no longer than 63 characters and no more than 128 bytes.\nPrefix \u0026#34;sys-\u0026#34; is reserved for Dialogflow defined labels. Currently allowed Dialogflow defined labels include: * sys-head * sys-contextual The above labels do not require value. \u0026#34;sys-head\u0026#34; means the intent is a head intent. \u0026#34;sys.contextual\u0026#34; means the intent is a contextual intent.\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `language_code` (`string`): The language of the following fields in intent:\nIntent.training_phrases.parts.text\nIf not specified, the agent\u0026#39;s default language is used. Many languages are supported. Note: languages must be enabled in the agent before they can be used. When `null`, the `language_code` field will be omitted from the resulting object.\n  - `parent` (`string`): The agent to create an intent for.\nFormat: projects/\u0026lt;Project ID\u0026gt;/locations/\u0026lt;Location ID\u0026gt;/agents/\u0026lt;Agent ID\u0026gt;. When `null`, the `parent` field will be omitted from the resulting object.\n  - `priority` (`number`): The priority of this intent. Higher numbers represent higher priorities.\nIf the supplied value is unspecified or 0, the service translates the value to 500,000, which corresponds to the Normal priority in the console.\nIf the supplied value is negative, the intent is ignored in runtime detect intent requests. When `null`, the `priority` field will be omitted from the resulting object.\n  - `parameters` (`list[obj]`): The collection of parameters associated with the intent. When `null`, the `parameters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_intent.parameters.new](#fn-parametersnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_intent.timeouts.new](#fn-timeoutsnew) constructor.\n  - `training_phrases` (`list[obj]`): The collection of training phrases the agent is trained on to identify the intent. When `null`, the `training_phrases` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_intent.training_phrases.new](#fn-training_phrasesnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.dialogflow_cx_intent.new` injects a new `google_dialogflow_cx_intent` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dialogflow_cx_intent.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dialogflow_cx_intent` using the reference:\n\n    $._ref.google_dialogflow_cx_intent.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dialogflow_cx_intent.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Human readable description for better understanding an intent like its scope, content, result etc. Maximum character limit: 140 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable name of the intent, unique within the agent.\n  - `is_fallback` (`bool`): Indicates whether this is a fallback intent. Currently only default fallback intent is allowed in the agent, which is added upon agent creation.\nAdding training phrases to fallback intent is useful in the case of requests that are mistakenly matched, since training phrases assigned to fallback intents act as negative examples that triggers no-match event. When `null`, the `is_fallback` field will be omitted from the resulting object.\n  - `labels` (`obj`): The key/value metadata to label an intent. Labels can contain lowercase letters, digits and the symbols \u0026#39;-\u0026#39; and \u0026#39;_\u0026#39;. International characters are allowed, including letters from unicase alphabets. Keys must start with a letter. Keys and values can be no longer than 63 characters and no more than 128 bytes.\nPrefix \u0026#34;sys-\u0026#34; is reserved for Dialogflow defined labels. Currently allowed Dialogflow defined labels include: * sys-head * sys-contextual The above labels do not require value. \u0026#34;sys-head\u0026#34; means the intent is a head intent. \u0026#34;sys.contextual\u0026#34; means the intent is a contextual intent.\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `language_code` (`string`): The language of the following fields in intent:\nIntent.training_phrases.parts.text\nIf not specified, the agent\u0026#39;s default language is used. Many languages are supported. Note: languages must be enabled in the agent before they can be used. When `null`, the `language_code` field will be omitted from the resulting object.\n  - `parent` (`string`): The agent to create an intent for.\nFormat: projects/\u0026lt;Project ID\u0026gt;/locations/\u0026lt;Location ID\u0026gt;/agents/\u0026lt;Agent ID\u0026gt;. When `null`, the `parent` field will be omitted from the resulting object.\n  - `priority` (`number`): The priority of this intent. Higher numbers represent higher priorities.\nIf the supplied value is unspecified or 0, the service translates the value to 500,000, which corresponds to the Normal priority in the console.\nIf the supplied value is negative, the intent is ignored in runtime detect intent requests. When `null`, the `priority` field will be omitted from the resulting object.\n  - `parameters` (`list[obj]`): The collection of parameters associated with the intent. When `null`, the `parameters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_intent.parameters.new](#fn-parametersnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_intent.timeouts.new](#fn-timeoutsnew) constructor.\n  - `training_phrases` (`list[obj]`): The collection of training phrases the agent is trained on to identify the intent. When `null`, the `training_phrases` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_intent.training_phrases.new](#fn-training_phrasesnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     display_name,
@@ -33,7 +33,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.dialogflow_cx_intent.newAttrs` constructs a new object with attributes and blocks configured for the `dialogflow_cx_intent`\nTerraform resource.\n\nUnlike [google.dialogflow_cx_intent.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Human readable description for better understanding an intent like its scope, content, result etc. Maximum character limit: 140 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable name of the intent, unique within the agent.\n  - `is_fallback` (`bool`): Indicates whether this is a fallback intent. Currently only default fallback intent is allowed in the agent, which is added upon agent creation.\nAdding training phrases to fallback intent is useful in the case of requests that are mistakenly matched, since training phrases assigned to fallback intents act as negative examples that triggers no-match event. When `null`, the `is_fallback` field will be omitted from the resulting object.\n  - `labels` (`obj`): The key/value metadata to label an intent. Labels can contain lowercase letters, digits and the symbols '-' and '_'. International characters are allowed, including letters from unicase alphabets. Keys must start with a letter. Keys and values can be no longer than 63 characters and no more than 128 bytes.\nPrefix "sys-" is reserved for Dialogflow defined labels. Currently allowed Dialogflow defined labels include: * sys-head * sys-contextual The above labels do not require value. "sys-head" means the intent is a head intent. "sys.contextual" means the intent is a contextual intent.\nAn object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `language_code` (`string`): The language of the following fields in intent:\nIntent.training_phrases.parts.text\nIf not specified, the agent's default language is used. Many languages are supported. Note: languages must be enabled in the agent before they can be used. When `null`, the `language_code` field will be omitted from the resulting object.\n  - `parent` (`string`): The agent to create an intent for.\nFormat: projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>. When `null`, the `parent` field will be omitted from the resulting object.\n  - `priority` (`number`): The priority of this intent. Higher numbers represent higher priorities.\nIf the supplied value is unspecified or 0, the service translates the value to 500,000, which corresponds to the Normal priority in the console.\nIf the supplied value is negative, the intent is ignored in runtime detect intent requests. When `null`, the `priority` field will be omitted from the resulting object.\n  - `parameters` (`list[obj]`): The collection of parameters associated with the intent. When `null`, the `parameters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_intent.parameters.new](#fn-parametersnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_intent.timeouts.new](#fn-timeoutsnew) constructor.\n  - `training_phrases` (`list[obj]`): The collection of training phrases the agent is trained on to identify the intent. When `null`, the `training_phrases` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_intent.training_phrases.new](#fn-training_phrasesnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dialogflow_cx_intent` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.dialogflow_cx_intent.newAttrs` constructs a new object with attributes and blocks configured for the `dialogflow_cx_intent`\nTerraform resource.\n\nUnlike [google.dialogflow_cx_intent.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Human readable description for better understanding an intent like its scope, content, result etc. Maximum character limit: 140 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable name of the intent, unique within the agent.\n  - `is_fallback` (`bool`): Indicates whether this is a fallback intent. Currently only default fallback intent is allowed in the agent, which is added upon agent creation.\nAdding training phrases to fallback intent is useful in the case of requests that are mistakenly matched, since training phrases assigned to fallback intents act as negative examples that triggers no-match event. When `null`, the `is_fallback` field will be omitted from the resulting object.\n  - `labels` (`obj`): The key/value metadata to label an intent. Labels can contain lowercase letters, digits and the symbols '-' and '_'. International characters are allowed, including letters from unicase alphabets. Keys must start with a letter. Keys and values can be no longer than 63 characters and no more than 128 bytes.\nPrefix "sys-" is reserved for Dialogflow defined labels. Currently allowed Dialogflow defined labels include: * sys-head * sys-contextual The above labels do not require value. "sys-head" means the intent is a head intent. "sys.contextual" means the intent is a contextual intent.\nAn object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `language_code` (`string`): The language of the following fields in intent:\nIntent.training_phrases.parts.text\nIf not specified, the agent's default language is used. Many languages are supported. Note: languages must be enabled in the agent before they can be used. When `null`, the `language_code` field will be omitted from the resulting object.\n  - `parent` (`string`): The agent to create an intent for.\nFormat: projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>. When `null`, the `parent` field will be omitted from the resulting object.\n  - `priority` (`number`): The priority of this intent. Higher numbers represent higher priorities.\nIf the supplied value is unspecified or 0, the service translates the value to 500,000, which corresponds to the Normal priority in the console.\nIf the supplied value is negative, the intent is ignored in runtime detect intent requests. When `null`, the `priority` field will be omitted from the resulting object.\n  - `parameters` (`list[obj]`): The collection of parameters associated with the intent. When `null`, the `parameters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_intent.parameters.new](#fn-parametersnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_intent.timeouts.new](#fn-timeoutsnew) constructor.\n  - `training_phrases` (`list[obj]`): The collection of training phrases the agent is trained on to identify the intent. When `null`, the `training_phrases` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_intent.training_phrases.new](#fn-training_phrasesnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dialogflow_cx_intent` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     display_name,
     description=null,
diff --git a/4.x/_gen/resources/dialogflow_cx_page.libsonnet b/4.x/_gen/resources/dialogflow_cx_page.libsonnet
index d4cb174c..3bd30e7e 100644
--- a/4.x/_gen/resources/dialogflow_cx_page.libsonnet
+++ b/4.x/_gen/resources/dialogflow_cx_page.libsonnet
@@ -2,6 +2,26 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='dialogflow_cx_page', url='', help='`dialogflow_cx_page` represents the `google_dialogflow_cx_page` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  advanced_settings:: {
+    dtmf_settings:: {
+      '#new':: d.fn(help='\n`google.dialogflow_cx_page.advanced_settings.dtmf_settings.new` constructs a new object with attributes and blocks configured for the `dtmf_settings`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): If true, incoming audio is processed for DTMF (dual tone multi frequency) events. For example, if the caller presses a button on their telephone keypad and DTMF processing is enabled, Dialogflow will detect the event (e.g. a "3" was pressed) in the incoming audio and pass the event to the bot to drive business logic (e.g. when 3 is pressed, return the account balance). When `null`, the `enabled` field will be omitted from the resulting object.\n  - `finish_digit` (`string`): The digit that terminates a DTMF digit sequence. When `null`, the `finish_digit` field will be omitted from the resulting object.\n  - `max_digits` (`number`): Max length of DTMF digits. When `null`, the `max_digits` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `dtmf_settings` sub block.\n', args=[]),
+      new(
+        enabled=null,
+        finish_digit=null,
+        max_digits=null
+      ):: std.prune(a={
+        enabled: enabled,
+        finish_digit: finish_digit,
+        max_digits: max_digits,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.dialogflow_cx_page.advanced_settings.new` constructs a new object with attributes and blocks configured for the `advanced_settings`\nTerraform sub block.\n\n\n\n**Args**:\n  - `dtmf_settings` (`list[obj]`): Define behaviors for DTMF (dual tone multi frequency). DTMF settings does not override each other. DTMF settings set at different levels define DTMF detections running in parallel. Exposed at the following levels:\n* Agent level\n* Flow level\n* Page level\n* Parameter level When `null`, the `dtmf_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.advanced_settings.dtmf_settings.new](#fn-advanced_settingsdtmf_settingsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `advanced_settings` sub block.\n', args=[]),
+    new(
+      dtmf_settings=null
+    ):: std.prune(a={
+      dtmf_settings: dtmf_settings,
+    }),
+  },
   entry_fulfillment:: {
     conditional_cases:: {
       '#new':: d.fn(help='\n`google.dialogflow_cx_page.entry_fulfillment.conditional_cases.new` constructs a new object with attributes and blocks configured for the `conditional_cases`\nTerraform sub block.\n\n\n\n**Args**:\n  - `cases` (`string`): A JSON encoded list of cascading if-else conditions. Cases are mutually exclusive. The first one with a matching condition is selected, all the rest ignored.\nSee [Case](https://cloud.google.com/dialogflow/cx/docs/reference/rest/v3/Fulfillment#case) for the schema. When `null`, the `cases` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `conditional_cases` sub block.\n', args=[]),
@@ -240,6 +260,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       parameters: parameters,
     }),
     parameters:: {
+      advanced_settings:: {
+        dtmf_settings:: {
+          '#new':: d.fn(help='\n`google.dialogflow_cx_page.form.parameters.advanced_settings.dtmf_settings.new` constructs a new object with attributes and blocks configured for the `dtmf_settings`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): If true, incoming audio is processed for DTMF (dual tone multi frequency) events. For example, if the caller presses a button on their telephone keypad and DTMF processing is enabled, Dialogflow will detect the event (e.g. a "3" was pressed) in the incoming audio and pass the event to the bot to drive business logic (e.g. when 3 is pressed, return the account balance). When `null`, the `enabled` field will be omitted from the resulting object.\n  - `finish_digit` (`string`): The digit that terminates a DTMF digit sequence. When `null`, the `finish_digit` field will be omitted from the resulting object.\n  - `max_digits` (`number`): Max length of DTMF digits. When `null`, the `max_digits` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `dtmf_settings` sub block.\n', args=[]),
+          new(
+            enabled=null,
+            finish_digit=null,
+            max_digits=null
+          ):: std.prune(a={
+            enabled: enabled,
+            finish_digit: finish_digit,
+            max_digits: max_digits,
+          }),
+        },
+        '#new':: d.fn(help='\n`google.dialogflow_cx_page.form.parameters.advanced_settings.new` constructs a new object with attributes and blocks configured for the `advanced_settings`\nTerraform sub block.\n\n\n\n**Args**:\n  - `dtmf_settings` (`list[obj]`): Define behaviors for DTMF (dual tone multi frequency). DTMF settings does not override each other. DTMF settings set at different levels define DTMF detections running in parallel. Exposed at the following levels:\n* Agent level\n* Flow level\n* Page level\n* Parameter level When `null`, the `dtmf_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.form.parameters.advanced_settings.dtmf_settings.new](#fn-formformparametersdtmf_settingsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `advanced_settings` sub block.\n', args=[]),
+        new(
+          dtmf_settings=null
+        ):: std.prune(a={
+          dtmf_settings: dtmf_settings,
+        }),
+      },
       fill_behavior:: {
         initial_prompt_fulfillment:: {
           conditional_cases:: {
@@ -480,8 +520,9 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
           },
         },
       },
-      '#new':: d.fn(help='\n`google.dialogflow_cx_page.form.parameters.new` constructs a new object with attributes and blocks configured for the `parameters`\nTerraform sub block.\n\n\n\n**Args**:\n  - `default_value` (`string`): The default value of an optional parameter. If the parameter is required, the default value will be ignored. When `null`, the `default_value` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable name of the parameter, unique within the form. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `entity_type` (`string`): The entity type of the parameter.\nFormat: projects/-/locations/-/agents/-/entityTypes/<System Entity Type ID> for system entity types (for example, projects/-/locations/-/agents/-/entityTypes/sys.date), or projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/entityTypes/<Entity Type ID> for developer entity types. When `null`, the `entity_type` field will be omitted from the resulting object.\n  - `is_list` (`bool`): Indicates whether the parameter represents a list of values. When `null`, the `is_list` field will be omitted from the resulting object.\n  - `redact` (`bool`): Indicates whether the parameter content should be redacted in log.\nIf redaction is enabled, the parameter content will be replaced by parameter name during logging. Note: the parameter content is subject to redaction if either parameter level redaction or entity type level redaction is enabled. When `null`, the `redact` field will be omitted from the resulting object.\n  - `required` (`bool`): Indicates whether the parameter is required. Optional parameters will not trigger prompts; however, they are filled if the user specifies them.\nRequired parameters must be filled before form filling concludes. When `null`, the `required` field will be omitted from the resulting object.\n  - `fill_behavior` (`list[obj]`): Defines fill behavior for the parameter. When `null`, the `fill_behavior` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.form.parameters.fill_behavior.new](#fn-formformfill_behaviornew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `parameters` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.dialogflow_cx_page.form.parameters.new` constructs a new object with attributes and blocks configured for the `parameters`\nTerraform sub block.\n\n\n\n**Args**:\n  - `default_value` (`string`): The default value of an optional parameter. If the parameter is required, the default value will be ignored. When `null`, the `default_value` field will be omitted from the resulting object.\n  - `display_name` (`string`): The human-readable name of the parameter, unique within the form. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `entity_type` (`string`): The entity type of the parameter.\nFormat: projects/-/locations/-/agents/-/entityTypes/<System Entity Type ID> for system entity types (for example, projects/-/locations/-/agents/-/entityTypes/sys.date), or projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/entityTypes/<Entity Type ID> for developer entity types. When `null`, the `entity_type` field will be omitted from the resulting object.\n  - `is_list` (`bool`): Indicates whether the parameter represents a list of values. When `null`, the `is_list` field will be omitted from the resulting object.\n  - `redact` (`bool`): Indicates whether the parameter content should be redacted in log.\nIf redaction is enabled, the parameter content will be replaced by parameter name during logging. Note: the parameter content is subject to redaction if either parameter level redaction or entity type level redaction is enabled. When `null`, the `redact` field will be omitted from the resulting object.\n  - `required` (`bool`): Indicates whether the parameter is required. Optional parameters will not trigger prompts; however, they are filled if the user specifies them.\nRequired parameters must be filled before form filling concludes. When `null`, the `required` field will be omitted from the resulting object.\n  - `advanced_settings` (`list[obj]`): Hierarchical advanced settings for this parameter. The settings exposed at the lower level overrides the settings exposed at the higher level.\nHierarchy: Agent->Flow->Page->Fulfillment/Parameter. When `null`, the `advanced_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.form.parameters.advanced_settings.new](#fn-formformadvanced_settingsnew) constructor.\n  - `fill_behavior` (`list[obj]`): Defines fill behavior for the parameter. When `null`, the `fill_behavior` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.form.parameters.fill_behavior.new](#fn-formformfill_behaviornew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `parameters` sub block.\n', args=[]),
       new(
+        advanced_settings=null,
         default_value=null,
         display_name=null,
         entity_type=null,
@@ -490,6 +531,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         redact=null,
         required=null
       ):: std.prune(a={
+        advanced_settings: advanced_settings,
         default_value: default_value,
         display_name: display_name,
         entity_type: entity_type,
@@ -500,10 +542,11 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
   },
-  '#new':: d.fn(help="\n`google.dialogflow_cx_page.new` injects a new `google_dialogflow_cx_page` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dialogflow_cx_page.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dialogflow_cx_page` using the reference:\n\n    $._ref.google_dialogflow_cx_page.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dialogflow_cx_page.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `display_name` (`string`): The human-readable name of the page, unique within the agent.\n  - `language_code` (`string`): The language of the following fields in page:\n\nPage.entry_fulfillment.messages\nPage.entry_fulfillment.conditional_cases\nPage.event_handlers.trigger_fulfillment.messages\nPage.event_handlers.trigger_fulfillment.conditional_cases\nPage.form.parameters.fill_behavior.initial_prompt_fulfillment.messages\nPage.form.parameters.fill_behavior.initial_prompt_fulfillment.conditional_cases\nPage.form.parameters.fill_behavior.reprompt_event_handlers.messages\nPage.form.parameters.fill_behavior.reprompt_event_handlers.conditional_cases\nPage.transition_routes.trigger_fulfillment.messages\nPage.transition_routes.trigger_fulfillment.conditional_cases\nIf not specified, the agent\u0026#39;s default language is used. Many languages are supported. Note: languages must be enabled in the agent before they can be used. When `null`, the `language_code` field will be omitted from the resulting object.\n  - `parent` (`string`): The flow to create a page for.\nFormat: projects/\u0026lt;Project ID\u0026gt;/locations/\u0026lt;Location ID\u0026gt;/agents/\u0026lt;Agent ID\u0026gt;/flows/\u0026lt;Flow ID\u0026gt;. When `null`, the `parent` field will be omitted from the resulting object.\n  - `transition_route_groups` (`list`): Ordered list of TransitionRouteGroups associated with the page. Transition route groups must be unique within a page.\nIf multiple transition routes within a page scope refer to the same intent, then the precedence order is: page\u0026#39;s transition route -\u0026gt; page\u0026#39;s transition route group -\u0026gt; flow\u0026#39;s transition routes.\nIf multiple transition route groups within a page contain the same intent, then the first group in the ordered list takes precedence.\nFormat:projects/\u0026lt;Project ID\u0026gt;/locations/\u0026lt;Location ID\u0026gt;/agents/\u0026lt;Agent ID\u0026gt;/flows/\u0026lt;Flow ID\u0026gt;/transitionRouteGroups/\u0026lt;TransitionRouteGroup ID\u0026gt;. When `null`, the `transition_route_groups` field will be omitted from the resulting object.\n  - `entry_fulfillment` (`list[obj]`): The fulfillment to call when the session is entering the page. When `null`, the `entry_fulfillment` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.entry_fulfillment.new](#fn-entry_fulfillmentnew) constructor.\n  - `event_handlers` (`list[obj]`): Handlers associated with the page to handle events such as webhook errors, no match or no input. When `null`, the `event_handlers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.event_handlers.new](#fn-event_handlersnew) constructor.\n  - `form` (`list[obj]`): The form associated with the page, used for collecting parameters relevant to the page. When `null`, the `form` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.form.new](#fn-formnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.timeouts.new](#fn-timeoutsnew) constructor.\n  - `transition_routes` (`list[obj]`): A list of transitions for the transition rules of this page. They route the conversation to another page in the same flow, or another flow.\nWhen we are in a certain page, the TransitionRoutes are evalauted in the following order:\nTransitionRoutes defined in the page with intent specified.\nTransitionRoutes defined in the transition route groups with intent specified.\nTransitionRoutes defined in flow with intent specified.\nTransitionRoutes defined in the transition route groups with intent specified.\nTransitionRoutes defined in the page with only condition specified.\nTransitionRoutes defined in the transition route groups with only condition specified. When `null`, the `transition_routes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.transition_routes.new](#fn-transition_routesnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.dialogflow_cx_page.new` injects a new `google_dialogflow_cx_page` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dialogflow_cx_page.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dialogflow_cx_page` using the reference:\n\n    $._ref.google_dialogflow_cx_page.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dialogflow_cx_page.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `display_name` (`string`): The human-readable name of the page, unique within the agent.\n  - `language_code` (`string`): The language of the following fields in page:\n\nPage.entry_fulfillment.messages\nPage.entry_fulfillment.conditional_cases\nPage.event_handlers.trigger_fulfillment.messages\nPage.event_handlers.trigger_fulfillment.conditional_cases\nPage.form.parameters.fill_behavior.initial_prompt_fulfillment.messages\nPage.form.parameters.fill_behavior.initial_prompt_fulfillment.conditional_cases\nPage.form.parameters.fill_behavior.reprompt_event_handlers.messages\nPage.form.parameters.fill_behavior.reprompt_event_handlers.conditional_cases\nPage.transition_routes.trigger_fulfillment.messages\nPage.transition_routes.trigger_fulfillment.conditional_cases\nIf not specified, the agent\u0026#39;s default language is used. Many languages are supported. Note: languages must be enabled in the agent before they can be used. When `null`, the `language_code` field will be omitted from the resulting object.\n  - `parent` (`string`): The flow to create a page for.\nFormat: projects/\u0026lt;Project ID\u0026gt;/locations/\u0026lt;Location ID\u0026gt;/agents/\u0026lt;Agent ID\u0026gt;/flows/\u0026lt;Flow ID\u0026gt;. When `null`, the `parent` field will be omitted from the resulting object.\n  - `transition_route_groups` (`list`): Ordered list of TransitionRouteGroups associated with the page. Transition route groups must be unique within a page.\nIf multiple transition routes within a page scope refer to the same intent, then the precedence order is: page\u0026#39;s transition route -\u0026gt; page\u0026#39;s transition route group -\u0026gt; flow\u0026#39;s transition routes.\nIf multiple transition route groups within a page contain the same intent, then the first group in the ordered list takes precedence.\nFormat:projects/\u0026lt;Project ID\u0026gt;/locations/\u0026lt;Location ID\u0026gt;/agents/\u0026lt;Agent ID\u0026gt;/flows/\u0026lt;Flow ID\u0026gt;/transitionRouteGroups/\u0026lt;TransitionRouteGroup ID\u0026gt;. When `null`, the `transition_route_groups` field will be omitted from the resulting object.\n  - `advanced_settings` (`list[obj]`): Hierarchical advanced settings for this page. The settings exposed at the lower level overrides the settings exposed at the higher level.\nHierarchy: Agent-\u0026gt;Flow-\u0026gt;Page-\u0026gt;Fulfillment/Parameter. When `null`, the `advanced_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.advanced_settings.new](#fn-advanced_settingsnew) constructor.\n  - `entry_fulfillment` (`list[obj]`): The fulfillment to call when the session is entering the page. When `null`, the `entry_fulfillment` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.entry_fulfillment.new](#fn-entry_fulfillmentnew) constructor.\n  - `event_handlers` (`list[obj]`): Handlers associated with the page to handle events such as webhook errors, no match or no input. When `null`, the `event_handlers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.event_handlers.new](#fn-event_handlersnew) constructor.\n  - `form` (`list[obj]`): The form associated with the page, used for collecting parameters relevant to the page. When `null`, the `form` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.form.new](#fn-formnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.timeouts.new](#fn-timeoutsnew) constructor.\n  - `transition_routes` (`list[obj]`): A list of transitions for the transition rules of this page. They route the conversation to another page in the same flow, or another flow.\nWhen we are in a certain page, the TransitionRoutes are evalauted in the following order:\nTransitionRoutes defined in the page with intent specified.\nTransitionRoutes defined in the transition route groups with intent specified.\nTransitionRoutes defined in flow with intent specified.\nTransitionRoutes defined in the transition route groups with intent specified.\nTransitionRoutes defined in the page with only condition specified.\nTransitionRoutes defined in the transition route groups with only condition specified. When `null`, the `transition_routes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.transition_routes.new](#fn-transition_routesnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     display_name,
+    advanced_settings=null,
     entry_fulfillment=null,
     event_handlers=null,
     form=null,
@@ -517,6 +560,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     type='google_dialogflow_cx_page',
     label=resourceLabel,
     attrs=self.newAttrs(
+      advanced_settings=advanced_settings,
       display_name=display_name,
       entry_fulfillment=entry_fulfillment,
       event_handlers=event_handlers,
@@ -529,9 +573,10 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.dialogflow_cx_page.newAttrs` constructs a new object with attributes and blocks configured for the `dialogflow_cx_page`\nTerraform resource.\n\nUnlike [google.dialogflow_cx_page.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `display_name` (`string`): The human-readable name of the page, unique within the agent.\n  - `language_code` (`string`): The language of the following fields in page:\n\nPage.entry_fulfillment.messages\nPage.entry_fulfillment.conditional_cases\nPage.event_handlers.trigger_fulfillment.messages\nPage.event_handlers.trigger_fulfillment.conditional_cases\nPage.form.parameters.fill_behavior.initial_prompt_fulfillment.messages\nPage.form.parameters.fill_behavior.initial_prompt_fulfillment.conditional_cases\nPage.form.parameters.fill_behavior.reprompt_event_handlers.messages\nPage.form.parameters.fill_behavior.reprompt_event_handlers.conditional_cases\nPage.transition_routes.trigger_fulfillment.messages\nPage.transition_routes.trigger_fulfillment.conditional_cases\nIf not specified, the agent's default language is used. Many languages are supported. Note: languages must be enabled in the agent before they can be used. When `null`, the `language_code` field will be omitted from the resulting object.\n  - `parent` (`string`): The flow to create a page for.\nFormat: projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/flows/<Flow ID>. When `null`, the `parent` field will be omitted from the resulting object.\n  - `transition_route_groups` (`list`): Ordered list of TransitionRouteGroups associated with the page. Transition route groups must be unique within a page.\nIf multiple transition routes within a page scope refer to the same intent, then the precedence order is: page's transition route -> page's transition route group -> flow's transition routes.\nIf multiple transition route groups within a page contain the same intent, then the first group in the ordered list takes precedence.\nFormat:projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/flows/<Flow ID>/transitionRouteGroups/<TransitionRouteGroup ID>. When `null`, the `transition_route_groups` field will be omitted from the resulting object.\n  - `entry_fulfillment` (`list[obj]`): The fulfillment to call when the session is entering the page. When `null`, the `entry_fulfillment` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.entry_fulfillment.new](#fn-entry_fulfillmentnew) constructor.\n  - `event_handlers` (`list[obj]`): Handlers associated with the page to handle events such as webhook errors, no match or no input. When `null`, the `event_handlers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.event_handlers.new](#fn-event_handlersnew) constructor.\n  - `form` (`list[obj]`): The form associated with the page, used for collecting parameters relevant to the page. When `null`, the `form` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.form.new](#fn-formnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.timeouts.new](#fn-timeoutsnew) constructor.\n  - `transition_routes` (`list[obj]`): A list of transitions for the transition rules of this page. They route the conversation to another page in the same flow, or another flow.\nWhen we are in a certain page, the TransitionRoutes are evalauted in the following order:\nTransitionRoutes defined in the page with intent specified.\nTransitionRoutes defined in the transition route groups with intent specified.\nTransitionRoutes defined in flow with intent specified.\nTransitionRoutes defined in the transition route groups with intent specified.\nTransitionRoutes defined in the page with only condition specified.\nTransitionRoutes defined in the transition route groups with only condition specified. When `null`, the `transition_routes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.transition_routes.new](#fn-transition_routesnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dialogflow_cx_page` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.dialogflow_cx_page.newAttrs` constructs a new object with attributes and blocks configured for the `dialogflow_cx_page`\nTerraform resource.\n\nUnlike [google.dialogflow_cx_page.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `display_name` (`string`): The human-readable name of the page, unique within the agent.\n  - `language_code` (`string`): The language of the following fields in page:\n\nPage.entry_fulfillment.messages\nPage.entry_fulfillment.conditional_cases\nPage.event_handlers.trigger_fulfillment.messages\nPage.event_handlers.trigger_fulfillment.conditional_cases\nPage.form.parameters.fill_behavior.initial_prompt_fulfillment.messages\nPage.form.parameters.fill_behavior.initial_prompt_fulfillment.conditional_cases\nPage.form.parameters.fill_behavior.reprompt_event_handlers.messages\nPage.form.parameters.fill_behavior.reprompt_event_handlers.conditional_cases\nPage.transition_routes.trigger_fulfillment.messages\nPage.transition_routes.trigger_fulfillment.conditional_cases\nIf not specified, the agent's default language is used. Many languages are supported. Note: languages must be enabled in the agent before they can be used. When `null`, the `language_code` field will be omitted from the resulting object.\n  - `parent` (`string`): The flow to create a page for.\nFormat: projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/flows/<Flow ID>. When `null`, the `parent` field will be omitted from the resulting object.\n  - `transition_route_groups` (`list`): Ordered list of TransitionRouteGroups associated with the page. Transition route groups must be unique within a page.\nIf multiple transition routes within a page scope refer to the same intent, then the precedence order is: page's transition route -> page's transition route group -> flow's transition routes.\nIf multiple transition route groups within a page contain the same intent, then the first group in the ordered list takes precedence.\nFormat:projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/flows/<Flow ID>/transitionRouteGroups/<TransitionRouteGroup ID>. When `null`, the `transition_route_groups` field will be omitted from the resulting object.\n  - `advanced_settings` (`list[obj]`): Hierarchical advanced settings for this page. The settings exposed at the lower level overrides the settings exposed at the higher level.\nHierarchy: Agent->Flow->Page->Fulfillment/Parameter. When `null`, the `advanced_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.advanced_settings.new](#fn-advanced_settingsnew) constructor.\n  - `entry_fulfillment` (`list[obj]`): The fulfillment to call when the session is entering the page. When `null`, the `entry_fulfillment` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.entry_fulfillment.new](#fn-entry_fulfillmentnew) constructor.\n  - `event_handlers` (`list[obj]`): Handlers associated with the page to handle events such as webhook errors, no match or no input. When `null`, the `event_handlers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.event_handlers.new](#fn-event_handlersnew) constructor.\n  - `form` (`list[obj]`): The form associated with the page, used for collecting parameters relevant to the page. When `null`, the `form` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.form.new](#fn-formnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.timeouts.new](#fn-timeoutsnew) constructor.\n  - `transition_routes` (`list[obj]`): A list of transitions for the transition rules of this page. They route the conversation to another page in the same flow, or another flow.\nWhen we are in a certain page, the TransitionRoutes are evalauted in the following order:\nTransitionRoutes defined in the page with intent specified.\nTransitionRoutes defined in the transition route groups with intent specified.\nTransitionRoutes defined in flow with intent specified.\nTransitionRoutes defined in the transition route groups with intent specified.\nTransitionRoutes defined in the page with only condition specified.\nTransitionRoutes defined in the transition route groups with only condition specified. When `null`, the `transition_routes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.transition_routes.new](#fn-transition_routesnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dialogflow_cx_page` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     display_name,
+    advanced_settings=null,
     entry_fulfillment=null,
     event_handlers=null,
     form=null,
@@ -541,6 +586,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     transition_route_groups=null,
     transition_routes=null
   ):: std.prune(a={
+    advanced_settings: advanced_settings,
     display_name: display_name,
     entry_fulfillment: entry_fulfillment,
     event_handlers: event_handlers,
@@ -687,6 +733,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withAdvancedSettings':: d.fn(help='`google.list[obj].withAdvancedSettings` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the advanced_settings field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withAdvancedSettingsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `advanced_settings` field.\n', args=[]),
+  withAdvancedSettings(resourceLabel, value): {
+    resource+: {
+      google_dialogflow_cx_page+: {
+        [resourceLabel]+: {
+          advanced_settings: value,
+        },
+      },
+    },
+  },
+  '#withAdvancedSettingsMixin':: d.fn(help='`google.list[obj].withAdvancedSettingsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the advanced_settings field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withAdvancedSettings](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `advanced_settings` field.\n', args=[]),
+  withAdvancedSettingsMixin(resourceLabel, value): {
+    resource+: {
+      google_dialogflow_cx_page+: {
+        [resourceLabel]+: {
+          advanced_settings+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withDisplayName':: d.fn(help='`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the display_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `display_name` field.\n', args=[]),
   withDisplayName(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/dns_managed_zone.libsonnet b/4.x/_gen/resources/dns_managed_zone.libsonnet
index 8c71e953..dde8b293 100644
--- a/4.x/_gen/resources/dns_managed_zone.libsonnet
+++ b/4.x/_gen/resources/dns_managed_zone.libsonnet
@@ -56,7 +56,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
   },
-  '#new':: d.fn(help="\n`google.dns_managed_zone.new` injects a new `google_dns_managed_zone` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dns_managed_zone.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dns_managed_zone` using the reference:\n\n    $._ref.google_dns_managed_zone.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dns_managed_zone.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A textual description field. Defaults to \u0026#39;Managed by Terraform\u0026#39;. When `null`, the `description` field will be omitted from the resulting object.\n  - `dns_name` (`string`): The DNS name of this managed zone, for instance \u0026#34;example.com.\u0026#34;.\n  - `force_destroy` (`bool`): Set this true to delete all records in the zone. When `null`, the `force_destroy` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this ManagedZone. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): User assigned name for this resource.\nMust be unique within the project.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `visibility` (`string`): The zone\u0026#39;s visibility: public zones are exposed to the Internet,\nwhile private zones are visible only to Virtual Private Cloud resources. Default value: \u0026#34;public\u0026#34; Possible values: [\u0026#34;private\u0026#34;, \u0026#34;public\u0026#34;] When `null`, the `visibility` field will be omitted from the resulting object.\n  - `cloud_logging_config` (`list[obj]`): Cloud logging configuration When `null`, the `cloud_logging_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.cloud_logging_config.new](#fn-cloud_logging_confignew) constructor.\n  - `dnssec_config` (`list[obj]`): DNSSEC configuration When `null`, the `dnssec_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.dnssec_config.new](#fn-dnssec_confignew) constructor.\n  - `forwarding_config` (`list[obj]`): The presence for this field indicates that outbound forwarding is enabled\nfor this zone. The value of this field contains the set of destinations\nto forward to. When `null`, the `forwarding_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.forwarding_config.new](#fn-forwarding_confignew) constructor.\n  - `peering_config` (`list[obj]`): The presence of this field indicates that DNS Peering is enabled for this\nzone. The value of this field contains the network to peer with. When `null`, the `peering_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.peering_config.new](#fn-peering_confignew) constructor.\n  - `private_visibility_config` (`list[obj]`): For privately visible zones, the set of Virtual Private Cloud\nresources that the zone is visible from. At least one of \u0026#39;gke_clusters\u0026#39; or \u0026#39;networks\u0026#39; must be specified. When `null`, the `private_visibility_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.private_visibility_config.new](#fn-private_visibility_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.dns_managed_zone.new` injects a new `google_dns_managed_zone` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.dns_managed_zone.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.dns_managed_zone` using the reference:\n\n    $._ref.google_dns_managed_zone.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_dns_managed_zone.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A textual description field. Defaults to \u0026#39;Managed by Terraform\u0026#39;. When `null`, the `description` field will be omitted from the resulting object.\n  - `dns_name` (`string`): The DNS name of this managed zone, for instance \u0026#34;example.com.\u0026#34;.\n  - `force_destroy` (`bool`): Set this true to delete all records in the zone. When `null`, the `force_destroy` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this ManagedZone.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): User assigned name for this resource.\nMust be unique within the project.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `visibility` (`string`): The zone\u0026#39;s visibility: public zones are exposed to the Internet,\nwhile private zones are visible only to Virtual Private Cloud resources. Default value: \u0026#34;public\u0026#34; Possible values: [\u0026#34;private\u0026#34;, \u0026#34;public\u0026#34;] When `null`, the `visibility` field will be omitted from the resulting object.\n  - `cloud_logging_config` (`list[obj]`): Cloud logging configuration When `null`, the `cloud_logging_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.cloud_logging_config.new](#fn-cloud_logging_confignew) constructor.\n  - `dnssec_config` (`list[obj]`): DNSSEC configuration When `null`, the `dnssec_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.dnssec_config.new](#fn-dnssec_confignew) constructor.\n  - `forwarding_config` (`list[obj]`): The presence for this field indicates that outbound forwarding is enabled\nfor this zone. The value of this field contains the set of destinations\nto forward to. When `null`, the `forwarding_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.forwarding_config.new](#fn-forwarding_confignew) constructor.\n  - `peering_config` (`list[obj]`): The presence of this field indicates that DNS Peering is enabled for this\nzone. The value of this field contains the network to peer with. When `null`, the `peering_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.peering_config.new](#fn-peering_confignew) constructor.\n  - `private_visibility_config` (`list[obj]`): For privately visible zones, the set of Virtual Private Cloud\nresources that the zone is visible from. At least one of \u0026#39;gke_clusters\u0026#39; or \u0026#39;networks\u0026#39; must be specified. When `null`, the `private_visibility_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.private_visibility_config.new](#fn-private_visibility_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     dns_name,
@@ -93,7 +93,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.dns_managed_zone.newAttrs` constructs a new object with attributes and blocks configured for the `dns_managed_zone`\nTerraform resource.\n\nUnlike [google.dns_managed_zone.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A textual description field. Defaults to 'Managed by Terraform'. When `null`, the `description` field will be omitted from the resulting object.\n  - `dns_name` (`string`): The DNS name of this managed zone, for instance "example.com.".\n  - `force_destroy` (`bool`): Set this true to delete all records in the zone. When `null`, the `force_destroy` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this ManagedZone. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): User assigned name for this resource.\nMust be unique within the project.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `visibility` (`string`): The zone's visibility: public zones are exposed to the Internet,\nwhile private zones are visible only to Virtual Private Cloud resources. Default value: "public" Possible values: ["private", "public"] When `null`, the `visibility` field will be omitted from the resulting object.\n  - `cloud_logging_config` (`list[obj]`): Cloud logging configuration When `null`, the `cloud_logging_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.cloud_logging_config.new](#fn-cloud_logging_confignew) constructor.\n  - `dnssec_config` (`list[obj]`): DNSSEC configuration When `null`, the `dnssec_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.dnssec_config.new](#fn-dnssec_confignew) constructor.\n  - `forwarding_config` (`list[obj]`): The presence for this field indicates that outbound forwarding is enabled\nfor this zone. The value of this field contains the set of destinations\nto forward to. When `null`, the `forwarding_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.forwarding_config.new](#fn-forwarding_confignew) constructor.\n  - `peering_config` (`list[obj]`): The presence of this field indicates that DNS Peering is enabled for this\nzone. The value of this field contains the network to peer with. When `null`, the `peering_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.peering_config.new](#fn-peering_confignew) constructor.\n  - `private_visibility_config` (`list[obj]`): For privately visible zones, the set of Virtual Private Cloud\nresources that the zone is visible from. At least one of 'gke_clusters' or 'networks' must be specified. When `null`, the `private_visibility_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.private_visibility_config.new](#fn-private_visibility_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dns_managed_zone` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.dns_managed_zone.newAttrs` constructs a new object with attributes and blocks configured for the `dns_managed_zone`\nTerraform resource.\n\nUnlike [google.dns_managed_zone.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A textual description field. Defaults to 'Managed by Terraform'. When `null`, the `description` field will be omitted from the resulting object.\n  - `dns_name` (`string`): The DNS name of this managed zone, for instance "example.com.".\n  - `force_destroy` (`bool`): Set this true to delete all records in the zone. When `null`, the `force_destroy` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this ManagedZone.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): User assigned name for this resource.\nMust be unique within the project.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `visibility` (`string`): The zone's visibility: public zones are exposed to the Internet,\nwhile private zones are visible only to Virtual Private Cloud resources. Default value: "public" Possible values: ["private", "public"] When `null`, the `visibility` field will be omitted from the resulting object.\n  - `cloud_logging_config` (`list[obj]`): Cloud logging configuration When `null`, the `cloud_logging_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.cloud_logging_config.new](#fn-cloud_logging_confignew) constructor.\n  - `dnssec_config` (`list[obj]`): DNSSEC configuration When `null`, the `dnssec_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.dnssec_config.new](#fn-dnssec_confignew) constructor.\n  - `forwarding_config` (`list[obj]`): The presence for this field indicates that outbound forwarding is enabled\nfor this zone. The value of this field contains the set of destinations\nto forward to. When `null`, the `forwarding_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.forwarding_config.new](#fn-forwarding_confignew) constructor.\n  - `peering_config` (`list[obj]`): The presence of this field indicates that DNS Peering is enabled for this\nzone. The value of this field contains the network to peer with. When `null`, the `peering_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.peering_config.new](#fn-peering_confignew) constructor.\n  - `private_visibility_config` (`list[obj]`): For privately visible zones, the set of Virtual Private Cloud\nresources that the zone is visible from. At least one of 'gke_clusters' or 'networks' must be specified. When `null`, the `private_visibility_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.private_visibility_config.new](#fn-private_visibility_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dns_managed_zone.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dns_managed_zone` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     dns_name,
     name,
diff --git a/4.x/_gen/resources/edgecontainer_cluster.libsonnet b/4.x/_gen/resources/edgecontainer_cluster.libsonnet
new file mode 100644
index 00000000..f80362cb
--- /dev/null
+++ b/4.x/_gen/resources/edgecontainer_cluster.libsonnet
@@ -0,0 +1,468 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='edgecontainer_cluster', url='', help='`edgecontainer_cluster` represents the `google_edgecontainer_cluster` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  authorization:: {
+    admin_users:: {
+      '#new':: d.fn(help='\n`google.edgecontainer_cluster.authorization.admin_users.new` constructs a new object with attributes and blocks configured for the `admin_users`\nTerraform sub block.\n\n\n\n**Args**:\n  - `username` (`string`): An active Google username.\n\n**Returns**:\n  - An attribute object that represents the `admin_users` sub block.\n', args=[]),
+      new(
+        username
+      ):: std.prune(a={
+        username: username,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.edgecontainer_cluster.authorization.new` constructs a new object with attributes and blocks configured for the `authorization`\nTerraform sub block.\n\n\n\n**Args**:\n  - `admin_users` (`list[obj]`): User that will be granted the cluster-admin role on the cluster, providing\nfull access to the cluster. Currently, this is a singular field, but will\nbe expanded to allow multiple admins in the future. When `null`, the `admin_users` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.authorization.admin_users.new](#fn-authorizationadmin_usersnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `authorization` sub block.\n', args=[]),
+    new(
+      admin_users=null
+    ):: std.prune(a={
+      admin_users: admin_users,
+    }),
+  },
+  control_plane:: {
+    'local':: {
+      '#new':: d.fn(help='\n`google.edgecontainer_cluster.control_plane.local.new` constructs a new object with attributes and blocks configured for the `local`\nTerraform sub block.\n\n\n\n**Args**:\n  - `machine_filter` (`string`): Only machines matching this filter will be allowed to host control\nplane nodes. The filtering language accepts strings like "name=<name>",\nand is documented here: [AIP-160](https://google.aip.dev/160). When `null`, the `machine_filter` field will be omitted from the resulting object.\n  - `node_count` (`number`): The number of nodes to serve as replicas of the Control Plane.\nOnly 1 and 3 are supported. When `null`, the `node_count` field will be omitted from the resulting object.\n  - `node_location` (`string`): Name of the Google Distributed Cloud Edge zones where this node pool\nwill be created. For example: 'us-central1-edge-customer-a'. When `null`, the `node_location` field will be omitted from the resulting object.\n  - `shared_deployment_policy` (`string`): Policy configuration about how user applications are deployed. Possible values: ["SHARED_DEPLOYMENT_POLICY_UNSPECIFIED", "ALLOWED", "DISALLOWED"] When `null`, the `shared_deployment_policy` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `local` sub block.\n', args=[]),
+      new(
+        machine_filter=null,
+        node_count=null,
+        node_location=null,
+        shared_deployment_policy=null
+      ):: std.prune(a={
+        machine_filter: machine_filter,
+        node_count: node_count,
+        node_location: node_location,
+        shared_deployment_policy: shared_deployment_policy,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.edgecontainer_cluster.control_plane.new` constructs a new object with attributes and blocks configured for the `control_plane`\nTerraform sub block.\n\n\n\n**Args**:\n  - `local_` (`list[obj]`): Local control plane configuration. When `null`, the `local_` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.control_plane.local_.new](#fn-control_planelocal_new) constructor.\n  - `remote` (`list[obj]`): Remote control plane configuration. When `null`, the `remote` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.control_plane.remote.new](#fn-control_planeremotenew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `control_plane` sub block.\n', args=[]),
+    new(
+      local_=null,
+      remote=null
+    ):: std.prune(a={
+      'local': local_,
+      remote: remote,
+    }),
+    remote:: {
+      '#new':: d.fn(help='\n`google.edgecontainer_cluster.control_plane.remote.new` constructs a new object with attributes and blocks configured for the `remote`\nTerraform sub block.\n\n\n\n**Args**:\n  - `node_location` (`string`): Name of the Google Distributed Cloud Edge zones where this node pool\nwill be created. For example: 'us-central1-edge-customer-a'. When `null`, the `node_location` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `remote` sub block.\n', args=[]),
+      new(
+        node_location=null
+      ):: std.prune(a={
+        node_location: node_location,
+      }),
+    },
+  },
+  control_plane_encryption:: {
+    '#new':: d.fn(help='\n`google.edgecontainer_cluster.control_plane_encryption.new` constructs a new object with attributes and blocks configured for the `control_plane_encryption`\nTerraform sub block.\n\n\n\n**Args**:\n  - `kms_key` (`string`): The Cloud KMS CryptoKey e.g.\nprojects/{project}/locations/{location}/keyRings/{keyRing}/cryptoKeys/{cryptoKey}\nto use for protecting control plane disks. If not specified, a\nGoogle-managed key will be used instead. When `null`, the `kms_key` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `control_plane_encryption` sub block.\n', args=[]),
+    new(
+      kms_key=null
+    ):: std.prune(a={
+      kms_key: kms_key,
+    }),
+  },
+  fleet:: {
+    '#new':: d.fn(help='\n`google.edgecontainer_cluster.fleet.new` constructs a new object with attributes and blocks configured for the `fleet`\nTerraform sub block.\n\n\n\n**Args**:\n  - `project` (`string`): The name of the Fleet host project where this cluster will be registered.\nProject names are formatted as\n'projects/<project-number>'.\n\n**Returns**:\n  - An attribute object that represents the `fleet` sub block.\n', args=[]),
+    new(
+      project
+    ):: std.prune(a={
+      project: project,
+    }),
+  },
+  maintenance_policy:: {
+    '#new':: d.fn(help='\n`google.edgecontainer_cluster.maintenance_policy.new` constructs a new object with attributes and blocks configured for the `maintenance_policy`\nTerraform sub block.\n\n\n\n**Args**:\n  - `window` (`list[obj]`): Specifies the maintenance window in which maintenance may be performed. When `null`, the `window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.maintenance_policy.window.new](#fn-maintenance_policywindownew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `maintenance_policy` sub block.\n', args=[]),
+    new(
+      window=null
+    ):: std.prune(a={
+      window: window,
+    }),
+    window:: {
+      '#new':: d.fn(help='\n`google.edgecontainer_cluster.maintenance_policy.window.new` constructs a new object with attributes and blocks configured for the `window`\nTerraform sub block.\n\n\n\n**Args**:\n  - `recurring_window` (`list[obj]`): Represents an arbitrary window of time that recurs. When `null`, the `recurring_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.maintenance_policy.window.recurring_window.new](#fn-maintenance_policymaintenance_policyrecurring_windownew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `window` sub block.\n', args=[]),
+      new(
+        recurring_window=null
+      ):: std.prune(a={
+        recurring_window: recurring_window,
+      }),
+      recurring_window:: {
+        '#new':: d.fn(help='\n`google.edgecontainer_cluster.maintenance_policy.window.recurring_window.new` constructs a new object with attributes and blocks configured for the `recurring_window`\nTerraform sub block.\n\n\n\n**Args**:\n  - `recurrence` (`string`): An RRULE (https://tools.ietf.org/html/rfc5545#section-3.8.5.3) for how\nthis window recurs. They go on for the span of time between the start and\nend time. When `null`, the `recurrence` field will be omitted from the resulting object.\n  - `window` (`list[obj]`): Represents an arbitrary window of time. When `null`, the `window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.maintenance_policy.window.recurring_window.window.new](#fn-maintenance_policymaintenance_policywindowwindownew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `recurring_window` sub block.\n', args=[]),
+        new(
+          recurrence=null,
+          window=null
+        ):: std.prune(a={
+          recurrence: recurrence,
+          window: window,
+        }),
+        window:: {
+          '#new':: d.fn(help='\n`google.edgecontainer_cluster.maintenance_policy.window.recurring_window.window.new` constructs a new object with attributes and blocks configured for the `window`\nTerraform sub block.\n\n\n\n**Args**:\n  - `end_time` (`string`): The time that the window ends. The end time must take place after the\nstart time. When `null`, the `end_time` field will be omitted from the resulting object.\n  - `start_time` (`string`): The time that the window first starts. When `null`, the `start_time` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `window` sub block.\n', args=[]),
+          new(
+            end_time=null,
+            start_time=null
+          ):: std.prune(a={
+            end_time: end_time,
+            start_time: start_time,
+          }),
+        },
+      },
+    },
+  },
+  networking:: {
+    '#new':: d.fn(help='\n`google.edgecontainer_cluster.networking.new` constructs a new object with attributes and blocks configured for the `networking`\nTerraform sub block.\n\n\n\n**Args**:\n  - `cluster_ipv4_cidr_blocks` (`list`): All pods in the cluster are assigned an RFC1918 IPv4 address from these\nblocks. Only a single block is supported. This field cannot be changed\nafter creation.\n  - `cluster_ipv6_cidr_blocks` (`list`): If specified, dual stack mode is enabled and all pods in the cluster are\nassigned an IPv6 address from these blocks alongside from an IPv4\naddress. Only a single block is supported. This field cannot be changed\nafter creation. When `null`, the `cluster_ipv6_cidr_blocks` field will be omitted from the resulting object.\n  - `services_ipv4_cidr_blocks` (`list`): All services in the cluster are assigned an RFC1918 IPv4 address from these\nblocks. Only a single block is supported. This field cannot be changed\nafter creation.\n  - `services_ipv6_cidr_blocks` (`list`): If specified, dual stack mode is enabled and all services in the cluster are\nassigned an IPv6 address from these blocks alongside from an IPv4\naddress. Only a single block is supported. This field cannot be changed\nafter creation. When `null`, the `services_ipv6_cidr_blocks` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `networking` sub block.\n', args=[]),
+    new(
+      cluster_ipv4_cidr_blocks,
+      services_ipv4_cidr_blocks,
+      cluster_ipv6_cidr_blocks=null,
+      services_ipv6_cidr_blocks=null
+    ):: std.prune(a={
+      cluster_ipv4_cidr_blocks: cluster_ipv4_cidr_blocks,
+      cluster_ipv6_cidr_blocks: cluster_ipv6_cidr_blocks,
+      services_ipv4_cidr_blocks: services_ipv4_cidr_blocks,
+      services_ipv6_cidr_blocks: services_ipv6_cidr_blocks,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.edgecontainer_cluster.new` injects a new `google_edgecontainer_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.edgecontainer_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.edgecontainer_cluster` using the reference:\n\n    $._ref.google_edgecontainer_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_edgecontainer_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `default_max_pods_per_node` (`number`): The default maximum number of pods per node used if a maximum value is not\nspecified explicitly for a node pool in this cluster. If unspecified, the\nKubernetes default value will be used. When `null`, the `default_max_pods_per_node` field will be omitted from the resulting object.\n  - `external_load_balancer_ipv4_address_pools` (`list`): Address pools for cluster data plane external load balancing. When `null`, the `external_load_balancer_ipv4_address_pools` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the edgecloud cluster.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the resource.\n  - `name` (`string`): The GDCE cluster name.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `release_channel` (`string`): The release channel a cluster is subscribed to. Possible values: [\u0026#34;RELEASE_CHANNEL_UNSPECIFIED\u0026#34;, \u0026#34;NONE\u0026#34;, \u0026#34;REGULAR\u0026#34;] When `null`, the `release_channel` field will be omitted from the resulting object.\n  - `target_version` (`string`): The target cluster version. For example: \u0026#34;1.5.0\u0026#34;. When `null`, the `target_version` field will be omitted from the resulting object.\n  - `authorization` (`list[obj]`): RBAC policy that will be applied and managed by GEC. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.authorization.new](#fn-authorizationnew) constructor.\n  - `control_plane` (`list[obj]`): The configuration of the cluster control plane. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.control_plane.new](#fn-control_planenew) constructor.\n  - `control_plane_encryption` (`list[obj]`): Remote control plane disk encryption options. This field is only used when\nenabling CMEK support. When `null`, the `control_plane_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.control_plane_encryption.new](#fn-control_plane_encryptionnew) constructor.\n  - `fleet` (`list[obj]`): Fleet related configuration.\nFleets are a Google Cloud concept for logically organizing clusters,\nletting you use and manage multi-cluster capabilities and apply\nconsistent policies across your systems. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.fleet.new](#fn-fleetnew) constructor.\n  - `maintenance_policy` (`list[obj]`): Cluster-wide maintenance policy configuration. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.maintenance_policy.new](#fn-maintenance_policynew) constructor.\n  - `networking` (`list[obj]`): Fleet related configuration.\nFleets are a Google Cloud concept for logically organizing clusters,\nletting you use and manage multi-cluster capabilities and apply\nconsistent policies across your systems. When `null`, the `networking` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.networking.new](#fn-networkingnew) constructor.\n  - `system_addons_config` (`list[obj]`): Config that customers are allowed to define for GDCE system add-ons. When `null`, the `system_addons_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.system_addons_config.new](#fn-system_addons_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    location,
+    name,
+    authorization=null,
+    control_plane=null,
+    control_plane_encryption=null,
+    default_max_pods_per_node=null,
+    external_load_balancer_ipv4_address_pools=null,
+    fleet=null,
+    labels=null,
+    maintenance_policy=null,
+    networking=null,
+    project=null,
+    release_channel=null,
+    system_addons_config=null,
+    target_version=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_edgecontainer_cluster',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      authorization=authorization,
+      control_plane=control_plane,
+      control_plane_encryption=control_plane_encryption,
+      default_max_pods_per_node=default_max_pods_per_node,
+      external_load_balancer_ipv4_address_pools=external_load_balancer_ipv4_address_pools,
+      fleet=fleet,
+      labels=labels,
+      location=location,
+      maintenance_policy=maintenance_policy,
+      name=name,
+      networking=networking,
+      project=project,
+      release_channel=release_channel,
+      system_addons_config=system_addons_config,
+      target_version=target_version,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.edgecontainer_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `edgecontainer_cluster`\nTerraform resource.\n\nUnlike [google.edgecontainer_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `default_max_pods_per_node` (`number`): The default maximum number of pods per node used if a maximum value is not\nspecified explicitly for a node pool in this cluster. If unspecified, the\nKubernetes default value will be used. When `null`, the `default_max_pods_per_node` field will be omitted from the resulting object.\n  - `external_load_balancer_ipv4_address_pools` (`list`): Address pools for cluster data plane external load balancing. When `null`, the `external_load_balancer_ipv4_address_pools` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels for the edgecloud cluster.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the resource.\n  - `name` (`string`): The GDCE cluster name.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `release_channel` (`string`): The release channel a cluster is subscribed to. Possible values: ["RELEASE_CHANNEL_UNSPECIFIED", "NONE", "REGULAR"] When `null`, the `release_channel` field will be omitted from the resulting object.\n  - `target_version` (`string`): The target cluster version. For example: "1.5.0". When `null`, the `target_version` field will be omitted from the resulting object.\n  - `authorization` (`list[obj]`): RBAC policy that will be applied and managed by GEC. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.authorization.new](#fn-authorizationnew) constructor.\n  - `control_plane` (`list[obj]`): The configuration of the cluster control plane. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.control_plane.new](#fn-control_planenew) constructor.\n  - `control_plane_encryption` (`list[obj]`): Remote control plane disk encryption options. This field is only used when\nenabling CMEK support. When `null`, the `control_plane_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.control_plane_encryption.new](#fn-control_plane_encryptionnew) constructor.\n  - `fleet` (`list[obj]`): Fleet related configuration.\nFleets are a Google Cloud concept for logically organizing clusters,\nletting you use and manage multi-cluster capabilities and apply\nconsistent policies across your systems. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.fleet.new](#fn-fleetnew) constructor.\n  - `maintenance_policy` (`list[obj]`): Cluster-wide maintenance policy configuration. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.maintenance_policy.new](#fn-maintenance_policynew) constructor.\n  - `networking` (`list[obj]`): Fleet related configuration.\nFleets are a Google Cloud concept for logically organizing clusters,\nletting you use and manage multi-cluster capabilities and apply\nconsistent policies across your systems. When `null`, the `networking` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.networking.new](#fn-networkingnew) constructor.\n  - `system_addons_config` (`list[obj]`): Config that customers are allowed to define for GDCE system add-ons. When `null`, the `system_addons_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.system_addons_config.new](#fn-system_addons_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `edgecontainer_cluster` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    location,
+    name,
+    authorization=null,
+    control_plane=null,
+    control_plane_encryption=null,
+    default_max_pods_per_node=null,
+    external_load_balancer_ipv4_address_pools=null,
+    fleet=null,
+    labels=null,
+    maintenance_policy=null,
+    networking=null,
+    project=null,
+    release_channel=null,
+    system_addons_config=null,
+    target_version=null,
+    timeouts=null
+  ):: std.prune(a={
+    authorization: authorization,
+    control_plane: control_plane,
+    control_plane_encryption: control_plane_encryption,
+    default_max_pods_per_node: default_max_pods_per_node,
+    external_load_balancer_ipv4_address_pools: external_load_balancer_ipv4_address_pools,
+    fleet: fleet,
+    labels: labels,
+    location: location,
+    maintenance_policy: maintenance_policy,
+    name: name,
+    networking: networking,
+    project: project,
+    release_channel: release_channel,
+    system_addons_config: system_addons_config,
+    target_version: target_version,
+    timeouts: timeouts,
+  }),
+  system_addons_config:: {
+    ingress:: {
+      '#new':: d.fn(help='\n`google.edgecontainer_cluster.system_addons_config.ingress.new` constructs a new object with attributes and blocks configured for the `ingress`\nTerraform sub block.\n\n\n\n**Args**:\n  - `disabled` (`bool`): Whether Ingress is disabled. When `null`, the `disabled` field will be omitted from the resulting object.\n  - `ipv4_vip` (`string`): Ingress VIP. When `null`, the `ipv4_vip` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `ingress` sub block.\n', args=[]),
+      new(
+        disabled=null,
+        ipv4_vip=null
+      ):: std.prune(a={
+        disabled: disabled,
+        ipv4_vip: ipv4_vip,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.edgecontainer_cluster.system_addons_config.new` constructs a new object with attributes and blocks configured for the `system_addons_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `ingress` (`list[obj]`): Config for the Ingress add-on which allows customers to create an Ingress\nobject to manage external access to the servers in a cluster. The add-on\nconsists of istiod and istio-ingress. When `null`, the `ingress` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.system_addons_config.ingress.new](#fn-system_addons_configingressnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `system_addons_config` sub block.\n', args=[]),
+    new(
+      ingress=null
+    ):: std.prune(a={
+      ingress: ingress,
+    }),
+  },
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.edgecontainer_cluster.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withAuthorization':: d.fn(help='`google.list[obj].withAuthorization` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the authorization field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withAuthorizationMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `authorization` field.\n', args=[]),
+  withAuthorization(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          authorization: value,
+        },
+      },
+    },
+  },
+  '#withAuthorizationMixin':: d.fn(help='`google.list[obj].withAuthorizationMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the authorization field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withAuthorization](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `authorization` field.\n', args=[]),
+  withAuthorizationMixin(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          authorization+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withControlPlane':: d.fn(help='`google.list[obj].withControlPlane` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the control_plane field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withControlPlaneMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `control_plane` field.\n', args=[]),
+  withControlPlane(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          control_plane: value,
+        },
+      },
+    },
+  },
+  '#withControlPlaneEncryption':: d.fn(help='`google.list[obj].withControlPlaneEncryption` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the control_plane_encryption field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withControlPlaneEncryptionMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `control_plane_encryption` field.\n', args=[]),
+  withControlPlaneEncryption(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          control_plane_encryption: value,
+        },
+      },
+    },
+  },
+  '#withControlPlaneEncryptionMixin':: d.fn(help='`google.list[obj].withControlPlaneEncryptionMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the control_plane_encryption field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withControlPlaneEncryption](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `control_plane_encryption` field.\n', args=[]),
+  withControlPlaneEncryptionMixin(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          control_plane_encryption+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withControlPlaneMixin':: d.fn(help='`google.list[obj].withControlPlaneMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the control_plane field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withControlPlane](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `control_plane` field.\n', args=[]),
+  withControlPlaneMixin(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          control_plane+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withDefaultMaxPodsPerNode':: d.fn(help='`google.number.withDefaultMaxPodsPerNode` constructs a mixin object that can be merged into the `number`\nTerraform resource block to set or update the default_max_pods_per_node field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`number`): The value to set for the `default_max_pods_per_node` field.\n', args=[]),
+  withDefaultMaxPodsPerNode(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          default_max_pods_per_node: value,
+        },
+      },
+    },
+  },
+  '#withExternalLoadBalancerIpv4AddressPools':: d.fn(help='`google.list.withExternalLoadBalancerIpv4AddressPools` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the external_load_balancer_ipv4_address_pools field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `external_load_balancer_ipv4_address_pools` field.\n', args=[]),
+  withExternalLoadBalancerIpv4AddressPools(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          external_load_balancer_ipv4_address_pools: value,
+        },
+      },
+    },
+  },
+  '#withFleet':: d.fn(help='`google.list[obj].withFleet` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the fleet field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withFleetMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `fleet` field.\n', args=[]),
+  withFleet(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          fleet: value,
+        },
+      },
+    },
+  },
+  '#withFleetMixin':: d.fn(help='`google.list[obj].withFleetMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the fleet field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withFleet](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `fleet` field.\n', args=[]),
+  withFleetMixin(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          fleet+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
+  withLabels(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          labels: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withMaintenancePolicy':: d.fn(help='`google.list[obj].withMaintenancePolicy` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the maintenance_policy field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withMaintenancePolicyMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `maintenance_policy` field.\n', args=[]),
+  withMaintenancePolicy(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          maintenance_policy: value,
+        },
+      },
+    },
+  },
+  '#withMaintenancePolicyMixin':: d.fn(help='`google.list[obj].withMaintenancePolicyMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the maintenance_policy field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withMaintenancePolicy](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `maintenance_policy` field.\n', args=[]),
+  withMaintenancePolicyMixin(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          maintenance_policy+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withNetworking':: d.fn(help='`google.list[obj].withNetworking` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the networking field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withNetworkingMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `networking` field.\n', args=[]),
+  withNetworking(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          networking: value,
+        },
+      },
+    },
+  },
+  '#withNetworkingMixin':: d.fn(help='`google.list[obj].withNetworkingMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the networking field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withNetworking](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `networking` field.\n', args=[]),
+  withNetworkingMixin(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          networking+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withReleaseChannel':: d.fn(help='`google.string.withReleaseChannel` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the release_channel field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `release_channel` field.\n', args=[]),
+  withReleaseChannel(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          release_channel: value,
+        },
+      },
+    },
+  },
+  '#withSystemAddonsConfig':: d.fn(help='`google.list[obj].withSystemAddonsConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the system_addons_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withSystemAddonsConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `system_addons_config` field.\n', args=[]),
+  withSystemAddonsConfig(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          system_addons_config: value,
+        },
+      },
+    },
+  },
+  '#withSystemAddonsConfigMixin':: d.fn(help='`google.list[obj].withSystemAddonsConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the system_addons_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withSystemAddonsConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `system_addons_config` field.\n', args=[]),
+  withSystemAddonsConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          system_addons_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withTargetVersion':: d.fn(help='`google.string.withTargetVersion` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the target_version field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `target_version` field.\n', args=[]),
+  withTargetVersion(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          target_version: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_cluster+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/edgecontainer_node_pool.libsonnet b/4.x/_gen/resources/edgecontainer_node_pool.libsonnet
new file mode 100644
index 00000000..689085d0
--- /dev/null
+++ b/4.x/_gen/resources/edgecontainer_node_pool.libsonnet
@@ -0,0 +1,232 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='edgecontainer_node_pool', url='', help='`edgecontainer_node_pool` represents the `google_edgecontainer_node_pool` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  local_disk_encryption:: {
+    '#new':: d.fn(help='\n`google.edgecontainer_node_pool.local_disk_encryption.new` constructs a new object with attributes and blocks configured for the `local_disk_encryption`\nTerraform sub block.\n\n\n\n**Args**:\n  - `kms_key` (`string`): The Cloud KMS CryptoKey e.g. projects/{project}/locations/{location}/keyRings/{keyRing}/cryptoKeys/{cryptoKey} to use for protecting node local disks.\nIf not specified, a Google-managed key will be used instead. When `null`, the `kms_key` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `local_disk_encryption` sub block.\n', args=[]),
+    new(
+      kms_key=null
+    ):: std.prune(a={
+      kms_key: kms_key,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.edgecontainer_node_pool.new` injects a new `google_edgecontainer_node_pool` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.edgecontainer_node_pool.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.edgecontainer_node_pool` using the reference:\n\n    $._ref.google_edgecontainer_node_pool.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_edgecontainer_node_pool.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `cluster` (`string`): The name of the target Distributed Cloud Edge Cluster.\n  - `labels` (`obj`): Labels associated with this resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the resource.\n  - `machine_filter` (`string`): Only machines matching this filter will be allowed to join the node pool.\nThe filtering language accepts strings like \u0026#34;name=\u0026lt;name\u0026gt;\u0026#34;, and is\ndocumented in more detail in [AIP-160](https://google.aip.dev/160). When `null`, the `machine_filter` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name of the node pool.\n  - `node_count` (`number`): The number of nodes in the pool.\n  - `node_location` (`string`): Name of the Google Distributed Cloud Edge zone where this node pool will be created. For example: \u0026#39;us-central1-edge-customer-a\u0026#39;.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `local_disk_encryption` (`list[obj]`): Local disk encryption options. This field is only used when enabling CMEK support. When `null`, the `local_disk_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_node_pool.local_disk_encryption.new](#fn-local_disk_encryptionnew) constructor.\n  - `node_config` (`list[obj]`): Configuration for each node in the NodePool When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_node_pool.node_config.new](#fn-node_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_node_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    cluster,
+    location,
+    name,
+    node_count,
+    node_location,
+    labels=null,
+    local_disk_encryption=null,
+    machine_filter=null,
+    node_config=null,
+    project=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_edgecontainer_node_pool',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      cluster=cluster,
+      labels=labels,
+      local_disk_encryption=local_disk_encryption,
+      location=location,
+      machine_filter=machine_filter,
+      name=name,
+      node_config=node_config,
+      node_count=node_count,
+      node_location=node_location,
+      project=project,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.edgecontainer_node_pool.newAttrs` constructs a new object with attributes and blocks configured for the `edgecontainer_node_pool`\nTerraform resource.\n\nUnlike [google.edgecontainer_node_pool.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `cluster` (`string`): The name of the target Distributed Cloud Edge Cluster.\n  - `labels` (`obj`): Labels associated with this resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the resource.\n  - `machine_filter` (`string`): Only machines matching this filter will be allowed to join the node pool.\nThe filtering language accepts strings like "name=<name>", and is\ndocumented in more detail in [AIP-160](https://google.aip.dev/160). When `null`, the `machine_filter` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name of the node pool.\n  - `node_count` (`number`): The number of nodes in the pool.\n  - `node_location` (`string`): Name of the Google Distributed Cloud Edge zone where this node pool will be created. For example: 'us-central1-edge-customer-a'.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `local_disk_encryption` (`list[obj]`): Local disk encryption options. This field is only used when enabling CMEK support. When `null`, the `local_disk_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_node_pool.local_disk_encryption.new](#fn-local_disk_encryptionnew) constructor.\n  - `node_config` (`list[obj]`): Configuration for each node in the NodePool When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_node_pool.node_config.new](#fn-node_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_node_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `edgecontainer_node_pool` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    cluster,
+    location,
+    name,
+    node_count,
+    node_location,
+    labels=null,
+    local_disk_encryption=null,
+    machine_filter=null,
+    node_config=null,
+    project=null,
+    timeouts=null
+  ):: std.prune(a={
+    cluster: cluster,
+    labels: labels,
+    local_disk_encryption: local_disk_encryption,
+    location: location,
+    machine_filter: machine_filter,
+    name: name,
+    node_config: node_config,
+    node_count: node_count,
+    node_location: node_location,
+    project: project,
+    timeouts: timeouts,
+  }),
+  node_config:: {
+    '#new':: d.fn(help='\n`google.edgecontainer_node_pool.node_config.new` constructs a new object with attributes and blocks configured for the `node_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `labels` (`obj`): "The Kubernetes node labels" When `null`, the `labels` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `node_config` sub block.\n', args=[]),
+    new(
+      labels=null
+    ):: std.prune(a={
+      labels: labels,
+    }),
+  },
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.edgecontainer_node_pool.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withCluster':: d.fn(help='`google.string.withCluster` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the cluster field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `cluster` field.\n', args=[]),
+  withCluster(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_node_pool+: {
+        [resourceLabel]+: {
+          cluster: value,
+        },
+      },
+    },
+  },
+  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
+  withLabels(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_node_pool+: {
+        [resourceLabel]+: {
+          labels: value,
+        },
+      },
+    },
+  },
+  '#withLocalDiskEncryption':: d.fn(help='`google.list[obj].withLocalDiskEncryption` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the local_disk_encryption field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withLocalDiskEncryptionMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `local_disk_encryption` field.\n', args=[]),
+  withLocalDiskEncryption(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_node_pool+: {
+        [resourceLabel]+: {
+          local_disk_encryption: value,
+        },
+      },
+    },
+  },
+  '#withLocalDiskEncryptionMixin':: d.fn(help='`google.list[obj].withLocalDiskEncryptionMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the local_disk_encryption field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withLocalDiskEncryption](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `local_disk_encryption` field.\n', args=[]),
+  withLocalDiskEncryptionMixin(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_node_pool+: {
+        [resourceLabel]+: {
+          local_disk_encryption+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_node_pool+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withMachineFilter':: d.fn(help='`google.string.withMachineFilter` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the machine_filter field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `machine_filter` field.\n', args=[]),
+  withMachineFilter(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_node_pool+: {
+        [resourceLabel]+: {
+          machine_filter: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_node_pool+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withNodeConfig':: d.fn(help='`google.list[obj].withNodeConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the node_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withNodeConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `node_config` field.\n', args=[]),
+  withNodeConfig(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_node_pool+: {
+        [resourceLabel]+: {
+          node_config: value,
+        },
+      },
+    },
+  },
+  '#withNodeConfigMixin':: d.fn(help='`google.list[obj].withNodeConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the node_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withNodeConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `node_config` field.\n', args=[]),
+  withNodeConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_node_pool+: {
+        [resourceLabel]+: {
+          node_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withNodeCount':: d.fn(help='`google.number.withNodeCount` constructs a mixin object that can be merged into the `number`\nTerraform resource block to set or update the node_count field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`number`): The value to set for the `node_count` field.\n', args=[]),
+  withNodeCount(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_node_pool+: {
+        [resourceLabel]+: {
+          node_count: value,
+        },
+      },
+    },
+  },
+  '#withNodeLocation':: d.fn(help='`google.string.withNodeLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the node_location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `node_location` field.\n', args=[]),
+  withNodeLocation(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_node_pool+: {
+        [resourceLabel]+: {
+          node_location: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_node_pool+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_node_pool+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_node_pool+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/edgecontainer_vpn_connection.libsonnet b/4.x/_gen/resources/edgecontainer_vpn_connection.libsonnet
new file mode 100644
index 00000000..b48b2738
--- /dev/null
+++ b/4.x/_gen/resources/edgecontainer_vpn_connection.libsonnet
@@ -0,0 +1,214 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='edgecontainer_vpn_connection', url='', help='`edgecontainer_vpn_connection` represents the `google_edgecontainer_vpn_connection` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.edgecontainer_vpn_connection.new` injects a new `google_edgecontainer_vpn_connection` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.edgecontainer_vpn_connection.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.edgecontainer_vpn_connection` using the reference:\n\n    $._ref.google_edgecontainer_vpn_connection.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_edgecontainer_vpn_connection.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `cluster` (`string`): The canonical Cluster name to connect to. It is in the form of projects/{project}/locations/{location}/clusters/{cluster}.\n  - `enable_high_availability` (`bool`): Whether this VPN connection has HA enabled on cluster side. If enabled, when creating VPN connection we will attempt to use 2 ANG floating IPs. When `null`, the `enable_high_availability` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels associated with this resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Google Cloud Platform location.\n  - `name` (`string`): The resource name of VPN connection\n  - `nat_gateway_ip` (`string`): NAT gateway IP, or WAN IP address. If a customer has multiple NAT IPs, the customer needs to configure NAT such that only one external IP maps to the GMEC Anthos cluster.\nThis is empty if NAT is not used. When `null`, the `nat_gateway_ip` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `router` (`string`): The VPN connection Cloud Router name. When `null`, the `router` field will be omitted from the resulting object.\n  - `vpc` (`string`): The network ID of VPC to connect to. When `null`, the `vpc` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_vpn_connection.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vpc_project` (`list[obj]`): Project detail of the VPC network. Required if VPC is in a different project than the cluster project. When `null`, the `vpc_project` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_vpn_connection.vpc_project.new](#fn-vpc_projectnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    cluster,
+    location,
+    name,
+    enable_high_availability=null,
+    labels=null,
+    nat_gateway_ip=null,
+    project=null,
+    router=null,
+    timeouts=null,
+    vpc=null,
+    vpc_project=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_edgecontainer_vpn_connection',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      cluster=cluster,
+      enable_high_availability=enable_high_availability,
+      labels=labels,
+      location=location,
+      name=name,
+      nat_gateway_ip=nat_gateway_ip,
+      project=project,
+      router=router,
+      timeouts=timeouts,
+      vpc=vpc,
+      vpc_project=vpc_project
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.edgecontainer_vpn_connection.newAttrs` constructs a new object with attributes and blocks configured for the `edgecontainer_vpn_connection`\nTerraform resource.\n\nUnlike [google.edgecontainer_vpn_connection.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `cluster` (`string`): The canonical Cluster name to connect to. It is in the form of projects/{project}/locations/{location}/clusters/{cluster}.\n  - `enable_high_availability` (`bool`): Whether this VPN connection has HA enabled on cluster side. If enabled, when creating VPN connection we will attempt to use 2 ANG floating IPs. When `null`, the `enable_high_availability` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels associated with this resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Google Cloud Platform location.\n  - `name` (`string`): The resource name of VPN connection\n  - `nat_gateway_ip` (`string`): NAT gateway IP, or WAN IP address. If a customer has multiple NAT IPs, the customer needs to configure NAT such that only one external IP maps to the GMEC Anthos cluster.\nThis is empty if NAT is not used. When `null`, the `nat_gateway_ip` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `router` (`string`): The VPN connection Cloud Router name. When `null`, the `router` field will be omitted from the resulting object.\n  - `vpc` (`string`): The network ID of VPC to connect to. When `null`, the `vpc` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_vpn_connection.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vpc_project` (`list[obj]`): Project detail of the VPC network. Required if VPC is in a different project than the cluster project. When `null`, the `vpc_project` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_vpn_connection.vpc_project.new](#fn-vpc_projectnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `edgecontainer_vpn_connection` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    cluster,
+    location,
+    name,
+    enable_high_availability=null,
+    labels=null,
+    nat_gateway_ip=null,
+    project=null,
+    router=null,
+    timeouts=null,
+    vpc=null,
+    vpc_project=null
+  ):: std.prune(a={
+    cluster: cluster,
+    enable_high_availability: enable_high_availability,
+    labels: labels,
+    location: location,
+    name: name,
+    nat_gateway_ip: nat_gateway_ip,
+    project: project,
+    router: router,
+    timeouts: timeouts,
+    vpc: vpc,
+    vpc_project: vpc_project,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.edgecontainer_vpn_connection.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  vpc_project:: {
+    '#new':: d.fn(help='\n`google.edgecontainer_vpn_connection.vpc_project.new` constructs a new object with attributes and blocks configured for the `vpc_project`\nTerraform sub block.\n\n\n\n**Args**:\n  - `project_id` (`string`): The project of the VPC to connect to. If not specified, it is the same as the cluster project. When `null`, the `project_id` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `vpc_project` sub block.\n', args=[]),
+    new(
+      project_id=null
+    ):: std.prune(a={
+      project_id: project_id,
+    }),
+  },
+  '#withCluster':: d.fn(help='`google.string.withCluster` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the cluster field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `cluster` field.\n', args=[]),
+  withCluster(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_vpn_connection+: {
+        [resourceLabel]+: {
+          cluster: value,
+        },
+      },
+    },
+  },
+  '#withEnableHighAvailability':: d.fn(help='`google.bool.withEnableHighAvailability` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the enable_high_availability field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `enable_high_availability` field.\n', args=[]),
+  withEnableHighAvailability(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_vpn_connection+: {
+        [resourceLabel]+: {
+          enable_high_availability: value,
+        },
+      },
+    },
+  },
+  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
+  withLabels(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_vpn_connection+: {
+        [resourceLabel]+: {
+          labels: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_vpn_connection+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_vpn_connection+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withNatGatewayIp':: d.fn(help='`google.string.withNatGatewayIp` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the nat_gateway_ip field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `nat_gateway_ip` field.\n', args=[]),
+  withNatGatewayIp(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_vpn_connection+: {
+        [resourceLabel]+: {
+          nat_gateway_ip: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_vpn_connection+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withRouter':: d.fn(help='`google.string.withRouter` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the router field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `router` field.\n', args=[]),
+  withRouter(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_vpn_connection+: {
+        [resourceLabel]+: {
+          router: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_vpn_connection+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_vpn_connection+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+  '#withVpc':: d.fn(help='`google.string.withVpc` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the vpc field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `vpc` field.\n', args=[]),
+  withVpc(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_vpn_connection+: {
+        [resourceLabel]+: {
+          vpc: value,
+        },
+      },
+    },
+  },
+  '#withVpcProject':: d.fn(help='`google.list[obj].withVpcProject` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the vpc_project field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withVpcProjectMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `vpc_project` field.\n', args=[]),
+  withVpcProject(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_vpn_connection+: {
+        [resourceLabel]+: {
+          vpc_project: value,
+        },
+      },
+    },
+  },
+  '#withVpcProjectMixin':: d.fn(help='`google.list[obj].withVpcProjectMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the vpc_project field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withVpcProject](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `vpc_project` field.\n', args=[]),
+  withVpcProjectMixin(resourceLabel, value): {
+    resource+: {
+      google_edgecontainer_vpn_connection+: {
+        [resourceLabel]+: {
+          vpc_project+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/eventarc_trigger.libsonnet b/4.x/_gen/resources/eventarc_trigger.libsonnet
index 261d645b..5876cfdd 100644
--- a/4.x/_gen/resources/eventarc_trigger.libsonnet
+++ b/4.x/_gen/resources/eventarc_trigger.libsonnet
@@ -56,7 +56,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       value: value,
     }),
   },
-  '#new':: d.fn(help="\n`google.eventarc_trigger.new` injects a new `google_eventarc_trigger` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.eventarc_trigger.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.eventarc_trigger` using the reference:\n\n    $._ref.google_eventarc_trigger.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_eventarc_trigger.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `channel` (`string`): Optional. The name of the channel associated with the trigger in `projects/{project}/locations/{location}/channels/{channel}` format. You must provide a channel to receive events from Eventarc SaaS partners. When `null`, the `channel` field will be omitted from the resulting object.\n  - `event_data_content_type` (`string`): Optional. EventDataContentType specifies the type of payload in MIME format that is expected from the CloudEvent data field. This is set to `application/json` if the value is not defined. When `null`, the `event_data_content_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. User labels attached to the triggers that can be used to group resources. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Required. The resource name of the trigger. Must be unique within the location on the project.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `service_account` (`string`): Optional. The IAM service account email associated with the trigger. The service account represents the identity of the trigger. The principal who calls this API must have `iam.serviceAccounts.actAs` permission in the service account. See https://cloud.google.com/iam/docs/understanding-service-accounts#sa_common for more information. For Cloud Run destinations, this service account is used to generate identity tokens when invoking the service. See https://cloud.google.com/run/docs/triggering/pubsub-push#create-service-account for information on how to invoke authenticated Cloud Run services. In order to create Audit Log triggers, the service account should also have `roles/eventarc.eventReceiver` IAM role. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `destination` (`list[obj]`): Required. Destination specifies where the events should be sent to. When `null`, the `destination` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.destination.new](#fn-destinationnew) constructor.\n  - `matching_criteria` (`list[obj]`): Required. null The list of filters that applies to event attributes. Only events that match all the provided filters will be sent to the destination. When `null`, the `matching_criteria` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.matching_criteria.new](#fn-matching_criterianew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.timeouts.new](#fn-timeoutsnew) constructor.\n  - `transport` (`list[obj]`): Optional. In order to deliver messages, Eventarc may use other GCP products as transport intermediary. This field contains a reference to that transport intermediary. This information can be used for debugging purposes. When `null`, the `transport` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.transport.new](#fn-transportnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.eventarc_trigger.new` injects a new `google_eventarc_trigger` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.eventarc_trigger.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.eventarc_trigger` using the reference:\n\n    $._ref.google_eventarc_trigger.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_eventarc_trigger.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `channel` (`string`): Optional. The name of the channel associated with the trigger in `projects/{project}/locations/{location}/channels/{channel}` format. You must provide a channel to receive events from Eventarc SaaS partners. When `null`, the `channel` field will be omitted from the resulting object.\n  - `event_data_content_type` (`string`): Optional. EventDataContentType specifies the type of payload in MIME format that is expected from the CloudEvent data field. This is set to `application/json` if the value is not defined. When `null`, the `event_data_content_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. User labels attached to the triggers that can be used to group resources.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Required. The resource name of the trigger. Must be unique within the location on the project.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `service_account` (`string`): Optional. The IAM service account email associated with the trigger. The service account represents the identity of the trigger. The principal who calls this API must have `iam.serviceAccounts.actAs` permission in the service account. See https://cloud.google.com/iam/docs/understanding-service-accounts#sa_common for more information. For Cloud Run destinations, this service account is used to generate identity tokens when invoking the service. See https://cloud.google.com/run/docs/triggering/pubsub-push#create-service-account for information on how to invoke authenticated Cloud Run services. In order to create Audit Log triggers, the service account should also have `roles/eventarc.eventReceiver` IAM role. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `destination` (`list[obj]`): Required. Destination specifies where the events should be sent to. When `null`, the `destination` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.destination.new](#fn-destinationnew) constructor.\n  - `matching_criteria` (`list[obj]`): Required. null The list of filters that applies to event attributes. Only events that match all the provided filters will be sent to the destination. When `null`, the `matching_criteria` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.matching_criteria.new](#fn-matching_criterianew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.timeouts.new](#fn-timeoutsnew) constructor.\n  - `transport` (`list[obj]`): Optional. In order to deliver messages, Eventarc may use other GCP products as transport intermediary. This field contains a reference to that transport intermediary. This information can be used for debugging purposes. When `null`, the `transport` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.transport.new](#fn-transportnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -89,7 +89,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.eventarc_trigger.newAttrs` constructs a new object with attributes and blocks configured for the `eventarc_trigger`\nTerraform resource.\n\nUnlike [google.eventarc_trigger.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `channel` (`string`): Optional. The name of the channel associated with the trigger in `projects/{project}/locations/{location}/channels/{channel}` format. You must provide a channel to receive events from Eventarc SaaS partners. When `null`, the `channel` field will be omitted from the resulting object.\n  - `event_data_content_type` (`string`): Optional. EventDataContentType specifies the type of payload in MIME format that is expected from the CloudEvent data field. This is set to `application/json` if the value is not defined. When `null`, the `event_data_content_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. User labels attached to the triggers that can be used to group resources. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Required. The resource name of the trigger. Must be unique within the location on the project.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `service_account` (`string`): Optional. The IAM service account email associated with the trigger. The service account represents the identity of the trigger. The principal who calls this API must have `iam.serviceAccounts.actAs` permission in the service account. See https://cloud.google.com/iam/docs/understanding-service-accounts#sa_common for more information. For Cloud Run destinations, this service account is used to generate identity tokens when invoking the service. See https://cloud.google.com/run/docs/triggering/pubsub-push#create-service-account for information on how to invoke authenticated Cloud Run services. In order to create Audit Log triggers, the service account should also have `roles/eventarc.eventReceiver` IAM role. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `destination` (`list[obj]`): Required. Destination specifies where the events should be sent to. When `null`, the `destination` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.destination.new](#fn-destinationnew) constructor.\n  - `matching_criteria` (`list[obj]`): Required. null The list of filters that applies to event attributes. Only events that match all the provided filters will be sent to the destination. When `null`, the `matching_criteria` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.matching_criteria.new](#fn-matching_criterianew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.timeouts.new](#fn-timeoutsnew) constructor.\n  - `transport` (`list[obj]`): Optional. In order to deliver messages, Eventarc may use other GCP products as transport intermediary. This field contains a reference to that transport intermediary. This information can be used for debugging purposes. When `null`, the `transport` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.transport.new](#fn-transportnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `eventarc_trigger` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.eventarc_trigger.newAttrs` constructs a new object with attributes and blocks configured for the `eventarc_trigger`\nTerraform resource.\n\nUnlike [google.eventarc_trigger.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `channel` (`string`): Optional. The name of the channel associated with the trigger in `projects/{project}/locations/{location}/channels/{channel}` format. You must provide a channel to receive events from Eventarc SaaS partners. When `null`, the `channel` field will be omitted from the resulting object.\n  - `event_data_content_type` (`string`): Optional. EventDataContentType specifies the type of payload in MIME format that is expected from the CloudEvent data field. This is set to `application/json` if the value is not defined. When `null`, the `event_data_content_type` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. User labels attached to the triggers that can be used to group resources.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Required. The resource name of the trigger. Must be unique within the location on the project.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `service_account` (`string`): Optional. The IAM service account email associated with the trigger. The service account represents the identity of the trigger. The principal who calls this API must have `iam.serviceAccounts.actAs` permission in the service account. See https://cloud.google.com/iam/docs/understanding-service-accounts#sa_common for more information. For Cloud Run destinations, this service account is used to generate identity tokens when invoking the service. See https://cloud.google.com/run/docs/triggering/pubsub-push#create-service-account for information on how to invoke authenticated Cloud Run services. In order to create Audit Log triggers, the service account should also have `roles/eventarc.eventReceiver` IAM role. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `destination` (`list[obj]`): Required. Destination specifies where the events should be sent to. When `null`, the `destination` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.destination.new](#fn-destinationnew) constructor.\n  - `matching_criteria` (`list[obj]`): Required. null The list of filters that applies to event attributes. Only events that match all the provided filters will be sent to the destination. When `null`, the `matching_criteria` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.matching_criteria.new](#fn-matching_criterianew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.timeouts.new](#fn-timeoutsnew) constructor.\n  - `transport` (`list[obj]`): Optional. In order to deliver messages, Eventarc may use other GCP products as transport intermediary. This field contains a reference to that transport intermediary. This information can be used for debugging purposes. When `null`, the `transport` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.eventarc_trigger.transport.new](#fn-transportnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `eventarc_trigger` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     name,
diff --git a/4.x/_gen/resources/filestore_backup.libsonnet b/4.x/_gen/resources/filestore_backup.libsonnet
index 2aebde10..8339c250 100644
--- a/4.x/_gen/resources/filestore_backup.libsonnet
+++ b/4.x/_gen/resources/filestore_backup.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='filestore_backup', url='', help='`filestore_backup` represents the `google_filestore_backup` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.filestore_backup.new` injects a new `google_filestore_backup` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.filestore_backup.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.filestore_backup` using the reference:\n\n    $._ref.google_filestore_backup.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_filestore_backup.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A description of the backup with 2048 characters or less. Requests with longer descriptions will be rejected. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances.\n  - `name` (`string`): The resource name of the backup. The name must be unique within the specified instance.\n\nThe name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `source_file_share` (`string`): Name of the file share in the source Cloud Filestore instance that the backup is created from.\n  - `source_instance` (`string`): The resource name of the source Cloud Filestore instance, in the format projects/{projectId}/locations/{locationId}/instances/{instanceId}, used to create this backup.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_backup.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.filestore_backup.new` injects a new `google_filestore_backup` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.filestore_backup.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.filestore_backup` using the reference:\n\n    $._ref.google_filestore_backup.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_filestore_backup.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A description of the backup with 2048 characters or less. Requests with longer descriptions will be rejected. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances.\n  - `name` (`string`): The resource name of the backup. The name must be unique within the specified instance.\n\nThe name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `source_file_share` (`string`): Name of the file share in the source Cloud Filestore instance that the backup is created from.\n  - `source_instance` (`string`): The resource name of the source Cloud Filestore instance, in the format projects/{projectId}/locations/{locationId}/instances/{instanceId}, used to create this backup.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_backup.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -29,7 +29,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.filestore_backup.newAttrs` constructs a new object with attributes and blocks configured for the `filestore_backup`\nTerraform resource.\n\nUnlike [google.filestore_backup.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A description of the backup with 2048 characters or less. Requests with longer descriptions will be rejected. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances.\n  - `name` (`string`): The resource name of the backup. The name must be unique within the specified instance.\n\nThe name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `source_file_share` (`string`): Name of the file share in the source Cloud Filestore instance that the backup is created from.\n  - `source_instance` (`string`): The resource name of the source Cloud Filestore instance, in the format projects/{projectId}/locations/{locationId}/instances/{instanceId}, used to create this backup.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_backup.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `filestore_backup` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.filestore_backup.newAttrs` constructs a new object with attributes and blocks configured for the `filestore_backup`\nTerraform resource.\n\nUnlike [google.filestore_backup.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A description of the backup with 2048 characters or less. Requests with longer descriptions will be rejected. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances.\n  - `name` (`string`): The resource name of the backup. The name must be unique within the specified instance.\n\nThe name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `source_file_share` (`string`): Name of the file share in the source Cloud Filestore instance that the backup is created from.\n  - `source_instance` (`string`): The resource name of the source Cloud Filestore instance, in the format projects/{projectId}/locations/{locationId}/instances/{instanceId}, used to create this backup.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_backup.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `filestore_backup` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     name,
diff --git a/4.x/_gen/resources/filestore_instance.libsonnet b/4.x/_gen/resources/filestore_instance.libsonnet
index aa91134d..801d79fb 100644
--- a/4.x/_gen/resources/filestore_instance.libsonnet
+++ b/4.x/_gen/resources/filestore_instance.libsonnet
@@ -44,7 +44,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       reserved_ip_range: reserved_ip_range,
     }),
   },
-  '#new':: d.fn(help="\n`google.filestore_instance.new` injects a new `google_filestore_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.filestore_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.filestore_instance` using the reference:\n\n    $._ref.google_filestore_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_filestore_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A description of the instance. When `null`, the `description` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): KMS key name used for data encryption. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name of the instance.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `tier` (`string`): The service tier of the instance.\nPossible values include: STANDARD, PREMIUM, BASIC_HDD, BASIC_SSD, HIGH_SCALE_SSD, ZONAL and ENTERPRISE\n  - `zone` (`string`): The name of the Filestore zone of the instance. When `null`, the `zone` field will be omitted from the resulting object.\n  - `file_shares` (`list[obj]`): File system shares on the instance. For this version, only a\nsingle file share is supported. When `null`, the `file_shares` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_instance.file_shares.new](#fn-file_sharesnew) constructor.\n  - `networks` (`list[obj]`): VPC networks to which the instance is connected. For this version,\nonly a single network is supported. When `null`, the `networks` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_instance.networks.new](#fn-networksnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.filestore_instance.new` injects a new `google_filestore_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.filestore_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.filestore_instance` using the reference:\n\n    $._ref.google_filestore_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_filestore_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A description of the instance. When `null`, the `description` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): KMS key name used for data encryption. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name of the instance.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `tier` (`string`): The service tier of the instance.\nPossible values include: STANDARD, PREMIUM, BASIC_HDD, BASIC_SSD, HIGH_SCALE_SSD, ZONAL and ENTERPRISE\n  - `zone` (`string`): The name of the Filestore zone of the instance. When `null`, the `zone` field will be omitted from the resulting object.\n  - `file_shares` (`list[obj]`): File system shares on the instance. For this version, only a\nsingle file share is supported. When `null`, the `file_shares` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_instance.file_shares.new](#fn-file_sharesnew) constructor.\n  - `networks` (`list[obj]`): VPC networks to which the instance is connected. For this version,\nonly a single network is supported. When `null`, the `networks` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_instance.networks.new](#fn-networksnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -77,7 +77,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.filestore_instance.newAttrs` constructs a new object with attributes and blocks configured for the `filestore_instance`\nTerraform resource.\n\nUnlike [google.filestore_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A description of the instance. When `null`, the `description` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): KMS key name used for data encryption. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name of the instance.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `tier` (`string`): The service tier of the instance.\nPossible values include: STANDARD, PREMIUM, BASIC_HDD, BASIC_SSD, HIGH_SCALE_SSD, ZONAL and ENTERPRISE\n  - `zone` (`string`): The name of the Filestore zone of the instance. When `null`, the `zone` field will be omitted from the resulting object.\n  - `file_shares` (`list[obj]`): File system shares on the instance. For this version, only a\nsingle file share is supported. When `null`, the `file_shares` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_instance.file_shares.new](#fn-file_sharesnew) constructor.\n  - `networks` (`list[obj]`): VPC networks to which the instance is connected. For this version,\nonly a single network is supported. When `null`, the `networks` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_instance.networks.new](#fn-networksnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `filestore_instance` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.filestore_instance.newAttrs` constructs a new object with attributes and blocks configured for the `filestore_instance`\nTerraform resource.\n\nUnlike [google.filestore_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A description of the instance. When `null`, the `description` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): KMS key name used for data encryption. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name of the instance.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `tier` (`string`): The service tier of the instance.\nPossible values include: STANDARD, PREMIUM, BASIC_HDD, BASIC_SSD, HIGH_SCALE_SSD, ZONAL and ENTERPRISE\n  - `zone` (`string`): The name of the Filestore zone of the instance. When `null`, the `zone` field will be omitted from the resulting object.\n  - `file_shares` (`list[obj]`): File system shares on the instance. For this version, only a\nsingle file share is supported. When `null`, the `file_shares` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_instance.file_shares.new](#fn-file_sharesnew) constructor.\n  - `networks` (`list[obj]`): VPC networks to which the instance is connected. For this version,\nonly a single network is supported. When `null`, the `networks` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_instance.networks.new](#fn-networksnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `filestore_instance` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     tier,
diff --git a/4.x/_gen/resources/filestore_snapshot.libsonnet b/4.x/_gen/resources/filestore_snapshot.libsonnet
index 65025e34..b8fb7111 100644
--- a/4.x/_gen/resources/filestore_snapshot.libsonnet
+++ b/4.x/_gen/resources/filestore_snapshot.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='filestore_snapshot', url='', help='`filestore_snapshot` represents the `google_filestore_snapshot` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.filestore_snapshot.new` injects a new `google_filestore_snapshot` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.filestore_snapshot.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.filestore_snapshot` using the reference:\n\n    $._ref.google_filestore_snapshot.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_filestore_snapshot.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A description of the snapshot with 2048 characters or less. Requests with longer descriptions will be rejected. When `null`, the `description` field will be omitted from the resulting object.\n  - `instance` (`string`): The resource name of the filestore instance.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances.\n  - `name` (`string`): The resource name of the snapshot. The name must be unique within the specified instance.\n\nThe name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_snapshot.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.filestore_snapshot.new` injects a new `google_filestore_snapshot` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.filestore_snapshot.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.filestore_snapshot` using the reference:\n\n    $._ref.google_filestore_snapshot.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_filestore_snapshot.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A description of the snapshot with 2048 characters or less. Requests with longer descriptions will be rejected. When `null`, the `description` field will be omitted from the resulting object.\n  - `instance` (`string`): The resource name of the filestore instance.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances.\n  - `name` (`string`): The resource name of the snapshot. The name must be unique within the specified instance.\n\nThe name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression \u0026#39;[a-z]([-a-z0-9]*[a-z0-9])?\u0026#39; which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_snapshot.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     instance,
@@ -27,7 +27,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.filestore_snapshot.newAttrs` constructs a new object with attributes and blocks configured for the `filestore_snapshot`\nTerraform resource.\n\nUnlike [google.filestore_snapshot.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A description of the snapshot with 2048 characters or less. Requests with longer descriptions will be rejected. When `null`, the `description` field will be omitted from the resulting object.\n  - `instance` (`string`): The resource name of the filestore instance.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances.\n  - `name` (`string`): The resource name of the snapshot. The name must be unique within the specified instance.\n\nThe name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_snapshot.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `filestore_snapshot` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.filestore_snapshot.newAttrs` constructs a new object with attributes and blocks configured for the `filestore_snapshot`\nTerraform resource.\n\nUnlike [google.filestore_snapshot.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A description of the snapshot with 2048 characters or less. Requests with longer descriptions will be rejected. When `null`, the `description` field will be omitted from the resulting object.\n  - `instance` (`string`): The resource name of the filestore instance.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances.\n  - `name` (`string`): The resource name of the snapshot. The name must be unique within the specified instance.\n\nThe name must be 1-63 characters long, and comply with\nRFC1035. Specifically, the name must be 1-63 characters long and match\nthe regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the\nfirst character must be a lowercase letter, and all following\ncharacters must be a dash, lowercase letter, or digit, except the last\ncharacter, which cannot be a dash.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.filestore_snapshot.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `filestore_snapshot` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     instance,
     location,
diff --git a/4.x/_gen/resources/firebaserules_release.libsonnet b/4.x/_gen/resources/firebaserules_release.libsonnet
index d5605b00..16a8b78e 100644
--- a/4.x/_gen/resources/firebaserules_release.libsonnet
+++ b/4.x/_gen/resources/firebaserules_release.libsonnet
@@ -34,15 +34,13 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     timeouts: timeouts,
   }),
   timeouts:: {
-    '#new':: d.fn(help='\n`google.firebaserules_release.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.firebaserules_release.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
     new(
       create=null,
-      delete=null,
-      update=null
+      delete=null
     ):: std.prune(a={
       create: create,
       delete: delete,
-      update: update,
     }),
   },
   '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
diff --git a/4.x/_gen/resources/firestore_backup_schedule.libsonnet b/4.x/_gen/resources/firestore_backup_schedule.libsonnet
new file mode 100644
index 00000000..f36f384d
--- /dev/null
+++ b/4.x/_gen/resources/firestore_backup_schedule.libsonnet
@@ -0,0 +1,160 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='firestore_backup_schedule', url='', help='`firestore_backup_schedule` represents the `google_firestore_backup_schedule` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  daily_recurrence:: {
+    '#new':: d.fn(help='\n`google.firestore_backup_schedule.daily_recurrence.new` constructs a new object with attributes and blocks configured for the `daily_recurrence`\nTerraform sub block.\n\n\n\n**Returns**:\n  - An attribute object that represents the `daily_recurrence` sub block.\n', args=[]),
+    new(
+
+    ):: std.prune(a={}),
+  },
+  '#new':: d.fn(help="\n`google.firestore_backup_schedule.new` injects a new `google_firestore_backup_schedule` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.firestore_backup_schedule.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.firestore_backup_schedule` using the reference:\n\n    $._ref.google_firestore_backup_schedule.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_firestore_backup_schedule.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `database` (`string`): The Firestore database id. Defaults to \u0026#39;\u0026#34;(default)\u0026#34;\u0026#39;. When `null`, the `database` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `retention` (`string`): At what relative time in the future, compared to its creation time, the backup should be deleted, e.g. keep backups for 7 days.\nA duration in seconds with up to nine fractional digits, ending with \u0026#39;s\u0026#39;. Example: \u0026#34;3.5s\u0026#34;.\n\nFor a daily backup recurrence, set this to a value up to 7 days. If you set a weekly backup recurrence, set this to a value up to 14 weeks.\n  - `daily_recurrence` (`list[obj]`): For a schedule that runs daily at a specified time. When `null`, the `daily_recurrence` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_backup_schedule.daily_recurrence.new](#fn-daily_recurrencenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_backup_schedule.timeouts.new](#fn-timeoutsnew) constructor.\n  - `weekly_recurrence` (`list[obj]`): For a schedule that runs weekly on a specific day and time. When `null`, the `weekly_recurrence` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_backup_schedule.weekly_recurrence.new](#fn-weekly_recurrencenew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    retention,
+    daily_recurrence=null,
+    database=null,
+    project=null,
+    timeouts=null,
+    weekly_recurrence=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_firestore_backup_schedule',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      daily_recurrence=daily_recurrence,
+      database=database,
+      project=project,
+      retention=retention,
+      timeouts=timeouts,
+      weekly_recurrence=weekly_recurrence
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.firestore_backup_schedule.newAttrs` constructs a new object with attributes and blocks configured for the `firestore_backup_schedule`\nTerraform resource.\n\nUnlike [google.firestore_backup_schedule.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `database` (`string`): The Firestore database id. Defaults to '"(default)"'. When `null`, the `database` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `retention` (`string`): At what relative time in the future, compared to its creation time, the backup should be deleted, e.g. keep backups for 7 days.\nA duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".\n\nFor a daily backup recurrence, set this to a value up to 7 days. If you set a weekly backup recurrence, set this to a value up to 14 weeks.\n  - `daily_recurrence` (`list[obj]`): For a schedule that runs daily at a specified time. When `null`, the `daily_recurrence` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_backup_schedule.daily_recurrence.new](#fn-daily_recurrencenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_backup_schedule.timeouts.new](#fn-timeoutsnew) constructor.\n  - `weekly_recurrence` (`list[obj]`): For a schedule that runs weekly on a specific day and time. When `null`, the `weekly_recurrence` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_backup_schedule.weekly_recurrence.new](#fn-weekly_recurrencenew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `firestore_backup_schedule` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    retention,
+    daily_recurrence=null,
+    database=null,
+    project=null,
+    timeouts=null,
+    weekly_recurrence=null
+  ):: std.prune(a={
+    daily_recurrence: daily_recurrence,
+    database: database,
+    project: project,
+    retention: retention,
+    timeouts: timeouts,
+    weekly_recurrence: weekly_recurrence,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.firestore_backup_schedule.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  weekly_recurrence:: {
+    '#new':: d.fn(help='\n`google.firestore_backup_schedule.weekly_recurrence.new` constructs a new object with attributes and blocks configured for the `weekly_recurrence`\nTerraform sub block.\n\n\n\n**Args**:\n  - `day` (`string`): The day of week to run. Possible values: ["DAY_OF_WEEK_UNSPECIFIED", "MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY", "SUNDAY"] When `null`, the `day` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `weekly_recurrence` sub block.\n', args=[]),
+    new(
+      day=null
+    ):: std.prune(a={
+      day: day,
+    }),
+  },
+  '#withDailyRecurrence':: d.fn(help='`google.list[obj].withDailyRecurrence` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the daily_recurrence field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withDailyRecurrenceMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `daily_recurrence` field.\n', args=[]),
+  withDailyRecurrence(resourceLabel, value): {
+    resource+: {
+      google_firestore_backup_schedule+: {
+        [resourceLabel]+: {
+          daily_recurrence: value,
+        },
+      },
+    },
+  },
+  '#withDailyRecurrenceMixin':: d.fn(help='`google.list[obj].withDailyRecurrenceMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the daily_recurrence field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withDailyRecurrence](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `daily_recurrence` field.\n', args=[]),
+  withDailyRecurrenceMixin(resourceLabel, value): {
+    resource+: {
+      google_firestore_backup_schedule+: {
+        [resourceLabel]+: {
+          daily_recurrence+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withDatabase':: d.fn(help='`google.string.withDatabase` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the database field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `database` field.\n', args=[]),
+  withDatabase(resourceLabel, value): {
+    resource+: {
+      google_firestore_backup_schedule+: {
+        [resourceLabel]+: {
+          database: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_firestore_backup_schedule+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withRetention':: d.fn(help='`google.string.withRetention` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the retention field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `retention` field.\n', args=[]),
+  withRetention(resourceLabel, value): {
+    resource+: {
+      google_firestore_backup_schedule+: {
+        [resourceLabel]+: {
+          retention: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_firestore_backup_schedule+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_firestore_backup_schedule+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+  '#withWeeklyRecurrence':: d.fn(help='`google.list[obj].withWeeklyRecurrence` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the weekly_recurrence field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withWeeklyRecurrenceMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `weekly_recurrence` field.\n', args=[]),
+  withWeeklyRecurrence(resourceLabel, value): {
+    resource+: {
+      google_firestore_backup_schedule+: {
+        [resourceLabel]+: {
+          weekly_recurrence: value,
+        },
+      },
+    },
+  },
+  '#withWeeklyRecurrenceMixin':: d.fn(help='`google.list[obj].withWeeklyRecurrenceMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the weekly_recurrence field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withWeeklyRecurrence](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `weekly_recurrence` field.\n', args=[]),
+  withWeeklyRecurrenceMixin(resourceLabel, value): {
+    resource+: {
+      google_firestore_backup_schedule+: {
+        [resourceLabel]+: {
+          weekly_recurrence+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/firestore_field.libsonnet b/4.x/_gen/resources/firestore_field.libsonnet
index 312406b3..678c23bb 100644
--- a/4.x/_gen/resources/firestore_field.libsonnet
+++ b/4.x/_gen/resources/firestore_field.libsonnet
@@ -22,7 +22,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       indexes: indexes,
     }),
   },
-  '#new':: d.fn(help="\n`google.firestore_field.new` injects a new `google_firestore_field` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.firestore_field.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.firestore_field` using the reference:\n\n    $._ref.google_firestore_field.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_firestore_field.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `collection` (`string`): The id of the collection group to configure.\n  - `database` (`string`): The Firestore database id. Defaults to \u0026#39;\u0026#34;(default)\u0026#34;\u0026#39;. When `null`, the `database` field will be omitted from the resulting object.\n  - `field` (`string`): The id of the field to configure.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `index_config` (`list[obj]`): The single field index configuration for this field.\nCreating an index configuration for this field will override any inherited configuration with the\nindexes specified. Configuring the index configuration with an empty block disables all indexes on\nthe field. When `null`, the `index_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.index_config.new](#fn-index_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.timeouts.new](#fn-timeoutsnew) constructor.\n  - `ttl_config` (`list[obj]`): If set, this field is configured for TTL deletion. When `null`, the `ttl_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.ttl_config.new](#fn-ttl_confignew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.firestore_field.new` injects a new `google_firestore_field` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.firestore_field.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.firestore_field` using the reference:\n\n    $._ref.google_firestore_field.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_firestore_field.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `collection` (`string`): The id of the collection group to configure.\n  - `database` (`string`): The Firestore database id. Defaults to \u0026#39;\u0026#34;(default)\u0026#34;\u0026#39;. When `null`, the `database` field will be omitted from the resulting object.\n  - `field` (`string`): The id of the field to configure.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `index_config` (`list[obj]`): The single field index configuration for this field.\nCreating an index configuration for this field will override any inherited configuration with the\nindexes specified. Configuring the index configuration with an empty block disables all indexes on\nthe field. When `null`, the `index_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.index_config.new](#fn-index_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.timeouts.new](#fn-timeoutsnew) constructor.\n  - `ttl_config` (`list[obj]`): The TTL configuration for this Field. If set to an empty block (i.e. \u0026#39;ttl_config {}\u0026#39;), a TTL policy is configured based on the field. If unset, a TTL policy is not configured (or will be disabled upon updating the resource). When `null`, the `ttl_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.ttl_config.new](#fn-ttl_confignew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     collection,
@@ -47,7 +47,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.firestore_field.newAttrs` constructs a new object with attributes and blocks configured for the `firestore_field`\nTerraform resource.\n\nUnlike [google.firestore_field.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `collection` (`string`): The id of the collection group to configure.\n  - `database` (`string`): The Firestore database id. Defaults to '"(default)"'. When `null`, the `database` field will be omitted from the resulting object.\n  - `field` (`string`): The id of the field to configure.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `index_config` (`list[obj]`): The single field index configuration for this field.\nCreating an index configuration for this field will override any inherited configuration with the\nindexes specified. Configuring the index configuration with an empty block disables all indexes on\nthe field. When `null`, the `index_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.index_config.new](#fn-index_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.timeouts.new](#fn-timeoutsnew) constructor.\n  - `ttl_config` (`list[obj]`): If set, this field is configured for TTL deletion. When `null`, the `ttl_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.ttl_config.new](#fn-ttl_confignew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `firestore_field` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.firestore_field.newAttrs` constructs a new object with attributes and blocks configured for the `firestore_field`\nTerraform resource.\n\nUnlike [google.firestore_field.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `collection` (`string`): The id of the collection group to configure.\n  - `database` (`string`): The Firestore database id. Defaults to '"(default)"'. When `null`, the `database` field will be omitted from the resulting object.\n  - `field` (`string`): The id of the field to configure.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `index_config` (`list[obj]`): The single field index configuration for this field.\nCreating an index configuration for this field will override any inherited configuration with the\nindexes specified. Configuring the index configuration with an empty block disables all indexes on\nthe field. When `null`, the `index_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.index_config.new](#fn-index_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.timeouts.new](#fn-timeoutsnew) constructor.\n  - `ttl_config` (`list[obj]`): The TTL configuration for this Field. If set to an empty block (i.e. 'ttl_config {}'), a TTL policy is configured based on the field. If unset, a TTL policy is not configured (or will be disabled upon updating the resource). When `null`, the `ttl_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.ttl_config.new](#fn-ttl_confignew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `firestore_field` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     collection,
     field,
diff --git a/4.x/_gen/resources/firestore_index.libsonnet b/4.x/_gen/resources/firestore_index.libsonnet
index 3f30167f..ca82f0b1 100644
--- a/4.x/_gen/resources/firestore_index.libsonnet
+++ b/4.x/_gen/resources/firestore_index.libsonnet
@@ -14,10 +14,11 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       order: order,
     }),
   },
-  '#new':: d.fn(help="\n`google.firestore_index.new` injects a new `google_firestore_index` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.firestore_index.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.firestore_index` using the reference:\n\n    $._ref.google_firestore_index.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_firestore_index.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `collection` (`string`): The collection being indexed.\n  - `database` (`string`): The Firestore database id. Defaults to \u0026#39;\u0026#34;(default)\u0026#34;\u0026#39;. When `null`, the `database` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `query_scope` (`string`): The scope at which a query is run. Default value: \u0026#34;COLLECTION\u0026#34; Possible values: [\u0026#34;COLLECTION\u0026#34;, \u0026#34;COLLECTION_GROUP\u0026#34;] When `null`, the `query_scope` field will be omitted from the resulting object.\n  - `fields` (`list[obj]`): The fields supported by this index. The last field entry is always for\nthe field path \u0026#39;__name__\u0026#39;. If, on creation, \u0026#39;__name__\u0026#39; was not\nspecified as the last field, it will be added automatically with the\nsame direction as that of the last field defined. If the final field\nin a composite index is not directional, the \u0026#39;__name__\u0026#39; will be\nordered \u0026#39;\u0026#34;ASCENDING\u0026#34;\u0026#39; (unless explicitly specified otherwise). When `null`, the `fields` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_index.fields.new](#fn-fieldsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_index.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.firestore_index.new` injects a new `google_firestore_index` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.firestore_index.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.firestore_index` using the reference:\n\n    $._ref.google_firestore_index.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_firestore_index.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `api_scope` (`string`): The API scope at which a query is run. Default value: \u0026#34;ANY_API\u0026#34; Possible values: [\u0026#34;ANY_API\u0026#34;, \u0026#34;DATASTORE_MODE_API\u0026#34;] When `null`, the `api_scope` field will be omitted from the resulting object.\n  - `collection` (`string`): The collection being indexed.\n  - `database` (`string`): The Firestore database id. Defaults to \u0026#39;\u0026#34;(default)\u0026#34;\u0026#39;. When `null`, the `database` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `query_scope` (`string`): The scope at which a query is run. Default value: \u0026#34;COLLECTION\u0026#34; Possible values: [\u0026#34;COLLECTION\u0026#34;, \u0026#34;COLLECTION_GROUP\u0026#34;, \u0026#34;COLLECTION_RECURSIVE\u0026#34;] When `null`, the `query_scope` field will be omitted from the resulting object.\n  - `fields` (`list[obj]`): The fields supported by this index. The last field entry is always for\nthe field path \u0026#39;__name__\u0026#39;. If, on creation, \u0026#39;__name__\u0026#39; was not\nspecified as the last field, it will be added automatically with the\nsame direction as that of the last field defined. If the final field\nin a composite index is not directional, the \u0026#39;__name__\u0026#39; will be\nordered \u0026#39;\u0026#34;ASCENDING\u0026#34;\u0026#39; (unless explicitly specified otherwise). When `null`, the `fields` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_index.fields.new](#fn-fieldsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_index.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     collection,
+    api_scope=null,
     database=null,
     fields=null,
     project=null,
@@ -28,6 +29,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     type='google_firestore_index',
     label=resourceLabel,
     attrs=self.newAttrs(
+      api_scope=api_scope,
       collection=collection,
       database=database,
       fields=fields,
@@ -37,15 +39,17 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.firestore_index.newAttrs` constructs a new object with attributes and blocks configured for the `firestore_index`\nTerraform resource.\n\nUnlike [google.firestore_index.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `collection` (`string`): The collection being indexed.\n  - `database` (`string`): The Firestore database id. Defaults to '"(default)"'. When `null`, the `database` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `query_scope` (`string`): The scope at which a query is run. Default value: "COLLECTION" Possible values: ["COLLECTION", "COLLECTION_GROUP"] When `null`, the `query_scope` field will be omitted from the resulting object.\n  - `fields` (`list[obj]`): The fields supported by this index. The last field entry is always for\nthe field path '__name__'. If, on creation, '__name__' was not\nspecified as the last field, it will be added automatically with the\nsame direction as that of the last field defined. If the final field\nin a composite index is not directional, the '__name__' will be\nordered '"ASCENDING"' (unless explicitly specified otherwise). When `null`, the `fields` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_index.fields.new](#fn-fieldsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_index.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `firestore_index` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.firestore_index.newAttrs` constructs a new object with attributes and blocks configured for the `firestore_index`\nTerraform resource.\n\nUnlike [google.firestore_index.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `api_scope` (`string`): The API scope at which a query is run. Default value: "ANY_API" Possible values: ["ANY_API", "DATASTORE_MODE_API"] When `null`, the `api_scope` field will be omitted from the resulting object.\n  - `collection` (`string`): The collection being indexed.\n  - `database` (`string`): The Firestore database id. Defaults to '"(default)"'. When `null`, the `database` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `query_scope` (`string`): The scope at which a query is run. Default value: "COLLECTION" Possible values: ["COLLECTION", "COLLECTION_GROUP", "COLLECTION_RECURSIVE"] When `null`, the `query_scope` field will be omitted from the resulting object.\n  - `fields` (`list[obj]`): The fields supported by this index. The last field entry is always for\nthe field path '__name__'. If, on creation, '__name__' was not\nspecified as the last field, it will be added automatically with the\nsame direction as that of the last field defined. If the final field\nin a composite index is not directional, the '__name__' will be\nordered '"ASCENDING"' (unless explicitly specified otherwise). When `null`, the `fields` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_index.fields.new](#fn-fieldsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_index.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `firestore_index` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     collection,
+    api_scope=null,
     database=null,
     fields=null,
     project=null,
     query_scope=null,
     timeouts=null
   ):: std.prune(a={
+    api_scope: api_scope,
     collection: collection,
     database: database,
     fields: fields,
@@ -63,6 +67,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       delete: delete,
     }),
   },
+  '#withApiScope':: d.fn(help='`google.string.withApiScope` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the api_scope field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `api_scope` field.\n', args=[]),
+  withApiScope(resourceLabel, value): {
+    resource+: {
+      google_firestore_index+: {
+        [resourceLabel]+: {
+          api_scope: value,
+        },
+      },
+    },
+  },
   '#withCollection':: d.fn(help='`google.string.withCollection` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the collection field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `collection` field.\n', args=[]),
   withCollection(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/game_services_game_server_cluster.libsonnet b/4.x/_gen/resources/game_services_game_server_cluster.libsonnet
deleted file mode 100644
index 49beb8c8..00000000
--- a/4.x/_gen/resources/game_services_game_server_cluster.libsonnet
+++ /dev/null
@@ -1,182 +0,0 @@
-local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
-local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
-{
-  '#':: d.pkg(name='game_services_game_server_cluster', url='', help='`game_services_game_server_cluster` represents the `google_game_services_game_server_cluster` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  connection_info:: {
-    gke_cluster_reference:: {
-      '#new':: d.fn(help='\n`google.game_services_game_server_cluster.connection_info.gke_cluster_reference.new` constructs a new object with attributes and blocks configured for the `gke_cluster_reference`\nTerraform sub block.\n\n\n\n**Args**:\n  - `cluster` (`string`): The full or partial name of a GKE cluster, using one of the following\nforms:\n\n* 'projects/{project_id}/locations/{location}/clusters/{cluster_id}'\n* 'locations/{location}/clusters/{cluster_id}'\n* '{cluster_id}'\n\nIf project and location are not specified, the project and location of the\nGameServerCluster resource are used to generate the full name of the\nGKE cluster.\n\n**Returns**:\n  - An attribute object that represents the `gke_cluster_reference` sub block.\n', args=[]),
-      new(
-        cluster
-      ):: std.prune(a={
-        cluster: cluster,
-      }),
-    },
-    '#new':: d.fn(help='\n`google.game_services_game_server_cluster.connection_info.new` constructs a new object with attributes and blocks configured for the `connection_info`\nTerraform sub block.\n\n\n\n**Args**:\n  - `namespace` (`string`): Namespace designated on the game server cluster where the game server\ninstances will be created. The namespace existence will be validated\nduring creation.\n  - `gke_cluster_reference` (`list[obj]`): Reference of the GKE cluster where the game servers are installed. When `null`, the `gke_cluster_reference` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_cluster.connection_info.gke_cluster_reference.new](#fn-connection_infogke_cluster_referencenew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `connection_info` sub block.\n', args=[]),
-    new(
-      namespace,
-      gke_cluster_reference=null
-    ):: std.prune(a={
-      gke_cluster_reference: gke_cluster_reference,
-      namespace: namespace,
-    }),
-  },
-  '#new':: d.fn(help="\n`google.game_services_game_server_cluster.new` injects a new `google_game_services_game_server_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.game_services_game_server_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.game_services_game_server_cluster` using the reference:\n\n    $._ref.google_game_services_game_server_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_game_services_game_server_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `cluster_id` (`string`): Required. The resource name of the game server cluster\n  - `description` (`string`): Human readable description of the cluster. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels associated with this game server cluster. Each label is a\nkey-value pair. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the Cluster. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `realm_id` (`string`): The realm id of the game server realm.\n  - `connection_info` (`list[obj]`): Game server cluster connection information. This information is used to\nmanage game server clusters. When `null`, the `connection_info` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_cluster.connection_info.new](#fn-connection_infonew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
-  new(
-    resourceLabel,
-    cluster_id,
-    realm_id,
-    connection_info=null,
-    description=null,
-    labels=null,
-    location=null,
-    project=null,
-    timeouts=null,
-    _meta={}
-  ):: tf.withResource(
-    type='google_game_services_game_server_cluster',
-    label=resourceLabel,
-    attrs=self.newAttrs(
-      cluster_id=cluster_id,
-      connection_info=connection_info,
-      description=description,
-      labels=labels,
-      location=location,
-      project=project,
-      realm_id=realm_id,
-      timeouts=timeouts
-    ),
-    _meta=_meta
-  ),
-  '#newAttrs':: d.fn(help='\n`google.game_services_game_server_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `game_services_game_server_cluster`\nTerraform resource.\n\nUnlike [google.game_services_game_server_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `cluster_id` (`string`): Required. The resource name of the game server cluster\n  - `description` (`string`): Human readable description of the cluster. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels associated with this game server cluster. Each label is a\nkey-value pair. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the Cluster. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `realm_id` (`string`): The realm id of the game server realm.\n  - `connection_info` (`list[obj]`): Game server cluster connection information. This information is used to\nmanage game server clusters. When `null`, the `connection_info` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_cluster.connection_info.new](#fn-connection_infonew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `game_services_game_server_cluster` resource into the root Terraform configuration.\n', args=[]),
-  newAttrs(
-    cluster_id,
-    realm_id,
-    connection_info=null,
-    description=null,
-    labels=null,
-    location=null,
-    project=null,
-    timeouts=null
-  ):: std.prune(a={
-    cluster_id: cluster_id,
-    connection_info: connection_info,
-    description: description,
-    labels: labels,
-    location: location,
-    project: project,
-    realm_id: realm_id,
-    timeouts: timeouts,
-  }),
-  timeouts:: {
-    '#new':: d.fn(help='\n`google.game_services_game_server_cluster.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
-    new(
-      create=null,
-      delete=null,
-      update=null
-    ):: std.prune(a={
-      create: create,
-      delete: delete,
-      update: update,
-    }),
-  },
-  '#withClusterId':: d.fn(help='`google.string.withClusterId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the cluster_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `cluster_id` field.\n', args=[]),
-  withClusterId(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_cluster+: {
-        [resourceLabel]+: {
-          cluster_id: value,
-        },
-      },
-    },
-  },
-  '#withConnectionInfo':: d.fn(help='`google.list[obj].withConnectionInfo` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the connection_info field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withConnectionInfoMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `connection_info` field.\n', args=[]),
-  withConnectionInfo(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_cluster+: {
-        [resourceLabel]+: {
-          connection_info: value,
-        },
-      },
-    },
-  },
-  '#withConnectionInfoMixin':: d.fn(help='`google.list[obj].withConnectionInfoMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the connection_info field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withConnectionInfo](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `connection_info` field.\n', args=[]),
-  withConnectionInfoMixin(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_cluster+: {
-        [resourceLabel]+: {
-          connection_info+: if std.isArray(v=value) then value else [value],
-        },
-      },
-    },
-  },
-  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
-  withDescription(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_cluster+: {
-        [resourceLabel]+: {
-          description: value,
-        },
-      },
-    },
-  },
-  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
-  withLabels(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_cluster+: {
-        [resourceLabel]+: {
-          labels: value,
-        },
-      },
-    },
-  },
-  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
-  withLocation(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_cluster+: {
-        [resourceLabel]+: {
-          location: value,
-        },
-      },
-    },
-  },
-  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
-  withProject(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_cluster+: {
-        [resourceLabel]+: {
-          project: value,
-        },
-      },
-    },
-  },
-  '#withRealmId':: d.fn(help='`google.string.withRealmId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the realm_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `realm_id` field.\n', args=[]),
-  withRealmId(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_cluster+: {
-        [resourceLabel]+: {
-          realm_id: value,
-        },
-      },
-    },
-  },
-  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
-  withTimeouts(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_cluster+: {
-        [resourceLabel]+: {
-          timeouts: value,
-        },
-      },
-    },
-  },
-  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
-  withTimeoutsMixin(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_cluster+: {
-        [resourceLabel]+: {
-          timeouts+: value,
-        },
-      },
-    },
-  },
-}
diff --git a/4.x/_gen/resources/game_services_game_server_config.libsonnet b/4.x/_gen/resources/game_services_game_server_config.libsonnet
deleted file mode 100644
index 0ab7d3a0..00000000
--- a/4.x/_gen/resources/game_services_game_server_config.libsonnet
+++ /dev/null
@@ -1,232 +0,0 @@
-local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
-local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
-{
-  '#':: d.pkg(name='game_services_game_server_config', url='', help='`game_services_game_server_config` represents the `google_game_services_game_server_config` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  fleet_configs:: {
-    '#new':: d.fn(help='\n`google.game_services_game_server_config.fleet_configs.new` constructs a new object with attributes and blocks configured for the `fleet_configs`\nTerraform sub block.\n\n\n\n**Args**:\n  - `fleet_spec` (`string`): The fleet spec, which is sent to Agones to configure fleet.\nThe spec can be passed as inline json but it is recommended to use a file reference\ninstead. File references can contain the json or yaml format of the fleet spec. Eg:\n\n* fleet_spec = jsonencode(yamldecode(file("fleet_configs.yaml")))\n* fleet_spec = file("fleet_configs.json")\n\nThe format of the spec can be found :\n'https://agones.dev/site/docs/reference/fleet/'.\n  - `name` (`string`): The name of the FleetConfig. When `null`, the `name` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `fleet_configs` sub block.\n', args=[]),
-    new(
-      fleet_spec,
-      name=null
-    ):: std.prune(a={
-      fleet_spec: fleet_spec,
-      name: name,
-    }),
-  },
-  '#new':: d.fn(help="\n`google.game_services_game_server_config.new` injects a new `google_game_services_game_server_config` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.game_services_game_server_config.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.game_services_game_server_config` using the reference:\n\n    $._ref.google_game_services_game_server_config.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_game_services_game_server_config.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `config_id` (`string`): A unique id for the deployment config.\n  - `deployment_id` (`string`): A unique id for the deployment.\n  - `description` (`string`): The description of the game server config. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels associated with this game server config. Each label is a\nkey-value pair. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the Deployment. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `fleet_configs` (`list[obj]`): The fleet config contains list of fleet specs. In the Single Cloud, there\nwill be only one. When `null`, the `fleet_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_config.fleet_configs.new](#fn-fleet_configsnew) constructor.\n  - `scaling_configs` (`list[obj]`): Optional. This contains the autoscaling settings. When `null`, the `scaling_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_config.scaling_configs.new](#fn-scaling_configsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_config.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
-  new(
-    resourceLabel,
-    config_id,
-    deployment_id,
-    description=null,
-    fleet_configs=null,
-    labels=null,
-    location=null,
-    project=null,
-    scaling_configs=null,
-    timeouts=null,
-    _meta={}
-  ):: tf.withResource(
-    type='google_game_services_game_server_config',
-    label=resourceLabel,
-    attrs=self.newAttrs(
-      config_id=config_id,
-      deployment_id=deployment_id,
-      description=description,
-      fleet_configs=fleet_configs,
-      labels=labels,
-      location=location,
-      project=project,
-      scaling_configs=scaling_configs,
-      timeouts=timeouts
-    ),
-    _meta=_meta
-  ),
-  '#newAttrs':: d.fn(help='\n`google.game_services_game_server_config.newAttrs` constructs a new object with attributes and blocks configured for the `game_services_game_server_config`\nTerraform resource.\n\nUnlike [google.game_services_game_server_config.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `config_id` (`string`): A unique id for the deployment config.\n  - `deployment_id` (`string`): A unique id for the deployment.\n  - `description` (`string`): The description of the game server config. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels associated with this game server config. Each label is a\nkey-value pair. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the Deployment. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `fleet_configs` (`list[obj]`): The fleet config contains list of fleet specs. In the Single Cloud, there\nwill be only one. When `null`, the `fleet_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_config.fleet_configs.new](#fn-fleet_configsnew) constructor.\n  - `scaling_configs` (`list[obj]`): Optional. This contains the autoscaling settings. When `null`, the `scaling_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_config.scaling_configs.new](#fn-scaling_configsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_config.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `game_services_game_server_config` resource into the root Terraform configuration.\n', args=[]),
-  newAttrs(
-    config_id,
-    deployment_id,
-    description=null,
-    fleet_configs=null,
-    labels=null,
-    location=null,
-    project=null,
-    scaling_configs=null,
-    timeouts=null
-  ):: std.prune(a={
-    config_id: config_id,
-    deployment_id: deployment_id,
-    description: description,
-    fleet_configs: fleet_configs,
-    labels: labels,
-    location: location,
-    project: project,
-    scaling_configs: scaling_configs,
-    timeouts: timeouts,
-  }),
-  scaling_configs:: {
-    '#new':: d.fn(help='\n`google.game_services_game_server_config.scaling_configs.new` constructs a new object with attributes and blocks configured for the `scaling_configs`\nTerraform sub block.\n\n\n\n**Args**:\n  - `fleet_autoscaler_spec` (`string`): Fleet autoscaler spec, which is sent to Agones.\nExample spec can be found :\nhttps://agones.dev/site/docs/reference/fleetautoscaler/\n  - `name` (`string`): The name of the ScalingConfig\n  - `schedules` (`list[obj]`): The schedules to which this scaling config applies. When `null`, the `schedules` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_config.scaling_configs.schedules.new](#fn-scaling_configsschedulesnew) constructor.\n  - `selectors` (`list[obj]`): Labels used to identify the clusters to which this scaling config\napplies. A cluster is subject to this scaling config if its labels match\nany of the selector entries. When `null`, the `selectors` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_config.scaling_configs.selectors.new](#fn-scaling_configsselectorsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `scaling_configs` sub block.\n', args=[]),
-    new(
-      fleet_autoscaler_spec,
-      name,
-      schedules=null,
-      selectors=null
-    ):: std.prune(a={
-      fleet_autoscaler_spec: fleet_autoscaler_spec,
-      name: name,
-      schedules: schedules,
-      selectors: selectors,
-    }),
-    schedules:: {
-      '#new':: d.fn(help='\n`google.game_services_game_server_config.scaling_configs.schedules.new` constructs a new object with attributes and blocks configured for the `schedules`\nTerraform sub block.\n\n\n\n**Args**:\n  - `cron_job_duration` (`string`): The duration for the cron job event. The duration of the event is effective\nafter the cron job's start time.\n\nA duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s". When `null`, the `cron_job_duration` field will be omitted from the resulting object.\n  - `cron_spec` (`string`): The cron definition of the scheduled event. See\nhttps://en.wikipedia.org/wiki/Cron. Cron spec specifies the local time as\ndefined by the realm. When `null`, the `cron_spec` field will be omitted from the resulting object.\n  - `end_time` (`string`): The end time of the event.\n\nA timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z". When `null`, the `end_time` field will be omitted from the resulting object.\n  - `start_time` (`string`): The start time of the event.\n\nA timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z". When `null`, the `start_time` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `schedules` sub block.\n', args=[]),
-      new(
-        cron_job_duration=null,
-        cron_spec=null,
-        end_time=null,
-        start_time=null
-      ):: std.prune(a={
-        cron_job_duration: cron_job_duration,
-        cron_spec: cron_spec,
-        end_time: end_time,
-        start_time: start_time,
-      }),
-    },
-    selectors:: {
-      '#new':: d.fn(help='\n`google.game_services_game_server_config.scaling_configs.selectors.new` constructs a new object with attributes and blocks configured for the `selectors`\nTerraform sub block.\n\n\n\n**Args**:\n  - `labels` (`obj`): Set of labels to group by. When `null`, the `labels` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `selectors` sub block.\n', args=[]),
-      new(
-        labels=null
-      ):: std.prune(a={
-        labels: labels,
-      }),
-    },
-  },
-  timeouts:: {
-    '#new':: d.fn(help='\n`google.game_services_game_server_config.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
-    new(
-      create=null,
-      delete=null
-    ):: std.prune(a={
-      create: create,
-      delete: delete,
-    }),
-  },
-  '#withConfigId':: d.fn(help='`google.string.withConfigId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the config_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `config_id` field.\n', args=[]),
-  withConfigId(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_config+: {
-        [resourceLabel]+: {
-          config_id: value,
-        },
-      },
-    },
-  },
-  '#withDeploymentId':: d.fn(help='`google.string.withDeploymentId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the deployment_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `deployment_id` field.\n', args=[]),
-  withDeploymentId(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_config+: {
-        [resourceLabel]+: {
-          deployment_id: value,
-        },
-      },
-    },
-  },
-  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
-  withDescription(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_config+: {
-        [resourceLabel]+: {
-          description: value,
-        },
-      },
-    },
-  },
-  '#withFleetConfigs':: d.fn(help='`google.list[obj].withFleetConfigs` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the fleet_configs field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withFleetConfigsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `fleet_configs` field.\n', args=[]),
-  withFleetConfigs(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_config+: {
-        [resourceLabel]+: {
-          fleet_configs: value,
-        },
-      },
-    },
-  },
-  '#withFleetConfigsMixin':: d.fn(help='`google.list[obj].withFleetConfigsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the fleet_configs field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withFleetConfigs](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `fleet_configs` field.\n', args=[]),
-  withFleetConfigsMixin(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_config+: {
-        [resourceLabel]+: {
-          fleet_configs+: if std.isArray(v=value) then value else [value],
-        },
-      },
-    },
-  },
-  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
-  withLabels(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_config+: {
-        [resourceLabel]+: {
-          labels: value,
-        },
-      },
-    },
-  },
-  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
-  withLocation(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_config+: {
-        [resourceLabel]+: {
-          location: value,
-        },
-      },
-    },
-  },
-  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
-  withProject(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_config+: {
-        [resourceLabel]+: {
-          project: value,
-        },
-      },
-    },
-  },
-  '#withScalingConfigs':: d.fn(help='`google.list[obj].withScalingConfigs` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the scaling_configs field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withScalingConfigsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `scaling_configs` field.\n', args=[]),
-  withScalingConfigs(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_config+: {
-        [resourceLabel]+: {
-          scaling_configs: value,
-        },
-      },
-    },
-  },
-  '#withScalingConfigsMixin':: d.fn(help='`google.list[obj].withScalingConfigsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the scaling_configs field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withScalingConfigs](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `scaling_configs` field.\n', args=[]),
-  withScalingConfigsMixin(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_config+: {
-        [resourceLabel]+: {
-          scaling_configs+: if std.isArray(v=value) then value else [value],
-        },
-      },
-    },
-  },
-  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
-  withTimeouts(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_config+: {
-        [resourceLabel]+: {
-          timeouts: value,
-        },
-      },
-    },
-  },
-  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
-  withTimeoutsMixin(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_config+: {
-        [resourceLabel]+: {
-          timeouts+: value,
-        },
-      },
-    },
-  },
-}
diff --git a/4.x/_gen/resources/game_services_game_server_deployment.libsonnet b/4.x/_gen/resources/game_services_game_server_deployment.libsonnet
deleted file mode 100644
index 7fabe285..00000000
--- a/4.x/_gen/resources/game_services_game_server_deployment.libsonnet
+++ /dev/null
@@ -1,126 +0,0 @@
-local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
-local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
-{
-  '#':: d.pkg(name='game_services_game_server_deployment', url='', help='`game_services_game_server_deployment` represents the `google_game_services_game_server_deployment` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.game_services_game_server_deployment.new` injects a new `google_game_services_game_server_deployment` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.game_services_game_server_deployment.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.game_services_game_server_deployment` using the reference:\n\n    $._ref.google_game_services_game_server_deployment.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_game_services_game_server_deployment.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `deployment_id` (`string`): A unique id for the deployment.\n  - `description` (`string`): Human readable description of the game server deployment. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels associated with this game server deployment. Each label is a\nkey-value pair. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the Deployment. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_deployment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
-  new(
-    resourceLabel,
-    deployment_id,
-    description=null,
-    labels=null,
-    location=null,
-    project=null,
-    timeouts=null,
-    _meta={}
-  ):: tf.withResource(
-    type='google_game_services_game_server_deployment',
-    label=resourceLabel,
-    attrs=self.newAttrs(
-      deployment_id=deployment_id,
-      description=description,
-      labels=labels,
-      location=location,
-      project=project,
-      timeouts=timeouts
-    ),
-    _meta=_meta
-  ),
-  '#newAttrs':: d.fn(help='\n`google.game_services_game_server_deployment.newAttrs` constructs a new object with attributes and blocks configured for the `game_services_game_server_deployment`\nTerraform resource.\n\nUnlike [google.game_services_game_server_deployment.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `deployment_id` (`string`): A unique id for the deployment.\n  - `description` (`string`): Human readable description of the game server deployment. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels associated with this game server deployment. Each label is a\nkey-value pair. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the Deployment. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_deployment.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `game_services_game_server_deployment` resource into the root Terraform configuration.\n', args=[]),
-  newAttrs(
-    deployment_id,
-    description=null,
-    labels=null,
-    location=null,
-    project=null,
-    timeouts=null
-  ):: std.prune(a={
-    deployment_id: deployment_id,
-    description: description,
-    labels: labels,
-    location: location,
-    project: project,
-    timeouts: timeouts,
-  }),
-  timeouts:: {
-    '#new':: d.fn(help='\n`google.game_services_game_server_deployment.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
-    new(
-      create=null,
-      delete=null,
-      update=null
-    ):: std.prune(a={
-      create: create,
-      delete: delete,
-      update: update,
-    }),
-  },
-  '#withDeploymentId':: d.fn(help='`google.string.withDeploymentId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the deployment_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `deployment_id` field.\n', args=[]),
-  withDeploymentId(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_deployment+: {
-        [resourceLabel]+: {
-          deployment_id: value,
-        },
-      },
-    },
-  },
-  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
-  withDescription(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_deployment+: {
-        [resourceLabel]+: {
-          description: value,
-        },
-      },
-    },
-  },
-  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
-  withLabels(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_deployment+: {
-        [resourceLabel]+: {
-          labels: value,
-        },
-      },
-    },
-  },
-  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
-  withLocation(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_deployment+: {
-        [resourceLabel]+: {
-          location: value,
-        },
-      },
-    },
-  },
-  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
-  withProject(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_deployment+: {
-        [resourceLabel]+: {
-          project: value,
-        },
-      },
-    },
-  },
-  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
-  withTimeouts(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_deployment+: {
-        [resourceLabel]+: {
-          timeouts: value,
-        },
-      },
-    },
-  },
-  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
-  withTimeoutsMixin(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_deployment+: {
-        [resourceLabel]+: {
-          timeouts+: value,
-        },
-      },
-    },
-  },
-}
diff --git a/4.x/_gen/resources/game_services_game_server_deployment_rollout.libsonnet b/4.x/_gen/resources/game_services_game_server_deployment_rollout.libsonnet
deleted file mode 100644
index 7d8aed80..00000000
--- a/4.x/_gen/resources/game_services_game_server_deployment_rollout.libsonnet
+++ /dev/null
@@ -1,140 +0,0 @@
-local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
-local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
-{
-  '#':: d.pkg(name='game_services_game_server_deployment_rollout', url='', help='`game_services_game_server_deployment_rollout` represents the `google_game_services_game_server_deployment_rollout` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  game_server_config_overrides:: {
-    '#new':: d.fn(help='\n`google.game_services_game_server_deployment_rollout.game_server_config_overrides.new` constructs a new object with attributes and blocks configured for the `game_server_config_overrides`\nTerraform sub block.\n\n\n\n**Args**:\n  - `config_version` (`string`): Version of the configuration. When `null`, the `config_version` field will be omitted from the resulting object.\n  - `realms_selector` (`list[obj]`): Selection by realms. When `null`, the `realms_selector` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_deployment_rollout.game_server_config_overrides.realms_selector.new](#fn-game_server_config_overridesrealms_selectornew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `game_server_config_overrides` sub block.\n', args=[]),
-    new(
-      config_version=null,
-      realms_selector=null
-    ):: std.prune(a={
-      config_version: config_version,
-      realms_selector: realms_selector,
-    }),
-    realms_selector:: {
-      '#new':: d.fn(help='\n`google.game_services_game_server_deployment_rollout.game_server_config_overrides.realms_selector.new` constructs a new object with attributes and blocks configured for the `realms_selector`\nTerraform sub block.\n\n\n\n**Args**:\n  - `realms` (`list`): List of realms to match against. When `null`, the `realms` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `realms_selector` sub block.\n', args=[]),
-      new(
-        realms=null
-      ):: std.prune(a={
-        realms: realms,
-      }),
-    },
-  },
-  '#new':: d.fn(help="\n`google.game_services_game_server_deployment_rollout.new` injects a new `google_game_services_game_server_deployment_rollout` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.game_services_game_server_deployment_rollout.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.game_services_game_server_deployment_rollout` using the reference:\n\n    $._ref.google_game_services_game_server_deployment_rollout.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_game_services_game_server_deployment_rollout.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `default_game_server_config` (`string`): This field points to the game server config that is\napplied by default to all realms and clusters. For example,\n\n\u0026#39;projects/my-project/locations/global/gameServerDeployments/my-game/configs/my-config\u0026#39;.\n  - `deployment_id` (`string`): The deployment to rollout the new config to. Only 1 rollout must be associated with each deployment.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `game_server_config_overrides` (`list[obj]`): The game_server_config_overrides contains the per game server config\noverrides. The overrides are processed in the order they are listed. As\nsoon as a match is found for a cluster, the rest of the list is not\nprocessed. When `null`, the `game_server_config_overrides` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_deployment_rollout.game_server_config_overrides.new](#fn-game_server_config_overridesnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_deployment_rollout.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
-  new(
-    resourceLabel,
-    default_game_server_config,
-    deployment_id,
-    game_server_config_overrides=null,
-    project=null,
-    timeouts=null,
-    _meta={}
-  ):: tf.withResource(
-    type='google_game_services_game_server_deployment_rollout',
-    label=resourceLabel,
-    attrs=self.newAttrs(
-      default_game_server_config=default_game_server_config,
-      deployment_id=deployment_id,
-      game_server_config_overrides=game_server_config_overrides,
-      project=project,
-      timeouts=timeouts
-    ),
-    _meta=_meta
-  ),
-  '#newAttrs':: d.fn(help='\n`google.game_services_game_server_deployment_rollout.newAttrs` constructs a new object with attributes and blocks configured for the `game_services_game_server_deployment_rollout`\nTerraform resource.\n\nUnlike [google.game_services_game_server_deployment_rollout.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `default_game_server_config` (`string`): This field points to the game server config that is\napplied by default to all realms and clusters. For example,\n\n'projects/my-project/locations/global/gameServerDeployments/my-game/configs/my-config'.\n  - `deployment_id` (`string`): The deployment to rollout the new config to. Only 1 rollout must be associated with each deployment.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `game_server_config_overrides` (`list[obj]`): The game_server_config_overrides contains the per game server config\noverrides. The overrides are processed in the order they are listed. As\nsoon as a match is found for a cluster, the rest of the list is not\nprocessed. When `null`, the `game_server_config_overrides` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_deployment_rollout.game_server_config_overrides.new](#fn-game_server_config_overridesnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_deployment_rollout.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `game_services_game_server_deployment_rollout` resource into the root Terraform configuration.\n', args=[]),
-  newAttrs(
-    default_game_server_config,
-    deployment_id,
-    game_server_config_overrides=null,
-    project=null,
-    timeouts=null
-  ):: std.prune(a={
-    default_game_server_config: default_game_server_config,
-    deployment_id: deployment_id,
-    game_server_config_overrides: game_server_config_overrides,
-    project: project,
-    timeouts: timeouts,
-  }),
-  timeouts:: {
-    '#new':: d.fn(help='\n`google.game_services_game_server_deployment_rollout.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
-    new(
-      create=null,
-      delete=null,
-      update=null
-    ):: std.prune(a={
-      create: create,
-      delete: delete,
-      update: update,
-    }),
-  },
-  '#withDefaultGameServerConfig':: d.fn(help='`google.string.withDefaultGameServerConfig` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the default_game_server_config field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `default_game_server_config` field.\n', args=[]),
-  withDefaultGameServerConfig(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_deployment_rollout+: {
-        [resourceLabel]+: {
-          default_game_server_config: value,
-        },
-      },
-    },
-  },
-  '#withDeploymentId':: d.fn(help='`google.string.withDeploymentId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the deployment_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `deployment_id` field.\n', args=[]),
-  withDeploymentId(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_deployment_rollout+: {
-        [resourceLabel]+: {
-          deployment_id: value,
-        },
-      },
-    },
-  },
-  '#withGameServerConfigOverrides':: d.fn(help='`google.list[obj].withGameServerConfigOverrides` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the game_server_config_overrides field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withGameServerConfigOverridesMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `game_server_config_overrides` field.\n', args=[]),
-  withGameServerConfigOverrides(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_deployment_rollout+: {
-        [resourceLabel]+: {
-          game_server_config_overrides: value,
-        },
-      },
-    },
-  },
-  '#withGameServerConfigOverridesMixin':: d.fn(help='`google.list[obj].withGameServerConfigOverridesMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the game_server_config_overrides field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withGameServerConfigOverrides](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `game_server_config_overrides` field.\n', args=[]),
-  withGameServerConfigOverridesMixin(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_deployment_rollout+: {
-        [resourceLabel]+: {
-          game_server_config_overrides+: if std.isArray(v=value) then value else [value],
-        },
-      },
-    },
-  },
-  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
-  withProject(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_deployment_rollout+: {
-        [resourceLabel]+: {
-          project: value,
-        },
-      },
-    },
-  },
-  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
-  withTimeouts(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_deployment_rollout+: {
-        [resourceLabel]+: {
-          timeouts: value,
-        },
-      },
-    },
-  },
-  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
-  withTimeoutsMixin(resourceLabel, value): {
-    resource+: {
-      google_game_services_game_server_deployment_rollout+: {
-        [resourceLabel]+: {
-          timeouts+: value,
-        },
-      },
-    },
-  },
-}
diff --git a/4.x/_gen/resources/game_services_realm.libsonnet b/4.x/_gen/resources/game_services_realm.libsonnet
deleted file mode 100644
index 84066d07..00000000
--- a/4.x/_gen/resources/game_services_realm.libsonnet
+++ /dev/null
@@ -1,140 +0,0 @@
-local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
-local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
-{
-  '#':: d.pkg(name='game_services_realm', url='', help='`game_services_realm` represents the `google_game_services_realm` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.game_services_realm.new` injects a new `google_game_services_realm` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.game_services_realm.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.game_services_realm` using the reference:\n\n    $._ref.google_game_services_realm.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_game_services_realm.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Human readable description of the realm. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels associated with this realm. Each label is a key-value pair. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the Realm. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `realm_id` (`string`): GCP region of the Realm.\n  - `time_zone` (`string`): Required. Time zone where all realm-specific policies are evaluated. The value of\nthis field must be from the IANA time zone database:\nhttps://www.iana.org/time-zones.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_realm.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
-  new(
-    resourceLabel,
-    realm_id,
-    time_zone,
-    description=null,
-    labels=null,
-    location=null,
-    project=null,
-    timeouts=null,
-    _meta={}
-  ):: tf.withResource(
-    type='google_game_services_realm',
-    label=resourceLabel,
-    attrs=self.newAttrs(
-      description=description,
-      labels=labels,
-      location=location,
-      project=project,
-      realm_id=realm_id,
-      time_zone=time_zone,
-      timeouts=timeouts
-    ),
-    _meta=_meta
-  ),
-  '#newAttrs':: d.fn(help='\n`google.game_services_realm.newAttrs` constructs a new object with attributes and blocks configured for the `game_services_realm`\nTerraform resource.\n\nUnlike [google.game_services_realm.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Human readable description of the realm. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels associated with this realm. Each label is a key-value pair. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the Realm. When `null`, the `location` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `realm_id` (`string`): GCP region of the Realm.\n  - `time_zone` (`string`): Required. Time zone where all realm-specific policies are evaluated. The value of\nthis field must be from the IANA time zone database:\nhttps://www.iana.org/time-zones.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_realm.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `game_services_realm` resource into the root Terraform configuration.\n', args=[]),
-  newAttrs(
-    realm_id,
-    time_zone,
-    description=null,
-    labels=null,
-    location=null,
-    project=null,
-    timeouts=null
-  ):: std.prune(a={
-    description: description,
-    labels: labels,
-    location: location,
-    project: project,
-    realm_id: realm_id,
-    time_zone: time_zone,
-    timeouts: timeouts,
-  }),
-  timeouts:: {
-    '#new':: d.fn(help='\n`google.game_services_realm.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
-    new(
-      create=null,
-      delete=null,
-      update=null
-    ):: std.prune(a={
-      create: create,
-      delete: delete,
-      update: update,
-    }),
-  },
-  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
-  withDescription(resourceLabel, value): {
-    resource+: {
-      google_game_services_realm+: {
-        [resourceLabel]+: {
-          description: value,
-        },
-      },
-    },
-  },
-  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
-  withLabels(resourceLabel, value): {
-    resource+: {
-      google_game_services_realm+: {
-        [resourceLabel]+: {
-          labels: value,
-        },
-      },
-    },
-  },
-  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
-  withLocation(resourceLabel, value): {
-    resource+: {
-      google_game_services_realm+: {
-        [resourceLabel]+: {
-          location: value,
-        },
-      },
-    },
-  },
-  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
-  withProject(resourceLabel, value): {
-    resource+: {
-      google_game_services_realm+: {
-        [resourceLabel]+: {
-          project: value,
-        },
-      },
-    },
-  },
-  '#withRealmId':: d.fn(help='`google.string.withRealmId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the realm_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `realm_id` field.\n', args=[]),
-  withRealmId(resourceLabel, value): {
-    resource+: {
-      google_game_services_realm+: {
-        [resourceLabel]+: {
-          realm_id: value,
-        },
-      },
-    },
-  },
-  '#withTimeZone':: d.fn(help='`google.string.withTimeZone` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the time_zone field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `time_zone` field.\n', args=[]),
-  withTimeZone(resourceLabel, value): {
-    resource+: {
-      google_game_services_realm+: {
-        [resourceLabel]+: {
-          time_zone: value,
-        },
-      },
-    },
-  },
-  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
-  withTimeouts(resourceLabel, value): {
-    resource+: {
-      google_game_services_realm+: {
-        [resourceLabel]+: {
-          timeouts: value,
-        },
-      },
-    },
-  },
-  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
-  withTimeoutsMixin(resourceLabel, value): {
-    resource+: {
-      google_game_services_realm+: {
-        [resourceLabel]+: {
-          timeouts+: value,
-        },
-      },
-    },
-  },
-}
diff --git a/4.x/_gen/resources/gke_backup_backup_plan.libsonnet b/4.x/_gen/resources/gke_backup_backup_plan.libsonnet
index 21bdf4c0..ce618465 100644
--- a/4.x/_gen/resources/gke_backup_backup_plan.libsonnet
+++ b/4.x/_gen/resources/gke_backup_backup_plan.libsonnet
@@ -64,7 +64,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       paused: paused,
     }),
   },
-  '#new':: d.fn(help="\n`google.gke_backup_backup_plan.new` injects a new `google_gke_backup_backup_plan` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_backup_backup_plan.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_backup_backup_plan` using the reference:\n\n    $._ref.google_gke_backup_backup_plan.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_backup_backup_plan.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `cluster` (`string`): The source cluster from which Backups will be created via this BackupPlan.\n  - `deactivated` (`bool`): This flag indicates whether this BackupPlan has been deactivated.\nSetting this field to True locks the BackupPlan such that no further updates will be allowed\n(except deletes), including the deactivated field itself. It also prevents any new Backups\nfrom being created via this BackupPlan (including scheduled Backups). When `null`, the `deactivated` field will be omitted from the resulting object.\n  - `description` (`string`): User specified descriptive string for this BackupPlan. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Description: A set of custom labels supplied by the user.\nA list of key-\u0026gt;value pairs.\nExample: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The region of the Backup Plan.\n  - `name` (`string`): The full name of the BackupPlan Resource.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `backup_config` (`list[obj]`): Defines the configuration of Backups created via this BackupPlan. When `null`, the `backup_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_backup_plan.backup_config.new](#fn-backup_confignew) constructor.\n  - `backup_schedule` (`list[obj]`): Defines a schedule for automatic Backup creation via this BackupPlan. When `null`, the `backup_schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_backup_plan.backup_schedule.new](#fn-backup_schedulenew) constructor.\n  - `retention_policy` (`list[obj]`): RetentionPolicy governs lifecycle of Backups created under this plan. When `null`, the `retention_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_backup_plan.retention_policy.new](#fn-retention_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_backup_plan.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.gke_backup_backup_plan.new` injects a new `google_gke_backup_backup_plan` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_backup_backup_plan.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_backup_backup_plan` using the reference:\n\n    $._ref.google_gke_backup_backup_plan.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_backup_backup_plan.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `cluster` (`string`): The source cluster from which Backups will be created via this BackupPlan.\n  - `deactivated` (`bool`): This flag indicates whether this BackupPlan has been deactivated.\nSetting this field to True locks the BackupPlan such that no further updates will be allowed\n(except deletes), including the deactivated field itself. It also prevents any new Backups\nfrom being created via this BackupPlan (including scheduled Backups). When `null`, the `deactivated` field will be omitted from the resulting object.\n  - `description` (`string`): User specified descriptive string for this BackupPlan. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Description: A set of custom labels supplied by the user.\nA list of key-\u0026gt;value pairs.\nExample: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The region of the Backup Plan.\n  - `name` (`string`): The full name of the BackupPlan Resource.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `backup_config` (`list[obj]`): Defines the configuration of Backups created via this BackupPlan. When `null`, the `backup_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_backup_plan.backup_config.new](#fn-backup_confignew) constructor.\n  - `backup_schedule` (`list[obj]`): Defines a schedule for automatic Backup creation via this BackupPlan. When `null`, the `backup_schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_backup_plan.backup_schedule.new](#fn-backup_schedulenew) constructor.\n  - `retention_policy` (`list[obj]`): RetentionPolicy governs lifecycle of Backups created under this plan. When `null`, the `retention_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_backup_plan.retention_policy.new](#fn-retention_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_backup_plan.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     cluster,
@@ -97,7 +97,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.gke_backup_backup_plan.newAttrs` constructs a new object with attributes and blocks configured for the `gke_backup_backup_plan`\nTerraform resource.\n\nUnlike [google.gke_backup_backup_plan.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `cluster` (`string`): The source cluster from which Backups will be created via this BackupPlan.\n  - `deactivated` (`bool`): This flag indicates whether this BackupPlan has been deactivated.\nSetting this field to True locks the BackupPlan such that no further updates will be allowed\n(except deletes), including the deactivated field itself. It also prevents any new Backups\nfrom being created via this BackupPlan (including scheduled Backups). When `null`, the `deactivated` field will be omitted from the resulting object.\n  - `description` (`string`): User specified descriptive string for this BackupPlan. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Description: A set of custom labels supplied by the user.\nA list of key->value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The region of the Backup Plan.\n  - `name` (`string`): The full name of the BackupPlan Resource.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `backup_config` (`list[obj]`): Defines the configuration of Backups created via this BackupPlan. When `null`, the `backup_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_backup_plan.backup_config.new](#fn-backup_confignew) constructor.\n  - `backup_schedule` (`list[obj]`): Defines a schedule for automatic Backup creation via this BackupPlan. When `null`, the `backup_schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_backup_plan.backup_schedule.new](#fn-backup_schedulenew) constructor.\n  - `retention_policy` (`list[obj]`): RetentionPolicy governs lifecycle of Backups created under this plan. When `null`, the `retention_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_backup_plan.retention_policy.new](#fn-retention_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_backup_plan.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_backup_backup_plan` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.gke_backup_backup_plan.newAttrs` constructs a new object with attributes and blocks configured for the `gke_backup_backup_plan`\nTerraform resource.\n\nUnlike [google.gke_backup_backup_plan.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `cluster` (`string`): The source cluster from which Backups will be created via this BackupPlan.\n  - `deactivated` (`bool`): This flag indicates whether this BackupPlan has been deactivated.\nSetting this field to True locks the BackupPlan such that no further updates will be allowed\n(except deletes), including the deactivated field itself. It also prevents any new Backups\nfrom being created via this BackupPlan (including scheduled Backups). When `null`, the `deactivated` field will be omitted from the resulting object.\n  - `description` (`string`): User specified descriptive string for this BackupPlan. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Description: A set of custom labels supplied by the user.\nA list of key->value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The region of the Backup Plan.\n  - `name` (`string`): The full name of the BackupPlan Resource.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `backup_config` (`list[obj]`): Defines the configuration of Backups created via this BackupPlan. When `null`, the `backup_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_backup_plan.backup_config.new](#fn-backup_confignew) constructor.\n  - `backup_schedule` (`list[obj]`): Defines a schedule for automatic Backup creation via this BackupPlan. When `null`, the `backup_schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_backup_plan.backup_schedule.new](#fn-backup_schedulenew) constructor.\n  - `retention_policy` (`list[obj]`): RetentionPolicy governs lifecycle of Backups created under this plan. When `null`, the `retention_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_backup_plan.retention_policy.new](#fn-retention_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_backup_plan.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_backup_backup_plan` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     cluster,
     location,
diff --git a/4.x/_gen/resources/gke_backup_restore_plan.libsonnet b/4.x/_gen/resources/gke_backup_restore_plan.libsonnet
index f126671e..548ff07e 100644
--- a/4.x/_gen/resources/gke_backup_restore_plan.libsonnet
+++ b/4.x/_gen/resources/gke_backup_restore_plan.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='gke_backup_restore_plan', url='', help='`gke_backup_restore_plan` represents the `google_gke_backup_restore_plan` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.gke_backup_restore_plan.new` injects a new `google_gke_backup_restore_plan` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_backup_restore_plan.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_backup_restore_plan` using the reference:\n\n    $._ref.google_gke_backup_restore_plan.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_backup_restore_plan.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `backup_plan` (`string`): A reference to the BackupPlan from which Backups may be used\nas the source for Restores created via this RestorePlan.\n  - `cluster` (`string`): The source cluster from which Restores will be created via this RestorePlan.\n  - `description` (`string`): User specified descriptive string for this RestorePlan. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Description: A set of custom labels supplied by the user.\nA list of key-\u0026gt;value pairs.\nExample: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The region of the Restore Plan.\n  - `name` (`string`): The full name of the BackupPlan Resource.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `restore_config` (`list[obj]`): Defines the configuration of Restores created via this RestorePlan. When `null`, the `restore_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_restore_plan.restore_config.new](#fn-restore_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_restore_plan.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.gke_backup_restore_plan.new` injects a new `google_gke_backup_restore_plan` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_backup_restore_plan.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_backup_restore_plan` using the reference:\n\n    $._ref.google_gke_backup_restore_plan.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_backup_restore_plan.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `backup_plan` (`string`): A reference to the BackupPlan from which Backups may be used\nas the source for Restores created via this RestorePlan.\n  - `cluster` (`string`): The source cluster from which Restores will be created via this RestorePlan.\n  - `description` (`string`): User specified descriptive string for this RestorePlan. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Description: A set of custom labels supplied by the user.\nA list of key-\u0026gt;value pairs.\nExample: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The region of the Restore Plan.\n  - `name` (`string`): The full name of the BackupPlan Resource.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `restore_config` (`list[obj]`): Defines the configuration of Restores created via this RestorePlan. When `null`, the `restore_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_restore_plan.restore_config.new](#fn-restore_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_restore_plan.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     backup_plan,
@@ -31,7 +31,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.gke_backup_restore_plan.newAttrs` constructs a new object with attributes and blocks configured for the `gke_backup_restore_plan`\nTerraform resource.\n\nUnlike [google.gke_backup_restore_plan.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `backup_plan` (`string`): A reference to the BackupPlan from which Backups may be used\nas the source for Restores created via this RestorePlan.\n  - `cluster` (`string`): The source cluster from which Restores will be created via this RestorePlan.\n  - `description` (`string`): User specified descriptive string for this RestorePlan. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Description: A set of custom labels supplied by the user.\nA list of key->value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The region of the Restore Plan.\n  - `name` (`string`): The full name of the BackupPlan Resource.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `restore_config` (`list[obj]`): Defines the configuration of Restores created via this RestorePlan. When `null`, the `restore_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_restore_plan.restore_config.new](#fn-restore_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_restore_plan.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_backup_restore_plan` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.gke_backup_restore_plan.newAttrs` constructs a new object with attributes and blocks configured for the `gke_backup_restore_plan`\nTerraform resource.\n\nUnlike [google.gke_backup_restore_plan.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `backup_plan` (`string`): A reference to the BackupPlan from which Backups may be used\nas the source for Restores created via this RestorePlan.\n  - `cluster` (`string`): The source cluster from which Restores will be created via this RestorePlan.\n  - `description` (`string`): User specified descriptive string for this RestorePlan. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Description: A set of custom labels supplied by the user.\nA list of key->value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The region of the Restore Plan.\n  - `name` (`string`): The full name of the BackupPlan Resource.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `restore_config` (`list[obj]`): Defines the configuration of Restores created via this RestorePlan. When `null`, the `restore_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_restore_plan.restore_config.new](#fn-restore_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_backup_restore_plan.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_backup_restore_plan` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     backup_plan,
     cluster,
diff --git a/4.x/_gen/resources/gke_hub_feature.libsonnet b/4.x/_gen/resources/gke_hub_feature.libsonnet
index 3b691058..35d72e26 100644
--- a/4.x/_gen/resources/gke_hub_feature.libsonnet
+++ b/4.x/_gen/resources/gke_hub_feature.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='gke_hub_feature', url='', help='`gke_hub_feature` represents the `google_gke_hub_feature` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.gke_hub_feature.new` injects a new `google_gke_hub_feature` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_feature.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_feature` using the reference:\n\n    $._ref.google_gke_hub_feature.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_feature.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `labels` (`obj`): GCP labels for this Feature. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The full, unique name of this Feature resource When `null`, the `name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `spec` (`list[obj]`): Optional. Hub-wide Feature configuration. If this Feature does not support any Hub-wide configuration, this field may be unused. When `null`, the `spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.spec.new](#fn-specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.gke_hub_feature.new` injects a new `google_gke_hub_feature` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_feature.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_feature` using the reference:\n\n    $._ref.google_gke_hub_feature.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_feature.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `labels` (`obj`): GCP labels for this Feature.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The full, unique name of this Feature resource When `null`, the `name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `spec` (`list[obj]`): Optional. Hub-wide Feature configuration. If this Feature does not support any Hub-wide configuration, this field may be unused. When `null`, the `spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.spec.new](#fn-specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -25,7 +25,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.gke_hub_feature.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_feature`\nTerraform resource.\n\nUnlike [google.gke_hub_feature.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `labels` (`obj`): GCP labels for this Feature. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The full, unique name of this Feature resource When `null`, the `name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `spec` (`list[obj]`): Optional. Hub-wide Feature configuration. If this Feature does not support any Hub-wide configuration, this field may be unused. When `null`, the `spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.spec.new](#fn-specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_feature` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.gke_hub_feature.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_feature`\nTerraform resource.\n\nUnlike [google.gke_hub_feature.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `labels` (`obj`): GCP labels for this Feature.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The full, unique name of this Feature resource When `null`, the `name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `spec` (`list[obj]`): Optional. Hub-wide Feature configuration. If this Feature does not support any Hub-wide configuration, this field may be unused. When `null`, the `spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.spec.new](#fn-specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_feature.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_feature` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     labels=null,
diff --git a/4.x/_gen/resources/gke_hub_fleet.libsonnet b/4.x/_gen/resources/gke_hub_fleet.libsonnet
new file mode 100644
index 00000000..fe2b1f0c
--- /dev/null
+++ b/4.x/_gen/resources/gke_hub_fleet.libsonnet
@@ -0,0 +1,80 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='gke_hub_fleet', url='', help='`gke_hub_fleet` represents the `google_gke_hub_fleet` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.gke_hub_fleet.new` injects a new `google_gke_hub_fleet` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_fleet.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_fleet` using the reference:\n\n    $._ref.google_gke_hub_fleet.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_fleet.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `display_name` (`string`): A user-assigned display name of the Fleet. When present, it must be between 4 to 30 characters.\nAllowed characters are: lowercase and uppercase letters, numbers, hyphen, single-quote, double-quote, space, and exclamation point. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_fleet.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    display_name=null,
+    project=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_gke_hub_fleet',
+    label=resourceLabel,
+    attrs=self.newAttrs(display_name=display_name, project=project, timeouts=timeouts),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.gke_hub_fleet.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_fleet`\nTerraform resource.\n\nUnlike [google.gke_hub_fleet.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `display_name` (`string`): A user-assigned display name of the Fleet. When present, it must be between 4 to 30 characters.\nAllowed characters are: lowercase and uppercase letters, numbers, hyphen, single-quote, double-quote, space, and exclamation point. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_fleet.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_fleet` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    display_name=null,
+    project=null,
+    timeouts=null
+  ):: std.prune(a={
+    display_name: display_name,
+    project: project,
+    timeouts: timeouts,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.gke_hub_fleet.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withDisplayName':: d.fn(help='`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the display_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `display_name` field.\n', args=[]),
+  withDisplayName(resourceLabel, value): {
+    resource+: {
+      google_gke_hub_fleet+: {
+        [resourceLabel]+: {
+          display_name: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_gke_hub_fleet+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_gke_hub_fleet+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_gke_hub_fleet+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/gke_hub_membership.libsonnet b/4.x/_gen/resources/gke_hub_membership.libsonnet
index f46d56a8..cfa14dc7 100644
--- a/4.x/_gen/resources/gke_hub_membership.libsonnet
+++ b/4.x/_gen/resources/gke_hub_membership.libsonnet
@@ -26,13 +26,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       gke_cluster: gke_cluster,
     }),
   },
-  '#new':: d.fn(help="\n`google.gke_hub_membership.new` injects a new `google_gke_hub_membership` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_membership.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_membership` using the reference:\n\n    $._ref.google_gke_hub_membership.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_membership.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `labels` (`obj`): Labels to apply to this membership. When `null`, the `labels` field will be omitted from the resulting object.\n  - `membership_id` (`string`): The client-provided identifier of the membership.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `authority` (`list[obj]`): Authority encodes how Google will recognize identities from this Membership.\nSee the workload identity documentation for more details:\nhttps://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity When `null`, the `authority` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership.authority.new](#fn-authoritynew) constructor.\n  - `endpoint` (`list[obj]`): If this Membership is a Kubernetes API server hosted on GKE, this is a self link to its GCP resource. When `null`, the `endpoint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership.endpoint.new](#fn-endpointnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.gke_hub_membership.new` injects a new `google_gke_hub_membership` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_membership.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_membership` using the reference:\n\n    $._ref.google_gke_hub_membership.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_membership.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `labels` (`obj`): Labels to apply to this membership.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the membership.\nThe default value is \u0026#39;global\u0026#39;. When `null`, the `location` field will be omitted from the resulting object.\n  - `membership_id` (`string`): The client-provided identifier of the membership.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `authority` (`list[obj]`): Authority encodes how Google will recognize identities from this Membership.\nSee the workload identity documentation for more details:\nhttps://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity When `null`, the `authority` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership.authority.new](#fn-authoritynew) constructor.\n  - `endpoint` (`list[obj]`): If this Membership is a Kubernetes API server hosted on GKE, this is a self link to its GCP resource. When `null`, the `endpoint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership.endpoint.new](#fn-endpointnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     membership_id,
     authority=null,
     endpoint=null,
     labels=null,
+    location=null,
     project=null,
     timeouts=null,
     _meta={}
@@ -43,24 +44,27 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       authority=authority,
       endpoint=endpoint,
       labels=labels,
+      location=location,
       membership_id=membership_id,
       project=project,
       timeouts=timeouts
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.gke_hub_membership.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_membership`\nTerraform resource.\n\nUnlike [google.gke_hub_membership.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `labels` (`obj`): Labels to apply to this membership. When `null`, the `labels` field will be omitted from the resulting object.\n  - `membership_id` (`string`): The client-provided identifier of the membership.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `authority` (`list[obj]`): Authority encodes how Google will recognize identities from this Membership.\nSee the workload identity documentation for more details:\nhttps://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity When `null`, the `authority` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership.authority.new](#fn-authoritynew) constructor.\n  - `endpoint` (`list[obj]`): If this Membership is a Kubernetes API server hosted on GKE, this is a self link to its GCP resource. When `null`, the `endpoint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership.endpoint.new](#fn-endpointnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_membership` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.gke_hub_membership.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_membership`\nTerraform resource.\n\nUnlike [google.gke_hub_membership.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `labels` (`obj`): Labels to apply to this membership.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the membership.\nThe default value is 'global'. When `null`, the `location` field will be omitted from the resulting object.\n  - `membership_id` (`string`): The client-provided identifier of the membership.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `authority` (`list[obj]`): Authority encodes how Google will recognize identities from this Membership.\nSee the workload identity documentation for more details:\nhttps://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity When `null`, the `authority` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership.authority.new](#fn-authoritynew) constructor.\n  - `endpoint` (`list[obj]`): If this Membership is a Kubernetes API server hosted on GKE, this is a self link to its GCP resource. When `null`, the `endpoint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership.endpoint.new](#fn-endpointnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_membership` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     membership_id,
     authority=null,
     endpoint=null,
     labels=null,
+    location=null,
     project=null,
     timeouts=null
   ):: std.prune(a={
     authority: authority,
     endpoint: endpoint,
     labels: labels,
+    location: location,
     membership_id: membership_id,
     project: project,
     timeouts: timeouts,
@@ -127,6 +131,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_gke_hub_membership+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
   '#withMembershipId':: d.fn(help='`google.string.withMembershipId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the membership_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `membership_id` field.\n', args=[]),
   withMembershipId(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/gke_hub_membership_binding.libsonnet b/4.x/_gen/resources/gke_hub_membership_binding.libsonnet
index 4fa7479d..142328bf 100644
--- a/4.x/_gen/resources/gke_hub_membership_binding.libsonnet
+++ b/4.x/_gen/resources/gke_hub_membership_binding.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='gke_hub_membership_binding', url='', help='`gke_hub_membership_binding` represents the `google_gke_hub_membership_binding` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.gke_hub_membership_binding.new` injects a new `google_gke_hub_membership_binding` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_membership_binding.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_membership_binding` using the reference:\n\n    $._ref.google_gke_hub_membership_binding.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_membership_binding.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `labels` (`obj`): Labels for this Membership binding. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the membership\n  - `membership_binding_id` (`string`): The client-provided identifier of the membership binding.\n  - `membership_id` (`string`): Id of the membership\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope` (`string`): A Workspace resource name in the format\n\u0026#39;projects/*/locations/*/scopes/*\u0026#39;.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership_binding.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.gke_hub_membership_binding.new` injects a new `google_gke_hub_membership_binding` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_membership_binding.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_membership_binding` using the reference:\n\n    $._ref.google_gke_hub_membership_binding.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_membership_binding.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `labels` (`obj`): Labels for this Membership binding.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the membership\n  - `membership_binding_id` (`string`): The client-provided identifier of the membership binding.\n  - `membership_id` (`string`): Id of the membership\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope` (`string`): A Workspace resource name in the format\n\u0026#39;projects/*/locations/*/scopes/*\u0026#39;.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership_binding.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -27,7 +27,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.gke_hub_membership_binding.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_membership_binding`\nTerraform resource.\n\nUnlike [google.gke_hub_membership_binding.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `labels` (`obj`): Labels for this Membership binding. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the membership\n  - `membership_binding_id` (`string`): The client-provided identifier of the membership binding.\n  - `membership_id` (`string`): Id of the membership\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope` (`string`): A Workspace resource name in the format\n'projects/*/locations/*/scopes/*'.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership_binding.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_membership_binding` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.gke_hub_membership_binding.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_membership_binding`\nTerraform resource.\n\nUnlike [google.gke_hub_membership_binding.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `labels` (`obj`): Labels for this Membership binding.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the membership\n  - `membership_binding_id` (`string`): The client-provided identifier of the membership binding.\n  - `membership_id` (`string`): Id of the membership\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope` (`string`): A Workspace resource name in the format\n'projects/*/locations/*/scopes/*'.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership_binding.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_membership_binding` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     membership_binding_id,
diff --git a/4.x/_gen/resources/gke_hub_membership_iam_binding.libsonnet b/4.x/_gen/resources/gke_hub_membership_iam_binding.libsonnet
index d90880f3..ca9ebfa1 100644
--- a/4.x/_gen/resources/gke_hub_membership_iam_binding.libsonnet
+++ b/4.x/_gen/resources/gke_hub_membership_iam_binding.libsonnet
@@ -14,13 +14,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       title: title,
     }),
   },
-  '#new':: d.fn(help="\n`google.gke_hub_membership_iam_binding.new` injects a new `google_gke_hub_membership_iam_binding` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_membership_iam_binding.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_membership_iam_binding` using the reference:\n\n    $._ref.google_gke_hub_membership_iam_binding.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_membership_iam_binding.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `members` (`list`): Set the `members` field on the resulting resource block.\n  - `membership_id` (`string`): Set the `membership_id` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting resource block.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership_iam_binding.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.gke_hub_membership_iam_binding.new` injects a new `google_gke_hub_membership_iam_binding` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_membership_iam_binding.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_membership_iam_binding` using the reference:\n\n    $._ref.google_gke_hub_membership_iam_binding.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_membership_iam_binding.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.\n  - `members` (`list`): Set the `members` field on the resulting resource block.\n  - `membership_id` (`string`): Set the `membership_id` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting resource block.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership_iam_binding.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     members,
     membership_id,
     role,
     condition=null,
+    location=null,
     project=null,
     _meta={}
   ):: tf.withResource(
@@ -28,6 +29,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     label=resourceLabel,
     attrs=self.newAttrs(
       condition=condition,
+      location=location,
       members=members,
       membership_id=membership_id,
       project=project,
@@ -35,15 +37,17 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.gke_hub_membership_iam_binding.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_membership_iam_binding`\nTerraform resource.\n\nUnlike [google.gke_hub_membership_iam_binding.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `members` (`list`): Set the `members` field on the resulting object.\n  - `membership_id` (`string`): Set the `membership_id` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting object.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership_iam_binding.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_membership_iam_binding` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.gke_hub_membership_iam_binding.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_membership_iam_binding`\nTerraform resource.\n\nUnlike [google.gke_hub_membership_iam_binding.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.\n  - `members` (`list`): Set the `members` field on the resulting object.\n  - `membership_id` (`string`): Set the `membership_id` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting object.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership_iam_binding.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_membership_iam_binding` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     members,
     membership_id,
     role,
     condition=null,
+    location=null,
     project=null
   ):: std.prune(a={
     condition: condition,
+    location: location,
     members: members,
     membership_id: membership_id,
     project: project,
@@ -69,6 +73,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_gke_hub_membership_iam_binding+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
   '#withMembers':: d.fn(help='`google.list.withMembers` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the members field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `members` field.\n', args=[]),
   withMembers(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/gke_hub_membership_iam_member.libsonnet b/4.x/_gen/resources/gke_hub_membership_iam_member.libsonnet
index 6f3a6aae..dcc80bb6 100644
--- a/4.x/_gen/resources/gke_hub_membership_iam_member.libsonnet
+++ b/4.x/_gen/resources/gke_hub_membership_iam_member.libsonnet
@@ -14,13 +14,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       title: title,
     }),
   },
-  '#new':: d.fn(help="\n`google.gke_hub_membership_iam_member.new` injects a new `google_gke_hub_membership_iam_member` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_membership_iam_member.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_membership_iam_member` using the reference:\n\n    $._ref.google_gke_hub_membership_iam_member.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_membership_iam_member.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `member` (`string`): Set the `member` field on the resulting resource block.\n  - `membership_id` (`string`): Set the `membership_id` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting resource block.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership_iam_member.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.gke_hub_membership_iam_member.new` injects a new `google_gke_hub_membership_iam_member` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_membership_iam_member.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_membership_iam_member` using the reference:\n\n    $._ref.google_gke_hub_membership_iam_member.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_membership_iam_member.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.\n  - `member` (`string`): Set the `member` field on the resulting resource block.\n  - `membership_id` (`string`): Set the `membership_id` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting resource block.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership_iam_member.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     member,
     membership_id,
     role,
     condition=null,
+    location=null,
     project=null,
     _meta={}
   ):: tf.withResource(
@@ -28,6 +29,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     label=resourceLabel,
     attrs=self.newAttrs(
       condition=condition,
+      location=location,
       member=member,
       membership_id=membership_id,
       project=project,
@@ -35,15 +37,17 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.gke_hub_membership_iam_member.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_membership_iam_member`\nTerraform resource.\n\nUnlike [google.gke_hub_membership_iam_member.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `member` (`string`): Set the `member` field on the resulting object.\n  - `membership_id` (`string`): Set the `membership_id` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting object.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership_iam_member.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_membership_iam_member` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.gke_hub_membership_iam_member.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_membership_iam_member`\nTerraform resource.\n\nUnlike [google.gke_hub_membership_iam_member.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.\n  - `member` (`string`): Set the `member` field on the resulting object.\n  - `membership_id` (`string`): Set the `membership_id` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting object.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_membership_iam_member.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_membership_iam_member` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     member,
     membership_id,
     role,
     condition=null,
+    location=null,
     project=null
   ):: std.prune(a={
     condition: condition,
+    location: location,
     member: member,
     membership_id: membership_id,
     project: project,
@@ -69,6 +73,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_gke_hub_membership_iam_member+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
   '#withMember':: d.fn(help='`google.string.withMember` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the member field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `member` field.\n', args=[]),
   withMember(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/gke_hub_membership_iam_policy.libsonnet b/4.x/_gen/resources/gke_hub_membership_iam_policy.libsonnet
index 91d4e4a2..583ab28d 100644
--- a/4.x/_gen/resources/gke_hub_membership_iam_policy.libsonnet
+++ b/4.x/_gen/resources/gke_hub_membership_iam_policy.libsonnet
@@ -2,29 +2,47 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='gke_hub_membership_iam_policy', url='', help='`gke_hub_membership_iam_policy` represents the `google_gke_hub_membership_iam_policy` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.gke_hub_membership_iam_policy.new` injects a new `google_gke_hub_membership_iam_policy` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_membership_iam_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_membership_iam_policy` using the reference:\n\n    $._ref.google_gke_hub_membership_iam_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_membership_iam_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `membership_id` (`string`): Set the `membership_id` field on the resulting resource block.\n  - `policy_data` (`string`): Set the `policy_data` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.gke_hub_membership_iam_policy.new` injects a new `google_gke_hub_membership_iam_policy` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_membership_iam_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_membership_iam_policy` using the reference:\n\n    $._ref.google_gke_hub_membership_iam_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_membership_iam_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.\n  - `membership_id` (`string`): Set the `membership_id` field on the resulting resource block.\n  - `policy_data` (`string`): Set the `policy_data` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     membership_id,
     policy_data,
+    location=null,
     project=null,
     _meta={}
   ):: tf.withResource(
     type='google_gke_hub_membership_iam_policy',
     label=resourceLabel,
-    attrs=self.newAttrs(membership_id=membership_id, policy_data=policy_data, project=project),
+    attrs=self.newAttrs(
+      location=location,
+      membership_id=membership_id,
+      policy_data=policy_data,
+      project=project
+    ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.gke_hub_membership_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_membership_iam_policy`\nTerraform resource.\n\nUnlike [google.gke_hub_membership_iam_policy.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `membership_id` (`string`): Set the `membership_id` field on the resulting object.\n  - `policy_data` (`string`): Set the `policy_data` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_membership_iam_policy` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.gke_hub_membership_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_membership_iam_policy`\nTerraform resource.\n\nUnlike [google.gke_hub_membership_iam_policy.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.\n  - `membership_id` (`string`): Set the `membership_id` field on the resulting object.\n  - `policy_data` (`string`): Set the `policy_data` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_membership_iam_policy` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     membership_id,
     policy_data,
+    location=null,
     project=null
   ):: std.prune(a={
+    location: location,
     membership_id: membership_id,
     policy_data: policy_data,
     project: project,
   }),
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_gke_hub_membership_iam_policy+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
   '#withMembershipId':: d.fn(help='`google.string.withMembershipId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the membership_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `membership_id` field.\n', args=[]),
   withMembershipId(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/gke_hub_namespace.libsonnet b/4.x/_gen/resources/gke_hub_namespace.libsonnet
index 90b8958b..08312380 100644
--- a/4.x/_gen/resources/gke_hub_namespace.libsonnet
+++ b/4.x/_gen/resources/gke_hub_namespace.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='gke_hub_namespace', url='', help='`gke_hub_namespace` represents the `google_gke_hub_namespace` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.gke_hub_namespace.new` injects a new `google_gke_hub_namespace` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_namespace.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_namespace` using the reference:\n\n    $._ref.google_gke_hub_namespace.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_namespace.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `labels` (`obj`): Labels for this Namespace. When `null`, the `labels` field will be omitted from the resulting object.\n  - `namespace_labels` (`obj`): Namespace-level cluster namespace labels. These labels are applied\nto the related namespace of the member clusters bound to the parent\nScope. Scope-level labels (\u0026#39;namespace_labels\u0026#39; in the Fleet Scope\nresource) take precedence over Namespace-level labels if they share\na key. Keys and values must be Kubernetes-conformant. When `null`, the `namespace_labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope` (`string`): The name of the Scope instance.\n  - `scope_id` (`string`): Id of the scope\n  - `scope_namespace_id` (`string`): The client-provided identifier of the namespace.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_namespace.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.gke_hub_namespace.new` injects a new `google_gke_hub_namespace` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_namespace.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_namespace` using the reference:\n\n    $._ref.google_gke_hub_namespace.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_namespace.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `labels` (`obj`): Labels for this Namespace.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `namespace_labels` (`obj`): Namespace-level cluster namespace labels. These labels are applied\nto the related namespace of the member clusters bound to the parent\nScope. Scope-level labels (\u0026#39;namespace_labels\u0026#39; in the Fleet Scope\nresource) take precedence over Namespace-level labels if they share\na key. Keys and values must be Kubernetes-conformant. When `null`, the `namespace_labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope` (`string`): The name of the Scope instance.\n  - `scope_id` (`string`): Id of the scope\n  - `scope_namespace_id` (`string`): The client-provided identifier of the namespace.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_namespace.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     scope,
@@ -27,7 +27,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.gke_hub_namespace.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_namespace`\nTerraform resource.\n\nUnlike [google.gke_hub_namespace.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `labels` (`obj`): Labels for this Namespace. When `null`, the `labels` field will be omitted from the resulting object.\n  - `namespace_labels` (`obj`): Namespace-level cluster namespace labels. These labels are applied\nto the related namespace of the member clusters bound to the parent\nScope. Scope-level labels ('namespace_labels' in the Fleet Scope\nresource) take precedence over Namespace-level labels if they share\na key. Keys and values must be Kubernetes-conformant. When `null`, the `namespace_labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope` (`string`): The name of the Scope instance.\n  - `scope_id` (`string`): Id of the scope\n  - `scope_namespace_id` (`string`): The client-provided identifier of the namespace.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_namespace.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_namespace` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.gke_hub_namespace.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_namespace`\nTerraform resource.\n\nUnlike [google.gke_hub_namespace.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `labels` (`obj`): Labels for this Namespace.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `namespace_labels` (`obj`): Namespace-level cluster namespace labels. These labels are applied\nto the related namespace of the member clusters bound to the parent\nScope. Scope-level labels ('namespace_labels' in the Fleet Scope\nresource) take precedence over Namespace-level labels if they share\na key. Keys and values must be Kubernetes-conformant. When `null`, the `namespace_labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope` (`string`): The name of the Scope instance.\n  - `scope_id` (`string`): Id of the scope\n  - `scope_namespace_id` (`string`): The client-provided identifier of the namespace.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_namespace.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_namespace` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     scope,
     scope_id,
diff --git a/4.x/_gen/resources/gke_hub_scope.libsonnet b/4.x/_gen/resources/gke_hub_scope.libsonnet
index 493826c0..0ccbd3db 100644
--- a/4.x/_gen/resources/gke_hub_scope.libsonnet
+++ b/4.x/_gen/resources/gke_hub_scope.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='gke_hub_scope', url='', help='`gke_hub_scope` represents the `google_gke_hub_scope` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.gke_hub_scope.new` injects a new `google_gke_hub_scope` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_scope.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_scope` using the reference:\n\n    $._ref.google_gke_hub_scope.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_scope.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `labels` (`obj`): Labels for this Scope. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope_id` (`string`): The client-provided identifier of the scope.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_scope.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.gke_hub_scope.new` injects a new `google_gke_hub_scope` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_scope.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_scope` using the reference:\n\n    $._ref.google_gke_hub_scope.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_scope.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `labels` (`obj`): Labels for this Scope.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope_id` (`string`): The client-provided identifier of the scope.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_scope.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     scope_id,
@@ -21,7 +21,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.gke_hub_scope.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_scope`\nTerraform resource.\n\nUnlike [google.gke_hub_scope.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `labels` (`obj`): Labels for this Scope. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope_id` (`string`): The client-provided identifier of the scope.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_scope.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_scope` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.gke_hub_scope.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_scope`\nTerraform resource.\n\nUnlike [google.gke_hub_scope.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `labels` (`obj`): Labels for this Scope.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope_id` (`string`): The client-provided identifier of the scope.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_scope.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_scope` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     scope_id,
     labels=null,
diff --git a/4.x/_gen/resources/gke_hub_scope_rbac_role_binding.libsonnet b/4.x/_gen/resources/gke_hub_scope_rbac_role_binding.libsonnet
index b29adb17..4b7d2536 100644
--- a/4.x/_gen/resources/gke_hub_scope_rbac_role_binding.libsonnet
+++ b/4.x/_gen/resources/gke_hub_scope_rbac_role_binding.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='gke_hub_scope_rbac_role_binding', url='', help='`gke_hub_scope_rbac_role_binding` represents the `google_gke_hub_scope_rbac_role_binding` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.gke_hub_scope_rbac_role_binding.new` injects a new `google_gke_hub_scope_rbac_role_binding` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_scope_rbac_role_binding.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_scope_rbac_role_binding` using the reference:\n\n    $._ref.google_gke_hub_scope_rbac_role_binding.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_scope_rbac_role_binding.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `group` (`string`): Principal that is be authorized in the cluster (at least of one the oneof\nis required). Updating one will unset the other automatically.\ngroup is the group, as seen by the kubernetes cluster. When `null`, the `group` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels for this ScopeRBACRoleBinding. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope_id` (`string`): Id of the scope\n  - `scope_rbac_role_binding_id` (`string`): The client-provided identifier of the RBAC Role Binding.\n  - `user` (`string`): Principal that is be authorized in the cluster (at least of one the oneof\nis required). Updating one will unset the other automatically.\nuser is the name of the user as seen by the kubernetes cluster, example\n\u0026#34;alice\u0026#34; or \u0026#34;alice@domain.tld\u0026#34; When `null`, the `user` field will be omitted from the resulting object.\n  - `role` (`list[obj]`): Role to bind to the principal. When `null`, the `role` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_scope_rbac_role_binding.role.new](#fn-rolenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_scope_rbac_role_binding.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.gke_hub_scope_rbac_role_binding.new` injects a new `google_gke_hub_scope_rbac_role_binding` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gke_hub_scope_rbac_role_binding.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gke_hub_scope_rbac_role_binding` using the reference:\n\n    $._ref.google_gke_hub_scope_rbac_role_binding.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gke_hub_scope_rbac_role_binding.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `group` (`string`): Principal that is be authorized in the cluster (at least of one the oneof\nis required). Updating one will unset the other automatically.\ngroup is the group, as seen by the kubernetes cluster. When `null`, the `group` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels for this ScopeRBACRoleBinding.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope_id` (`string`): Id of the scope\n  - `scope_rbac_role_binding_id` (`string`): The client-provided identifier of the RBAC Role Binding.\n  - `user` (`string`): Principal that is be authorized in the cluster (at least of one the oneof\nis required). Updating one will unset the other automatically.\nuser is the name of the user as seen by the kubernetes cluster, example\n\u0026#34;alice\u0026#34; or \u0026#34;alice@domain.tld\u0026#34; When `null`, the `user` field will be omitted from the resulting object.\n  - `role` (`list[obj]`): Role to bind to the principal. When `null`, the `role` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_scope_rbac_role_binding.role.new](#fn-rolenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_scope_rbac_role_binding.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     scope_id,
@@ -29,7 +29,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.gke_hub_scope_rbac_role_binding.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_scope_rbac_role_binding`\nTerraform resource.\n\nUnlike [google.gke_hub_scope_rbac_role_binding.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `group` (`string`): Principal that is be authorized in the cluster (at least of one the oneof\nis required). Updating one will unset the other automatically.\ngroup is the group, as seen by the kubernetes cluster. When `null`, the `group` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels for this ScopeRBACRoleBinding. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope_id` (`string`): Id of the scope\n  - `scope_rbac_role_binding_id` (`string`): The client-provided identifier of the RBAC Role Binding.\n  - `user` (`string`): Principal that is be authorized in the cluster (at least of one the oneof\nis required). Updating one will unset the other automatically.\nuser is the name of the user as seen by the kubernetes cluster, example\n"alice" or "alice@domain.tld" When `null`, the `user` field will be omitted from the resulting object.\n  - `role` (`list[obj]`): Role to bind to the principal. When `null`, the `role` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_scope_rbac_role_binding.role.new](#fn-rolenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_scope_rbac_role_binding.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_scope_rbac_role_binding` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.gke_hub_scope_rbac_role_binding.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_scope_rbac_role_binding`\nTerraform resource.\n\nUnlike [google.gke_hub_scope_rbac_role_binding.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `group` (`string`): Principal that is be authorized in the cluster (at least of one the oneof\nis required). Updating one will unset the other automatically.\ngroup is the group, as seen by the kubernetes cluster. When `null`, the `group` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels for this ScopeRBACRoleBinding.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope_id` (`string`): Id of the scope\n  - `scope_rbac_role_binding_id` (`string`): The client-provided identifier of the RBAC Role Binding.\n  - `user` (`string`): Principal that is be authorized in the cluster (at least of one the oneof\nis required). Updating one will unset the other automatically.\nuser is the name of the user as seen by the kubernetes cluster, example\n"alice" or "alice@domain.tld" When `null`, the `user` field will be omitted from the resulting object.\n  - `role` (`list[obj]`): Role to bind to the principal. When `null`, the `role` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_scope_rbac_role_binding.role.new](#fn-rolenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_scope_rbac_role_binding.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_scope_rbac_role_binding` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     scope_id,
     scope_rbac_role_binding_id,
diff --git a/4.x/_gen/resources/gkeonprem_bare_metal_admin_cluster.libsonnet b/4.x/_gen/resources/gkeonprem_bare_metal_admin_cluster.libsonnet
new file mode 100644
index 00000000..80161359
--- /dev/null
+++ b/4.x/_gen/resources/gkeonprem_bare_metal_admin_cluster.libsonnet
@@ -0,0 +1,604 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='gkeonprem_bare_metal_admin_cluster', url='', help='`gkeonprem_bare_metal_admin_cluster` represents the `google_gkeonprem_bare_metal_admin_cluster` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  cluster_operations:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.cluster_operations.new` constructs a new object with attributes and blocks configured for the `cluster_operations`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enable_application_logs` (`bool`): Whether collection of application logs/metrics should be enabled (in addition to system logs/metrics). When `null`, the `enable_application_logs` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `cluster_operations` sub block.\n', args=[]),
+    new(
+      enable_application_logs=null
+    ):: std.prune(a={
+      enable_application_logs: enable_application_logs,
+    }),
+  },
+  control_plane:: {
+    api_server_args:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.control_plane.api_server_args.new` constructs a new object with attributes and blocks configured for the `api_server_args`\nTerraform sub block.\n\n\n\n**Args**:\n  - `argument` (`string`): The argument name as it appears on the API Server command line please make sure to remove the leading dashes.\n  - `value` (`string`): The value of the arg as it will be passed to the API Server command line.\n\n**Returns**:\n  - An attribute object that represents the `api_server_args` sub block.\n', args=[]),
+      new(
+        argument,
+        value
+      ):: std.prune(a={
+        argument: argument,
+        value: value,
+      }),
+    },
+    control_plane_node_pool_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.control_plane.control_plane_node_pool_config.new` constructs a new object with attributes and blocks configured for the `control_plane_node_pool_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `node_pool_config` (`list[obj]`): The generic configuration for a node pool running the control plane. When `null`, the `node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.control_plane.control_plane_node_pool_config.node_pool_config.new](#fn-control_planecontrol_planenode_pool_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `control_plane_node_pool_config` sub block.\n', args=[]),
+      new(
+        node_pool_config=null
+      ):: std.prune(a={
+        node_pool_config: node_pool_config,
+      }),
+      node_pool_config:: {
+        '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.control_plane.control_plane_node_pool_config.node_pool_config.new` constructs a new object with attributes and blocks configured for the `node_pool_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to\neach node. These will added in addition to any default label(s)\nthat Kubernetes may apply to the node. In case of conflict in\nlabel keys, the applied set may differ depending on the Kubernetes\nversion -- it's best to assume the behavior is undefined and\nconflicts should be avoided. For more information, including usage\nand the valid values, see:\n  http://kubernetes.io/v1.1/docs/user-guide/labels.html\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `operating_system` (`string`): Specifies the nodes operating system (default: LINUX). When `null`, the `operating_system` field will be omitted from the resulting object.\n  - `node_configs` (`list[obj]`): The list of machine addresses in the Bare Metal Node Pool. When `null`, the `node_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.control_plane.control_plane_node_pool_config.node_pool_config.node_configs.new](#fn-control_planecontrol_planecontrol_plane_node_pool_confignode_configsnew) constructor.\n  - `taints` (`list[obj]`): The initial taints assigned to nodes of this node pool. When `null`, the `taints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.control_plane.control_plane_node_pool_config.node_pool_config.taints.new](#fn-control_planecontrol_planecontrol_plane_node_pool_configtaintsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `node_pool_config` sub block.\n', args=[]),
+        new(
+          labels=null,
+          node_configs=null,
+          operating_system=null,
+          taints=null
+        ):: std.prune(a={
+          labels: labels,
+          node_configs: node_configs,
+          operating_system: operating_system,
+          taints: taints,
+        }),
+        node_configs:: {
+          '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.control_plane.control_plane_node_pool_config.node_pool_config.node_configs.new` constructs a new object with attributes and blocks configured for the `node_configs`\nTerraform sub block.\n\n\n\n**Args**:\n  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to\neach node. These will added in addition to any default label(s)\nthat Kubernetes may apply to the node. In case of conflict in\nlabel keys, the applied set may differ depending on the Kubernetes\nversion -- it's best to assume the behavior is undefined and\nconflicts should be avoided. For more information, including usage\nand the valid values, see:\n  http://kubernetes.io/v1.1/docs/user-guide/labels.html\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `node_ip` (`string`): The default IPv4 address for SSH access and Kubernetes node.\nExample: 192.168.0.1 When `null`, the `node_ip` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `node_configs` sub block.\n', args=[]),
+          new(
+            labels=null,
+            node_ip=null
+          ):: std.prune(a={
+            labels: labels,
+            node_ip: node_ip,
+          }),
+        },
+        taints:: {
+          '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.control_plane.control_plane_node_pool_config.node_pool_config.taints.new` constructs a new object with attributes and blocks configured for the `taints`\nTerraform sub block.\n\n\n\n**Args**:\n  - `effect` (`string`): Specifies the nodes operating system (default: LINUX). Possible values: ["EFFECT_UNSPECIFIED", "PREFER_NO_SCHEDULE", "NO_EXECUTE"] When `null`, the `effect` field will be omitted from the resulting object.\n  - `key` (`string`): Key associated with the effect. When `null`, the `key` field will be omitted from the resulting object.\n  - `value` (`string`): Value associated with the effect. When `null`, the `value` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `taints` sub block.\n', args=[]),
+          new(
+            effect=null,
+            key=null,
+            value=null
+          ):: std.prune(a={
+            effect: effect,
+            key: key,
+            value: value,
+          }),
+        },
+      },
+    },
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.control_plane.new` constructs a new object with attributes and blocks configured for the `control_plane`\nTerraform sub block.\n\n\n\n**Args**:\n  - `api_server_args` (`list[obj]`): Customizes the default API server args. Only a subset of\ncustomized flags are supported. Please refer to the API server\ndocumentation below to know the exact format:\nhttps://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/ When `null`, the `api_server_args` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.control_plane.api_server_args.new](#fn-control_planeapi_server_argsnew) constructor.\n  - `control_plane_node_pool_config` (`list[obj]`): Configures the node pool running the control plane. If specified the corresponding NodePool will be created for the cluster's control plane. The NodePool will have the same name and namespace as the cluster. When `null`, the `control_plane_node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.control_plane.control_plane_node_pool_config.new](#fn-control_planecontrol_plane_node_pool_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `control_plane` sub block.\n', args=[]),
+    new(
+      api_server_args=null,
+      control_plane_node_pool_config=null
+    ):: std.prune(a={
+      api_server_args: api_server_args,
+      control_plane_node_pool_config: control_plane_node_pool_config,
+    }),
+  },
+  load_balancer:: {
+    manual_lb_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.load_balancer.manual_lb_config.new` constructs a new object with attributes and blocks configured for the `manual_lb_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): Whether manual load balancing is enabled.\n\n**Returns**:\n  - An attribute object that represents the `manual_lb_config` sub block.\n', args=[]),
+      new(
+        enabled
+      ):: std.prune(a={
+        enabled: enabled,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.load_balancer.new` constructs a new object with attributes and blocks configured for the `load_balancer`\nTerraform sub block.\n\n\n\n**Args**:\n  - `manual_lb_config` (`list[obj]`): A nested object resource When `null`, the `manual_lb_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.load_balancer.manual_lb_config.new](#fn-load_balancermanual_lb_confignew) constructor.\n  - `port_config` (`list[obj]`): Specifies the load balancer ports. When `null`, the `port_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.load_balancer.port_config.new](#fn-load_balancerport_confignew) constructor.\n  - `vip_config` (`list[obj]`): Specified the Bare Metal Load Balancer Config When `null`, the `vip_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.load_balancer.vip_config.new](#fn-load_balancervip_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `load_balancer` sub block.\n', args=[]),
+    new(
+      manual_lb_config=null,
+      port_config=null,
+      vip_config=null
+    ):: std.prune(a={
+      manual_lb_config: manual_lb_config,
+      port_config: port_config,
+      vip_config: vip_config,
+    }),
+    port_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.load_balancer.port_config.new` constructs a new object with attributes and blocks configured for the `port_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `control_plane_load_balancer_port` (`number`): The port that control plane hosted load balancers will listen on.\n\n**Returns**:\n  - An attribute object that represents the `port_config` sub block.\n', args=[]),
+      new(
+        control_plane_load_balancer_port
+      ):: std.prune(a={
+        control_plane_load_balancer_port: control_plane_load_balancer_port,
+      }),
+    },
+    vip_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.load_balancer.vip_config.new` constructs a new object with attributes and blocks configured for the `vip_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `control_plane_vip` (`string`): The VIP which you previously set aside for the Kubernetes API of this Bare Metal Admin Cluster.\n\n**Returns**:\n  - An attribute object that represents the `vip_config` sub block.\n', args=[]),
+      new(
+        control_plane_vip
+      ):: std.prune(a={
+        control_plane_vip: control_plane_vip,
+      }),
+    },
+  },
+  maintenance_config:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.maintenance_config.new` constructs a new object with attributes and blocks configured for the `maintenance_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `maintenance_address_cidr_blocks` (`list`): All IPv4 address from these ranges will be placed into maintenance mode.\nNodes in maintenance mode will be cordoned and drained. When both of these\nare true, the "baremetal.cluster.gke.io/maintenance" annotation will be set\non the node resource.\n\n**Returns**:\n  - An attribute object that represents the `maintenance_config` sub block.\n', args=[]),
+    new(
+      maintenance_address_cidr_blocks
+    ):: std.prune(a={
+      maintenance_address_cidr_blocks: maintenance_address_cidr_blocks,
+    }),
+  },
+  network_config:: {
+    island_mode_cidr:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.network_config.island_mode_cidr.new` constructs a new object with attributes and blocks configured for the `island_mode_cidr`\nTerraform sub block.\n\n\n\n**Args**:\n  - `pod_address_cidr_blocks` (`list`): All pods in the cluster are assigned an RFC1918 IPv4 address from these ranges. This field cannot be changed after creation.\n  - `service_address_cidr_blocks` (`list`): All services in the cluster are assigned an RFC1918 IPv4 address from these ranges. This field cannot be changed after creation.\n\n**Returns**:\n  - An attribute object that represents the `island_mode_cidr` sub block.\n', args=[]),
+      new(
+        pod_address_cidr_blocks,
+        service_address_cidr_blocks
+      ):: std.prune(a={
+        pod_address_cidr_blocks: pod_address_cidr_blocks,
+        service_address_cidr_blocks: service_address_cidr_blocks,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.network_config.new` constructs a new object with attributes and blocks configured for the `network_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `island_mode_cidr` (`list[obj]`): A nested object resource When `null`, the `island_mode_cidr` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.network_config.island_mode_cidr.new](#fn-network_configisland_mode_cidrnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `network_config` sub block.\n', args=[]),
+    new(
+      island_mode_cidr=null
+    ):: std.prune(a={
+      island_mode_cidr: island_mode_cidr,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.gkeonprem_bare_metal_admin_cluster.new` injects a new `google_gkeonprem_bare_metal_admin_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gkeonprem_bare_metal_admin_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gkeonprem_bare_metal_admin_cluster` using the reference:\n\n    $._ref.google_gkeonprem_bare_metal_admin_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gkeonprem_bare_metal_admin_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Annotations on the Bare Metal Admin Cluster.\nThis field has the same restrictions as Kubernetes annotations.\nThe total size of all keys and values combined is limited to 256k.\nKey can have 2 segments: prefix (optional) and name (required),\nseparated by a slash (/).\nPrefix must be a DNS subdomain.\nName must be 63 characters or less, begin and end with alphanumerics,\nwith dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field \u0026#39;effective_annotations\u0026#39; for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `bare_metal_version` (`string`): A human readable description of this Bare Metal Admin Cluster. When `null`, the `bare_metal_version` field will be omitted from the resulting object.\n  - `description` (`string`): A human readable description of this Bare Metal Admin Cluster. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the resource.\n  - `name` (`string`): The bare metal admin cluster name.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `cluster_operations` (`list[obj]`): Specifies the Admin Cluster\u0026#39;s observability infrastructure. When `null`, the `cluster_operations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.cluster_operations.new](#fn-cluster_operationsnew) constructor.\n  - `control_plane` (`list[obj]`): Specifies the control plane configuration. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.control_plane.new](#fn-control_planenew) constructor.\n  - `load_balancer` (`list[obj]`): Specifies the load balancer configuration. When `null`, the `load_balancer` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.load_balancer.new](#fn-load_balancernew) constructor.\n  - `maintenance_config` (`list[obj]`): Specifies the workload node configurations. When `null`, the `maintenance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.maintenance_config.new](#fn-maintenance_confignew) constructor.\n  - `network_config` (`list[obj]`): Network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.network_config.new](#fn-network_confignew) constructor.\n  - `node_access_config` (`list[obj]`): Specifies the node access related settings for the bare metal user cluster. When `null`, the `node_access_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.node_access_config.new](#fn-node_access_confignew) constructor.\n  - `node_config` (`list[obj]`): Specifies the workload node configurations. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.node_config.new](#fn-node_confignew) constructor.\n  - `proxy` (`list[obj]`): Specifies the cluster proxy configuration. When `null`, the `proxy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.proxy.new](#fn-proxynew) constructor.\n  - `security_config` (`list[obj]`): Specifies the security related settings for the Bare Metal User Cluster. When `null`, the `security_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.security_config.new](#fn-security_confignew) constructor.\n  - `storage` (`list[obj]`): Specifies the cluster storage configuration. When `null`, the `storage` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.storage.new](#fn-storagenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    location,
+    name,
+    annotations=null,
+    bare_metal_version=null,
+    cluster_operations=null,
+    control_plane=null,
+    description=null,
+    load_balancer=null,
+    maintenance_config=null,
+    network_config=null,
+    node_access_config=null,
+    node_config=null,
+    project=null,
+    proxy=null,
+    security_config=null,
+    storage=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_gkeonprem_bare_metal_admin_cluster',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      annotations=annotations,
+      bare_metal_version=bare_metal_version,
+      cluster_operations=cluster_operations,
+      control_plane=control_plane,
+      description=description,
+      load_balancer=load_balancer,
+      location=location,
+      maintenance_config=maintenance_config,
+      name=name,
+      network_config=network_config,
+      node_access_config=node_access_config,
+      node_config=node_config,
+      project=project,
+      proxy=proxy,
+      security_config=security_config,
+      storage=storage,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `gkeonprem_bare_metal_admin_cluster`\nTerraform resource.\n\nUnlike [google.gkeonprem_bare_metal_admin_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Annotations on the Bare Metal Admin Cluster.\nThis field has the same restrictions as Kubernetes annotations.\nThe total size of all keys and values combined is limited to 256k.\nKey can have 2 segments: prefix (optional) and name (required),\nseparated by a slash (/).\nPrefix must be a DNS subdomain.\nName must be 63 characters or less, begin and end with alphanumerics,\nwith dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `bare_metal_version` (`string`): A human readable description of this Bare Metal Admin Cluster. When `null`, the `bare_metal_version` field will be omitted from the resulting object.\n  - `description` (`string`): A human readable description of this Bare Metal Admin Cluster. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the resource.\n  - `name` (`string`): The bare metal admin cluster name.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `cluster_operations` (`list[obj]`): Specifies the Admin Cluster's observability infrastructure. When `null`, the `cluster_operations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.cluster_operations.new](#fn-cluster_operationsnew) constructor.\n  - `control_plane` (`list[obj]`): Specifies the control plane configuration. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.control_plane.new](#fn-control_planenew) constructor.\n  - `load_balancer` (`list[obj]`): Specifies the load balancer configuration. When `null`, the `load_balancer` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.load_balancer.new](#fn-load_balancernew) constructor.\n  - `maintenance_config` (`list[obj]`): Specifies the workload node configurations. When `null`, the `maintenance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.maintenance_config.new](#fn-maintenance_confignew) constructor.\n  - `network_config` (`list[obj]`): Network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.network_config.new](#fn-network_confignew) constructor.\n  - `node_access_config` (`list[obj]`): Specifies the node access related settings for the bare metal user cluster. When `null`, the `node_access_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.node_access_config.new](#fn-node_access_confignew) constructor.\n  - `node_config` (`list[obj]`): Specifies the workload node configurations. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.node_config.new](#fn-node_confignew) constructor.\n  - `proxy` (`list[obj]`): Specifies the cluster proxy configuration. When `null`, the `proxy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.proxy.new](#fn-proxynew) constructor.\n  - `security_config` (`list[obj]`): Specifies the security related settings for the Bare Metal User Cluster. When `null`, the `security_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.security_config.new](#fn-security_confignew) constructor.\n  - `storage` (`list[obj]`): Specifies the cluster storage configuration. When `null`, the `storage` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.storage.new](#fn-storagenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gkeonprem_bare_metal_admin_cluster` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    location,
+    name,
+    annotations=null,
+    bare_metal_version=null,
+    cluster_operations=null,
+    control_plane=null,
+    description=null,
+    load_balancer=null,
+    maintenance_config=null,
+    network_config=null,
+    node_access_config=null,
+    node_config=null,
+    project=null,
+    proxy=null,
+    security_config=null,
+    storage=null,
+    timeouts=null
+  ):: std.prune(a={
+    annotations: annotations,
+    bare_metal_version: bare_metal_version,
+    cluster_operations: cluster_operations,
+    control_plane: control_plane,
+    description: description,
+    load_balancer: load_balancer,
+    location: location,
+    maintenance_config: maintenance_config,
+    name: name,
+    network_config: network_config,
+    node_access_config: node_access_config,
+    node_config: node_config,
+    project: project,
+    proxy: proxy,
+    security_config: security_config,
+    storage: storage,
+    timeouts: timeouts,
+  }),
+  node_access_config:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.node_access_config.new` constructs a new object with attributes and blocks configured for the `node_access_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `login_user` (`string`): LoginUser is the user name used to access node machines.\nIt defaults to "root" if not set. When `null`, the `login_user` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `node_access_config` sub block.\n', args=[]),
+    new(
+      login_user=null
+    ):: std.prune(a={
+      login_user: login_user,
+    }),
+  },
+  node_config:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.node_config.new` constructs a new object with attributes and blocks configured for the `node_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `max_pods_per_node` (`number`): The maximum number of pods a node can run. The size of the CIDR range\nassigned to the node will be derived from this parameter. When `null`, the `max_pods_per_node` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `node_config` sub block.\n', args=[]),
+    new(
+      max_pods_per_node=null
+    ):: std.prune(a={
+      max_pods_per_node: max_pods_per_node,
+    }),
+  },
+  proxy:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.proxy.new` constructs a new object with attributes and blocks configured for the `proxy`\nTerraform sub block.\n\n\n\n**Args**:\n  - `no_proxy` (`list`): A list of IPs, hostnames, and domains that should skip the proxy.\nExamples: ["127.0.0.1", "example.com", ".corp", "localhost"]. When `null`, the `no_proxy` field will be omitted from the resulting object.\n  - `uri` (`string`): Specifies the address of your proxy server.\nExamples: http://domain\nWARNING: Do not provide credentials in the format\nhttp://(username:password@)domain these will be rejected by the server.\n\n**Returns**:\n  - An attribute object that represents the `proxy` sub block.\n', args=[]),
+    new(
+      uri,
+      no_proxy=null
+    ):: std.prune(a={
+      no_proxy: no_proxy,
+      uri: uri,
+    }),
+  },
+  security_config:: {
+    authorization:: {
+      admin_users:: {
+        '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.security_config.authorization.admin_users.new` constructs a new object with attributes and blocks configured for the `admin_users`\nTerraform sub block.\n\n\n\n**Args**:\n  - `username` (`string`): The name of the user, e.g. 'my-gcp-id@gmail.com'.\n\n**Returns**:\n  - An attribute object that represents the `admin_users` sub block.\n', args=[]),
+        new(
+          username
+        ):: std.prune(a={
+          username: username,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.security_config.authorization.new` constructs a new object with attributes and blocks configured for the `authorization`\nTerraform sub block.\n\n\n\n**Args**:\n  - `admin_users` (`list[obj]`): Users that will be granted the cluster-admin role on the cluster, providing full access to the cluster. When `null`, the `admin_users` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.security_config.authorization.admin_users.new](#fn-security_configsecurity_configadmin_usersnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `authorization` sub block.\n', args=[]),
+      new(
+        admin_users=null
+      ):: std.prune(a={
+        admin_users: admin_users,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.security_config.new` constructs a new object with attributes and blocks configured for the `security_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `authorization` (`list[obj]`): Configures user access to the Bare Metal User cluster. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.security_config.authorization.new](#fn-security_configauthorizationnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `security_config` sub block.\n', args=[]),
+    new(
+      authorization=null
+    ):: std.prune(a={
+      authorization: authorization,
+    }),
+  },
+  storage:: {
+    lvp_node_mounts_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.storage.lvp_node_mounts_config.new` constructs a new object with attributes and blocks configured for the `lvp_node_mounts_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `path` (`string`): The host machine path.\n  - `storage_class` (`string`): The StorageClass name that PVs will be created with.\n\n**Returns**:\n  - An attribute object that represents the `lvp_node_mounts_config` sub block.\n', args=[]),
+      new(
+        path,
+        storage_class
+      ):: std.prune(a={
+        path: path,
+        storage_class: storage_class,
+      }),
+    },
+    lvp_share_config:: {
+      lvp_config:: {
+        '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.storage.lvp_share_config.lvp_config.new` constructs a new object with attributes and blocks configured for the `lvp_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `path` (`string`): The host machine path.\n  - `storage_class` (`string`): The StorageClass name that PVs will be created with.\n\n**Returns**:\n  - An attribute object that represents the `lvp_config` sub block.\n', args=[]),
+        new(
+          path,
+          storage_class
+        ):: std.prune(a={
+          path: path,
+          storage_class: storage_class,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.storage.lvp_share_config.new` constructs a new object with attributes and blocks configured for the `lvp_share_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `shared_path_pv_count` (`number`): The number of subdirectories to create under path. When `null`, the `shared_path_pv_count` field will be omitted from the resulting object.\n  - `lvp_config` (`list[obj]`): Defines the machine path and storage class for the LVP Share. When `null`, the `lvp_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.storage.lvp_share_config.lvp_config.new](#fn-storagestoragelvp_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `lvp_share_config` sub block.\n', args=[]),
+      new(
+        lvp_config=null,
+        shared_path_pv_count=null
+      ):: std.prune(a={
+        lvp_config: lvp_config,
+        shared_path_pv_count: shared_path_pv_count,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.storage.new` constructs a new object with attributes and blocks configured for the `storage`\nTerraform sub block.\n\n\n\n**Args**:\n  - `lvp_node_mounts_config` (`list[obj]`): Specifies the config for local PersistentVolumes backed\nby mounted node disks. These disks need to be formatted and mounted by the\nuser, which can be done before or after cluster creation. When `null`, the `lvp_node_mounts_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.storage.lvp_node_mounts_config.new](#fn-storagelvp_node_mounts_confignew) constructor.\n  - `lvp_share_config` (`list[obj]`): Specifies the config for local PersistentVolumes backed by\nsubdirectories in a shared filesystem. These subdirectores are\nautomatically created during cluster creation. When `null`, the `lvp_share_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.storage.lvp_share_config.new](#fn-storagelvp_share_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `storage` sub block.\n', args=[]),
+    new(
+      lvp_node_mounts_config=null,
+      lvp_share_config=null
+    ):: std.prune(a={
+      lvp_node_mounts_config: lvp_node_mounts_config,
+      lvp_share_config: lvp_share_config,
+    }),
+  },
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_admin_cluster.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withAnnotations':: d.fn(help='`google.obj.withAnnotations` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the annotations field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `annotations` field.\n', args=[]),
+  withAnnotations(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          annotations: value,
+        },
+      },
+    },
+  },
+  '#withBareMetalVersion':: d.fn(help='`google.string.withBareMetalVersion` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the bare_metal_version field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `bare_metal_version` field.\n', args=[]),
+  withBareMetalVersion(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          bare_metal_version: value,
+        },
+      },
+    },
+  },
+  '#withClusterOperations':: d.fn(help='`google.list[obj].withClusterOperations` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the cluster_operations field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withClusterOperationsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `cluster_operations` field.\n', args=[]),
+  withClusterOperations(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          cluster_operations: value,
+        },
+      },
+    },
+  },
+  '#withClusterOperationsMixin':: d.fn(help='`google.list[obj].withClusterOperationsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the cluster_operations field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withClusterOperations](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `cluster_operations` field.\n', args=[]),
+  withClusterOperationsMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          cluster_operations+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withControlPlane':: d.fn(help='`google.list[obj].withControlPlane` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the control_plane field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withControlPlaneMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `control_plane` field.\n', args=[]),
+  withControlPlane(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          control_plane: value,
+        },
+      },
+    },
+  },
+  '#withControlPlaneMixin':: d.fn(help='`google.list[obj].withControlPlaneMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the control_plane field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withControlPlane](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `control_plane` field.\n', args=[]),
+  withControlPlaneMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          control_plane+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
+  withDescription(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          description: value,
+        },
+      },
+    },
+  },
+  '#withLoadBalancer':: d.fn(help='`google.list[obj].withLoadBalancer` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the load_balancer field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withLoadBalancerMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `load_balancer` field.\n', args=[]),
+  withLoadBalancer(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          load_balancer: value,
+        },
+      },
+    },
+  },
+  '#withLoadBalancerMixin':: d.fn(help='`google.list[obj].withLoadBalancerMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the load_balancer field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withLoadBalancer](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `load_balancer` field.\n', args=[]),
+  withLoadBalancerMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          load_balancer+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withMaintenanceConfig':: d.fn(help='`google.list[obj].withMaintenanceConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the maintenance_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withMaintenanceConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `maintenance_config` field.\n', args=[]),
+  withMaintenanceConfig(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          maintenance_config: value,
+        },
+      },
+    },
+  },
+  '#withMaintenanceConfigMixin':: d.fn(help='`google.list[obj].withMaintenanceConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the maintenance_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withMaintenanceConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `maintenance_config` field.\n', args=[]),
+  withMaintenanceConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          maintenance_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withNetworkConfig':: d.fn(help='`google.list[obj].withNetworkConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the network_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withNetworkConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `network_config` field.\n', args=[]),
+  withNetworkConfig(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          network_config: value,
+        },
+      },
+    },
+  },
+  '#withNetworkConfigMixin':: d.fn(help='`google.list[obj].withNetworkConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the network_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withNetworkConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `network_config` field.\n', args=[]),
+  withNetworkConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          network_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withNodeAccessConfig':: d.fn(help='`google.list[obj].withNodeAccessConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the node_access_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withNodeAccessConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `node_access_config` field.\n', args=[]),
+  withNodeAccessConfig(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          node_access_config: value,
+        },
+      },
+    },
+  },
+  '#withNodeAccessConfigMixin':: d.fn(help='`google.list[obj].withNodeAccessConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the node_access_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withNodeAccessConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `node_access_config` field.\n', args=[]),
+  withNodeAccessConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          node_access_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withNodeConfig':: d.fn(help='`google.list[obj].withNodeConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the node_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withNodeConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `node_config` field.\n', args=[]),
+  withNodeConfig(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          node_config: value,
+        },
+      },
+    },
+  },
+  '#withNodeConfigMixin':: d.fn(help='`google.list[obj].withNodeConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the node_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withNodeConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `node_config` field.\n', args=[]),
+  withNodeConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          node_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withProxy':: d.fn(help='`google.list[obj].withProxy` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the proxy field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withProxyMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `proxy` field.\n', args=[]),
+  withProxy(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          proxy: value,
+        },
+      },
+    },
+  },
+  '#withProxyMixin':: d.fn(help='`google.list[obj].withProxyMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the proxy field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withProxy](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `proxy` field.\n', args=[]),
+  withProxyMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          proxy+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withSecurityConfig':: d.fn(help='`google.list[obj].withSecurityConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the security_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withSecurityConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `security_config` field.\n', args=[]),
+  withSecurityConfig(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          security_config: value,
+        },
+      },
+    },
+  },
+  '#withSecurityConfigMixin':: d.fn(help='`google.list[obj].withSecurityConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the security_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withSecurityConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `security_config` field.\n', args=[]),
+  withSecurityConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          security_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withStorage':: d.fn(help='`google.list[obj].withStorage` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the storage field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withStorageMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `storage` field.\n', args=[]),
+  withStorage(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          storage: value,
+        },
+      },
+    },
+  },
+  '#withStorageMixin':: d.fn(help='`google.list[obj].withStorageMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the storage field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withStorage](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `storage` field.\n', args=[]),
+  withStorageMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          storage+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_admin_cluster+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/gkeonprem_bare_metal_cluster.libsonnet b/4.x/_gen/resources/gkeonprem_bare_metal_cluster.libsonnet
new file mode 100644
index 00000000..b2a5316a
--- /dev/null
+++ b/4.x/_gen/resources/gkeonprem_bare_metal_cluster.libsonnet
@@ -0,0 +1,910 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='gkeonprem_bare_metal_cluster', url='', help='`gkeonprem_bare_metal_cluster` represents the `google_gkeonprem_bare_metal_cluster` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  binary_authorization:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.binary_authorization.new` constructs a new object with attributes and blocks configured for the `binary_authorization`\nTerraform sub block.\n\n\n\n**Args**:\n  - `evaluation_mode` (`string`): Mode of operation for binauthz policy evaluation. If unspecified,\ndefaults to DISABLED. Possible values: ["DISABLED", "PROJECT_SINGLETON_POLICY_ENFORCE"] When `null`, the `evaluation_mode` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `binary_authorization` sub block.\n', args=[]),
+    new(
+      evaluation_mode=null
+    ):: std.prune(a={
+      evaluation_mode: evaluation_mode,
+    }),
+  },
+  cluster_operations:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.cluster_operations.new` constructs a new object with attributes and blocks configured for the `cluster_operations`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enable_application_logs` (`bool`): Whether collection of application logs/metrics should be enabled (in addition to system logs/metrics). When `null`, the `enable_application_logs` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `cluster_operations` sub block.\n', args=[]),
+    new(
+      enable_application_logs=null
+    ):: std.prune(a={
+      enable_application_logs: enable_application_logs,
+    }),
+  },
+  control_plane:: {
+    api_server_args:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.control_plane.api_server_args.new` constructs a new object with attributes and blocks configured for the `api_server_args`\nTerraform sub block.\n\n\n\n**Args**:\n  - `argument` (`string`): The argument name as it appears on the API Server command line please make sure to remove the leading dashes.\n  - `value` (`string`): The value of the arg as it will be passed to the API Server command line.\n\n**Returns**:\n  - An attribute object that represents the `api_server_args` sub block.\n', args=[]),
+      new(
+        argument,
+        value
+      ):: std.prune(a={
+        argument: argument,
+        value: value,
+      }),
+    },
+    control_plane_node_pool_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.control_plane.control_plane_node_pool_config.new` constructs a new object with attributes and blocks configured for the `control_plane_node_pool_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `node_pool_config` (`list[obj]`): The generic configuration for a node pool running the control plane. When `null`, the `node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.control_plane.control_plane_node_pool_config.node_pool_config.new](#fn-control_planecontrol_planenode_pool_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `control_plane_node_pool_config` sub block.\n', args=[]),
+      new(
+        node_pool_config=null
+      ):: std.prune(a={
+        node_pool_config: node_pool_config,
+      }),
+      node_pool_config:: {
+        '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.control_plane.control_plane_node_pool_config.node_pool_config.new` constructs a new object with attributes and blocks configured for the `node_pool_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to\neach node. These will added in addition to any default label(s)\nthat Kubernetes may apply to the node. In case of conflict in\nlabel keys, the applied set may differ depending on the Kubernetes\nversion -- it's best to assume the behavior is undefined and\nconflicts should be avoided. For more information, including usage\nand the valid values, see:\n  http://kubernetes.io/v1.1/docs/user-guide/labels.html\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `operating_system` (`string`): Specifies the nodes operating system (default: LINUX). When `null`, the `operating_system` field will be omitted from the resulting object.\n  - `node_configs` (`list[obj]`): The list of machine addresses in the Bare Metal Node Pool. When `null`, the `node_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.control_plane.control_plane_node_pool_config.node_pool_config.node_configs.new](#fn-control_planecontrol_planecontrol_plane_node_pool_confignode_configsnew) constructor.\n  - `taints` (`list[obj]`): The initial taints assigned to nodes of this node pool. When `null`, the `taints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.control_plane.control_plane_node_pool_config.node_pool_config.taints.new](#fn-control_planecontrol_planecontrol_plane_node_pool_configtaintsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `node_pool_config` sub block.\n', args=[]),
+        new(
+          labels=null,
+          node_configs=null,
+          operating_system=null,
+          taints=null
+        ):: std.prune(a={
+          labels: labels,
+          node_configs: node_configs,
+          operating_system: operating_system,
+          taints: taints,
+        }),
+        node_configs:: {
+          '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.control_plane.control_plane_node_pool_config.node_pool_config.node_configs.new` constructs a new object with attributes and blocks configured for the `node_configs`\nTerraform sub block.\n\n\n\n**Args**:\n  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to\neach node. These will added in addition to any default label(s)\nthat Kubernetes may apply to the node. In case of conflict in\nlabel keys, the applied set may differ depending on the Kubernetes\nversion -- it's best to assume the behavior is undefined and\nconflicts should be avoided. For more information, including usage\nand the valid values, see:\n  http://kubernetes.io/v1.1/docs/user-guide/labels.html\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `node_ip` (`string`): The default IPv4 address for SSH access and Kubernetes node.\nExample: 192.168.0.1 When `null`, the `node_ip` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `node_configs` sub block.\n', args=[]),
+          new(
+            labels=null,
+            node_ip=null
+          ):: std.prune(a={
+            labels: labels,
+            node_ip: node_ip,
+          }),
+        },
+        taints:: {
+          '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.control_plane.control_plane_node_pool_config.node_pool_config.taints.new` constructs a new object with attributes and blocks configured for the `taints`\nTerraform sub block.\n\n\n\n**Args**:\n  - `effect` (`string`): Specifies the nodes operating system (default: LINUX). Possible values: ["EFFECT_UNSPECIFIED", "PREFER_NO_SCHEDULE", "NO_EXECUTE"] When `null`, the `effect` field will be omitted from the resulting object.\n  - `key` (`string`): Key associated with the effect. When `null`, the `key` field will be omitted from the resulting object.\n  - `value` (`string`): Value associated with the effect. When `null`, the `value` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `taints` sub block.\n', args=[]),
+          new(
+            effect=null,
+            key=null,
+            value=null
+          ):: std.prune(a={
+            effect: effect,
+            key: key,
+            value: value,
+          }),
+        },
+      },
+    },
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.control_plane.new` constructs a new object with attributes and blocks configured for the `control_plane`\nTerraform sub block.\n\n\n\n**Args**:\n  - `api_server_args` (`list[obj]`): Customizes the default API server args. Only a subset of\ncustomized flags are supported. Please refer to the API server\ndocumentation below to know the exact format:\nhttps://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/ When `null`, the `api_server_args` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.control_plane.api_server_args.new](#fn-control_planeapi_server_argsnew) constructor.\n  - `control_plane_node_pool_config` (`list[obj]`): Configures the node pool running the control plane. If specified the corresponding NodePool will be created for the cluster's control plane. The NodePool will have the same name and namespace as the cluster. When `null`, the `control_plane_node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.control_plane.control_plane_node_pool_config.new](#fn-control_planecontrol_plane_node_pool_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `control_plane` sub block.\n', args=[]),
+    new(
+      api_server_args=null,
+      control_plane_node_pool_config=null
+    ):: std.prune(a={
+      api_server_args: api_server_args,
+      control_plane_node_pool_config: control_plane_node_pool_config,
+    }),
+  },
+  load_balancer:: {
+    bgp_lb_config:: {
+      address_pools:: {
+        '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.address_pools.new` constructs a new object with attributes and blocks configured for the `address_pools`\nTerraform sub block.\n\n\n\n**Args**:\n  - `addresses` (`list`): The addresses that are part of this pool. Each address must be either in the CIDR form (1.2.3.0/24) or range form (1.2.3.1-1.2.3.5).\n  - `avoid_buggy_ips` (`bool`): If true, avoid using IPs ending in .0 or .255.\nThis avoids buggy consumer devices mistakenly dropping IPv4 traffic for those special IP addresses. When `null`, the `avoid_buggy_ips` field will be omitted from the resulting object.\n  - `manual_assign` (`string`): If true, prevent IP addresses from being automatically assigned. When `null`, the `manual_assign` field will be omitted from the resulting object.\n  - `pool` (`string`): The name of the address pool.\n\n**Returns**:\n  - An attribute object that represents the `address_pools` sub block.\n', args=[]),
+        new(
+          addresses,
+          pool,
+          avoid_buggy_ips=null,
+          manual_assign=null
+        ):: std.prune(a={
+          addresses: addresses,
+          avoid_buggy_ips: avoid_buggy_ips,
+          manual_assign: manual_assign,
+          pool: pool,
+        }),
+      },
+      bgp_peer_configs:: {
+        '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.bgp_peer_configs.new` constructs a new object with attributes and blocks configured for the `bgp_peer_configs`\nTerraform sub block.\n\n\n\n**Args**:\n  - `asn` (`number`): BGP autonomous system number (ASN) for the network that contains the\nexternal peer device.\n  - `control_plane_nodes` (`list`): The IP address of the control plane node that connects to the external\npeer.\nIf you don't specify any control plane nodes, all control plane nodes\ncan connect to the external peer. If you specify one or more IP addresses,\nonly the nodes specified participate in peering sessions. When `null`, the `control_plane_nodes` field will be omitted from the resulting object.\n  - `ip_address` (`string`): The IP address of the external peer device.\n\n**Returns**:\n  - An attribute object that represents the `bgp_peer_configs` sub block.\n', args=[]),
+        new(
+          asn,
+          ip_address,
+          control_plane_nodes=null
+        ):: std.prune(a={
+          asn: asn,
+          control_plane_nodes: control_plane_nodes,
+          ip_address: ip_address,
+        }),
+      },
+      load_balancer_node_pool_config:: {
+        '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.new` constructs a new object with attributes and blocks configured for the `load_balancer_node_pool_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `node_pool_config` (`list[obj]`): The generic configuration for a node pool running a load balancer. When `null`, the `node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.new](#fn-load_balancerload_balancerbgp_lb_confignode_pool_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `load_balancer_node_pool_config` sub block.\n', args=[]),
+        new(
+          node_pool_config=null
+        ):: std.prune(a={
+          node_pool_config: node_pool_config,
+        }),
+        node_pool_config:: {
+          kubelet_config:: {
+            '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.kubelet_config.new` constructs a new object with attributes and blocks configured for the `kubelet_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `registry_burst` (`number`): The maximum size of bursty pulls, temporarily allows pulls to burst to this\nnumber, while still not exceeding registry_pull_qps.\nThe value must not be a negative number.\nUpdating this field may impact scalability by changing the amount of\ntraffic produced by image pulls.\nDefaults to 10. When `null`, the `registry_burst` field will be omitted from the resulting object.\n  - `registry_pull_qps` (`number`): The limit of registry pulls per second.\nSetting this value to 0 means no limit.\nUpdating this field may impact scalability by changing the amount of\ntraffic produced by image pulls.\nDefaults to 5. When `null`, the `registry_pull_qps` field will be omitted from the resulting object.\n  - `serialize_image_pulls_disabled` (`bool`): Prevents the Kubelet from pulling multiple images at a time.\nWe recommend *not* changing the default value on nodes that run docker\ndaemon with version  < 1.9 or an Another Union File System (Aufs) storage\nbackend. Issue https://github.com/kubernetes/kubernetes/issues/10959 has\nmore details. When `null`, the `serialize_image_pulls_disabled` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `kubelet_config` sub block.\n', args=[]),
+            new(
+              registry_burst=null,
+              registry_pull_qps=null,
+              serialize_image_pulls_disabled=null
+            ):: std.prune(a={
+              registry_burst: registry_burst,
+              registry_pull_qps: registry_pull_qps,
+              serialize_image_pulls_disabled: serialize_image_pulls_disabled,
+            }),
+          },
+          '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.new` constructs a new object with attributes and blocks configured for the `node_pool_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to\neach node. These will added in addition to any default label(s)\nthat Kubernetes may apply to the node. In case of conflict in\nlabel keys, the applied set may differ depending on the Kubernetes\nversion -- it's best to assume the behavior is undefined and\nconflicts should be avoided. For more information, including usage\nand the valid values, see:\n  http://kubernetes.io/v1.1/docs/user-guide/labels.html\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `operating_system` (`string`): Specifies the nodes operating system (default: LINUX). When `null`, the `operating_system` field will be omitted from the resulting object.\n  - `kubelet_config` (`list[obj]`): The modifiable kubelet configurations for the baremetal machines. When `null`, the `kubelet_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.kubelet_config.new](#fn-load_balancerload_balancerbgp_lb_configload_balancer_node_pool_configkubelet_confignew) constructor.\n  - `node_configs` (`list[obj]`): The list of machine addresses in the Bare Metal Node Pool. When `null`, the `node_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.node_configs.new](#fn-load_balancerload_balancerbgp_lb_configload_balancer_node_pool_confignode_configsnew) constructor.\n  - `taints` (`list[obj]`): The initial taints assigned to nodes of this node pool. When `null`, the `taints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.taints.new](#fn-load_balancerload_balancerbgp_lb_configload_balancer_node_pool_configtaintsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `node_pool_config` sub block.\n', args=[]),
+          new(
+            kubelet_config=null,
+            labels=null,
+            node_configs=null,
+            operating_system=null,
+            taints=null
+          ):: std.prune(a={
+            kubelet_config: kubelet_config,
+            labels: labels,
+            node_configs: node_configs,
+            operating_system: operating_system,
+            taints: taints,
+          }),
+          node_configs:: {
+            '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.node_configs.new` constructs a new object with attributes and blocks configured for the `node_configs`\nTerraform sub block.\n\n\n\n**Args**:\n  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to\neach node. These will added in addition to any default label(s)\nthat Kubernetes may apply to the node. In case of conflict in\nlabel keys, the applied set may differ depending on the Kubernetes\nversion -- it's best to assume the behavior is undefined and\nconflicts should be avoided. For more information, including usage\nand the valid values, see:\n  http://kubernetes.io/v1.1/docs/user-guide/labels.html\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `node_ip` (`string`): The default IPv4 address for SSH access and Kubernetes node.\nExample: 192.168.0.1 When `null`, the `node_ip` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `node_configs` sub block.\n', args=[]),
+            new(
+              labels=null,
+              node_ip=null
+            ):: std.prune(a={
+              labels: labels,
+              node_ip: node_ip,
+            }),
+          },
+          taints:: {
+            '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.taints.new` constructs a new object with attributes and blocks configured for the `taints`\nTerraform sub block.\n\n\n\n**Args**:\n  - `effect` (`string`): Specifies the nodes operating system (default: LINUX). Possible values: ["EFFECT_UNSPECIFIED", "PREFER_NO_SCHEDULE", "NO_EXECUTE"] When `null`, the `effect` field will be omitted from the resulting object.\n  - `key` (`string`): Key associated with the effect. When `null`, the `key` field will be omitted from the resulting object.\n  - `value` (`string`): Value associated with the effect. When `null`, the `value` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `taints` sub block.\n', args=[]),
+            new(
+              effect=null,
+              key=null,
+              value=null
+            ):: std.prune(a={
+              effect: effect,
+              key: key,
+              value: value,
+            }),
+          },
+        },
+      },
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.new` constructs a new object with attributes and blocks configured for the `bgp_lb_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `asn` (`number`): BGP autonomous system number (ASN) of the cluster.\nThis field can be updated after cluster creation.\n  - `address_pools` (`list[obj]`): AddressPools is a list of non-overlapping IP pools used by load balancer\ntyped services. All addresses must be routable to load balancer nodes.\nIngressVIP must be included in the pools. When `null`, the `address_pools` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.address_pools.new](#fn-load_balancerload_balanceraddress_poolsnew) constructor.\n  - `bgp_peer_configs` (`list[obj]`): The list of BGP peers that the cluster will connect to.\nAt least one peer must be configured for each control plane node.\nControl plane nodes will connect to these peers to advertise the control\nplane VIP. The Services load balancer also uses these peers by default.\nThis field can be updated after cluster creation. When `null`, the `bgp_peer_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.bgp_peer_configs.new](#fn-load_balancerload_balancerbgp_peer_configsnew) constructor.\n  - `load_balancer_node_pool_config` (`list[obj]`): Specifies the node pool running data plane load balancing. L2 connectivity\nis required among nodes in this pool. If missing, the control plane node\npool is used for data plane load balancing. When `null`, the `load_balancer_node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.new](#fn-load_balancerload_balancerload_balancer_node_pool_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `bgp_lb_config` sub block.\n', args=[]),
+      new(
+        asn,
+        address_pools=null,
+        bgp_peer_configs=null,
+        load_balancer_node_pool_config=null
+      ):: std.prune(a={
+        address_pools: address_pools,
+        asn: asn,
+        bgp_peer_configs: bgp_peer_configs,
+        load_balancer_node_pool_config: load_balancer_node_pool_config,
+      }),
+    },
+    manual_lb_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.manual_lb_config.new` constructs a new object with attributes and blocks configured for the `manual_lb_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): Whether manual load balancing is enabled.\n\n**Returns**:\n  - An attribute object that represents the `manual_lb_config` sub block.\n', args=[]),
+      new(
+        enabled
+      ):: std.prune(a={
+        enabled: enabled,
+      }),
+    },
+    metal_lb_config:: {
+      address_pools:: {
+        '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.address_pools.new` constructs a new object with attributes and blocks configured for the `address_pools`\nTerraform sub block.\n\n\n\n**Args**:\n  - `addresses` (`list`): The addresses that are part of this pool. Each address must be either in the CIDR form (1.2.3.0/24) or range form (1.2.3.1-1.2.3.5).\n  - `avoid_buggy_ips` (`bool`): If true, avoid using IPs ending in .0 or .255.\nThis avoids buggy consumer devices mistakenly dropping IPv4 traffic for those special IP addresses. When `null`, the `avoid_buggy_ips` field will be omitted from the resulting object.\n  - `manual_assign` (`bool`): If true, prevent IP addresses from being automatically assigned. When `null`, the `manual_assign` field will be omitted from the resulting object.\n  - `pool` (`string`): The name of the address pool.\n\n**Returns**:\n  - An attribute object that represents the `address_pools` sub block.\n', args=[]),
+        new(
+          addresses,
+          pool,
+          avoid_buggy_ips=null,
+          manual_assign=null
+        ):: std.prune(a={
+          addresses: addresses,
+          avoid_buggy_ips: avoid_buggy_ips,
+          manual_assign: manual_assign,
+          pool: pool,
+        }),
+      },
+      load_balancer_node_pool_config:: {
+        '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.load_balancer_node_pool_config.new` constructs a new object with attributes and blocks configured for the `load_balancer_node_pool_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `node_pool_config` (`list[obj]`): The generic configuration for a node pool running a load balancer. When `null`, the `node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.new](#fn-load_balancerload_balancermetal_lb_confignode_pool_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `load_balancer_node_pool_config` sub block.\n', args=[]),
+        new(
+          node_pool_config=null
+        ):: std.prune(a={
+          node_pool_config: node_pool_config,
+        }),
+        node_pool_config:: {
+          '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.new` constructs a new object with attributes and blocks configured for the `node_pool_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to\neach node. These will added in addition to any default label(s)\nthat Kubernetes may apply to the node. In case of conflict in\nlabel keys, the applied set may differ depending on the Kubernetes\nversion -- it's best to assume the behavior is undefined and\nconflicts should be avoided. For more information, including usage\nand the valid values, see:\n  http://kubernetes.io/v1.1/docs/user-guide/labels.html\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `operating_system` (`string`): Specifies the nodes operating system (default: LINUX). When `null`, the `operating_system` field will be omitted from the resulting object.\n  - `node_configs` (`list[obj]`): The list of machine addresses in the Bare Metal Node Pool. When `null`, the `node_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.node_configs.new](#fn-load_balancerload_balancermetal_lb_configload_balancer_node_pool_confignode_configsnew) constructor.\n  - `taints` (`list[obj]`): The initial taints assigned to nodes of this node pool. When `null`, the `taints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.taints.new](#fn-load_balancerload_balancermetal_lb_configload_balancer_node_pool_configtaintsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `node_pool_config` sub block.\n', args=[]),
+          new(
+            labels=null,
+            node_configs=null,
+            operating_system=null,
+            taints=null
+          ):: std.prune(a={
+            labels: labels,
+            node_configs: node_configs,
+            operating_system: operating_system,
+            taints: taints,
+          }),
+          node_configs:: {
+            '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.node_configs.new` constructs a new object with attributes and blocks configured for the `node_configs`\nTerraform sub block.\n\n\n\n**Args**:\n  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to\neach node. These will added in addition to any default label(s)\nthat Kubernetes may apply to the node. In case of conflict in\nlabel keys, the applied set may differ depending on the Kubernetes\nversion -- it's best to assume the behavior is undefined and\nconflicts should be avoided. For more information, including usage\nand the valid values, see:\n  http://kubernetes.io/v1.1/docs/user-guide/labels.html\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `node_ip` (`string`): The default IPv4 address for SSH access and Kubernetes node.\nExample: 192.168.0.1 When `null`, the `node_ip` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `node_configs` sub block.\n', args=[]),
+            new(
+              labels=null,
+              node_ip=null
+            ):: std.prune(a={
+              labels: labels,
+              node_ip: node_ip,
+            }),
+          },
+          taints:: {
+            '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.taints.new` constructs a new object with attributes and blocks configured for the `taints`\nTerraform sub block.\n\n\n\n**Args**:\n  - `effect` (`string`): Specifies the nodes operating system (default: LINUX). Possible values: ["EFFECT_UNSPECIFIED", "PREFER_NO_SCHEDULE", "NO_EXECUTE"] When `null`, the `effect` field will be omitted from the resulting object.\n  - `key` (`string`): Key associated with the effect. When `null`, the `key` field will be omitted from the resulting object.\n  - `value` (`string`): Value associated with the effect. When `null`, the `value` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `taints` sub block.\n', args=[]),
+            new(
+              effect=null,
+              key=null,
+              value=null
+            ):: std.prune(a={
+              effect: effect,
+              key: key,
+              value: value,
+            }),
+          },
+        },
+      },
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.new` constructs a new object with attributes and blocks configured for the `metal_lb_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `address_pools` (`list[obj]`): AddressPools is a list of non-overlapping IP pools used by load balancer\ntyped services. All addresses must be routable to load balancer nodes.\nIngressVIP must be included in the pools. When `null`, the `address_pools` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.address_pools.new](#fn-load_balancerload_balanceraddress_poolsnew) constructor.\n  - `load_balancer_node_pool_config` (`list[obj]`): Specifies the load balancer's node pool configuration. When `null`, the `load_balancer_node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.load_balancer_node_pool_config.new](#fn-load_balancerload_balancerload_balancer_node_pool_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `metal_lb_config` sub block.\n', args=[]),
+      new(
+        address_pools=null,
+        load_balancer_node_pool_config=null
+      ):: std.prune(a={
+        address_pools: address_pools,
+        load_balancer_node_pool_config: load_balancer_node_pool_config,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.new` constructs a new object with attributes and blocks configured for the `load_balancer`\nTerraform sub block.\n\n\n\n**Args**:\n  - `bgp_lb_config` (`list[obj]`): Configuration for BGP typed load balancers. When `null`, the `bgp_lb_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.new](#fn-load_balancerbgp_lb_confignew) constructor.\n  - `manual_lb_config` (`list[obj]`): A nested object resource When `null`, the `manual_lb_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.manual_lb_config.new](#fn-load_balancermanual_lb_confignew) constructor.\n  - `metal_lb_config` (`list[obj]`): A nested object resource When `null`, the `metal_lb_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.new](#fn-load_balancermetal_lb_confignew) constructor.\n  - `port_config` (`list[obj]`): Specifies the load balancer ports. When `null`, the `port_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.port_config.new](#fn-load_balancerport_confignew) constructor.\n  - `vip_config` (`list[obj]`): Specified the Bare Metal Load Balancer Config When `null`, the `vip_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.vip_config.new](#fn-load_balancervip_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `load_balancer` sub block.\n', args=[]),
+    new(
+      bgp_lb_config=null,
+      manual_lb_config=null,
+      metal_lb_config=null,
+      port_config=null,
+      vip_config=null
+    ):: std.prune(a={
+      bgp_lb_config: bgp_lb_config,
+      manual_lb_config: manual_lb_config,
+      metal_lb_config: metal_lb_config,
+      port_config: port_config,
+      vip_config: vip_config,
+    }),
+    port_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.port_config.new` constructs a new object with attributes and blocks configured for the `port_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `control_plane_load_balancer_port` (`number`): The port that control plane hosted load balancers will listen on.\n\n**Returns**:\n  - An attribute object that represents the `port_config` sub block.\n', args=[]),
+      new(
+        control_plane_load_balancer_port
+      ):: std.prune(a={
+        control_plane_load_balancer_port: control_plane_load_balancer_port,
+      }),
+    },
+    vip_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.load_balancer.vip_config.new` constructs a new object with attributes and blocks configured for the `vip_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `control_plane_vip` (`string`): The VIP which you previously set aside for the Kubernetes API of this Bare Metal User Cluster.\n  - `ingress_vip` (`string`): The VIP which you previously set aside for ingress traffic into this Bare Metal User Cluster.\n\n**Returns**:\n  - An attribute object that represents the `vip_config` sub block.\n', args=[]),
+      new(
+        control_plane_vip,
+        ingress_vip
+      ):: std.prune(a={
+        control_plane_vip: control_plane_vip,
+        ingress_vip: ingress_vip,
+      }),
+    },
+  },
+  maintenance_config:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.maintenance_config.new` constructs a new object with attributes and blocks configured for the `maintenance_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `maintenance_address_cidr_blocks` (`list`): All IPv4 address from these ranges will be placed into maintenance mode.\nNodes in maintenance mode will be cordoned and drained. When both of these\nare true, the "baremetal.cluster.gke.io/maintenance" annotation will be set\non the node resource.\n\n**Returns**:\n  - An attribute object that represents the `maintenance_config` sub block.\n', args=[]),
+    new(
+      maintenance_address_cidr_blocks
+    ):: std.prune(a={
+      maintenance_address_cidr_blocks: maintenance_address_cidr_blocks,
+    }),
+  },
+  network_config:: {
+    island_mode_cidr:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.network_config.island_mode_cidr.new` constructs a new object with attributes and blocks configured for the `island_mode_cidr`\nTerraform sub block.\n\n\n\n**Args**:\n  - `pod_address_cidr_blocks` (`list`): All pods in the cluster are assigned an RFC1918 IPv4 address from these ranges. This field cannot be changed after creation.\n  - `service_address_cidr_blocks` (`list`): All services in the cluster are assigned an RFC1918 IPv4 address from these ranges. This field cannot be changed after creation.\n\n**Returns**:\n  - An attribute object that represents the `island_mode_cidr` sub block.\n', args=[]),
+      new(
+        pod_address_cidr_blocks,
+        service_address_cidr_blocks
+      ):: std.prune(a={
+        pod_address_cidr_blocks: pod_address_cidr_blocks,
+        service_address_cidr_blocks: service_address_cidr_blocks,
+      }),
+    },
+    multiple_network_interfaces_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.network_config.multiple_network_interfaces_config.new` constructs a new object with attributes and blocks configured for the `multiple_network_interfaces_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): Whether to enable multiple network interfaces for your pods.\nWhen set network_config.advanced_networking is automatically\nset to true. When `null`, the `enabled` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `multiple_network_interfaces_config` sub block.\n', args=[]),
+      new(
+        enabled=null
+      ):: std.prune(a={
+        enabled: enabled,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.network_config.new` constructs a new object with attributes and blocks configured for the `network_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `advanced_networking` (`bool`): Enables the use of advanced Anthos networking features, such as Bundled\nLoad Balancing with BGP or the egress NAT gateway.\nSetting configuration for advanced networking features will automatically\nset this flag. When `null`, the `advanced_networking` field will be omitted from the resulting object.\n  - `island_mode_cidr` (`list[obj]`): A nested object resource When `null`, the `island_mode_cidr` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.network_config.island_mode_cidr.new](#fn-network_configisland_mode_cidrnew) constructor.\n  - `multiple_network_interfaces_config` (`list[obj]`): Configuration for multiple network interfaces. When `null`, the `multiple_network_interfaces_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.network_config.multiple_network_interfaces_config.new](#fn-network_configmultiple_network_interfaces_confignew) constructor.\n  - `sr_iov_config` (`list[obj]`): Configuration for SR-IOV. When `null`, the `sr_iov_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.network_config.sr_iov_config.new](#fn-network_configsr_iov_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `network_config` sub block.\n', args=[]),
+    new(
+      advanced_networking=null,
+      island_mode_cidr=null,
+      multiple_network_interfaces_config=null,
+      sr_iov_config=null
+    ):: std.prune(a={
+      advanced_networking: advanced_networking,
+      island_mode_cidr: island_mode_cidr,
+      multiple_network_interfaces_config: multiple_network_interfaces_config,
+      sr_iov_config: sr_iov_config,
+    }),
+    sr_iov_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.network_config.sr_iov_config.new` constructs a new object with attributes and blocks configured for the `sr_iov_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): Whether to install the SR-IOV operator. When `null`, the `enabled` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `sr_iov_config` sub block.\n', args=[]),
+      new(
+        enabled=null
+      ):: std.prune(a={
+        enabled: enabled,
+      }),
+    },
+  },
+  '#new':: d.fn(help="\n`google.gkeonprem_bare_metal_cluster.new` injects a new `google_gkeonprem_bare_metal_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gkeonprem_bare_metal_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gkeonprem_bare_metal_cluster` using the reference:\n\n    $._ref.google_gkeonprem_bare_metal_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gkeonprem_bare_metal_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `admin_cluster_membership` (`string`): The Admin Cluster this Bare Metal User Cluster belongs to.\nThis is the full resource name of the Admin Cluster\u0026#39;s hub membership.\n  - `annotations` (`obj`): Annotations on the Bare Metal User Cluster.\nThis field has the same restrictions as Kubernetes annotations.\nThe total size of all keys and values combined is limited to 256k.\nKey can have 2 segments: prefix (optional) and name (required),\nseparated by a slash (/).\nPrefix must be a DNS subdomain.\nName must be 63 characters or less, begin and end with alphanumerics,\nwith dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field \u0026#39;effective_annotations\u0026#39; for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `bare_metal_version` (`string`): A human readable description of this Bare Metal User Cluster.\n  - `description` (`string`): A human readable description of this Bare Metal User Cluster. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the resource.\n  - `name` (`string`): The bare metal cluster name.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `binary_authorization` (`list[obj]`): Binary Authorization related configurations. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `cluster_operations` (`list[obj]`): Specifies the User Cluster\u0026#39;s observability infrastructure. When `null`, the `cluster_operations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.cluster_operations.new](#fn-cluster_operationsnew) constructor.\n  - `control_plane` (`list[obj]`): Specifies the control plane configuration. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.control_plane.new](#fn-control_planenew) constructor.\n  - `load_balancer` (`list[obj]`): Specifies the load balancer configuration. When `null`, the `load_balancer` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.new](#fn-load_balancernew) constructor.\n  - `maintenance_config` (`list[obj]`): Specifies the workload node configurations. When `null`, the `maintenance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.maintenance_config.new](#fn-maintenance_confignew) constructor.\n  - `network_config` (`list[obj]`): Network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.network_config.new](#fn-network_confignew) constructor.\n  - `node_access_config` (`list[obj]`): Specifies the node access related settings for the bare metal user cluster. When `null`, the `node_access_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.node_access_config.new](#fn-node_access_confignew) constructor.\n  - `node_config` (`list[obj]`): Specifies the workload node configurations. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.node_config.new](#fn-node_confignew) constructor.\n  - `os_environment_config` (`list[obj]`): OS environment related configurations. When `null`, the `os_environment_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.os_environment_config.new](#fn-os_environment_confignew) constructor.\n  - `proxy` (`list[obj]`): Specifies the cluster proxy configuration. When `null`, the `proxy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.proxy.new](#fn-proxynew) constructor.\n  - `security_config` (`list[obj]`): Specifies the security related settings for the Bare Metal User Cluster. When `null`, the `security_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.security_config.new](#fn-security_confignew) constructor.\n  - `storage` (`list[obj]`): Specifies the cluster storage configuration. When `null`, the `storage` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.storage.new](#fn-storagenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n  - `upgrade_policy` (`list[obj]`): The cluster upgrade policy. When `null`, the `upgrade_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.upgrade_policy.new](#fn-upgrade_policynew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    admin_cluster_membership,
+    bare_metal_version,
+    location,
+    name,
+    annotations=null,
+    binary_authorization=null,
+    cluster_operations=null,
+    control_plane=null,
+    description=null,
+    load_balancer=null,
+    maintenance_config=null,
+    network_config=null,
+    node_access_config=null,
+    node_config=null,
+    os_environment_config=null,
+    project=null,
+    proxy=null,
+    security_config=null,
+    storage=null,
+    timeouts=null,
+    upgrade_policy=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_gkeonprem_bare_metal_cluster',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      admin_cluster_membership=admin_cluster_membership,
+      annotations=annotations,
+      bare_metal_version=bare_metal_version,
+      binary_authorization=binary_authorization,
+      cluster_operations=cluster_operations,
+      control_plane=control_plane,
+      description=description,
+      load_balancer=load_balancer,
+      location=location,
+      maintenance_config=maintenance_config,
+      name=name,
+      network_config=network_config,
+      node_access_config=node_access_config,
+      node_config=node_config,
+      os_environment_config=os_environment_config,
+      project=project,
+      proxy=proxy,
+      security_config=security_config,
+      storage=storage,
+      timeouts=timeouts,
+      upgrade_policy=upgrade_policy
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `gkeonprem_bare_metal_cluster`\nTerraform resource.\n\nUnlike [google.gkeonprem_bare_metal_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `admin_cluster_membership` (`string`): The Admin Cluster this Bare Metal User Cluster belongs to.\nThis is the full resource name of the Admin Cluster's hub membership.\n  - `annotations` (`obj`): Annotations on the Bare Metal User Cluster.\nThis field has the same restrictions as Kubernetes annotations.\nThe total size of all keys and values combined is limited to 256k.\nKey can have 2 segments: prefix (optional) and name (required),\nseparated by a slash (/).\nPrefix must be a DNS subdomain.\nName must be 63 characters or less, begin and end with alphanumerics,\nwith dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `bare_metal_version` (`string`): A human readable description of this Bare Metal User Cluster.\n  - `description` (`string`): A human readable description of this Bare Metal User Cluster. When `null`, the `description` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the resource.\n  - `name` (`string`): The bare metal cluster name.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `binary_authorization` (`list[obj]`): Binary Authorization related configurations. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.binary_authorization.new](#fn-binary_authorizationnew) constructor.\n  - `cluster_operations` (`list[obj]`): Specifies the User Cluster's observability infrastructure. When `null`, the `cluster_operations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.cluster_operations.new](#fn-cluster_operationsnew) constructor.\n  - `control_plane` (`list[obj]`): Specifies the control plane configuration. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.control_plane.new](#fn-control_planenew) constructor.\n  - `load_balancer` (`list[obj]`): Specifies the load balancer configuration. When `null`, the `load_balancer` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.new](#fn-load_balancernew) constructor.\n  - `maintenance_config` (`list[obj]`): Specifies the workload node configurations. When `null`, the `maintenance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.maintenance_config.new](#fn-maintenance_confignew) constructor.\n  - `network_config` (`list[obj]`): Network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.network_config.new](#fn-network_confignew) constructor.\n  - `node_access_config` (`list[obj]`): Specifies the node access related settings for the bare metal user cluster. When `null`, the `node_access_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.node_access_config.new](#fn-node_access_confignew) constructor.\n  - `node_config` (`list[obj]`): Specifies the workload node configurations. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.node_config.new](#fn-node_confignew) constructor.\n  - `os_environment_config` (`list[obj]`): OS environment related configurations. When `null`, the `os_environment_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.os_environment_config.new](#fn-os_environment_confignew) constructor.\n  - `proxy` (`list[obj]`): Specifies the cluster proxy configuration. When `null`, the `proxy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.proxy.new](#fn-proxynew) constructor.\n  - `security_config` (`list[obj]`): Specifies the security related settings for the Bare Metal User Cluster. When `null`, the `security_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.security_config.new](#fn-security_confignew) constructor.\n  - `storage` (`list[obj]`): Specifies the cluster storage configuration. When `null`, the `storage` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.storage.new](#fn-storagenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n  - `upgrade_policy` (`list[obj]`): The cluster upgrade policy. When `null`, the `upgrade_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.upgrade_policy.new](#fn-upgrade_policynew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gkeonprem_bare_metal_cluster` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    admin_cluster_membership,
+    bare_metal_version,
+    location,
+    name,
+    annotations=null,
+    binary_authorization=null,
+    cluster_operations=null,
+    control_plane=null,
+    description=null,
+    load_balancer=null,
+    maintenance_config=null,
+    network_config=null,
+    node_access_config=null,
+    node_config=null,
+    os_environment_config=null,
+    project=null,
+    proxy=null,
+    security_config=null,
+    storage=null,
+    timeouts=null,
+    upgrade_policy=null
+  ):: std.prune(a={
+    admin_cluster_membership: admin_cluster_membership,
+    annotations: annotations,
+    bare_metal_version: bare_metal_version,
+    binary_authorization: binary_authorization,
+    cluster_operations: cluster_operations,
+    control_plane: control_plane,
+    description: description,
+    load_balancer: load_balancer,
+    location: location,
+    maintenance_config: maintenance_config,
+    name: name,
+    network_config: network_config,
+    node_access_config: node_access_config,
+    node_config: node_config,
+    os_environment_config: os_environment_config,
+    project: project,
+    proxy: proxy,
+    security_config: security_config,
+    storage: storage,
+    timeouts: timeouts,
+    upgrade_policy: upgrade_policy,
+  }),
+  node_access_config:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.node_access_config.new` constructs a new object with attributes and blocks configured for the `node_access_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `login_user` (`string`): LoginUser is the user name used to access node machines.\nIt defaults to "root" if not set. When `null`, the `login_user` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `node_access_config` sub block.\n', args=[]),
+    new(
+      login_user=null
+    ):: std.prune(a={
+      login_user: login_user,
+    }),
+  },
+  node_config:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.node_config.new` constructs a new object with attributes and blocks configured for the `node_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `container_runtime` (`string`): The available runtimes that can be used to run containers in a Bare Metal User Cluster. Possible values: ["CONTAINER_RUNTIME_UNSPECIFIED", "DOCKER", "CONTAINERD"] When `null`, the `container_runtime` field will be omitted from the resulting object.\n  - `max_pods_per_node` (`number`): The maximum number of pods a node can run. The size of the CIDR range\nassigned to the node will be derived from this parameter. When `null`, the `max_pods_per_node` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `node_config` sub block.\n', args=[]),
+    new(
+      container_runtime=null,
+      max_pods_per_node=null
+    ):: std.prune(a={
+      container_runtime: container_runtime,
+      max_pods_per_node: max_pods_per_node,
+    }),
+  },
+  os_environment_config:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.os_environment_config.new` constructs a new object with attributes and blocks configured for the `os_environment_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `package_repo_excluded` (`bool`): Whether the package repo should not be included when initializing\nbare metal machines.\n\n**Returns**:\n  - An attribute object that represents the `os_environment_config` sub block.\n', args=[]),
+    new(
+      package_repo_excluded
+    ):: std.prune(a={
+      package_repo_excluded: package_repo_excluded,
+    }),
+  },
+  proxy:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.proxy.new` constructs a new object with attributes and blocks configured for the `proxy`\nTerraform sub block.\n\n\n\n**Args**:\n  - `no_proxy` (`list`): A list of IPs, hostnames, and domains that should skip the proxy.\nExamples: ["127.0.0.1", "example.com", ".corp", "localhost"]. When `null`, the `no_proxy` field will be omitted from the resulting object.\n  - `uri` (`string`): Specifies the address of your proxy server.\nExamples: http://domain\nWARNING: Do not provide credentials in the format\nhttp://(username:password@)domain these will be rejected by the server.\n\n**Returns**:\n  - An attribute object that represents the `proxy` sub block.\n', args=[]),
+    new(
+      uri,
+      no_proxy=null
+    ):: std.prune(a={
+      no_proxy: no_proxy,
+      uri: uri,
+    }),
+  },
+  security_config:: {
+    authorization:: {
+      admin_users:: {
+        '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.security_config.authorization.admin_users.new` constructs a new object with attributes and blocks configured for the `admin_users`\nTerraform sub block.\n\n\n\n**Args**:\n  - `username` (`string`): The name of the user, e.g. 'my-gcp-id@gmail.com'.\n\n**Returns**:\n  - An attribute object that represents the `admin_users` sub block.\n', args=[]),
+        new(
+          username
+        ):: std.prune(a={
+          username: username,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.security_config.authorization.new` constructs a new object with attributes and blocks configured for the `authorization`\nTerraform sub block.\n\n\n\n**Args**:\n  - `admin_users` (`list[obj]`): Users that will be granted the cluster-admin role on the cluster, providing full access to the cluster. When `null`, the `admin_users` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.security_config.authorization.admin_users.new](#fn-security_configsecurity_configadmin_usersnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `authorization` sub block.\n', args=[]),
+      new(
+        admin_users=null
+      ):: std.prune(a={
+        admin_users: admin_users,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.security_config.new` constructs a new object with attributes and blocks configured for the `security_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `authorization` (`list[obj]`): Configures user access to the Bare Metal User cluster. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.security_config.authorization.new](#fn-security_configauthorizationnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `security_config` sub block.\n', args=[]),
+    new(
+      authorization=null
+    ):: std.prune(a={
+      authorization: authorization,
+    }),
+  },
+  storage:: {
+    lvp_node_mounts_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.storage.lvp_node_mounts_config.new` constructs a new object with attributes and blocks configured for the `lvp_node_mounts_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `path` (`string`): The host machine path.\n  - `storage_class` (`string`): The StorageClass name that PVs will be created with.\n\n**Returns**:\n  - An attribute object that represents the `lvp_node_mounts_config` sub block.\n', args=[]),
+      new(
+        path,
+        storage_class
+      ):: std.prune(a={
+        path: path,
+        storage_class: storage_class,
+      }),
+    },
+    lvp_share_config:: {
+      lvp_config:: {
+        '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.storage.lvp_share_config.lvp_config.new` constructs a new object with attributes and blocks configured for the `lvp_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `path` (`string`): The host machine path.\n  - `storage_class` (`string`): The StorageClass name that PVs will be created with.\n\n**Returns**:\n  - An attribute object that represents the `lvp_config` sub block.\n', args=[]),
+        new(
+          path,
+          storage_class
+        ):: std.prune(a={
+          path: path,
+          storage_class: storage_class,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.storage.lvp_share_config.new` constructs a new object with attributes and blocks configured for the `lvp_share_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `shared_path_pv_count` (`number`): The number of subdirectories to create under path. When `null`, the `shared_path_pv_count` field will be omitted from the resulting object.\n  - `lvp_config` (`list[obj]`): Defines the machine path and storage class for the LVP Share. When `null`, the `lvp_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.storage.lvp_share_config.lvp_config.new](#fn-storagestoragelvp_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `lvp_share_config` sub block.\n', args=[]),
+      new(
+        lvp_config=null,
+        shared_path_pv_count=null
+      ):: std.prune(a={
+        lvp_config: lvp_config,
+        shared_path_pv_count: shared_path_pv_count,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.storage.new` constructs a new object with attributes and blocks configured for the `storage`\nTerraform sub block.\n\n\n\n**Args**:\n  - `lvp_node_mounts_config` (`list[obj]`): Specifies the config for local PersistentVolumes backed\nby mounted node disks. These disks need to be formatted and mounted by the\nuser, which can be done before or after cluster creation. When `null`, the `lvp_node_mounts_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.storage.lvp_node_mounts_config.new](#fn-storagelvp_node_mounts_confignew) constructor.\n  - `lvp_share_config` (`list[obj]`): Specifies the config for local PersistentVolumes backed by\nsubdirectories in a shared filesystem. These subdirectores are\nautomatically created during cluster creation. When `null`, the `lvp_share_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.storage.lvp_share_config.new](#fn-storagelvp_share_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `storage` sub block.\n', args=[]),
+    new(
+      lvp_node_mounts_config=null,
+      lvp_share_config=null
+    ):: std.prune(a={
+      lvp_node_mounts_config: lvp_node_mounts_config,
+      lvp_share_config: lvp_share_config,
+    }),
+  },
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  upgrade_policy:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_cluster.upgrade_policy.new` constructs a new object with attributes and blocks configured for the `upgrade_policy`\nTerraform sub block.\n\n\n\n**Args**:\n  - `policy` (`string`): Specifies which upgrade policy to use. Possible values: ["SERIAL", "CONCURRENT"] When `null`, the `policy` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `upgrade_policy` sub block.\n', args=[]),
+    new(
+      policy=null
+    ):: std.prune(a={
+      policy: policy,
+    }),
+  },
+  '#withAdminClusterMembership':: d.fn(help='`google.string.withAdminClusterMembership` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the admin_cluster_membership field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `admin_cluster_membership` field.\n', args=[]),
+  withAdminClusterMembership(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          admin_cluster_membership: value,
+        },
+      },
+    },
+  },
+  '#withAnnotations':: d.fn(help='`google.obj.withAnnotations` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the annotations field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `annotations` field.\n', args=[]),
+  withAnnotations(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          annotations: value,
+        },
+      },
+    },
+  },
+  '#withBareMetalVersion':: d.fn(help='`google.string.withBareMetalVersion` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the bare_metal_version field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `bare_metal_version` field.\n', args=[]),
+  withBareMetalVersion(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          bare_metal_version: value,
+        },
+      },
+    },
+  },
+  '#withBinaryAuthorization':: d.fn(help='`google.list[obj].withBinaryAuthorization` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the binary_authorization field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withBinaryAuthorizationMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `binary_authorization` field.\n', args=[]),
+  withBinaryAuthorization(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          binary_authorization: value,
+        },
+      },
+    },
+  },
+  '#withBinaryAuthorizationMixin':: d.fn(help='`google.list[obj].withBinaryAuthorizationMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the binary_authorization field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withBinaryAuthorization](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `binary_authorization` field.\n', args=[]),
+  withBinaryAuthorizationMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          binary_authorization+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withClusterOperations':: d.fn(help='`google.list[obj].withClusterOperations` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the cluster_operations field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withClusterOperationsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `cluster_operations` field.\n', args=[]),
+  withClusterOperations(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          cluster_operations: value,
+        },
+      },
+    },
+  },
+  '#withClusterOperationsMixin':: d.fn(help='`google.list[obj].withClusterOperationsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the cluster_operations field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withClusterOperations](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `cluster_operations` field.\n', args=[]),
+  withClusterOperationsMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          cluster_operations+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withControlPlane':: d.fn(help='`google.list[obj].withControlPlane` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the control_plane field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withControlPlaneMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `control_plane` field.\n', args=[]),
+  withControlPlane(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          control_plane: value,
+        },
+      },
+    },
+  },
+  '#withControlPlaneMixin':: d.fn(help='`google.list[obj].withControlPlaneMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the control_plane field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withControlPlane](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `control_plane` field.\n', args=[]),
+  withControlPlaneMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          control_plane+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
+  withDescription(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          description: value,
+        },
+      },
+    },
+  },
+  '#withLoadBalancer':: d.fn(help='`google.list[obj].withLoadBalancer` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the load_balancer field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withLoadBalancerMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `load_balancer` field.\n', args=[]),
+  withLoadBalancer(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          load_balancer: value,
+        },
+      },
+    },
+  },
+  '#withLoadBalancerMixin':: d.fn(help='`google.list[obj].withLoadBalancerMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the load_balancer field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withLoadBalancer](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `load_balancer` field.\n', args=[]),
+  withLoadBalancerMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          load_balancer+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withMaintenanceConfig':: d.fn(help='`google.list[obj].withMaintenanceConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the maintenance_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withMaintenanceConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `maintenance_config` field.\n', args=[]),
+  withMaintenanceConfig(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          maintenance_config: value,
+        },
+      },
+    },
+  },
+  '#withMaintenanceConfigMixin':: d.fn(help='`google.list[obj].withMaintenanceConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the maintenance_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withMaintenanceConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `maintenance_config` field.\n', args=[]),
+  withMaintenanceConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          maintenance_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withNetworkConfig':: d.fn(help='`google.list[obj].withNetworkConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the network_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withNetworkConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `network_config` field.\n', args=[]),
+  withNetworkConfig(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          network_config: value,
+        },
+      },
+    },
+  },
+  '#withNetworkConfigMixin':: d.fn(help='`google.list[obj].withNetworkConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the network_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withNetworkConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `network_config` field.\n', args=[]),
+  withNetworkConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          network_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withNodeAccessConfig':: d.fn(help='`google.list[obj].withNodeAccessConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the node_access_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withNodeAccessConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `node_access_config` field.\n', args=[]),
+  withNodeAccessConfig(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          node_access_config: value,
+        },
+      },
+    },
+  },
+  '#withNodeAccessConfigMixin':: d.fn(help='`google.list[obj].withNodeAccessConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the node_access_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withNodeAccessConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `node_access_config` field.\n', args=[]),
+  withNodeAccessConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          node_access_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withNodeConfig':: d.fn(help='`google.list[obj].withNodeConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the node_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withNodeConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `node_config` field.\n', args=[]),
+  withNodeConfig(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          node_config: value,
+        },
+      },
+    },
+  },
+  '#withNodeConfigMixin':: d.fn(help='`google.list[obj].withNodeConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the node_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withNodeConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `node_config` field.\n', args=[]),
+  withNodeConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          node_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withOsEnvironmentConfig':: d.fn(help='`google.list[obj].withOsEnvironmentConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the os_environment_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withOsEnvironmentConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `os_environment_config` field.\n', args=[]),
+  withOsEnvironmentConfig(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          os_environment_config: value,
+        },
+      },
+    },
+  },
+  '#withOsEnvironmentConfigMixin':: d.fn(help='`google.list[obj].withOsEnvironmentConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the os_environment_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withOsEnvironmentConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `os_environment_config` field.\n', args=[]),
+  withOsEnvironmentConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          os_environment_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withProxy':: d.fn(help='`google.list[obj].withProxy` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the proxy field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withProxyMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `proxy` field.\n', args=[]),
+  withProxy(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          proxy: value,
+        },
+      },
+    },
+  },
+  '#withProxyMixin':: d.fn(help='`google.list[obj].withProxyMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the proxy field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withProxy](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `proxy` field.\n', args=[]),
+  withProxyMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          proxy+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withSecurityConfig':: d.fn(help='`google.list[obj].withSecurityConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the security_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withSecurityConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `security_config` field.\n', args=[]),
+  withSecurityConfig(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          security_config: value,
+        },
+      },
+    },
+  },
+  '#withSecurityConfigMixin':: d.fn(help='`google.list[obj].withSecurityConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the security_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withSecurityConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `security_config` field.\n', args=[]),
+  withSecurityConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          security_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withStorage':: d.fn(help='`google.list[obj].withStorage` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the storage field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withStorageMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `storage` field.\n', args=[]),
+  withStorage(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          storage: value,
+        },
+      },
+    },
+  },
+  '#withStorageMixin':: d.fn(help='`google.list[obj].withStorageMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the storage field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withStorage](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `storage` field.\n', args=[]),
+  withStorageMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          storage+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+  '#withUpgradePolicy':: d.fn(help='`google.list[obj].withUpgradePolicy` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the upgrade_policy field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withUpgradePolicyMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `upgrade_policy` field.\n', args=[]),
+  withUpgradePolicy(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          upgrade_policy: value,
+        },
+      },
+    },
+  },
+  '#withUpgradePolicyMixin':: d.fn(help='`google.list[obj].withUpgradePolicyMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the upgrade_policy field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withUpgradePolicy](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `upgrade_policy` field.\n', args=[]),
+  withUpgradePolicyMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_cluster+: {
+        [resourceLabel]+: {
+          upgrade_policy+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/gkeonprem_bare_metal_node_pool.libsonnet b/4.x/_gen/resources/gkeonprem_bare_metal_node_pool.libsonnet
new file mode 100644
index 00000000..ec7e33fb
--- /dev/null
+++ b/4.x/_gen/resources/gkeonprem_bare_metal_node_pool.libsonnet
@@ -0,0 +1,200 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='gkeonprem_bare_metal_node_pool', url='', help='`gkeonprem_bare_metal_node_pool` represents the `google_gkeonprem_bare_metal_node_pool` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.gkeonprem_bare_metal_node_pool.new` injects a new `google_gkeonprem_bare_metal_node_pool` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gkeonprem_bare_metal_node_pool.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gkeonprem_bare_metal_node_pool` using the reference:\n\n    $._ref.google_gkeonprem_bare_metal_node_pool.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gkeonprem_bare_metal_node_pool.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Annotations on the Bare Metal Node Pool.\nThis field has the same restrictions as Kubernetes annotations.\nThe total size of all keys and values combined is limited to 256k.\nKey can have 2 segments: prefix (optional) and name (required),\nseparated by a slash (/).\nPrefix must be a DNS subdomain.\nName must be 63 characters or less, begin and end with alphanumerics,\nwith dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field \u0026#39;effective_annotations\u0026#39; for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `bare_metal_cluster` (`string`): The cluster this node pool belongs to.\n  - `display_name` (`string`): The display name for the Bare Metal Node Pool. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the resource.\n  - `name` (`string`): The bare metal node pool name.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `node_pool_config` (`list[obj]`): Node pool configuration. When `null`, the `node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_node_pool.node_pool_config.new](#fn-node_pool_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_node_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    bare_metal_cluster,
+    location,
+    name,
+    annotations=null,
+    display_name=null,
+    node_pool_config=null,
+    project=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_gkeonprem_bare_metal_node_pool',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      annotations=annotations,
+      bare_metal_cluster=bare_metal_cluster,
+      display_name=display_name,
+      location=location,
+      name=name,
+      node_pool_config=node_pool_config,
+      project=project,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.gkeonprem_bare_metal_node_pool.newAttrs` constructs a new object with attributes and blocks configured for the `gkeonprem_bare_metal_node_pool`\nTerraform resource.\n\nUnlike [google.gkeonprem_bare_metal_node_pool.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Annotations on the Bare Metal Node Pool.\nThis field has the same restrictions as Kubernetes annotations.\nThe total size of all keys and values combined is limited to 256k.\nKey can have 2 segments: prefix (optional) and name (required),\nseparated by a slash (/).\nPrefix must be a DNS subdomain.\nName must be 63 characters or less, begin and end with alphanumerics,\nwith dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `bare_metal_cluster` (`string`): The cluster this node pool belongs to.\n  - `display_name` (`string`): The display name for the Bare Metal Node Pool. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the resource.\n  - `name` (`string`): The bare metal node pool name.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `node_pool_config` (`list[obj]`): Node pool configuration. When `null`, the `node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_node_pool.node_pool_config.new](#fn-node_pool_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_node_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gkeonprem_bare_metal_node_pool` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    bare_metal_cluster,
+    location,
+    name,
+    annotations=null,
+    display_name=null,
+    node_pool_config=null,
+    project=null,
+    timeouts=null
+  ):: std.prune(a={
+    annotations: annotations,
+    bare_metal_cluster: bare_metal_cluster,
+    display_name: display_name,
+    location: location,
+    name: name,
+    node_pool_config: node_pool_config,
+    project: project,
+    timeouts: timeouts,
+  }),
+  node_pool_config:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_node_pool.node_pool_config.new` constructs a new object with attributes and blocks configured for the `node_pool_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to\neach node. These will added in addition to any default label(s)\nthat Kubernetes may apply to the node. In case of conflict in\nlabel keys, the applied set may differ depending on the Kubernetes\nversion -- it's best to assume the behavior is undefined and\nconflicts should be avoided. For more information, including usage\nand the valid values, see:\n  http://kubernetes.io/v1.1/docs/user-guide/labels.html\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `operating_system` (`string`): Specifies the nodes operating system (default: LINUX). When `null`, the `operating_system` field will be omitted from the resulting object.\n  - `node_configs` (`list[obj]`): The list of machine addresses in the Bare Metal Node Pool. When `null`, the `node_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_node_pool.node_pool_config.node_configs.new](#fn-node_pool_confignode_configsnew) constructor.\n  - `taints` (`list[obj]`): The initial taints assigned to nodes of this node pool. When `null`, the `taints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_node_pool.node_pool_config.taints.new](#fn-node_pool_configtaintsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `node_pool_config` sub block.\n', args=[]),
+    new(
+      labels=null,
+      node_configs=null,
+      operating_system=null,
+      taints=null
+    ):: std.prune(a={
+      labels: labels,
+      node_configs: node_configs,
+      operating_system: operating_system,
+      taints: taints,
+    }),
+    node_configs:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_node_pool.node_pool_config.node_configs.new` constructs a new object with attributes and blocks configured for the `node_configs`\nTerraform sub block.\n\n\n\n**Args**:\n  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to\neach node. These will added in addition to any default label(s)\nthat Kubernetes may apply to the node. In case of conflict in\nlabel keys, the applied set may differ depending on the Kubernetes\nversion -- it's best to assume the behavior is undefined and\nconflicts should be avoided. For more information, including usage\nand the valid values, see:\n  http://kubernetes.io/v1.1/docs/user-guide/labels.html\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `node_ip` (`string`): The default IPv4 address for SSH access and Kubernetes node.\nExample: 192.168.0.1 When `null`, the `node_ip` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `node_configs` sub block.\n', args=[]),
+      new(
+        labels=null,
+        node_ip=null
+      ):: std.prune(a={
+        labels: labels,
+        node_ip: node_ip,
+      }),
+    },
+    taints:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_node_pool.node_pool_config.taints.new` constructs a new object with attributes and blocks configured for the `taints`\nTerraform sub block.\n\n\n\n**Args**:\n  - `effect` (`string`): Specifies the nodes operating system (default: LINUX). Possible values: ["EFFECT_UNSPECIFIED", "PREFER_NO_SCHEDULE", "NO_EXECUTE"] When `null`, the `effect` field will be omitted from the resulting object.\n  - `key` (`string`): Key associated with the effect. When `null`, the `key` field will be omitted from the resulting object.\n  - `value` (`string`): Value associated with the effect. When `null`, the `value` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `taints` sub block.\n', args=[]),
+      new(
+        effect=null,
+        key=null,
+        value=null
+      ):: std.prune(a={
+        effect: effect,
+        key: key,
+        value: value,
+      }),
+    },
+  },
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_bare_metal_node_pool.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withAnnotations':: d.fn(help='`google.obj.withAnnotations` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the annotations field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `annotations` field.\n', args=[]),
+  withAnnotations(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_node_pool+: {
+        [resourceLabel]+: {
+          annotations: value,
+        },
+      },
+    },
+  },
+  '#withBareMetalCluster':: d.fn(help='`google.string.withBareMetalCluster` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the bare_metal_cluster field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `bare_metal_cluster` field.\n', args=[]),
+  withBareMetalCluster(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_node_pool+: {
+        [resourceLabel]+: {
+          bare_metal_cluster: value,
+        },
+      },
+    },
+  },
+  '#withDisplayName':: d.fn(help='`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the display_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `display_name` field.\n', args=[]),
+  withDisplayName(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_node_pool+: {
+        [resourceLabel]+: {
+          display_name: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_node_pool+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_node_pool+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withNodePoolConfig':: d.fn(help='`google.list[obj].withNodePoolConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the node_pool_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withNodePoolConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `node_pool_config` field.\n', args=[]),
+  withNodePoolConfig(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_node_pool+: {
+        [resourceLabel]+: {
+          node_pool_config: value,
+        },
+      },
+    },
+  },
+  '#withNodePoolConfigMixin':: d.fn(help='`google.list[obj].withNodePoolConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the node_pool_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withNodePoolConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `node_pool_config` field.\n', args=[]),
+  withNodePoolConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_node_pool+: {
+        [resourceLabel]+: {
+          node_pool_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_node_pool+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_node_pool+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_bare_metal_node_pool+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/gkeonprem_vmware_cluster.libsonnet b/4.x/_gen/resources/gkeonprem_vmware_cluster.libsonnet
new file mode 100644
index 00000000..ef67d2b6
--- /dev/null
+++ b/4.x/_gen/resources/gkeonprem_vmware_cluster.libsonnet
@@ -0,0 +1,694 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='gkeonprem_vmware_cluster', url='', help='`gkeonprem_vmware_cluster` represents the `google_gkeonprem_vmware_cluster` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  anti_affinity_groups:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.anti_affinity_groups.new` constructs a new object with attributes and blocks configured for the `anti_affinity_groups`\nTerraform sub block.\n\n\n\n**Args**:\n  - `aag_config_disabled` (`bool`): Spread nodes across at least three physical hosts (requires at least three\nhosts).\nEnabled by default.\n\n**Returns**:\n  - An attribute object that represents the `anti_affinity_groups` sub block.\n', args=[]),
+    new(
+      aag_config_disabled
+    ):: std.prune(a={
+      aag_config_disabled: aag_config_disabled,
+    }),
+  },
+  authorization:: {
+    admin_users:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.authorization.admin_users.new` constructs a new object with attributes and blocks configured for the `admin_users`\nTerraform sub block.\n\n\n\n**Args**:\n  - `username` (`string`): The name of the user, e.g. 'my-gcp-id@gmail.com'.\n\n**Returns**:\n  - An attribute object that represents the `admin_users` sub block.\n', args=[]),
+      new(
+        username
+      ):: std.prune(a={
+        username: username,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.authorization.new` constructs a new object with attributes and blocks configured for the `authorization`\nTerraform sub block.\n\n\n\n**Args**:\n  - `admin_users` (`list[obj]`): Users that will be granted the cluster-admin role on the cluster, providing\nfull access to the cluster. When `null`, the `admin_users` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.authorization.admin_users.new](#fn-authorizationadmin_usersnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `authorization` sub block.\n', args=[]),
+    new(
+      admin_users=null
+    ):: std.prune(a={
+      admin_users: admin_users,
+    }),
+  },
+  auto_repair_config:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.auto_repair_config.new` constructs a new object with attributes and blocks configured for the `auto_repair_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): Whether auto repair is enabled.\n\n**Returns**:\n  - An attribute object that represents the `auto_repair_config` sub block.\n', args=[]),
+    new(
+      enabled
+    ):: std.prune(a={
+      enabled: enabled,
+    }),
+  },
+  control_plane_node:: {
+    auto_resize_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.control_plane_node.auto_resize_config.new` constructs a new object with attributes and blocks configured for the `auto_resize_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): Whether to enable control plane node auto resizing.\n\n**Returns**:\n  - An attribute object that represents the `auto_resize_config` sub block.\n', args=[]),
+      new(
+        enabled
+      ):: std.prune(a={
+        enabled: enabled,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.control_plane_node.new` constructs a new object with attributes and blocks configured for the `control_plane_node`\nTerraform sub block.\n\n\n\n**Args**:\n  - `cpus` (`number`): The number of CPUs for each admin cluster node that serve as control planes\nfor this VMware User Cluster. (default: 4 CPUs) When `null`, the `cpus` field will be omitted from the resulting object.\n  - `memory` (`number`): The megabytes of memory for each admin cluster node that serves as a\ncontrol plane for this VMware User Cluster (default: 8192 MB memory). When `null`, the `memory` field will be omitted from the resulting object.\n  - `replicas` (`number`): The number of control plane nodes for this VMware User Cluster.\n(default: 1 replica). When `null`, the `replicas` field will be omitted from the resulting object.\n  - `auto_resize_config` (`list[obj]`): AutoResizeConfig provides auto resizing configurations. When `null`, the `auto_resize_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.control_plane_node.auto_resize_config.new](#fn-control_plane_nodeauto_resize_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `control_plane_node` sub block.\n', args=[]),
+    new(
+      auto_resize_config=null,
+      cpus=null,
+      memory=null,
+      replicas=null
+    ):: std.prune(a={
+      auto_resize_config: auto_resize_config,
+      cpus: cpus,
+      memory: memory,
+      replicas: replicas,
+    }),
+  },
+  dataplane_v2:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.dataplane_v2.new` constructs a new object with attributes and blocks configured for the `dataplane_v2`\nTerraform sub block.\n\n\n\n**Args**:\n  - `advanced_networking` (`bool`): Enable advanced networking which requires dataplane_v2_enabled to be set true. When `null`, the `advanced_networking` field will be omitted from the resulting object.\n  - `dataplane_v2_enabled` (`bool`): Enables Dataplane V2. When `null`, the `dataplane_v2_enabled` field will be omitted from the resulting object.\n  - `windows_dataplane_v2_enabled` (`bool`): Enable Dataplane V2 for clusters with Windows nodes. When `null`, the `windows_dataplane_v2_enabled` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `dataplane_v2` sub block.\n', args=[]),
+    new(
+      advanced_networking=null,
+      dataplane_v2_enabled=null,
+      windows_dataplane_v2_enabled=null
+    ):: std.prune(a={
+      advanced_networking: advanced_networking,
+      dataplane_v2_enabled: dataplane_v2_enabled,
+      windows_dataplane_v2_enabled: windows_dataplane_v2_enabled,
+    }),
+  },
+  load_balancer:: {
+    f5_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.load_balancer.f5_config.new` constructs a new object with attributes and blocks configured for the `f5_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `address` (`string`): The load balancer's IP address. When `null`, the `address` field will be omitted from the resulting object.\n  - `partition` (`string`): he preexisting partition to be used by the load balancer. T\nhis partition is usually created for the admin cluster for example:\n'my-f5-admin-partition'. When `null`, the `partition` field will be omitted from the resulting object.\n  - `snat_pool` (`string`): The pool name. Only necessary, if using SNAT. When `null`, the `snat_pool` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `f5_config` sub block.\n', args=[]),
+      new(
+        address=null,
+        partition=null,
+        snat_pool=null
+      ):: std.prune(a={
+        address: address,
+        partition: partition,
+        snat_pool: snat_pool,
+      }),
+    },
+    manual_lb_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.load_balancer.manual_lb_config.new` constructs a new object with attributes and blocks configured for the `manual_lb_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `control_plane_node_port` (`number`): NodePort for control plane service. The Kubernetes API server in the admin\ncluster is implemented as a Service of type NodePort (ex. 30968). When `null`, the `control_plane_node_port` field will be omitted from the resulting object.\n  - `ingress_http_node_port` (`number`): NodePort for ingress service's http. The ingress service in the admin\ncluster is implemented as a Service of type NodePort (ex. 32527). When `null`, the `ingress_http_node_port` field will be omitted from the resulting object.\n  - `ingress_https_node_port` (`number`): NodePort for ingress service's https. The ingress service in the admin\ncluster is implemented as a Service of type NodePort (ex. 30139). When `null`, the `ingress_https_node_port` field will be omitted from the resulting object.\n  - `konnectivity_server_node_port` (`number`): NodePort for konnectivity server service running as a sidecar in each\nkube-apiserver pod (ex. 30564). When `null`, the `konnectivity_server_node_port` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `manual_lb_config` sub block.\n', args=[]),
+      new(
+        control_plane_node_port=null,
+        ingress_http_node_port=null,
+        ingress_https_node_port=null,
+        konnectivity_server_node_port=null
+      ):: std.prune(a={
+        control_plane_node_port: control_plane_node_port,
+        ingress_http_node_port: ingress_http_node_port,
+        ingress_https_node_port: ingress_https_node_port,
+        konnectivity_server_node_port: konnectivity_server_node_port,
+      }),
+    },
+    metal_lb_config:: {
+      address_pools:: {
+        '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.load_balancer.metal_lb_config.address_pools.new` constructs a new object with attributes and blocks configured for the `address_pools`\nTerraform sub block.\n\n\n\n**Args**:\n  - `addresses` (`list`): The addresses that are part of this pool. Each address\nmust be either in the CIDR form (1.2.3.0/24) or range\nform (1.2.3.1-1.2.3.5).\n  - `avoid_buggy_ips` (`bool`): If true, avoid using IPs ending in .0 or .255.\nThis avoids buggy consumer devices mistakenly dropping IPv4 traffic for\nthose special IP addresses. When `null`, the `avoid_buggy_ips` field will be omitted from the resulting object.\n  - `manual_assign` (`bool`): If true, prevent IP addresses from being automatically assigned. When `null`, the `manual_assign` field will be omitted from the resulting object.\n  - `pool` (`string`): The name of the address pool.\n\n**Returns**:\n  - An attribute object that represents the `address_pools` sub block.\n', args=[]),
+        new(
+          addresses,
+          pool,
+          avoid_buggy_ips=null,
+          manual_assign=null
+        ):: std.prune(a={
+          addresses: addresses,
+          avoid_buggy_ips: avoid_buggy_ips,
+          manual_assign: manual_assign,
+          pool: pool,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.load_balancer.metal_lb_config.new` constructs a new object with attributes and blocks configured for the `metal_lb_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `address_pools` (`list[obj]`): AddressPools is a list of non-overlapping IP pools used by load balancer\ntyped services. All addresses must be routable to load balancer nodes.\nIngressVIP must be included in the pools. When `null`, the `address_pools` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.load_balancer.metal_lb_config.address_pools.new](#fn-load_balancerload_balanceraddress_poolsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `metal_lb_config` sub block.\n', args=[]),
+      new(
+        address_pools=null
+      ):: std.prune(a={
+        address_pools: address_pools,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.load_balancer.new` constructs a new object with attributes and blocks configured for the `load_balancer`\nTerraform sub block.\n\n\n\n**Args**:\n  - `f5_config` (`list[obj]`): Configuration for F5 Big IP typed load balancers. When `null`, the `f5_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.load_balancer.f5_config.new](#fn-load_balancerf5_confignew) constructor.\n  - `manual_lb_config` (`list[obj]`): Manually configured load balancers. When `null`, the `manual_lb_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.load_balancer.manual_lb_config.new](#fn-load_balancermanual_lb_confignew) constructor.\n  - `metal_lb_config` (`list[obj]`): Configuration for MetalLB typed load balancers. When `null`, the `metal_lb_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.load_balancer.metal_lb_config.new](#fn-load_balancermetal_lb_confignew) constructor.\n  - `vip_config` (`list[obj]`): The VIPs used by the load balancer. When `null`, the `vip_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.load_balancer.vip_config.new](#fn-load_balancervip_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `load_balancer` sub block.\n', args=[]),
+    new(
+      f5_config=null,
+      manual_lb_config=null,
+      metal_lb_config=null,
+      vip_config=null
+    ):: std.prune(a={
+      f5_config: f5_config,
+      manual_lb_config: manual_lb_config,
+      metal_lb_config: metal_lb_config,
+      vip_config: vip_config,
+    }),
+    vip_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.load_balancer.vip_config.new` constructs a new object with attributes and blocks configured for the `vip_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `control_plane_vip` (`string`): The VIP which you previously set aside for the Kubernetes API of this cluster. When `null`, the `control_plane_vip` field will be omitted from the resulting object.\n  - `ingress_vip` (`string`): The VIP which you previously set aside for ingress traffic into this cluster. When `null`, the `ingress_vip` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `vip_config` sub block.\n', args=[]),
+      new(
+        control_plane_vip=null,
+        ingress_vip=null
+      ):: std.prune(a={
+        control_plane_vip: control_plane_vip,
+        ingress_vip: ingress_vip,
+      }),
+    },
+  },
+  network_config:: {
+    control_plane_v2_config:: {
+      control_plane_ip_block:: {
+        ips:: {
+          '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.network_config.control_plane_v2_config.control_plane_ip_block.ips.new` constructs a new object with attributes and blocks configured for the `ips`\nTerraform sub block.\n\n\n\n**Args**:\n  - `hostname` (`string`): Hostname of the machine. VM's name will be used if this field is empty. When `null`, the `hostname` field will be omitted from the resulting object.\n  - `ip` (`string`): IP could be an IP address (like 1.2.3.4) or a CIDR (like 1.2.3.0/24). When `null`, the `ip` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `ips` sub block.\n', args=[]),
+          new(
+            hostname=null,
+            ip=null
+          ):: std.prune(a={
+            hostname: hostname,
+            ip: ip,
+          }),
+        },
+        '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.network_config.control_plane_v2_config.control_plane_ip_block.new` constructs a new object with attributes and blocks configured for the `control_plane_ip_block`\nTerraform sub block.\n\n\n\n**Args**:\n  - `gateway` (`string`): The network gateway used by the VMware User Cluster. When `null`, the `gateway` field will be omitted from the resulting object.\n  - `netmask` (`string`): The netmask used by the VMware User Cluster. When `null`, the `netmask` field will be omitted from the resulting object.\n  - `ips` (`list[obj]`): The node's network configurations used by the VMware User Cluster. When `null`, the `ips` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.control_plane_v2_config.control_plane_ip_block.ips.new](#fn-network_confignetwork_configcontrol_plane_v2_configipsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `control_plane_ip_block` sub block.\n', args=[]),
+        new(
+          gateway=null,
+          ips=null,
+          netmask=null
+        ):: std.prune(a={
+          gateway: gateway,
+          ips: ips,
+          netmask: netmask,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.network_config.control_plane_v2_config.new` constructs a new object with attributes and blocks configured for the `control_plane_v2_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `control_plane_ip_block` (`list[obj]`): Static IP addresses for the control plane nodes. When `null`, the `control_plane_ip_block` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.control_plane_v2_config.control_plane_ip_block.new](#fn-network_confignetwork_configcontrol_plane_ip_blocknew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `control_plane_v2_config` sub block.\n', args=[]),
+      new(
+        control_plane_ip_block=null
+      ):: std.prune(a={
+        control_plane_ip_block: control_plane_ip_block,
+      }),
+    },
+    dhcp_ip_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.network_config.dhcp_ip_config.new` constructs a new object with attributes and blocks configured for the `dhcp_ip_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): enabled is a flag to mark if DHCP IP allocation is\nused for VMware user clusters.\n\n**Returns**:\n  - An attribute object that represents the `dhcp_ip_config` sub block.\n', args=[]),
+      new(
+        enabled
+      ):: std.prune(a={
+        enabled: enabled,
+      }),
+    },
+    host_config:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.network_config.host_config.new` constructs a new object with attributes and blocks configured for the `host_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `dns_search_domains` (`list`): DNS search domains. When `null`, the `dns_search_domains` field will be omitted from the resulting object.\n  - `dns_servers` (`list`): DNS servers. When `null`, the `dns_servers` field will be omitted from the resulting object.\n  - `ntp_servers` (`list`): NTP servers. When `null`, the `ntp_servers` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `host_config` sub block.\n', args=[]),
+      new(
+        dns_search_domains=null,
+        dns_servers=null,
+        ntp_servers=null
+      ):: std.prune(a={
+        dns_search_domains: dns_search_domains,
+        dns_servers: dns_servers,
+        ntp_servers: ntp_servers,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.network_config.new` constructs a new object with attributes and blocks configured for the `network_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `pod_address_cidr_blocks` (`list`): All pods in the cluster are assigned an RFC1918 IPv4 address from these ranges.\nOnly a single range is supported. This field cannot be changed after creation.\n  - `service_address_cidr_blocks` (`list`): All services in the cluster are assigned an RFC1918 IPv4 address\nfrom these ranges. Only a single range is supported.. This field\ncannot be changed after creation.\n  - `control_plane_v2_config` (`list[obj]`): Configuration for control plane V2 mode. When `null`, the `control_plane_v2_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.control_plane_v2_config.new](#fn-network_configcontrol_plane_v2_confignew) constructor.\n  - `dhcp_ip_config` (`list[obj]`): Configuration settings for a DHCP IP configuration. When `null`, the `dhcp_ip_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.dhcp_ip_config.new](#fn-network_configdhcp_ip_confignew) constructor.\n  - `host_config` (`list[obj]`): Represents common network settings irrespective of the host's IP address. When `null`, the `host_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.host_config.new](#fn-network_confighost_confignew) constructor.\n  - `static_ip_config` (`list[obj]`): Configuration settings for a static IP configuration. When `null`, the `static_ip_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.static_ip_config.new](#fn-network_configstatic_ip_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `network_config` sub block.\n', args=[]),
+    new(
+      pod_address_cidr_blocks,
+      service_address_cidr_blocks,
+      control_plane_v2_config=null,
+      dhcp_ip_config=null,
+      host_config=null,
+      static_ip_config=null
+    ):: std.prune(a={
+      control_plane_v2_config: control_plane_v2_config,
+      dhcp_ip_config: dhcp_ip_config,
+      host_config: host_config,
+      pod_address_cidr_blocks: pod_address_cidr_blocks,
+      service_address_cidr_blocks: service_address_cidr_blocks,
+      static_ip_config: static_ip_config,
+    }),
+    static_ip_config:: {
+      ip_blocks:: {
+        ips:: {
+          '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.network_config.static_ip_config.ip_blocks.ips.new` constructs a new object with attributes and blocks configured for the `ips`\nTerraform sub block.\n\n\n\n**Args**:\n  - `hostname` (`string`): Hostname of the machine. VM's name will be used if this field is empty. When `null`, the `hostname` field will be omitted from the resulting object.\n  - `ip` (`string`): IP could be an IP address (like 1.2.3.4) or a CIDR (like 1.2.3.0/24).\n\n**Returns**:\n  - An attribute object that represents the `ips` sub block.\n', args=[]),
+          new(
+            ip,
+            hostname=null
+          ):: std.prune(a={
+            hostname: hostname,
+            ip: ip,
+          }),
+        },
+        '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.network_config.static_ip_config.ip_blocks.new` constructs a new object with attributes and blocks configured for the `ip_blocks`\nTerraform sub block.\n\n\n\n**Args**:\n  - `gateway` (`string`): The network gateway used by the VMware User Cluster.\n  - `netmask` (`string`): The netmask used by the VMware User Cluster.\n  - `ips` (`list[obj]`): The node's network configurations used by the VMware User Cluster. When `null`, the `ips` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.static_ip_config.ip_blocks.ips.new](#fn-network_confignetwork_configstatic_ip_configipsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `ip_blocks` sub block.\n', args=[]),
+        new(
+          gateway,
+          netmask,
+          ips=null
+        ):: std.prune(a={
+          gateway: gateway,
+          ips: ips,
+          netmask: netmask,
+        }),
+      },
+      '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.network_config.static_ip_config.new` constructs a new object with attributes and blocks configured for the `static_ip_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `ip_blocks` (`list[obj]`): Represents the configuration values for static IP allocation to nodes. When `null`, the `ip_blocks` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.static_ip_config.ip_blocks.new](#fn-network_confignetwork_configip_blocksnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `static_ip_config` sub block.\n', args=[]),
+      new(
+        ip_blocks=null
+      ):: std.prune(a={
+        ip_blocks: ip_blocks,
+      }),
+    },
+  },
+  '#new':: d.fn(help="\n`google.gkeonprem_vmware_cluster.new` injects a new `google_gkeonprem_vmware_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gkeonprem_vmware_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gkeonprem_vmware_cluster` using the reference:\n\n    $._ref.google_gkeonprem_vmware_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gkeonprem_vmware_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `admin_cluster_membership` (`string`): The admin cluster this VMware User Cluster belongs to.\nThis is the full resource name of the admin cluster\u0026#39;s hub membership.\nIn the future, references to other resource types might be allowed if\nadmin clusters are modeled as their own resources.\n  - `annotations` (`obj`): Annotations on the VMware User Cluster.\nThis field has the same restrictions as Kubernetes annotations.\nThe total size of all keys and values combined is limited to 256k.\nKey can have 2 segments: prefix (optional) and name (required),\nseparated by a slash (/).\nPrefix must be a DNS subdomain.\nName must be 63 characters or less, begin and end with alphanumerics,\nwith dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field \u0026#39;effective_annotations\u0026#39; for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `description` (`string`): A human readable description of this VMware User Cluster. When `null`, the `description` field will be omitted from the resulting object.\n  - `enable_control_plane_v2` (`bool`): Enable control plane V2. Default to false. When `null`, the `enable_control_plane_v2` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the resource.\n  - `name` (`string`): The VMware cluster name.\n  - `on_prem_version` (`string`): The Anthos clusters on the VMware version for your user cluster.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `vm_tracking_enabled` (`bool`): Enable VM tracking. When `null`, the `vm_tracking_enabled` field will be omitted from the resulting object.\n  - `anti_affinity_groups` (`list[obj]`): AAGConfig specifies whether to spread VMware User Cluster nodes across at\nleast three physical hosts in the datacenter. When `null`, the `anti_affinity_groups` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.anti_affinity_groups.new](#fn-anti_affinity_groupsnew) constructor.\n  - `authorization` (`list[obj]`): RBAC policy that will be applied and managed by GKE On-Prem. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.authorization.new](#fn-authorizationnew) constructor.\n  - `auto_repair_config` (`list[obj]`): Configuration for auto repairing. When `null`, the `auto_repair_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.auto_repair_config.new](#fn-auto_repair_confignew) constructor.\n  - `control_plane_node` (`list[obj]`): VMware User Cluster control plane nodes must have either 1 or 3 replicas. When `null`, the `control_plane_node` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.control_plane_node.new](#fn-control_plane_nodenew) constructor.\n  - `dataplane_v2` (`list[obj]`): VmwareDataplaneV2Config specifies configuration for Dataplane V2. When `null`, the `dataplane_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.dataplane_v2.new](#fn-dataplane_v2new) constructor.\n  - `load_balancer` (`list[obj]`): Load Balancer configuration. When `null`, the `load_balancer` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.load_balancer.new](#fn-load_balancernew) constructor.\n  - `network_config` (`list[obj]`): The VMware User Cluster network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.new](#fn-network_confignew) constructor.\n  - `storage` (`list[obj]`): Storage configuration. When `null`, the `storage` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.storage.new](#fn-storagenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n  - `upgrade_policy` (`list[obj]`): Specifies upgrade policy for the cluster. When `null`, the `upgrade_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.upgrade_policy.new](#fn-upgrade_policynew) constructor.\n  - `vcenter` (`list[obj]`): VmwareVCenterConfig specifies vCenter config for the user cluster.\nInherited from the admin cluster. When `null`, the `vcenter` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.vcenter.new](#fn-vcenternew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    admin_cluster_membership,
+    location,
+    name,
+    on_prem_version,
+    annotations=null,
+    anti_affinity_groups=null,
+    authorization=null,
+    auto_repair_config=null,
+    control_plane_node=null,
+    dataplane_v2=null,
+    description=null,
+    enable_control_plane_v2=null,
+    load_balancer=null,
+    network_config=null,
+    project=null,
+    storage=null,
+    timeouts=null,
+    upgrade_policy=null,
+    vcenter=null,
+    vm_tracking_enabled=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_gkeonprem_vmware_cluster',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      admin_cluster_membership=admin_cluster_membership,
+      annotations=annotations,
+      anti_affinity_groups=anti_affinity_groups,
+      authorization=authorization,
+      auto_repair_config=auto_repair_config,
+      control_plane_node=control_plane_node,
+      dataplane_v2=dataplane_v2,
+      description=description,
+      enable_control_plane_v2=enable_control_plane_v2,
+      load_balancer=load_balancer,
+      location=location,
+      name=name,
+      network_config=network_config,
+      on_prem_version=on_prem_version,
+      project=project,
+      storage=storage,
+      timeouts=timeouts,
+      upgrade_policy=upgrade_policy,
+      vcenter=vcenter,
+      vm_tracking_enabled=vm_tracking_enabled
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.gkeonprem_vmware_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `gkeonprem_vmware_cluster`\nTerraform resource.\n\nUnlike [google.gkeonprem_vmware_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `admin_cluster_membership` (`string`): The admin cluster this VMware User Cluster belongs to.\nThis is the full resource name of the admin cluster's hub membership.\nIn the future, references to other resource types might be allowed if\nadmin clusters are modeled as their own resources.\n  - `annotations` (`obj`): Annotations on the VMware User Cluster.\nThis field has the same restrictions as Kubernetes annotations.\nThe total size of all keys and values combined is limited to 256k.\nKey can have 2 segments: prefix (optional) and name (required),\nseparated by a slash (/).\nPrefix must be a DNS subdomain.\nName must be 63 characters or less, begin and end with alphanumerics,\nwith dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `description` (`string`): A human readable description of this VMware User Cluster. When `null`, the `description` field will be omitted from the resulting object.\n  - `enable_control_plane_v2` (`bool`): Enable control plane V2. Default to false. When `null`, the `enable_control_plane_v2` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the resource.\n  - `name` (`string`): The VMware cluster name.\n  - `on_prem_version` (`string`): The Anthos clusters on the VMware version for your user cluster.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `vm_tracking_enabled` (`bool`): Enable VM tracking. When `null`, the `vm_tracking_enabled` field will be omitted from the resulting object.\n  - `anti_affinity_groups` (`list[obj]`): AAGConfig specifies whether to spread VMware User Cluster nodes across at\nleast three physical hosts in the datacenter. When `null`, the `anti_affinity_groups` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.anti_affinity_groups.new](#fn-anti_affinity_groupsnew) constructor.\n  - `authorization` (`list[obj]`): RBAC policy that will be applied and managed by GKE On-Prem. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.authorization.new](#fn-authorizationnew) constructor.\n  - `auto_repair_config` (`list[obj]`): Configuration for auto repairing. When `null`, the `auto_repair_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.auto_repair_config.new](#fn-auto_repair_confignew) constructor.\n  - `control_plane_node` (`list[obj]`): VMware User Cluster control plane nodes must have either 1 or 3 replicas. When `null`, the `control_plane_node` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.control_plane_node.new](#fn-control_plane_nodenew) constructor.\n  - `dataplane_v2` (`list[obj]`): VmwareDataplaneV2Config specifies configuration for Dataplane V2. When `null`, the `dataplane_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.dataplane_v2.new](#fn-dataplane_v2new) constructor.\n  - `load_balancer` (`list[obj]`): Load Balancer configuration. When `null`, the `load_balancer` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.load_balancer.new](#fn-load_balancernew) constructor.\n  - `network_config` (`list[obj]`): The VMware User Cluster network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.new](#fn-network_confignew) constructor.\n  - `storage` (`list[obj]`): Storage configuration. When `null`, the `storage` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.storage.new](#fn-storagenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n  - `upgrade_policy` (`list[obj]`): Specifies upgrade policy for the cluster. When `null`, the `upgrade_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.upgrade_policy.new](#fn-upgrade_policynew) constructor.\n  - `vcenter` (`list[obj]`): VmwareVCenterConfig specifies vCenter config for the user cluster.\nInherited from the admin cluster. When `null`, the `vcenter` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.vcenter.new](#fn-vcenternew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gkeonprem_vmware_cluster` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    admin_cluster_membership,
+    location,
+    name,
+    on_prem_version,
+    annotations=null,
+    anti_affinity_groups=null,
+    authorization=null,
+    auto_repair_config=null,
+    control_plane_node=null,
+    dataplane_v2=null,
+    description=null,
+    enable_control_plane_v2=null,
+    load_balancer=null,
+    network_config=null,
+    project=null,
+    storage=null,
+    timeouts=null,
+    upgrade_policy=null,
+    vcenter=null,
+    vm_tracking_enabled=null
+  ):: std.prune(a={
+    admin_cluster_membership: admin_cluster_membership,
+    annotations: annotations,
+    anti_affinity_groups: anti_affinity_groups,
+    authorization: authorization,
+    auto_repair_config: auto_repair_config,
+    control_plane_node: control_plane_node,
+    dataplane_v2: dataplane_v2,
+    description: description,
+    enable_control_plane_v2: enable_control_plane_v2,
+    load_balancer: load_balancer,
+    location: location,
+    name: name,
+    network_config: network_config,
+    on_prem_version: on_prem_version,
+    project: project,
+    storage: storage,
+    timeouts: timeouts,
+    upgrade_policy: upgrade_policy,
+    vcenter: vcenter,
+    vm_tracking_enabled: vm_tracking_enabled,
+  }),
+  storage:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.storage.new` constructs a new object with attributes and blocks configured for the `storage`\nTerraform sub block.\n\n\n\n**Args**:\n  - `vsphere_csi_disabled` (`bool`): Whether or not to deploy vSphere CSI components in the VMware User Cluster.\nEnabled by default.\n\n**Returns**:\n  - An attribute object that represents the `storage` sub block.\n', args=[]),
+    new(
+      vsphere_csi_disabled
+    ):: std.prune(a={
+      vsphere_csi_disabled: vsphere_csi_disabled,
+    }),
+  },
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  upgrade_policy:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.upgrade_policy.new` constructs a new object with attributes and blocks configured for the `upgrade_policy`\nTerraform sub block.\n\n\n\n**Args**:\n  - `control_plane_only` (`bool`): Controls whether the upgrade applies to the control plane only. When `null`, the `control_plane_only` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `upgrade_policy` sub block.\n', args=[]),
+    new(
+      control_plane_only=null
+    ):: std.prune(a={
+      control_plane_only: control_plane_only,
+    }),
+  },
+  vcenter:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_vmware_cluster.vcenter.new` constructs a new object with attributes and blocks configured for the `vcenter`\nTerraform sub block.\n\n\n\n**Args**:\n  - `ca_cert_data` (`string`): Contains the vCenter CA certificate public key for SSL verification. When `null`, the `ca_cert_data` field will be omitted from the resulting object.\n  - `cluster` (`string`): The name of the vCenter cluster for the user cluster. When `null`, the `cluster` field will be omitted from the resulting object.\n  - `datacenter` (`string`): The name of the vCenter datacenter for the user cluster. When `null`, the `datacenter` field will be omitted from the resulting object.\n  - `datastore` (`string`): The name of the vCenter datastore for the user cluster. When `null`, the `datastore` field will be omitted from the resulting object.\n  - `folder` (`string`): The name of the vCenter folder for the user cluster. When `null`, the `folder` field will be omitted from the resulting object.\n  - `resource_pool` (`string`): The name of the vCenter resource pool for the user cluster. When `null`, the `resource_pool` field will be omitted from the resulting object.\n  - `storage_policy_name` (`string`): The name of the vCenter storage policy for the user cluster. When `null`, the `storage_policy_name` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `vcenter` sub block.\n', args=[]),
+    new(
+      ca_cert_data=null,
+      cluster=null,
+      datacenter=null,
+      datastore=null,
+      folder=null,
+      resource_pool=null,
+      storage_policy_name=null
+    ):: std.prune(a={
+      ca_cert_data: ca_cert_data,
+      cluster: cluster,
+      datacenter: datacenter,
+      datastore: datastore,
+      folder: folder,
+      resource_pool: resource_pool,
+      storage_policy_name: storage_policy_name,
+    }),
+  },
+  '#withAdminClusterMembership':: d.fn(help='`google.string.withAdminClusterMembership` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the admin_cluster_membership field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `admin_cluster_membership` field.\n', args=[]),
+  withAdminClusterMembership(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          admin_cluster_membership: value,
+        },
+      },
+    },
+  },
+  '#withAnnotations':: d.fn(help='`google.obj.withAnnotations` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the annotations field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `annotations` field.\n', args=[]),
+  withAnnotations(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          annotations: value,
+        },
+      },
+    },
+  },
+  '#withAntiAffinityGroups':: d.fn(help='`google.list[obj].withAntiAffinityGroups` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the anti_affinity_groups field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withAntiAffinityGroupsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `anti_affinity_groups` field.\n', args=[]),
+  withAntiAffinityGroups(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          anti_affinity_groups: value,
+        },
+      },
+    },
+  },
+  '#withAntiAffinityGroupsMixin':: d.fn(help='`google.list[obj].withAntiAffinityGroupsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the anti_affinity_groups field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withAntiAffinityGroups](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `anti_affinity_groups` field.\n', args=[]),
+  withAntiAffinityGroupsMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          anti_affinity_groups+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withAuthorization':: d.fn(help='`google.list[obj].withAuthorization` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the authorization field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withAuthorizationMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `authorization` field.\n', args=[]),
+  withAuthorization(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          authorization: value,
+        },
+      },
+    },
+  },
+  '#withAuthorizationMixin':: d.fn(help='`google.list[obj].withAuthorizationMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the authorization field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withAuthorization](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `authorization` field.\n', args=[]),
+  withAuthorizationMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          authorization+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withAutoRepairConfig':: d.fn(help='`google.list[obj].withAutoRepairConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the auto_repair_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withAutoRepairConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `auto_repair_config` field.\n', args=[]),
+  withAutoRepairConfig(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          auto_repair_config: value,
+        },
+      },
+    },
+  },
+  '#withAutoRepairConfigMixin':: d.fn(help='`google.list[obj].withAutoRepairConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the auto_repair_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withAutoRepairConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `auto_repair_config` field.\n', args=[]),
+  withAutoRepairConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          auto_repair_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withControlPlaneNode':: d.fn(help='`google.list[obj].withControlPlaneNode` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the control_plane_node field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withControlPlaneNodeMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `control_plane_node` field.\n', args=[]),
+  withControlPlaneNode(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          control_plane_node: value,
+        },
+      },
+    },
+  },
+  '#withControlPlaneNodeMixin':: d.fn(help='`google.list[obj].withControlPlaneNodeMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the control_plane_node field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withControlPlaneNode](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `control_plane_node` field.\n', args=[]),
+  withControlPlaneNodeMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          control_plane_node+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withDataplaneV2':: d.fn(help='`google.list[obj].withDataplaneV2` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the dataplane_v2 field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withDataplaneV2Mixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `dataplane_v2` field.\n', args=[]),
+  withDataplaneV2(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          dataplane_v2: value,
+        },
+      },
+    },
+  },
+  '#withDataplaneV2Mixin':: d.fn(help='`google.list[obj].withDataplaneV2Mixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the dataplane_v2 field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withDataplaneV2](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `dataplane_v2` field.\n', args=[]),
+  withDataplaneV2Mixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          dataplane_v2+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
+  withDescription(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          description: value,
+        },
+      },
+    },
+  },
+  '#withEnableControlPlaneV2':: d.fn(help='`google.bool.withEnableControlPlaneV2` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the enable_control_plane_v2 field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `enable_control_plane_v2` field.\n', args=[]),
+  withEnableControlPlaneV2(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          enable_control_plane_v2: value,
+        },
+      },
+    },
+  },
+  '#withLoadBalancer':: d.fn(help='`google.list[obj].withLoadBalancer` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the load_balancer field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withLoadBalancerMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `load_balancer` field.\n', args=[]),
+  withLoadBalancer(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          load_balancer: value,
+        },
+      },
+    },
+  },
+  '#withLoadBalancerMixin':: d.fn(help='`google.list[obj].withLoadBalancerMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the load_balancer field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withLoadBalancer](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `load_balancer` field.\n', args=[]),
+  withLoadBalancerMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          load_balancer+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withNetworkConfig':: d.fn(help='`google.list[obj].withNetworkConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the network_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withNetworkConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `network_config` field.\n', args=[]),
+  withNetworkConfig(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          network_config: value,
+        },
+      },
+    },
+  },
+  '#withNetworkConfigMixin':: d.fn(help='`google.list[obj].withNetworkConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the network_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withNetworkConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `network_config` field.\n', args=[]),
+  withNetworkConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          network_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withOnPremVersion':: d.fn(help='`google.string.withOnPremVersion` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the on_prem_version field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `on_prem_version` field.\n', args=[]),
+  withOnPremVersion(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          on_prem_version: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withStorage':: d.fn(help='`google.list[obj].withStorage` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the storage field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withStorageMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `storage` field.\n', args=[]),
+  withStorage(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          storage: value,
+        },
+      },
+    },
+  },
+  '#withStorageMixin':: d.fn(help='`google.list[obj].withStorageMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the storage field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withStorage](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `storage` field.\n', args=[]),
+  withStorageMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          storage+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+  '#withUpgradePolicy':: d.fn(help='`google.list[obj].withUpgradePolicy` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the upgrade_policy field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withUpgradePolicyMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `upgrade_policy` field.\n', args=[]),
+  withUpgradePolicy(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          upgrade_policy: value,
+        },
+      },
+    },
+  },
+  '#withUpgradePolicyMixin':: d.fn(help='`google.list[obj].withUpgradePolicyMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the upgrade_policy field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withUpgradePolicy](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `upgrade_policy` field.\n', args=[]),
+  withUpgradePolicyMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          upgrade_policy+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withVcenter':: d.fn(help='`google.list[obj].withVcenter` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the vcenter field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withVcenterMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `vcenter` field.\n', args=[]),
+  withVcenter(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          vcenter: value,
+        },
+      },
+    },
+  },
+  '#withVcenterMixin':: d.fn(help='`google.list[obj].withVcenterMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the vcenter field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withVcenter](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `vcenter` field.\n', args=[]),
+  withVcenterMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          vcenter+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withVmTrackingEnabled':: d.fn(help='`google.bool.withVmTrackingEnabled` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the vm_tracking_enabled field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `vm_tracking_enabled` field.\n', args=[]),
+  withVmTrackingEnabled(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_cluster+: {
+        [resourceLabel]+: {
+          vm_tracking_enabled: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/gkeonprem_vmware_node_pool.libsonnet b/4.x/_gen/resources/gkeonprem_vmware_node_pool.libsonnet
new file mode 100644
index 00000000..fed5285d
--- /dev/null
+++ b/4.x/_gen/resources/gkeonprem_vmware_node_pool.libsonnet
@@ -0,0 +1,234 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='gkeonprem_vmware_node_pool', url='', help='`gkeonprem_vmware_node_pool` represents the `google_gkeonprem_vmware_node_pool` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  config:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_vmware_node_pool.config.new` constructs a new object with attributes and blocks configured for the `config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `boot_disk_size_gb` (`number`): VMware disk size to be used during creation. When `null`, the `boot_disk_size_gb` field will be omitted from the resulting object.\n  - `cpus` (`number`): The number of CPUs for each node in the node pool. When `null`, the `cpus` field will be omitted from the resulting object.\n  - `enable_load_balancer` (`bool`): Allow node pool traffic to be load balanced. Only works for clusters with\nMetalLB load balancers. When `null`, the `enable_load_balancer` field will be omitted from the resulting object.\n  - `image` (`string`): The OS image name in vCenter, only valid when using Windows. When `null`, the `image` field will be omitted from the resulting object.\n  - `image_type` (`string`): The OS image to be used for each node in a node pool.\nCurrently 'cos', 'ubuntu', 'ubuntu_containerd' and 'windows' are supported.\n  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to each node.\nThese will added in addition to any default label(s) that\nKubernetes may apply to the node.\nIn case of conflict in label keys, the applied set may differ depending on\nthe Kubernetes version -- it's best to assume the behavior is undefined\nand conflicts should be avoided. When `null`, the `labels` field will be omitted from the resulting object.\n  - `memory_mb` (`number`): The megabytes of memory for each node in the node pool. When `null`, the `memory_mb` field will be omitted from the resulting object.\n  - `replicas` (`number`): The number of nodes in the node pool. When `null`, the `replicas` field will be omitted from the resulting object.\n  - `taints` (`list[obj]`): The initial taints assigned to nodes of this node pool. When `null`, the `taints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_node_pool.config.taints.new](#fn-configtaintsnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `config` sub block.\n', args=[]),
+    new(
+      image_type,
+      boot_disk_size_gb=null,
+      cpus=null,
+      enable_load_balancer=null,
+      image=null,
+      labels=null,
+      memory_mb=null,
+      replicas=null,
+      taints=null
+    ):: std.prune(a={
+      boot_disk_size_gb: boot_disk_size_gb,
+      cpus: cpus,
+      enable_load_balancer: enable_load_balancer,
+      image: image,
+      image_type: image_type,
+      labels: labels,
+      memory_mb: memory_mb,
+      replicas: replicas,
+      taints: taints,
+    }),
+    taints:: {
+      '#new':: d.fn(help='\n`google.gkeonprem_vmware_node_pool.config.taints.new` constructs a new object with attributes and blocks configured for the `taints`\nTerraform sub block.\n\n\n\n**Args**:\n  - `effect` (`string`): Available taint effects. Possible values: ["EFFECT_UNSPECIFIED", "NO_SCHEDULE", "PREFER_NO_SCHEDULE", "NO_EXECUTE"] When `null`, the `effect` field will be omitted from the resulting object.\n  - `key` (`string`): Key associated with the effect.\n  - `value` (`string`): Value associated with the effect.\n\n**Returns**:\n  - An attribute object that represents the `taints` sub block.\n', args=[]),
+      new(
+        key,
+        value,
+        effect=null
+      ):: std.prune(a={
+        effect: effect,
+        key: key,
+        value: value,
+      }),
+    },
+  },
+  '#new':: d.fn(help="\n`google.gkeonprem_vmware_node_pool.new` injects a new `google_gkeonprem_vmware_node_pool` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.gkeonprem_vmware_node_pool.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.gkeonprem_vmware_node_pool` using the reference:\n\n    $._ref.google_gkeonprem_vmware_node_pool.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_gkeonprem_vmware_node_pool.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Annotations on the node Pool.\nThis field has the same restrictions as Kubernetes annotations.\nThe total size of all keys and values combined is limited to 256k.\nKey can have 2 segments: prefix (optional) and name (required),\nseparated by a slash (/).\nPrefix must be a DNS subdomain.\nName must be 63 characters or less, begin and end with alphanumerics,\nwith dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field \u0026#39;effective_annotations\u0026#39; for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `display_name` (`string`): The display name for the node pool. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the resource.\n  - `name` (`string`): The vmware node pool name.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `vmware_cluster` (`string`): The cluster this node pool belongs to.\n  - `config` (`list[obj]`): The node configuration of the node pool. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_node_pool.config.new](#fn-confignew) constructor.\n  - `node_pool_autoscaling` (`list[obj]`): Node Pool autoscaling config for the node pool. When `null`, the `node_pool_autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_node_pool.node_pool_autoscaling.new](#fn-node_pool_autoscalingnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_node_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    location,
+    name,
+    vmware_cluster,
+    annotations=null,
+    config=null,
+    display_name=null,
+    node_pool_autoscaling=null,
+    project=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_gkeonprem_vmware_node_pool',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      annotations=annotations,
+      config=config,
+      display_name=display_name,
+      location=location,
+      name=name,
+      node_pool_autoscaling=node_pool_autoscaling,
+      project=project,
+      timeouts=timeouts,
+      vmware_cluster=vmware_cluster
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.gkeonprem_vmware_node_pool.newAttrs` constructs a new object with attributes and blocks configured for the `gkeonprem_vmware_node_pool`\nTerraform resource.\n\nUnlike [google.gkeonprem_vmware_node_pool.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Annotations on the node Pool.\nThis field has the same restrictions as Kubernetes annotations.\nThe total size of all keys and values combined is limited to 256k.\nKey can have 2 segments: prefix (optional) and name (required),\nseparated by a slash (/).\nPrefix must be a DNS subdomain.\nName must be 63 characters or less, begin and end with alphanumerics,\nwith dashes (-), underscores (_), dots (.), and alphanumerics between.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `display_name` (`string`): The display name for the node pool. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the resource.\n  - `name` (`string`): The vmware node pool name.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `vmware_cluster` (`string`): The cluster this node pool belongs to.\n  - `config` (`list[obj]`): The node configuration of the node pool. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_node_pool.config.new](#fn-confignew) constructor.\n  - `node_pool_autoscaling` (`list[obj]`): Node Pool autoscaling config for the node pool. When `null`, the `node_pool_autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_node_pool.node_pool_autoscaling.new](#fn-node_pool_autoscalingnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_node_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gkeonprem_vmware_node_pool` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    location,
+    name,
+    vmware_cluster,
+    annotations=null,
+    config=null,
+    display_name=null,
+    node_pool_autoscaling=null,
+    project=null,
+    timeouts=null
+  ):: std.prune(a={
+    annotations: annotations,
+    config: config,
+    display_name: display_name,
+    location: location,
+    name: name,
+    node_pool_autoscaling: node_pool_autoscaling,
+    project: project,
+    timeouts: timeouts,
+    vmware_cluster: vmware_cluster,
+  }),
+  node_pool_autoscaling:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_vmware_node_pool.node_pool_autoscaling.new` constructs a new object with attributes and blocks configured for the `node_pool_autoscaling`\nTerraform sub block.\n\n\n\n**Args**:\n  - `max_replicas` (`number`): Maximum number of replicas in the NodePool.\n  - `min_replicas` (`number`): Minimum number of replicas in the NodePool.\n\n**Returns**:\n  - An attribute object that represents the `node_pool_autoscaling` sub block.\n', args=[]),
+    new(
+      max_replicas,
+      min_replicas
+    ):: std.prune(a={
+      max_replicas: max_replicas,
+      min_replicas: min_replicas,
+    }),
+  },
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.gkeonprem_vmware_node_pool.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withAnnotations':: d.fn(help='`google.obj.withAnnotations` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the annotations field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `annotations` field.\n', args=[]),
+  withAnnotations(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_node_pool+: {
+        [resourceLabel]+: {
+          annotations: value,
+        },
+      },
+    },
+  },
+  '#withConfig':: d.fn(help='`google.list[obj].withConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `config` field.\n', args=[]),
+  withConfig(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_node_pool+: {
+        [resourceLabel]+: {
+          config: value,
+        },
+      },
+    },
+  },
+  '#withConfigMixin':: d.fn(help='`google.list[obj].withConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `config` field.\n', args=[]),
+  withConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_node_pool+: {
+        [resourceLabel]+: {
+          config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withDisplayName':: d.fn(help='`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the display_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `display_name` field.\n', args=[]),
+  withDisplayName(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_node_pool+: {
+        [resourceLabel]+: {
+          display_name: value,
+        },
+      },
+    },
+  },
+  '#withLocation':: d.fn(help='`google.string.withLocation` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the location field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `location` field.\n', args=[]),
+  withLocation(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_node_pool+: {
+        [resourceLabel]+: {
+          location: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_node_pool+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withNodePoolAutoscaling':: d.fn(help='`google.list[obj].withNodePoolAutoscaling` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the node_pool_autoscaling field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withNodePoolAutoscalingMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `node_pool_autoscaling` field.\n', args=[]),
+  withNodePoolAutoscaling(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_node_pool+: {
+        [resourceLabel]+: {
+          node_pool_autoscaling: value,
+        },
+      },
+    },
+  },
+  '#withNodePoolAutoscalingMixin':: d.fn(help='`google.list[obj].withNodePoolAutoscalingMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the node_pool_autoscaling field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withNodePoolAutoscaling](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `node_pool_autoscaling` field.\n', args=[]),
+  withNodePoolAutoscalingMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_node_pool+: {
+        [resourceLabel]+: {
+          node_pool_autoscaling+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_node_pool+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_node_pool+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_node_pool+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+  '#withVmwareCluster':: d.fn(help='`google.string.withVmwareCluster` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the vmware_cluster field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `vmware_cluster` field.\n', args=[]),
+  withVmwareCluster(resourceLabel, value): {
+    resource+: {
+      google_gkeonprem_vmware_node_pool+: {
+        [resourceLabel]+: {
+          vmware_cluster: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/healthcare_consent_store.libsonnet b/4.x/_gen/resources/healthcare_consent_store.libsonnet
index e779f4d9..5b4eafba 100644
--- a/4.x/_gen/resources/healthcare_consent_store.libsonnet
+++ b/4.x/_gen/resources/healthcare_consent_store.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='healthcare_consent_store', url='', help='`healthcare_consent_store` represents the `google_healthcare_consent_store` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.healthcare_consent_store.new` injects a new `google_healthcare_consent_store` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.healthcare_consent_store.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.healthcare_consent_store` using the reference:\n\n    $._ref.google_healthcare_consent_store.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_healthcare_consent_store.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `dataset` (`string`): Identifies the dataset addressed by this request. Must be in the format\n\u0026#39;projects/{project}/locations/{location}/datasets/{dataset}\u0026#39;\n  - `default_consent_ttl` (`string`): Default time to live for consents in this store. Must be at least 24 hours. Updating this field will not affect the expiration time of existing consents.\n\nA duration in seconds with up to nine fractional digits, terminated by \u0026#39;s\u0026#39;. Example: \u0026#34;3.5s\u0026#34;. When `null`, the `default_consent_ttl` field will be omitted from the resulting object.\n  - `enable_consent_create_on_update` (`bool`): If true, [consents.patch] [google.cloud.healthcare.v1.consent.UpdateConsent] creates the consent if it does not already exist. When `null`, the `enable_consent_create_on_update` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-supplied key-value pairs used to organize Consent stores.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must\nconform to the following PCRE regular expression: \u0026#39;[\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\u0026#39;\n\nLabel values are optional, must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128\nbytes, and must conform to the following PCRE regular expression: \u0026#39;[\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\u0026#39;\n\nNo more than 64 labels can be associated with a given store.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs.\nExample: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of this ConsentStore, for example:\n\u0026#34;consent1\u0026#34;\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_consent_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.healthcare_consent_store.new` injects a new `google_healthcare_consent_store` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.healthcare_consent_store.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.healthcare_consent_store` using the reference:\n\n    $._ref.google_healthcare_consent_store.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_healthcare_consent_store.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `dataset` (`string`): Identifies the dataset addressed by this request. Must be in the format\n\u0026#39;projects/{project}/locations/{location}/datasets/{dataset}\u0026#39;\n  - `default_consent_ttl` (`string`): Default time to live for consents in this store. Must be at least 24 hours. Updating this field will not affect the expiration time of existing consents.\n\nA duration in seconds with up to nine fractional digits, terminated by \u0026#39;s\u0026#39;. Example: \u0026#34;3.5s\u0026#34;. When `null`, the `default_consent_ttl` field will be omitted from the resulting object.\n  - `enable_consent_create_on_update` (`bool`): If true, [consents.patch] [google.cloud.healthcare.v1.consent.UpdateConsent] creates the consent if it does not already exist. When `null`, the `enable_consent_create_on_update` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-supplied key-value pairs used to organize Consent stores.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must\nconform to the following PCRE regular expression: \u0026#39;[\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\u0026#39;\n\nLabel values are optional, must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128\nbytes, and must conform to the following PCRE regular expression: \u0026#39;[\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\u0026#39;\n\nNo more than 64 labels can be associated with a given store.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs.\nExample: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of this ConsentStore, for example:\n\u0026#34;consent1\u0026#34;\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_consent_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     dataset,
@@ -25,7 +25,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.healthcare_consent_store.newAttrs` constructs a new object with attributes and blocks configured for the `healthcare_consent_store`\nTerraform resource.\n\nUnlike [google.healthcare_consent_store.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `dataset` (`string`): Identifies the dataset addressed by this request. Must be in the format\n'projects/{project}/locations/{location}/datasets/{dataset}'\n  - `default_consent_ttl` (`string`): Default time to live for consents in this store. Must be at least 24 hours. Updating this field will not affect the expiration time of existing consents.\n\nA duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s". When `null`, the `default_consent_ttl` field will be omitted from the resulting object.\n  - `enable_consent_create_on_update` (`bool`): If true, [consents.patch] [google.cloud.healthcare.v1.consent.UpdateConsent] creates the consent if it does not already exist. When `null`, the `enable_consent_create_on_update` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-supplied key-value pairs used to organize Consent stores.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must\nconform to the following PCRE regular expression: '[\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}'\n\nLabel values are optional, must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128\nbytes, and must conform to the following PCRE regular expression: '[\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}'\n\nNo more than 64 labels can be associated with a given store.\n\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of this ConsentStore, for example:\n"consent1"\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_consent_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `healthcare_consent_store` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.healthcare_consent_store.newAttrs` constructs a new object with attributes and blocks configured for the `healthcare_consent_store`\nTerraform resource.\n\nUnlike [google.healthcare_consent_store.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `dataset` (`string`): Identifies the dataset addressed by this request. Must be in the format\n'projects/{project}/locations/{location}/datasets/{dataset}'\n  - `default_consent_ttl` (`string`): Default time to live for consents in this store. Must be at least 24 hours. Updating this field will not affect the expiration time of existing consents.\n\nA duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s". When `null`, the `default_consent_ttl` field will be omitted from the resulting object.\n  - `enable_consent_create_on_update` (`bool`): If true, [consents.patch] [google.cloud.healthcare.v1.consent.UpdateConsent] creates the consent if it does not already exist. When `null`, the `enable_consent_create_on_update` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-supplied key-value pairs used to organize Consent stores.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must\nconform to the following PCRE regular expression: '[\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}'\n\nLabel values are optional, must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128\nbytes, and must conform to the following PCRE regular expression: '[\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}'\n\nNo more than 64 labels can be associated with a given store.\n\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of this ConsentStore, for example:\n"consent1"\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_consent_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `healthcare_consent_store` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     dataset,
     name,
diff --git a/4.x/_gen/resources/healthcare_dicom_store.libsonnet b/4.x/_gen/resources/healthcare_dicom_store.libsonnet
index 7e442021..a18849e1 100644
--- a/4.x/_gen/resources/healthcare_dicom_store.libsonnet
+++ b/4.x/_gen/resources/healthcare_dicom_store.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='healthcare_dicom_store', url='', help='`healthcare_dicom_store` represents the `google_healthcare_dicom_store` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.healthcare_dicom_store.new` injects a new `google_healthcare_dicom_store` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.healthcare_dicom_store.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.healthcare_dicom_store` using the reference:\n\n    $._ref.google_healthcare_dicom_store.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_healthcare_dicom_store.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `dataset` (`string`): Identifies the dataset addressed by this request. Must be in the format\n\u0026#39;projects/{project}/locations/{location}/datasets/{dataset}\u0026#39;\n  - `labels` (`obj`): User-supplied key-value pairs used to organize DICOM stores.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must\nconform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\n\nLabel values are optional, must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128\nbytes, and must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\n\nNo more than 64 labels can be associated with a given store.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs.\nExample: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the DicomStore.\n\n** Changing this property may recreate the Dicom store (removing all data) **\n  - `notification_config` (`list[obj]`): A nested object resource When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_dicom_store.notification_config.new](#fn-notification_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_dicom_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.healthcare_dicom_store.new` injects a new `google_healthcare_dicom_store` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.healthcare_dicom_store.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.healthcare_dicom_store` using the reference:\n\n    $._ref.google_healthcare_dicom_store.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_healthcare_dicom_store.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `dataset` (`string`): Identifies the dataset addressed by this request. Must be in the format\n\u0026#39;projects/{project}/locations/{location}/datasets/{dataset}\u0026#39;\n  - `labels` (`obj`): User-supplied key-value pairs used to organize DICOM stores.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must\nconform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\n\nLabel values are optional, must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128\nbytes, and must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\n\nNo more than 64 labels can be associated with a given store.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs.\nExample: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the DicomStore.\n\n** Changing this property may recreate the Dicom store (removing all data) **\n  - `notification_config` (`list[obj]`): A nested object resource When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_dicom_store.notification_config.new](#fn-notification_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_dicom_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     dataset,
@@ -23,7 +23,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.healthcare_dicom_store.newAttrs` constructs a new object with attributes and blocks configured for the `healthcare_dicom_store`\nTerraform resource.\n\nUnlike [google.healthcare_dicom_store.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `dataset` (`string`): Identifies the dataset addressed by this request. Must be in the format\n'projects/{project}/locations/{location}/datasets/{dataset}'\n  - `labels` (`obj`): User-supplied key-value pairs used to organize DICOM stores.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must\nconform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\n\nLabel values are optional, must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128\nbytes, and must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\n\nNo more than 64 labels can be associated with a given store.\n\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the DicomStore.\n\n** Changing this property may recreate the Dicom store (removing all data) **\n  - `notification_config` (`list[obj]`): A nested object resource When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_dicom_store.notification_config.new](#fn-notification_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_dicom_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `healthcare_dicom_store` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.healthcare_dicom_store.newAttrs` constructs a new object with attributes and blocks configured for the `healthcare_dicom_store`\nTerraform resource.\n\nUnlike [google.healthcare_dicom_store.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `dataset` (`string`): Identifies the dataset addressed by this request. Must be in the format\n'projects/{project}/locations/{location}/datasets/{dataset}'\n  - `labels` (`obj`): User-supplied key-value pairs used to organize DICOM stores.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must\nconform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\n\nLabel values are optional, must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128\nbytes, and must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\n\nNo more than 64 labels can be associated with a given store.\n\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the DicomStore.\n\n** Changing this property may recreate the Dicom store (removing all data) **\n  - `notification_config` (`list[obj]`): A nested object resource When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_dicom_store.notification_config.new](#fn-notification_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_dicom_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `healthcare_dicom_store` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     dataset,
     name,
diff --git a/4.x/_gen/resources/healthcare_fhir_store.libsonnet b/4.x/_gen/resources/healthcare_fhir_store.libsonnet
index 3a295c9b..5464d853 100644
--- a/4.x/_gen/resources/healthcare_fhir_store.libsonnet
+++ b/4.x/_gen/resources/healthcare_fhir_store.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='healthcare_fhir_store', url='', help='`healthcare_fhir_store` represents the `google_healthcare_fhir_store` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.healthcare_fhir_store.new` injects a new `google_healthcare_fhir_store` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.healthcare_fhir_store.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.healthcare_fhir_store` using the reference:\n\n    $._ref.google_healthcare_fhir_store.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_healthcare_fhir_store.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `complex_data_type_reference_parsing` (`string`): Enable parsing of references within complex FHIR data types such as Extensions. If this value is set to ENABLED, then features like referential integrity and Bundle reference rewriting apply to all references. If this flag has not been specified the behavior of the FHIR store will not change, references in complex data types will not be parsed. New stores will have this value set to ENABLED by default after a notification period. Warning: turning on this flag causes processing existing resources to fail if they contain references to non-existent resources. Possible values: [\u0026#34;COMPLEX_DATA_TYPE_REFERENCE_PARSING_UNSPECIFIED\u0026#34;, \u0026#34;DISABLED\u0026#34;, \u0026#34;ENABLED\u0026#34;] When `null`, the `complex_data_type_reference_parsing` field will be omitted from the resulting object.\n  - `dataset` (`string`): Identifies the dataset addressed by this request. Must be in the format\n\u0026#39;projects/{project}/locations/{location}/datasets/{dataset}\u0026#39;\n  - `default_search_handling_strict` (`bool`): If true, overrides the default search behavior for this FHIR store to handling=strict which returns an error for unrecognized search parameters.\nIf false, uses the FHIR specification default handling=lenient which ignores unrecognized search parameters.\nThe handling can always be changed from the default on an individual API call by setting the HTTP header Prefer: handling=strict or Prefer: handling=lenient. When `null`, the `default_search_handling_strict` field will be omitted from the resulting object.\n  - `disable_referential_integrity` (`bool`): Whether to disable referential integrity in this FHIR store. This field is immutable after FHIR store\ncreation. The default value is false, meaning that the API will enforce referential integrity and fail the\nrequests that will result in inconsistent state in the FHIR store. When this field is set to true, the API\nwill skip referential integrity check. Consequently, operations that rely on references, such as\nPatient.get$everything, will not return all the results if broken references exist.\n\n** Changing this property may recreate the FHIR store (removing all data) ** When `null`, the `disable_referential_integrity` field will be omitted from the resulting object.\n  - `disable_resource_versioning` (`bool`): Whether to disable resource versioning for this FHIR store. This field can not be changed after the creation\nof FHIR store. If set to false, which is the default behavior, all write operations will cause historical\nversions to be recorded automatically. The historical versions can be fetched through the history APIs, but\ncannot be updated. If set to true, no historical versions will be kept. The server will send back errors for\nattempts to read the historical versions.\n\n** Changing this property may recreate the FHIR store (removing all data) ** When `null`, the `disable_resource_versioning` field will be omitted from the resulting object.\n  - `enable_history_import` (`bool`): Whether to allow the bulk import API to accept history bundles and directly insert historical resource\nversions into the FHIR store. Importing resource histories creates resource interactions that appear to have\noccurred in the past, which clients may not want to allow. If set to false, history bundles within an import\nwill fail with an error.\n\n** Changing this property may recreate the FHIR store (removing all data) **\n\n** This property can be changed manually in the Google Cloud Healthcare admin console without recreating the FHIR store ** When `null`, the `enable_history_import` field will be omitted from the resulting object.\n  - `enable_update_create` (`bool`): Whether this FHIR store has the updateCreate capability. This determines if the client can use an Update\noperation to create a new resource with a client-specified ID. If false, all IDs are server-assigned through\nthe Create operation and attempts to Update a non-existent resource will return errors. Please treat the audit\nlogs with appropriate levels of care if client-specified resource IDs contain sensitive data such as patient\nidentifiers, those IDs will be part of the FHIR resource path recorded in Cloud audit logs and Cloud Pub/Sub\nnotifications. When `null`, the `enable_update_create` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-supplied key-value pairs used to organize FHIR stores.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must\nconform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\n\nLabel values are optional, must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128\nbytes, and must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\n\nNo more than 64 labels can be associated with a given store.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs.\nExample: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the FhirStore.\n\n** Changing this property may recreate the FHIR store (removing all data) **\n  - `version` (`string`): The FHIR specification version. Possible values: [\u0026#34;DSTU2\u0026#34;, \u0026#34;STU3\u0026#34;, \u0026#34;R4\u0026#34;]\n  - `notification_config` (`list[obj]`): A nested object resource When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_fhir_store.notification_config.new](#fn-notification_confignew) constructor.\n  - `stream_configs` (`list[obj]`): A list of streaming configs that configure the destinations of streaming export for every resource mutation in\nthis FHIR store. Each store is allowed to have up to 10 streaming configs. After a new config is added, the next\nresource mutation is streamed to the new location in addition to the existing ones. When a location is removed\nfrom the list, the server stops streaming to that location. Before adding a new config, you must add the required\nbigquery.dataEditor role to your project\u0026#39;s Cloud Healthcare Service Agent service account. Some lag (typically on\nthe order of dozens of seconds) is expected before the results show up in the streaming destination. When `null`, the `stream_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_fhir_store.stream_configs.new](#fn-stream_configsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_fhir_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.healthcare_fhir_store.new` injects a new `google_healthcare_fhir_store` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.healthcare_fhir_store.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.healthcare_fhir_store` using the reference:\n\n    $._ref.google_healthcare_fhir_store.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_healthcare_fhir_store.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `complex_data_type_reference_parsing` (`string`): Enable parsing of references within complex FHIR data types such as Extensions. If this value is set to ENABLED, then features like referential integrity and Bundle reference rewriting apply to all references. If this flag has not been specified the behavior of the FHIR store will not change, references in complex data types will not be parsed. New stores will have this value set to ENABLED by default after a notification period. Warning: turning on this flag causes processing existing resources to fail if they contain references to non-existent resources. Possible values: [\u0026#34;COMPLEX_DATA_TYPE_REFERENCE_PARSING_UNSPECIFIED\u0026#34;, \u0026#34;DISABLED\u0026#34;, \u0026#34;ENABLED\u0026#34;] When `null`, the `complex_data_type_reference_parsing` field will be omitted from the resulting object.\n  - `dataset` (`string`): Identifies the dataset addressed by this request. Must be in the format\n\u0026#39;projects/{project}/locations/{location}/datasets/{dataset}\u0026#39;\n  - `default_search_handling_strict` (`bool`): If true, overrides the default search behavior for this FHIR store to handling=strict which returns an error for unrecognized search parameters.\nIf false, uses the FHIR specification default handling=lenient which ignores unrecognized search parameters.\nThe handling can always be changed from the default on an individual API call by setting the HTTP header Prefer: handling=strict or Prefer: handling=lenient. When `null`, the `default_search_handling_strict` field will be omitted from the resulting object.\n  - `disable_referential_integrity` (`bool`): Whether to disable referential integrity in this FHIR store. This field is immutable after FHIR store\ncreation. The default value is false, meaning that the API will enforce referential integrity and fail the\nrequests that will result in inconsistent state in the FHIR store. When this field is set to true, the API\nwill skip referential integrity check. Consequently, operations that rely on references, such as\nPatient.get$everything, will not return all the results if broken references exist.\n\n** Changing this property may recreate the FHIR store (removing all data) ** When `null`, the `disable_referential_integrity` field will be omitted from the resulting object.\n  - `disable_resource_versioning` (`bool`): Whether to disable resource versioning for this FHIR store. This field can not be changed after the creation\nof FHIR store. If set to false, which is the default behavior, all write operations will cause historical\nversions to be recorded automatically. The historical versions can be fetched through the history APIs, but\ncannot be updated. If set to true, no historical versions will be kept. The server will send back errors for\nattempts to read the historical versions.\n\n** Changing this property may recreate the FHIR store (removing all data) ** When `null`, the `disable_resource_versioning` field will be omitted from the resulting object.\n  - `enable_history_import` (`bool`): Whether to allow the bulk import API to accept history bundles and directly insert historical resource\nversions into the FHIR store. Importing resource histories creates resource interactions that appear to have\noccurred in the past, which clients may not want to allow. If set to false, history bundles within an import\nwill fail with an error.\n\n** Changing this property may recreate the FHIR store (removing all data) **\n\n** This property can be changed manually in the Google Cloud Healthcare admin console without recreating the FHIR store ** When `null`, the `enable_history_import` field will be omitted from the resulting object.\n  - `enable_update_create` (`bool`): Whether this FHIR store has the updateCreate capability. This determines if the client can use an Update\noperation to create a new resource with a client-specified ID. If false, all IDs are server-assigned through\nthe Create operation and attempts to Update a non-existent resource will return errors. Please treat the audit\nlogs with appropriate levels of care if client-specified resource IDs contain sensitive data such as patient\nidentifiers, those IDs will be part of the FHIR resource path recorded in Cloud audit logs and Cloud Pub/Sub\nnotifications. When `null`, the `enable_update_create` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-supplied key-value pairs used to organize FHIR stores.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must\nconform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\n\nLabel values are optional, must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128\nbytes, and must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\n\nNo more than 64 labels can be associated with a given store.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs.\nExample: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the FhirStore.\n\n** Changing this property may recreate the FHIR store (removing all data) **\n  - `version` (`string`): The FHIR specification version. Possible values: [\u0026#34;DSTU2\u0026#34;, \u0026#34;STU3\u0026#34;, \u0026#34;R4\u0026#34;]\n  - `notification_config` (`list[obj]`): A nested object resource When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_fhir_store.notification_config.new](#fn-notification_confignew) constructor.\n  - `stream_configs` (`list[obj]`): A list of streaming configs that configure the destinations of streaming export for every resource mutation in\nthis FHIR store. Each store is allowed to have up to 10 streaming configs. After a new config is added, the next\nresource mutation is streamed to the new location in addition to the existing ones. When a location is removed\nfrom the list, the server stops streaming to that location. Before adding a new config, you must add the required\nbigquery.dataEditor role to your project\u0026#39;s Cloud Healthcare Service Agent service account. Some lag (typically on\nthe order of dozens of seconds) is expected before the results show up in the streaming destination. When `null`, the `stream_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_fhir_store.stream_configs.new](#fn-stream_configsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_fhir_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     dataset,
@@ -39,7 +39,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.healthcare_fhir_store.newAttrs` constructs a new object with attributes and blocks configured for the `healthcare_fhir_store`\nTerraform resource.\n\nUnlike [google.healthcare_fhir_store.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `complex_data_type_reference_parsing` (`string`): Enable parsing of references within complex FHIR data types such as Extensions. If this value is set to ENABLED, then features like referential integrity and Bundle reference rewriting apply to all references. If this flag has not been specified the behavior of the FHIR store will not change, references in complex data types will not be parsed. New stores will have this value set to ENABLED by default after a notification period. Warning: turning on this flag causes processing existing resources to fail if they contain references to non-existent resources. Possible values: ["COMPLEX_DATA_TYPE_REFERENCE_PARSING_UNSPECIFIED", "DISABLED", "ENABLED"] When `null`, the `complex_data_type_reference_parsing` field will be omitted from the resulting object.\n  - `dataset` (`string`): Identifies the dataset addressed by this request. Must be in the format\n'projects/{project}/locations/{location}/datasets/{dataset}'\n  - `default_search_handling_strict` (`bool`): If true, overrides the default search behavior for this FHIR store to handling=strict which returns an error for unrecognized search parameters.\nIf false, uses the FHIR specification default handling=lenient which ignores unrecognized search parameters.\nThe handling can always be changed from the default on an individual API call by setting the HTTP header Prefer: handling=strict or Prefer: handling=lenient. When `null`, the `default_search_handling_strict` field will be omitted from the resulting object.\n  - `disable_referential_integrity` (`bool`): Whether to disable referential integrity in this FHIR store. This field is immutable after FHIR store\ncreation. The default value is false, meaning that the API will enforce referential integrity and fail the\nrequests that will result in inconsistent state in the FHIR store. When this field is set to true, the API\nwill skip referential integrity check. Consequently, operations that rely on references, such as\nPatient.get$everything, will not return all the results if broken references exist.\n\n** Changing this property may recreate the FHIR store (removing all data) ** When `null`, the `disable_referential_integrity` field will be omitted from the resulting object.\n  - `disable_resource_versioning` (`bool`): Whether to disable resource versioning for this FHIR store. This field can not be changed after the creation\nof FHIR store. If set to false, which is the default behavior, all write operations will cause historical\nversions to be recorded automatically. The historical versions can be fetched through the history APIs, but\ncannot be updated. If set to true, no historical versions will be kept. The server will send back errors for\nattempts to read the historical versions.\n\n** Changing this property may recreate the FHIR store (removing all data) ** When `null`, the `disable_resource_versioning` field will be omitted from the resulting object.\n  - `enable_history_import` (`bool`): Whether to allow the bulk import API to accept history bundles and directly insert historical resource\nversions into the FHIR store. Importing resource histories creates resource interactions that appear to have\noccurred in the past, which clients may not want to allow. If set to false, history bundles within an import\nwill fail with an error.\n\n** Changing this property may recreate the FHIR store (removing all data) **\n\n** This property can be changed manually in the Google Cloud Healthcare admin console without recreating the FHIR store ** When `null`, the `enable_history_import` field will be omitted from the resulting object.\n  - `enable_update_create` (`bool`): Whether this FHIR store has the updateCreate capability. This determines if the client can use an Update\noperation to create a new resource with a client-specified ID. If false, all IDs are server-assigned through\nthe Create operation and attempts to Update a non-existent resource will return errors. Please treat the audit\nlogs with appropriate levels of care if client-specified resource IDs contain sensitive data such as patient\nidentifiers, those IDs will be part of the FHIR resource path recorded in Cloud audit logs and Cloud Pub/Sub\nnotifications. When `null`, the `enable_update_create` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-supplied key-value pairs used to organize FHIR stores.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must\nconform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\n\nLabel values are optional, must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128\nbytes, and must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\n\nNo more than 64 labels can be associated with a given store.\n\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the FhirStore.\n\n** Changing this property may recreate the FHIR store (removing all data) **\n  - `version` (`string`): The FHIR specification version. Possible values: ["DSTU2", "STU3", "R4"]\n  - `notification_config` (`list[obj]`): A nested object resource When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_fhir_store.notification_config.new](#fn-notification_confignew) constructor.\n  - `stream_configs` (`list[obj]`): A list of streaming configs that configure the destinations of streaming export for every resource mutation in\nthis FHIR store. Each store is allowed to have up to 10 streaming configs. After a new config is added, the next\nresource mutation is streamed to the new location in addition to the existing ones. When a location is removed\nfrom the list, the server stops streaming to that location. Before adding a new config, you must add the required\nbigquery.dataEditor role to your project's Cloud Healthcare Service Agent service account. Some lag (typically on\nthe order of dozens of seconds) is expected before the results show up in the streaming destination. When `null`, the `stream_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_fhir_store.stream_configs.new](#fn-stream_configsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_fhir_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `healthcare_fhir_store` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.healthcare_fhir_store.newAttrs` constructs a new object with attributes and blocks configured for the `healthcare_fhir_store`\nTerraform resource.\n\nUnlike [google.healthcare_fhir_store.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `complex_data_type_reference_parsing` (`string`): Enable parsing of references within complex FHIR data types such as Extensions. If this value is set to ENABLED, then features like referential integrity and Bundle reference rewriting apply to all references. If this flag has not been specified the behavior of the FHIR store will not change, references in complex data types will not be parsed. New stores will have this value set to ENABLED by default after a notification period. Warning: turning on this flag causes processing existing resources to fail if they contain references to non-existent resources. Possible values: ["COMPLEX_DATA_TYPE_REFERENCE_PARSING_UNSPECIFIED", "DISABLED", "ENABLED"] When `null`, the `complex_data_type_reference_parsing` field will be omitted from the resulting object.\n  - `dataset` (`string`): Identifies the dataset addressed by this request. Must be in the format\n'projects/{project}/locations/{location}/datasets/{dataset}'\n  - `default_search_handling_strict` (`bool`): If true, overrides the default search behavior for this FHIR store to handling=strict which returns an error for unrecognized search parameters.\nIf false, uses the FHIR specification default handling=lenient which ignores unrecognized search parameters.\nThe handling can always be changed from the default on an individual API call by setting the HTTP header Prefer: handling=strict or Prefer: handling=lenient. When `null`, the `default_search_handling_strict` field will be omitted from the resulting object.\n  - `disable_referential_integrity` (`bool`): Whether to disable referential integrity in this FHIR store. This field is immutable after FHIR store\ncreation. The default value is false, meaning that the API will enforce referential integrity and fail the\nrequests that will result in inconsistent state in the FHIR store. When this field is set to true, the API\nwill skip referential integrity check. Consequently, operations that rely on references, such as\nPatient.get$everything, will not return all the results if broken references exist.\n\n** Changing this property may recreate the FHIR store (removing all data) ** When `null`, the `disable_referential_integrity` field will be omitted from the resulting object.\n  - `disable_resource_versioning` (`bool`): Whether to disable resource versioning for this FHIR store. This field can not be changed after the creation\nof FHIR store. If set to false, which is the default behavior, all write operations will cause historical\nversions to be recorded automatically. The historical versions can be fetched through the history APIs, but\ncannot be updated. If set to true, no historical versions will be kept. The server will send back errors for\nattempts to read the historical versions.\n\n** Changing this property may recreate the FHIR store (removing all data) ** When `null`, the `disable_resource_versioning` field will be omitted from the resulting object.\n  - `enable_history_import` (`bool`): Whether to allow the bulk import API to accept history bundles and directly insert historical resource\nversions into the FHIR store. Importing resource histories creates resource interactions that appear to have\noccurred in the past, which clients may not want to allow. If set to false, history bundles within an import\nwill fail with an error.\n\n** Changing this property may recreate the FHIR store (removing all data) **\n\n** This property can be changed manually in the Google Cloud Healthcare admin console without recreating the FHIR store ** When `null`, the `enable_history_import` field will be omitted from the resulting object.\n  - `enable_update_create` (`bool`): Whether this FHIR store has the updateCreate capability. This determines if the client can use an Update\noperation to create a new resource with a client-specified ID. If false, all IDs are server-assigned through\nthe Create operation and attempts to Update a non-existent resource will return errors. Please treat the audit\nlogs with appropriate levels of care if client-specified resource IDs contain sensitive data such as patient\nidentifiers, those IDs will be part of the FHIR resource path recorded in Cloud audit logs and Cloud Pub/Sub\nnotifications. When `null`, the `enable_update_create` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-supplied key-value pairs used to organize FHIR stores.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must\nconform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\n\nLabel values are optional, must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128\nbytes, and must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\n\nNo more than 64 labels can be associated with a given store.\n\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the FhirStore.\n\n** Changing this property may recreate the FHIR store (removing all data) **\n  - `version` (`string`): The FHIR specification version. Possible values: ["DSTU2", "STU3", "R4"]\n  - `notification_config` (`list[obj]`): A nested object resource When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_fhir_store.notification_config.new](#fn-notification_confignew) constructor.\n  - `stream_configs` (`list[obj]`): A list of streaming configs that configure the destinations of streaming export for every resource mutation in\nthis FHIR store. Each store is allowed to have up to 10 streaming configs. After a new config is added, the next\nresource mutation is streamed to the new location in addition to the existing ones. When a location is removed\nfrom the list, the server stops streaming to that location. Before adding a new config, you must add the required\nbigquery.dataEditor role to your project's Cloud Healthcare Service Agent service account. Some lag (typically on\nthe order of dozens of seconds) is expected before the results show up in the streaming destination. When `null`, the `stream_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_fhir_store.stream_configs.new](#fn-stream_configsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_fhir_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `healthcare_fhir_store` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     dataset,
     name,
diff --git a/4.x/_gen/resources/healthcare_hl7_v2_store.libsonnet b/4.x/_gen/resources/healthcare_hl7_v2_store.libsonnet
index 019bdaf2..6eed6ec0 100644
--- a/4.x/_gen/resources/healthcare_hl7_v2_store.libsonnet
+++ b/4.x/_gen/resources/healthcare_hl7_v2_store.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='healthcare_hl7_v2_store', url='', help='`healthcare_hl7_v2_store` represents the `google_healthcare_hl7_v2_store` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.healthcare_hl7_v2_store.new` injects a new `google_healthcare_hl7_v2_store` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.healthcare_hl7_v2_store.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.healthcare_hl7_v2_store` using the reference:\n\n    $._ref.google_healthcare_hl7_v2_store.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_healthcare_hl7_v2_store.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `dataset` (`string`): Identifies the dataset addressed by this request. Must be in the format\n\u0026#39;projects/{project}/locations/{location}/datasets/{dataset}\u0026#39;\n  - `labels` (`obj`): User-supplied key-value pairs used to organize HL7v2 stores.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must\nconform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\n\nLabel values are optional, must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128\nbytes, and must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\n\nNo more than 64 labels can be associated with a given store.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs.\nExample: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the Hl7V2Store.\n\n** Changing this property may recreate the Hl7v2 store (removing all data) **\n  - `notification_config` (`list[obj]`): A nested object resource When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_hl7_v2_store.notification_config.new](#fn-notification_confignew) constructor.\n  - `notification_configs` (`list[obj]`): A list of notification configs. Each configuration uses a filter to determine whether to publish a\nmessage (both Ingest \u0026amp; Create) on the corresponding notification destination. Only the message name\nis sent as part of the notification. Supplied by the client. When `null`, the `notification_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_hl7_v2_store.notification_configs.new](#fn-notification_configsnew) constructor.\n  - `parser_config` (`list[obj]`): A nested object resource When `null`, the `parser_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_hl7_v2_store.parser_config.new](#fn-parser_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_hl7_v2_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.healthcare_hl7_v2_store.new` injects a new `google_healthcare_hl7_v2_store` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.healthcare_hl7_v2_store.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.healthcare_hl7_v2_store` using the reference:\n\n    $._ref.google_healthcare_hl7_v2_store.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_healthcare_hl7_v2_store.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `dataset` (`string`): Identifies the dataset addressed by this request. Must be in the format\n\u0026#39;projects/{project}/locations/{location}/datasets/{dataset}\u0026#39;\n  - `labels` (`obj`): User-supplied key-value pairs used to organize HL7v2 stores.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must\nconform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\n\nLabel values are optional, must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128\nbytes, and must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\n\nNo more than 64 labels can be associated with a given store.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs.\nExample: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the Hl7V2Store.\n\n** Changing this property may recreate the Hl7v2 store (removing all data) **\n  - `notification_config` (`list[obj]`): A nested object resource When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_hl7_v2_store.notification_config.new](#fn-notification_confignew) constructor.\n  - `notification_configs` (`list[obj]`): A list of notification configs. Each configuration uses a filter to determine whether to publish a\nmessage (both Ingest \u0026amp; Create) on the corresponding notification destination. Only the message name\nis sent as part of the notification. Supplied by the client. When `null`, the `notification_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_hl7_v2_store.notification_configs.new](#fn-notification_configsnew) constructor.\n  - `parser_config` (`list[obj]`): A nested object resource When `null`, the `parser_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_hl7_v2_store.parser_config.new](#fn-parser_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_hl7_v2_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     dataset,
@@ -27,7 +27,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.healthcare_hl7_v2_store.newAttrs` constructs a new object with attributes and blocks configured for the `healthcare_hl7_v2_store`\nTerraform resource.\n\nUnlike [google.healthcare_hl7_v2_store.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `dataset` (`string`): Identifies the dataset addressed by this request. Must be in the format\n'projects/{project}/locations/{location}/datasets/{dataset}'\n  - `labels` (`obj`): User-supplied key-value pairs used to organize HL7v2 stores.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must\nconform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\n\nLabel values are optional, must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128\nbytes, and must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\n\nNo more than 64 labels can be associated with a given store.\n\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the Hl7V2Store.\n\n** Changing this property may recreate the Hl7v2 store (removing all data) **\n  - `notification_config` (`list[obj]`): A nested object resource When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_hl7_v2_store.notification_config.new](#fn-notification_confignew) constructor.\n  - `notification_configs` (`list[obj]`): A list of notification configs. Each configuration uses a filter to determine whether to publish a\nmessage (both Ingest & Create) on the corresponding notification destination. Only the message name\nis sent as part of the notification. Supplied by the client. When `null`, the `notification_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_hl7_v2_store.notification_configs.new](#fn-notification_configsnew) constructor.\n  - `parser_config` (`list[obj]`): A nested object resource When `null`, the `parser_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_hl7_v2_store.parser_config.new](#fn-parser_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_hl7_v2_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `healthcare_hl7_v2_store` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.healthcare_hl7_v2_store.newAttrs` constructs a new object with attributes and blocks configured for the `healthcare_hl7_v2_store`\nTerraform resource.\n\nUnlike [google.healthcare_hl7_v2_store.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `dataset` (`string`): Identifies the dataset addressed by this request. Must be in the format\n'projects/{project}/locations/{location}/datasets/{dataset}'\n  - `labels` (`obj`): User-supplied key-value pairs used to organize HL7v2 stores.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must\nconform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\n\nLabel values are optional, must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128\nbytes, and must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\n\nNo more than 64 labels can be associated with a given store.\n\nAn object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the Hl7V2Store.\n\n** Changing this property may recreate the Hl7v2 store (removing all data) **\n  - `notification_config` (`list[obj]`): A nested object resource When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_hl7_v2_store.notification_config.new](#fn-notification_confignew) constructor.\n  - `notification_configs` (`list[obj]`): A list of notification configs. Each configuration uses a filter to determine whether to publish a\nmessage (both Ingest & Create) on the corresponding notification destination. Only the message name\nis sent as part of the notification. Supplied by the client. When `null`, the `notification_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_hl7_v2_store.notification_configs.new](#fn-notification_configsnew) constructor.\n  - `parser_config` (`list[obj]`): A nested object resource When `null`, the `parser_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_hl7_v2_store.parser_config.new](#fn-parser_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_hl7_v2_store.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `healthcare_hl7_v2_store` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     dataset,
     name,
diff --git a/4.x/_gen/resources/iam_workforce_pool_provider.libsonnet b/4.x/_gen/resources/iam_workforce_pool_provider.libsonnet
index fe626fd2..e657d029 100644
--- a/4.x/_gen/resources/iam_workforce_pool_provider.libsonnet
+++ b/4.x/_gen/resources/iam_workforce_pool_provider.libsonnet
@@ -78,16 +78,18 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         }),
       },
     },
-    '#new':: d.fn(help='\n`google.iam_workforce_pool_provider.oidc.new` constructs a new object with attributes and blocks configured for the `oidc`\nTerraform sub block.\n\n\n\n**Args**:\n  - `client_id` (`string`): The client ID. Must match the audience claim of the JWT issued by the identity provider.\n  - `issuer_uri` (`string`): The OIDC issuer URI. Must be a valid URI using the 'https' scheme.\n  - `client_secret` (`list[obj]`): The optional client secret. Required to enable Authorization Code flow for web sign-in. When `null`, the `client_secret` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workforce_pool_provider.oidc.client_secret.new](#fn-oidcclient_secretnew) constructor.\n  - `web_sso_config` (`list[obj]`): Configuration for web single sign-on for the OIDC provider. Here, web sign-in refers to console sign-in and gcloud sign-in through the browser. When `null`, the `web_sso_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workforce_pool_provider.oidc.web_sso_config.new](#fn-oidcweb_sso_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `oidc` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.iam_workforce_pool_provider.oidc.new` constructs a new object with attributes and blocks configured for the `oidc`\nTerraform sub block.\n\n\n\n**Args**:\n  - `client_id` (`string`): The client ID. Must match the audience claim of the JWT issued by the identity provider.\n  - `issuer_uri` (`string`): The OIDC issuer URI. Must be a valid URI using the 'https' scheme.\n  - `jwks_json` (`string`): OIDC JWKs in JSON String format. For details on definition of a\nJWK, see https:tools.ietf.org/html/rfc7517. If not set, then we\nuse the 'jwks_uri' from the discovery document fetched from the\n.well-known path for the 'issuer_uri'. Currently, RSA and EC asymmetric\nkeys are supported. The JWK must use following format and include only\nthe following fields:\n'''\n{\n  "keys": [\n    {\n          "kty": "RSA/EC",\n          "alg": "<algorithm>",\n          "use": "sig",\n          "kid": "<key-id>",\n          "n": "",\n          "e": "",\n          "x": "",\n          "y": "",\n          "crv": ""\n    }\n  ]\n}\n''' When `null`, the `jwks_json` field will be omitted from the resulting object.\n  - `client_secret` (`list[obj]`): The optional client secret. Required to enable Authorization Code flow for web sign-in. When `null`, the `client_secret` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workforce_pool_provider.oidc.client_secret.new](#fn-oidcclient_secretnew) constructor.\n  - `web_sso_config` (`list[obj]`): Configuration for web single sign-on for the OIDC provider. Here, web sign-in refers to console sign-in and gcloud sign-in through the browser. When `null`, the `web_sso_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workforce_pool_provider.oidc.web_sso_config.new](#fn-oidcweb_sso_confignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `oidc` sub block.\n', args=[]),
     new(
       client_id,
       issuer_uri,
       client_secret=null,
+      jwks_json=null,
       web_sso_config=null
     ):: std.prune(a={
       client_id: client_id,
       client_secret: client_secret,
       issuer_uri: issuer_uri,
+      jwks_json: jwks_json,
       web_sso_config: web_sso_config,
     }),
     web_sso_config:: {
diff --git a/4.x/_gen/resources/identity_platform_config.libsonnet b/4.x/_gen/resources/identity_platform_config.libsonnet
index bb47898b..2a8445df 100644
--- a/4.x/_gen/resources/identity_platform_config.libsonnet
+++ b/4.x/_gen/resources/identity_platform_config.libsonnet
@@ -34,7 +34,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
   },
-  '#new':: d.fn(help="\n`google.identity_platform_config.new` injects a new `google_identity_platform_config` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.identity_platform_config.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.identity_platform_config` using the reference:\n\n    $._ref.google_identity_platform_config.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_identity_platform_config.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `authorized_domains` (`list`): List of domains authorized for OAuth redirects. When `null`, the `authorized_domains` field will be omitted from the resulting object.\n  - `autodelete_anonymous_users` (`bool`): Whether anonymous users will be auto-deleted after a period of 30 days When `null`, the `autodelete_anonymous_users` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `blocking_functions` (`list[obj]`): Configuration related to blocking functions. When `null`, the `blocking_functions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.blocking_functions.new](#fn-blocking_functionsnew) constructor.\n  - `quota` (`list[obj]`): Configuration related to quotas. When `null`, the `quota` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.quota.new](#fn-quotanew) constructor.\n  - `sign_in` (`list[obj]`): Configuration related to local sign in methods. When `null`, the `sign_in` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.sign_in.new](#fn-sign_innew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.identity_platform_config.new` injects a new `google_identity_platform_config` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.identity_platform_config.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.identity_platform_config` using the reference:\n\n    $._ref.google_identity_platform_config.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_identity_platform_config.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `authorized_domains` (`list`): List of domains authorized for OAuth redirects. When `null`, the `authorized_domains` field will be omitted from the resulting object.\n  - `autodelete_anonymous_users` (`bool`): Whether anonymous users will be auto-deleted after a period of 30 days When `null`, the `autodelete_anonymous_users` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `blocking_functions` (`list[obj]`): Configuration related to blocking functions. When `null`, the `blocking_functions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.blocking_functions.new](#fn-blocking_functionsnew) constructor.\n  - `quota` (`list[obj]`): Configuration related to quotas. When `null`, the `quota` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.quota.new](#fn-quotanew) constructor.\n  - `sign_in` (`list[obj]`): Configuration related to local sign in methods. When `null`, the `sign_in` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.sign_in.new](#fn-sign_innew) constructor.\n  - `sms_region_config` (`list[obj]`): Configures the regions where users are allowed to send verification SMS for the project or tenant. This is based on the calling code of the destination phone number. When `null`, the `sms_region_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.sms_region_config.new](#fn-sms_region_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     authorized_domains=null,
@@ -43,6 +43,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project=null,
     quota=null,
     sign_in=null,
+    sms_region_config=null,
     timeouts=null,
     _meta={}
   ):: tf.withResource(
@@ -55,11 +56,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       project=project,
       quota=quota,
       sign_in=sign_in,
+      sms_region_config=sms_region_config,
       timeouts=timeouts
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.identity_platform_config.newAttrs` constructs a new object with attributes and blocks configured for the `identity_platform_config`\nTerraform resource.\n\nUnlike [google.identity_platform_config.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `authorized_domains` (`list`): List of domains authorized for OAuth redirects. When `null`, the `authorized_domains` field will be omitted from the resulting object.\n  - `autodelete_anonymous_users` (`bool`): Whether anonymous users will be auto-deleted after a period of 30 days When `null`, the `autodelete_anonymous_users` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `blocking_functions` (`list[obj]`): Configuration related to blocking functions. When `null`, the `blocking_functions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.blocking_functions.new](#fn-blocking_functionsnew) constructor.\n  - `quota` (`list[obj]`): Configuration related to quotas. When `null`, the `quota` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.quota.new](#fn-quotanew) constructor.\n  - `sign_in` (`list[obj]`): Configuration related to local sign in methods. When `null`, the `sign_in` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.sign_in.new](#fn-sign_innew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `identity_platform_config` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.identity_platform_config.newAttrs` constructs a new object with attributes and blocks configured for the `identity_platform_config`\nTerraform resource.\n\nUnlike [google.identity_platform_config.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `authorized_domains` (`list`): List of domains authorized for OAuth redirects. When `null`, the `authorized_domains` field will be omitted from the resulting object.\n  - `autodelete_anonymous_users` (`bool`): Whether anonymous users will be auto-deleted after a period of 30 days When `null`, the `autodelete_anonymous_users` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `blocking_functions` (`list[obj]`): Configuration related to blocking functions. When `null`, the `blocking_functions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.blocking_functions.new](#fn-blocking_functionsnew) constructor.\n  - `quota` (`list[obj]`): Configuration related to quotas. When `null`, the `quota` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.quota.new](#fn-quotanew) constructor.\n  - `sign_in` (`list[obj]`): Configuration related to local sign in methods. When `null`, the `sign_in` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.sign_in.new](#fn-sign_innew) constructor.\n  - `sms_region_config` (`list[obj]`): Configures the regions where users are allowed to send verification SMS for the project or tenant. This is based on the calling code of the destination phone number. When `null`, the `sms_region_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.sms_region_config.new](#fn-sms_region_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `identity_platform_config` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     authorized_domains=null,
     autodelete_anonymous_users=null,
@@ -67,6 +69,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project=null,
     quota=null,
     sign_in=null,
+    sms_region_config=null,
     timeouts=null
   ):: std.prune(a={
     authorized_domains: authorized_domains,
@@ -75,6 +78,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     project: project,
     quota: quota,
     sign_in: sign_in,
+    sms_region_config: sms_region_config,
     timeouts: timeouts,
   }),
   quota:: {
@@ -139,6 +143,32 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
   },
+  sms_region_config:: {
+    allow_by_default:: {
+      '#new':: d.fn(help='\n`google.identity_platform_config.sms_region_config.allow_by_default.new` constructs a new object with attributes and blocks configured for the `allow_by_default`\nTerraform sub block.\n\n\n\n**Args**:\n  - `disallowed_regions` (`list`): Two letter unicode region codes to disallow as defined by https://cldr.unicode.org/ The full list of these region codes is here: https://github.com/unicode-cldr/cldr-localenames-full/blob/master/main/en/territories.json When `null`, the `disallowed_regions` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `allow_by_default` sub block.\n', args=[]),
+      new(
+        disallowed_regions=null
+      ):: std.prune(a={
+        disallowed_regions: disallowed_regions,
+      }),
+    },
+    allowlist_only:: {
+      '#new':: d.fn(help='\n`google.identity_platform_config.sms_region_config.allowlist_only.new` constructs a new object with attributes and blocks configured for the `allowlist_only`\nTerraform sub block.\n\n\n\n**Args**:\n  - `allowed_regions` (`list`): Two letter unicode region codes to allow as defined by https://cldr.unicode.org/ The full list of these region codes is here: https://github.com/unicode-cldr/cldr-localenames-full/blob/master/main/en/territories.json When `null`, the `allowed_regions` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `allowlist_only` sub block.\n', args=[]),
+      new(
+        allowed_regions=null
+      ):: std.prune(a={
+        allowed_regions: allowed_regions,
+      }),
+    },
+    '#new':: d.fn(help='\n`google.identity_platform_config.sms_region_config.new` constructs a new object with attributes and blocks configured for the `sms_region_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `allow_by_default` (`list[obj]`): A policy of allowing SMS to every region by default and adding disallowed regions to a disallow list. When `null`, the `allow_by_default` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.sms_region_config.allow_by_default.new](#fn-sms_region_configallow_by_defaultnew) constructor.\n  - `allowlist_only` (`list[obj]`): A policy of only allowing regions by explicitly adding them to an allowlist. When `null`, the `allowlist_only` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.sms_region_config.allowlist_only.new](#fn-sms_region_configallowlist_onlynew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `sms_region_config` sub block.\n', args=[]),
+    new(
+      allow_by_default=null,
+      allowlist_only=null
+    ):: std.prune(a={
+      allow_by_default: allow_by_default,
+      allowlist_only: allowlist_only,
+    }),
+  },
   timeouts:: {
     '#new':: d.fn(help='\n`google.identity_platform_config.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
     new(
@@ -241,6 +271,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withSmsRegionConfig':: d.fn(help='`google.list[obj].withSmsRegionConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the sms_region_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withSmsRegionConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `sms_region_config` field.\n', args=[]),
+  withSmsRegionConfig(resourceLabel, value): {
+    resource+: {
+      google_identity_platform_config+: {
+        [resourceLabel]+: {
+          sms_region_config: value,
+        },
+      },
+    },
+  },
+  '#withSmsRegionConfigMixin':: d.fn(help='`google.list[obj].withSmsRegionConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the sms_region_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withSmsRegionConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `sms_region_config` field.\n', args=[]),
+  withSmsRegionConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_identity_platform_config+: {
+        [resourceLabel]+: {
+          sms_region_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
   withTimeouts(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/kms_crypto_key.libsonnet b/4.x/_gen/resources/kms_crypto_key.libsonnet
index 8dc923b1..c35ca787 100644
--- a/4.x/_gen/resources/kms_crypto_key.libsonnet
+++ b/4.x/_gen/resources/kms_crypto_key.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='kms_crypto_key', url='', help='`kms_crypto_key` represents the `google_kms_crypto_key` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.kms_crypto_key.new` injects a new `google_kms_crypto_key` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.kms_crypto_key.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.kms_crypto_key` using the reference:\n\n    $._ref.google_kms_crypto_key.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_kms_crypto_key.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `destroy_scheduled_duration` (`string`): The period of time that versions of this key spend in the DESTROY_SCHEDULED state before transitioning to DESTROYED.\nIf not specified at creation time, the default duration is 24 hours. When `null`, the `destroy_scheduled_duration` field will be omitted from the resulting object.\n  - `import_only` (`bool`): Whether this key may contain imported versions only. When `null`, the `import_only` field will be omitted from the resulting object.\n  - `key_ring` (`string`): The KeyRing that this key belongs to.\nFormat: \u0026#39;\u0026#39;projects/{{project}}/locations/{{location}}/keyRings/{{keyRing}}\u0026#39;\u0026#39;.\n  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the CryptoKey.\n  - `purpose` (`string`): The immutable purpose of this CryptoKey. See the\n[purpose reference](https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings.cryptoKeys#CryptoKeyPurpose)\nfor possible inputs.\nDefault value is \u0026#34;ENCRYPT_DECRYPT\u0026#34;. When `null`, the `purpose` field will be omitted from the resulting object.\n  - `rotation_period` (`string`): Every time this period passes, generate a new CryptoKeyVersion and set it as the primary.\nThe first rotation will take place after the specified period. The rotation period has\nthe format of a decimal number with up to 9 fractional digits, followed by the\nletter \u0026#39;s\u0026#39; (seconds). It must be greater than a day (ie, 86400). When `null`, the `rotation_period` field will be omitted from the resulting object.\n  - `skip_initial_version_creation` (`bool`): If set to true, the request will create a CryptoKey without any CryptoKeyVersions.\nYou must use the \u0026#39;google_kms_key_ring_import_job\u0026#39; resource to import the CryptoKeyVersion. When `null`, the `skip_initial_version_creation` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.kms_crypto_key.timeouts.new](#fn-timeoutsnew) constructor.\n  - `version_template` (`list[obj]`): A template describing settings for new crypto key versions. When `null`, the `version_template` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.kms_crypto_key.version_template.new](#fn-version_templatenew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.kms_crypto_key.new` injects a new `google_kms_crypto_key` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.kms_crypto_key.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.kms_crypto_key` using the reference:\n\n    $._ref.google_kms_crypto_key.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_kms_crypto_key.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `destroy_scheduled_duration` (`string`): The period of time that versions of this key spend in the DESTROY_SCHEDULED state before transitioning to DESTROYED.\nIf not specified at creation time, the default duration is 24 hours. When `null`, the `destroy_scheduled_duration` field will be omitted from the resulting object.\n  - `import_only` (`bool`): Whether this key may contain imported versions only. When `null`, the `import_only` field will be omitted from the resulting object.\n  - `key_ring` (`string`): The KeyRing that this key belongs to.\nFormat: \u0026#39;\u0026#39;projects/{{project}}/locations/{{location}}/keyRings/{{keyRing}}\u0026#39;\u0026#39;.\n  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the CryptoKey.\n  - `purpose` (`string`): The immutable purpose of this CryptoKey. See the\n[purpose reference](https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings.cryptoKeys#CryptoKeyPurpose)\nfor possible inputs.\nDefault value is \u0026#34;ENCRYPT_DECRYPT\u0026#34;. When `null`, the `purpose` field will be omitted from the resulting object.\n  - `rotation_period` (`string`): Every time this period passes, generate a new CryptoKeyVersion and set it as the primary.\nThe first rotation will take place after the specified period. The rotation period has\nthe format of a decimal number with up to 9 fractional digits, followed by the\nletter \u0026#39;s\u0026#39; (seconds). It must be greater than a day (ie, 86400). When `null`, the `rotation_period` field will be omitted from the resulting object.\n  - `skip_initial_version_creation` (`bool`): If set to true, the request will create a CryptoKey without any CryptoKeyVersions.\nYou must use the \u0026#39;google_kms_key_ring_import_job\u0026#39; resource to import the CryptoKeyVersion. When `null`, the `skip_initial_version_creation` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.kms_crypto_key.timeouts.new](#fn-timeoutsnew) constructor.\n  - `version_template` (`list[obj]`): A template describing settings for new crypto key versions. When `null`, the `version_template` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.kms_crypto_key.version_template.new](#fn-version_templatenew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     key_ring,
@@ -33,7 +33,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.kms_crypto_key.newAttrs` constructs a new object with attributes and blocks configured for the `kms_crypto_key`\nTerraform resource.\n\nUnlike [google.kms_crypto_key.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `destroy_scheduled_duration` (`string`): The period of time that versions of this key spend in the DESTROY_SCHEDULED state before transitioning to DESTROYED.\nIf not specified at creation time, the default duration is 24 hours. When `null`, the `destroy_scheduled_duration` field will be omitted from the resulting object.\n  - `import_only` (`bool`): Whether this key may contain imported versions only. When `null`, the `import_only` field will be omitted from the resulting object.\n  - `key_ring` (`string`): The KeyRing that this key belongs to.\nFormat: ''projects/{{project}}/locations/{{location}}/keyRings/{{keyRing}}''.\n  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the CryptoKey.\n  - `purpose` (`string`): The immutable purpose of this CryptoKey. See the\n[purpose reference](https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings.cryptoKeys#CryptoKeyPurpose)\nfor possible inputs.\nDefault value is "ENCRYPT_DECRYPT". When `null`, the `purpose` field will be omitted from the resulting object.\n  - `rotation_period` (`string`): Every time this period passes, generate a new CryptoKeyVersion and set it as the primary.\nThe first rotation will take place after the specified period. The rotation period has\nthe format of a decimal number with up to 9 fractional digits, followed by the\nletter 's' (seconds). It must be greater than a day (ie, 86400). When `null`, the `rotation_period` field will be omitted from the resulting object.\n  - `skip_initial_version_creation` (`bool`): If set to true, the request will create a CryptoKey without any CryptoKeyVersions.\nYou must use the 'google_kms_key_ring_import_job' resource to import the CryptoKeyVersion. When `null`, the `skip_initial_version_creation` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.kms_crypto_key.timeouts.new](#fn-timeoutsnew) constructor.\n  - `version_template` (`list[obj]`): A template describing settings for new crypto key versions. When `null`, the `version_template` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.kms_crypto_key.version_template.new](#fn-version_templatenew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `kms_crypto_key` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.kms_crypto_key.newAttrs` constructs a new object with attributes and blocks configured for the `kms_crypto_key`\nTerraform resource.\n\nUnlike [google.kms_crypto_key.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `destroy_scheduled_duration` (`string`): The period of time that versions of this key spend in the DESTROY_SCHEDULED state before transitioning to DESTROYED.\nIf not specified at creation time, the default duration is 24 hours. When `null`, the `destroy_scheduled_duration` field will be omitted from the resulting object.\n  - `import_only` (`bool`): Whether this key may contain imported versions only. When `null`, the `import_only` field will be omitted from the resulting object.\n  - `key_ring` (`string`): The KeyRing that this key belongs to.\nFormat: ''projects/{{project}}/locations/{{location}}/keyRings/{{keyRing}}''.\n  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name for the CryptoKey.\n  - `purpose` (`string`): The immutable purpose of this CryptoKey. See the\n[purpose reference](https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings.cryptoKeys#CryptoKeyPurpose)\nfor possible inputs.\nDefault value is "ENCRYPT_DECRYPT". When `null`, the `purpose` field will be omitted from the resulting object.\n  - `rotation_period` (`string`): Every time this period passes, generate a new CryptoKeyVersion and set it as the primary.\nThe first rotation will take place after the specified period. The rotation period has\nthe format of a decimal number with up to 9 fractional digits, followed by the\nletter 's' (seconds). It must be greater than a day (ie, 86400). When `null`, the `rotation_period` field will be omitted from the resulting object.\n  - `skip_initial_version_creation` (`bool`): If set to true, the request will create a CryptoKey without any CryptoKeyVersions.\nYou must use the 'google_kms_key_ring_import_job' resource to import the CryptoKeyVersion. When `null`, the `skip_initial_version_creation` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.kms_crypto_key.timeouts.new](#fn-timeoutsnew) constructor.\n  - `version_template` (`list[obj]`): A template describing settings for new crypto key versions. When `null`, the `version_template` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.kms_crypto_key.version_template.new](#fn-version_templatenew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `kms_crypto_key` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     key_ring,
     name,
diff --git a/4.x/_gen/resources/logging_metric.libsonnet b/4.x/_gen/resources/logging_metric.libsonnet
index a4a9b53b..a4071591 100644
--- a/4.x/_gen/resources/logging_metric.libsonnet
+++ b/4.x/_gen/resources/logging_metric.libsonnet
@@ -12,11 +12,11 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
     exponential_buckets:: {
-      '#new':: d.fn(help='\n`google.logging_metric.bucket_options.exponential_buckets.new` constructs a new object with attributes and blocks configured for the `exponential_buckets`\nTerraform sub block.\n\n\n\n**Args**:\n  - `growth_factor` (`number`): Must be greater than 1. When `null`, the `growth_factor` field will be omitted from the resulting object.\n  - `num_finite_buckets` (`number`): Must be greater than 0. When `null`, the `num_finite_buckets` field will be omitted from the resulting object.\n  - `scale` (`number`): Must be greater than 0. When `null`, the `scale` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `exponential_buckets` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.logging_metric.bucket_options.exponential_buckets.new` constructs a new object with attributes and blocks configured for the `exponential_buckets`\nTerraform sub block.\n\n\n\n**Args**:\n  - `growth_factor` (`number`): Must be greater than 1.\n  - `num_finite_buckets` (`number`): Must be greater than 0.\n  - `scale` (`number`): Must be greater than 0.\n\n**Returns**:\n  - An attribute object that represents the `exponential_buckets` sub block.\n', args=[]),
       new(
-        growth_factor=null,
-        num_finite_buckets=null,
-        scale=null
+        growth_factor,
+        num_finite_buckets,
+        scale
       ):: std.prune(a={
         growth_factor: growth_factor,
         num_finite_buckets: num_finite_buckets,
@@ -24,11 +24,11 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
     linear_buckets:: {
-      '#new':: d.fn(help='\n`google.logging_metric.bucket_options.linear_buckets.new` constructs a new object with attributes and blocks configured for the `linear_buckets`\nTerraform sub block.\n\n\n\n**Args**:\n  - `num_finite_buckets` (`number`): Must be greater than 0. When `null`, the `num_finite_buckets` field will be omitted from the resulting object.\n  - `offset` (`number`): Lower bound of the first bucket. When `null`, the `offset` field will be omitted from the resulting object.\n  - `width` (`number`): Must be greater than 0. When `null`, the `width` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `linear_buckets` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.logging_metric.bucket_options.linear_buckets.new` constructs a new object with attributes and blocks configured for the `linear_buckets`\nTerraform sub block.\n\n\n\n**Args**:\n  - `num_finite_buckets` (`number`): Must be greater than 0.\n  - `offset` (`number`): Lower bound of the first bucket.\n  - `width` (`number`): Must be greater than 0.\n\n**Returns**:\n  - An attribute object that represents the `linear_buckets` sub block.\n', args=[]),
       new(
-        num_finite_buckets=null,
-        offset=null,
-        width=null
+        num_finite_buckets,
+        offset,
+        width
       ):: std.prune(a={
         num_finite_buckets: num_finite_buckets,
         offset: offset,
diff --git a/4.x/_gen/resources/logging_project_sink.libsonnet b/4.x/_gen/resources/logging_project_sink.libsonnet
index 667c9e6c..189f8797 100644
--- a/4.x/_gen/resources/logging_project_sink.libsonnet
+++ b/4.x/_gen/resources/logging_project_sink.libsonnet
@@ -24,12 +24,13 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       name: name,
     }),
   },
-  '#new':: d.fn(help="\n`google.logging_project_sink.new` injects a new `google_logging_project_sink` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.logging_project_sink.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.logging_project_sink` using the reference:\n\n    $._ref.google_logging_project_sink.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_logging_project_sink.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A description of this sink. The maximum length of the description is 8000 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `destination` (`string`): The destination of the sink (or, in other words, where logs are written to). Can be a Cloud Storage bucket, a PubSub topic, or a BigQuery dataset. Examples: \u0026#34;storage.googleapis.com/[GCS_BUCKET]\u0026#34; \u0026#34;bigquery.googleapis.com/projects/[PROJECT_ID]/datasets/[DATASET]\u0026#34; \u0026#34;pubsub.googleapis.com/projects/[PROJECT_ID]/topics/[TOPIC_ID]\u0026#34; The writer associated with the sink must have access to write to the above resource.\n  - `disabled` (`bool`): If set to True, then this sink is disabled and it does not export any log entries. When `null`, the `disabled` field will be omitted from the resulting object.\n  - `filter` (`string`): The filter to apply when exporting logs. Only log entries that match the filter are exported. When `null`, the `filter` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the logging sink.\n  - `project` (`string`): The ID of the project to create the sink in. If omitted, the project associated with the provider is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `unique_writer_identity` (`bool`): Whether or not to create a unique identity associated with this sink. If false (the default), then the writer_identity used is serviceAccount:cloud-logs@system.gserviceaccount.com. If true, then a unique service account is created and used for this sink. If you wish to publish logs across projects, you must set unique_writer_identity to true. When `null`, the `unique_writer_identity` field will be omitted from the resulting object.\n  - `bigquery_options` (`list[obj]`): Options that affect sinks exporting data to BigQuery. When `null`, the `bigquery_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_project_sink.bigquery_options.new](#fn-bigquery_optionsnew) constructor.\n  - `exclusions` (`list[obj]`): Log entries that match any of the exclusion filters will not be exported. If a log entry is matched by both filter and one of exclusion\u0026#39;s filters, it will not be exported. When `null`, the `exclusions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_project_sink.exclusions.new](#fn-exclusionsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.logging_project_sink.new` injects a new `google_logging_project_sink` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.logging_project_sink.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.logging_project_sink` using the reference:\n\n    $._ref.google_logging_project_sink.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_logging_project_sink.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `custom_writer_identity` (`string`): A service account provided by the caller that will be used to write the log entries. The format must be serviceAccount:some@email. This field can only be specified if you are routing logs to a destination outside this sink\u0026#39;s project. If not specified, a Logging service account will automatically be generated. When `null`, the `custom_writer_identity` field will be omitted from the resulting object.\n  - `description` (`string`): A description of this sink. The maximum length of the description is 8000 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `destination` (`string`): The destination of the sink (or, in other words, where logs are written to). Can be a Cloud Storage bucket, a PubSub topic, or a BigQuery dataset. Examples: \u0026#34;storage.googleapis.com/[GCS_BUCKET]\u0026#34; \u0026#34;bigquery.googleapis.com/projects/[PROJECT_ID]/datasets/[DATASET]\u0026#34; \u0026#34;pubsub.googleapis.com/projects/[PROJECT_ID]/topics/[TOPIC_ID]\u0026#34; The writer associated with the sink must have access to write to the above resource.\n  - `disabled` (`bool`): If set to True, then this sink is disabled and it does not export any log entries. When `null`, the `disabled` field will be omitted from the resulting object.\n  - `filter` (`string`): The filter to apply when exporting logs. Only log entries that match the filter are exported. When `null`, the `filter` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the logging sink.\n  - `project` (`string`): The ID of the project to create the sink in. If omitted, the project associated with the provider is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `unique_writer_identity` (`bool`): Whether or not to create a unique identity associated with this sink. If false (the legacy behavior), then the writer_identity used is serviceAccount:cloud-logs@system.gserviceaccount.com. If true (default), then a unique service account is created and used for this sink. If you wish to publish logs across projects, you must set unique_writer_identity to true. When `null`, the `unique_writer_identity` field will be omitted from the resulting object.\n  - `bigquery_options` (`list[obj]`): Options that affect sinks exporting data to BigQuery. When `null`, the `bigquery_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_project_sink.bigquery_options.new](#fn-bigquery_optionsnew) constructor.\n  - `exclusions` (`list[obj]`): Log entries that match any of the exclusion filters will not be exported. If a log entry is matched by both filter and one of exclusion\u0026#39;s filters, it will not be exported. When `null`, the `exclusions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_project_sink.exclusions.new](#fn-exclusionsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     destination,
     name,
     bigquery_options=null,
+    custom_writer_identity=null,
     description=null,
     disabled=null,
     exclusions=null,
@@ -42,6 +43,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     label=resourceLabel,
     attrs=self.newAttrs(
       bigquery_options=bigquery_options,
+      custom_writer_identity=custom_writer_identity,
       description=description,
       destination=destination,
       disabled=disabled,
@@ -53,11 +55,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.logging_project_sink.newAttrs` constructs a new object with attributes and blocks configured for the `logging_project_sink`\nTerraform resource.\n\nUnlike [google.logging_project_sink.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A description of this sink. The maximum length of the description is 8000 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `destination` (`string`): The destination of the sink (or, in other words, where logs are written to). Can be a Cloud Storage bucket, a PubSub topic, or a BigQuery dataset. Examples: "storage.googleapis.com/[GCS_BUCKET]" "bigquery.googleapis.com/projects/[PROJECT_ID]/datasets/[DATASET]" "pubsub.googleapis.com/projects/[PROJECT_ID]/topics/[TOPIC_ID]" The writer associated with the sink must have access to write to the above resource.\n  - `disabled` (`bool`): If set to True, then this sink is disabled and it does not export any log entries. When `null`, the `disabled` field will be omitted from the resulting object.\n  - `filter` (`string`): The filter to apply when exporting logs. Only log entries that match the filter are exported. When `null`, the `filter` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the logging sink.\n  - `project` (`string`): The ID of the project to create the sink in. If omitted, the project associated with the provider is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `unique_writer_identity` (`bool`): Whether or not to create a unique identity associated with this sink. If false (the default), then the writer_identity used is serviceAccount:cloud-logs@system.gserviceaccount.com. If true, then a unique service account is created and used for this sink. If you wish to publish logs across projects, you must set unique_writer_identity to true. When `null`, the `unique_writer_identity` field will be omitted from the resulting object.\n  - `bigquery_options` (`list[obj]`): Options that affect sinks exporting data to BigQuery. When `null`, the `bigquery_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_project_sink.bigquery_options.new](#fn-bigquery_optionsnew) constructor.\n  - `exclusions` (`list[obj]`): Log entries that match any of the exclusion filters will not be exported. If a log entry is matched by both filter and one of exclusion's filters, it will not be exported. When `null`, the `exclusions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_project_sink.exclusions.new](#fn-exclusionsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `logging_project_sink` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.logging_project_sink.newAttrs` constructs a new object with attributes and blocks configured for the `logging_project_sink`\nTerraform resource.\n\nUnlike [google.logging_project_sink.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `custom_writer_identity` (`string`): A service account provided by the caller that will be used to write the log entries. The format must be serviceAccount:some@email. This field can only be specified if you are routing logs to a destination outside this sink's project. If not specified, a Logging service account will automatically be generated. When `null`, the `custom_writer_identity` field will be omitted from the resulting object.\n  - `description` (`string`): A description of this sink. The maximum length of the description is 8000 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `destination` (`string`): The destination of the sink (or, in other words, where logs are written to). Can be a Cloud Storage bucket, a PubSub topic, or a BigQuery dataset. Examples: "storage.googleapis.com/[GCS_BUCKET]" "bigquery.googleapis.com/projects/[PROJECT_ID]/datasets/[DATASET]" "pubsub.googleapis.com/projects/[PROJECT_ID]/topics/[TOPIC_ID]" The writer associated with the sink must have access to write to the above resource.\n  - `disabled` (`bool`): If set to True, then this sink is disabled and it does not export any log entries. When `null`, the `disabled` field will be omitted from the resulting object.\n  - `filter` (`string`): The filter to apply when exporting logs. Only log entries that match the filter are exported. When `null`, the `filter` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the logging sink.\n  - `project` (`string`): The ID of the project to create the sink in. If omitted, the project associated with the provider is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `unique_writer_identity` (`bool`): Whether or not to create a unique identity associated with this sink. If false (the legacy behavior), then the writer_identity used is serviceAccount:cloud-logs@system.gserviceaccount.com. If true (default), then a unique service account is created and used for this sink. If you wish to publish logs across projects, you must set unique_writer_identity to true. When `null`, the `unique_writer_identity` field will be omitted from the resulting object.\n  - `bigquery_options` (`list[obj]`): Options that affect sinks exporting data to BigQuery. When `null`, the `bigquery_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_project_sink.bigquery_options.new](#fn-bigquery_optionsnew) constructor.\n  - `exclusions` (`list[obj]`): Log entries that match any of the exclusion filters will not be exported. If a log entry is matched by both filter and one of exclusion's filters, it will not be exported. When `null`, the `exclusions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_project_sink.exclusions.new](#fn-exclusionsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `logging_project_sink` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     destination,
     name,
     bigquery_options=null,
+    custom_writer_identity=null,
     description=null,
     disabled=null,
     exclusions=null,
@@ -66,6 +69,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     unique_writer_identity=null
   ):: std.prune(a={
     bigquery_options: bigquery_options,
+    custom_writer_identity: custom_writer_identity,
     description: description,
     destination: destination,
     disabled: disabled,
@@ -95,6 +99,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withCustomWriterIdentity':: d.fn(help='`google.string.withCustomWriterIdentity` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the custom_writer_identity field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `custom_writer_identity` field.\n', args=[]),
+  withCustomWriterIdentity(resourceLabel, value): {
+    resource+: {
+      google_logging_project_sink+: {
+        [resourceLabel]+: {
+          custom_writer_identity: value,
+        },
+      },
+    },
+  },
   '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
   withDescription(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/looker_instance.libsonnet b/4.x/_gen/resources/looker_instance.libsonnet
index cdc277dd..495ce756 100644
--- a/4.x/_gen/resources/looker_instance.libsonnet
+++ b/4.x/_gen/resources/looker_instance.libsonnet
@@ -92,7 +92,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
   },
-  '#new':: d.fn(help="\n`google.looker_instance.new` injects a new `google_looker_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.looker_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.looker_instance` using the reference:\n\n    $._ref.google_looker_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_looker_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `consumer_network` (`string`): Network name in the consumer project in the format of: projects/{project}/global/networks/{network}\nNote that the consumer network may be in a different GCP project than the consumer\nproject that is hosting the Looker Instance. When `null`, the `consumer_network` field will be omitted from the resulting object.\n  - `name` (`string`): The ID of the instance or a fully qualified identifier for the instance.\n  - `platform_edition` (`string`): Platform editions for a Looker instance. Each edition maps to a set of instance features, like its size. Must be one of these values:\n- LOOKER_CORE_TRIAL: trial instance\n- LOOKER_CORE_STANDARD: pay as you go standard instance\n- LOOKER_CORE_STANDARD_ANNUAL: subscription standard instance\n- LOOKER_CORE_ENTERPRISE_ANNUAL: subscription enterprise instance\n- LOOKER_CORE_EMBED_ANNUAL: subscription embed instance\n- LOOKER_MODELER: standalone modeling service Default value: \u0026#34;LOOKER_CORE_TRIAL\u0026#34; Possible values: [\u0026#34;LOOKER_CORE_TRIAL\u0026#34;, \u0026#34;LOOKER_CORE_STANDARD\u0026#34;, \u0026#34;LOOKER_CORE_STANDARD_ANNUAL\u0026#34;, \u0026#34;LOOKER_CORE_ENTERPRISE_ANNUAL\u0026#34;, \u0026#34;LOOKER_CORE_EMBED_ANNUAL\u0026#34;, \u0026#34;LOOKER_MODELER\u0026#34;] When `null`, the `platform_edition` field will be omitted from the resulting object.\n  - `private_ip_enabled` (`bool`): Whether private IP is enabled on the Looker instance. When `null`, the `private_ip_enabled` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_ip_enabled` (`bool`): Whether public IP is enabled on the Looker instance. When `null`, the `public_ip_enabled` field will be omitted from the resulting object.\n  - `region` (`string`): The name of the Looker region of the instance. When `null`, the `region` field will be omitted from the resulting object.\n  - `reserved_range` (`string`): Name of a reserved IP address range within the consumer network, to be used for\nprivate service access connection. User may or may not specify this in a request. When `null`, the `reserved_range` field will be omitted from the resulting object.\n  - `admin_settings` (`list[obj]`): Looker instance Admin settings. When `null`, the `admin_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.admin_settings.new](#fn-admin_settingsnew) constructor.\n  - `deny_maintenance_period` (`list[obj]`): Maintenance denial period for this instance.\n\nYou must allow at least 14 days of maintenance availability\nbetween any two deny maintenance periods. When `null`, the `deny_maintenance_period` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.deny_maintenance_period.new](#fn-deny_maintenance_periodnew) constructor.\n  - `encryption_config` (`list[obj]`): Looker instance encryption settings. When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.encryption_config.new](#fn-encryption_confignew) constructor.\n  - `maintenance_window` (`list[obj]`): Maintenance window for an instance.\n\nMaintenance of your instance takes place once a month, and will require\nyour instance to be restarted during updates, which will temporarily\ndisrupt service. When `null`, the `maintenance_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.maintenance_window.new](#fn-maintenance_windownew) constructor.\n  - `oauth_config` (`list[obj]`): Looker Instance OAuth login settings. When `null`, the `oauth_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.oauth_config.new](#fn-oauth_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.timeouts.new](#fn-timeoutsnew) constructor.\n  - `user_metadata` (`list[obj]`): Metadata about users for a Looker instance.\n\nThese settings are only available when platform edition LOOKER_CORE_STANDARD is set.\n\nThere are ten Standard and two Developer users included in the cost of the product.\nYou can allocate additional Standard, Viewer, and Developer users for this instance.\nIt is an optional step and can be modified later.\n\nWith the Standard edition of Looker (Google Cloud core), you can provision up to 50\ntotal users, distributed across Viewer, Standard, and Developer. When `null`, the `user_metadata` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.user_metadata.new](#fn-user_metadatanew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.looker_instance.new` injects a new `google_looker_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.looker_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.looker_instance` using the reference:\n\n    $._ref.google_looker_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_looker_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `consumer_network` (`string`): Network name in the consumer project in the format of: projects/{project}/global/networks/{network}\nNote that the consumer network may be in a different GCP project than the consumer\nproject that is hosting the Looker Instance. When `null`, the `consumer_network` field will be omitted from the resulting object.\n  - `name` (`string`): The ID of the instance or a fully qualified identifier for the instance.\n  - `platform_edition` (`string`): Platform editions for a Looker instance. Each edition maps to a set of instance features, like its size. Must be one of these values:\n- LOOKER_CORE_TRIAL: trial instance\n- LOOKER_CORE_STANDARD: pay as you go standard instance\n- LOOKER_CORE_STANDARD_ANNUAL: subscription standard instance\n- LOOKER_CORE_ENTERPRISE_ANNUAL: subscription enterprise instance\n- LOOKER_CORE_EMBED_ANNUAL: subscription embed instance Default value: \u0026#34;LOOKER_CORE_TRIAL\u0026#34; Possible values: [\u0026#34;LOOKER_CORE_TRIAL\u0026#34;, \u0026#34;LOOKER_CORE_STANDARD\u0026#34;, \u0026#34;LOOKER_CORE_STANDARD_ANNUAL\u0026#34;, \u0026#34;LOOKER_CORE_ENTERPRISE_ANNUAL\u0026#34;, \u0026#34;LOOKER_CORE_EMBED_ANNUAL\u0026#34;] When `null`, the `platform_edition` field will be omitted from the resulting object.\n  - `private_ip_enabled` (`bool`): Whether private IP is enabled on the Looker instance. When `null`, the `private_ip_enabled` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_ip_enabled` (`bool`): Whether public IP is enabled on the Looker instance. When `null`, the `public_ip_enabled` field will be omitted from the resulting object.\n  - `region` (`string`): The name of the Looker region of the instance. When `null`, the `region` field will be omitted from the resulting object.\n  - `reserved_range` (`string`): Name of a reserved IP address range within the consumer network, to be used for\nprivate service access connection. User may or may not specify this in a request. When `null`, the `reserved_range` field will be omitted from the resulting object.\n  - `admin_settings` (`list[obj]`): Looker instance Admin settings. When `null`, the `admin_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.admin_settings.new](#fn-admin_settingsnew) constructor.\n  - `deny_maintenance_period` (`list[obj]`): Maintenance denial period for this instance.\n\nYou must allow at least 14 days of maintenance availability\nbetween any two deny maintenance periods. When `null`, the `deny_maintenance_period` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.deny_maintenance_period.new](#fn-deny_maintenance_periodnew) constructor.\n  - `encryption_config` (`list[obj]`): Looker instance encryption settings. When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.encryption_config.new](#fn-encryption_confignew) constructor.\n  - `maintenance_window` (`list[obj]`): Maintenance window for an instance.\n\nMaintenance of your instance takes place once a month, and will require\nyour instance to be restarted during updates, which will temporarily\ndisrupt service. When `null`, the `maintenance_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.maintenance_window.new](#fn-maintenance_windownew) constructor.\n  - `oauth_config` (`list[obj]`): Looker Instance OAuth login settings. When `null`, the `oauth_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.oauth_config.new](#fn-oauth_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.timeouts.new](#fn-timeoutsnew) constructor.\n  - `user_metadata` (`list[obj]`): Metadata about users for a Looker instance.\n\nThese settings are only available when platform edition LOOKER_CORE_STANDARD is set.\n\nThere are ten Standard and two Developer users included in the cost of the product.\nYou can allocate additional Standard, Viewer, and Developer users for this instance.\nIt is an optional step and can be modified later.\n\nWith the Standard edition of Looker (Google Cloud core), you can provision up to 50\ntotal users, distributed across Viewer, Standard, and Developer. When `null`, the `user_metadata` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.user_metadata.new](#fn-user_metadatanew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -133,7 +133,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.looker_instance.newAttrs` constructs a new object with attributes and blocks configured for the `looker_instance`\nTerraform resource.\n\nUnlike [google.looker_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `consumer_network` (`string`): Network name in the consumer project in the format of: projects/{project}/global/networks/{network}\nNote that the consumer network may be in a different GCP project than the consumer\nproject that is hosting the Looker Instance. When `null`, the `consumer_network` field will be omitted from the resulting object.\n  - `name` (`string`): The ID of the instance or a fully qualified identifier for the instance.\n  - `platform_edition` (`string`): Platform editions for a Looker instance. Each edition maps to a set of instance features, like its size. Must be one of these values:\n- LOOKER_CORE_TRIAL: trial instance\n- LOOKER_CORE_STANDARD: pay as you go standard instance\n- LOOKER_CORE_STANDARD_ANNUAL: subscription standard instance\n- LOOKER_CORE_ENTERPRISE_ANNUAL: subscription enterprise instance\n- LOOKER_CORE_EMBED_ANNUAL: subscription embed instance\n- LOOKER_MODELER: standalone modeling service Default value: "LOOKER_CORE_TRIAL" Possible values: ["LOOKER_CORE_TRIAL", "LOOKER_CORE_STANDARD", "LOOKER_CORE_STANDARD_ANNUAL", "LOOKER_CORE_ENTERPRISE_ANNUAL", "LOOKER_CORE_EMBED_ANNUAL", "LOOKER_MODELER"] When `null`, the `platform_edition` field will be omitted from the resulting object.\n  - `private_ip_enabled` (`bool`): Whether private IP is enabled on the Looker instance. When `null`, the `private_ip_enabled` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_ip_enabled` (`bool`): Whether public IP is enabled on the Looker instance. When `null`, the `public_ip_enabled` field will be omitted from the resulting object.\n  - `region` (`string`): The name of the Looker region of the instance. When `null`, the `region` field will be omitted from the resulting object.\n  - `reserved_range` (`string`): Name of a reserved IP address range within the consumer network, to be used for\nprivate service access connection. User may or may not specify this in a request. When `null`, the `reserved_range` field will be omitted from the resulting object.\n  - `admin_settings` (`list[obj]`): Looker instance Admin settings. When `null`, the `admin_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.admin_settings.new](#fn-admin_settingsnew) constructor.\n  - `deny_maintenance_period` (`list[obj]`): Maintenance denial period for this instance.\n\nYou must allow at least 14 days of maintenance availability\nbetween any two deny maintenance periods. When `null`, the `deny_maintenance_period` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.deny_maintenance_period.new](#fn-deny_maintenance_periodnew) constructor.\n  - `encryption_config` (`list[obj]`): Looker instance encryption settings. When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.encryption_config.new](#fn-encryption_confignew) constructor.\n  - `maintenance_window` (`list[obj]`): Maintenance window for an instance.\n\nMaintenance of your instance takes place once a month, and will require\nyour instance to be restarted during updates, which will temporarily\ndisrupt service. When `null`, the `maintenance_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.maintenance_window.new](#fn-maintenance_windownew) constructor.\n  - `oauth_config` (`list[obj]`): Looker Instance OAuth login settings. When `null`, the `oauth_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.oauth_config.new](#fn-oauth_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.timeouts.new](#fn-timeoutsnew) constructor.\n  - `user_metadata` (`list[obj]`): Metadata about users for a Looker instance.\n\nThese settings are only available when platform edition LOOKER_CORE_STANDARD is set.\n\nThere are ten Standard and two Developer users included in the cost of the product.\nYou can allocate additional Standard, Viewer, and Developer users for this instance.\nIt is an optional step and can be modified later.\n\nWith the Standard edition of Looker (Google Cloud core), you can provision up to 50\ntotal users, distributed across Viewer, Standard, and Developer. When `null`, the `user_metadata` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.user_metadata.new](#fn-user_metadatanew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `looker_instance` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.looker_instance.newAttrs` constructs a new object with attributes and blocks configured for the `looker_instance`\nTerraform resource.\n\nUnlike [google.looker_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `consumer_network` (`string`): Network name in the consumer project in the format of: projects/{project}/global/networks/{network}\nNote that the consumer network may be in a different GCP project than the consumer\nproject that is hosting the Looker Instance. When `null`, the `consumer_network` field will be omitted from the resulting object.\n  - `name` (`string`): The ID of the instance or a fully qualified identifier for the instance.\n  - `platform_edition` (`string`): Platform editions for a Looker instance. Each edition maps to a set of instance features, like its size. Must be one of these values:\n- LOOKER_CORE_TRIAL: trial instance\n- LOOKER_CORE_STANDARD: pay as you go standard instance\n- LOOKER_CORE_STANDARD_ANNUAL: subscription standard instance\n- LOOKER_CORE_ENTERPRISE_ANNUAL: subscription enterprise instance\n- LOOKER_CORE_EMBED_ANNUAL: subscription embed instance Default value: "LOOKER_CORE_TRIAL" Possible values: ["LOOKER_CORE_TRIAL", "LOOKER_CORE_STANDARD", "LOOKER_CORE_STANDARD_ANNUAL", "LOOKER_CORE_ENTERPRISE_ANNUAL", "LOOKER_CORE_EMBED_ANNUAL"] When `null`, the `platform_edition` field will be omitted from the resulting object.\n  - `private_ip_enabled` (`bool`): Whether private IP is enabled on the Looker instance. When `null`, the `private_ip_enabled` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_ip_enabled` (`bool`): Whether public IP is enabled on the Looker instance. When `null`, the `public_ip_enabled` field will be omitted from the resulting object.\n  - `region` (`string`): The name of the Looker region of the instance. When `null`, the `region` field will be omitted from the resulting object.\n  - `reserved_range` (`string`): Name of a reserved IP address range within the consumer network, to be used for\nprivate service access connection. User may or may not specify this in a request. When `null`, the `reserved_range` field will be omitted from the resulting object.\n  - `admin_settings` (`list[obj]`): Looker instance Admin settings. When `null`, the `admin_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.admin_settings.new](#fn-admin_settingsnew) constructor.\n  - `deny_maintenance_period` (`list[obj]`): Maintenance denial period for this instance.\n\nYou must allow at least 14 days of maintenance availability\nbetween any two deny maintenance periods. When `null`, the `deny_maintenance_period` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.deny_maintenance_period.new](#fn-deny_maintenance_periodnew) constructor.\n  - `encryption_config` (`list[obj]`): Looker instance encryption settings. When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.encryption_config.new](#fn-encryption_confignew) constructor.\n  - `maintenance_window` (`list[obj]`): Maintenance window for an instance.\n\nMaintenance of your instance takes place once a month, and will require\nyour instance to be restarted during updates, which will temporarily\ndisrupt service. When `null`, the `maintenance_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.maintenance_window.new](#fn-maintenance_windownew) constructor.\n  - `oauth_config` (`list[obj]`): Looker Instance OAuth login settings. When `null`, the `oauth_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.oauth_config.new](#fn-oauth_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.timeouts.new](#fn-timeoutsnew) constructor.\n  - `user_metadata` (`list[obj]`): Metadata about users for a Looker instance.\n\nThese settings are only available when platform edition LOOKER_CORE_STANDARD is set.\n\nThere are ten Standard and two Developer users included in the cost of the product.\nYou can allocate additional Standard, Viewer, and Developer users for this instance.\nIt is an optional step and can be modified later.\n\nWith the Standard edition of Looker (Google Cloud core), you can provision up to 50\ntotal users, distributed across Viewer, Standard, and Developer. When `null`, the `user_metadata` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.looker_instance.user_metadata.new](#fn-user_metadatanew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `looker_instance` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     admin_settings=null,
diff --git a/4.x/_gen/resources/memcache_instance.libsonnet b/4.x/_gen/resources/memcache_instance.libsonnet
index 943115d5..ff3f92da 100644
--- a/4.x/_gen/resources/memcache_instance.libsonnet
+++ b/4.x/_gen/resources/memcache_instance.libsonnet
@@ -46,7 +46,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       params: params,
     }),
   },
-  '#new':: d.fn(help="\n`google.memcache_instance.new` injects a new `google_memcache_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.memcache_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.memcache_instance` using the reference:\n\n    $._ref.google_memcache_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_memcache_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `authorized_network` (`string`): The full name of the GCE network to connect the instance to.  If not provided,\n\u0026#39;default\u0026#39; will be used. When `null`, the `authorized_network` field will be omitted from the resulting object.\n  - `display_name` (`string`): A user-visible name for the instance. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `memcache_version` (`string`): The major version of Memcached software. If not provided, latest supported version will be used.\nCurrently the latest supported major version is MEMCACHE_1_5. The minor version will be automatically\ndetermined by our system based on the latest supported minor version. Default value: \u0026#34;MEMCACHE_1_5\u0026#34; Possible values: [\u0026#34;MEMCACHE_1_5\u0026#34;] When `null`, the `memcache_version` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name of the instance.\n  - `node_count` (`number`): Number of nodes in the memcache instance.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the Memcache instance. If it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `zones` (`list`): Zones where memcache nodes should be provisioned.  If not\nprovided, all zones will be used. When `null`, the `zones` field will be omitted from the resulting object.\n  - `maintenance_policy` (`list[obj]`): Maintenance policy for an instance. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.memcache_instance.maintenance_policy.new](#fn-maintenance_policynew) constructor.\n  - `memcache_parameters` (`list[obj]`): User-specified parameters for this memcache instance. When `null`, the `memcache_parameters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.memcache_instance.memcache_parameters.new](#fn-memcache_parametersnew) constructor.\n  - `node_config` (`list[obj]`): Configuration for memcache nodes. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.memcache_instance.node_config.new](#fn-node_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.memcache_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.memcache_instance.new` injects a new `google_memcache_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.memcache_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.memcache_instance` using the reference:\n\n    $._ref.google_memcache_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_memcache_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `authorized_network` (`string`): The full name of the GCE network to connect the instance to.  If not provided,\n\u0026#39;default\u0026#39; will be used. When `null`, the `authorized_network` field will be omitted from the resulting object.\n  - `display_name` (`string`): A user-visible name for the instance. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `memcache_version` (`string`): The major version of Memcached software. If not provided, latest supported version will be used.\nCurrently the latest supported major version is MEMCACHE_1_5. The minor version will be automatically\ndetermined by our system based on the latest supported minor version. Default value: \u0026#34;MEMCACHE_1_5\u0026#34; Possible values: [\u0026#34;MEMCACHE_1_5\u0026#34;] When `null`, the `memcache_version` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name of the instance.\n  - `node_count` (`number`): Number of nodes in the memcache instance.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the Memcache instance. If it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `zones` (`list`): Zones where memcache nodes should be provisioned.  If not\nprovided, all zones will be used. When `null`, the `zones` field will be omitted from the resulting object.\n  - `maintenance_policy` (`list[obj]`): Maintenance policy for an instance. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.memcache_instance.maintenance_policy.new](#fn-maintenance_policynew) constructor.\n  - `memcache_parameters` (`list[obj]`): User-specified parameters for this memcache instance. When `null`, the `memcache_parameters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.memcache_instance.memcache_parameters.new](#fn-memcache_parametersnew) constructor.\n  - `node_config` (`list[obj]`): Configuration for memcache nodes. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.memcache_instance.node_config.new](#fn-node_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.memcache_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -83,7 +83,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.memcache_instance.newAttrs` constructs a new object with attributes and blocks configured for the `memcache_instance`\nTerraform resource.\n\nUnlike [google.memcache_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `authorized_network` (`string`): The full name of the GCE network to connect the instance to.  If not provided,\n'default' will be used. When `null`, the `authorized_network` field will be omitted from the resulting object.\n  - `display_name` (`string`): A user-visible name for the instance. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `memcache_version` (`string`): The major version of Memcached software. If not provided, latest supported version will be used.\nCurrently the latest supported major version is MEMCACHE_1_5. The minor version will be automatically\ndetermined by our system based on the latest supported minor version. Default value: "MEMCACHE_1_5" Possible values: ["MEMCACHE_1_5"] When `null`, the `memcache_version` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name of the instance.\n  - `node_count` (`number`): Number of nodes in the memcache instance.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the Memcache instance. If it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `zones` (`list`): Zones where memcache nodes should be provisioned.  If not\nprovided, all zones will be used. When `null`, the `zones` field will be omitted from the resulting object.\n  - `maintenance_policy` (`list[obj]`): Maintenance policy for an instance. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.memcache_instance.maintenance_policy.new](#fn-maintenance_policynew) constructor.\n  - `memcache_parameters` (`list[obj]`): User-specified parameters for this memcache instance. When `null`, the `memcache_parameters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.memcache_instance.memcache_parameters.new](#fn-memcache_parametersnew) constructor.\n  - `node_config` (`list[obj]`): Configuration for memcache nodes. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.memcache_instance.node_config.new](#fn-node_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.memcache_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `memcache_instance` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.memcache_instance.newAttrs` constructs a new object with attributes and blocks configured for the `memcache_instance`\nTerraform resource.\n\nUnlike [google.memcache_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `authorized_network` (`string`): The full name of the GCE network to connect the instance to.  If not provided,\n'default' will be used. When `null`, the `authorized_network` field will be omitted from the resulting object.\n  - `display_name` (`string`): A user-visible name for the instance. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `memcache_version` (`string`): The major version of Memcached software. If not provided, latest supported version will be used.\nCurrently the latest supported major version is MEMCACHE_1_5. The minor version will be automatically\ndetermined by our system based on the latest supported minor version. Default value: "MEMCACHE_1_5" Possible values: ["MEMCACHE_1_5"] When `null`, the `memcache_version` field will be omitted from the resulting object.\n  - `name` (`string`): The resource name of the instance.\n  - `node_count` (`number`): Number of nodes in the memcache instance.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the Memcache instance. If it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `zones` (`list`): Zones where memcache nodes should be provisioned.  If not\nprovided, all zones will be used. When `null`, the `zones` field will be omitted from the resulting object.\n  - `maintenance_policy` (`list[obj]`): Maintenance policy for an instance. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.memcache_instance.maintenance_policy.new](#fn-maintenance_policynew) constructor.\n  - `memcache_parameters` (`list[obj]`): User-specified parameters for this memcache instance. When `null`, the `memcache_parameters` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.memcache_instance.memcache_parameters.new](#fn-memcache_parametersnew) constructor.\n  - `node_config` (`list[obj]`): Configuration for memcache nodes. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.memcache_instance.node_config.new](#fn-node_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.memcache_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `memcache_instance` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     node_count,
diff --git a/4.x/_gen/resources/ml_engine_model.libsonnet b/4.x/_gen/resources/ml_engine_model.libsonnet
index f2180c1a..64ec74a6 100644
--- a/4.x/_gen/resources/ml_engine_model.libsonnet
+++ b/4.x/_gen/resources/ml_engine_model.libsonnet
@@ -10,7 +10,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       name: name,
     }),
   },
-  '#new':: d.fn(help="\n`google.ml_engine_model.new` injects a new `google_ml_engine_model` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.ml_engine_model.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.ml_engine_model` using the reference:\n\n    $._ref.google_ml_engine_model.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_ml_engine_model.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): The description specified for the model when it was created. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): One or more labels that you can add, to organize your models. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name specified for the model.\n  - `online_prediction_console_logging` (`bool`): If true, online prediction nodes send stderr and stdout streams to Stackdriver Logging When `null`, the `online_prediction_console_logging` field will be omitted from the resulting object.\n  - `online_prediction_logging` (`bool`): If true, online prediction access logs are sent to StackDriver Logging. When `null`, the `online_prediction_logging` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `regions` (`list`): The list of regions where the model is going to be deployed.\nCurrently only one region per model is supported When `null`, the `regions` field will be omitted from the resulting object.\n  - `default_version` (`list[obj]`): The default version of the model. This version will be used to handle\nprediction requests that do not specify a version. When `null`, the `default_version` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.ml_engine_model.default_version.new](#fn-default_versionnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.ml_engine_model.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.ml_engine_model.new` injects a new `google_ml_engine_model` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.ml_engine_model.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.ml_engine_model` using the reference:\n\n    $._ref.google_ml_engine_model.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_ml_engine_model.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): The description specified for the model when it was created. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): One or more labels that you can add, to organize your models.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name specified for the model.\n  - `online_prediction_console_logging` (`bool`): If true, online prediction nodes send stderr and stdout streams to Stackdriver Logging When `null`, the `online_prediction_console_logging` field will be omitted from the resulting object.\n  - `online_prediction_logging` (`bool`): If true, online prediction access logs are sent to StackDriver Logging. When `null`, the `online_prediction_logging` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `regions` (`list`): The list of regions where the model is going to be deployed.\nCurrently only one region per model is supported When `null`, the `regions` field will be omitted from the resulting object.\n  - `default_version` (`list[obj]`): The default version of the model. This version will be used to handle\nprediction requests that do not specify a version. When `null`, the `default_version` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.ml_engine_model.default_version.new](#fn-default_versionnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.ml_engine_model.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -39,7 +39,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.ml_engine_model.newAttrs` constructs a new object with attributes and blocks configured for the `ml_engine_model`\nTerraform resource.\n\nUnlike [google.ml_engine_model.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): The description specified for the model when it was created. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): One or more labels that you can add, to organize your models. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name specified for the model.\n  - `online_prediction_console_logging` (`bool`): If true, online prediction nodes send stderr and stdout streams to Stackdriver Logging When `null`, the `online_prediction_console_logging` field will be omitted from the resulting object.\n  - `online_prediction_logging` (`bool`): If true, online prediction access logs are sent to StackDriver Logging. When `null`, the `online_prediction_logging` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `regions` (`list`): The list of regions where the model is going to be deployed.\nCurrently only one region per model is supported When `null`, the `regions` field will be omitted from the resulting object.\n  - `default_version` (`list[obj]`): The default version of the model. This version will be used to handle\nprediction requests that do not specify a version. When `null`, the `default_version` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.ml_engine_model.default_version.new](#fn-default_versionnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.ml_engine_model.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `ml_engine_model` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.ml_engine_model.newAttrs` constructs a new object with attributes and blocks configured for the `ml_engine_model`\nTerraform resource.\n\nUnlike [google.ml_engine_model.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): The description specified for the model when it was created. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): One or more labels that you can add, to organize your models.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name specified for the model.\n  - `online_prediction_console_logging` (`bool`): If true, online prediction nodes send stderr and stdout streams to Stackdriver Logging When `null`, the `online_prediction_console_logging` field will be omitted from the resulting object.\n  - `online_prediction_logging` (`bool`): If true, online prediction access logs are sent to StackDriver Logging. When `null`, the `online_prediction_logging` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `regions` (`list`): The list of regions where the model is going to be deployed.\nCurrently only one region per model is supported When `null`, the `regions` field will be omitted from the resulting object.\n  - `default_version` (`list[obj]`): The default version of the model. This version will be used to handle\nprediction requests that do not specify a version. When `null`, the `default_version` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.ml_engine_model.default_version.new](#fn-default_versionnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.ml_engine_model.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `ml_engine_model` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     default_version=null,
diff --git a/4.x/_gen/resources/monitoring_alert_policy.libsonnet b/4.x/_gen/resources/monitoring_alert_policy.libsonnet
index 310dbf27..d65ffd7b 100644
--- a/4.x/_gen/resources/monitoring_alert_policy.libsonnet
+++ b/4.x/_gen/resources/monitoring_alert_policy.libsonnet
@@ -106,7 +106,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
     condition_prometheus_query_language:: {
-      '#new':: d.fn(help='\n`google.monitoring_alert_policy.conditions.condition_prometheus_query_language.new` constructs a new object with attributes and blocks configured for the `condition_prometheus_query_language`\nTerraform sub block.\n\n\n\n**Args**:\n  - `alert_rule` (`string`): The alerting rule name of this alert in the corresponding Prometheus\nconfiguration file.\n\nSome external tools may require this field to be populated correctly\nin order to refer to the original Prometheus configuration file.\nThe rule group name and the alert name are necessary to update the\nrelevant AlertPolicies in case the definition of the rule group changes\nin the future.\n\nThis field is optional. If this field is not empty, then it must be a\nvalid Prometheus label name. When `null`, the `alert_rule` field will be omitted from the resulting object.\n  - `duration` (`string`): Alerts are considered firing once their PromQL expression evaluated\nto be "true" for this long. Alerts whose PromQL expression was not\nevaluated to be "true" for long enough are considered pending. The\ndefault value is zero. Must be zero or positive. When `null`, the `duration` field will be omitted from the resulting object.\n  - `evaluation_interval` (`string`): How often this rule should be evaluated. Must be a positive multiple\nof 30 seconds or missing. The default value is 30 seconds. If this\nPrometheusQueryLanguageCondition was generated from a Prometheus\nalerting rule, then this value should be taken from the enclosing\nrule group. When `null`, the `evaluation_interval` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to add to or overwrite in the PromQL query result. Label names\nmust be valid.\n\nLabel values can be templatized by using variables. The only available\nvariable names are the names of the labels in the PromQL result, including\n"__name__" and "value". "labels" may be empty. This field is intended to be\nused for organizing and identifying the AlertPolicy When `null`, the `labels` field will be omitted from the resulting object.\n  - `query` (`string`): The PromQL expression to evaluate. Every evaluation cycle this\nexpression is evaluated at the current time, and all resultant time\nseries become pending/firing alerts. This field must not be empty.\n  - `rule_group` (`string`): The rule group name of this alert in the corresponding Prometheus\nconfiguration file.\n\nSome external tools may require this field to be populated correctly\nin order to refer to the original Prometheus configuration file.\nThe rule group name and the alert name are necessary to update the\nrelevant AlertPolicies in case the definition of the rule group changes\nin the future.\n\nThis field is optional. If this field is not empty, then it must be a\nvalid Prometheus label name. When `null`, the `rule_group` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `condition_prometheus_query_language` sub block.\n', args=[]),
+      '#new':: d.fn(help='\n`google.monitoring_alert_policy.conditions.condition_prometheus_query_language.new` constructs a new object with attributes and blocks configured for the `condition_prometheus_query_language`\nTerraform sub block.\n\n\n\n**Args**:\n  - `alert_rule` (`string`): The alerting rule name of this alert in the corresponding Prometheus\nconfiguration file.\n\nSome external tools may require this field to be populated correctly\nin order to refer to the original Prometheus configuration file.\nThe rule group name and the alert name are necessary to update the\nrelevant AlertPolicies in case the definition of the rule group changes\nin the future.\n\nThis field is optional. If this field is not empty, then it must be a\nvalid Prometheus label name. When `null`, the `alert_rule` field will be omitted from the resulting object.\n  - `duration` (`string`): Alerts are considered firing once their PromQL expression evaluated\nto be "true" for this long. Alerts whose PromQL expression was not\nevaluated to be "true" for long enough are considered pending. The\ndefault value is zero. Must be zero or positive. When `null`, the `duration` field will be omitted from the resulting object.\n  - `evaluation_interval` (`string`): How often this rule should be evaluated. Must be a positive multiple\nof 30 seconds or missing. The default value is 30 seconds. If this\nPrometheusQueryLanguageCondition was generated from a Prometheus\nalerting rule, then this value should be taken from the enclosing\nrule group. When `null`, the `evaluation_interval` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to add to or overwrite in the PromQL query result. Label names\nmust be valid.\n\nLabel values can be templatized by using variables. The only available\nvariable names are the names of the labels in the PromQL result, including\n"__name__" and "value". "labels" may be empty. This field is intended to be\nused for organizing and identifying the AlertPolicy When `null`, the `labels` field will be omitted from the resulting object.\n  - `query` (`string`): The PromQL expression to evaluate. Every evaluation cycle this\nexpression is evaluated at the current time, and all resultant time\nseries become pending/firing alerts. This field must not be empty.\n  - `rule_group` (`string`): The rule group name of this alert in the corresponding Prometheus\nconfiguration file.\n\nSome external tools may require this field to be populated correctly\nin order to refer to the original Prometheus configuration file.\nThe rule group name and the alert name are necessary to update the\nrelevant AlertPolicies in case the definition of the rule group changes\nin the future. This field is optional. When `null`, the `rule_group` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `condition_prometheus_query_language` sub block.\n', args=[]),
       new(
         query,
         alert_rule=null,
@@ -195,7 +195,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         }),
       },
     },
-    '#new':: d.fn(help='\n`google.monitoring_alert_policy.conditions.new` constructs a new object with attributes and blocks configured for the `conditions`\nTerraform sub block.\n\n\n\n**Args**:\n  - `display_name` (`string`): A short name or phrase used to identify the\ncondition in dashboards, notifications, and\nincidents. To avoid confusion, don't use the same\ndisplay name for multiple conditions in the same\npolicy.\n  - `condition_absent` (`list[obj]`): A condition that checks that a time series\ncontinues to receive new data points. When `null`, the `condition_absent` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.conditions.condition_absent.new](#fn-conditionscondition_absentnew) constructor.\n  - `condition_matched_log` (`list[obj]`): A condition that checks for log messages matching given constraints.\nIf set, no other conditions can be present. When `null`, the `condition_matched_log` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.conditions.condition_matched_log.new](#fn-conditionscondition_matched_lognew) constructor.\n  - `condition_monitoring_query_language` (`list[obj]`): A Monitoring Query Language query that outputs a boolean stream When `null`, the `condition_monitoring_query_language` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.conditions.condition_monitoring_query_language.new](#fn-conditionscondition_monitoring_query_languagenew) constructor.\n  - `condition_prometheus_query_language` (`list[obj]`): A Monitoring Query Language query that outputs a boolean stream\n\nA condition type that allows alert policies to be defined using\nPrometheus Query Language (PromQL).\n\nThe PrometheusQueryLanguageCondition message contains information\nfrom a Prometheus alerting rule and its associated rule group. When `null`, the `condition_prometheus_query_language` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.conditions.condition_prometheus_query_language.new](#fn-conditionscondition_prometheus_query_languagenew) constructor.\n  - `condition_threshold` (`list[obj]`): A condition that compares a time series against a\nthreshold. When `null`, the `condition_threshold` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.conditions.condition_threshold.new](#fn-conditionscondition_thresholdnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `conditions` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.monitoring_alert_policy.conditions.new` constructs a new object with attributes and blocks configured for the `conditions`\nTerraform sub block.\n\n\n\n**Args**:\n  - `display_name` (`string`): A short name or phrase used to identify the\ncondition in dashboards, notifications, and\nincidents. To avoid confusion, don't use the same\ndisplay name for multiple conditions in the same\npolicy.\n  - `condition_absent` (`list[obj]`): A condition that checks that a time series\ncontinues to receive new data points. When `null`, the `condition_absent` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.conditions.condition_absent.new](#fn-conditionscondition_absentnew) constructor.\n  - `condition_matched_log` (`list[obj]`): A condition that checks for log messages matching given constraints.\nIf set, no other conditions can be present. When `null`, the `condition_matched_log` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.conditions.condition_matched_log.new](#fn-conditionscondition_matched_lognew) constructor.\n  - `condition_monitoring_query_language` (`list[obj]`): A Monitoring Query Language query that outputs a boolean stream When `null`, the `condition_monitoring_query_language` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.conditions.condition_monitoring_query_language.new](#fn-conditionscondition_monitoring_query_languagenew) constructor.\n  - `condition_prometheus_query_language` (`list[obj]`): A condition type that allows alert policies to be defined using\nPrometheus Query Language (PromQL).\n\nThe PrometheusQueryLanguageCondition message contains information\nfrom a Prometheus alerting rule and its associated rule group. When `null`, the `condition_prometheus_query_language` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.conditions.condition_prometheus_query_language.new](#fn-conditionscondition_prometheus_query_languagenew) constructor.\n  - `condition_threshold` (`list[obj]`): A condition that compares a time series against a\nthreshold. When `null`, the `condition_threshold` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.conditions.condition_threshold.new](#fn-conditionscondition_thresholdnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `conditions` sub block.\n', args=[]),
     new(
       display_name,
       condition_absent=null,
@@ -213,13 +213,15 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     }),
   },
   documentation:: {
-    '#new':: d.fn(help='\n`google.monitoring_alert_policy.documentation.new` constructs a new object with attributes and blocks configured for the `documentation`\nTerraform sub block.\n\n\n\n**Args**:\n  - `content` (`string`): The text of the documentation, interpreted according to mimeType.\nThe content may not exceed 8,192 Unicode characters and may not\nexceed more than 10,240 bytes when encoded in UTF-8 format,\nwhichever is smaller. When `null`, the `content` field will be omitted from the resulting object.\n  - `mime_type` (`string`): The format of the content field. Presently, only the value\n"text/markdown" is supported. When `null`, the `mime_type` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `documentation` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.monitoring_alert_policy.documentation.new` constructs a new object with attributes and blocks configured for the `documentation`\nTerraform sub block.\n\n\n\n**Args**:\n  - `content` (`string`): The text of the documentation, interpreted according to mimeType.\nThe content may not exceed 8,192 Unicode characters and may not\nexceed more than 10,240 bytes when encoded in UTF-8 format,\nwhichever is smaller. When `null`, the `content` field will be omitted from the resulting object.\n  - `mime_type` (`string`): The format of the content field. Presently, only the value\n"text/markdown" is supported. When `null`, the `mime_type` field will be omitted from the resulting object.\n  - `subject` (`string`): The subject line of the notification. The subject line may not\nexceed 10,240 bytes. In notifications generated by this policy the contents\nof the subject line after variable expansion will be truncated to 255 bytes\nor shorter at the latest UTF-8 character boundary. When `null`, the `subject` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `documentation` sub block.\n', args=[]),
     new(
       content=null,
-      mime_type=null
+      mime_type=null,
+      subject=null
     ):: std.prune(a={
       content: content,
       mime_type: mime_type,
+      subject: subject,
     }),
   },
   '#new':: d.fn(help="\n`google.monitoring_alert_policy.new` injects a new `google_monitoring_alert_policy` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.monitoring_alert_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.monitoring_alert_policy` using the reference:\n\n    $._ref.google_monitoring_alert_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_monitoring_alert_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `combiner` (`string`): How to combine the results of multiple conditions to\ndetermine if an incident should be opened. Possible values: [\u0026#34;AND\u0026#34;, \u0026#34;OR\u0026#34;, \u0026#34;AND_WITH_MATCHING_RESOURCE\u0026#34;]\n  - `display_name` (`string`): A short name or phrase used to identify the policy in\ndashboards, notifications, and incidents. To avoid confusion, don\u0026#39;t use\nthe same display name for multiple policies in the same project. The\nname is limited to 512 Unicode characters.\n  - `enabled` (`bool`): Whether or not the policy is enabled. The default is true. When `null`, the `enabled` field will be omitted from the resulting object.\n  - `notification_channels` (`list`): Identifies the notification channels to which notifications should be\nsent when incidents are opened or closed or when new violations occur\non an already opened incident. Each element of this array corresponds\nto the name field in each of the NotificationChannel objects that are\nreturned from the notificationChannels.list method. The syntax of the\nentries in this field is\n\u0026#39;projects/[PROJECT_ID]/notificationChannels/[CHANNEL_ID]\u0026#39; When `null`, the `notification_channels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `user_labels` (`obj`): This field is intended to be used for organizing and identifying the AlertPolicy\nobjects.The field can contain up to 64 entries. Each key and value is limited\nto 63 Unicode characters or 128 bytes, whichever is smaller. Labels and values\ncan contain only lowercase letters, numerals, underscores, and dashes. Keys\nmust begin with a letter. When `null`, the `user_labels` field will be omitted from the resulting object.\n  - `alert_strategy` (`list[obj]`): Control over how this alert policy\u0026#39;s notification channels are notified. When `null`, the `alert_strategy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.alert_strategy.new](#fn-alert_strategynew) constructor.\n  - `conditions` (`list[obj]`): A list of conditions for the policy. The conditions are combined by\nAND or OR according to the combiner field. If the combined conditions\nevaluate to true, then an incident is created. A policy can have from\none to six conditions. When `null`, the `conditions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.conditions.new](#fn-conditionsnew) constructor.\n  - `documentation` (`list[obj]`): Documentation that is included with notifications and incidents related\nto this policy. Best practice is for the documentation to include information\nto help responders understand, mitigate, escalate, and correct the underlying\nproblems detected by the alerting policy. Notification channels that have\nlimited capacity might not show this documentation. When `null`, the `documentation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.documentation.new](#fn-documentationnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
diff --git a/4.x/_gen/resources/network_connectivity_hub.libsonnet b/4.x/_gen/resources/network_connectivity_hub.libsonnet
index 5ddd8bae..8dbef870 100644
--- a/4.x/_gen/resources/network_connectivity_hub.libsonnet
+++ b/4.x/_gen/resources/network_connectivity_hub.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='network_connectivity_hub', url='', help='`network_connectivity_hub` represents the `google_network_connectivity_hub` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.network_connectivity_hub.new` injects a new `google_network_connectivity_hub` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_connectivity_hub.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_connectivity_hub` using the reference:\n\n    $._ref.google_network_connectivity_hub.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_connectivity_hub.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of the hub. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements). When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Immutable. The name of the hub. Hub names must be unique. They use the following form: `projects/{project_number}/locations/global/hubs/{hub_id}`\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_hub.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.network_connectivity_hub.new` injects a new `google_network_connectivity_hub` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_connectivity_hub.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_connectivity_hub` using the reference:\n\n    $._ref.google_network_connectivity_hub.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_connectivity_hub.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of the hub. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements).\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Immutable. The name of the hub. Hub names must be unique. They use the following form: `projects/{project_number}/locations/global/hubs/{hub_id}`\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_hub.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -23,7 +23,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.network_connectivity_hub.newAttrs` constructs a new object with attributes and blocks configured for the `network_connectivity_hub`\nTerraform resource.\n\nUnlike [google.network_connectivity_hub.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of the hub. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements). When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Immutable. The name of the hub. Hub names must be unique. They use the following form: `projects/{project_number}/locations/global/hubs/{hub_id}`\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_hub.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_connectivity_hub` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.network_connectivity_hub.newAttrs` constructs a new object with attributes and blocks configured for the `network_connectivity_hub`\nTerraform resource.\n\nUnlike [google.network_connectivity_hub.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of the hub. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements).\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Immutable. The name of the hub. Hub names must be unique. They use the following form: `projects/{project_number}/locations/global/hubs/{hub_id}`\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_hub.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_connectivity_hub` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     description=null,
diff --git a/4.x/_gen/resources/network_connectivity_policy_based_route.libsonnet b/4.x/_gen/resources/network_connectivity_policy_based_route.libsonnet
new file mode 100644
index 00000000..278962e8
--- /dev/null
+++ b/4.x/_gen/resources/network_connectivity_policy_based_route.libsonnet
@@ -0,0 +1,268 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='network_connectivity_policy_based_route', url='', help='`network_connectivity_policy_based_route` represents the `google_network_connectivity_policy_based_route` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  filter:: {
+    '#new':: d.fn(help='\n`google.network_connectivity_policy_based_route.filter.new` constructs a new object with attributes and blocks configured for the `filter`\nTerraform sub block.\n\n\n\n**Args**:\n  - `dest_range` (`string`): The destination IP range of outgoing packets that this policy-based route applies to. Default is "0.0.0.0/0" if protocol version is IPv4. When `null`, the `dest_range` field will be omitted from the resulting object.\n  - `ip_protocol` (`string`): The IP protocol that this policy-based route applies to. Valid values are 'TCP', 'UDP', and 'ALL'. Default is 'ALL'. When `null`, the `ip_protocol` field will be omitted from the resulting object.\n  - `protocol_version` (`string`): Internet protocol versions this policy-based route applies to. Possible values: ["IPV4"]\n  - `src_range` (`string`): The source IP range of outgoing packets that this policy-based route applies to. Default is "0.0.0.0/0" if protocol version is IPv4. When `null`, the `src_range` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `filter` sub block.\n', args=[]),
+    new(
+      protocol_version,
+      dest_range=null,
+      ip_protocol=null,
+      src_range=null
+    ):: std.prune(a={
+      dest_range: dest_range,
+      ip_protocol: ip_protocol,
+      protocol_version: protocol_version,
+      src_range: src_range,
+    }),
+  },
+  interconnect_attachment:: {
+    '#new':: d.fn(help='\n`google.network_connectivity_policy_based_route.interconnect_attachment.new` constructs a new object with attributes and blocks configured for the `interconnect_attachment`\nTerraform sub block.\n\n\n\n**Args**:\n  - `region` (`string`): Cloud region to install this policy-based route on for Interconnect attachments. Use 'all' to install it on all Interconnect attachments.\n\n**Returns**:\n  - An attribute object that represents the `interconnect_attachment` sub block.\n', args=[]),
+    new(
+      region
+    ):: std.prune(a={
+      region: region,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.network_connectivity_policy_based_route.new` injects a new `google_network_connectivity_policy_based_route` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_connectivity_policy_based_route.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_connectivity_policy_based_route` using the reference:\n\n    $._ref.google_network_connectivity_policy_based_route.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_connectivity_policy_based_route.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the policy based route.\n  - `network` (`string`): Fully-qualified URL of the network that this route applies to, for example: projects/my-project/global/networks/my-network.\n  - `next_hop_ilb_ip` (`string`): The IP address of a global-access-enabled L4 ILB that is the next hop for matching packets. When `null`, the `next_hop_ilb_ip` field will be omitted from the resulting object.\n  - `next_hop_other_routes` (`string`): Other routes that will be referenced to determine the next hop of the packet. Possible values: [\u0026#34;DEFAULT_ROUTING\u0026#34;] When `null`, the `next_hop_other_routes` field will be omitted from the resulting object.\n  - `priority` (`number`): The priority of this policy-based route. Priority is used to break ties in cases where there are more than one matching policy-based routes found. In cases where multiple policy-based routes are matched, the one with the lowest-numbered priority value wins. The default value is 1000. The priority value must be from 1 to 65535, inclusive. When `null`, the `priority` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `filter` (`list[obj]`): The filter to match L4 traffic. When `null`, the `filter` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_policy_based_route.filter.new](#fn-filternew) constructor.\n  - `interconnect_attachment` (`list[obj]`): The interconnect attachments that this policy-based route applies to. When `null`, the `interconnect_attachment` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_policy_based_route.interconnect_attachment.new](#fn-interconnect_attachmentnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_policy_based_route.timeouts.new](#fn-timeoutsnew) constructor.\n  - `virtual_machine` (`list[obj]`): VM instances to which this policy-based route applies to. When `null`, the `virtual_machine` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_policy_based_route.virtual_machine.new](#fn-virtual_machinenew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    name,
+    network,
+    description=null,
+    filter=null,
+    interconnect_attachment=null,
+    labels=null,
+    next_hop_ilb_ip=null,
+    next_hop_other_routes=null,
+    priority=null,
+    project=null,
+    timeouts=null,
+    virtual_machine=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_network_connectivity_policy_based_route',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      description=description,
+      filter=filter,
+      interconnect_attachment=interconnect_attachment,
+      labels=labels,
+      name=name,
+      network=network,
+      next_hop_ilb_ip=next_hop_ilb_ip,
+      next_hop_other_routes=next_hop_other_routes,
+      priority=priority,
+      project=project,
+      timeouts=timeouts,
+      virtual_machine=virtual_machine
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.network_connectivity_policy_based_route.newAttrs` constructs a new object with attributes and blocks configured for the `network_connectivity_policy_based_route`\nTerraform resource.\n\nUnlike [google.network_connectivity_policy_based_route.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the policy based route.\n  - `network` (`string`): Fully-qualified URL of the network that this route applies to, for example: projects/my-project/global/networks/my-network.\n  - `next_hop_ilb_ip` (`string`): The IP address of a global-access-enabled L4 ILB that is the next hop for matching packets. When `null`, the `next_hop_ilb_ip` field will be omitted from the resulting object.\n  - `next_hop_other_routes` (`string`): Other routes that will be referenced to determine the next hop of the packet. Possible values: ["DEFAULT_ROUTING"] When `null`, the `next_hop_other_routes` field will be omitted from the resulting object.\n  - `priority` (`number`): The priority of this policy-based route. Priority is used to break ties in cases where there are more than one matching policy-based routes found. In cases where multiple policy-based routes are matched, the one with the lowest-numbered priority value wins. The default value is 1000. The priority value must be from 1 to 65535, inclusive. When `null`, the `priority` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `filter` (`list[obj]`): The filter to match L4 traffic. When `null`, the `filter` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_policy_based_route.filter.new](#fn-filternew) constructor.\n  - `interconnect_attachment` (`list[obj]`): The interconnect attachments that this policy-based route applies to. When `null`, the `interconnect_attachment` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_policy_based_route.interconnect_attachment.new](#fn-interconnect_attachmentnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_policy_based_route.timeouts.new](#fn-timeoutsnew) constructor.\n  - `virtual_machine` (`list[obj]`): VM instances to which this policy-based route applies to. When `null`, the `virtual_machine` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_policy_based_route.virtual_machine.new](#fn-virtual_machinenew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_connectivity_policy_based_route` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    name,
+    network,
+    description=null,
+    filter=null,
+    interconnect_attachment=null,
+    labels=null,
+    next_hop_ilb_ip=null,
+    next_hop_other_routes=null,
+    priority=null,
+    project=null,
+    timeouts=null,
+    virtual_machine=null
+  ):: std.prune(a={
+    description: description,
+    filter: filter,
+    interconnect_attachment: interconnect_attachment,
+    labels: labels,
+    name: name,
+    network: network,
+    next_hop_ilb_ip: next_hop_ilb_ip,
+    next_hop_other_routes: next_hop_other_routes,
+    priority: priority,
+    project: project,
+    timeouts: timeouts,
+    virtual_machine: virtual_machine,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.network_connectivity_policy_based_route.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+    }),
+  },
+  virtual_machine:: {
+    '#new':: d.fn(help='\n`google.network_connectivity_policy_based_route.virtual_machine.new` constructs a new object with attributes and blocks configured for the `virtual_machine`\nTerraform sub block.\n\n\n\n**Args**:\n  - `tags` (`list`): A list of VM instance tags that this policy-based route applies to. VM instances that have ANY of tags specified here will install this PBR.\n\n**Returns**:\n  - An attribute object that represents the `virtual_machine` sub block.\n', args=[]),
+    new(
+      tags
+    ):: std.prune(a={
+      tags: tags,
+    }),
+  },
+  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
+  withDescription(resourceLabel, value): {
+    resource+: {
+      google_network_connectivity_policy_based_route+: {
+        [resourceLabel]+: {
+          description: value,
+        },
+      },
+    },
+  },
+  '#withFilter':: d.fn(help='`google.list[obj].withFilter` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the filter field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withFilterMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `filter` field.\n', args=[]),
+  withFilter(resourceLabel, value): {
+    resource+: {
+      google_network_connectivity_policy_based_route+: {
+        [resourceLabel]+: {
+          filter: value,
+        },
+      },
+    },
+  },
+  '#withFilterMixin':: d.fn(help='`google.list[obj].withFilterMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the filter field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withFilter](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `filter` field.\n', args=[]),
+  withFilterMixin(resourceLabel, value): {
+    resource+: {
+      google_network_connectivity_policy_based_route+: {
+        [resourceLabel]+: {
+          filter+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withInterconnectAttachment':: d.fn(help='`google.list[obj].withInterconnectAttachment` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the interconnect_attachment field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withInterconnectAttachmentMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `interconnect_attachment` field.\n', args=[]),
+  withInterconnectAttachment(resourceLabel, value): {
+    resource+: {
+      google_network_connectivity_policy_based_route+: {
+        [resourceLabel]+: {
+          interconnect_attachment: value,
+        },
+      },
+    },
+  },
+  '#withInterconnectAttachmentMixin':: d.fn(help='`google.list[obj].withInterconnectAttachmentMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the interconnect_attachment field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withInterconnectAttachment](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `interconnect_attachment` field.\n', args=[]),
+  withInterconnectAttachmentMixin(resourceLabel, value): {
+    resource+: {
+      google_network_connectivity_policy_based_route+: {
+        [resourceLabel]+: {
+          interconnect_attachment+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withLabels':: d.fn(help='`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the labels field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `labels` field.\n', args=[]),
+  withLabels(resourceLabel, value): {
+    resource+: {
+      google_network_connectivity_policy_based_route+: {
+        [resourceLabel]+: {
+          labels: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_network_connectivity_policy_based_route+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withNetwork':: d.fn(help='`google.string.withNetwork` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the network field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `network` field.\n', args=[]),
+  withNetwork(resourceLabel, value): {
+    resource+: {
+      google_network_connectivity_policy_based_route+: {
+        [resourceLabel]+: {
+          network: value,
+        },
+      },
+    },
+  },
+  '#withNextHopIlbIp':: d.fn(help='`google.string.withNextHopIlbIp` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the next_hop_ilb_ip field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `next_hop_ilb_ip` field.\n', args=[]),
+  withNextHopIlbIp(resourceLabel, value): {
+    resource+: {
+      google_network_connectivity_policy_based_route+: {
+        [resourceLabel]+: {
+          next_hop_ilb_ip: value,
+        },
+      },
+    },
+  },
+  '#withNextHopOtherRoutes':: d.fn(help='`google.string.withNextHopOtherRoutes` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the next_hop_other_routes field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `next_hop_other_routes` field.\n', args=[]),
+  withNextHopOtherRoutes(resourceLabel, value): {
+    resource+: {
+      google_network_connectivity_policy_based_route+: {
+        [resourceLabel]+: {
+          next_hop_other_routes: value,
+        },
+      },
+    },
+  },
+  '#withPriority':: d.fn(help='`google.number.withPriority` constructs a mixin object that can be merged into the `number`\nTerraform resource block to set or update the priority field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`number`): The value to set for the `priority` field.\n', args=[]),
+  withPriority(resourceLabel, value): {
+    resource+: {
+      google_network_connectivity_policy_based_route+: {
+        [resourceLabel]+: {
+          priority: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_network_connectivity_policy_based_route+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_network_connectivity_policy_based_route+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_network_connectivity_policy_based_route+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+  '#withVirtualMachine':: d.fn(help='`google.list[obj].withVirtualMachine` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the virtual_machine field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withVirtualMachineMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `virtual_machine` field.\n', args=[]),
+  withVirtualMachine(resourceLabel, value): {
+    resource+: {
+      google_network_connectivity_policy_based_route+: {
+        [resourceLabel]+: {
+          virtual_machine: value,
+        },
+      },
+    },
+  },
+  '#withVirtualMachineMixin':: d.fn(help='`google.list[obj].withVirtualMachineMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the virtual_machine field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withVirtualMachine](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `virtual_machine` field.\n', args=[]),
+  withVirtualMachineMixin(resourceLabel, value): {
+    resource+: {
+      google_network_connectivity_policy_based_route+: {
+        [resourceLabel]+: {
+          virtual_machine+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/network_connectivity_service_connection_policy.libsonnet b/4.x/_gen/resources/network_connectivity_service_connection_policy.libsonnet
index fb081074..97963a14 100644
--- a/4.x/_gen/resources/network_connectivity_service_connection_policy.libsonnet
+++ b/4.x/_gen/resources/network_connectivity_service_connection_policy.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='network_connectivity_service_connection_policy', url='', help='`network_connectivity_service_connection_policy` represents the `google_network_connectivity_service_connection_policy` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.network_connectivity_service_connection_policy.new` injects a new `google_network_connectivity_service_connection_policy` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_connectivity_service_connection_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_connectivity_service_connection_policy` using the reference:\n\n    $._ref.google_network_connectivity_service_connection_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_connectivity_service_connection_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Free-text description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the ServiceConnectionPolicy.\n  - `name` (`string`): The name of a ServiceConnectionPolicy. Format: projects/{project}/locations/{location}/serviceConnectionPolicies/{service_connection_policy} See: https://google.aip.dev/122#fields-representing-resource-names\n  - `network` (`string`): The resource path of the consumer network. Example: - projects/{projectNumOrId}/global/networks/{resourceId}.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `service_class` (`string`): The service class identifier for which this ServiceConnectionPolicy is for. The service class identifier is a unique, symbolic representation of a ServiceClass.\nIt is provided by the Service Producer. Google services have a prefix of gcp. For example, gcp-cloud-sql. 3rd party services do not. For example, test-service-a3dfcx.\n  - `psc_config` (`list[obj]`): Configuration used for Private Service Connect connections. Used when Infrastructure is PSC. When `null`, the `psc_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_service_connection_policy.psc_config.new](#fn-psc_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_service_connection_policy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.network_connectivity_service_connection_policy.new` injects a new `google_network_connectivity_service_connection_policy` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_connectivity_service_connection_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_connectivity_service_connection_policy` using the reference:\n\n    $._ref.google_network_connectivity_service_connection_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_connectivity_service_connection_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Free-text description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the ServiceConnectionPolicy.\n  - `name` (`string`): The name of a ServiceConnectionPolicy. Format: projects/{project}/locations/{location}/serviceConnectionPolicies/{service_connection_policy} See: https://google.aip.dev/122#fields-representing-resource-names\n  - `network` (`string`): The resource path of the consumer network. Example: - projects/{projectNumOrId}/global/networks/{resourceId}.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `service_class` (`string`): The service class identifier for which this ServiceConnectionPolicy is for. The service class identifier is a unique, symbolic representation of a ServiceClass.\nIt is provided by the Service Producer. Google services have a prefix of gcp. For example, gcp-cloud-sql. 3rd party services do not. For example, test-service-a3dfcx.\n  - `psc_config` (`list[obj]`): Configuration used for Private Service Connect connections. Used when Infrastructure is PSC. When `null`, the `psc_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_service_connection_policy.psc_config.new](#fn-psc_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_service_connection_policy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -31,7 +31,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.network_connectivity_service_connection_policy.newAttrs` constructs a new object with attributes and blocks configured for the `network_connectivity_service_connection_policy`\nTerraform resource.\n\nUnlike [google.network_connectivity_service_connection_policy.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Free-text description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the ServiceConnectionPolicy.\n  - `name` (`string`): The name of a ServiceConnectionPolicy. Format: projects/{project}/locations/{location}/serviceConnectionPolicies/{service_connection_policy} See: https://google.aip.dev/122#fields-representing-resource-names\n  - `network` (`string`): The resource path of the consumer network. Example: - projects/{projectNumOrId}/global/networks/{resourceId}.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `service_class` (`string`): The service class identifier for which this ServiceConnectionPolicy is for. The service class identifier is a unique, symbolic representation of a ServiceClass.\nIt is provided by the Service Producer. Google services have a prefix of gcp. For example, gcp-cloud-sql. 3rd party services do not. For example, test-service-a3dfcx.\n  - `psc_config` (`list[obj]`): Configuration used for Private Service Connect connections. Used when Infrastructure is PSC. When `null`, the `psc_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_service_connection_policy.psc_config.new](#fn-psc_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_service_connection_policy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_connectivity_service_connection_policy` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.network_connectivity_service_connection_policy.newAttrs` constructs a new object with attributes and blocks configured for the `network_connectivity_service_connection_policy`\nTerraform resource.\n\nUnlike [google.network_connectivity_service_connection_policy.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Free-text description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): User-defined labels.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the ServiceConnectionPolicy.\n  - `name` (`string`): The name of a ServiceConnectionPolicy. Format: projects/{project}/locations/{location}/serviceConnectionPolicies/{service_connection_policy} See: https://google.aip.dev/122#fields-representing-resource-names\n  - `network` (`string`): The resource path of the consumer network. Example: - projects/{projectNumOrId}/global/networks/{resourceId}.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `service_class` (`string`): The service class identifier for which this ServiceConnectionPolicy is for. The service class identifier is a unique, symbolic representation of a ServiceClass.\nIt is provided by the Service Producer. Google services have a prefix of gcp. For example, gcp-cloud-sql. 3rd party services do not. For example, test-service-a3dfcx.\n  - `psc_config` (`list[obj]`): Configuration used for Private Service Connect connections. Used when Infrastructure is PSC. When `null`, the `psc_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_service_connection_policy.psc_config.new](#fn-psc_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_service_connection_policy.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_connectivity_service_connection_policy` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     name,
diff --git a/4.x/_gen/resources/network_connectivity_spoke.libsonnet b/4.x/_gen/resources/network_connectivity_spoke.libsonnet
index 24110b39..118c2ccd 100644
--- a/4.x/_gen/resources/network_connectivity_spoke.libsonnet
+++ b/4.x/_gen/resources/network_connectivity_spoke.libsonnet
@@ -52,7 +52,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       uris: uris,
     }),
   },
-  '#new':: d.fn(help="\n`google.network_connectivity_spoke.new` injects a new `google_network_connectivity_spoke` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_connectivity_spoke.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_connectivity_spoke` using the reference:\n\n    $._ref.google_network_connectivity_spoke.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_connectivity_spoke.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of the spoke. When `null`, the `description` field will be omitted from the resulting object.\n  - `hub` (`string`): Immutable. The URI of the hub that this spoke is attached to.\n  - `labels` (`obj`): Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements). When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Immutable. The name of the spoke. Spoke names must be unique.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `linked_interconnect_attachments` (`list[obj]`): A collection of VLAN attachment resources. These resources should be redundant attachments that all advertise the same prefixes to Google Cloud. Alternatively, in active/passive configurations, all attachments should be capable of advertising the same prefixes. When `null`, the `linked_interconnect_attachments` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.linked_interconnect_attachments.new](#fn-linked_interconnect_attachmentsnew) constructor.\n  - `linked_router_appliance_instances` (`list[obj]`): The URIs of linked Router appliance resources When `null`, the `linked_router_appliance_instances` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.linked_router_appliance_instances.new](#fn-linked_router_appliance_instancesnew) constructor.\n  - `linked_vpc_network` (`list[obj]`): VPC network that is associated with the spoke. When `null`, the `linked_vpc_network` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.linked_vpc_network.new](#fn-linked_vpc_networknew) constructor.\n  - `linked_vpn_tunnels` (`list[obj]`): The URIs of linked VPN tunnel resources When `null`, the `linked_vpn_tunnels` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.linked_vpn_tunnels.new](#fn-linked_vpn_tunnelsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.network_connectivity_spoke.new` injects a new `google_network_connectivity_spoke` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_connectivity_spoke.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_connectivity_spoke` using the reference:\n\n    $._ref.google_network_connectivity_spoke.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_connectivity_spoke.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): An optional description of the spoke. When `null`, the `description` field will be omitted from the resulting object.\n  - `hub` (`string`): Immutable. The URI of the hub that this spoke is attached to.\n  - `labels` (`obj`): Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements).\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Immutable. The name of the spoke. Spoke names must be unique.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `linked_interconnect_attachments` (`list[obj]`): A collection of VLAN attachment resources. These resources should be redundant attachments that all advertise the same prefixes to Google Cloud. Alternatively, in active/passive configurations, all attachments should be capable of advertising the same prefixes. When `null`, the `linked_interconnect_attachments` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.linked_interconnect_attachments.new](#fn-linked_interconnect_attachmentsnew) constructor.\n  - `linked_router_appliance_instances` (`list[obj]`): The URIs of linked Router appliance resources When `null`, the `linked_router_appliance_instances` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.linked_router_appliance_instances.new](#fn-linked_router_appliance_instancesnew) constructor.\n  - `linked_vpc_network` (`list[obj]`): VPC network that is associated with the spoke. When `null`, the `linked_vpc_network` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.linked_vpc_network.new](#fn-linked_vpc_networknew) constructor.\n  - `linked_vpn_tunnels` (`list[obj]`): The URIs of linked VPN tunnel resources When `null`, the `linked_vpn_tunnels` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.linked_vpn_tunnels.new](#fn-linked_vpn_tunnelsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     hub,
@@ -85,7 +85,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.network_connectivity_spoke.newAttrs` constructs a new object with attributes and blocks configured for the `network_connectivity_spoke`\nTerraform resource.\n\nUnlike [google.network_connectivity_spoke.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of the spoke. When `null`, the `description` field will be omitted from the resulting object.\n  - `hub` (`string`): Immutable. The URI of the hub that this spoke is attached to.\n  - `labels` (`obj`): Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements). When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Immutable. The name of the spoke. Spoke names must be unique.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `linked_interconnect_attachments` (`list[obj]`): A collection of VLAN attachment resources. These resources should be redundant attachments that all advertise the same prefixes to Google Cloud. Alternatively, in active/passive configurations, all attachments should be capable of advertising the same prefixes. When `null`, the `linked_interconnect_attachments` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.linked_interconnect_attachments.new](#fn-linked_interconnect_attachmentsnew) constructor.\n  - `linked_router_appliance_instances` (`list[obj]`): The URIs of linked Router appliance resources When `null`, the `linked_router_appliance_instances` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.linked_router_appliance_instances.new](#fn-linked_router_appliance_instancesnew) constructor.\n  - `linked_vpc_network` (`list[obj]`): VPC network that is associated with the spoke. When `null`, the `linked_vpc_network` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.linked_vpc_network.new](#fn-linked_vpc_networknew) constructor.\n  - `linked_vpn_tunnels` (`list[obj]`): The URIs of linked VPN tunnel resources When `null`, the `linked_vpn_tunnels` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.linked_vpn_tunnels.new](#fn-linked_vpn_tunnelsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_connectivity_spoke` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.network_connectivity_spoke.newAttrs` constructs a new object with attributes and blocks configured for the `network_connectivity_spoke`\nTerraform resource.\n\nUnlike [google.network_connectivity_spoke.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): An optional description of the spoke. When `null`, the `description` field will be omitted from the resulting object.\n  - `hub` (`string`): Immutable. The URI of the hub that this spoke is attached to.\n  - `labels` (`obj`): Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements).\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): Immutable. The name of the spoke. Spoke names must be unique.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `linked_interconnect_attachments` (`list[obj]`): A collection of VLAN attachment resources. These resources should be redundant attachments that all advertise the same prefixes to Google Cloud. Alternatively, in active/passive configurations, all attachments should be capable of advertising the same prefixes. When `null`, the `linked_interconnect_attachments` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.linked_interconnect_attachments.new](#fn-linked_interconnect_attachmentsnew) constructor.\n  - `linked_router_appliance_instances` (`list[obj]`): The URIs of linked Router appliance resources When `null`, the `linked_router_appliance_instances` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.linked_router_appliance_instances.new](#fn-linked_router_appliance_instancesnew) constructor.\n  - `linked_vpc_network` (`list[obj]`): VPC network that is associated with the spoke. When `null`, the `linked_vpc_network` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.linked_vpc_network.new](#fn-linked_vpc_networknew) constructor.\n  - `linked_vpn_tunnels` (`list[obj]`): The URIs of linked VPN tunnel resources When `null`, the `linked_vpn_tunnels` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.linked_vpn_tunnels.new](#fn-linked_vpn_tunnelsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_spoke.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_connectivity_spoke` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     hub,
     location,
diff --git a/4.x/_gen/resources/network_management_connectivity_test.libsonnet b/4.x/_gen/resources/network_management_connectivity_test.libsonnet
index edcef286..2e777f26 100644
--- a/4.x/_gen/resources/network_management_connectivity_test.libsonnet
+++ b/4.x/_gen/resources/network_management_connectivity_test.libsonnet
@@ -18,7 +18,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       project_id: project_id,
     }),
   },
-  '#new':: d.fn(help="\n`google.network_management_connectivity_test.new` injects a new `google_network_management_connectivity_test` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_management_connectivity_test.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_management_connectivity_test` using the reference:\n\n    $._ref.google_network_management_connectivity_test.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_management_connectivity_test.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): The user-supplied description of the Connectivity Test.\nMaximum of 512 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Unique name for the connectivity test.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `protocol` (`string`): IP Protocol of the test. When not provided, \u0026#34;TCP\u0026#34; is assumed. When `null`, the `protocol` field will be omitted from the resulting object.\n  - `related_projects` (`list`): Other projects that may be relevant for reachability analysis.\nThis is applicable to scenarios where a test can cross project\nboundaries. When `null`, the `related_projects` field will be omitted from the resulting object.\n  - `destination` (`list[obj]`): Required. Destination specification of the Connectivity Test.\n\nYou can use a combination of destination IP address, Compute\nEngine VM instance, or VPC network to uniquely identify the\ndestination location.\n\nEven if the destination IP address is not unique, the source IP\nlocation is unique. Usually, the analysis can infer the destination\nendpoint from route information.\n\nIf the destination you specify is a VM instance and the instance has\nmultiple network interfaces, then you must also specify either a\ndestination IP address or VPC network to identify the destination\ninterface.\n\nA reachability analysis proceeds even if the destination location\nis ambiguous. However, the result can include endpoints that you\ndon\u0026#39;t intend to test. When `null`, the `destination` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_management_connectivity_test.destination.new](#fn-destinationnew) constructor.\n  - `source` (`list[obj]`): Required. Source specification of the Connectivity Test.\n\nYou can use a combination of source IP address, virtual machine\n(VM) instance, or Compute Engine network to uniquely identify the\nsource location.\n\nExamples: If the source IP address is an internal IP address within\na Google Cloud Virtual Private Cloud (VPC) network, then you must\nalso specify the VPC network. Otherwise, specify the VM instance,\nwhich already contains its internal IP address and VPC network\ninformation.\n\nIf the source of the test is within an on-premises network, then\nyou must provide the destination VPC network.\n\nIf the source endpoint is a Compute Engine VM instance with multiple\nnetwork interfaces, the instance itself is not sufficient to\nidentify the endpoint. So, you must also specify the source IP\naddress or VPC network.\n\nA reachability analysis proceeds even if the source location is\nambiguous. However, the test result may include endpoints that\nyou don\u0026#39;t intend to test. When `null`, the `source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_management_connectivity_test.source.new](#fn-sourcenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_management_connectivity_test.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.network_management_connectivity_test.new` injects a new `google_network_management_connectivity_test` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_management_connectivity_test.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_management_connectivity_test` using the reference:\n\n    $._ref.google_network_management_connectivity_test.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_management_connectivity_test.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): The user-supplied description of the Connectivity Test.\nMaximum of 512 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Unique name for the connectivity test.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `protocol` (`string`): IP Protocol of the test. When not provided, \u0026#34;TCP\u0026#34; is assumed. When `null`, the `protocol` field will be omitted from the resulting object.\n  - `related_projects` (`list`): Other projects that may be relevant for reachability analysis.\nThis is applicable to scenarios where a test can cross project\nboundaries. When `null`, the `related_projects` field will be omitted from the resulting object.\n  - `destination` (`list[obj]`): Required. Destination specification of the Connectivity Test.\n\nYou can use a combination of destination IP address, Compute\nEngine VM instance, or VPC network to uniquely identify the\ndestination location.\n\nEven if the destination IP address is not unique, the source IP\nlocation is unique. Usually, the analysis can infer the destination\nendpoint from route information.\n\nIf the destination you specify is a VM instance and the instance has\nmultiple network interfaces, then you must also specify either a\ndestination IP address or VPC network to identify the destination\ninterface.\n\nA reachability analysis proceeds even if the destination location\nis ambiguous. However, the result can include endpoints that you\ndon\u0026#39;t intend to test. When `null`, the `destination` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_management_connectivity_test.destination.new](#fn-destinationnew) constructor.\n  - `source` (`list[obj]`): Required. Source specification of the Connectivity Test.\n\nYou can use a combination of source IP address, virtual machine\n(VM) instance, or Compute Engine network to uniquely identify the\nsource location.\n\nExamples: If the source IP address is an internal IP address within\na Google Cloud Virtual Private Cloud (VPC) network, then you must\nalso specify the VPC network. Otherwise, specify the VM instance,\nwhich already contains its internal IP address and VPC network\ninformation.\n\nIf the source of the test is within an on-premises network, then\nyou must provide the destination VPC network.\n\nIf the source endpoint is a Compute Engine VM instance with multiple\nnetwork interfaces, the instance itself is not sufficient to\nidentify the endpoint. So, you must also specify the source IP\naddress or VPC network.\n\nA reachability analysis proceeds even if the source location is\nambiguous. However, the test result may include endpoints that\nyou don\u0026#39;t intend to test. When `null`, the `source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_management_connectivity_test.source.new](#fn-sourcenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_management_connectivity_test.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -47,7 +47,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.network_management_connectivity_test.newAttrs` constructs a new object with attributes and blocks configured for the `network_management_connectivity_test`\nTerraform resource.\n\nUnlike [google.network_management_connectivity_test.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): The user-supplied description of the Connectivity Test.\nMaximum of 512 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Unique name for the connectivity test.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `protocol` (`string`): IP Protocol of the test. When not provided, "TCP" is assumed. When `null`, the `protocol` field will be omitted from the resulting object.\n  - `related_projects` (`list`): Other projects that may be relevant for reachability analysis.\nThis is applicable to scenarios where a test can cross project\nboundaries. When `null`, the `related_projects` field will be omitted from the resulting object.\n  - `destination` (`list[obj]`): Required. Destination specification of the Connectivity Test.\n\nYou can use a combination of destination IP address, Compute\nEngine VM instance, or VPC network to uniquely identify the\ndestination location.\n\nEven if the destination IP address is not unique, the source IP\nlocation is unique. Usually, the analysis can infer the destination\nendpoint from route information.\n\nIf the destination you specify is a VM instance and the instance has\nmultiple network interfaces, then you must also specify either a\ndestination IP address or VPC network to identify the destination\ninterface.\n\nA reachability analysis proceeds even if the destination location\nis ambiguous. However, the result can include endpoints that you\ndon't intend to test. When `null`, the `destination` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_management_connectivity_test.destination.new](#fn-destinationnew) constructor.\n  - `source` (`list[obj]`): Required. Source specification of the Connectivity Test.\n\nYou can use a combination of source IP address, virtual machine\n(VM) instance, or Compute Engine network to uniquely identify the\nsource location.\n\nExamples: If the source IP address is an internal IP address within\na Google Cloud Virtual Private Cloud (VPC) network, then you must\nalso specify the VPC network. Otherwise, specify the VM instance,\nwhich already contains its internal IP address and VPC network\ninformation.\n\nIf the source of the test is within an on-premises network, then\nyou must provide the destination VPC network.\n\nIf the source endpoint is a Compute Engine VM instance with multiple\nnetwork interfaces, the instance itself is not sufficient to\nidentify the endpoint. So, you must also specify the source IP\naddress or VPC network.\n\nA reachability analysis proceeds even if the source location is\nambiguous. However, the test result may include endpoints that\nyou don't intend to test. When `null`, the `source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_management_connectivity_test.source.new](#fn-sourcenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_management_connectivity_test.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_management_connectivity_test` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.network_management_connectivity_test.newAttrs` constructs a new object with attributes and blocks configured for the `network_management_connectivity_test`\nTerraform resource.\n\nUnlike [google.network_management_connectivity_test.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): The user-supplied description of the Connectivity Test.\nMaximum of 512 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user-provided metadata.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Unique name for the connectivity test.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `protocol` (`string`): IP Protocol of the test. When not provided, "TCP" is assumed. When `null`, the `protocol` field will be omitted from the resulting object.\n  - `related_projects` (`list`): Other projects that may be relevant for reachability analysis.\nThis is applicable to scenarios where a test can cross project\nboundaries. When `null`, the `related_projects` field will be omitted from the resulting object.\n  - `destination` (`list[obj]`): Required. Destination specification of the Connectivity Test.\n\nYou can use a combination of destination IP address, Compute\nEngine VM instance, or VPC network to uniquely identify the\ndestination location.\n\nEven if the destination IP address is not unique, the source IP\nlocation is unique. Usually, the analysis can infer the destination\nendpoint from route information.\n\nIf the destination you specify is a VM instance and the instance has\nmultiple network interfaces, then you must also specify either a\ndestination IP address or VPC network to identify the destination\ninterface.\n\nA reachability analysis proceeds even if the destination location\nis ambiguous. However, the result can include endpoints that you\ndon't intend to test. When `null`, the `destination` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_management_connectivity_test.destination.new](#fn-destinationnew) constructor.\n  - `source` (`list[obj]`): Required. Source specification of the Connectivity Test.\n\nYou can use a combination of source IP address, virtual machine\n(VM) instance, or Compute Engine network to uniquely identify the\nsource location.\n\nExamples: If the source IP address is an internal IP address within\na Google Cloud Virtual Private Cloud (VPC) network, then you must\nalso specify the VPC network. Otherwise, specify the VM instance,\nwhich already contains its internal IP address and VPC network\ninformation.\n\nIf the source of the test is within an on-premises network, then\nyou must provide the destination VPC network.\n\nIf the source endpoint is a Compute Engine VM instance with multiple\nnetwork interfaces, the instance itself is not sufficient to\nidentify the endpoint. So, you must also specify the source IP\naddress or VPC network.\n\nA reachability analysis proceeds even if the source location is\nambiguous. However, the test result may include endpoints that\nyou don't intend to test. When `null`, the `source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_management_connectivity_test.source.new](#fn-sourcenew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_management_connectivity_test.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_management_connectivity_test` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     description=null,
diff --git a/4.x/_gen/resources/network_security_address_group.libsonnet b/4.x/_gen/resources/network_security_address_group.libsonnet
index 070a1cd3..576fa8e8 100644
--- a/4.x/_gen/resources/network_security_address_group.libsonnet
+++ b/4.x/_gen/resources/network_security_address_group.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='network_security_address_group', url='', help='`network_security_address_group` represents the `google_network_security_address_group` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.network_security_address_group.new` injects a new `google_network_security_address_group` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_security_address_group.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_security_address_group` using the reference:\n\n    $._ref.google_network_security_address_group.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_security_address_group.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `capacity` (`number`): Capacity of the Address Group.\n  - `description` (`string`): Free-text description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `items` (`list`): List of items. When `null`, the `items` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the AddressGroup resource.\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the gateway security policy.\nThe default value is \u0026#39;global\u0026#39;.\n  - `name` (`string`): Name of the AddressGroup resource.\n  - `parent` (`string`): The name of the parent this address group belongs to. Format: organizations/{organization_id} or projects/{project_id}. When `null`, the `parent` field will be omitted from the resulting object.\n  - `type` (`string`): The type of the Address Group. Possible values are \u0026#34;IPV4\u0026#34; or \u0026#34;IPV6\u0026#34;. Possible values: [\u0026#34;IPV4\u0026#34;, \u0026#34;IPV6\u0026#34;]\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_security_address_group.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.network_security_address_group.new` injects a new `google_network_security_address_group` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_security_address_group.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_security_address_group` using the reference:\n\n    $._ref.google_network_security_address_group.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_security_address_group.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `capacity` (`number`): Capacity of the Address Group.\n  - `description` (`string`): Free-text description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `items` (`list`): List of items. When `null`, the `items` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the AddressGroup resource.\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the gateway security policy.\nThe default value is \u0026#39;global\u0026#39;.\n  - `name` (`string`): Name of the AddressGroup resource.\n  - `parent` (`string`): The name of the parent this address group belongs to. Format: organizations/{organization_id} or projects/{project_id}. When `null`, the `parent` field will be omitted from the resulting object.\n  - `type` (`string`): The type of the Address Group. Possible values are \u0026#34;IPV4\u0026#34; or \u0026#34;IPV6\u0026#34;. Possible values: [\u0026#34;IPV4\u0026#34;, \u0026#34;IPV6\u0026#34;]\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_security_address_group.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     capacity,
@@ -31,7 +31,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.network_security_address_group.newAttrs` constructs a new object with attributes and blocks configured for the `network_security_address_group`\nTerraform resource.\n\nUnlike [google.network_security_address_group.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `capacity` (`number`): Capacity of the Address Group.\n  - `description` (`string`): Free-text description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `items` (`list`): List of items. When `null`, the `items` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the AddressGroup resource.\nAn object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the gateway security policy.\nThe default value is 'global'.\n  - `name` (`string`): Name of the AddressGroup resource.\n  - `parent` (`string`): The name of the parent this address group belongs to. Format: organizations/{organization_id} or projects/{project_id}. When `null`, the `parent` field will be omitted from the resulting object.\n  - `type` (`string`): The type of the Address Group. Possible values are "IPV4" or "IPV6". Possible values: ["IPV4", "IPV6"]\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_security_address_group.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_security_address_group` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.network_security_address_group.newAttrs` constructs a new object with attributes and blocks configured for the `network_security_address_group`\nTerraform resource.\n\nUnlike [google.network_security_address_group.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `capacity` (`number`): Capacity of the Address Group.\n  - `description` (`string`): Free-text description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `items` (`list`): List of items. When `null`, the `items` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the AddressGroup resource.\nAn object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the gateway security policy.\nThe default value is 'global'.\n  - `name` (`string`): Name of the AddressGroup resource.\n  - `parent` (`string`): The name of the parent this address group belongs to. Format: organizations/{organization_id} or projects/{project_id}. When `null`, the `parent` field will be omitted from the resulting object.\n  - `type` (`string`): The type of the Address Group. Possible values are "IPV4" or "IPV6". Possible values: ["IPV4", "IPV6"]\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_security_address_group.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_security_address_group` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     capacity,
     location,
diff --git a/4.x/_gen/resources/network_services_edge_cache_keyset.libsonnet b/4.x/_gen/resources/network_services_edge_cache_keyset.libsonnet
index c9d99966..56e4fce7 100644
--- a/4.x/_gen/resources/network_services_edge_cache_keyset.libsonnet
+++ b/4.x/_gen/resources/network_services_edge_cache_keyset.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='network_services_edge_cache_keyset', url='', help='`network_services_edge_cache_keyset` represents the `google_network_services_edge_cache_keyset` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.network_services_edge_cache_keyset.new` injects a new `google_network_services_edge_cache_keyset` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_services_edge_cache_keyset.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_services_edge_cache_keyset` using the reference:\n\n    $._ref.google_network_services_edge_cache_keyset.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_services_edge_cache_keyset.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_key` (`list[obj]`): An ordered list of Ed25519 public keys to use for validating signed requests.\nYou must specify \u0026#39;public_keys\u0026#39; or \u0026#39;validation_shared_keys\u0026#39; (or both). The keys in \u0026#39;public_keys\u0026#39; are checked first.\nYou may specify no more than one Google-managed public key.\nIf you specify \u0026#39;public_keys\u0026#39;, you must specify at least one (1) key and may specify up to three (3) keys.\n\nEd25519 public keys are not secret, and only allow Google to validate a request was signed by your corresponding private key.\nEnsure that the private key is kept secret, and that only authorized users can add public keys to a keyset. When `null`, the `public_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_keyset.public_key.new](#fn-public_keynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_keyset.timeouts.new](#fn-timeoutsnew) constructor.\n  - `validation_shared_keys` (`list[obj]`): An ordered list of shared keys to use for validating signed requests.\nShared keys are secret.  Ensure that only authorized users can add \u0026#39;validation_shared_keys\u0026#39; to a keyset.\nYou can rotate keys by appending (pushing) a new key to the list of \u0026#39;validation_shared_keys\u0026#39; and removing any superseded keys.\nYou must specify \u0026#39;public_keys\u0026#39; or \u0026#39;validation_shared_keys\u0026#39; (or both). The keys in \u0026#39;public_keys\u0026#39; are checked first. When `null`, the `validation_shared_keys` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_keyset.validation_shared_keys.new](#fn-validation_shared_keysnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.network_services_edge_cache_keyset.new` injects a new `google_network_services_edge_cache_keyset` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_services_edge_cache_keyset.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_services_edge_cache_keyset` using the reference:\n\n    $._ref.google_network_services_edge_cache_keyset.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_services_edge_cache_keyset.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_key` (`list[obj]`): An ordered list of Ed25519 public keys to use for validating signed requests.\nYou must specify \u0026#39;public_keys\u0026#39; or \u0026#39;validation_shared_keys\u0026#39; (or both). The keys in \u0026#39;public_keys\u0026#39; are checked first.\nYou may specify no more than one Google-managed public key.\nIf you specify \u0026#39;public_keys\u0026#39;, you must specify at least one (1) key and may specify up to three (3) keys.\n\nEd25519 public keys are not secret, and only allow Google to validate a request was signed by your corresponding private key.\nEnsure that the private key is kept secret, and that only authorized users can add public keys to a keyset. When `null`, the `public_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_keyset.public_key.new](#fn-public_keynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_keyset.timeouts.new](#fn-timeoutsnew) constructor.\n  - `validation_shared_keys` (`list[obj]`): An ordered list of shared keys to use for validating signed requests.\nShared keys are secret.  Ensure that only authorized users can add \u0026#39;validation_shared_keys\u0026#39; to a keyset.\nYou can rotate keys by appending (pushing) a new key to the list of \u0026#39;validation_shared_keys\u0026#39; and removing any superseded keys.\nYou must specify \u0026#39;public_keys\u0026#39; or \u0026#39;validation_shared_keys\u0026#39; (or both). The keys in \u0026#39;public_keys\u0026#39; are checked first. When `null`, the `validation_shared_keys` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_keyset.validation_shared_keys.new](#fn-validation_shared_keysnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -27,7 +27,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.network_services_edge_cache_keyset.newAttrs` constructs a new object with attributes and blocks configured for the `network_services_edge_cache_keyset`\nTerraform resource.\n\nUnlike [google.network_services_edge_cache_keyset.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_key` (`list[obj]`): An ordered list of Ed25519 public keys to use for validating signed requests.\nYou must specify 'public_keys' or 'validation_shared_keys' (or both). The keys in 'public_keys' are checked first.\nYou may specify no more than one Google-managed public key.\nIf you specify 'public_keys', you must specify at least one (1) key and may specify up to three (3) keys.\n\nEd25519 public keys are not secret, and only allow Google to validate a request was signed by your corresponding private key.\nEnsure that the private key is kept secret, and that only authorized users can add public keys to a keyset. When `null`, the `public_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_keyset.public_key.new](#fn-public_keynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_keyset.timeouts.new](#fn-timeoutsnew) constructor.\n  - `validation_shared_keys` (`list[obj]`): An ordered list of shared keys to use for validating signed requests.\nShared keys are secret.  Ensure that only authorized users can add 'validation_shared_keys' to a keyset.\nYou can rotate keys by appending (pushing) a new key to the list of 'validation_shared_keys' and removing any superseded keys.\nYou must specify 'public_keys' or 'validation_shared_keys' (or both). The keys in 'public_keys' are checked first. When `null`, the `validation_shared_keys` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_keyset.validation_shared_keys.new](#fn-validation_shared_keysnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_services_edge_cache_keyset` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.network_services_edge_cache_keyset.newAttrs` constructs a new object with attributes and blocks configured for the `network_services_edge_cache_keyset`\nTerraform resource.\n\nUnlike [google.network_services_edge_cache_keyset.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_key` (`list[obj]`): An ordered list of Ed25519 public keys to use for validating signed requests.\nYou must specify 'public_keys' or 'validation_shared_keys' (or both). The keys in 'public_keys' are checked first.\nYou may specify no more than one Google-managed public key.\nIf you specify 'public_keys', you must specify at least one (1) key and may specify up to three (3) keys.\n\nEd25519 public keys are not secret, and only allow Google to validate a request was signed by your corresponding private key.\nEnsure that the private key is kept secret, and that only authorized users can add public keys to a keyset. When `null`, the `public_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_keyset.public_key.new](#fn-public_keynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_keyset.timeouts.new](#fn-timeoutsnew) constructor.\n  - `validation_shared_keys` (`list[obj]`): An ordered list of shared keys to use for validating signed requests.\nShared keys are secret.  Ensure that only authorized users can add 'validation_shared_keys' to a keyset.\nYou can rotate keys by appending (pushing) a new key to the list of 'validation_shared_keys' and removing any superseded keys.\nYou must specify 'public_keys' or 'validation_shared_keys' (or both). The keys in 'public_keys' are checked first. When `null`, the `validation_shared_keys` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_keyset.validation_shared_keys.new](#fn-validation_shared_keysnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_services_edge_cache_keyset` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     description=null,
diff --git a/4.x/_gen/resources/network_services_edge_cache_origin.libsonnet b/4.x/_gen/resources/network_services_edge_cache_origin.libsonnet
index 654060f3..187f10c2 100644
--- a/4.x/_gen/resources/network_services_edge_cache_origin.libsonnet
+++ b/4.x/_gen/resources/network_services_edge_cache_origin.libsonnet
@@ -14,7 +14,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       secret_access_key_version: secret_access_key_version,
     }),
   },
-  '#new':: d.fn(help="\n`google.network_services_edge_cache_origin.new` injects a new `google_network_services_edge_cache_origin` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_services_edge_cache_origin.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_services_edge_cache_origin` using the reference:\n\n    $._ref.google_network_services_edge_cache_origin.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_services_edge_cache_origin.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `failover_origin` (`string`): The Origin resource to try when the current origin cannot be reached.\nAfter maxAttempts is reached, the configured failoverOrigin will be used to fulfil the request.\n\nThe value of timeout.maxAttemptsTimeout dictates the timeout across all origins.\nA reference to a Topic resource. When `null`, the `failover_origin` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `max_attempts` (`number`): The maximum number of attempts to cache fill from this origin. Another attempt is made when a cache fill fails with one of the retryConditions.\n\nOnce maxAttempts to this origin have failed the failoverOrigin will be used, if one is specified. That failoverOrigin may specify its own maxAttempts,\nretryConditions and failoverOrigin to control its own cache fill failures.\n\nThe total number of allowed attempts to cache fill across this and failover origins is limited to four.\nThe total time allowed for cache fill attempts across this and failover origins can be controlled with maxAttemptsTimeout.\n\nThe last valid, non-retried response from all origins will be returned to the client.\nIf no origin returns a valid response, an HTTP 502 will be returned to the client.\n\nDefaults to 1. Must be a value greater than 0 and less than 4. When `null`, the `max_attempts` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `origin_address` (`string`): A fully qualified domain name (FQDN) or IP address reachable over the public Internet, or the address of a Google Cloud Storage bucket.\n\nThis address will be used as the origin for cache requests - e.g. FQDN: media-backend.example.com, IPv4: 35.218.1.1, IPv6: 2607:f8b0:4012:809::200e, Cloud Storage: gs://bucketname\n\nWhen providing an FQDN (hostname), it must be publicly resolvable (e.g. via Google public DNS) and IP addresses must be publicly routable.  It must not contain a protocol (e.g., https://) and it must not contain any slashes.\nIf a Cloud Storage bucket is provided, it must be in the canonical \u0026#34;gs://bucketname\u0026#34; format. Other forms, such as \u0026#34;storage.googleapis.com\u0026#34;, will be rejected.\n  - `port` (`number`): The port to connect to the origin on.\nDefaults to port 443 for HTTP2 and HTTPS protocols, and port 80 for HTTP. When `null`, the `port` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `protocol` (`string`): The protocol to use to connect to the configured origin. Defaults to HTTP2, and it is strongly recommended that users use HTTP2 for both security \u0026amp; performance.\n\nWhen using HTTP2 or HTTPS as the protocol, a valid, publicly-signed, unexpired TLS (SSL) certificate must be presented by the origin server. Possible values: [\u0026#34;HTTP2\u0026#34;, \u0026#34;HTTPS\u0026#34;, \u0026#34;HTTP\u0026#34;] When `null`, the `protocol` field will be omitted from the resulting object.\n  - `retry_conditions` (`list`): Specifies one or more retry conditions for the configured origin.\n\nIf the failure mode during a connection attempt to the origin matches the configured retryCondition(s),\nthe origin request will be retried up to maxAttempts times. The failoverOrigin, if configured, will then be used to satisfy the request.\n\nThe default retryCondition is \u0026#34;CONNECT_FAILURE\u0026#34;.\n\nretryConditions apply to this origin, and not subsequent failoverOrigin(s),\nwhich may specify their own retryConditions and maxAttempts.\n\nValid values are:\n\n- CONNECT_FAILURE: Retry on failures connecting to origins, for example due to connection timeouts.\n- HTTP_5XX: Retry if the origin responds with any 5xx response code, or if the origin does not respond at all, example: disconnects, reset, read timeout, connection failure, and refused streams.\n- GATEWAY_ERROR: Similar to 5xx, but only applies to response codes 502, 503 or 504.\n- RETRIABLE_4XX: Retry for retriable 4xx response codes, which include HTTP 409 (Conflict) and HTTP 429 (Too Many Requests)\n- NOT_FOUND: Retry if the origin returns a HTTP 404 (Not Found). This can be useful when generating video content, and the segment is not available yet.\n- FORBIDDEN: Retry if the origin returns a HTTP 403 (Forbidden). Possible values: [\u0026#34;CONNECT_FAILURE\u0026#34;, \u0026#34;HTTP_5XX\u0026#34;, \u0026#34;GATEWAY_ERROR\u0026#34;, \u0026#34;RETRIABLE_4XX\u0026#34;, \u0026#34;NOT_FOUND\u0026#34;, \u0026#34;FORBIDDEN\u0026#34;] When `null`, the `retry_conditions` field will be omitted from the resulting object.\n  - `aws_v4_authentication` (`list[obj]`): Enable AWS Signature Version 4 origin authentication. When `null`, the `aws_v4_authentication` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.aws_v4_authentication.new](#fn-aws_v4_authenticationnew) constructor.\n  - `origin_override_action` (`list[obj]`): The override actions, including url rewrites and header\nadditions, for requests that use this origin. When `null`, the `origin_override_action` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.origin_override_action.new](#fn-origin_override_actionnew) constructor.\n  - `origin_redirect` (`list[obj]`): Follow redirects from this origin. When `null`, the `origin_redirect` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.origin_redirect.new](#fn-origin_redirectnew) constructor.\n  - `timeout` (`list[obj]`): The connection and HTTP timeout configuration for this origin. When `null`, the `timeout` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.timeout.new](#fn-timeoutnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.network_services_edge_cache_origin.new` injects a new `google_network_services_edge_cache_origin` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_services_edge_cache_origin.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_services_edge_cache_origin` using the reference:\n\n    $._ref.google_network_services_edge_cache_origin.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_services_edge_cache_origin.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `failover_origin` (`string`): The Origin resource to try when the current origin cannot be reached.\nAfter maxAttempts is reached, the configured failoverOrigin will be used to fulfil the request.\n\nThe value of timeout.maxAttemptsTimeout dictates the timeout across all origins.\nA reference to a Topic resource. When `null`, the `failover_origin` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `max_attempts` (`number`): The maximum number of attempts to cache fill from this origin. Another attempt is made when a cache fill fails with one of the retryConditions.\n\nOnce maxAttempts to this origin have failed the failoverOrigin will be used, if one is specified. That failoverOrigin may specify its own maxAttempts,\nretryConditions and failoverOrigin to control its own cache fill failures.\n\nThe total number of allowed attempts to cache fill across this and failover origins is limited to four.\nThe total time allowed for cache fill attempts across this and failover origins can be controlled with maxAttemptsTimeout.\n\nThe last valid, non-retried response from all origins will be returned to the client.\nIf no origin returns a valid response, an HTTP 502 will be returned to the client.\n\nDefaults to 1. Must be a value greater than 0 and less than 4. When `null`, the `max_attempts` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `origin_address` (`string`): A fully qualified domain name (FQDN) or IP address reachable over the public Internet, or the address of a Google Cloud Storage bucket.\n\nThis address will be used as the origin for cache requests - e.g. FQDN: media-backend.example.com, IPv4: 35.218.1.1, IPv6: 2607:f8b0:4012:809::200e, Cloud Storage: gs://bucketname\n\nWhen providing an FQDN (hostname), it must be publicly resolvable (e.g. via Google public DNS) and IP addresses must be publicly routable.  It must not contain a protocol (e.g., https://) and it must not contain any slashes.\nIf a Cloud Storage bucket is provided, it must be in the canonical \u0026#34;gs://bucketname\u0026#34; format. Other forms, such as \u0026#34;storage.googleapis.com\u0026#34;, will be rejected.\n  - `port` (`number`): The port to connect to the origin on.\nDefaults to port 443 for HTTP2 and HTTPS protocols, and port 80 for HTTP. When `null`, the `port` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `protocol` (`string`): The protocol to use to connect to the configured origin. Defaults to HTTP2, and it is strongly recommended that users use HTTP2 for both security \u0026amp; performance.\n\nWhen using HTTP2 or HTTPS as the protocol, a valid, publicly-signed, unexpired TLS (SSL) certificate must be presented by the origin server. Possible values: [\u0026#34;HTTP2\u0026#34;, \u0026#34;HTTPS\u0026#34;, \u0026#34;HTTP\u0026#34;] When `null`, the `protocol` field will be omitted from the resulting object.\n  - `retry_conditions` (`list`): Specifies one or more retry conditions for the configured origin.\n\nIf the failure mode during a connection attempt to the origin matches the configured retryCondition(s),\nthe origin request will be retried up to maxAttempts times. The failoverOrigin, if configured, will then be used to satisfy the request.\n\nThe default retryCondition is \u0026#34;CONNECT_FAILURE\u0026#34;.\n\nretryConditions apply to this origin, and not subsequent failoverOrigin(s),\nwhich may specify their own retryConditions and maxAttempts.\n\nValid values are:\n\n- CONNECT_FAILURE: Retry on failures connecting to origins, for example due to connection timeouts.\n- HTTP_5XX: Retry if the origin responds with any 5xx response code, or if the origin does not respond at all, example: disconnects, reset, read timeout, connection failure, and refused streams.\n- GATEWAY_ERROR: Similar to 5xx, but only applies to response codes 502, 503 or 504.\n- RETRIABLE_4XX: Retry for retriable 4xx response codes, which include HTTP 409 (Conflict) and HTTP 429 (Too Many Requests)\n- NOT_FOUND: Retry if the origin returns a HTTP 404 (Not Found). This can be useful when generating video content, and the segment is not available yet.\n- FORBIDDEN: Retry if the origin returns a HTTP 403 (Forbidden). Possible values: [\u0026#34;CONNECT_FAILURE\u0026#34;, \u0026#34;HTTP_5XX\u0026#34;, \u0026#34;GATEWAY_ERROR\u0026#34;, \u0026#34;RETRIABLE_4XX\u0026#34;, \u0026#34;NOT_FOUND\u0026#34;, \u0026#34;FORBIDDEN\u0026#34;] When `null`, the `retry_conditions` field will be omitted from the resulting object.\n  - `aws_v4_authentication` (`list[obj]`): Enable AWS Signature Version 4 origin authentication. When `null`, the `aws_v4_authentication` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.aws_v4_authentication.new](#fn-aws_v4_authenticationnew) constructor.\n  - `origin_override_action` (`list[obj]`): The override actions, including url rewrites and header\nadditions, for requests that use this origin. When `null`, the `origin_override_action` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.origin_override_action.new](#fn-origin_override_actionnew) constructor.\n  - `origin_redirect` (`list[obj]`): Follow redirects from this origin. When `null`, the `origin_redirect` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.origin_redirect.new](#fn-origin_redirectnew) constructor.\n  - `timeout` (`list[obj]`): The connection and HTTP timeout configuration for this origin. When `null`, the `timeout` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.timeout.new](#fn-timeoutnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -55,7 +55,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.network_services_edge_cache_origin.newAttrs` constructs a new object with attributes and blocks configured for the `network_services_edge_cache_origin`\nTerraform resource.\n\nUnlike [google.network_services_edge_cache_origin.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `failover_origin` (`string`): The Origin resource to try when the current origin cannot be reached.\nAfter maxAttempts is reached, the configured failoverOrigin will be used to fulfil the request.\n\nThe value of timeout.maxAttemptsTimeout dictates the timeout across all origins.\nA reference to a Topic resource. When `null`, the `failover_origin` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `max_attempts` (`number`): The maximum number of attempts to cache fill from this origin. Another attempt is made when a cache fill fails with one of the retryConditions.\n\nOnce maxAttempts to this origin have failed the failoverOrigin will be used, if one is specified. That failoverOrigin may specify its own maxAttempts,\nretryConditions and failoverOrigin to control its own cache fill failures.\n\nThe total number of allowed attempts to cache fill across this and failover origins is limited to four.\nThe total time allowed for cache fill attempts across this and failover origins can be controlled with maxAttemptsTimeout.\n\nThe last valid, non-retried response from all origins will be returned to the client.\nIf no origin returns a valid response, an HTTP 502 will be returned to the client.\n\nDefaults to 1. Must be a value greater than 0 and less than 4. When `null`, the `max_attempts` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `origin_address` (`string`): A fully qualified domain name (FQDN) or IP address reachable over the public Internet, or the address of a Google Cloud Storage bucket.\n\nThis address will be used as the origin for cache requests - e.g. FQDN: media-backend.example.com, IPv4: 35.218.1.1, IPv6: 2607:f8b0:4012:809::200e, Cloud Storage: gs://bucketname\n\nWhen providing an FQDN (hostname), it must be publicly resolvable (e.g. via Google public DNS) and IP addresses must be publicly routable.  It must not contain a protocol (e.g., https://) and it must not contain any slashes.\nIf a Cloud Storage bucket is provided, it must be in the canonical "gs://bucketname" format. Other forms, such as "storage.googleapis.com", will be rejected.\n  - `port` (`number`): The port to connect to the origin on.\nDefaults to port 443 for HTTP2 and HTTPS protocols, and port 80 for HTTP. When `null`, the `port` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `protocol` (`string`): The protocol to use to connect to the configured origin. Defaults to HTTP2, and it is strongly recommended that users use HTTP2 for both security & performance.\n\nWhen using HTTP2 or HTTPS as the protocol, a valid, publicly-signed, unexpired TLS (SSL) certificate must be presented by the origin server. Possible values: ["HTTP2", "HTTPS", "HTTP"] When `null`, the `protocol` field will be omitted from the resulting object.\n  - `retry_conditions` (`list`): Specifies one or more retry conditions for the configured origin.\n\nIf the failure mode during a connection attempt to the origin matches the configured retryCondition(s),\nthe origin request will be retried up to maxAttempts times. The failoverOrigin, if configured, will then be used to satisfy the request.\n\nThe default retryCondition is "CONNECT_FAILURE".\n\nretryConditions apply to this origin, and not subsequent failoverOrigin(s),\nwhich may specify their own retryConditions and maxAttempts.\n\nValid values are:\n\n- CONNECT_FAILURE: Retry on failures connecting to origins, for example due to connection timeouts.\n- HTTP_5XX: Retry if the origin responds with any 5xx response code, or if the origin does not respond at all, example: disconnects, reset, read timeout, connection failure, and refused streams.\n- GATEWAY_ERROR: Similar to 5xx, but only applies to response codes 502, 503 or 504.\n- RETRIABLE_4XX: Retry for retriable 4xx response codes, which include HTTP 409 (Conflict) and HTTP 429 (Too Many Requests)\n- NOT_FOUND: Retry if the origin returns a HTTP 404 (Not Found). This can be useful when generating video content, and the segment is not available yet.\n- FORBIDDEN: Retry if the origin returns a HTTP 403 (Forbidden). Possible values: ["CONNECT_FAILURE", "HTTP_5XX", "GATEWAY_ERROR", "RETRIABLE_4XX", "NOT_FOUND", "FORBIDDEN"] When `null`, the `retry_conditions` field will be omitted from the resulting object.\n  - `aws_v4_authentication` (`list[obj]`): Enable AWS Signature Version 4 origin authentication. When `null`, the `aws_v4_authentication` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.aws_v4_authentication.new](#fn-aws_v4_authenticationnew) constructor.\n  - `origin_override_action` (`list[obj]`): The override actions, including url rewrites and header\nadditions, for requests that use this origin. When `null`, the `origin_override_action` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.origin_override_action.new](#fn-origin_override_actionnew) constructor.\n  - `origin_redirect` (`list[obj]`): Follow redirects from this origin. When `null`, the `origin_redirect` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.origin_redirect.new](#fn-origin_redirectnew) constructor.\n  - `timeout` (`list[obj]`): The connection and HTTP timeout configuration for this origin. When `null`, the `timeout` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.timeout.new](#fn-timeoutnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_services_edge_cache_origin` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.network_services_edge_cache_origin.newAttrs` constructs a new object with attributes and blocks configured for the `network_services_edge_cache_origin`\nTerraform resource.\n\nUnlike [google.network_services_edge_cache_origin.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `failover_origin` (`string`): The Origin resource to try when the current origin cannot be reached.\nAfter maxAttempts is reached, the configured failoverOrigin will be used to fulfil the request.\n\nThe value of timeout.maxAttemptsTimeout dictates the timeout across all origins.\nA reference to a Topic resource. When `null`, the `failover_origin` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `max_attempts` (`number`): The maximum number of attempts to cache fill from this origin. Another attempt is made when a cache fill fails with one of the retryConditions.\n\nOnce maxAttempts to this origin have failed the failoverOrigin will be used, if one is specified. That failoverOrigin may specify its own maxAttempts,\nretryConditions and failoverOrigin to control its own cache fill failures.\n\nThe total number of allowed attempts to cache fill across this and failover origins is limited to four.\nThe total time allowed for cache fill attempts across this and failover origins can be controlled with maxAttemptsTimeout.\n\nThe last valid, non-retried response from all origins will be returned to the client.\nIf no origin returns a valid response, an HTTP 502 will be returned to the client.\n\nDefaults to 1. Must be a value greater than 0 and less than 4. When `null`, the `max_attempts` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `origin_address` (`string`): A fully qualified domain name (FQDN) or IP address reachable over the public Internet, or the address of a Google Cloud Storage bucket.\n\nThis address will be used as the origin for cache requests - e.g. FQDN: media-backend.example.com, IPv4: 35.218.1.1, IPv6: 2607:f8b0:4012:809::200e, Cloud Storage: gs://bucketname\n\nWhen providing an FQDN (hostname), it must be publicly resolvable (e.g. via Google public DNS) and IP addresses must be publicly routable.  It must not contain a protocol (e.g., https://) and it must not contain any slashes.\nIf a Cloud Storage bucket is provided, it must be in the canonical "gs://bucketname" format. Other forms, such as "storage.googleapis.com", will be rejected.\n  - `port` (`number`): The port to connect to the origin on.\nDefaults to port 443 for HTTP2 and HTTPS protocols, and port 80 for HTTP. When `null`, the `port` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `protocol` (`string`): The protocol to use to connect to the configured origin. Defaults to HTTP2, and it is strongly recommended that users use HTTP2 for both security & performance.\n\nWhen using HTTP2 or HTTPS as the protocol, a valid, publicly-signed, unexpired TLS (SSL) certificate must be presented by the origin server. Possible values: ["HTTP2", "HTTPS", "HTTP"] When `null`, the `protocol` field will be omitted from the resulting object.\n  - `retry_conditions` (`list`): Specifies one or more retry conditions for the configured origin.\n\nIf the failure mode during a connection attempt to the origin matches the configured retryCondition(s),\nthe origin request will be retried up to maxAttempts times. The failoverOrigin, if configured, will then be used to satisfy the request.\n\nThe default retryCondition is "CONNECT_FAILURE".\n\nretryConditions apply to this origin, and not subsequent failoverOrigin(s),\nwhich may specify their own retryConditions and maxAttempts.\n\nValid values are:\n\n- CONNECT_FAILURE: Retry on failures connecting to origins, for example due to connection timeouts.\n- HTTP_5XX: Retry if the origin responds with any 5xx response code, or if the origin does not respond at all, example: disconnects, reset, read timeout, connection failure, and refused streams.\n- GATEWAY_ERROR: Similar to 5xx, but only applies to response codes 502, 503 or 504.\n- RETRIABLE_4XX: Retry for retriable 4xx response codes, which include HTTP 409 (Conflict) and HTTP 429 (Too Many Requests)\n- NOT_FOUND: Retry if the origin returns a HTTP 404 (Not Found). This can be useful when generating video content, and the segment is not available yet.\n- FORBIDDEN: Retry if the origin returns a HTTP 403 (Forbidden). Possible values: ["CONNECT_FAILURE", "HTTP_5XX", "GATEWAY_ERROR", "RETRIABLE_4XX", "NOT_FOUND", "FORBIDDEN"] When `null`, the `retry_conditions` field will be omitted from the resulting object.\n  - `aws_v4_authentication` (`list[obj]`): Enable AWS Signature Version 4 origin authentication. When `null`, the `aws_v4_authentication` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.aws_v4_authentication.new](#fn-aws_v4_authenticationnew) constructor.\n  - `origin_override_action` (`list[obj]`): The override actions, including url rewrites and header\nadditions, for requests that use this origin. When `null`, the `origin_override_action` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.origin_override_action.new](#fn-origin_override_actionnew) constructor.\n  - `origin_redirect` (`list[obj]`): Follow redirects from this origin. When `null`, the `origin_redirect` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.origin_redirect.new](#fn-origin_redirectnew) constructor.\n  - `timeout` (`list[obj]`): The connection and HTTP timeout configuration for this origin. When `null`, the `timeout` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.timeout.new](#fn-timeoutnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_origin.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_services_edge_cache_origin` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     origin_address,
diff --git a/4.x/_gen/resources/network_services_edge_cache_service.libsonnet b/4.x/_gen/resources/network_services_edge_cache_service.libsonnet
index 41ae49bc..7f187a5f 100644
--- a/4.x/_gen/resources/network_services_edge_cache_service.libsonnet
+++ b/4.x/_gen/resources/network_services_edge_cache_service.libsonnet
@@ -12,7 +12,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       sample_rate: sample_rate,
     }),
   },
-  '#new':: d.fn(help="\n`google.network_services_edge_cache_service.new` injects a new `google_network_services_edge_cache_service` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_services_edge_cache_service.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_services_edge_cache_service` using the reference:\n\n    $._ref.google_network_services_edge_cache_service.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_services_edge_cache_service.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `disable_http2` (`bool`): Disables HTTP/2.\n\nHTTP/2 (h2) is enabled by default and recommended for performance. HTTP/2 improves connection re-use and reduces connection setup overhead by sending multiple streams over the same connection.\n\nSome legacy HTTP clients may have issues with HTTP/2 connections due to broken HTTP/2 implementations. Setting this to true will prevent HTTP/2 from being advertised and negotiated. When `null`, the `disable_http2` field will be omitted from the resulting object.\n  - `disable_quic` (`bool`): HTTP/3 (IETF QUIC) and Google QUIC are enabled by default. When `null`, the `disable_quic` field will be omitted from the resulting object.\n  - `edge_security_policy` (`string`): Resource URL that points at the Cloud Armor edge security policy that is applied on each request against the EdgeCacheService. When `null`, the `edge_security_policy` field will be omitted from the resulting object.\n  - `edge_ssl_certificates` (`list`): URLs to sslCertificate resources that are used to authenticate connections between users and the EdgeCacheService.\n\nNote that only \u0026#34;global\u0026#34; certificates with a \u0026#34;scope\u0026#34; of \u0026#34;EDGE_CACHE\u0026#34; can be attached to an EdgeCacheService. When `null`, the `edge_ssl_certificates` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `require_tls` (`bool`): Require TLS (HTTPS) for all clients connecting to this service.\n\nClients who connect over HTTP (port 80) will receive a HTTP 301 to the same URL over HTTPS (port 443).\nYou must have at least one (1) edgeSslCertificate specified to enable this. When `null`, the `require_tls` field will be omitted from the resulting object.\n  - `ssl_policy` (`string`): URL of the SslPolicy resource that will be associated with the EdgeCacheService.\n\nIf not set, the EdgeCacheService has no SSL policy configured, and will default to the \u0026#34;COMPATIBLE\u0026#34; policy. When `null`, the `ssl_policy` field will be omitted from the resulting object.\n  - `log_config` (`list[obj]`): Specifies the logging options for the traffic served by this service. If logging is enabled, logs will be exported to Cloud Logging. When `null`, the `log_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_service.log_config.new](#fn-log_confignew) constructor.\n  - `routing` (`list[obj]`): Defines how requests are routed, modified, cached and/or which origin content is filled from. When `null`, the `routing` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_service.routing.new](#fn-routingnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_service.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.network_services_edge_cache_service.new` injects a new `google_network_services_edge_cache_service` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_services_edge_cache_service.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_services_edge_cache_service` using the reference:\n\n    $._ref.google_network_services_edge_cache_service.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_services_edge_cache_service.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `disable_http2` (`bool`): Disables HTTP/2.\n\nHTTP/2 (h2) is enabled by default and recommended for performance. HTTP/2 improves connection re-use and reduces connection setup overhead by sending multiple streams over the same connection.\n\nSome legacy HTTP clients may have issues with HTTP/2 connections due to broken HTTP/2 implementations. Setting this to true will prevent HTTP/2 from being advertised and negotiated. When `null`, the `disable_http2` field will be omitted from the resulting object.\n  - `disable_quic` (`bool`): HTTP/3 (IETF QUIC) and Google QUIC are enabled by default. When `null`, the `disable_quic` field will be omitted from the resulting object.\n  - `edge_security_policy` (`string`): Resource URL that points at the Cloud Armor edge security policy that is applied on each request against the EdgeCacheService. When `null`, the `edge_security_policy` field will be omitted from the resulting object.\n  - `edge_ssl_certificates` (`list`): URLs to sslCertificate resources that are used to authenticate connections between users and the EdgeCacheService.\n\nNote that only \u0026#34;global\u0026#34; certificates with a \u0026#34;scope\u0026#34; of \u0026#34;EDGE_CACHE\u0026#34; can be attached to an EdgeCacheService. When `null`, the `edge_ssl_certificates` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `require_tls` (`bool`): Require TLS (HTTPS) for all clients connecting to this service.\n\nClients who connect over HTTP (port 80) will receive a HTTP 301 to the same URL over HTTPS (port 443).\nYou must have at least one (1) edgeSslCertificate specified to enable this. When `null`, the `require_tls` field will be omitted from the resulting object.\n  - `ssl_policy` (`string`): URL of the SslPolicy resource that will be associated with the EdgeCacheService.\n\nIf not set, the EdgeCacheService has no SSL policy configured, and will default to the \u0026#34;COMPATIBLE\u0026#34; policy. When `null`, the `ssl_policy` field will be omitted from the resulting object.\n  - `log_config` (`list[obj]`): Specifies the logging options for the traffic served by this service. If logging is enabled, logs will be exported to Cloud Logging. When `null`, the `log_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_service.log_config.new](#fn-log_confignew) constructor.\n  - `routing` (`list[obj]`): Defines how requests are routed, modified, cached and/or which origin content is filled from. When `null`, the `routing` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_service.routing.new](#fn-routingnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_service.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -49,7 +49,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.network_services_edge_cache_service.newAttrs` constructs a new object with attributes and blocks configured for the `network_services_edge_cache_service`\nTerraform resource.\n\nUnlike [google.network_services_edge_cache_service.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `disable_http2` (`bool`): Disables HTTP/2.\n\nHTTP/2 (h2) is enabled by default and recommended for performance. HTTP/2 improves connection re-use and reduces connection setup overhead by sending multiple streams over the same connection.\n\nSome legacy HTTP clients may have issues with HTTP/2 connections due to broken HTTP/2 implementations. Setting this to true will prevent HTTP/2 from being advertised and negotiated. When `null`, the `disable_http2` field will be omitted from the resulting object.\n  - `disable_quic` (`bool`): HTTP/3 (IETF QUIC) and Google QUIC are enabled by default. When `null`, the `disable_quic` field will be omitted from the resulting object.\n  - `edge_security_policy` (`string`): Resource URL that points at the Cloud Armor edge security policy that is applied on each request against the EdgeCacheService. When `null`, the `edge_security_policy` field will be omitted from the resulting object.\n  - `edge_ssl_certificates` (`list`): URLs to sslCertificate resources that are used to authenticate connections between users and the EdgeCacheService.\n\nNote that only "global" certificates with a "scope" of "EDGE_CACHE" can be attached to an EdgeCacheService. When `null`, the `edge_ssl_certificates` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `require_tls` (`bool`): Require TLS (HTTPS) for all clients connecting to this service.\n\nClients who connect over HTTP (port 80) will receive a HTTP 301 to the same URL over HTTPS (port 443).\nYou must have at least one (1) edgeSslCertificate specified to enable this. When `null`, the `require_tls` field will be omitted from the resulting object.\n  - `ssl_policy` (`string`): URL of the SslPolicy resource that will be associated with the EdgeCacheService.\n\nIf not set, the EdgeCacheService has no SSL policy configured, and will default to the "COMPATIBLE" policy. When `null`, the `ssl_policy` field will be omitted from the resulting object.\n  - `log_config` (`list[obj]`): Specifies the logging options for the traffic served by this service. If logging is enabled, logs will be exported to Cloud Logging. When `null`, the `log_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_service.log_config.new](#fn-log_confignew) constructor.\n  - `routing` (`list[obj]`): Defines how requests are routed, modified, cached and/or which origin content is filled from. When `null`, the `routing` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_service.routing.new](#fn-routingnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_service.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_services_edge_cache_service` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.network_services_edge_cache_service.newAttrs` constructs a new object with attributes and blocks configured for the `network_services_edge_cache_service`\nTerraform resource.\n\nUnlike [google.network_services_edge_cache_service.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.\n  - `disable_http2` (`bool`): Disables HTTP/2.\n\nHTTP/2 (h2) is enabled by default and recommended for performance. HTTP/2 improves connection re-use and reduces connection setup overhead by sending multiple streams over the same connection.\n\nSome legacy HTTP clients may have issues with HTTP/2 connections due to broken HTTP/2 implementations. Setting this to true will prevent HTTP/2 from being advertised and negotiated. When `null`, the `disable_http2` field will be omitted from the resulting object.\n  - `disable_quic` (`bool`): HTTP/3 (IETF QUIC) and Google QUIC are enabled by default. When `null`, the `disable_quic` field will be omitted from the resulting object.\n  - `edge_security_policy` (`string`): Resource URL that points at the Cloud Armor edge security policy that is applied on each request against the EdgeCacheService. When `null`, the `edge_security_policy` field will be omitted from the resulting object.\n  - `edge_ssl_certificates` (`list`): URLs to sslCertificate resources that are used to authenticate connections between users and the EdgeCacheService.\n\nNote that only "global" certificates with a "scope" of "EDGE_CACHE" can be attached to an EdgeCacheService. When `null`, the `edge_ssl_certificates` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the resource; provided by the client when the resource is created.\nThe name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,\nand all following characters must be a dash, underscore, letter or digit.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `require_tls` (`bool`): Require TLS (HTTPS) for all clients connecting to this service.\n\nClients who connect over HTTP (port 80) will receive a HTTP 301 to the same URL over HTTPS (port 443).\nYou must have at least one (1) edgeSslCertificate specified to enable this. When `null`, the `require_tls` field will be omitted from the resulting object.\n  - `ssl_policy` (`string`): URL of the SslPolicy resource that will be associated with the EdgeCacheService.\n\nIf not set, the EdgeCacheService has no SSL policy configured, and will default to the "COMPATIBLE" policy. When `null`, the `ssl_policy` field will be omitted from the resulting object.\n  - `log_config` (`list[obj]`): Specifies the logging options for the traffic served by this service. If logging is enabled, logs will be exported to Cloud Logging. When `null`, the `log_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_service.log_config.new](#fn-log_confignew) constructor.\n  - `routing` (`list[obj]`): Defines how requests are routed, modified, cached and/or which origin content is filled from. When `null`, the `routing` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_service.routing.new](#fn-routingnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_edge_cache_service.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_services_edge_cache_service` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     description=null,
diff --git a/4.x/_gen/resources/network_services_gateway.libsonnet b/4.x/_gen/resources/network_services_gateway.libsonnet
index ea902964..3d0d5d15 100644
--- a/4.x/_gen/resources/network_services_gateway.libsonnet
+++ b/4.x/_gen/resources/network_services_gateway.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='network_services_gateway', url='', help='`network_services_gateway` represents the `google_network_services_gateway` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.network_services_gateway.new` injects a new `google_network_services_gateway` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_services_gateway.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_services_gateway` using the reference:\n\n    $._ref.google_network_services_gateway.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_services_gateway.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `addresses` (`list`): Zero or one IPv4-address on which the Gateway will receive the traffic. When no address is provided,\nan IP from the subnetwork is allocated This field only applies to gateways of type \u0026#39;SECURE_WEB_GATEWAY\u0026#39;.\nGateways of type \u0026#39;OPEN_MESH\u0026#39; listen on 0.0.0.0. When `null`, the `addresses` field will be omitted from the resulting object.\n  - `certificate_urls` (`list`): A fully-qualified Certificates URL reference. The proxy presents a Certificate (selected based on SNI) when establishing a TLS connection.\nThis feature only applies to gateways of type \u0026#39;SECURE_WEB_GATEWAY\u0026#39;. When `null`, the `certificate_urls` field will be omitted from the resulting object.\n  - `delete_swg_autogen_router_on_destroy` (`bool`): When deleting a gateway of type \u0026#39;SECURE_WEB_GATEWAY\u0026#39;, this boolean option will also delete auto generated router by the gateway creation.\nIf there is no other gateway of type \u0026#39;SECURE_WEB_GATEWAY\u0026#39; remaining for that region and network it will be deleted. When `null`, the `delete_swg_autogen_router_on_destroy` field will be omitted from the resulting object.\n  - `description` (`string`): A free-text description of the resource. Max length 1024 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `gateway_security_policy` (`string`): A fully-qualified GatewaySecurityPolicy URL reference. Defines how a server should apply security policy to inbound (VM to Proxy) initiated connections.\nFor example: \u0026#39;projects/*/locations/*/gatewaySecurityPolicies/swg-policy\u0026#39;.\nThis policy is specific to gateways of type \u0026#39;SECURE_WEB_GATEWAY\u0026#39;. When `null`, the `gateway_security_policy` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the Gateway resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the gateway.\nThe default value is \u0026#39;global\u0026#39;. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Short name of the Gateway resource to be created.\n  - `network` (`string`): The relative resource name identifying the VPC network that is using this configuration.\nFor example: \u0026#39;projects/*/global/networks/network-1\u0026#39;.\nCurrently, this field is specific to gateways of type \u0026#39;SECURE_WEB_GATEWAY\u0026#39;. When `null`, the `network` field will be omitted from the resulting object.\n  - `ports` (`list`): One or more port numbers (1-65535), on which the Gateway will receive traffic.\nThe proxy binds to the specified ports. Gateways of type \u0026#39;SECURE_WEB_GATEWAY\u0026#39; are\nlimited to 1 port. Gateways of type \u0026#39;OPEN_MESH\u0026#39; listen on 0.0.0.0 and support multiple ports.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope` (`string`): Immutable. Scope determines how configuration across multiple Gateway instances are merged.\nThe configuration for multiple Gateway instances with the same scope will be merged as presented as\na single coniguration to the proxy/load balancer.\nMax length 64 characters. Scope should start with a letter and can only have letters, numbers, hyphens. When `null`, the `scope` field will be omitted from the resulting object.\n  - `server_tls_policy` (`string`): A fully-qualified ServerTLSPolicy URL reference. Specifies how TLS traffic is terminated.\nIf empty, TLS termination is disabled. When `null`, the `server_tls_policy` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): The relative resource name identifying the subnetwork in which this SWG is allocated.\nFor example: \u0026#39;projects/*/regions/us-central1/subnetworks/network-1\u0026#39;.\nCurrently, this field is specific to gateways of type \u0026#39;SECURE_WEB_GATEWAY. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `type` (`string`): Immutable. The type of the customer-managed gateway. Possible values are: * OPEN_MESH * SECURE_WEB_GATEWAY. Possible values: [\u0026#34;TYPE_UNSPECIFIED\u0026#34;, \u0026#34;OPEN_MESH\u0026#34;, \u0026#34;SECURE_WEB_GATEWAY\u0026#34;]\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_gateway.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.network_services_gateway.new` injects a new `google_network_services_gateway` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.network_services_gateway.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.network_services_gateway` using the reference:\n\n    $._ref.google_network_services_gateway.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_network_services_gateway.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `addresses` (`list`): Zero or one IPv4-address on which the Gateway will receive the traffic. When no address is provided,\nan IP from the subnetwork is allocated This field only applies to gateways of type \u0026#39;SECURE_WEB_GATEWAY\u0026#39;.\nGateways of type \u0026#39;OPEN_MESH\u0026#39; listen on 0.0.0.0. When `null`, the `addresses` field will be omitted from the resulting object.\n  - `certificate_urls` (`list`): A fully-qualified Certificates URL reference. The proxy presents a Certificate (selected based on SNI) when establishing a TLS connection.\nThis feature only applies to gateways of type \u0026#39;SECURE_WEB_GATEWAY\u0026#39;. When `null`, the `certificate_urls` field will be omitted from the resulting object.\n  - `delete_swg_autogen_router_on_destroy` (`bool`): When deleting a gateway of type \u0026#39;SECURE_WEB_GATEWAY\u0026#39;, this boolean option will also delete auto generated router by the gateway creation.\nIf there is no other gateway of type \u0026#39;SECURE_WEB_GATEWAY\u0026#39; remaining for that region and network it will be deleted. When `null`, the `delete_swg_autogen_router_on_destroy` field will be omitted from the resulting object.\n  - `description` (`string`): A free-text description of the resource. Max length 1024 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `gateway_security_policy` (`string`): A fully-qualified GatewaySecurityPolicy URL reference. Defines how a server should apply security policy to inbound (VM to Proxy) initiated connections.\nFor example: \u0026#39;projects/*/locations/*/gatewaySecurityPolicies/swg-policy\u0026#39;.\nThis policy is specific to gateways of type \u0026#39;SECURE_WEB_GATEWAY\u0026#39;. When `null`, the `gateway_security_policy` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the Gateway resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the gateway.\nThe default value is \u0026#39;global\u0026#39;. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Short name of the Gateway resource to be created.\n  - `network` (`string`): The relative resource name identifying the VPC network that is using this configuration.\nFor example: \u0026#39;projects/*/global/networks/network-1\u0026#39;.\nCurrently, this field is specific to gateways of type \u0026#39;SECURE_WEB_GATEWAY\u0026#39;. When `null`, the `network` field will be omitted from the resulting object.\n  - `ports` (`list`): One or more port numbers (1-65535), on which the Gateway will receive traffic.\nThe proxy binds to the specified ports. Gateways of type \u0026#39;SECURE_WEB_GATEWAY\u0026#39; are\nlimited to 1 port. Gateways of type \u0026#39;OPEN_MESH\u0026#39; listen on 0.0.0.0 and support multiple ports.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope` (`string`): Immutable. Scope determines how configuration across multiple Gateway instances are merged.\nThe configuration for multiple Gateway instances with the same scope will be merged as presented as\na single coniguration to the proxy/load balancer.\nMax length 64 characters. Scope should start with a letter and can only have letters, numbers, hyphens. When `null`, the `scope` field will be omitted from the resulting object.\n  - `server_tls_policy` (`string`): A fully-qualified ServerTLSPolicy URL reference. Specifies how TLS traffic is terminated.\nIf empty, TLS termination is disabled. When `null`, the `server_tls_policy` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): The relative resource name identifying the subnetwork in which this SWG is allocated.\nFor example: \u0026#39;projects/*/regions/us-central1/subnetworks/network-1\u0026#39;.\nCurrently, this field is specific to gateways of type \u0026#39;SECURE_WEB_GATEWAY. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `type` (`string`): Immutable. The type of the customer-managed gateway. Possible values are: * OPEN_MESH * SECURE_WEB_GATEWAY. Possible values: [\u0026#34;TYPE_UNSPECIFIED\u0026#34;, \u0026#34;OPEN_MESH\u0026#34;, \u0026#34;SECURE_WEB_GATEWAY\u0026#34;]\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_gateway.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -45,7 +45,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.network_services_gateway.newAttrs` constructs a new object with attributes and blocks configured for the `network_services_gateway`\nTerraform resource.\n\nUnlike [google.network_services_gateway.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `addresses` (`list`): Zero or one IPv4-address on which the Gateway will receive the traffic. When no address is provided,\nan IP from the subnetwork is allocated This field only applies to gateways of type 'SECURE_WEB_GATEWAY'.\nGateways of type 'OPEN_MESH' listen on 0.0.0.0. When `null`, the `addresses` field will be omitted from the resulting object.\n  - `certificate_urls` (`list`): A fully-qualified Certificates URL reference. The proxy presents a Certificate (selected based on SNI) when establishing a TLS connection.\nThis feature only applies to gateways of type 'SECURE_WEB_GATEWAY'. When `null`, the `certificate_urls` field will be omitted from the resulting object.\n  - `delete_swg_autogen_router_on_destroy` (`bool`): When deleting a gateway of type 'SECURE_WEB_GATEWAY', this boolean option will also delete auto generated router by the gateway creation.\nIf there is no other gateway of type 'SECURE_WEB_GATEWAY' remaining for that region and network it will be deleted. When `null`, the `delete_swg_autogen_router_on_destroy` field will be omitted from the resulting object.\n  - `description` (`string`): A free-text description of the resource. Max length 1024 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `gateway_security_policy` (`string`): A fully-qualified GatewaySecurityPolicy URL reference. Defines how a server should apply security policy to inbound (VM to Proxy) initiated connections.\nFor example: 'projects/*/locations/*/gatewaySecurityPolicies/swg-policy'.\nThis policy is specific to gateways of type 'SECURE_WEB_GATEWAY'. When `null`, the `gateway_security_policy` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the Gateway resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the gateway.\nThe default value is 'global'. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Short name of the Gateway resource to be created.\n  - `network` (`string`): The relative resource name identifying the VPC network that is using this configuration.\nFor example: 'projects/*/global/networks/network-1'.\nCurrently, this field is specific to gateways of type 'SECURE_WEB_GATEWAY'. When `null`, the `network` field will be omitted from the resulting object.\n  - `ports` (`list`): One or more port numbers (1-65535), on which the Gateway will receive traffic.\nThe proxy binds to the specified ports. Gateways of type 'SECURE_WEB_GATEWAY' are\nlimited to 1 port. Gateways of type 'OPEN_MESH' listen on 0.0.0.0 and support multiple ports.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope` (`string`): Immutable. Scope determines how configuration across multiple Gateway instances are merged.\nThe configuration for multiple Gateway instances with the same scope will be merged as presented as\na single coniguration to the proxy/load balancer.\nMax length 64 characters. Scope should start with a letter and can only have letters, numbers, hyphens. When `null`, the `scope` field will be omitted from the resulting object.\n  - `server_tls_policy` (`string`): A fully-qualified ServerTLSPolicy URL reference. Specifies how TLS traffic is terminated.\nIf empty, TLS termination is disabled. When `null`, the `server_tls_policy` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): The relative resource name identifying the subnetwork in which this SWG is allocated.\nFor example: 'projects/*/regions/us-central1/subnetworks/network-1'.\nCurrently, this field is specific to gateways of type 'SECURE_WEB_GATEWAY. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `type` (`string`): Immutable. The type of the customer-managed gateway. Possible values are: * OPEN_MESH * SECURE_WEB_GATEWAY. Possible values: ["TYPE_UNSPECIFIED", "OPEN_MESH", "SECURE_WEB_GATEWAY"]\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_gateway.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_services_gateway` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.network_services_gateway.newAttrs` constructs a new object with attributes and blocks configured for the `network_services_gateway`\nTerraform resource.\n\nUnlike [google.network_services_gateway.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `addresses` (`list`): Zero or one IPv4-address on which the Gateway will receive the traffic. When no address is provided,\nan IP from the subnetwork is allocated This field only applies to gateways of type 'SECURE_WEB_GATEWAY'.\nGateways of type 'OPEN_MESH' listen on 0.0.0.0. When `null`, the `addresses` field will be omitted from the resulting object.\n  - `certificate_urls` (`list`): A fully-qualified Certificates URL reference. The proxy presents a Certificate (selected based on SNI) when establishing a TLS connection.\nThis feature only applies to gateways of type 'SECURE_WEB_GATEWAY'. When `null`, the `certificate_urls` field will be omitted from the resulting object.\n  - `delete_swg_autogen_router_on_destroy` (`bool`): When deleting a gateway of type 'SECURE_WEB_GATEWAY', this boolean option will also delete auto generated router by the gateway creation.\nIf there is no other gateway of type 'SECURE_WEB_GATEWAY' remaining for that region and network it will be deleted. When `null`, the `delete_swg_autogen_router_on_destroy` field will be omitted from the resulting object.\n  - `description` (`string`): A free-text description of the resource. Max length 1024 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `gateway_security_policy` (`string`): A fully-qualified GatewaySecurityPolicy URL reference. Defines how a server should apply security policy to inbound (VM to Proxy) initiated connections.\nFor example: 'projects/*/locations/*/gatewaySecurityPolicies/swg-policy'.\nThis policy is specific to gateways of type 'SECURE_WEB_GATEWAY'. When `null`, the `gateway_security_policy` field will be omitted from the resulting object.\n  - `labels` (`obj`): Set of label tags associated with the Gateway resource.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location of the gateway.\nThe default value is 'global'. When `null`, the `location` field will be omitted from the resulting object.\n  - `name` (`string`): Short name of the Gateway resource to be created.\n  - `network` (`string`): The relative resource name identifying the VPC network that is using this configuration.\nFor example: 'projects/*/global/networks/network-1'.\nCurrently, this field is specific to gateways of type 'SECURE_WEB_GATEWAY'. When `null`, the `network` field will be omitted from the resulting object.\n  - `ports` (`list`): One or more port numbers (1-65535), on which the Gateway will receive traffic.\nThe proxy binds to the specified ports. Gateways of type 'SECURE_WEB_GATEWAY' are\nlimited to 1 port. Gateways of type 'OPEN_MESH' listen on 0.0.0.0 and support multiple ports.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `scope` (`string`): Immutable. Scope determines how configuration across multiple Gateway instances are merged.\nThe configuration for multiple Gateway instances with the same scope will be merged as presented as\na single coniguration to the proxy/load balancer.\nMax length 64 characters. Scope should start with a letter and can only have letters, numbers, hyphens. When `null`, the `scope` field will be omitted from the resulting object.\n  - `server_tls_policy` (`string`): A fully-qualified ServerTLSPolicy URL reference. Specifies how TLS traffic is terminated.\nIf empty, TLS termination is disabled. When `null`, the `server_tls_policy` field will be omitted from the resulting object.\n  - `subnetwork` (`string`): The relative resource name identifying the subnetwork in which this SWG is allocated.\nFor example: 'projects/*/regions/us-central1/subnetworks/network-1'.\nCurrently, this field is specific to gateways of type 'SECURE_WEB_GATEWAY. When `null`, the `subnetwork` field will be omitted from the resulting object.\n  - `type` (`string`): Immutable. The type of the customer-managed gateway. Possible values are: * OPEN_MESH * SECURE_WEB_GATEWAY. Possible values: ["TYPE_UNSPECIFIED", "OPEN_MESH", "SECURE_WEB_GATEWAY"]\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_services_gateway.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_services_gateway` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     ports,
diff --git a/4.x/_gen/resources/notebooks_instance.libsonnet b/4.x/_gen/resources/notebooks_instance.libsonnet
index 2bbe914b..a0150e6f 100644
--- a/4.x/_gen/resources/notebooks_instance.libsonnet
+++ b/4.x/_gen/resources/notebooks_instance.libsonnet
@@ -22,7 +22,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       tag: tag,
     }),
   },
-  '#new':: d.fn(help="\n`google.notebooks_instance.new` injects a new `google_notebooks_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.notebooks_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.notebooks_instance` using the reference:\n\n    $._ref.google_notebooks_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_notebooks_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `boot_disk_size_gb` (`number`): The size of the boot disk in GB attached to this instance,\nup to a maximum of 64000 GB (64 TB). The minimum recommended value is 100 GB.\nIf not specified, this defaults to 100. When `null`, the `boot_disk_size_gb` field will be omitted from the resulting object.\n  - `boot_disk_type` (`string`): Possible disk types for notebook instances. Possible values: [\u0026#34;DISK_TYPE_UNSPECIFIED\u0026#34;, \u0026#34;PD_STANDARD\u0026#34;, \u0026#34;PD_SSD\u0026#34;, \u0026#34;PD_BALANCED\u0026#34;, \u0026#34;PD_EXTREME\u0026#34;] When `null`, the `boot_disk_type` field will be omitted from the resulting object.\n  - `create_time` (`string`): Instance creation time When `null`, the `create_time` field will be omitted from the resulting object.\n  - `custom_gpu_driver_path` (`string`): Specify a custom Cloud Storage path where the GPU driver is stored.\nIf not specified, we\u0026#39;ll automatically choose from official GPU drivers. When `null`, the `custom_gpu_driver_path` field will be omitted from the resulting object.\n  - `data_disk_size_gb` (`number`): The size of the data disk in GB attached to this instance,\nup to a maximum of 64000 GB (64 TB).\nYou can choose the size of the data disk based on how big your notebooks and data are.\nIf not specified, this defaults to 100. When `null`, the `data_disk_size_gb` field will be omitted from the resulting object.\n  - `data_disk_type` (`string`): Possible disk types for notebook instances. Possible values: [\u0026#34;DISK_TYPE_UNSPECIFIED\u0026#34;, \u0026#34;PD_STANDARD\u0026#34;, \u0026#34;PD_SSD\u0026#34;, \u0026#34;PD_BALANCED\u0026#34;, \u0026#34;PD_EXTREME\u0026#34;] When `null`, the `data_disk_type` field will be omitted from the resulting object.\n  - `disk_encryption` (`string`): Disk encryption method used on the boot and data disks, defaults to GMEK. Possible values: [\u0026#34;DISK_ENCRYPTION_UNSPECIFIED\u0026#34;, \u0026#34;GMEK\u0026#34;, \u0026#34;CMEK\u0026#34;] When `null`, the `disk_encryption` field will be omitted from the resulting object.\n  - `install_gpu_driver` (`bool`): Whether the end user authorizes Google Cloud to install GPU driver\non this instance. If this field is empty or set to false, the GPU driver\nwon\u0026#39;t be installed. Only applicable to instances with GPUs. When `null`, the `install_gpu_driver` field will be omitted from the resulting object.\n  - `instance_owners` (`list`): The list of owners of this instance after creation.\nFormat: alias@example.com.\nCurrently supports one owner only.\nIf not specified, all of the service account users of\nyour VM instance\u0026#39;s service account can use the instance. When `null`, the `instance_owners` field will be omitted from the resulting object.\n  - `kms_key` (`string`): The KMS key used to encrypt the disks, only applicable if diskEncryption is CMEK.\nFormat: projects/{project_id}/locations/{location}/keyRings/{key_ring_id}/cryptoKeys/{key_id} When `null`, the `kms_key` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this instance. These can be later modified by the setLabels method.\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): A reference to the zone where the machine resides.\n  - `machine_type` (`string`): A reference to a machine type which defines VM kind.\n  - `metadata` (`obj`): Custom metadata to apply to this instance.\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `name` (`string`): The name specified for the Notebook instance.\n  - `network` (`string`): The name of the VPC that this instance is in.\nFormat: projects/{project_id}/global/networks/{network_id} When `null`, the `network` field will be omitted from the resulting object.\n  - `nic_type` (`string`): The type of vNIC driver. Possible values: [\u0026#34;UNSPECIFIED_NIC_TYPE\u0026#34;, \u0026#34;VIRTIO_NET\u0026#34;, \u0026#34;GVNIC\u0026#34;] When `null`, the `nic_type` field will be omitted from the resulting object.\n  - `no_proxy_access` (`bool`): The notebook instance will not register with the proxy.. When `null`, the `no_proxy_access` field will be omitted from the resulting object.\n  - `no_public_ip` (`bool`): No public IP will be assigned to this instance. When `null`, the `no_public_ip` field will be omitted from the resulting object.\n  - `no_remove_data_disk` (`bool`): If true, the data disk will not be auto deleted when deleting the instance. When `null`, the `no_remove_data_disk` field will be omitted from the resulting object.\n  - `post_startup_script` (`string`): Path to a Bash script that automatically runs after a\nnotebook instance fully boots up. The path must be a URL\nor Cloud Storage path (gs://path-to-file/file-name). When `null`, the `post_startup_script` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `service_account` (`string`): The service account on this instance, giving access to other\nGoogle Cloud services. You can use any service account within\nthe same project, but you must have the service account user\npermission to use the instance. If not specified,\nthe Compute Engine default service account is used. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `service_account_scopes` (`list`): Optional. The URIs of service account scopes to be included in Compute Engine instances.\nIf not specified, the following scopes are defined:\n- https://www.googleapis.com/auth/cloud-platform\n- https://www.googleapis.com/auth/userinfo.email When `null`, the `service_account_scopes` field will be omitted from the resulting object.\n  - `subnet` (`string`): The name of the subnet that this instance is in.\nFormat: projects/{project_id}/regions/{region}/subnetworks/{subnetwork_id} When `null`, the `subnet` field will be omitted from the resulting object.\n  - `tags` (`list`): The Compute Engine tags to add to instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `update_time` (`string`): Instance update time. When `null`, the `update_time` field will be omitted from the resulting object.\n  - `accelerator_config` (`list[obj]`): The hardware accelerator used on this instance. If you use accelerators,\nmake sure that your configuration has enough vCPUs and memory to support the\nmachineType you have selected. When `null`, the `accelerator_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.accelerator_config.new](#fn-accelerator_confignew) constructor.\n  - `container_image` (`list[obj]`): Use a container image to start the notebook instance. When `null`, the `container_image` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.container_image.new](#fn-container_imagenew) constructor.\n  - `reservation_affinity` (`list[obj]`): Reservation Affinity for consuming Zonal reservation. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `shielded_instance_config` (`list[obj]`): A set of Shielded Instance options. Check [Images using supported Shielded VM features]\nNot all combinations are valid When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vm_image` (`list[obj]`): Use a Compute Engine VM image to start the notebook instance. When `null`, the `vm_image` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.vm_image.new](#fn-vm_imagenew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.notebooks_instance.new` injects a new `google_notebooks_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.notebooks_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.notebooks_instance` using the reference:\n\n    $._ref.google_notebooks_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_notebooks_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `boot_disk_size_gb` (`number`): The size of the boot disk in GB attached to this instance,\nup to a maximum of 64000 GB (64 TB). The minimum recommended value is 100 GB.\nIf not specified, this defaults to 100. When `null`, the `boot_disk_size_gb` field will be omitted from the resulting object.\n  - `boot_disk_type` (`string`): Possible disk types for notebook instances. Possible values: [\u0026#34;DISK_TYPE_UNSPECIFIED\u0026#34;, \u0026#34;PD_STANDARD\u0026#34;, \u0026#34;PD_SSD\u0026#34;, \u0026#34;PD_BALANCED\u0026#34;, \u0026#34;PD_EXTREME\u0026#34;] When `null`, the `boot_disk_type` field will be omitted from the resulting object.\n  - `create_time` (`string`): Instance creation time When `null`, the `create_time` field will be omitted from the resulting object.\n  - `custom_gpu_driver_path` (`string`): Specify a custom Cloud Storage path where the GPU driver is stored.\nIf not specified, we\u0026#39;ll automatically choose from official GPU drivers. When `null`, the `custom_gpu_driver_path` field will be omitted from the resulting object.\n  - `data_disk_size_gb` (`number`): The size of the data disk in GB attached to this instance,\nup to a maximum of 64000 GB (64 TB).\nYou can choose the size of the data disk based on how big your notebooks and data are.\nIf not specified, this defaults to 100. When `null`, the `data_disk_size_gb` field will be omitted from the resulting object.\n  - `data_disk_type` (`string`): Possible disk types for notebook instances. Possible values: [\u0026#34;DISK_TYPE_UNSPECIFIED\u0026#34;, \u0026#34;PD_STANDARD\u0026#34;, \u0026#34;PD_SSD\u0026#34;, \u0026#34;PD_BALANCED\u0026#34;, \u0026#34;PD_EXTREME\u0026#34;] When `null`, the `data_disk_type` field will be omitted from the resulting object.\n  - `disk_encryption` (`string`): Disk encryption method used on the boot and data disks, defaults to GMEK. Possible values: [\u0026#34;DISK_ENCRYPTION_UNSPECIFIED\u0026#34;, \u0026#34;GMEK\u0026#34;, \u0026#34;CMEK\u0026#34;] When `null`, the `disk_encryption` field will be omitted from the resulting object.\n  - `install_gpu_driver` (`bool`): Whether the end user authorizes Google Cloud to install GPU driver\non this instance. If this field is empty or set to false, the GPU driver\nwon\u0026#39;t be installed. Only applicable to instances with GPUs. When `null`, the `install_gpu_driver` field will be omitted from the resulting object.\n  - `instance_owners` (`list`): The list of owners of this instance after creation.\nFormat: alias@example.com.\nCurrently supports one owner only.\nIf not specified, all of the service account users of\nyour VM instance\u0026#39;s service account can use the instance. When `null`, the `instance_owners` field will be omitted from the resulting object.\n  - `kms_key` (`string`): The KMS key used to encrypt the disks, only applicable if diskEncryption is CMEK.\nFormat: projects/{project_id}/locations/{location}/keyRings/{key_ring_id}/cryptoKeys/{key_id} When `null`, the `kms_key` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this instance. These can be later modified by the setLabels method.\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): A reference to the zone where the machine resides.\n  - `machine_type` (`string`): A reference to a machine type which defines VM kind.\n  - `metadata` (`obj`): Custom metadata to apply to this instance.\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `name` (`string`): The name specified for the Notebook instance.\n  - `network` (`string`): The name of the VPC that this instance is in.\nFormat: projects/{project_id}/global/networks/{network_id} When `null`, the `network` field will be omitted from the resulting object.\n  - `nic_type` (`string`): The type of vNIC driver. Possible values: [\u0026#34;UNSPECIFIED_NIC_TYPE\u0026#34;, \u0026#34;VIRTIO_NET\u0026#34;, \u0026#34;GVNIC\u0026#34;] When `null`, the `nic_type` field will be omitted from the resulting object.\n  - `no_proxy_access` (`bool`): The notebook instance will not register with the proxy.. When `null`, the `no_proxy_access` field will be omitted from the resulting object.\n  - `no_public_ip` (`bool`): No public IP will be assigned to this instance. When `null`, the `no_public_ip` field will be omitted from the resulting object.\n  - `no_remove_data_disk` (`bool`): If true, the data disk will not be auto deleted when deleting the instance. When `null`, the `no_remove_data_disk` field will be omitted from the resulting object.\n  - `post_startup_script` (`string`): Path to a Bash script that automatically runs after a\nnotebook instance fully boots up. The path must be a URL\nor Cloud Storage path (gs://path-to-file/file-name). When `null`, the `post_startup_script` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `service_account` (`string`): The service account on this instance, giving access to other\nGoogle Cloud services. You can use any service account within\nthe same project, but you must have the service account user\npermission to use the instance. If not specified,\nthe Compute Engine default service account is used. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `service_account_scopes` (`list`): Optional. The URIs of service account scopes to be included in Compute Engine instances.\nIf not specified, the following scopes are defined:\n- https://www.googleapis.com/auth/cloud-platform\n- https://www.googleapis.com/auth/userinfo.email When `null`, the `service_account_scopes` field will be omitted from the resulting object.\n  - `subnet` (`string`): The name of the subnet that this instance is in.\nFormat: projects/{project_id}/regions/{region}/subnetworks/{subnetwork_id} When `null`, the `subnet` field will be omitted from the resulting object.\n  - `tags` (`list`): The Compute Engine tags to add to instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `update_time` (`string`): Instance update time. When `null`, the `update_time` field will be omitted from the resulting object.\n  - `accelerator_config` (`list[obj]`): The hardware accelerator used on this instance. If you use accelerators,\nmake sure that your configuration has enough vCPUs and memory to support the\nmachineType you have selected. When `null`, the `accelerator_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.accelerator_config.new](#fn-accelerator_confignew) constructor.\n  - `container_image` (`list[obj]`): Use a container image to start the notebook instance. When `null`, the `container_image` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.container_image.new](#fn-container_imagenew) constructor.\n  - `reservation_affinity` (`list[obj]`): Reservation Affinity for consuming Zonal reservation. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `shielded_instance_config` (`list[obj]`): A set of Shielded Instance options. Check [Images using supported Shielded VM features]\nNot all combinations are valid When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vm_image` (`list[obj]`): Use a Compute Engine VM image to start the notebook instance. When `null`, the `vm_image` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.vm_image.new](#fn-vm_imagenew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -99,7 +99,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.notebooks_instance.newAttrs` constructs a new object with attributes and blocks configured for the `notebooks_instance`\nTerraform resource.\n\nUnlike [google.notebooks_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `boot_disk_size_gb` (`number`): The size of the boot disk in GB attached to this instance,\nup to a maximum of 64000 GB (64 TB). The minimum recommended value is 100 GB.\nIf not specified, this defaults to 100. When `null`, the `boot_disk_size_gb` field will be omitted from the resulting object.\n  - `boot_disk_type` (`string`): Possible disk types for notebook instances. Possible values: ["DISK_TYPE_UNSPECIFIED", "PD_STANDARD", "PD_SSD", "PD_BALANCED", "PD_EXTREME"] When `null`, the `boot_disk_type` field will be omitted from the resulting object.\n  - `create_time` (`string`): Instance creation time When `null`, the `create_time` field will be omitted from the resulting object.\n  - `custom_gpu_driver_path` (`string`): Specify a custom Cloud Storage path where the GPU driver is stored.\nIf not specified, we'll automatically choose from official GPU drivers. When `null`, the `custom_gpu_driver_path` field will be omitted from the resulting object.\n  - `data_disk_size_gb` (`number`): The size of the data disk in GB attached to this instance,\nup to a maximum of 64000 GB (64 TB).\nYou can choose the size of the data disk based on how big your notebooks and data are.\nIf not specified, this defaults to 100. When `null`, the `data_disk_size_gb` field will be omitted from the resulting object.\n  - `data_disk_type` (`string`): Possible disk types for notebook instances. Possible values: ["DISK_TYPE_UNSPECIFIED", "PD_STANDARD", "PD_SSD", "PD_BALANCED", "PD_EXTREME"] When `null`, the `data_disk_type` field will be omitted from the resulting object.\n  - `disk_encryption` (`string`): Disk encryption method used on the boot and data disks, defaults to GMEK. Possible values: ["DISK_ENCRYPTION_UNSPECIFIED", "GMEK", "CMEK"] When `null`, the `disk_encryption` field will be omitted from the resulting object.\n  - `install_gpu_driver` (`bool`): Whether the end user authorizes Google Cloud to install GPU driver\non this instance. If this field is empty or set to false, the GPU driver\nwon't be installed. Only applicable to instances with GPUs. When `null`, the `install_gpu_driver` field will be omitted from the resulting object.\n  - `instance_owners` (`list`): The list of owners of this instance after creation.\nFormat: alias@example.com.\nCurrently supports one owner only.\nIf not specified, all of the service account users of\nyour VM instance's service account can use the instance. When `null`, the `instance_owners` field will be omitted from the resulting object.\n  - `kms_key` (`string`): The KMS key used to encrypt the disks, only applicable if diskEncryption is CMEK.\nFormat: projects/{project_id}/locations/{location}/keyRings/{key_ring_id}/cryptoKeys/{key_id} When `null`, the `kms_key` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this instance. These can be later modified by the setLabels method.\nAn object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): A reference to the zone where the machine resides.\n  - `machine_type` (`string`): A reference to a machine type which defines VM kind.\n  - `metadata` (`obj`): Custom metadata to apply to this instance.\nAn object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `name` (`string`): The name specified for the Notebook instance.\n  - `network` (`string`): The name of the VPC that this instance is in.\nFormat: projects/{project_id}/global/networks/{network_id} When `null`, the `network` field will be omitted from the resulting object.\n  - `nic_type` (`string`): The type of vNIC driver. Possible values: ["UNSPECIFIED_NIC_TYPE", "VIRTIO_NET", "GVNIC"] When `null`, the `nic_type` field will be omitted from the resulting object.\n  - `no_proxy_access` (`bool`): The notebook instance will not register with the proxy.. When `null`, the `no_proxy_access` field will be omitted from the resulting object.\n  - `no_public_ip` (`bool`): No public IP will be assigned to this instance. When `null`, the `no_public_ip` field will be omitted from the resulting object.\n  - `no_remove_data_disk` (`bool`): If true, the data disk will not be auto deleted when deleting the instance. When `null`, the `no_remove_data_disk` field will be omitted from the resulting object.\n  - `post_startup_script` (`string`): Path to a Bash script that automatically runs after a\nnotebook instance fully boots up. The path must be a URL\nor Cloud Storage path (gs://path-to-file/file-name). When `null`, the `post_startup_script` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `service_account` (`string`): The service account on this instance, giving access to other\nGoogle Cloud services. You can use any service account within\nthe same project, but you must have the service account user\npermission to use the instance. If not specified,\nthe Compute Engine default service account is used. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `service_account_scopes` (`list`): Optional. The URIs of service account scopes to be included in Compute Engine instances.\nIf not specified, the following scopes are defined:\n- https://www.googleapis.com/auth/cloud-platform\n- https://www.googleapis.com/auth/userinfo.email When `null`, the `service_account_scopes` field will be omitted from the resulting object.\n  - `subnet` (`string`): The name of the subnet that this instance is in.\nFormat: projects/{project_id}/regions/{region}/subnetworks/{subnetwork_id} When `null`, the `subnet` field will be omitted from the resulting object.\n  - `tags` (`list`): The Compute Engine tags to add to instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `update_time` (`string`): Instance update time. When `null`, the `update_time` field will be omitted from the resulting object.\n  - `accelerator_config` (`list[obj]`): The hardware accelerator used on this instance. If you use accelerators,\nmake sure that your configuration has enough vCPUs and memory to support the\nmachineType you have selected. When `null`, the `accelerator_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.accelerator_config.new](#fn-accelerator_confignew) constructor.\n  - `container_image` (`list[obj]`): Use a container image to start the notebook instance. When `null`, the `container_image` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.container_image.new](#fn-container_imagenew) constructor.\n  - `reservation_affinity` (`list[obj]`): Reservation Affinity for consuming Zonal reservation. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `shielded_instance_config` (`list[obj]`): A set of Shielded Instance options. Check [Images using supported Shielded VM features]\nNot all combinations are valid When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vm_image` (`list[obj]`): Use a Compute Engine VM image to start the notebook instance. When `null`, the `vm_image` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.vm_image.new](#fn-vm_imagenew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `notebooks_instance` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.notebooks_instance.newAttrs` constructs a new object with attributes and blocks configured for the `notebooks_instance`\nTerraform resource.\n\nUnlike [google.notebooks_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `boot_disk_size_gb` (`number`): The size of the boot disk in GB attached to this instance,\nup to a maximum of 64000 GB (64 TB). The minimum recommended value is 100 GB.\nIf not specified, this defaults to 100. When `null`, the `boot_disk_size_gb` field will be omitted from the resulting object.\n  - `boot_disk_type` (`string`): Possible disk types for notebook instances. Possible values: ["DISK_TYPE_UNSPECIFIED", "PD_STANDARD", "PD_SSD", "PD_BALANCED", "PD_EXTREME"] When `null`, the `boot_disk_type` field will be omitted from the resulting object.\n  - `create_time` (`string`): Instance creation time When `null`, the `create_time` field will be omitted from the resulting object.\n  - `custom_gpu_driver_path` (`string`): Specify a custom Cloud Storage path where the GPU driver is stored.\nIf not specified, we'll automatically choose from official GPU drivers. When `null`, the `custom_gpu_driver_path` field will be omitted from the resulting object.\n  - `data_disk_size_gb` (`number`): The size of the data disk in GB attached to this instance,\nup to a maximum of 64000 GB (64 TB).\nYou can choose the size of the data disk based on how big your notebooks and data are.\nIf not specified, this defaults to 100. When `null`, the `data_disk_size_gb` field will be omitted from the resulting object.\n  - `data_disk_type` (`string`): Possible disk types for notebook instances. Possible values: ["DISK_TYPE_UNSPECIFIED", "PD_STANDARD", "PD_SSD", "PD_BALANCED", "PD_EXTREME"] When `null`, the `data_disk_type` field will be omitted from the resulting object.\n  - `disk_encryption` (`string`): Disk encryption method used on the boot and data disks, defaults to GMEK. Possible values: ["DISK_ENCRYPTION_UNSPECIFIED", "GMEK", "CMEK"] When `null`, the `disk_encryption` field will be omitted from the resulting object.\n  - `install_gpu_driver` (`bool`): Whether the end user authorizes Google Cloud to install GPU driver\non this instance. If this field is empty or set to false, the GPU driver\nwon't be installed. Only applicable to instances with GPUs. When `null`, the `install_gpu_driver` field will be omitted from the resulting object.\n  - `instance_owners` (`list`): The list of owners of this instance after creation.\nFormat: alias@example.com.\nCurrently supports one owner only.\nIf not specified, all of the service account users of\nyour VM instance's service account can use the instance. When `null`, the `instance_owners` field will be omitted from the resulting object.\n  - `kms_key` (`string`): The KMS key used to encrypt the disks, only applicable if diskEncryption is CMEK.\nFormat: projects/{project_id}/locations/{location}/keyRings/{key_ring_id}/cryptoKeys/{key_id} When `null`, the `kms_key` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels to apply to this instance. These can be later modified by the setLabels method.\nAn object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): A reference to the zone where the machine resides.\n  - `machine_type` (`string`): A reference to a machine type which defines VM kind.\n  - `metadata` (`obj`): Custom metadata to apply to this instance.\nAn object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `name` (`string`): The name specified for the Notebook instance.\n  - `network` (`string`): The name of the VPC that this instance is in.\nFormat: projects/{project_id}/global/networks/{network_id} When `null`, the `network` field will be omitted from the resulting object.\n  - `nic_type` (`string`): The type of vNIC driver. Possible values: ["UNSPECIFIED_NIC_TYPE", "VIRTIO_NET", "GVNIC"] When `null`, the `nic_type` field will be omitted from the resulting object.\n  - `no_proxy_access` (`bool`): The notebook instance will not register with the proxy.. When `null`, the `no_proxy_access` field will be omitted from the resulting object.\n  - `no_public_ip` (`bool`): No public IP will be assigned to this instance. When `null`, the `no_public_ip` field will be omitted from the resulting object.\n  - `no_remove_data_disk` (`bool`): If true, the data disk will not be auto deleted when deleting the instance. When `null`, the `no_remove_data_disk` field will be omitted from the resulting object.\n  - `post_startup_script` (`string`): Path to a Bash script that automatically runs after a\nnotebook instance fully boots up. The path must be a URL\nor Cloud Storage path (gs://path-to-file/file-name). When `null`, the `post_startup_script` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `service_account` (`string`): The service account on this instance, giving access to other\nGoogle Cloud services. You can use any service account within\nthe same project, but you must have the service account user\npermission to use the instance. If not specified,\nthe Compute Engine default service account is used. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `service_account_scopes` (`list`): Optional. The URIs of service account scopes to be included in Compute Engine instances.\nIf not specified, the following scopes are defined:\n- https://www.googleapis.com/auth/cloud-platform\n- https://www.googleapis.com/auth/userinfo.email When `null`, the `service_account_scopes` field will be omitted from the resulting object.\n  - `subnet` (`string`): The name of the subnet that this instance is in.\nFormat: projects/{project_id}/regions/{region}/subnetworks/{subnetwork_id} When `null`, the `subnet` field will be omitted from the resulting object.\n  - `tags` (`list`): The Compute Engine tags to add to instance. When `null`, the `tags` field will be omitted from the resulting object.\n  - `update_time` (`string`): Instance update time. When `null`, the `update_time` field will be omitted from the resulting object.\n  - `accelerator_config` (`list[obj]`): The hardware accelerator used on this instance. If you use accelerators,\nmake sure that your configuration has enough vCPUs and memory to support the\nmachineType you have selected. When `null`, the `accelerator_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.accelerator_config.new](#fn-accelerator_confignew) constructor.\n  - `container_image` (`list[obj]`): Use a container image to start the notebook instance. When `null`, the `container_image` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.container_image.new](#fn-container_imagenew) constructor.\n  - `reservation_affinity` (`list[obj]`): Reservation Affinity for consuming Zonal reservation. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.reservation_affinity.new](#fn-reservation_affinitynew) constructor.\n  - `shielded_instance_config` (`list[obj]`): A set of Shielded Instance options. Check [Images using supported Shielded VM features]\nNot all combinations are valid When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.shielded_instance_config.new](#fn-shielded_instance_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.timeouts.new](#fn-timeoutsnew) constructor.\n  - `vm_image` (`list[obj]`): Use a Compute Engine VM image to start the notebook instance. When `null`, the `vm_image` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.notebooks_instance.vm_image.new](#fn-vm_imagenew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `notebooks_instance` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     machine_type,
diff --git a/4.x/_gen/resources/org_policy_custom_constraint.libsonnet b/4.x/_gen/resources/org_policy_custom_constraint.libsonnet
new file mode 100644
index 00000000..a0c76dc9
--- /dev/null
+++ b/4.x/_gen/resources/org_policy_custom_constraint.libsonnet
@@ -0,0 +1,168 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='org_policy_custom_constraint', url='', help='`org_policy_custom_constraint` represents the `google_org_policy_custom_constraint` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.org_policy_custom_constraint.new` injects a new `google_org_policy_custom_constraint` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.org_policy_custom_constraint.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.org_policy_custom_constraint` using the reference:\n\n    $._ref.google_org_policy_custom_constraint.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_org_policy_custom_constraint.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `action_type` (`string`): The action to take if the condition is met. Possible values: [\u0026#34;ALLOW\u0026#34;, \u0026#34;DENY\u0026#34;]\n  - `condition` (`string`): A CEL condition that refers to a supported service resource, for example \u0026#39;resource.management.autoUpgrade == false\u0026#39;. For details about CEL usage, see [Common Expression Language](https://cloud.google.com/resource-manager/docs/organization-policy/creating-managing-custom-constraints#common_expression_language).\n  - `description` (`string`): A human-friendly description of the constraint to display as an error message when the policy is violated. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): A human-friendly name for the constraint. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `method_types` (`list`): A list of RESTful methods for which to enforce the constraint. Can be \u0026#39;CREATE\u0026#39;, \u0026#39;UPDATE\u0026#39;, or both. Not all Google Cloud services support both methods. To see supported methods for each service, find the service in [Supported services](https://cloud.google.com/resource-manager/docs/organization-policy/custom-constraint-supported-services).\n  - `name` (`string`): Immutable. The name of the custom constraint. This is unique within the organization.\n  - `parent` (`string`): The parent of the resource, an organization. Format should be \u0026#39;organizations/{organization_id}\u0026#39;.\n  - `resource_types` (`list`): Immutable. The fully qualified name of the Google Cloud REST resource containing the object and field you want to restrict. For example, \u0026#39;container.googleapis.com/NodePool\u0026#39;.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_custom_constraint.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    action_type,
+    condition,
+    method_types,
+    name,
+    parent,
+    resource_types,
+    description=null,
+    display_name=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_org_policy_custom_constraint',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      action_type=action_type,
+      condition=condition,
+      description=description,
+      display_name=display_name,
+      method_types=method_types,
+      name=name,
+      parent=parent,
+      resource_types=resource_types,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.org_policy_custom_constraint.newAttrs` constructs a new object with attributes and blocks configured for the `org_policy_custom_constraint`\nTerraform resource.\n\nUnlike [google.org_policy_custom_constraint.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `action_type` (`string`): The action to take if the condition is met. Possible values: ["ALLOW", "DENY"]\n  - `condition` (`string`): A CEL condition that refers to a supported service resource, for example 'resource.management.autoUpgrade == false'. For details about CEL usage, see [Common Expression Language](https://cloud.google.com/resource-manager/docs/organization-policy/creating-managing-custom-constraints#common_expression_language).\n  - `description` (`string`): A human-friendly description of the constraint to display as an error message when the policy is violated. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): A human-friendly name for the constraint. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `method_types` (`list`): A list of RESTful methods for which to enforce the constraint. Can be 'CREATE', 'UPDATE', or both. Not all Google Cloud services support both methods. To see supported methods for each service, find the service in [Supported services](https://cloud.google.com/resource-manager/docs/organization-policy/custom-constraint-supported-services).\n  - `name` (`string`): Immutable. The name of the custom constraint. This is unique within the organization.\n  - `parent` (`string`): The parent of the resource, an organization. Format should be 'organizations/{organization_id}'.\n  - `resource_types` (`list`): Immutable. The fully qualified name of the Google Cloud REST resource containing the object and field you want to restrict. For example, 'container.googleapis.com/NodePool'.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_custom_constraint.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `org_policy_custom_constraint` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    action_type,
+    condition,
+    method_types,
+    name,
+    parent,
+    resource_types,
+    description=null,
+    display_name=null,
+    timeouts=null
+  ):: std.prune(a={
+    action_type: action_type,
+    condition: condition,
+    description: description,
+    display_name: display_name,
+    method_types: method_types,
+    name: name,
+    parent: parent,
+    resource_types: resource_types,
+    timeouts: timeouts,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.org_policy_custom_constraint.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withActionType':: d.fn(help='`google.string.withActionType` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the action_type field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `action_type` field.\n', args=[]),
+  withActionType(resourceLabel, value): {
+    resource+: {
+      google_org_policy_custom_constraint+: {
+        [resourceLabel]+: {
+          action_type: value,
+        },
+      },
+    },
+  },
+  '#withCondition':: d.fn(help='`google.string.withCondition` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the condition field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `condition` field.\n', args=[]),
+  withCondition(resourceLabel, value): {
+    resource+: {
+      google_org_policy_custom_constraint+: {
+        [resourceLabel]+: {
+          condition: value,
+        },
+      },
+    },
+  },
+  '#withDescription':: d.fn(help='`google.string.withDescription` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the description field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `description` field.\n', args=[]),
+  withDescription(resourceLabel, value): {
+    resource+: {
+      google_org_policy_custom_constraint+: {
+        [resourceLabel]+: {
+          description: value,
+        },
+      },
+    },
+  },
+  '#withDisplayName':: d.fn(help='`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the display_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `display_name` field.\n', args=[]),
+  withDisplayName(resourceLabel, value): {
+    resource+: {
+      google_org_policy_custom_constraint+: {
+        [resourceLabel]+: {
+          display_name: value,
+        },
+      },
+    },
+  },
+  '#withMethodTypes':: d.fn(help='`google.list.withMethodTypes` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the method_types field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `method_types` field.\n', args=[]),
+  withMethodTypes(resourceLabel, value): {
+    resource+: {
+      google_org_policy_custom_constraint+: {
+        [resourceLabel]+: {
+          method_types: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_org_policy_custom_constraint+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withParent':: d.fn(help='`google.string.withParent` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the parent field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `parent` field.\n', args=[]),
+  withParent(resourceLabel, value): {
+    resource+: {
+      google_org_policy_custom_constraint+: {
+        [resourceLabel]+: {
+          parent: value,
+        },
+      },
+    },
+  },
+  '#withResourceTypes':: d.fn(help='`google.list.withResourceTypes` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the resource_types field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `resource_types` field.\n', args=[]),
+  withResourceTypes(resourceLabel, value): {
+    resource+: {
+      google_org_policy_custom_constraint+: {
+        [resourceLabel]+: {
+          resource_types: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_org_policy_custom_constraint+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_org_policy_custom_constraint+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/os_config_patch_deployment.libsonnet b/4.x/_gen/resources/os_config_patch_deployment.libsonnet
index 3ca69dd5..27d5efba 100644
--- a/4.x/_gen/resources/os_config_patch_deployment.libsonnet
+++ b/4.x/_gen/resources/os_config_patch_deployment.libsonnet
@@ -312,12 +312,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         week_day_of_month: week_day_of_month,
       }),
       week_day_of_month:: {
-        '#new':: d.fn(help='\n`google.os_config_patch_deployment.recurring_schedule.monthly.week_day_of_month.new` constructs a new object with attributes and blocks configured for the `week_day_of_month`\nTerraform sub block.\n\n\n\n**Args**:\n  - `day_of_week` (`string`): A day of the week. Possible values: ["MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY", "SUNDAY"]\n  - `week_ordinal` (`number`): Week number in a month. 1-4 indicates the 1st to 4th week of the month. -1 indicates the last week of the month.\n\n**Returns**:\n  - An attribute object that represents the `week_day_of_month` sub block.\n', args=[]),
+        '#new':: d.fn(help='\n`google.os_config_patch_deployment.recurring_schedule.monthly.week_day_of_month.new` constructs a new object with attributes and blocks configured for the `week_day_of_month`\nTerraform sub block.\n\n\n\n**Args**:\n  - `day_of_week` (`string`): A day of the week. Possible values: ["MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY", "SUNDAY"]\n  - `day_offset` (`number`): Represents the number of days before or after the given week day of month that the patch deployment is scheduled for. When `null`, the `day_offset` field will be omitted from the resulting object.\n  - `week_ordinal` (`number`): Week number in a month. 1-4 indicates the 1st to 4th week of the month. -1 indicates the last week of the month.\n\n**Returns**:\n  - An attribute object that represents the `week_day_of_month` sub block.\n', args=[]),
         new(
           day_of_week,
-          week_ordinal
+          week_ordinal,
+          day_offset=null
         ):: std.prune(a={
           day_of_week: day_of_week,
+          day_offset: day_offset,
           week_ordinal: week_ordinal,
         }),
       },
diff --git a/4.x/_gen/resources/privateca_ca_pool.libsonnet b/4.x/_gen/resources/privateca_ca_pool.libsonnet
index dc4713e6..0b3fb4af 100644
--- a/4.x/_gen/resources/privateca_ca_pool.libsonnet
+++ b/4.x/_gen/resources/privateca_ca_pool.libsonnet
@@ -228,7 +228,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       maximum_lifetime: maximum_lifetime,
     }),
   },
-  '#new':: d.fn(help="\n`google.privateca_ca_pool.new` injects a new `google_privateca_ca_pool` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.privateca_ca_pool.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.privateca_ca_pool` using the reference:\n\n    $._ref.google_privateca_ca_pool.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_privateca_ca_pool.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `labels` (`obj`): Labels with user-defined metadata.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;:\n\u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the CaPool. A full list of valid locations can be found by\nrunning \u0026#39;gcloud privateca locations list\u0026#39;.\n  - `name` (`string`): The name for this CaPool.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `tier` (`string`): The Tier of this CaPool. Possible values: [\u0026#34;ENTERPRISE\u0026#34;, \u0026#34;DEVOPS\u0026#34;]\n  - `issuance_policy` (`list[obj]`): The IssuancePolicy to control how Certificates will be issued from this CaPool. When `null`, the `issuance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_ca_pool.issuance_policy.new](#fn-issuance_policynew) constructor.\n  - `publishing_options` (`list[obj]`): The PublishingOptions to follow when issuing Certificates from any CertificateAuthority in this CaPool. When `null`, the `publishing_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_ca_pool.publishing_options.new](#fn-publishing_optionsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_ca_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.privateca_ca_pool.new` injects a new `google_privateca_ca_pool` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.privateca_ca_pool.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.privateca_ca_pool` using the reference:\n\n    $._ref.google_privateca_ca_pool.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_privateca_ca_pool.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `labels` (`obj`): Labels with user-defined metadata.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;:\n\u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the CaPool. A full list of valid locations can be found by\nrunning \u0026#39;gcloud privateca locations list\u0026#39;.\n  - `name` (`string`): The name for this CaPool.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `tier` (`string`): The Tier of this CaPool. Possible values: [\u0026#34;ENTERPRISE\u0026#34;, \u0026#34;DEVOPS\u0026#34;]\n  - `issuance_policy` (`list[obj]`): The IssuancePolicy to control how Certificates will be issued from this CaPool. When `null`, the `issuance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_ca_pool.issuance_policy.new](#fn-issuance_policynew) constructor.\n  - `publishing_options` (`list[obj]`): The PublishingOptions to follow when issuing Certificates from any CertificateAuthority in this CaPool. When `null`, the `publishing_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_ca_pool.publishing_options.new](#fn-publishing_optionsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_ca_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -255,7 +255,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.privateca_ca_pool.newAttrs` constructs a new object with attributes and blocks configured for the `privateca_ca_pool`\nTerraform resource.\n\nUnlike [google.privateca_ca_pool.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `labels` (`obj`): Labels with user-defined metadata.\n\nAn object containing a list of "key": value pairs. Example: { "name": "wrench", "mass":\n"1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the CaPool. A full list of valid locations can be found by\nrunning 'gcloud privateca locations list'.\n  - `name` (`string`): The name for this CaPool.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `tier` (`string`): The Tier of this CaPool. Possible values: ["ENTERPRISE", "DEVOPS"]\n  - `issuance_policy` (`list[obj]`): The IssuancePolicy to control how Certificates will be issued from this CaPool. When `null`, the `issuance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_ca_pool.issuance_policy.new](#fn-issuance_policynew) constructor.\n  - `publishing_options` (`list[obj]`): The PublishingOptions to follow when issuing Certificates from any CertificateAuthority in this CaPool. When `null`, the `publishing_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_ca_pool.publishing_options.new](#fn-publishing_optionsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_ca_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `privateca_ca_pool` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.privateca_ca_pool.newAttrs` constructs a new object with attributes and blocks configured for the `privateca_ca_pool`\nTerraform resource.\n\nUnlike [google.privateca_ca_pool.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `labels` (`obj`): Labels with user-defined metadata.\n\nAn object containing a list of "key": value pairs. Example: { "name": "wrench", "mass":\n"1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the CaPool. A full list of valid locations can be found by\nrunning 'gcloud privateca locations list'.\n  - `name` (`string`): The name for this CaPool.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `tier` (`string`): The Tier of this CaPool. Possible values: ["ENTERPRISE", "DEVOPS"]\n  - `issuance_policy` (`list[obj]`): The IssuancePolicy to control how Certificates will be issued from this CaPool. When `null`, the `issuance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_ca_pool.issuance_policy.new](#fn-issuance_policynew) constructor.\n  - `publishing_options` (`list[obj]`): The PublishingOptions to follow when issuing Certificates from any CertificateAuthority in this CaPool. When `null`, the `publishing_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_ca_pool.publishing_options.new](#fn-publishing_optionsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_ca_pool.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `privateca_ca_pool` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     name,
diff --git a/4.x/_gen/resources/privateca_certificate.libsonnet b/4.x/_gen/resources/privateca_certificate.libsonnet
index 5721d30c..f4d0a14e 100644
--- a/4.x/_gen/resources/privateca_certificate.libsonnet
+++ b/4.x/_gen/resources/privateca_certificate.libsonnet
@@ -216,7 +216,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
-  '#new':: d.fn(help="\n`google.privateca_certificate.new` injects a new `google_privateca_certificate` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.privateca_certificate.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.privateca_certificate` using the reference:\n\n    $._ref.google_privateca_certificate.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_privateca_certificate.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `certificate_authority` (`string`): The Certificate Authority ID that should issue the certificate. For example, to issue a Certificate from\na Certificate Authority with resource name \u0026#39;projects/my-project/locations/us-central1/caPools/my-pool/certificateAuthorities/my-ca\u0026#39;,\nargument \u0026#39;pool\u0026#39; should be set to \u0026#39;projects/my-project/locations/us-central1/caPools/my-pool\u0026#39;, argument \u0026#39;certificate_authority\u0026#39;\nshould be set to \u0026#39;my-ca\u0026#39;. When `null`, the `certificate_authority` field will be omitted from the resulting object.\n  - `certificate_template` (`string`): The resource name for a CertificateTemplate used to issue this certificate,\nin the format \u0026#39;projects/*/locations/*/certificateTemplates/*\u0026#39;. If this is specified,\nthe caller must have the necessary permission to use this template. If this is\nomitted, no template will be used. This template must be in the same location\nas the Certificate. When `null`, the `certificate_template` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lifetime` (`string`): The desired lifetime of the CA certificate. Used to create the \u0026#34;notBeforeTime\u0026#34; and\n\u0026#34;notAfterTime\u0026#34; fields inside an X.509 certificate. A duration in seconds with up to nine\nfractional digits, terminated by \u0026#39;s\u0026#39;. Example: \u0026#34;3.5s\u0026#34;. When `null`, the `lifetime` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the Certificate. A full list of valid locations can be found by\nrunning \u0026#39;gcloud privateca locations list\u0026#39;.\n  - `name` (`string`): The name for this Certificate.\n  - `pem_csr` (`string`): Immutable. A pem-encoded X.509 certificate signing request (CSR). When `null`, the `pem_csr` field will be omitted from the resulting object.\n  - `pool` (`string`): The name of the CaPool this Certificate belongs to.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `config` (`list[obj]`): The config used to create a self-signed X.509 certificate or CSR. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate.config.new](#fn-confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.privateca_certificate.new` injects a new `google_privateca_certificate` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.privateca_certificate.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.privateca_certificate` using the reference:\n\n    $._ref.google_privateca_certificate.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_privateca_certificate.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `certificate_authority` (`string`): The Certificate Authority ID that should issue the certificate. For example, to issue a Certificate from\na Certificate Authority with resource name \u0026#39;projects/my-project/locations/us-central1/caPools/my-pool/certificateAuthorities/my-ca\u0026#39;,\nargument \u0026#39;pool\u0026#39; should be set to \u0026#39;projects/my-project/locations/us-central1/caPools/my-pool\u0026#39;, argument \u0026#39;certificate_authority\u0026#39;\nshould be set to \u0026#39;my-ca\u0026#39;. When `null`, the `certificate_authority` field will be omitted from the resulting object.\n  - `certificate_template` (`string`): The resource name for a CertificateTemplate used to issue this certificate,\nin the format \u0026#39;projects/*/locations/*/certificateTemplates/*\u0026#39;. If this is specified,\nthe caller must have the necessary permission to use this template. If this is\nomitted, no template will be used. This template must be in the same location\nas the Certificate. When `null`, the `certificate_template` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lifetime` (`string`): The desired lifetime of the CA certificate. Used to create the \u0026#34;notBeforeTime\u0026#34; and\n\u0026#34;notAfterTime\u0026#34; fields inside an X.509 certificate. A duration in seconds with up to nine\nfractional digits, terminated by \u0026#39;s\u0026#39;. Example: \u0026#34;3.5s\u0026#34;. When `null`, the `lifetime` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the Certificate. A full list of valid locations can be found by\nrunning \u0026#39;gcloud privateca locations list\u0026#39;.\n  - `name` (`string`): The name for this Certificate.\n  - `pem_csr` (`string`): Immutable. A pem-encoded X.509 certificate signing request (CSR). When `null`, the `pem_csr` field will be omitted from the resulting object.\n  - `pool` (`string`): The name of the CaPool this Certificate belongs to.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `config` (`list[obj]`): The config used to create a self-signed X.509 certificate or CSR. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate.config.new](#fn-confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -249,7 +249,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.privateca_certificate.newAttrs` constructs a new object with attributes and blocks configured for the `privateca_certificate`\nTerraform resource.\n\nUnlike [google.privateca_certificate.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `certificate_authority` (`string`): The Certificate Authority ID that should issue the certificate. For example, to issue a Certificate from\na Certificate Authority with resource name 'projects/my-project/locations/us-central1/caPools/my-pool/certificateAuthorities/my-ca',\nargument 'pool' should be set to 'projects/my-project/locations/us-central1/caPools/my-pool', argument 'certificate_authority'\nshould be set to 'my-ca'. When `null`, the `certificate_authority` field will be omitted from the resulting object.\n  - `certificate_template` (`string`): The resource name for a CertificateTemplate used to issue this certificate,\nin the format 'projects/*/locations/*/certificateTemplates/*'. If this is specified,\nthe caller must have the necessary permission to use this template. If this is\nomitted, no template will be used. This template must be in the same location\nas the Certificate. When `null`, the `certificate_template` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lifetime` (`string`): The desired lifetime of the CA certificate. Used to create the "notBeforeTime" and\n"notAfterTime" fields inside an X.509 certificate. A duration in seconds with up to nine\nfractional digits, terminated by 's'. Example: "3.5s". When `null`, the `lifetime` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the Certificate. A full list of valid locations can be found by\nrunning 'gcloud privateca locations list'.\n  - `name` (`string`): The name for this Certificate.\n  - `pem_csr` (`string`): Immutable. A pem-encoded X.509 certificate signing request (CSR). When `null`, the `pem_csr` field will be omitted from the resulting object.\n  - `pool` (`string`): The name of the CaPool this Certificate belongs to.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `config` (`list[obj]`): The config used to create a self-signed X.509 certificate or CSR. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate.config.new](#fn-confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `privateca_certificate` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.privateca_certificate.newAttrs` constructs a new object with attributes and blocks configured for the `privateca_certificate`\nTerraform resource.\n\nUnlike [google.privateca_certificate.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `certificate_authority` (`string`): The Certificate Authority ID that should issue the certificate. For example, to issue a Certificate from\na Certificate Authority with resource name 'projects/my-project/locations/us-central1/caPools/my-pool/certificateAuthorities/my-ca',\nargument 'pool' should be set to 'projects/my-project/locations/us-central1/caPools/my-pool', argument 'certificate_authority'\nshould be set to 'my-ca'. When `null`, the `certificate_authority` field will be omitted from the resulting object.\n  - `certificate_template` (`string`): The resource name for a CertificateTemplate used to issue this certificate,\nin the format 'projects/*/locations/*/certificateTemplates/*'. If this is specified,\nthe caller must have the necessary permission to use this template. If this is\nomitted, no template will be used. This template must be in the same location\nas the Certificate. When `null`, the `certificate_template` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lifetime` (`string`): The desired lifetime of the CA certificate. Used to create the "notBeforeTime" and\n"notAfterTime" fields inside an X.509 certificate. A duration in seconds with up to nine\nfractional digits, terminated by 's'. Example: "3.5s". When `null`, the `lifetime` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the Certificate. A full list of valid locations can be found by\nrunning 'gcloud privateca locations list'.\n  - `name` (`string`): The name for this Certificate.\n  - `pem_csr` (`string`): Immutable. A pem-encoded X.509 certificate signing request (CSR). When `null`, the `pem_csr` field will be omitted from the resulting object.\n  - `pool` (`string`): The name of the CaPool this Certificate belongs to.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `config` (`list[obj]`): The config used to create a self-signed X.509 certificate or CSR. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate.config.new](#fn-confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `privateca_certificate` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     name,
diff --git a/4.x/_gen/resources/privateca_certificate_authority.libsonnet b/4.x/_gen/resources/privateca_certificate_authority.libsonnet
index 79627942..59fb2d88 100644
--- a/4.x/_gen/resources/privateca_certificate_authority.libsonnet
+++ b/4.x/_gen/resources/privateca_certificate_authority.libsonnet
@@ -214,7 +214,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       cloud_kms_key_version: cloud_kms_key_version,
     }),
   },
-  '#new':: d.fn(help="\n`google.privateca_certificate_authority.new` injects a new `google_privateca_certificate_authority` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.privateca_certificate_authority.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.privateca_certificate_authority` using the reference:\n\n    $._ref.google_privateca_certificate_authority.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_privateca_certificate_authority.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `certificate_authority_id` (`string`): The user provided Resource ID for this Certificate Authority.\n  - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the CertificateAuthority. Unless this field is set to false\nin Terraform state, a \u0026#39;terraform destroy\u0026#39; or \u0026#39;terraform apply\u0026#39; that would delete the instance will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `desired_state` (`string`): Desired state of the CertificateAuthority. Set this field to \u0026#39;STAGED\u0026#39; to create a \u0026#39;STAGED\u0026#39; root CA. When `null`, the `desired_state` field will be omitted from the resulting object.\n  - `gcs_bucket` (`string`): The name of a Cloud Storage bucket where this CertificateAuthority will publish content,\nsuch as the CA certificate and CRLs. This must be a bucket name, without any prefixes\n(such as \u0026#39;gs://\u0026#39;) or suffixes (such as \u0026#39;.googleapis.com\u0026#39;). For example, to use a bucket named\nmy-bucket, you would simply specify \u0026#39;my-bucket\u0026#39;. If not specified, a managed bucket will be\ncreated. When `null`, the `gcs_bucket` field will be omitted from the resulting object.\n  - `ignore_active_certificates_on_deletion` (`bool`): This field allows the CA to be deleted even if the CA has active certs. Active certs include both unrevoked and unexpired certs.\nUse with care. Defaults to \u0026#39;false\u0026#39;. When `null`, the `ignore_active_certificates_on_deletion` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels with user-defined metadata.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;:\n\u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lifetime` (`string`): The desired lifetime of the CA certificate. Used to create the \u0026#34;notBeforeTime\u0026#34; and\n\u0026#34;notAfterTime\u0026#34; fields inside an X.509 certificate. A duration in seconds with up to nine\nfractional digits, terminated by \u0026#39;s\u0026#39;. Example: \u0026#34;3.5s\u0026#34;. When `null`, the `lifetime` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the CertificateAuthority. A full list of valid locations can be found by\nrunning \u0026#39;gcloud privateca locations list\u0026#39;.\n  - `pem_ca_certificate` (`string`): The signed CA certificate issued from the subordinated CA\u0026#39;s CSR. This is needed when activating the subordiante CA with a third party issuer. When `null`, the `pem_ca_certificate` field will be omitted from the resulting object.\n  - `pool` (`string`): The name of the CaPool this Certificate Authority belongs to.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `skip_grace_period` (`bool`): If this flag is set, the Certificate Authority will be deleted as soon as\npossible without a 30-day grace period where undeletion would have been\nallowed. If you proceed, there will be no way to recover this CA.\nUse with care. Defaults to \u0026#39;false\u0026#39;. When `null`, the `skip_grace_period` field will be omitted from the resulting object.\n  - `type` (`string`): The Type of this CertificateAuthority.\n\n~\u0026gt; **Note:** For \u0026#39;SUBORDINATE\u0026#39; Certificate Authorities, they need to\nbe activated before they can issue certificates. Default value: \u0026#34;SELF_SIGNED\u0026#34; Possible values: [\u0026#34;SELF_SIGNED\u0026#34;, \u0026#34;SUBORDINATE\u0026#34;] When `null`, the `type` field will be omitted from the resulting object.\n  - `config` (`list[obj]`): The config used to create a self-signed X.509 certificate or CSR. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_authority.config.new](#fn-confignew) constructor.\n  - `key_spec` (`list[obj]`): Used when issuing certificates for this CertificateAuthority. If this CertificateAuthority\nis a self-signed CertificateAuthority, this key is also used to sign the self-signed CA\ncertificate. Otherwise, it is used to sign a CSR. When `null`, the `key_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_authority.key_spec.new](#fn-key_specnew) constructor.\n  - `subordinate_config` (`list[obj]`): If this is a subordinate CertificateAuthority, this field will be set\nwith the subordinate configuration, which describes its issuers. When `null`, the `subordinate_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_authority.subordinate_config.new](#fn-subordinate_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_authority.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.privateca_certificate_authority.new` injects a new `google_privateca_certificate_authority` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.privateca_certificate_authority.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.privateca_certificate_authority` using the reference:\n\n    $._ref.google_privateca_certificate_authority.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_privateca_certificate_authority.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `certificate_authority_id` (`string`): The user provided Resource ID for this Certificate Authority.\n  - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the CertificateAuthority. Unless this field is set to false\nin Terraform state, a \u0026#39;terraform destroy\u0026#39; or \u0026#39;terraform apply\u0026#39; that would delete the instance will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `desired_state` (`string`): Desired state of the CertificateAuthority. Set this field to \u0026#39;STAGED\u0026#39; to create a \u0026#39;STAGED\u0026#39; root CA. When `null`, the `desired_state` field will be omitted from the resulting object.\n  - `gcs_bucket` (`string`): The name of a Cloud Storage bucket where this CertificateAuthority will publish content,\nsuch as the CA certificate and CRLs. This must be a bucket name, without any prefixes\n(such as \u0026#39;gs://\u0026#39;) or suffixes (such as \u0026#39;.googleapis.com\u0026#39;). For example, to use a bucket named\nmy-bucket, you would simply specify \u0026#39;my-bucket\u0026#39;. If not specified, a managed bucket will be\ncreated. When `null`, the `gcs_bucket` field will be omitted from the resulting object.\n  - `ignore_active_certificates_on_deletion` (`bool`): This field allows the CA to be deleted even if the CA has active certs. Active certs include both unrevoked and unexpired certs.\nUse with care. Defaults to \u0026#39;false\u0026#39;. When `null`, the `ignore_active_certificates_on_deletion` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels with user-defined metadata.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;:\n\u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lifetime` (`string`): The desired lifetime of the CA certificate. Used to create the \u0026#34;notBeforeTime\u0026#34; and\n\u0026#34;notAfterTime\u0026#34; fields inside an X.509 certificate. A duration in seconds with up to nine\nfractional digits, terminated by \u0026#39;s\u0026#39;. Example: \u0026#34;3.5s\u0026#34;. When `null`, the `lifetime` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the CertificateAuthority. A full list of valid locations can be found by\nrunning \u0026#39;gcloud privateca locations list\u0026#39;.\n  - `pem_ca_certificate` (`string`): The signed CA certificate issued from the subordinated CA\u0026#39;s CSR. This is needed when activating the subordiante CA with a third party issuer. When `null`, the `pem_ca_certificate` field will be omitted from the resulting object.\n  - `pool` (`string`): The name of the CaPool this Certificate Authority belongs to.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `skip_grace_period` (`bool`): If this flag is set, the Certificate Authority will be deleted as soon as\npossible without a 30-day grace period where undeletion would have been\nallowed. If you proceed, there will be no way to recover this CA.\nUse with care. Defaults to \u0026#39;false\u0026#39;. When `null`, the `skip_grace_period` field will be omitted from the resulting object.\n  - `type` (`string`): The Type of this CertificateAuthority.\n\n~\u0026gt; **Note:** For \u0026#39;SUBORDINATE\u0026#39; Certificate Authorities, they need to\nbe activated before they can issue certificates. Default value: \u0026#34;SELF_SIGNED\u0026#34; Possible values: [\u0026#34;SELF_SIGNED\u0026#34;, \u0026#34;SUBORDINATE\u0026#34;] When `null`, the `type` field will be omitted from the resulting object.\n  - `config` (`list[obj]`): The config used to create a self-signed X.509 certificate or CSR. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_authority.config.new](#fn-confignew) constructor.\n  - `key_spec` (`list[obj]`): Used when issuing certificates for this CertificateAuthority. If this CertificateAuthority\nis a self-signed CertificateAuthority, this key is also used to sign the self-signed CA\ncertificate. Otherwise, it is used to sign a CSR. When `null`, the `key_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_authority.key_spec.new](#fn-key_specnew) constructor.\n  - `subordinate_config` (`list[obj]`): If this is a subordinate CertificateAuthority, this field will be set\nwith the subordinate configuration, which describes its issuers. When `null`, the `subordinate_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_authority.subordinate_config.new](#fn-subordinate_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_authority.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     certificate_authority_id,
@@ -259,7 +259,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.privateca_certificate_authority.newAttrs` constructs a new object with attributes and blocks configured for the `privateca_certificate_authority`\nTerraform resource.\n\nUnlike [google.privateca_certificate_authority.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `certificate_authority_id` (`string`): The user provided Resource ID for this Certificate Authority.\n  - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the CertificateAuthority. Unless this field is set to false\nin Terraform state, a 'terraform destroy' or 'terraform apply' that would delete the instance will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `desired_state` (`string`): Desired state of the CertificateAuthority. Set this field to 'STAGED' to create a 'STAGED' root CA. When `null`, the `desired_state` field will be omitted from the resulting object.\n  - `gcs_bucket` (`string`): The name of a Cloud Storage bucket where this CertificateAuthority will publish content,\nsuch as the CA certificate and CRLs. This must be a bucket name, without any prefixes\n(such as 'gs://') or suffixes (such as '.googleapis.com'). For example, to use a bucket named\nmy-bucket, you would simply specify 'my-bucket'. If not specified, a managed bucket will be\ncreated. When `null`, the `gcs_bucket` field will be omitted from the resulting object.\n  - `ignore_active_certificates_on_deletion` (`bool`): This field allows the CA to be deleted even if the CA has active certs. Active certs include both unrevoked and unexpired certs.\nUse with care. Defaults to 'false'. When `null`, the `ignore_active_certificates_on_deletion` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels with user-defined metadata.\n\nAn object containing a list of "key": value pairs. Example: { "name": "wrench", "mass":\n"1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lifetime` (`string`): The desired lifetime of the CA certificate. Used to create the "notBeforeTime" and\n"notAfterTime" fields inside an X.509 certificate. A duration in seconds with up to nine\nfractional digits, terminated by 's'. Example: "3.5s". When `null`, the `lifetime` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the CertificateAuthority. A full list of valid locations can be found by\nrunning 'gcloud privateca locations list'.\n  - `pem_ca_certificate` (`string`): The signed CA certificate issued from the subordinated CA's CSR. This is needed when activating the subordiante CA with a third party issuer. When `null`, the `pem_ca_certificate` field will be omitted from the resulting object.\n  - `pool` (`string`): The name of the CaPool this Certificate Authority belongs to.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `skip_grace_period` (`bool`): If this flag is set, the Certificate Authority will be deleted as soon as\npossible without a 30-day grace period where undeletion would have been\nallowed. If you proceed, there will be no way to recover this CA.\nUse with care. Defaults to 'false'. When `null`, the `skip_grace_period` field will be omitted from the resulting object.\n  - `type` (`string`): The Type of this CertificateAuthority.\n\n~> **Note:** For 'SUBORDINATE' Certificate Authorities, they need to\nbe activated before they can issue certificates. Default value: "SELF_SIGNED" Possible values: ["SELF_SIGNED", "SUBORDINATE"] When `null`, the `type` field will be omitted from the resulting object.\n  - `config` (`list[obj]`): The config used to create a self-signed X.509 certificate or CSR. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_authority.config.new](#fn-confignew) constructor.\n  - `key_spec` (`list[obj]`): Used when issuing certificates for this CertificateAuthority. If this CertificateAuthority\nis a self-signed CertificateAuthority, this key is also used to sign the self-signed CA\ncertificate. Otherwise, it is used to sign a CSR. When `null`, the `key_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_authority.key_spec.new](#fn-key_specnew) constructor.\n  - `subordinate_config` (`list[obj]`): If this is a subordinate CertificateAuthority, this field will be set\nwith the subordinate configuration, which describes its issuers. When `null`, the `subordinate_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_authority.subordinate_config.new](#fn-subordinate_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_authority.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `privateca_certificate_authority` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.privateca_certificate_authority.newAttrs` constructs a new object with attributes and blocks configured for the `privateca_certificate_authority`\nTerraform resource.\n\nUnlike [google.privateca_certificate_authority.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `certificate_authority_id` (`string`): The user provided Resource ID for this Certificate Authority.\n  - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the CertificateAuthority. Unless this field is set to false\nin Terraform state, a 'terraform destroy' or 'terraform apply' that would delete the instance will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.\n  - `desired_state` (`string`): Desired state of the CertificateAuthority. Set this field to 'STAGED' to create a 'STAGED' root CA. When `null`, the `desired_state` field will be omitted from the resulting object.\n  - `gcs_bucket` (`string`): The name of a Cloud Storage bucket where this CertificateAuthority will publish content,\nsuch as the CA certificate and CRLs. This must be a bucket name, without any prefixes\n(such as 'gs://') or suffixes (such as '.googleapis.com'). For example, to use a bucket named\nmy-bucket, you would simply specify 'my-bucket'. If not specified, a managed bucket will be\ncreated. When `null`, the `gcs_bucket` field will be omitted from the resulting object.\n  - `ignore_active_certificates_on_deletion` (`bool`): This field allows the CA to be deleted even if the CA has active certs. Active certs include both unrevoked and unexpired certs.\nUse with care. Defaults to 'false'. When `null`, the `ignore_active_certificates_on_deletion` field will be omitted from the resulting object.\n  - `labels` (`obj`): Labels with user-defined metadata.\n\nAn object containing a list of "key": value pairs. Example: { "name": "wrench", "mass":\n"1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `lifetime` (`string`): The desired lifetime of the CA certificate. Used to create the "notBeforeTime" and\n"notAfterTime" fields inside an X.509 certificate. A duration in seconds with up to nine\nfractional digits, terminated by 's'. Example: "3.5s". When `null`, the `lifetime` field will be omitted from the resulting object.\n  - `location` (`string`): Location of the CertificateAuthority. A full list of valid locations can be found by\nrunning 'gcloud privateca locations list'.\n  - `pem_ca_certificate` (`string`): The signed CA certificate issued from the subordinated CA's CSR. This is needed when activating the subordiante CA with a third party issuer. When `null`, the `pem_ca_certificate` field will be omitted from the resulting object.\n  - `pool` (`string`): The name of the CaPool this Certificate Authority belongs to.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `skip_grace_period` (`bool`): If this flag is set, the Certificate Authority will be deleted as soon as\npossible without a 30-day grace period where undeletion would have been\nallowed. If you proceed, there will be no way to recover this CA.\nUse with care. Defaults to 'false'. When `null`, the `skip_grace_period` field will be omitted from the resulting object.\n  - `type` (`string`): The Type of this CertificateAuthority.\n\n~> **Note:** For 'SUBORDINATE' Certificate Authorities, they need to\nbe activated before they can issue certificates. Default value: "SELF_SIGNED" Possible values: ["SELF_SIGNED", "SUBORDINATE"] When `null`, the `type` field will be omitted from the resulting object.\n  - `config` (`list[obj]`): The config used to create a self-signed X.509 certificate or CSR. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_authority.config.new](#fn-confignew) constructor.\n  - `key_spec` (`list[obj]`): Used when issuing certificates for this CertificateAuthority. If this CertificateAuthority\nis a self-signed CertificateAuthority, this key is also used to sign the self-signed CA\ncertificate. Otherwise, it is used to sign a CSR. When `null`, the `key_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_authority.key_spec.new](#fn-key_specnew) constructor.\n  - `subordinate_config` (`list[obj]`): If this is a subordinate CertificateAuthority, this field will be set\nwith the subordinate configuration, which describes its issuers. When `null`, the `subordinate_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_authority.subordinate_config.new](#fn-subordinate_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_authority.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `privateca_certificate_authority` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     certificate_authority_id,
     location,
diff --git a/4.x/_gen/resources/privateca_certificate_template.libsonnet b/4.x/_gen/resources/privateca_certificate_template.libsonnet
index 52bd242d..f7f99cd7 100644
--- a/4.x/_gen/resources/privateca_certificate_template.libsonnet
+++ b/4.x/_gen/resources/privateca_certificate_template.libsonnet
@@ -28,7 +28,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       cel_expression: cel_expression,
     }),
   },
-  '#new':: d.fn(help="\n`google.privateca_certificate_template.new` injects a new `google_privateca_certificate_template` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.privateca_certificate_template.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.privateca_certificate_template` using the reference:\n\n    $._ref.google_privateca_certificate_template.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_privateca_certificate_template.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Optional. A human-readable description of scenarios this template is intended for. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. Labels with user-defined metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The resource name for this CertificateTemplate in the format `projects/*/locations/*/certificateTemplates/*`.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `identity_constraints` (`list[obj]`): Optional. Describes constraints on identities that may be appear in Certificates issued using this template. If this is omitted, then this template will not add restrictions on a certificate\u0026#39;s identity. When `null`, the `identity_constraints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_template.identity_constraints.new](#fn-identity_constraintsnew) constructor.\n  - `passthrough_extensions` (`list[obj]`): Optional. Describes the set of X.509 extensions that may appear in a Certificate issued using this CertificateTemplate. If a certificate request sets extensions that don\u0026#39;t appear in the passthrough_extensions, those extensions will be dropped. If the issuing CaPool\u0026#39;s IssuancePolicy defines baseline_values that don\u0026#39;t appear here, the certificate issuance request will fail. If this is omitted, then this template will not add restrictions on a certificate\u0026#39;s X.509 extensions. These constraints do not apply to X.509 extensions set in this CertificateTemplate\u0026#39;s predefined_values. When `null`, the `passthrough_extensions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_template.passthrough_extensions.new](#fn-passthrough_extensionsnew) constructor.\n  - `predefined_values` (`list[obj]`): Optional. A set of X.509 values that will be applied to all issued certificates that use this template. If the certificate request includes conflicting values for the same properties, they will be overwritten by the values defined here. If the issuing CaPool\u0026#39;s IssuancePolicy defines conflicting baseline_values for the same properties, the certificate issuance request will fail. When `null`, the `predefined_values` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_template.predefined_values.new](#fn-predefined_valuesnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.privateca_certificate_template.new` injects a new `google_privateca_certificate_template` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.privateca_certificate_template.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.privateca_certificate_template` using the reference:\n\n    $._ref.google_privateca_certificate_template.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_privateca_certificate_template.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Optional. A human-readable description of scenarios this template is intended for. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. Labels with user-defined metadata.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The resource name for this CertificateTemplate in the format `projects/*/locations/*/certificateTemplates/*`.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `identity_constraints` (`list[obj]`): Optional. Describes constraints on identities that may be appear in Certificates issued using this template. If this is omitted, then this template will not add restrictions on a certificate\u0026#39;s identity. When `null`, the `identity_constraints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_template.identity_constraints.new](#fn-identity_constraintsnew) constructor.\n  - `passthrough_extensions` (`list[obj]`): Optional. Describes the set of X.509 extensions that may appear in a Certificate issued using this CertificateTemplate. If a certificate request sets extensions that don\u0026#39;t appear in the passthrough_extensions, those extensions will be dropped. If the issuing CaPool\u0026#39;s IssuancePolicy defines baseline_values that don\u0026#39;t appear here, the certificate issuance request will fail. If this is omitted, then this template will not add restrictions on a certificate\u0026#39;s X.509 extensions. These constraints do not apply to X.509 extensions set in this CertificateTemplate\u0026#39;s predefined_values. When `null`, the `passthrough_extensions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_template.passthrough_extensions.new](#fn-passthrough_extensionsnew) constructor.\n  - `predefined_values` (`list[obj]`): Optional. A set of X.509 values that will be applied to all issued certificates that use this template. If the certificate request includes conflicting values for the same properties, they will be overwritten by the values defined here. If the issuing CaPool\u0026#39;s IssuancePolicy defines conflicting baseline_values for the same properties, the certificate issuance request will fail. When `null`, the `predefined_values` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_template.predefined_values.new](#fn-predefined_valuesnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -57,7 +57,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.privateca_certificate_template.newAttrs` constructs a new object with attributes and blocks configured for the `privateca_certificate_template`\nTerraform resource.\n\nUnlike [google.privateca_certificate_template.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Optional. A human-readable description of scenarios this template is intended for. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. Labels with user-defined metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The resource name for this CertificateTemplate in the format `projects/*/locations/*/certificateTemplates/*`.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `identity_constraints` (`list[obj]`): Optional. Describes constraints on identities that may be appear in Certificates issued using this template. If this is omitted, then this template will not add restrictions on a certificate's identity. When `null`, the `identity_constraints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_template.identity_constraints.new](#fn-identity_constraintsnew) constructor.\n  - `passthrough_extensions` (`list[obj]`): Optional. Describes the set of X.509 extensions that may appear in a Certificate issued using this CertificateTemplate. If a certificate request sets extensions that don't appear in the passthrough_extensions, those extensions will be dropped. If the issuing CaPool's IssuancePolicy defines baseline_values that don't appear here, the certificate issuance request will fail. If this is omitted, then this template will not add restrictions on a certificate's X.509 extensions. These constraints do not apply to X.509 extensions set in this CertificateTemplate's predefined_values. When `null`, the `passthrough_extensions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_template.passthrough_extensions.new](#fn-passthrough_extensionsnew) constructor.\n  - `predefined_values` (`list[obj]`): Optional. A set of X.509 values that will be applied to all issued certificates that use this template. If the certificate request includes conflicting values for the same properties, they will be overwritten by the values defined here. If the issuing CaPool's IssuancePolicy defines conflicting baseline_values for the same properties, the certificate issuance request will fail. When `null`, the `predefined_values` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_template.predefined_values.new](#fn-predefined_valuesnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `privateca_certificate_template` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.privateca_certificate_template.newAttrs` constructs a new object with attributes and blocks configured for the `privateca_certificate_template`\nTerraform resource.\n\nUnlike [google.privateca_certificate_template.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Optional. A human-readable description of scenarios this template is intended for. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Optional. Labels with user-defined metadata.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The resource name for this CertificateTemplate in the format `projects/*/locations/*/certificateTemplates/*`.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `identity_constraints` (`list[obj]`): Optional. Describes constraints on identities that may be appear in Certificates issued using this template. If this is omitted, then this template will not add restrictions on a certificate's identity. When `null`, the `identity_constraints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_template.identity_constraints.new](#fn-identity_constraintsnew) constructor.\n  - `passthrough_extensions` (`list[obj]`): Optional. Describes the set of X.509 extensions that may appear in a Certificate issued using this CertificateTemplate. If a certificate request sets extensions that don't appear in the passthrough_extensions, those extensions will be dropped. If the issuing CaPool's IssuancePolicy defines baseline_values that don't appear here, the certificate issuance request will fail. If this is omitted, then this template will not add restrictions on a certificate's X.509 extensions. These constraints do not apply to X.509 extensions set in this CertificateTemplate's predefined_values. When `null`, the `passthrough_extensions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_template.passthrough_extensions.new](#fn-passthrough_extensionsnew) constructor.\n  - `predefined_values` (`list[obj]`): Optional. A set of X.509 values that will be applied to all issued certificates that use this template. If the certificate request includes conflicting values for the same properties, they will be overwritten by the values defined here. If the issuing CaPool's IssuancePolicy defines conflicting baseline_values for the same properties, the certificate issuance request will fail. When `null`, the `predefined_values` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_template.predefined_values.new](#fn-predefined_valuesnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.privateca_certificate_template.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `privateca_certificate_template` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     name,
diff --git a/4.x/_gen/resources/project.libsonnet b/4.x/_gen/resources/project.libsonnet
index fd079ffc..134dfb7c 100644
--- a/4.x/_gen/resources/project.libsonnet
+++ b/4.x/_gen/resources/project.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='project', url='', help='`project` represents the `google_project` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.project.new` injects a new `google_project` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.project.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.project` using the reference:\n\n    $._ref.google_project.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_project.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `auto_create_network` (`bool`): Create the \u0026#39;default\u0026#39; network automatically.  Default true. If set to false, the default network will be deleted.  Note that, for quota purposes, you will still need to have 1 network slot available to create the project successfully, even if you set auto_create_network to false, since the network will exist momentarily. When `null`, the `auto_create_network` field will be omitted from the resulting object.\n  - `billing_account` (`string`): The alphanumeric ID of the billing account this project belongs to. The user or service account performing this operation with Terraform must have Billing Account Administrator privileges (roles/billing.admin) in the organization. See Google Cloud Billing API Access Control for more details. When `null`, the `billing_account` field will be omitted from the resulting object.\n  - `folder_id` (`string`): The numeric ID of the folder this project should be created under. Only one of org_id or folder_id may be specified. If the folder_id is specified, then the project is created under the specified folder. Changing this forces the project to be migrated to the newly specified folder. When `null`, the `folder_id` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to the project. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The display name of the project.\n  - `org_id` (`string`): The numeric ID of the organization this project belongs to. Changing this forces a new project to be created.  Only one of org_id or folder_id may be specified. If the org_id is specified then the project is created at the top level. Changing this forces the project to be migrated to the newly specified organization. When `null`, the `org_id` field will be omitted from the resulting object.\n  - `project_id` (`string`): The project ID. Changing this forces a new project to be created.\n  - `skip_delete` (`bool`): If true, the Terraform resource can be deleted without deleting the Project via the Google API. When `null`, the `skip_delete` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.project.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.project.new` injects a new `google_project` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.project.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.project` using the reference:\n\n    $._ref.google_project.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_project.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `auto_create_network` (`bool`): Create the \u0026#39;default\u0026#39; network automatically.  Default true. If set to false, the default network will be deleted.  Note that, for quota purposes, you will still need to have 1 network slot available to create the project successfully, even if you set auto_create_network to false, since the network will exist momentarily. When `null`, the `auto_create_network` field will be omitted from the resulting object.\n  - `billing_account` (`string`): The alphanumeric ID of the billing account this project belongs to. The user or service account performing this operation with Terraform must have Billing Account Administrator privileges (roles/billing.admin) in the organization. See Google Cloud Billing API Access Control for more details. When `null`, the `billing_account` field will be omitted from the resulting object.\n  - `folder_id` (`string`): The numeric ID of the folder this project should be created under. Only one of org_id or folder_id may be specified. If the folder_id is specified, then the project is created under the specified folder. Changing this forces the project to be migrated to the newly specified folder. When `null`, the `folder_id` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to the project.\n\t\t\t\t\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The display name of the project.\n  - `org_id` (`string`): The numeric ID of the organization this project belongs to. Changing this forces a new project to be created.  Only one of org_id or folder_id may be specified. If the org_id is specified then the project is created at the top level. Changing this forces the project to be migrated to the newly specified organization. When `null`, the `org_id` field will be omitted from the resulting object.\n  - `project_id` (`string`): The project ID. Changing this forces a new project to be created.\n  - `skip_delete` (`bool`): If true, the Terraform resource can be deleted without deleting the Project via the Google API. When `null`, the `skip_delete` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.project.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -31,7 +31,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.project.newAttrs` constructs a new object with attributes and blocks configured for the `project`\nTerraform resource.\n\nUnlike [google.project.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `auto_create_network` (`bool`): Create the 'default' network automatically.  Default true. If set to false, the default network will be deleted.  Note that, for quota purposes, you will still need to have 1 network slot available to create the project successfully, even if you set auto_create_network to false, since the network will exist momentarily. When `null`, the `auto_create_network` field will be omitted from the resulting object.\n  - `billing_account` (`string`): The alphanumeric ID of the billing account this project belongs to. The user or service account performing this operation with Terraform must have Billing Account Administrator privileges (roles/billing.admin) in the organization. See Google Cloud Billing API Access Control for more details. When `null`, the `billing_account` field will be omitted from the resulting object.\n  - `folder_id` (`string`): The numeric ID of the folder this project should be created under. Only one of org_id or folder_id may be specified. If the folder_id is specified, then the project is created under the specified folder. Changing this forces the project to be migrated to the newly specified folder. When `null`, the `folder_id` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to the project. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The display name of the project.\n  - `org_id` (`string`): The numeric ID of the organization this project belongs to. Changing this forces a new project to be created.  Only one of org_id or folder_id may be specified. If the org_id is specified then the project is created at the top level. Changing this forces the project to be migrated to the newly specified organization. When `null`, the `org_id` field will be omitted from the resulting object.\n  - `project_id` (`string`): The project ID. Changing this forces a new project to be created.\n  - `skip_delete` (`bool`): If true, the Terraform resource can be deleted without deleting the Project via the Google API. When `null`, the `skip_delete` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.project.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `project` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.project.newAttrs` constructs a new object with attributes and blocks configured for the `project`\nTerraform resource.\n\nUnlike [google.project.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `auto_create_network` (`bool`): Create the 'default' network automatically.  Default true. If set to false, the default network will be deleted.  Note that, for quota purposes, you will still need to have 1 network slot available to create the project successfully, even if you set auto_create_network to false, since the network will exist momentarily. When `null`, the `auto_create_network` field will be omitted from the resulting object.\n  - `billing_account` (`string`): The alphanumeric ID of the billing account this project belongs to. The user or service account performing this operation with Terraform must have Billing Account Administrator privileges (roles/billing.admin) in the organization. See Google Cloud Billing API Access Control for more details. When `null`, the `billing_account` field will be omitted from the resulting object.\n  - `folder_id` (`string`): The numeric ID of the folder this project should be created under. Only one of org_id or folder_id may be specified. If the folder_id is specified, then the project is created under the specified folder. Changing this forces the project to be migrated to the newly specified folder. When `null`, the `folder_id` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to the project.\n\t\t\t\t\n\t\t\t\t**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\n\t\t\t\tPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The display name of the project.\n  - `org_id` (`string`): The numeric ID of the organization this project belongs to. Changing this forces a new project to be created.  Only one of org_id or folder_id may be specified. If the org_id is specified then the project is created at the top level. Changing this forces the project to be migrated to the newly specified organization. When `null`, the `org_id` field will be omitted from the resulting object.\n  - `project_id` (`string`): The project ID. Changing this forces a new project to be created.\n  - `skip_delete` (`bool`): If true, the Terraform resource can be deleted without deleting the Project via the Google API. When `null`, the `skip_delete` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.project.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `project` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     project_id,
diff --git a/4.x/_gen/resources/pubsub_schema.libsonnet b/4.x/_gen/resources/pubsub_schema.libsonnet
index b2eaed5d..cc812d82 100644
--- a/4.x/_gen/resources/pubsub_schema.libsonnet
+++ b/4.x/_gen/resources/pubsub_schema.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='pubsub_schema', url='', help='`pubsub_schema` represents the `google_pubsub_schema` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.pubsub_schema.new` injects a new `google_pubsub_schema` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.pubsub_schema.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.pubsub_schema` using the reference:\n\n    $._ref.google_pubsub_schema.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_pubsub_schema.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `definition` (`string`): The definition of the schema.\nThis should contain a string representing the full definition of the schema\nthat is a valid schema definition of the type specified in type. When `null`, the `definition` field will be omitted from the resulting object.\n  - `name` (`string`): The ID to use for the schema, which will become the final component of the schema\u0026#39;s resource name.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `type` (`string`): The type of the schema definition Default value: \u0026#34;TYPE_UNSPECIFIED\u0026#34; Possible values: [\u0026#34;TYPE_UNSPECIFIED\u0026#34;, \u0026#34;PROTOCOL_BUFFER\u0026#34;, \u0026#34;AVRO\u0026#34;] When `null`, the `type` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_schema.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.pubsub_schema.new` injects a new `google_pubsub_schema` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.pubsub_schema.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.pubsub_schema` using the reference:\n\n    $._ref.google_pubsub_schema.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_pubsub_schema.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `definition` (`string`): The definition of the schema.\nThis should contain a string representing the full definition of the schema\nthat is a valid schema definition of the type specified in type. Changes\nto the definition commit new [schema revisions](https://cloud.google.com/pubsub/docs/commit-schema-revision).\nA schema can only have up to 20 revisions, so updates that fail with an\nerror indicating that the limit has been reached require manually\n[deleting old revisions](https://cloud.google.com/pubsub/docs/delete-schema-revision). When `null`, the `definition` field will be omitted from the resulting object.\n  - `name` (`string`): The ID to use for the schema, which will become the final component of the schema\u0026#39;s resource name.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `type` (`string`): The type of the schema definition Default value: \u0026#34;TYPE_UNSPECIFIED\u0026#34; Possible values: [\u0026#34;TYPE_UNSPECIFIED\u0026#34;, \u0026#34;PROTOCOL_BUFFER\u0026#34;, \u0026#34;AVRO\u0026#34;] When `null`, the `type` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_schema.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -23,7 +23,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.pubsub_schema.newAttrs` constructs a new object with attributes and blocks configured for the `pubsub_schema`\nTerraform resource.\n\nUnlike [google.pubsub_schema.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `definition` (`string`): The definition of the schema.\nThis should contain a string representing the full definition of the schema\nthat is a valid schema definition of the type specified in type. When `null`, the `definition` field will be omitted from the resulting object.\n  - `name` (`string`): The ID to use for the schema, which will become the final component of the schema's resource name.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `type` (`string`): The type of the schema definition Default value: "TYPE_UNSPECIFIED" Possible values: ["TYPE_UNSPECIFIED", "PROTOCOL_BUFFER", "AVRO"] When `null`, the `type` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_schema.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pubsub_schema` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.pubsub_schema.newAttrs` constructs a new object with attributes and blocks configured for the `pubsub_schema`\nTerraform resource.\n\nUnlike [google.pubsub_schema.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `definition` (`string`): The definition of the schema.\nThis should contain a string representing the full definition of the schema\nthat is a valid schema definition of the type specified in type. Changes\nto the definition commit new [schema revisions](https://cloud.google.com/pubsub/docs/commit-schema-revision).\nA schema can only have up to 20 revisions, so updates that fail with an\nerror indicating that the limit has been reached require manually\n[deleting old revisions](https://cloud.google.com/pubsub/docs/delete-schema-revision). When `null`, the `definition` field will be omitted from the resulting object.\n  - `name` (`string`): The ID to use for the schema, which will become the final component of the schema's resource name.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `type` (`string`): The type of the schema definition Default value: "TYPE_UNSPECIFIED" Possible values: ["TYPE_UNSPECIFIED", "PROTOCOL_BUFFER", "AVRO"] When `null`, the `type` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_schema.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pubsub_schema` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     definition=null,
diff --git a/4.x/_gen/resources/pubsub_schema_iam_binding.libsonnet b/4.x/_gen/resources/pubsub_schema_iam_binding.libsonnet
new file mode 100644
index 00000000..e4cc4ba4
--- /dev/null
+++ b/4.x/_gen/resources/pubsub_schema_iam_binding.libsonnet
@@ -0,0 +1,112 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='pubsub_schema_iam_binding', url='', help='`pubsub_schema_iam_binding` represents the `google_pubsub_schema_iam_binding` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  condition:: {
+    '#new':: d.fn(help='\n`google.pubsub_schema_iam_binding.condition.new` constructs a new object with attributes and blocks configured for the `condition`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Set the `description` field on the resulting object. When `null`, the `description` field will be omitted from the resulting object.\n  - `expression` (`string`): Set the `expression` field on the resulting object.\n  - `title` (`string`): Set the `title` field on the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `condition` sub block.\n', args=[]),
+    new(
+      expression,
+      title,
+      description=null
+    ):: std.prune(a={
+      description: description,
+      expression: expression,
+      title: title,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.pubsub_schema_iam_binding.new` injects a new `google_pubsub_schema_iam_binding` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.pubsub_schema_iam_binding.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.pubsub_schema_iam_binding` using the reference:\n\n    $._ref.google_pubsub_schema_iam_binding.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_pubsub_schema_iam_binding.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `members` (`list`): Set the `members` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting resource block.\n  - `schema` (`string`): Set the `schema` field on the resulting resource block.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_schema_iam_binding.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    members,
+    role,
+    schema,
+    condition=null,
+    project=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_pubsub_schema_iam_binding',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      condition=condition,
+      members=members,
+      project=project,
+      role=role,
+      schema=schema
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.pubsub_schema_iam_binding.newAttrs` constructs a new object with attributes and blocks configured for the `pubsub_schema_iam_binding`\nTerraform resource.\n\nUnlike [google.pubsub_schema_iam_binding.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `members` (`list`): Set the `members` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting object.\n  - `schema` (`string`): Set the `schema` field on the resulting object.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_schema_iam_binding.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pubsub_schema_iam_binding` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    members,
+    role,
+    schema,
+    condition=null,
+    project=null
+  ):: std.prune(a={
+    condition: condition,
+    members: members,
+    project: project,
+    role: role,
+    schema: schema,
+  }),
+  '#withCondition':: d.fn(help='`google.list[obj].withCondition` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the condition field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withConditionMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `condition` field.\n', args=[]),
+  withCondition(resourceLabel, value): {
+    resource+: {
+      google_pubsub_schema_iam_binding+: {
+        [resourceLabel]+: {
+          condition: value,
+        },
+      },
+    },
+  },
+  '#withConditionMixin':: d.fn(help='`google.list[obj].withConditionMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the condition field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withCondition](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `condition` field.\n', args=[]),
+  withConditionMixin(resourceLabel, value): {
+    resource+: {
+      google_pubsub_schema_iam_binding+: {
+        [resourceLabel]+: {
+          condition+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withMembers':: d.fn(help='`google.list.withMembers` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the members field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `members` field.\n', args=[]),
+  withMembers(resourceLabel, value): {
+    resource+: {
+      google_pubsub_schema_iam_binding+: {
+        [resourceLabel]+: {
+          members: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_pubsub_schema_iam_binding+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withRole':: d.fn(help='`google.string.withRole` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the role field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `role` field.\n', args=[]),
+  withRole(resourceLabel, value): {
+    resource+: {
+      google_pubsub_schema_iam_binding+: {
+        [resourceLabel]+: {
+          role: value,
+        },
+      },
+    },
+  },
+  '#withSchema':: d.fn(help='`google.string.withSchema` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the schema field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `schema` field.\n', args=[]),
+  withSchema(resourceLabel, value): {
+    resource+: {
+      google_pubsub_schema_iam_binding+: {
+        [resourceLabel]+: {
+          schema: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/pubsub_schema_iam_member.libsonnet b/4.x/_gen/resources/pubsub_schema_iam_member.libsonnet
new file mode 100644
index 00000000..a567080c
--- /dev/null
+++ b/4.x/_gen/resources/pubsub_schema_iam_member.libsonnet
@@ -0,0 +1,112 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='pubsub_schema_iam_member', url='', help='`pubsub_schema_iam_member` represents the `google_pubsub_schema_iam_member` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  condition:: {
+    '#new':: d.fn(help='\n`google.pubsub_schema_iam_member.condition.new` constructs a new object with attributes and blocks configured for the `condition`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Set the `description` field on the resulting object. When `null`, the `description` field will be omitted from the resulting object.\n  - `expression` (`string`): Set the `expression` field on the resulting object.\n  - `title` (`string`): Set the `title` field on the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `condition` sub block.\n', args=[]),
+    new(
+      expression,
+      title,
+      description=null
+    ):: std.prune(a={
+      description: description,
+      expression: expression,
+      title: title,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.pubsub_schema_iam_member.new` injects a new `google_pubsub_schema_iam_member` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.pubsub_schema_iam_member.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.pubsub_schema_iam_member` using the reference:\n\n    $._ref.google_pubsub_schema_iam_member.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_pubsub_schema_iam_member.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `member` (`string`): Set the `member` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting resource block.\n  - `schema` (`string`): Set the `schema` field on the resulting resource block.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_schema_iam_member.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    member,
+    role,
+    schema,
+    condition=null,
+    project=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_pubsub_schema_iam_member',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      condition=condition,
+      member=member,
+      project=project,
+      role=role,
+      schema=schema
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.pubsub_schema_iam_member.newAttrs` constructs a new object with attributes and blocks configured for the `pubsub_schema_iam_member`\nTerraform resource.\n\nUnlike [google.pubsub_schema_iam_member.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `member` (`string`): Set the `member` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `role` (`string`): Set the `role` field on the resulting object.\n  - `schema` (`string`): Set the `schema` field on the resulting object.\n  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_schema_iam_member.condition.new](#fn-conditionnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pubsub_schema_iam_member` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    member,
+    role,
+    schema,
+    condition=null,
+    project=null
+  ):: std.prune(a={
+    condition: condition,
+    member: member,
+    project: project,
+    role: role,
+    schema: schema,
+  }),
+  '#withCondition':: d.fn(help='`google.list[obj].withCondition` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the condition field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withConditionMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `condition` field.\n', args=[]),
+  withCondition(resourceLabel, value): {
+    resource+: {
+      google_pubsub_schema_iam_member+: {
+        [resourceLabel]+: {
+          condition: value,
+        },
+      },
+    },
+  },
+  '#withConditionMixin':: d.fn(help='`google.list[obj].withConditionMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the condition field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withCondition](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `condition` field.\n', args=[]),
+  withConditionMixin(resourceLabel, value): {
+    resource+: {
+      google_pubsub_schema_iam_member+: {
+        [resourceLabel]+: {
+          condition+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withMember':: d.fn(help='`google.string.withMember` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the member field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `member` field.\n', args=[]),
+  withMember(resourceLabel, value): {
+    resource+: {
+      google_pubsub_schema_iam_member+: {
+        [resourceLabel]+: {
+          member: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_pubsub_schema_iam_member+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withRole':: d.fn(help='`google.string.withRole` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the role field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `role` field.\n', args=[]),
+  withRole(resourceLabel, value): {
+    resource+: {
+      google_pubsub_schema_iam_member+: {
+        [resourceLabel]+: {
+          role: value,
+        },
+      },
+    },
+  },
+  '#withSchema':: d.fn(help='`google.string.withSchema` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the schema field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `schema` field.\n', args=[]),
+  withSchema(resourceLabel, value): {
+    resource+: {
+      google_pubsub_schema_iam_member+: {
+        [resourceLabel]+: {
+          schema: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/pubsub_schema_iam_policy.libsonnet b/4.x/_gen/resources/pubsub_schema_iam_policy.libsonnet
new file mode 100644
index 00000000..64def572
--- /dev/null
+++ b/4.x/_gen/resources/pubsub_schema_iam_policy.libsonnet
@@ -0,0 +1,58 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='pubsub_schema_iam_policy', url='', help='`pubsub_schema_iam_policy` represents the `google_pubsub_schema_iam_policy` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.pubsub_schema_iam_policy.new` injects a new `google_pubsub_schema_iam_policy` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.pubsub_schema_iam_policy.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.pubsub_schema_iam_policy` using the reference:\n\n    $._ref.google_pubsub_schema_iam_policy.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_pubsub_schema_iam_policy.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `policy_data` (`string`): Set the `policy_data` field on the resulting resource block.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `schema` (`string`): Set the `schema` field on the resulting resource block.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    policy_data,
+    schema,
+    project=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_pubsub_schema_iam_policy',
+    label=resourceLabel,
+    attrs=self.newAttrs(policy_data=policy_data, project=project, schema=schema),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.pubsub_schema_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `pubsub_schema_iam_policy`\nTerraform resource.\n\nUnlike [google.pubsub_schema_iam_policy.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `policy_data` (`string`): Set the `policy_data` field on the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `schema` (`string`): Set the `schema` field on the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pubsub_schema_iam_policy` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    policy_data,
+    schema,
+    project=null
+  ):: std.prune(a={
+    policy_data: policy_data,
+    project: project,
+    schema: schema,
+  }),
+  '#withPolicyData':: d.fn(help='`google.string.withPolicyData` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the policy_data field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `policy_data` field.\n', args=[]),
+  withPolicyData(resourceLabel, value): {
+    resource+: {
+      google_pubsub_schema_iam_policy+: {
+        [resourceLabel]+: {
+          policy_data: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_pubsub_schema_iam_policy+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withSchema':: d.fn(help='`google.string.withSchema` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the schema field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `schema` field.\n', args=[]),
+  withSchema(resourceLabel, value): {
+    resource+: {
+      google_pubsub_schema_iam_policy+: {
+        [resourceLabel]+: {
+          schema: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/pubsub_subscription.libsonnet b/4.x/_gen/resources/pubsub_subscription.libsonnet
index d61eb4a8..6296af08 100644
--- a/4.x/_gen/resources/pubsub_subscription.libsonnet
+++ b/4.x/_gen/resources/pubsub_subscription.libsonnet
@@ -60,7 +60,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       ttl: ttl,
     }),
   },
-  '#new':: d.fn(help="\n`google.pubsub_subscription.new` injects a new `google_pubsub_subscription` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.pubsub_subscription.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.pubsub_subscription` using the reference:\n\n    $._ref.google_pubsub_subscription.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_pubsub_subscription.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `ack_deadline_seconds` (`number`): This value is the maximum time after a subscriber receives a message\nbefore the subscriber should acknowledge the message. After message\ndelivery but before the ack deadline expires and before the message is\nacknowledged, it is an outstanding message and will not be delivered\nagain during that time (on a best-effort basis).\n\nFor pull subscriptions, this value is used as the initial value for\nthe ack deadline. To override this value for a given message, call\nsubscriptions.modifyAckDeadline with the corresponding ackId if using\npull. The minimum custom deadline you can specify is 10 seconds. The\nmaximum custom deadline you can specify is 600 seconds (10 minutes).\nIf this parameter is 0, a default value of 10 seconds is used.\n\nFor push delivery, this value is also used to set the request timeout\nfor the call to the push endpoint.\n\nIf the subscriber never acknowledges the message, the Pub/Sub system\nwill eventually redeliver the message. When `null`, the `ack_deadline_seconds` field will be omitted from the resulting object.\n  - `enable_exactly_once_delivery` (`bool`): If \u0026#39;true\u0026#39;, Pub/Sub provides the following guarantees for the delivery\nof a message with a given value of messageId on this Subscriptions\u0026#39;:\n\n- The message sent to a subscriber is guaranteed not to be resent before the message\u0026#39;s acknowledgement deadline expires.\n\n- An acknowledged message will not be resent to a subscriber.\n\nNote that subscribers may still receive multiple copies of a message when \u0026#39;enable_exactly_once_delivery\u0026#39;\nis true if the message was published multiple times by a publisher client. These copies are considered distinct by Pub/Sub and have distinct messageId values When `null`, the `enable_exactly_once_delivery` field will be omitted from the resulting object.\n  - `enable_message_ordering` (`bool`): If \u0026#39;true\u0026#39;, messages published with the same orderingKey in PubsubMessage will be delivered to\nthe subscribers in the order in which they are received by the Pub/Sub system. Otherwise, they\nmay be delivered in any order. When `null`, the `enable_message_ordering` field will be omitted from the resulting object.\n  - `filter` (`string`): The subscription only delivers the messages that match the filter.\nPub/Sub automatically acknowledges the messages that don\u0026#39;t match the filter. You can filter messages\nby their attributes. The maximum length of a filter is 256 bytes. After creating the subscription,\nyou can\u0026#39;t modify the filter. When `null`, the `filter` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Subscription. When `null`, the `labels` field will be omitted from the resulting object.\n  - `message_retention_duration` (`string`): How long to retain unacknowledged messages in the subscription\u0026#39;s\nbacklog, from the moment a message is published. If\nretain_acked_messages is true, then this also configures the retention\nof acknowledged messages, and thus configures how far back in time a\nsubscriptions.seek can be done. Defaults to 7 days. Cannot be more\nthan 7 days (\u0026#39;\u0026#34;604800s\u0026#34;\u0026#39;) or less than 10 minutes (\u0026#39;\u0026#34;600s\u0026#34;\u0026#39;).\n\nA duration in seconds with up to nine fractional digits, terminated\nby \u0026#39;s\u0026#39;. Example: \u0026#39;\u0026#34;600.5s\u0026#34;\u0026#39;. When `null`, the `message_retention_duration` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the subscription.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `retain_acked_messages` (`bool`): Indicates whether to retain acknowledged messages. If \u0026#39;true\u0026#39;, then\nmessages are not expunged from the subscription\u0026#39;s backlog, even if\nthey are acknowledged, until they fall out of the\nmessageRetentionDuration window. When `null`, the `retain_acked_messages` field will be omitted from the resulting object.\n  - `topic` (`string`): A reference to a Topic resource.\n  - `bigquery_config` (`list[obj]`): If delivery to BigQuery is used with this subscription, this field is used to configure it.\nEither pushConfig, bigQueryConfig or cloudStorageConfig can be set, but not combined.\nIf all three are empty, then the subscriber will pull and ack messages using API methods. When `null`, the `bigquery_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.bigquery_config.new](#fn-bigquery_confignew) constructor.\n  - `cloud_storage_config` (`list[obj]`): If delivery to Cloud Storage is used with this subscription, this field is used to configure it.\nEither pushConfig, bigQueryConfig or cloudStorageConfig can be set, but not combined.\nIf all three are empty, then the subscriber will pull and ack messages using API methods. When `null`, the `cloud_storage_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.cloud_storage_config.new](#fn-cloud_storage_confignew) constructor.\n  - `dead_letter_policy` (`list[obj]`): A policy that specifies the conditions for dead lettering messages in\nthis subscription. If dead_letter_policy is not set, dead lettering\nis disabled.\n\nThe Cloud Pub/Sub service account associated with this subscription\u0026#39;s\nparent project (i.e.,\nservice-{project_number}@gcp-sa-pubsub.iam.gserviceaccount.com) must have\npermission to Acknowledge() messages on this subscription. When `null`, the `dead_letter_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.dead_letter_policy.new](#fn-dead_letter_policynew) constructor.\n  - `expiration_policy` (`list[obj]`): A policy that specifies the conditions for this subscription\u0026#39;s expiration.\nA subscription is considered active as long as any connected subscriber\nis successfully consuming messages from the subscription or is issuing\noperations on the subscription. If expirationPolicy is not set, a default\npolicy with ttl of 31 days will be used.  If it is set but ttl is \u0026#34;\u0026#34;, the\nresource never expires.  The minimum allowed value for expirationPolicy.ttl\nis 1 day. When `null`, the `expiration_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.expiration_policy.new](#fn-expiration_policynew) constructor.\n  - `push_config` (`list[obj]`): If push delivery is used with this subscription, this field is used to\nconfigure it. An empty pushConfig signifies that the subscriber will\npull and ack messages using API methods. When `null`, the `push_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.push_config.new](#fn-push_confignew) constructor.\n  - `retry_policy` (`list[obj]`): A policy that specifies how Pub/Sub retries message delivery for this subscription.\n\nIf not set, the default retry policy is applied. This generally implies that messages will be retried as soon as possible for healthy subscribers.\nRetryPolicy will be triggered on NACKs or acknowledgement deadline exceeded events for a given message When `null`, the `retry_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.retry_policy.new](#fn-retry_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.pubsub_subscription.new` injects a new `google_pubsub_subscription` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.pubsub_subscription.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.pubsub_subscription` using the reference:\n\n    $._ref.google_pubsub_subscription.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_pubsub_subscription.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `ack_deadline_seconds` (`number`): This value is the maximum time after a subscriber receives a message\nbefore the subscriber should acknowledge the message. After message\ndelivery but before the ack deadline expires and before the message is\nacknowledged, it is an outstanding message and will not be delivered\nagain during that time (on a best-effort basis).\n\nFor pull subscriptions, this value is used as the initial value for\nthe ack deadline. To override this value for a given message, call\nsubscriptions.modifyAckDeadline with the corresponding ackId if using\npull. The minimum custom deadline you can specify is 10 seconds. The\nmaximum custom deadline you can specify is 600 seconds (10 minutes).\nIf this parameter is 0, a default value of 10 seconds is used.\n\nFor push delivery, this value is also used to set the request timeout\nfor the call to the push endpoint.\n\nIf the subscriber never acknowledges the message, the Pub/Sub system\nwill eventually redeliver the message. When `null`, the `ack_deadline_seconds` field will be omitted from the resulting object.\n  - `enable_exactly_once_delivery` (`bool`): If \u0026#39;true\u0026#39;, Pub/Sub provides the following guarantees for the delivery\nof a message with a given value of messageId on this Subscriptions\u0026#39;:\n\n- The message sent to a subscriber is guaranteed not to be resent before the message\u0026#39;s acknowledgement deadline expires.\n\n- An acknowledged message will not be resent to a subscriber.\n\nNote that subscribers may still receive multiple copies of a message when \u0026#39;enable_exactly_once_delivery\u0026#39;\nis true if the message was published multiple times by a publisher client. These copies are considered distinct by Pub/Sub and have distinct messageId values When `null`, the `enable_exactly_once_delivery` field will be omitted from the resulting object.\n  - `enable_message_ordering` (`bool`): If \u0026#39;true\u0026#39;, messages published with the same orderingKey in PubsubMessage will be delivered to\nthe subscribers in the order in which they are received by the Pub/Sub system. Otherwise, they\nmay be delivered in any order. When `null`, the `enable_message_ordering` field will be omitted from the resulting object.\n  - `filter` (`string`): The subscription only delivers the messages that match the filter.\nPub/Sub automatically acknowledges the messages that don\u0026#39;t match the filter. You can filter messages\nby their attributes. The maximum length of a filter is 256 bytes. After creating the subscription,\nyou can\u0026#39;t modify the filter. When `null`, the `filter` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Subscription.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `message_retention_duration` (`string`): How long to retain unacknowledged messages in the subscription\u0026#39;s\nbacklog, from the moment a message is published. If\nretain_acked_messages is true, then this also configures the retention\nof acknowledged messages, and thus configures how far back in time a\nsubscriptions.seek can be done. Defaults to 7 days. Cannot be more\nthan 7 days (\u0026#39;\u0026#34;604800s\u0026#34;\u0026#39;) or less than 10 minutes (\u0026#39;\u0026#34;600s\u0026#34;\u0026#39;).\n\nA duration in seconds with up to nine fractional digits, terminated\nby \u0026#39;s\u0026#39;. Example: \u0026#39;\u0026#34;600.5s\u0026#34;\u0026#39;. When `null`, the `message_retention_duration` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the subscription.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `retain_acked_messages` (`bool`): Indicates whether to retain acknowledged messages. If \u0026#39;true\u0026#39;, then\nmessages are not expunged from the subscription\u0026#39;s backlog, even if\nthey are acknowledged, until they fall out of the\nmessageRetentionDuration window. When `null`, the `retain_acked_messages` field will be omitted from the resulting object.\n  - `topic` (`string`): A reference to a Topic resource.\n  - `bigquery_config` (`list[obj]`): If delivery to BigQuery is used with this subscription, this field is used to configure it.\nEither pushConfig, bigQueryConfig or cloudStorageConfig can be set, but not combined.\nIf all three are empty, then the subscriber will pull and ack messages using API methods. When `null`, the `bigquery_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.bigquery_config.new](#fn-bigquery_confignew) constructor.\n  - `cloud_storage_config` (`list[obj]`): If delivery to Cloud Storage is used with this subscription, this field is used to configure it.\nEither pushConfig, bigQueryConfig or cloudStorageConfig can be set, but not combined.\nIf all three are empty, then the subscriber will pull and ack messages using API methods. When `null`, the `cloud_storage_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.cloud_storage_config.new](#fn-cloud_storage_confignew) constructor.\n  - `dead_letter_policy` (`list[obj]`): A policy that specifies the conditions for dead lettering messages in\nthis subscription. If dead_letter_policy is not set, dead lettering\nis disabled.\n\nThe Cloud Pub/Sub service account associated with this subscription\u0026#39;s\nparent project (i.e.,\nservice-{project_number}@gcp-sa-pubsub.iam.gserviceaccount.com) must have\npermission to Acknowledge() messages on this subscription. When `null`, the `dead_letter_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.dead_letter_policy.new](#fn-dead_letter_policynew) constructor.\n  - `expiration_policy` (`list[obj]`): A policy that specifies the conditions for this subscription\u0026#39;s expiration.\nA subscription is considered active as long as any connected subscriber\nis successfully consuming messages from the subscription or is issuing\noperations on the subscription. If expirationPolicy is not set, a default\npolicy with ttl of 31 days will be used.  If it is set but ttl is \u0026#34;\u0026#34;, the\nresource never expires.  The minimum allowed value for expirationPolicy.ttl\nis 1 day. When `null`, the `expiration_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.expiration_policy.new](#fn-expiration_policynew) constructor.\n  - `push_config` (`list[obj]`): If push delivery is used with this subscription, this field is used to\nconfigure it. An empty pushConfig signifies that the subscriber will\npull and ack messages using API methods. When `null`, the `push_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.push_config.new](#fn-push_confignew) constructor.\n  - `retry_policy` (`list[obj]`): A policy that specifies how Pub/Sub retries message delivery for this subscription.\n\nIf not set, the default retry policy is applied. This generally implies that messages will be retried as soon as possible for healthy subscribers.\nRetryPolicy will be triggered on NACKs or acknowledgement deadline exceeded events for a given message When `null`, the `retry_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.retry_policy.new](#fn-retry_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -105,7 +105,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.pubsub_subscription.newAttrs` constructs a new object with attributes and blocks configured for the `pubsub_subscription`\nTerraform resource.\n\nUnlike [google.pubsub_subscription.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `ack_deadline_seconds` (`number`): This value is the maximum time after a subscriber receives a message\nbefore the subscriber should acknowledge the message. After message\ndelivery but before the ack deadline expires and before the message is\nacknowledged, it is an outstanding message and will not be delivered\nagain during that time (on a best-effort basis).\n\nFor pull subscriptions, this value is used as the initial value for\nthe ack deadline. To override this value for a given message, call\nsubscriptions.modifyAckDeadline with the corresponding ackId if using\npull. The minimum custom deadline you can specify is 10 seconds. The\nmaximum custom deadline you can specify is 600 seconds (10 minutes).\nIf this parameter is 0, a default value of 10 seconds is used.\n\nFor push delivery, this value is also used to set the request timeout\nfor the call to the push endpoint.\n\nIf the subscriber never acknowledges the message, the Pub/Sub system\nwill eventually redeliver the message. When `null`, the `ack_deadline_seconds` field will be omitted from the resulting object.\n  - `enable_exactly_once_delivery` (`bool`): If 'true', Pub/Sub provides the following guarantees for the delivery\nof a message with a given value of messageId on this Subscriptions':\n\n- The message sent to a subscriber is guaranteed not to be resent before the message's acknowledgement deadline expires.\n\n- An acknowledged message will not be resent to a subscriber.\n\nNote that subscribers may still receive multiple copies of a message when 'enable_exactly_once_delivery'\nis true if the message was published multiple times by a publisher client. These copies are considered distinct by Pub/Sub and have distinct messageId values When `null`, the `enable_exactly_once_delivery` field will be omitted from the resulting object.\n  - `enable_message_ordering` (`bool`): If 'true', messages published with the same orderingKey in PubsubMessage will be delivered to\nthe subscribers in the order in which they are received by the Pub/Sub system. Otherwise, they\nmay be delivered in any order. When `null`, the `enable_message_ordering` field will be omitted from the resulting object.\n  - `filter` (`string`): The subscription only delivers the messages that match the filter.\nPub/Sub automatically acknowledges the messages that don't match the filter. You can filter messages\nby their attributes. The maximum length of a filter is 256 bytes. After creating the subscription,\nyou can't modify the filter. When `null`, the `filter` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Subscription. When `null`, the `labels` field will be omitted from the resulting object.\n  - `message_retention_duration` (`string`): How long to retain unacknowledged messages in the subscription's\nbacklog, from the moment a message is published. If\nretain_acked_messages is true, then this also configures the retention\nof acknowledged messages, and thus configures how far back in time a\nsubscriptions.seek can be done. Defaults to 7 days. Cannot be more\nthan 7 days ('"604800s"') or less than 10 minutes ('"600s"').\n\nA duration in seconds with up to nine fractional digits, terminated\nby 's'. Example: '"600.5s"'. When `null`, the `message_retention_duration` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the subscription.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `retain_acked_messages` (`bool`): Indicates whether to retain acknowledged messages. If 'true', then\nmessages are not expunged from the subscription's backlog, even if\nthey are acknowledged, until they fall out of the\nmessageRetentionDuration window. When `null`, the `retain_acked_messages` field will be omitted from the resulting object.\n  - `topic` (`string`): A reference to a Topic resource.\n  - `bigquery_config` (`list[obj]`): If delivery to BigQuery is used with this subscription, this field is used to configure it.\nEither pushConfig, bigQueryConfig or cloudStorageConfig can be set, but not combined.\nIf all three are empty, then the subscriber will pull and ack messages using API methods. When `null`, the `bigquery_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.bigquery_config.new](#fn-bigquery_confignew) constructor.\n  - `cloud_storage_config` (`list[obj]`): If delivery to Cloud Storage is used with this subscription, this field is used to configure it.\nEither pushConfig, bigQueryConfig or cloudStorageConfig can be set, but not combined.\nIf all three are empty, then the subscriber will pull and ack messages using API methods. When `null`, the `cloud_storage_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.cloud_storage_config.new](#fn-cloud_storage_confignew) constructor.\n  - `dead_letter_policy` (`list[obj]`): A policy that specifies the conditions for dead lettering messages in\nthis subscription. If dead_letter_policy is not set, dead lettering\nis disabled.\n\nThe Cloud Pub/Sub service account associated with this subscription's\nparent project (i.e.,\nservice-{project_number}@gcp-sa-pubsub.iam.gserviceaccount.com) must have\npermission to Acknowledge() messages on this subscription. When `null`, the `dead_letter_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.dead_letter_policy.new](#fn-dead_letter_policynew) constructor.\n  - `expiration_policy` (`list[obj]`): A policy that specifies the conditions for this subscription's expiration.\nA subscription is considered active as long as any connected subscriber\nis successfully consuming messages from the subscription or is issuing\noperations on the subscription. If expirationPolicy is not set, a default\npolicy with ttl of 31 days will be used.  If it is set but ttl is "", the\nresource never expires.  The minimum allowed value for expirationPolicy.ttl\nis 1 day. When `null`, the `expiration_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.expiration_policy.new](#fn-expiration_policynew) constructor.\n  - `push_config` (`list[obj]`): If push delivery is used with this subscription, this field is used to\nconfigure it. An empty pushConfig signifies that the subscriber will\npull and ack messages using API methods. When `null`, the `push_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.push_config.new](#fn-push_confignew) constructor.\n  - `retry_policy` (`list[obj]`): A policy that specifies how Pub/Sub retries message delivery for this subscription.\n\nIf not set, the default retry policy is applied. This generally implies that messages will be retried as soon as possible for healthy subscribers.\nRetryPolicy will be triggered on NACKs or acknowledgement deadline exceeded events for a given message When `null`, the `retry_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.retry_policy.new](#fn-retry_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pubsub_subscription` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.pubsub_subscription.newAttrs` constructs a new object with attributes and blocks configured for the `pubsub_subscription`\nTerraform resource.\n\nUnlike [google.pubsub_subscription.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `ack_deadline_seconds` (`number`): This value is the maximum time after a subscriber receives a message\nbefore the subscriber should acknowledge the message. After message\ndelivery but before the ack deadline expires and before the message is\nacknowledged, it is an outstanding message and will not be delivered\nagain during that time (on a best-effort basis).\n\nFor pull subscriptions, this value is used as the initial value for\nthe ack deadline. To override this value for a given message, call\nsubscriptions.modifyAckDeadline with the corresponding ackId if using\npull. The minimum custom deadline you can specify is 10 seconds. The\nmaximum custom deadline you can specify is 600 seconds (10 minutes).\nIf this parameter is 0, a default value of 10 seconds is used.\n\nFor push delivery, this value is also used to set the request timeout\nfor the call to the push endpoint.\n\nIf the subscriber never acknowledges the message, the Pub/Sub system\nwill eventually redeliver the message. When `null`, the `ack_deadline_seconds` field will be omitted from the resulting object.\n  - `enable_exactly_once_delivery` (`bool`): If 'true', Pub/Sub provides the following guarantees for the delivery\nof a message with a given value of messageId on this Subscriptions':\n\n- The message sent to a subscriber is guaranteed not to be resent before the message's acknowledgement deadline expires.\n\n- An acknowledged message will not be resent to a subscriber.\n\nNote that subscribers may still receive multiple copies of a message when 'enable_exactly_once_delivery'\nis true if the message was published multiple times by a publisher client. These copies are considered distinct by Pub/Sub and have distinct messageId values When `null`, the `enable_exactly_once_delivery` field will be omitted from the resulting object.\n  - `enable_message_ordering` (`bool`): If 'true', messages published with the same orderingKey in PubsubMessage will be delivered to\nthe subscribers in the order in which they are received by the Pub/Sub system. Otherwise, they\nmay be delivered in any order. When `null`, the `enable_message_ordering` field will be omitted from the resulting object.\n  - `filter` (`string`): The subscription only delivers the messages that match the filter.\nPub/Sub automatically acknowledges the messages that don't match the filter. You can filter messages\nby their attributes. The maximum length of a filter is 256 bytes. After creating the subscription,\nyou can't modify the filter. When `null`, the `filter` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Subscription.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `message_retention_duration` (`string`): How long to retain unacknowledged messages in the subscription's\nbacklog, from the moment a message is published. If\nretain_acked_messages is true, then this also configures the retention\nof acknowledged messages, and thus configures how far back in time a\nsubscriptions.seek can be done. Defaults to 7 days. Cannot be more\nthan 7 days ('"604800s"') or less than 10 minutes ('"600s"').\n\nA duration in seconds with up to nine fractional digits, terminated\nby 's'. Example: '"600.5s"'. When `null`, the `message_retention_duration` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the subscription.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `retain_acked_messages` (`bool`): Indicates whether to retain acknowledged messages. If 'true', then\nmessages are not expunged from the subscription's backlog, even if\nthey are acknowledged, until they fall out of the\nmessageRetentionDuration window. When `null`, the `retain_acked_messages` field will be omitted from the resulting object.\n  - `topic` (`string`): A reference to a Topic resource.\n  - `bigquery_config` (`list[obj]`): If delivery to BigQuery is used with this subscription, this field is used to configure it.\nEither pushConfig, bigQueryConfig or cloudStorageConfig can be set, but not combined.\nIf all three are empty, then the subscriber will pull and ack messages using API methods. When `null`, the `bigquery_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.bigquery_config.new](#fn-bigquery_confignew) constructor.\n  - `cloud_storage_config` (`list[obj]`): If delivery to Cloud Storage is used with this subscription, this field is used to configure it.\nEither pushConfig, bigQueryConfig or cloudStorageConfig can be set, but not combined.\nIf all three are empty, then the subscriber will pull and ack messages using API methods. When `null`, the `cloud_storage_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.cloud_storage_config.new](#fn-cloud_storage_confignew) constructor.\n  - `dead_letter_policy` (`list[obj]`): A policy that specifies the conditions for dead lettering messages in\nthis subscription. If dead_letter_policy is not set, dead lettering\nis disabled.\n\nThe Cloud Pub/Sub service account associated with this subscription's\nparent project (i.e.,\nservice-{project_number}@gcp-sa-pubsub.iam.gserviceaccount.com) must have\npermission to Acknowledge() messages on this subscription. When `null`, the `dead_letter_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.dead_letter_policy.new](#fn-dead_letter_policynew) constructor.\n  - `expiration_policy` (`list[obj]`): A policy that specifies the conditions for this subscription's expiration.\nA subscription is considered active as long as any connected subscriber\nis successfully consuming messages from the subscription or is issuing\noperations on the subscription. If expirationPolicy is not set, a default\npolicy with ttl of 31 days will be used.  If it is set but ttl is "", the\nresource never expires.  The minimum allowed value for expirationPolicy.ttl\nis 1 day. When `null`, the `expiration_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.expiration_policy.new](#fn-expiration_policynew) constructor.\n  - `push_config` (`list[obj]`): If push delivery is used with this subscription, this field is used to\nconfigure it. An empty pushConfig signifies that the subscriber will\npull and ack messages using API methods. When `null`, the `push_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.push_config.new](#fn-push_confignew) constructor.\n  - `retry_policy` (`list[obj]`): A policy that specifies how Pub/Sub retries message delivery for this subscription.\n\nIf not set, the default retry policy is applied. This generally implies that messages will be retried as soon as possible for healthy subscribers.\nRetryPolicy will be triggered on NACKs or acknowledgement deadline exceeded events for a given message When `null`, the `retry_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.retry_policy.new](#fn-retry_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_subscription.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pubsub_subscription` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     topic,
diff --git a/4.x/_gen/resources/pubsub_topic.libsonnet b/4.x/_gen/resources/pubsub_topic.libsonnet
index 1e052519..a88b4ab1 100644
--- a/4.x/_gen/resources/pubsub_topic.libsonnet
+++ b/4.x/_gen/resources/pubsub_topic.libsonnet
@@ -10,7 +10,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       allowed_persistence_regions: allowed_persistence_regions,
     }),
   },
-  '#new':: d.fn(help="\n`google.pubsub_topic.new` injects a new `google_pubsub_topic` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.pubsub_topic.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.pubsub_topic` using the reference:\n\n    $._ref.google_pubsub_topic.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_pubsub_topic.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `kms_key_name` (`string`): The resource name of the Cloud KMS CryptoKey to be used to protect access\nto messages published on this topic. Your project\u0026#39;s PubSub service account\n(\u0026#39;service-{{PROJECT_NUMBER}}@gcp-sa-pubsub.iam.gserviceaccount.com\u0026#39;) must have\n\u0026#39;roles/cloudkms.cryptoKeyEncrypterDecrypter\u0026#39; to use this feature.\nThe expected format is \u0026#39;projects/*/locations/*/keyRings/*/cryptoKeys/*\u0026#39; When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Topic. When `null`, the `labels` field will be omitted from the resulting object.\n  - `message_retention_duration` (`string`): Indicates the minimum duration to retain a message after it is published\nto the topic. If this field is set, messages published to the topic in\nthe last messageRetentionDuration are always available to subscribers.\nFor instance, it allows any attached subscription to seek to a timestamp\nthat is up to messageRetentionDuration in the past. If this field is not\nset, message retention is controlled by settings on individual subscriptions.\nCannot be more than 31 days or less than 10 minutes. When `null`, the `message_retention_duration` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the topic.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `message_storage_policy` (`list[obj]`): Policy constraining the set of Google Cloud Platform regions where\nmessages published to the topic may be stored. If not present, then no\nconstraints are in effect. When `null`, the `message_storage_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_topic.message_storage_policy.new](#fn-message_storage_policynew) constructor.\n  - `schema_settings` (`list[obj]`): Settings for validating messages published against a schema. When `null`, the `schema_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_topic.schema_settings.new](#fn-schema_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_topic.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.pubsub_topic.new` injects a new `google_pubsub_topic` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.pubsub_topic.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.pubsub_topic` using the reference:\n\n    $._ref.google_pubsub_topic.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_pubsub_topic.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `kms_key_name` (`string`): The resource name of the Cloud KMS CryptoKey to be used to protect access\nto messages published on this topic. Your project\u0026#39;s PubSub service account\n(\u0026#39;service-{{PROJECT_NUMBER}}@gcp-sa-pubsub.iam.gserviceaccount.com\u0026#39;) must have\n\u0026#39;roles/cloudkms.cryptoKeyEncrypterDecrypter\u0026#39; to use this feature.\nThe expected format is \u0026#39;projects/*/locations/*/keyRings/*/cryptoKeys/*\u0026#39; When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Topic.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `message_retention_duration` (`string`): Indicates the minimum duration to retain a message after it is published\nto the topic. If this field is set, messages published to the topic in\nthe last messageRetentionDuration are always available to subscribers.\nFor instance, it allows any attached subscription to seek to a timestamp\nthat is up to messageRetentionDuration in the past. If this field is not\nset, message retention is controlled by settings on individual subscriptions.\nCannot be more than 31 days or less than 10 minutes. When `null`, the `message_retention_duration` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the topic.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `message_storage_policy` (`list[obj]`): Policy constraining the set of Google Cloud Platform regions where\nmessages published to the topic may be stored. If not present, then no\nconstraints are in effect. When `null`, the `message_storage_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_topic.message_storage_policy.new](#fn-message_storage_policynew) constructor.\n  - `schema_settings` (`list[obj]`): Settings for validating messages published against a schema. When `null`, the `schema_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_topic.schema_settings.new](#fn-schema_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_topic.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     name,
@@ -37,7 +37,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.pubsub_topic.newAttrs` constructs a new object with attributes and blocks configured for the `pubsub_topic`\nTerraform resource.\n\nUnlike [google.pubsub_topic.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `kms_key_name` (`string`): The resource name of the Cloud KMS CryptoKey to be used to protect access\nto messages published on this topic. Your project's PubSub service account\n('service-{{PROJECT_NUMBER}}@gcp-sa-pubsub.iam.gserviceaccount.com') must have\n'roles/cloudkms.cryptoKeyEncrypterDecrypter' to use this feature.\nThe expected format is 'projects/*/locations/*/keyRings/*/cryptoKeys/*' When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Topic. When `null`, the `labels` field will be omitted from the resulting object.\n  - `message_retention_duration` (`string`): Indicates the minimum duration to retain a message after it is published\nto the topic. If this field is set, messages published to the topic in\nthe last messageRetentionDuration are always available to subscribers.\nFor instance, it allows any attached subscription to seek to a timestamp\nthat is up to messageRetentionDuration in the past. If this field is not\nset, message retention is controlled by settings on individual subscriptions.\nCannot be more than 31 days or less than 10 minutes. When `null`, the `message_retention_duration` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the topic.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `message_storage_policy` (`list[obj]`): Policy constraining the set of Google Cloud Platform regions where\nmessages published to the topic may be stored. If not present, then no\nconstraints are in effect. When `null`, the `message_storage_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_topic.message_storage_policy.new](#fn-message_storage_policynew) constructor.\n  - `schema_settings` (`list[obj]`): Settings for validating messages published against a schema. When `null`, the `schema_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_topic.schema_settings.new](#fn-schema_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_topic.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pubsub_topic` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.pubsub_topic.newAttrs` constructs a new object with attributes and blocks configured for the `pubsub_topic`\nTerraform resource.\n\nUnlike [google.pubsub_topic.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `kms_key_name` (`string`): The resource name of the Cloud KMS CryptoKey to be used to protect access\nto messages published on this topic. Your project's PubSub service account\n('service-{{PROJECT_NUMBER}}@gcp-sa-pubsub.iam.gserviceaccount.com') must have\n'roles/cloudkms.cryptoKeyEncrypterDecrypter' to use this feature.\nThe expected format is 'projects/*/locations/*/keyRings/*/cryptoKeys/*' When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Topic.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `message_retention_duration` (`string`): Indicates the minimum duration to retain a message after it is published\nto the topic. If this field is set, messages published to the topic in\nthe last messageRetentionDuration are always available to subscribers.\nFor instance, it allows any attached subscription to seek to a timestamp\nthat is up to messageRetentionDuration in the past. If this field is not\nset, message retention is controlled by settings on individual subscriptions.\nCannot be more than 31 days or less than 10 minutes. When `null`, the `message_retention_duration` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the topic.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `message_storage_policy` (`list[obj]`): Policy constraining the set of Google Cloud Platform regions where\nmessages published to the topic may be stored. If not present, then no\nconstraints are in effect. When `null`, the `message_storage_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_topic.message_storage_policy.new](#fn-message_storage_policynew) constructor.\n  - `schema_settings` (`list[obj]`): Settings for validating messages published against a schema. When `null`, the `schema_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_topic.schema_settings.new](#fn-schema_settingsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_topic.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pubsub_topic` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     name,
     kms_key_name=null,
diff --git a/4.x/_gen/resources/recaptcha_enterprise_key.libsonnet b/4.x/_gen/resources/recaptcha_enterprise_key.libsonnet
index 0a905231..cd06b8fb 100644
--- a/4.x/_gen/resources/recaptcha_enterprise_key.libsonnet
+++ b/4.x/_gen/resources/recaptcha_enterprise_key.libsonnet
@@ -22,7 +22,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       allowed_bundle_ids: allowed_bundle_ids,
     }),
   },
-  '#new':: d.fn(help="\n`google.recaptcha_enterprise_key.new` injects a new `google_recaptcha_enterprise_key` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.recaptcha_enterprise_key.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.recaptcha_enterprise_key` using the reference:\n\n    $._ref.google_recaptcha_enterprise_key.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_recaptcha_enterprise_key.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `display_name` (`string`): Human-readable display name of this key. Modifiable by user.\n  - `labels` (`obj`): See [Creating and managing labels](https://cloud.google.com/recaptcha-enterprise/docs/labels). When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `android_settings` (`list[obj]`): Settings for keys that can be used by Android apps. When `null`, the `android_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.android_settings.new](#fn-android_settingsnew) constructor.\n  - `ios_settings` (`list[obj]`): Settings for keys that can be used by iOS apps. When `null`, the `ios_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.ios_settings.new](#fn-ios_settingsnew) constructor.\n  - `testing_options` (`list[obj]`): Options for user acceptance testing. When `null`, the `testing_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.testing_options.new](#fn-testing_optionsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.timeouts.new](#fn-timeoutsnew) constructor.\n  - `web_settings` (`list[obj]`): Settings for keys that can be used by websites. When `null`, the `web_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.web_settings.new](#fn-web_settingsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.recaptcha_enterprise_key.new` injects a new `google_recaptcha_enterprise_key` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.recaptcha_enterprise_key.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.recaptcha_enterprise_key` using the reference:\n\n    $._ref.google_recaptcha_enterprise_key.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_recaptcha_enterprise_key.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `display_name` (`string`): Human-readable display name of this key. Modifiable by user.\n  - `labels` (`obj`): See [Creating and managing labels](https://cloud.google.com/recaptcha-enterprise/docs/labels).\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `android_settings` (`list[obj]`): Settings for keys that can be used by Android apps. When `null`, the `android_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.android_settings.new](#fn-android_settingsnew) constructor.\n  - `ios_settings` (`list[obj]`): Settings for keys that can be used by iOS apps. When `null`, the `ios_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.ios_settings.new](#fn-ios_settingsnew) constructor.\n  - `testing_options` (`list[obj]`): Options for user acceptance testing. When `null`, the `testing_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.testing_options.new](#fn-testing_optionsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.timeouts.new](#fn-timeoutsnew) constructor.\n  - `web_settings` (`list[obj]`): Settings for keys that can be used by websites. When `null`, the `web_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.web_settings.new](#fn-web_settingsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     display_name,
@@ -49,7 +49,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.recaptcha_enterprise_key.newAttrs` constructs a new object with attributes and blocks configured for the `recaptcha_enterprise_key`\nTerraform resource.\n\nUnlike [google.recaptcha_enterprise_key.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `display_name` (`string`): Human-readable display name of this key. Modifiable by user.\n  - `labels` (`obj`): See [Creating and managing labels](https://cloud.google.com/recaptcha-enterprise/docs/labels). When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `android_settings` (`list[obj]`): Settings for keys that can be used by Android apps. When `null`, the `android_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.android_settings.new](#fn-android_settingsnew) constructor.\n  - `ios_settings` (`list[obj]`): Settings for keys that can be used by iOS apps. When `null`, the `ios_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.ios_settings.new](#fn-ios_settingsnew) constructor.\n  - `testing_options` (`list[obj]`): Options for user acceptance testing. When `null`, the `testing_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.testing_options.new](#fn-testing_optionsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.timeouts.new](#fn-timeoutsnew) constructor.\n  - `web_settings` (`list[obj]`): Settings for keys that can be used by websites. When `null`, the `web_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.web_settings.new](#fn-web_settingsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `recaptcha_enterprise_key` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.recaptcha_enterprise_key.newAttrs` constructs a new object with attributes and blocks configured for the `recaptcha_enterprise_key`\nTerraform resource.\n\nUnlike [google.recaptcha_enterprise_key.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `display_name` (`string`): Human-readable display name of this key. Modifiable by user.\n  - `labels` (`obj`): See [Creating and managing labels](https://cloud.google.com/recaptcha-enterprise/docs/labels).\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.\n  - `android_settings` (`list[obj]`): Settings for keys that can be used by Android apps. When `null`, the `android_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.android_settings.new](#fn-android_settingsnew) constructor.\n  - `ios_settings` (`list[obj]`): Settings for keys that can be used by iOS apps. When `null`, the `ios_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.ios_settings.new](#fn-ios_settingsnew) constructor.\n  - `testing_options` (`list[obj]`): Options for user acceptance testing. When `null`, the `testing_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.testing_options.new](#fn-testing_optionsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.timeouts.new](#fn-timeoutsnew) constructor.\n  - `web_settings` (`list[obj]`): Settings for keys that can be used by websites. When `null`, the `web_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.web_settings.new](#fn-web_settingsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `recaptcha_enterprise_key` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     display_name,
     android_settings=null,
diff --git a/4.x/_gen/resources/redis_cluster.libsonnet b/4.x/_gen/resources/redis_cluster.libsonnet
new file mode 100644
index 00000000..8709de76
--- /dev/null
+++ b/4.x/_gen/resources/redis_cluster.libsonnet
@@ -0,0 +1,186 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='redis_cluster', url='', help='`redis_cluster` represents the `google_redis_cluster` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`google.redis_cluster.new` injects a new `google_redis_cluster` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.redis_cluster.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.redis_cluster` using the reference:\n\n    $._ref.google_redis_cluster.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_redis_cluster.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `authorization_mode` (`string`): Optional. The authorization mode of the Redis cluster. If not provided, auth feature is disabled for the cluster. Default value: \u0026#34;AUTH_MODE_DISABLED\u0026#34; Possible values: [\u0026#34;AUTH_MODE_UNSPECIFIED\u0026#34;, \u0026#34;AUTH_MODE_IAM_AUTH\u0026#34;, \u0026#34;AUTH_MODE_DISABLED\u0026#34;] When `null`, the `authorization_mode` field will be omitted from the resulting object.\n  - `name` (`string`): Unique name of the resource in this scope including project and location using the form:\nprojects/{projectId}/locations/{locationId}/clusters/{clusterId} When `null`, the `name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The name of the region of the Redis cluster. When `null`, the `region` field will be omitted from the resulting object.\n  - `replica_count` (`number`): Optional. The number of replica nodes per shard. When `null`, the `replica_count` field will be omitted from the resulting object.\n  - `shard_count` (`number`): Required. Number of shards for the Redis cluster.\n  - `transit_encryption_mode` (`string`): Optional. The in-transit encryption for the Redis cluster.\nIf not provided, encryption is disabled for the cluster. Default value: \u0026#34;TRANSIT_ENCRYPTION_MODE_DISABLED\u0026#34; Possible values: [\u0026#34;TRANSIT_ENCRYPTION_MODE_UNSPECIFIED\u0026#34;, \u0026#34;TRANSIT_ENCRYPTION_MODE_DISABLED\u0026#34;, \u0026#34;TRANSIT_ENCRYPTION_MODE_SERVER_AUTHENTICATION\u0026#34;] When `null`, the `transit_encryption_mode` field will be omitted from the resulting object.\n  - `psc_configs` (`list[obj]`): Required. Each PscConfig configures the consumer network where two\nnetwork addresses will be designated to the cluster for client access.\nCurrently, only one PscConfig is supported. When `null`, the `psc_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_cluster.psc_configs.new](#fn-psc_configsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    shard_count,
+    authorization_mode=null,
+    name=null,
+    project=null,
+    psc_configs=null,
+    region=null,
+    replica_count=null,
+    timeouts=null,
+    transit_encryption_mode=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_redis_cluster',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      authorization_mode=authorization_mode,
+      name=name,
+      project=project,
+      psc_configs=psc_configs,
+      region=region,
+      replica_count=replica_count,
+      shard_count=shard_count,
+      timeouts=timeouts,
+      transit_encryption_mode=transit_encryption_mode
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.redis_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `redis_cluster`\nTerraform resource.\n\nUnlike [google.redis_cluster.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `authorization_mode` (`string`): Optional. The authorization mode of the Redis cluster. If not provided, auth feature is disabled for the cluster. Default value: "AUTH_MODE_DISABLED" Possible values: ["AUTH_MODE_UNSPECIFIED", "AUTH_MODE_IAM_AUTH", "AUTH_MODE_DISABLED"] When `null`, the `authorization_mode` field will be omitted from the resulting object.\n  - `name` (`string`): Unique name of the resource in this scope including project and location using the form:\nprojects/{projectId}/locations/{locationId}/clusters/{clusterId} When `null`, the `name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The name of the region of the Redis cluster. When `null`, the `region` field will be omitted from the resulting object.\n  - `replica_count` (`number`): Optional. The number of replica nodes per shard. When `null`, the `replica_count` field will be omitted from the resulting object.\n  - `shard_count` (`number`): Required. Number of shards for the Redis cluster.\n  - `transit_encryption_mode` (`string`): Optional. The in-transit encryption for the Redis cluster.\nIf not provided, encryption is disabled for the cluster. Default value: "TRANSIT_ENCRYPTION_MODE_DISABLED" Possible values: ["TRANSIT_ENCRYPTION_MODE_UNSPECIFIED", "TRANSIT_ENCRYPTION_MODE_DISABLED", "TRANSIT_ENCRYPTION_MODE_SERVER_AUTHENTICATION"] When `null`, the `transit_encryption_mode` field will be omitted from the resulting object.\n  - `psc_configs` (`list[obj]`): Required. Each PscConfig configures the consumer network where two\nnetwork addresses will be designated to the cluster for client access.\nCurrently, only one PscConfig is supported. When `null`, the `psc_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_cluster.psc_configs.new](#fn-psc_configsnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_cluster.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `redis_cluster` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    shard_count,
+    authorization_mode=null,
+    name=null,
+    project=null,
+    psc_configs=null,
+    region=null,
+    replica_count=null,
+    timeouts=null,
+    transit_encryption_mode=null
+  ):: std.prune(a={
+    authorization_mode: authorization_mode,
+    name: name,
+    project: project,
+    psc_configs: psc_configs,
+    region: region,
+    replica_count: replica_count,
+    shard_count: shard_count,
+    timeouts: timeouts,
+    transit_encryption_mode: transit_encryption_mode,
+  }),
+  psc_configs:: {
+    '#new':: d.fn(help='\n`google.redis_cluster.psc_configs.new` constructs a new object with attributes and blocks configured for the `psc_configs`\nTerraform sub block.\n\n\n\n**Args**:\n  - `network` (`string`): Required. The consumer network where the network address of\nthe discovery endpoint will be reserved, in the form of\nprojects/{network_project_id_or_number}/global/networks/{network_id}.\n\n**Returns**:\n  - An attribute object that represents the `psc_configs` sub block.\n', args=[]),
+    new(
+      network
+    ):: std.prune(a={
+      network: network,
+    }),
+  },
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.redis_cluster.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withAuthorizationMode':: d.fn(help='`google.string.withAuthorizationMode` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the authorization_mode field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `authorization_mode` field.\n', args=[]),
+  withAuthorizationMode(resourceLabel, value): {
+    resource+: {
+      google_redis_cluster+: {
+        [resourceLabel]+: {
+          authorization_mode: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`google.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      google_redis_cluster+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withProject':: d.fn(help='`google.string.withProject` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the project field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `project` field.\n', args=[]),
+  withProject(resourceLabel, value): {
+    resource+: {
+      google_redis_cluster+: {
+        [resourceLabel]+: {
+          project: value,
+        },
+      },
+    },
+  },
+  '#withPscConfigs':: d.fn(help='`google.list[obj].withPscConfigs` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the psc_configs field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withPscConfigsMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `psc_configs` field.\n', args=[]),
+  withPscConfigs(resourceLabel, value): {
+    resource+: {
+      google_redis_cluster+: {
+        [resourceLabel]+: {
+          psc_configs: value,
+        },
+      },
+    },
+  },
+  '#withPscConfigsMixin':: d.fn(help='`google.list[obj].withPscConfigsMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the psc_configs field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withPscConfigs](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `psc_configs` field.\n', args=[]),
+  withPscConfigsMixin(resourceLabel, value): {
+    resource+: {
+      google_redis_cluster+: {
+        [resourceLabel]+: {
+          psc_configs+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withRegion':: d.fn(help='`google.string.withRegion` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the region field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `region` field.\n', args=[]),
+  withRegion(resourceLabel, value): {
+    resource+: {
+      google_redis_cluster+: {
+        [resourceLabel]+: {
+          region: value,
+        },
+      },
+    },
+  },
+  '#withReplicaCount':: d.fn(help='`google.number.withReplicaCount` constructs a mixin object that can be merged into the `number`\nTerraform resource block to set or update the replica_count field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`number`): The value to set for the `replica_count` field.\n', args=[]),
+  withReplicaCount(resourceLabel, value): {
+    resource+: {
+      google_redis_cluster+: {
+        [resourceLabel]+: {
+          replica_count: value,
+        },
+      },
+    },
+  },
+  '#withShardCount':: d.fn(help='`google.number.withShardCount` constructs a mixin object that can be merged into the `number`\nTerraform resource block to set or update the shard_count field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`number`): The value to set for the `shard_count` field.\n', args=[]),
+  withShardCount(resourceLabel, value): {
+    resource+: {
+      google_redis_cluster+: {
+        [resourceLabel]+: {
+          shard_count: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_redis_cluster+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_redis_cluster+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+  '#withTransitEncryptionMode':: d.fn(help='`google.string.withTransitEncryptionMode` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the transit_encryption_mode field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `transit_encryption_mode` field.\n', args=[]),
+  withTransitEncryptionMode(resourceLabel, value): {
+    resource+: {
+      google_redis_cluster+: {
+        [resourceLabel]+: {
+          transit_encryption_mode: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/redis_instance.libsonnet b/4.x/_gen/resources/redis_instance.libsonnet
index c4bbcfb4..b08210d8 100644
--- a/4.x/_gen/resources/redis_instance.libsonnet
+++ b/4.x/_gen/resources/redis_instance.libsonnet
@@ -36,7 +36,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
-  '#new':: d.fn(help="\n`google.redis_instance.new` injects a new `google_redis_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.redis_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.redis_instance` using the reference:\n\n    $._ref.google_redis_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_redis_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `alternative_location_id` (`string`): Only applicable to STANDARD_HA tier which protects the instance\nagainst zonal failures by provisioning it across two zones.\nIf provided, it must be a different zone from the one provided in\n[locationId]. When `null`, the `alternative_location_id` field will be omitted from the resulting object.\n  - `auth_enabled` (`bool`): Optional. Indicates whether OSS Redis AUTH is enabled for the\ninstance. If set to \u0026#34;true\u0026#34; AUTH is enabled on the instance.\nDefault value is \u0026#34;false\u0026#34; meaning AUTH is disabled. When `null`, the `auth_enabled` field will be omitted from the resulting object.\n  - `authorized_network` (`string`): The full name of the Google Compute Engine network to which the\ninstance is connected. If left unspecified, the default network\nwill be used. When `null`, the `authorized_network` field will be omitted from the resulting object.\n  - `connect_mode` (`string`): The connection mode of the Redis instance. Default value: \u0026#34;DIRECT_PEERING\u0026#34; Possible values: [\u0026#34;DIRECT_PEERING\u0026#34;, \u0026#34;PRIVATE_SERVICE_ACCESS\u0026#34;] When `null`, the `connect_mode` field will be omitted from the resulting object.\n  - `customer_managed_key` (`string`): Optional. The KMS key reference that you want to use to encrypt the data at rest for this Redis\ninstance. If this is provided, CMEK is enabled. When `null`, the `customer_managed_key` field will be omitted from the resulting object.\n  - `display_name` (`string`): An arbitrary and optional user-provided name for the instance. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location_id` (`string`): The zone where the instance will be provisioned. If not provided,\nthe service will choose a zone for the instance. For STANDARD_HA tier,\ninstances will be created across two zones for protection against\nzonal failures. If [alternativeLocationId] is also provided, it must\nbe different from [locationId]. When `null`, the `location_id` field will be omitted from the resulting object.\n  - `memory_size_gb` (`number`): Redis memory size in GiB.\n  - `name` (`string`): The ID of the instance or a fully qualified identifier for the instance.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `read_replicas_mode` (`string`): Optional. Read replica mode. Can only be specified when trying to create the instance.\nIf not set, Memorystore Redis backend will default to READ_REPLICAS_DISABLED.\n- READ_REPLICAS_DISABLED: If disabled, read endpoint will not be provided and the\ninstance cannot scale up or down the number of replicas.\n- READ_REPLICAS_ENABLED: If enabled, read endpoint will be provided and the instance\ncan scale up and down the number of replicas. Possible values: [\u0026#34;READ_REPLICAS_DISABLED\u0026#34;, \u0026#34;READ_REPLICAS_ENABLED\u0026#34;] When `null`, the `read_replicas_mode` field will be omitted from the resulting object.\n  - `redis_configs` (`obj`): Redis configuration parameters, according to http://redis.io/topics/config.\nPlease check Memorystore documentation for the list of supported parameters:\nhttps://cloud.google.com/memorystore/docs/redis/reference/rest/v1/projects.locations.instances#Instance.FIELDS.redis_configs When `null`, the `redis_configs` field will be omitted from the resulting object.\n  - `redis_version` (`string`): The version of Redis software. If not provided, latest supported\nversion will be used. Please check the API documentation linked\nat the top for the latest valid values. When `null`, the `redis_version` field will be omitted from the resulting object.\n  - `region` (`string`): The name of the Redis region of the instance. When `null`, the `region` field will be omitted from the resulting object.\n  - `replica_count` (`number`): Optional. The number of replica nodes. The valid range for the Standard Tier with\nread replicas enabled is [1-5] and defaults to 2. If read replicas are not enabled\nfor a Standard Tier instance, the only valid value is 1 and the default is 1.\nThe valid value for basic tier is 0 and the default is also 0. When `null`, the `replica_count` field will be omitted from the resulting object.\n  - `reserved_ip_range` (`string`): The CIDR range of internal addresses that are reserved for this\ninstance. If not provided, the service will choose an unused /29\nblock, for example, 10.0.0.0/29 or 192.168.0.0/29. Ranges must be\nunique and non-overlapping with existing subnets in an authorized\nnetwork. When `null`, the `reserved_ip_range` field will be omitted from the resulting object.\n  - `secondary_ip_range` (`string`): Optional. Additional IP range for node placement. Required when enabling read replicas on\nan existing instance. For DIRECT_PEERING mode value must be a CIDR range of size /28, or\n\u0026#34;auto\u0026#34;. For PRIVATE_SERVICE_ACCESS mode value must be the name of an allocated address\nrange associated with the private service access connection, or \u0026#34;auto\u0026#34;. When `null`, the `secondary_ip_range` field will be omitted from the resulting object.\n  - `tier` (`string`): The service tier of the instance. Must be one of these values:\n\n- BASIC: standalone instance\n- STANDARD_HA: highly available primary/replica instances Default value: \u0026#34;BASIC\u0026#34; Possible values: [\u0026#34;BASIC\u0026#34;, \u0026#34;STANDARD_HA\u0026#34;] When `null`, the `tier` field will be omitted from the resulting object.\n  - `transit_encryption_mode` (`string`): The TLS mode of the Redis instance, If not provided, TLS is disabled for the instance.\n\n- SERVER_AUTHENTICATION: Client to Server traffic encryption enabled with server authentication Default value: \u0026#34;DISABLED\u0026#34; Possible values: [\u0026#34;SERVER_AUTHENTICATION\u0026#34;, \u0026#34;DISABLED\u0026#34;] When `null`, the `transit_encryption_mode` field will be omitted from the resulting object.\n  - `maintenance_policy` (`list[obj]`): Maintenance policy for an instance. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_instance.maintenance_policy.new](#fn-maintenance_policynew) constructor.\n  - `persistence_config` (`list[obj]`): Persistence configuration for an instance. When `null`, the `persistence_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_instance.persistence_config.new](#fn-persistence_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.redis_instance.new` injects a new `google_redis_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.redis_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.redis_instance` using the reference:\n\n    $._ref.google_redis_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_redis_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `alternative_location_id` (`string`): Only applicable to STANDARD_HA tier which protects the instance\nagainst zonal failures by provisioning it across two zones.\nIf provided, it must be a different zone from the one provided in\n[locationId]. When `null`, the `alternative_location_id` field will be omitted from the resulting object.\n  - `auth_enabled` (`bool`): Optional. Indicates whether OSS Redis AUTH is enabled for the\ninstance. If set to \u0026#34;true\u0026#34; AUTH is enabled on the instance.\nDefault value is \u0026#34;false\u0026#34; meaning AUTH is disabled. When `null`, the `auth_enabled` field will be omitted from the resulting object.\n  - `authorized_network` (`string`): The full name of the Google Compute Engine network to which the\ninstance is connected. If left unspecified, the default network\nwill be used. When `null`, the `authorized_network` field will be omitted from the resulting object.\n  - `connect_mode` (`string`): The connection mode of the Redis instance. Default value: \u0026#34;DIRECT_PEERING\u0026#34; Possible values: [\u0026#34;DIRECT_PEERING\u0026#34;, \u0026#34;PRIVATE_SERVICE_ACCESS\u0026#34;] When `null`, the `connect_mode` field will be omitted from the resulting object.\n  - `customer_managed_key` (`string`): Optional. The KMS key reference that you want to use to encrypt the data at rest for this Redis\ninstance. If this is provided, CMEK is enabled. When `null`, the `customer_managed_key` field will be omitted from the resulting object.\n  - `display_name` (`string`): An arbitrary and optional user-provided name for the instance. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location_id` (`string`): The zone where the instance will be provisioned. If not provided,\nthe service will choose a zone for the instance. For STANDARD_HA tier,\ninstances will be created across two zones for protection against\nzonal failures. If [alternativeLocationId] is also provided, it must\nbe different from [locationId]. When `null`, the `location_id` field will be omitted from the resulting object.\n  - `memory_size_gb` (`number`): Redis memory size in GiB.\n  - `name` (`string`): The ID of the instance or a fully qualified identifier for the instance.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `read_replicas_mode` (`string`): Optional. Read replica mode. Can only be specified when trying to create the instance.\nIf not set, Memorystore Redis backend will default to READ_REPLICAS_DISABLED.\n- READ_REPLICAS_DISABLED: If disabled, read endpoint will not be provided and the\ninstance cannot scale up or down the number of replicas.\n- READ_REPLICAS_ENABLED: If enabled, read endpoint will be provided and the instance\ncan scale up and down the number of replicas. Possible values: [\u0026#34;READ_REPLICAS_DISABLED\u0026#34;, \u0026#34;READ_REPLICAS_ENABLED\u0026#34;] When `null`, the `read_replicas_mode` field will be omitted from the resulting object.\n  - `redis_configs` (`obj`): Redis configuration parameters, according to http://redis.io/topics/config.\nPlease check Memorystore documentation for the list of supported parameters:\nhttps://cloud.google.com/memorystore/docs/redis/reference/rest/v1/projects.locations.instances#Instance.FIELDS.redis_configs When `null`, the `redis_configs` field will be omitted from the resulting object.\n  - `redis_version` (`string`): The version of Redis software. If not provided, latest supported\nversion will be used. Please check the API documentation linked\nat the top for the latest valid values. When `null`, the `redis_version` field will be omitted from the resulting object.\n  - `region` (`string`): The name of the Redis region of the instance. When `null`, the `region` field will be omitted from the resulting object.\n  - `replica_count` (`number`): Optional. The number of replica nodes. The valid range for the Standard Tier with\nread replicas enabled is [1-5] and defaults to 2. If read replicas are not enabled\nfor a Standard Tier instance, the only valid value is 1 and the default is 1.\nThe valid value for basic tier is 0 and the default is also 0. When `null`, the `replica_count` field will be omitted from the resulting object.\n  - `reserved_ip_range` (`string`): The CIDR range of internal addresses that are reserved for this\ninstance. If not provided, the service will choose an unused /29\nblock, for example, 10.0.0.0/29 or 192.168.0.0/29. Ranges must be\nunique and non-overlapping with existing subnets in an authorized\nnetwork. When `null`, the `reserved_ip_range` field will be omitted from the resulting object.\n  - `secondary_ip_range` (`string`): Optional. Additional IP range for node placement. Required when enabling read replicas on\nan existing instance. For DIRECT_PEERING mode value must be a CIDR range of size /28, or\n\u0026#34;auto\u0026#34;. For PRIVATE_SERVICE_ACCESS mode value must be the name of an allocated address\nrange associated with the private service access connection, or \u0026#34;auto\u0026#34;. When `null`, the `secondary_ip_range` field will be omitted from the resulting object.\n  - `tier` (`string`): The service tier of the instance. Must be one of these values:\n\n- BASIC: standalone instance\n- STANDARD_HA: highly available primary/replica instances Default value: \u0026#34;BASIC\u0026#34; Possible values: [\u0026#34;BASIC\u0026#34;, \u0026#34;STANDARD_HA\u0026#34;] When `null`, the `tier` field will be omitted from the resulting object.\n  - `transit_encryption_mode` (`string`): The TLS mode of the Redis instance, If not provided, TLS is disabled for the instance.\n\n- SERVER_AUTHENTICATION: Client to Server traffic encryption enabled with server authentication Default value: \u0026#34;DISABLED\u0026#34; Possible values: [\u0026#34;SERVER_AUTHENTICATION\u0026#34;, \u0026#34;DISABLED\u0026#34;] When `null`, the `transit_encryption_mode` field will be omitted from the resulting object.\n  - `maintenance_policy` (`list[obj]`): Maintenance policy for an instance. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_instance.maintenance_policy.new](#fn-maintenance_policynew) constructor.\n  - `persistence_config` (`list[obj]`): Persistence configuration for an instance. When `null`, the `persistence_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_instance.persistence_config.new](#fn-persistence_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     memory_size_gb,
@@ -93,7 +93,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.redis_instance.newAttrs` constructs a new object with attributes and blocks configured for the `redis_instance`\nTerraform resource.\n\nUnlike [google.redis_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `alternative_location_id` (`string`): Only applicable to STANDARD_HA tier which protects the instance\nagainst zonal failures by provisioning it across two zones.\nIf provided, it must be a different zone from the one provided in\n[locationId]. When `null`, the `alternative_location_id` field will be omitted from the resulting object.\n  - `auth_enabled` (`bool`): Optional. Indicates whether OSS Redis AUTH is enabled for the\ninstance. If set to "true" AUTH is enabled on the instance.\nDefault value is "false" meaning AUTH is disabled. When `null`, the `auth_enabled` field will be omitted from the resulting object.\n  - `authorized_network` (`string`): The full name of the Google Compute Engine network to which the\ninstance is connected. If left unspecified, the default network\nwill be used. When `null`, the `authorized_network` field will be omitted from the resulting object.\n  - `connect_mode` (`string`): The connection mode of the Redis instance. Default value: "DIRECT_PEERING" Possible values: ["DIRECT_PEERING", "PRIVATE_SERVICE_ACCESS"] When `null`, the `connect_mode` field will be omitted from the resulting object.\n  - `customer_managed_key` (`string`): Optional. The KMS key reference that you want to use to encrypt the data at rest for this Redis\ninstance. If this is provided, CMEK is enabled. When `null`, the `customer_managed_key` field will be omitted from the resulting object.\n  - `display_name` (`string`): An arbitrary and optional user-provided name for the instance. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location_id` (`string`): The zone where the instance will be provisioned. If not provided,\nthe service will choose a zone for the instance. For STANDARD_HA tier,\ninstances will be created across two zones for protection against\nzonal failures. If [alternativeLocationId] is also provided, it must\nbe different from [locationId]. When `null`, the `location_id` field will be omitted from the resulting object.\n  - `memory_size_gb` (`number`): Redis memory size in GiB.\n  - `name` (`string`): The ID of the instance or a fully qualified identifier for the instance.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `read_replicas_mode` (`string`): Optional. Read replica mode. Can only be specified when trying to create the instance.\nIf not set, Memorystore Redis backend will default to READ_REPLICAS_DISABLED.\n- READ_REPLICAS_DISABLED: If disabled, read endpoint will not be provided and the\ninstance cannot scale up or down the number of replicas.\n- READ_REPLICAS_ENABLED: If enabled, read endpoint will be provided and the instance\ncan scale up and down the number of replicas. Possible values: ["READ_REPLICAS_DISABLED", "READ_REPLICAS_ENABLED"] When `null`, the `read_replicas_mode` field will be omitted from the resulting object.\n  - `redis_configs` (`obj`): Redis configuration parameters, according to http://redis.io/topics/config.\nPlease check Memorystore documentation for the list of supported parameters:\nhttps://cloud.google.com/memorystore/docs/redis/reference/rest/v1/projects.locations.instances#Instance.FIELDS.redis_configs When `null`, the `redis_configs` field will be omitted from the resulting object.\n  - `redis_version` (`string`): The version of Redis software. If not provided, latest supported\nversion will be used. Please check the API documentation linked\nat the top for the latest valid values. When `null`, the `redis_version` field will be omitted from the resulting object.\n  - `region` (`string`): The name of the Redis region of the instance. When `null`, the `region` field will be omitted from the resulting object.\n  - `replica_count` (`number`): Optional. The number of replica nodes. The valid range for the Standard Tier with\nread replicas enabled is [1-5] and defaults to 2. If read replicas are not enabled\nfor a Standard Tier instance, the only valid value is 1 and the default is 1.\nThe valid value for basic tier is 0 and the default is also 0. When `null`, the `replica_count` field will be omitted from the resulting object.\n  - `reserved_ip_range` (`string`): The CIDR range of internal addresses that are reserved for this\ninstance. If not provided, the service will choose an unused /29\nblock, for example, 10.0.0.0/29 or 192.168.0.0/29. Ranges must be\nunique and non-overlapping with existing subnets in an authorized\nnetwork. When `null`, the `reserved_ip_range` field will be omitted from the resulting object.\n  - `secondary_ip_range` (`string`): Optional. Additional IP range for node placement. Required when enabling read replicas on\nan existing instance. For DIRECT_PEERING mode value must be a CIDR range of size /28, or\n"auto". For PRIVATE_SERVICE_ACCESS mode value must be the name of an allocated address\nrange associated with the private service access connection, or "auto". When `null`, the `secondary_ip_range` field will be omitted from the resulting object.\n  - `tier` (`string`): The service tier of the instance. Must be one of these values:\n\n- BASIC: standalone instance\n- STANDARD_HA: highly available primary/replica instances Default value: "BASIC" Possible values: ["BASIC", "STANDARD_HA"] When `null`, the `tier` field will be omitted from the resulting object.\n  - `transit_encryption_mode` (`string`): The TLS mode of the Redis instance, If not provided, TLS is disabled for the instance.\n\n- SERVER_AUTHENTICATION: Client to Server traffic encryption enabled with server authentication Default value: "DISABLED" Possible values: ["SERVER_AUTHENTICATION", "DISABLED"] When `null`, the `transit_encryption_mode` field will be omitted from the resulting object.\n  - `maintenance_policy` (`list[obj]`): Maintenance policy for an instance. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_instance.maintenance_policy.new](#fn-maintenance_policynew) constructor.\n  - `persistence_config` (`list[obj]`): Persistence configuration for an instance. When `null`, the `persistence_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_instance.persistence_config.new](#fn-persistence_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `redis_instance` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.redis_instance.newAttrs` constructs a new object with attributes and blocks configured for the `redis_instance`\nTerraform resource.\n\nUnlike [google.redis_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `alternative_location_id` (`string`): Only applicable to STANDARD_HA tier which protects the instance\nagainst zonal failures by provisioning it across two zones.\nIf provided, it must be a different zone from the one provided in\n[locationId]. When `null`, the `alternative_location_id` field will be omitted from the resulting object.\n  - `auth_enabled` (`bool`): Optional. Indicates whether OSS Redis AUTH is enabled for the\ninstance. If set to "true" AUTH is enabled on the instance.\nDefault value is "false" meaning AUTH is disabled. When `null`, the `auth_enabled` field will be omitted from the resulting object.\n  - `authorized_network` (`string`): The full name of the Google Compute Engine network to which the\ninstance is connected. If left unspecified, the default network\nwill be used. When `null`, the `authorized_network` field will be omitted from the resulting object.\n  - `connect_mode` (`string`): The connection mode of the Redis instance. Default value: "DIRECT_PEERING" Possible values: ["DIRECT_PEERING", "PRIVATE_SERVICE_ACCESS"] When `null`, the `connect_mode` field will be omitted from the resulting object.\n  - `customer_managed_key` (`string`): Optional. The KMS key reference that you want to use to encrypt the data at rest for this Redis\ninstance. If this is provided, CMEK is enabled. When `null`, the `customer_managed_key` field will be omitted from the resulting object.\n  - `display_name` (`string`): An arbitrary and optional user-provided name for the instance. When `null`, the `display_name` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location_id` (`string`): The zone where the instance will be provisioned. If not provided,\nthe service will choose a zone for the instance. For STANDARD_HA tier,\ninstances will be created across two zones for protection against\nzonal failures. If [alternativeLocationId] is also provided, it must\nbe different from [locationId]. When `null`, the `location_id` field will be omitted from the resulting object.\n  - `memory_size_gb` (`number`): Redis memory size in GiB.\n  - `name` (`string`): The ID of the instance or a fully qualified identifier for the instance.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `read_replicas_mode` (`string`): Optional. Read replica mode. Can only be specified when trying to create the instance.\nIf not set, Memorystore Redis backend will default to READ_REPLICAS_DISABLED.\n- READ_REPLICAS_DISABLED: If disabled, read endpoint will not be provided and the\ninstance cannot scale up or down the number of replicas.\n- READ_REPLICAS_ENABLED: If enabled, read endpoint will be provided and the instance\ncan scale up and down the number of replicas. Possible values: ["READ_REPLICAS_DISABLED", "READ_REPLICAS_ENABLED"] When `null`, the `read_replicas_mode` field will be omitted from the resulting object.\n  - `redis_configs` (`obj`): Redis configuration parameters, according to http://redis.io/topics/config.\nPlease check Memorystore documentation for the list of supported parameters:\nhttps://cloud.google.com/memorystore/docs/redis/reference/rest/v1/projects.locations.instances#Instance.FIELDS.redis_configs When `null`, the `redis_configs` field will be omitted from the resulting object.\n  - `redis_version` (`string`): The version of Redis software. If not provided, latest supported\nversion will be used. Please check the API documentation linked\nat the top for the latest valid values. When `null`, the `redis_version` field will be omitted from the resulting object.\n  - `region` (`string`): The name of the Redis region of the instance. When `null`, the `region` field will be omitted from the resulting object.\n  - `replica_count` (`number`): Optional. The number of replica nodes. The valid range for the Standard Tier with\nread replicas enabled is [1-5] and defaults to 2. If read replicas are not enabled\nfor a Standard Tier instance, the only valid value is 1 and the default is 1.\nThe valid value for basic tier is 0 and the default is also 0. When `null`, the `replica_count` field will be omitted from the resulting object.\n  - `reserved_ip_range` (`string`): The CIDR range of internal addresses that are reserved for this\ninstance. If not provided, the service will choose an unused /29\nblock, for example, 10.0.0.0/29 or 192.168.0.0/29. Ranges must be\nunique and non-overlapping with existing subnets in an authorized\nnetwork. When `null`, the `reserved_ip_range` field will be omitted from the resulting object.\n  - `secondary_ip_range` (`string`): Optional. Additional IP range for node placement. Required when enabling read replicas on\nan existing instance. For DIRECT_PEERING mode value must be a CIDR range of size /28, or\n"auto". For PRIVATE_SERVICE_ACCESS mode value must be the name of an allocated address\nrange associated with the private service access connection, or "auto". When `null`, the `secondary_ip_range` field will be omitted from the resulting object.\n  - `tier` (`string`): The service tier of the instance. Must be one of these values:\n\n- BASIC: standalone instance\n- STANDARD_HA: highly available primary/replica instances Default value: "BASIC" Possible values: ["BASIC", "STANDARD_HA"] When `null`, the `tier` field will be omitted from the resulting object.\n  - `transit_encryption_mode` (`string`): The TLS mode of the Redis instance, If not provided, TLS is disabled for the instance.\n\n- SERVER_AUTHENTICATION: Client to Server traffic encryption enabled with server authentication Default value: "DISABLED" Possible values: ["SERVER_AUTHENTICATION", "DISABLED"] When `null`, the `transit_encryption_mode` field will be omitted from the resulting object.\n  - `maintenance_policy` (`list[obj]`): Maintenance policy for an instance. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_instance.maintenance_policy.new](#fn-maintenance_policynew) constructor.\n  - `persistence_config` (`list[obj]`): Persistence configuration for an instance. When `null`, the `persistence_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_instance.persistence_config.new](#fn-persistence_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `redis_instance` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     memory_size_gb,
     name,
diff --git a/4.x/_gen/resources/scc_folder_custom_module.libsonnet b/4.x/_gen/resources/scc_folder_custom_module.libsonnet
new file mode 100644
index 00000000..70f40acd
--- /dev/null
+++ b/4.x/_gen/resources/scc_folder_custom_module.libsonnet
@@ -0,0 +1,194 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='scc_folder_custom_module', url='', help='`scc_folder_custom_module` represents the `google_scc_folder_custom_module` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  custom_config:: {
+    custom_output:: {
+      '#new':: d.fn(help='\n`google.scc_folder_custom_module.custom_config.custom_output.new` constructs a new object with attributes and blocks configured for the `custom_output`\nTerraform sub block.\n\n\n\n**Args**:\n  - `properties` (`list[obj]`): A list of custom output properties to add to the finding. When `null`, the `properties` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.custom_config.custom_output.properties.new](#fn-custom_configcustom_configpropertiesnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `custom_output` sub block.\n', args=[]),
+      new(
+        properties=null
+      ):: std.prune(a={
+        properties: properties,
+      }),
+      properties:: {
+        '#new':: d.fn(help='\n`google.scc_folder_custom_module.custom_config.custom_output.properties.new` constructs a new object with attributes and blocks configured for the `properties`\nTerraform sub block.\n\n\n\n**Args**:\n  - `name` (`string`): Name of the property for the custom output. When `null`, the `name` field will be omitted from the resulting object.\n  - `value_expression` (`list[obj]`): The CEL expression for the custom output. A resource property can be specified\nto return the value of the property or a text string enclosed in quotation marks. When `null`, the `value_expression` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.custom_config.custom_output.properties.value_expression.new](#fn-custom_configcustom_configcustom_outputvalue_expressionnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `properties` sub block.\n', args=[]),
+        new(
+          name=null,
+          value_expression=null
+        ):: std.prune(a={
+          name: name,
+          value_expression: value_expression,
+        }),
+        value_expression:: {
+          '#new':: d.fn(help='\n`google.scc_folder_custom_module.custom_config.custom_output.properties.value_expression.new` constructs a new object with attributes and blocks configured for the `value_expression`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Description of the expression. This is a longer text which describes the\nexpression, e.g. when hovered over it in a UI. When `null`, the `description` field will be omitted from the resulting object.\n  - `expression` (`string`): Textual representation of an expression in Common Expression Language syntax.\n  - `location` (`string`): String indicating the location of the expression for error reporting, e.g. a\nfile name and a position in the file. When `null`, the `location` field will be omitted from the resulting object.\n  - `title` (`string`): Title for the expression, i.e. a short string describing its purpose. This can\nbe used e.g. in UIs which allow to enter the expression. When `null`, the `title` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `value_expression` sub block.\n', args=[]),
+          new(
+            expression,
+            description=null,
+            location=null,
+            title=null
+          ):: std.prune(a={
+            description: description,
+            expression: expression,
+            location: location,
+            title: title,
+          }),
+        },
+      },
+    },
+    '#new':: d.fn(help='\n`google.scc_folder_custom_module.custom_config.new` constructs a new object with attributes and blocks configured for the `custom_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Text that describes the vulnerability or misconfiguration that the custom\nmodule detects. This explanation is returned with each finding instance to\nhelp investigators understand the detected issue. The text must be enclosed in quotation marks. When `null`, the `description` field will be omitted from the resulting object.\n  - `recommendation` (`string`): An explanation of the recommended steps that security teams can take to resolve\nthe detected issue. This explanation is returned with each finding generated by\nthis module in the nextSteps property of the finding JSON.\n  - `severity` (`string`): The severity to assign to findings generated by the module. Possible values: ["CRITICAL", "HIGH", "MEDIUM", "LOW"]\n  - `custom_output` (`list[obj]`): Custom output properties. When `null`, the `custom_output` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.custom_config.custom_output.new](#fn-custom_configcustom_outputnew) constructor.\n  - `predicate` (`list[obj]`): The CEL expression to evaluate to produce findings. When the expression evaluates\nto true against a resource, a finding is generated. When `null`, the `predicate` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.custom_config.predicate.new](#fn-custom_configpredicatenew) constructor.\n  - `resource_selector` (`list[obj]`): The resource types that the custom module operates on. Each custom module\ncan specify up to 5 resource types. When `null`, the `resource_selector` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.custom_config.resource_selector.new](#fn-custom_configresource_selectornew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `custom_config` sub block.\n', args=[]),
+    new(
+      recommendation,
+      severity,
+      custom_output=null,
+      description=null,
+      predicate=null,
+      resource_selector=null
+    ):: std.prune(a={
+      custom_output: custom_output,
+      description: description,
+      predicate: predicate,
+      recommendation: recommendation,
+      resource_selector: resource_selector,
+      severity: severity,
+    }),
+    predicate:: {
+      '#new':: d.fn(help='\n`google.scc_folder_custom_module.custom_config.predicate.new` constructs a new object with attributes and blocks configured for the `predicate`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Description of the expression. This is a longer text which describes the\nexpression, e.g. when hovered over it in a UI. When `null`, the `description` field will be omitted from the resulting object.\n  - `expression` (`string`): Textual representation of an expression in Common Expression Language syntax.\n  - `location` (`string`): String indicating the location of the expression for error reporting, e.g. a\nfile name and a position in the file. When `null`, the `location` field will be omitted from the resulting object.\n  - `title` (`string`): Title for the expression, i.e. a short string describing its purpose. This can\nbe used e.g. in UIs which allow to enter the expression. When `null`, the `title` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `predicate` sub block.\n', args=[]),
+      new(
+        expression,
+        description=null,
+        location=null,
+        title=null
+      ):: std.prune(a={
+        description: description,
+        expression: expression,
+        location: location,
+        title: title,
+      }),
+    },
+    resource_selector:: {
+      '#new':: d.fn(help='\n`google.scc_folder_custom_module.custom_config.resource_selector.new` constructs a new object with attributes and blocks configured for the `resource_selector`\nTerraform sub block.\n\n\n\n**Args**:\n  - `resource_types` (`list`): The resource types to run the detector on.\n\n**Returns**:\n  - An attribute object that represents the `resource_selector` sub block.\n', args=[]),
+      new(
+        resource_types
+      ):: std.prune(a={
+        resource_types: resource_types,
+      }),
+    },
+  },
+  '#new':: d.fn(help="\n`google.scc_folder_custom_module.new` injects a new `google_scc_folder_custom_module` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.scc_folder_custom_module.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.scc_folder_custom_module` using the reference:\n\n    $._ref.google_scc_folder_custom_module.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_scc_folder_custom_module.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `display_name` (`string`): The display name of the Security Health Analytics custom module. This\ndisplay name becomes the finding category for all findings that are\nreturned by this custom module. The display name must be between 1 and\n128 characters, start with a lowercase letter, and contain alphanumeric\ncharacters or underscores only.\n  - `enablement_state` (`string`): The enablement state of the custom module. Possible values: [\u0026#34;ENABLED\u0026#34;, \u0026#34;DISABLED\u0026#34;]\n  - `folder` (`string`): Numerical ID of the parent folder.\n  - `custom_config` (`list[obj]`): The user specified custom configuration for the module. When `null`, the `custom_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.custom_config.new](#fn-custom_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    display_name,
+    enablement_state,
+    folder,
+    custom_config=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_scc_folder_custom_module',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      custom_config=custom_config,
+      display_name=display_name,
+      enablement_state=enablement_state,
+      folder=folder,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.scc_folder_custom_module.newAttrs` constructs a new object with attributes and blocks configured for the `scc_folder_custom_module`\nTerraform resource.\n\nUnlike [google.scc_folder_custom_module.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `display_name` (`string`): The display name of the Security Health Analytics custom module. This\ndisplay name becomes the finding category for all findings that are\nreturned by this custom module. The display name must be between 1 and\n128 characters, start with a lowercase letter, and contain alphanumeric\ncharacters or underscores only.\n  - `enablement_state` (`string`): The enablement state of the custom module. Possible values: ["ENABLED", "DISABLED"]\n  - `folder` (`string`): Numerical ID of the parent folder.\n  - `custom_config` (`list[obj]`): The user specified custom configuration for the module. When `null`, the `custom_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.custom_config.new](#fn-custom_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `scc_folder_custom_module` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    display_name,
+    enablement_state,
+    folder,
+    custom_config=null,
+    timeouts=null
+  ):: std.prune(a={
+    custom_config: custom_config,
+    display_name: display_name,
+    enablement_state: enablement_state,
+    folder: folder,
+    timeouts: timeouts,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.scc_folder_custom_module.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withCustomConfig':: d.fn(help='`google.list[obj].withCustomConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the custom_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withCustomConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `custom_config` field.\n', args=[]),
+  withCustomConfig(resourceLabel, value): {
+    resource+: {
+      google_scc_folder_custom_module+: {
+        [resourceLabel]+: {
+          custom_config: value,
+        },
+      },
+    },
+  },
+  '#withCustomConfigMixin':: d.fn(help='`google.list[obj].withCustomConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the custom_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withCustomConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `custom_config` field.\n', args=[]),
+  withCustomConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_scc_folder_custom_module+: {
+        [resourceLabel]+: {
+          custom_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withDisplayName':: d.fn(help='`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the display_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `display_name` field.\n', args=[]),
+  withDisplayName(resourceLabel, value): {
+    resource+: {
+      google_scc_folder_custom_module+: {
+        [resourceLabel]+: {
+          display_name: value,
+        },
+      },
+    },
+  },
+  '#withEnablementState':: d.fn(help='`google.string.withEnablementState` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the enablement_state field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `enablement_state` field.\n', args=[]),
+  withEnablementState(resourceLabel, value): {
+    resource+: {
+      google_scc_folder_custom_module+: {
+        [resourceLabel]+: {
+          enablement_state: value,
+        },
+      },
+    },
+  },
+  '#withFolder':: d.fn(help='`google.string.withFolder` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the folder field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `folder` field.\n', args=[]),
+  withFolder(resourceLabel, value): {
+    resource+: {
+      google_scc_folder_custom_module+: {
+        [resourceLabel]+: {
+          folder: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_scc_folder_custom_module+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_scc_folder_custom_module+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/scc_organization_custom_module.libsonnet b/4.x/_gen/resources/scc_organization_custom_module.libsonnet
new file mode 100644
index 00000000..c35b5f84
--- /dev/null
+++ b/4.x/_gen/resources/scc_organization_custom_module.libsonnet
@@ -0,0 +1,194 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='scc_organization_custom_module', url='', help='`scc_organization_custom_module` represents the `google_scc_organization_custom_module` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  custom_config:: {
+    custom_output:: {
+      '#new':: d.fn(help='\n`google.scc_organization_custom_module.custom_config.custom_output.new` constructs a new object with attributes and blocks configured for the `custom_output`\nTerraform sub block.\n\n\n\n**Args**:\n  - `properties` (`list[obj]`): A list of custom output properties to add to the finding. When `null`, the `properties` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.custom_config.custom_output.properties.new](#fn-custom_configcustom_configpropertiesnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `custom_output` sub block.\n', args=[]),
+      new(
+        properties=null
+      ):: std.prune(a={
+        properties: properties,
+      }),
+      properties:: {
+        '#new':: d.fn(help='\n`google.scc_organization_custom_module.custom_config.custom_output.properties.new` constructs a new object with attributes and blocks configured for the `properties`\nTerraform sub block.\n\n\n\n**Args**:\n  - `name` (`string`): Name of the property for the custom output. When `null`, the `name` field will be omitted from the resulting object.\n  - `value_expression` (`list[obj]`): The CEL expression for the custom output. A resource property can be specified\nto return the value of the property or a text string enclosed in quotation marks. When `null`, the `value_expression` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.custom_config.custom_output.properties.value_expression.new](#fn-custom_configcustom_configcustom_outputvalue_expressionnew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `properties` sub block.\n', args=[]),
+        new(
+          name=null,
+          value_expression=null
+        ):: std.prune(a={
+          name: name,
+          value_expression: value_expression,
+        }),
+        value_expression:: {
+          '#new':: d.fn(help='\n`google.scc_organization_custom_module.custom_config.custom_output.properties.value_expression.new` constructs a new object with attributes and blocks configured for the `value_expression`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Description of the expression. This is a longer text which describes the\nexpression, e.g. when hovered over it in a UI. When `null`, the `description` field will be omitted from the resulting object.\n  - `expression` (`string`): Textual representation of an expression in Common Expression Language syntax.\n  - `location` (`string`): String indicating the location of the expression for error reporting, e.g. a\nfile name and a position in the file. When `null`, the `location` field will be omitted from the resulting object.\n  - `title` (`string`): Title for the expression, i.e. a short string describing its purpose. This can\nbe used e.g. in UIs which allow to enter the expression. When `null`, the `title` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `value_expression` sub block.\n', args=[]),
+          new(
+            expression,
+            description=null,
+            location=null,
+            title=null
+          ):: std.prune(a={
+            description: description,
+            expression: expression,
+            location: location,
+            title: title,
+          }),
+        },
+      },
+    },
+    '#new':: d.fn(help='\n`google.scc_organization_custom_module.custom_config.new` constructs a new object with attributes and blocks configured for the `custom_config`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Text that describes the vulnerability or misconfiguration that the custom\nmodule detects. This explanation is returned with each finding instance to\nhelp investigators understand the detected issue. The text must be enclosed in quotation marks. When `null`, the `description` field will be omitted from the resulting object.\n  - `recommendation` (`string`): An explanation of the recommended steps that security teams can take to resolve\nthe detected issue. This explanation is returned with each finding generated by\nthis module in the nextSteps property of the finding JSON.\n  - `severity` (`string`): The severity to assign to findings generated by the module. Possible values: ["CRITICAL", "HIGH", "MEDIUM", "LOW"]\n  - `custom_output` (`list[obj]`): Custom output properties. When `null`, the `custom_output` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.custom_config.custom_output.new](#fn-custom_configcustom_outputnew) constructor.\n  - `predicate` (`list[obj]`): The CEL expression to evaluate to produce findings. When the expression evaluates\nto true against a resource, a finding is generated. When `null`, the `predicate` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.custom_config.predicate.new](#fn-custom_configpredicatenew) constructor.\n  - `resource_selector` (`list[obj]`): The resource types that the custom module operates on. Each custom module\ncan specify up to 5 resource types. When `null`, the `resource_selector` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.custom_config.resource_selector.new](#fn-custom_configresource_selectornew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `custom_config` sub block.\n', args=[]),
+    new(
+      recommendation,
+      severity,
+      custom_output=null,
+      description=null,
+      predicate=null,
+      resource_selector=null
+    ):: std.prune(a={
+      custom_output: custom_output,
+      description: description,
+      predicate: predicate,
+      recommendation: recommendation,
+      resource_selector: resource_selector,
+      severity: severity,
+    }),
+    predicate:: {
+      '#new':: d.fn(help='\n`google.scc_organization_custom_module.custom_config.predicate.new` constructs a new object with attributes and blocks configured for the `predicate`\nTerraform sub block.\n\n\n\n**Args**:\n  - `description` (`string`): Description of the expression. This is a longer text which describes the\nexpression, e.g. when hovered over it in a UI. When `null`, the `description` field will be omitted from the resulting object.\n  - `expression` (`string`): Textual representation of an expression in Common Expression Language syntax.\n  - `location` (`string`): String indicating the location of the expression for error reporting, e.g. a\nfile name and a position in the file. When `null`, the `location` field will be omitted from the resulting object.\n  - `title` (`string`): Title for the expression, i.e. a short string describing its purpose. This can\nbe used e.g. in UIs which allow to enter the expression. When `null`, the `title` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `predicate` sub block.\n', args=[]),
+      new(
+        expression,
+        description=null,
+        location=null,
+        title=null
+      ):: std.prune(a={
+        description: description,
+        expression: expression,
+        location: location,
+        title: title,
+      }),
+    },
+    resource_selector:: {
+      '#new':: d.fn(help='\n`google.scc_organization_custom_module.custom_config.resource_selector.new` constructs a new object with attributes and blocks configured for the `resource_selector`\nTerraform sub block.\n\n\n\n**Args**:\n  - `resource_types` (`list`): The resource types to run the detector on.\n\n**Returns**:\n  - An attribute object that represents the `resource_selector` sub block.\n', args=[]),
+      new(
+        resource_types
+      ):: std.prune(a={
+        resource_types: resource_types,
+      }),
+    },
+  },
+  '#new':: d.fn(help="\n`google.scc_organization_custom_module.new` injects a new `google_scc_organization_custom_module` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.scc_organization_custom_module.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.scc_organization_custom_module` using the reference:\n\n    $._ref.google_scc_organization_custom_module.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_scc_organization_custom_module.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `display_name` (`string`): The display name of the Security Health Analytics custom module. This\ndisplay name becomes the finding category for all findings that are\nreturned by this custom module. The display name must be between 1 and\n128 characters, start with a lowercase letter, and contain alphanumeric\ncharacters or underscores only.\n  - `enablement_state` (`string`): The enablement state of the custom module. Possible values: [\u0026#34;ENABLED\u0026#34;, \u0026#34;DISABLED\u0026#34;]\n  - `organization` (`string`): Numerical ID of the parent organization.\n  - `custom_config` (`list[obj]`): The user specified custom configuration for the module. When `null`, the `custom_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.custom_config.new](#fn-custom_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    display_name,
+    enablement_state,
+    organization,
+    custom_config=null,
+    timeouts=null,
+    _meta={}
+  ):: tf.withResource(
+    type='google_scc_organization_custom_module',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      custom_config=custom_config,
+      display_name=display_name,
+      enablement_state=enablement_state,
+      organization=organization,
+      timeouts=timeouts
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`google.scc_organization_custom_module.newAttrs` constructs a new object with attributes and blocks configured for the `scc_organization_custom_module`\nTerraform resource.\n\nUnlike [google.scc_organization_custom_module.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `display_name` (`string`): The display name of the Security Health Analytics custom module. This\ndisplay name becomes the finding category for all findings that are\nreturned by this custom module. The display name must be between 1 and\n128 characters, start with a lowercase letter, and contain alphanumeric\ncharacters or underscores only.\n  - `enablement_state` (`string`): The enablement state of the custom module. Possible values: ["ENABLED", "DISABLED"]\n  - `organization` (`string`): Numerical ID of the parent organization.\n  - `custom_config` (`list[obj]`): The user specified custom configuration for the module. When `null`, the `custom_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.custom_config.new](#fn-custom_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `scc_organization_custom_module` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    display_name,
+    enablement_state,
+    organization,
+    custom_config=null,
+    timeouts=null
+  ):: std.prune(a={
+    custom_config: custom_config,
+    display_name: display_name,
+    enablement_state: enablement_state,
+    organization: organization,
+    timeouts: timeouts,
+  }),
+  timeouts:: {
+    '#new':: d.fn(help='\n`google.scc_organization_custom_module.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
+    new(
+      create=null,
+      delete=null,
+      update=null
+    ):: std.prune(a={
+      create: create,
+      delete: delete,
+      update: update,
+    }),
+  },
+  '#withCustomConfig':: d.fn(help='`google.list[obj].withCustomConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the custom_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withCustomConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `custom_config` field.\n', args=[]),
+  withCustomConfig(resourceLabel, value): {
+    resource+: {
+      google_scc_organization_custom_module+: {
+        [resourceLabel]+: {
+          custom_config: value,
+        },
+      },
+    },
+  },
+  '#withCustomConfigMixin':: d.fn(help='`google.list[obj].withCustomConfigMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the custom_config field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withCustomConfig](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `custom_config` field.\n', args=[]),
+  withCustomConfigMixin(resourceLabel, value): {
+    resource+: {
+      google_scc_organization_custom_module+: {
+        [resourceLabel]+: {
+          custom_config+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
+  '#withDisplayName':: d.fn(help='`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the display_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `display_name` field.\n', args=[]),
+  withDisplayName(resourceLabel, value): {
+    resource+: {
+      google_scc_organization_custom_module+: {
+        [resourceLabel]+: {
+          display_name: value,
+        },
+      },
+    },
+  },
+  '#withEnablementState':: d.fn(help='`google.string.withEnablementState` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the enablement_state field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `enablement_state` field.\n', args=[]),
+  withEnablementState(resourceLabel, value): {
+    resource+: {
+      google_scc_organization_custom_module+: {
+        [resourceLabel]+: {
+          enablement_state: value,
+        },
+      },
+    },
+  },
+  '#withOrganization':: d.fn(help='`google.string.withOrganization` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the organization field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `organization` field.\n', args=[]),
+  withOrganization(resourceLabel, value): {
+    resource+: {
+      google_scc_organization_custom_module+: {
+        [resourceLabel]+: {
+          organization: value,
+        },
+      },
+    },
+  },
+  '#withTimeouts':: d.fn(help='`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will replace the map with the passed in `value`. If you wish to instead merge the\npassed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeouts(resourceLabel, value): {
+    resource+: {
+      google_scc_organization_custom_module+: {
+        [resourceLabel]+: {
+          timeouts: value,
+        },
+      },
+    },
+  },
+  '#withTimeoutsMixin':: d.fn(help='`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the timeouts field.\n\nThis function will merge the passed in value to the existing map. If you wish\nto instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `timeouts` field.\n', args=[]),
+  withTimeoutsMixin(resourceLabel, value): {
+    resource+: {
+      google_scc_organization_custom_module+: {
+        [resourceLabel]+: {
+          timeouts+: value,
+        },
+      },
+    },
+  },
+}
diff --git a/4.x/_gen/resources/secret_manager_secret.libsonnet b/4.x/_gen/resources/secret_manager_secret.libsonnet
index 2fc4a616..ef1611f2 100644
--- a/4.x/_gen/resources/secret_manager_secret.libsonnet
+++ b/4.x/_gen/resources/secret_manager_secret.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='secret_manager_secret', url='', help='`secret_manager_secret` represents the `google_secret_manager_secret` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.secret_manager_secret.new` injects a new `google_secret_manager_secret` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.secret_manager_secret.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.secret_manager_secret` using the reference:\n\n    $._ref.google_secret_manager_secret.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_secret_manager_secret.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Custom metadata about the secret.\n\nAnnotations are distinct from various forms of labels. Annotations exist to allow\nclient tools to store their own state information without requiring a database.\n\nAnnotation keys must be between 1 and 63 characters long, have a UTF-8 encoding of\nmaximum 128 bytes, begin and end with an alphanumeric character ([a-z0-9A-Z]), and\nmay have dashes (-), underscores (_), dots (.), and alphanumerics in between these\nsymbols.\n\nThe total size of annotation keys and values must be less than 16KiB.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example:\n{ \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `expire_time` (`string`): Timestamp in UTC when the Secret is scheduled to expire. This is always provided on output, regardless of what was sent on input.\nA timestamp in RFC3339 UTC \u0026#34;Zulu\u0026#34; format, with nanosecond resolution and up to nine fractional digits. Examples: \u0026#34;2014-10-02T15:01:23Z\u0026#34; and \u0026#34;2014-10-02T15:01:23.045123456Z\u0026#34;. When `null`, the `expire_time` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels assigned to this Secret.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes,\nand must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\n\nLabel values must be between 0 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes,\nand must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\n\nNo more than 64 labels can be assigned to a given resource.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example:\n{ \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `secret_id` (`string`): This must be unique within the project.\n  - `ttl` (`string`): The TTL for the Secret.\nA duration in seconds with up to nine fractional digits, terminated by \u0026#39;s\u0026#39;. Example: \u0026#34;3.5s\u0026#34;. When `null`, the `ttl` field will be omitted from the resulting object.\n  - `version_aliases` (`obj`): Mapping from version alias to version name.\n\nA version alias is a string with a maximum length of 63 characters and can contain\nuppercase and lowercase letters, numerals, and the hyphen (-) and underscore (\u0026#39;_\u0026#39;)\ncharacters. An alias string must start with a letter and cannot be the string\n\u0026#39;latest\u0026#39; or \u0026#39;NEW\u0026#39;. No more than 50 aliases can be assigned to a given secret.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example:\n{ \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `version_aliases` field will be omitted from the resulting object.\n  - `replication` (`list[obj]`): The replication policy of the secret data attached to the Secret. It cannot be changed\nafter the Secret has been created. When `null`, the `replication` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.replication.new](#fn-replicationnew) constructor.\n  - `rotation` (`list[obj]`): The rotation time and period for a Secret. At \u0026#39;next_rotation_time\u0026#39;, Secret Manager will send a Pub/Sub notification to the topics configured on the Secret. \u0026#39;topics\u0026#39; must be set to configure rotation. When `null`, the `rotation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.rotation.new](#fn-rotationnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.timeouts.new](#fn-timeoutsnew) constructor.\n  - `topics` (`list[obj]`): A list of up to 10 Pub/Sub topics to which messages are published when control plane operations are called on the secret or its versions. When `null`, the `topics` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.topics.new](#fn-topicsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.secret_manager_secret.new` injects a new `google_secret_manager_secret` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.secret_manager_secret.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.secret_manager_secret` using the reference:\n\n    $._ref.google_secret_manager_secret.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_secret_manager_secret.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `annotations` (`obj`): Custom metadata about the secret.\n\nAnnotations are distinct from various forms of labels. Annotations exist to allow\nclient tools to store their own state information without requiring a database.\n\nAnnotation keys must be between 1 and 63 characters long, have a UTF-8 encoding of\nmaximum 128 bytes, begin and end with an alphanumeric character ([a-z0-9A-Z]), and\nmay have dashes (-), underscores (_), dots (.), and alphanumerics in between these\nsymbols.\n\nThe total size of annotation keys and values must be less than 16KiB.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example:\n{ \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field \u0026#39;effective_annotations\u0026#39; for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `expire_time` (`string`): Timestamp in UTC when the Secret is scheduled to expire. This is always provided on output, regardless of what was sent on input.\nA timestamp in RFC3339 UTC \u0026#34;Zulu\u0026#34; format, with nanosecond resolution and up to nine fractional digits. Examples: \u0026#34;2014-10-02T15:01:23Z\u0026#34; and \u0026#34;2014-10-02T15:01:23.045123456Z\u0026#34;.\nOnly one of \u0026#39;expire_time\u0026#39; or \u0026#39;ttl\u0026#39; can be provided. When `null`, the `expire_time` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels assigned to this Secret.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes,\nand must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\n\nLabel values must be between 0 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes,\nand must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\n\nNo more than 64 labels can be assigned to a given resource.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example:\n{ \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `secret_id` (`string`): This must be unique within the project.\n  - `ttl` (`string`): The TTL for the Secret.\nA duration in seconds with up to nine fractional digits, terminated by \u0026#39;s\u0026#39;. Example: \u0026#34;3.5s\u0026#34;.\nOnly one of \u0026#39;ttl\u0026#39; or \u0026#39;expire_time\u0026#39; can be provided. When `null`, the `ttl` field will be omitted from the resulting object.\n  - `version_aliases` (`obj`): Mapping from version alias to version name.\n\nA version alias is a string with a maximum length of 63 characters and can contain\nuppercase and lowercase letters, numerals, and the hyphen (-) and underscore (\u0026#39;_\u0026#39;)\ncharacters. An alias string must start with a letter and cannot be the string\n\u0026#39;latest\u0026#39; or \u0026#39;NEW\u0026#39;. No more than 50 aliases can be assigned to a given secret.\n\nAn object containing a list of \u0026#34;key\u0026#34;: value pairs. Example:\n{ \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `version_aliases` field will be omitted from the resulting object.\n  - `replication` (`list[obj]`): The replication policy of the secret data attached to the Secret. It cannot be changed\nafter the Secret has been created. When `null`, the `replication` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.replication.new](#fn-replicationnew) constructor.\n  - `rotation` (`list[obj]`): The rotation time and period for a Secret. At \u0026#39;next_rotation_time\u0026#39;, Secret Manager will send a Pub/Sub notification to the topics configured on the Secret. \u0026#39;topics\u0026#39; must be set to configure rotation. When `null`, the `rotation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.rotation.new](#fn-rotationnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.timeouts.new](#fn-timeoutsnew) constructor.\n  - `topics` (`list[obj]`): A list of up to 10 Pub/Sub topics to which messages are published when control plane operations are called on the secret or its versions. When `null`, the `topics` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.topics.new](#fn-topicsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     secret_id,
@@ -35,7 +35,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.secret_manager_secret.newAttrs` constructs a new object with attributes and blocks configured for the `secret_manager_secret`\nTerraform resource.\n\nUnlike [google.secret_manager_secret.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Custom metadata about the secret.\n\nAnnotations are distinct from various forms of labels. Annotations exist to allow\nclient tools to store their own state information without requiring a database.\n\nAnnotation keys must be between 1 and 63 characters long, have a UTF-8 encoding of\nmaximum 128 bytes, begin and end with an alphanumeric character ([a-z0-9A-Z]), and\nmay have dashes (-), underscores (_), dots (.), and alphanumerics in between these\nsymbols.\n\nThe total size of annotation keys and values must be less than 16KiB.\n\nAn object containing a list of "key": value pairs. Example:\n{ "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `expire_time` (`string`): Timestamp in UTC when the Secret is scheduled to expire. This is always provided on output, regardless of what was sent on input.\nA timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z". When `null`, the `expire_time` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels assigned to this Secret.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes,\nand must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\n\nLabel values must be between 0 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes,\nand must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\n\nNo more than 64 labels can be assigned to a given resource.\n\nAn object containing a list of "key": value pairs. Example:\n{ "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `secret_id` (`string`): This must be unique within the project.\n  - `ttl` (`string`): The TTL for the Secret.\nA duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s". When `null`, the `ttl` field will be omitted from the resulting object.\n  - `version_aliases` (`obj`): Mapping from version alias to version name.\n\nA version alias is a string with a maximum length of 63 characters and can contain\nuppercase and lowercase letters, numerals, and the hyphen (-) and underscore ('_')\ncharacters. An alias string must start with a letter and cannot be the string\n'latest' or 'NEW'. No more than 50 aliases can be assigned to a given secret.\n\nAn object containing a list of "key": value pairs. Example:\n{ "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `version_aliases` field will be omitted from the resulting object.\n  - `replication` (`list[obj]`): The replication policy of the secret data attached to the Secret. It cannot be changed\nafter the Secret has been created. When `null`, the `replication` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.replication.new](#fn-replicationnew) constructor.\n  - `rotation` (`list[obj]`): The rotation time and period for a Secret. At 'next_rotation_time', Secret Manager will send a Pub/Sub notification to the topics configured on the Secret. 'topics' must be set to configure rotation. When `null`, the `rotation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.rotation.new](#fn-rotationnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.timeouts.new](#fn-timeoutsnew) constructor.\n  - `topics` (`list[obj]`): A list of up to 10 Pub/Sub topics to which messages are published when control plane operations are called on the secret or its versions. When `null`, the `topics` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.topics.new](#fn-topicsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `secret_manager_secret` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.secret_manager_secret.newAttrs` constructs a new object with attributes and blocks configured for the `secret_manager_secret`\nTerraform resource.\n\nUnlike [google.secret_manager_secret.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `annotations` (`obj`): Custom metadata about the secret.\n\nAnnotations are distinct from various forms of labels. Annotations exist to allow\nclient tools to store their own state information without requiring a database.\n\nAnnotation keys must be between 1 and 63 characters long, have a UTF-8 encoding of\nmaximum 128 bytes, begin and end with an alphanumeric character ([a-z0-9A-Z]), and\nmay have dashes (-), underscores (_), dots (.), and alphanumerics in between these\nsymbols.\n\nThe total size of annotation keys and values must be less than 16KiB.\n\nAn object containing a list of "key": value pairs. Example:\n{ "name": "wrench", "mass": "1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.\nPlease refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.\n  - `expire_time` (`string`): Timestamp in UTC when the Secret is scheduled to expire. This is always provided on output, regardless of what was sent on input.\nA timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".\nOnly one of 'expire_time' or 'ttl' can be provided. When `null`, the `expire_time` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels assigned to this Secret.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes,\nand must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}\n\nLabel values must be between 0 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes,\nand must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}\n\nNo more than 64 labels can be assigned to a given resource.\n\nAn object containing a list of "key": value pairs. Example:\n{ "name": "wrench", "mass": "1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `secret_id` (`string`): This must be unique within the project.\n  - `ttl` (`string`): The TTL for the Secret.\nA duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s".\nOnly one of 'ttl' or 'expire_time' can be provided. When `null`, the `ttl` field will be omitted from the resulting object.\n  - `version_aliases` (`obj`): Mapping from version alias to version name.\n\nA version alias is a string with a maximum length of 63 characters and can contain\nuppercase and lowercase letters, numerals, and the hyphen (-) and underscore ('_')\ncharacters. An alias string must start with a letter and cannot be the string\n'latest' or 'NEW'. No more than 50 aliases can be assigned to a given secret.\n\nAn object containing a list of "key": value pairs. Example:\n{ "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `version_aliases` field will be omitted from the resulting object.\n  - `replication` (`list[obj]`): The replication policy of the secret data attached to the Secret. It cannot be changed\nafter the Secret has been created. When `null`, the `replication` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.replication.new](#fn-replicationnew) constructor.\n  - `rotation` (`list[obj]`): The rotation time and period for a Secret. At 'next_rotation_time', Secret Manager will send a Pub/Sub notification to the topics configured on the Secret. 'topics' must be set to configure rotation. When `null`, the `rotation` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.rotation.new](#fn-rotationnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.timeouts.new](#fn-timeoutsnew) constructor.\n  - `topics` (`list[obj]`): A list of up to 10 Pub/Sub topics to which messages are published when control plane operations are called on the secret or its versions. When `null`, the `topics` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.topics.new](#fn-topicsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `secret_manager_secret` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     secret_id,
     annotations=null,
@@ -78,14 +78,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         customer_managed_encryption: customer_managed_encryption,
       }),
     },
-    '#new':: d.fn(help='\n`google.secret_manager_secret.replication.new` constructs a new object with attributes and blocks configured for the `replication`\nTerraform sub block.\n\n\n\n**Args**:\n  - `automatic` (`bool`): The Secret will automatically be replicated without any restrictions. When `null`, the `automatic` field will be omitted from the resulting object.\n  - `auto` (`list[obj]`): The Secret will automatically be replicated without any restrictions. When `null`, the `auto` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.replication.auto.new](#fn-replicationautonew) constructor.\n  - `user_managed` (`list[obj]`): The Secret will be replicated to the regions specified by the user. When `null`, the `user_managed` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.replication.user_managed.new](#fn-replicationuser_managednew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `replication` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.secret_manager_secret.replication.new` constructs a new object with attributes and blocks configured for the `replication`\nTerraform sub block.\n\n\n\n**Args**:\n  - `auto` (`list[obj]`): The Secret will automatically be replicated without any restrictions. When `null`, the `auto` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.replication.auto.new](#fn-replicationautonew) constructor.\n  - `user_managed` (`list[obj]`): The Secret will be replicated to the regions specified by the user. When `null`, the `user_managed` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.replication.user_managed.new](#fn-replicationuser_managednew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `replication` sub block.\n', args=[]),
     new(
       auto=null,
-      automatic=null,
       user_managed=null
     ):: std.prune(a={
       auto: auto,
-      automatic: automatic,
       user_managed: user_managed,
     }),
     user_managed:: {
diff --git a/4.x/_gen/resources/spanner_instance.libsonnet b/4.x/_gen/resources/spanner_instance.libsonnet
index f7da38f7..54a00d86 100644
--- a/4.x/_gen/resources/spanner_instance.libsonnet
+++ b/4.x/_gen/resources/spanner_instance.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='spanner_instance', url='', help='`spanner_instance` represents the `google_spanner_instance` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.spanner_instance.new` injects a new `google_spanner_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.spanner_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.spanner_instance` using the reference:\n\n    $._ref.google_spanner_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_spanner_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `config` (`string`): The name of the instance\u0026#39;s configuration (similar but not\nquite the same as a region) which defines the geographic placement and\nreplication of your databases in this instance. It determines where your data\nis stored. Values are typically of the form \u0026#39;regional-europe-west1\u0026#39; , \u0026#39;us-central\u0026#39; etc.\nIn order to obtain a valid list please consult the\n[Configuration section of the docs](https://cloud.google.com/spanner/docs/instances).\n  - `display_name` (`string`): The descriptive name for this instance as it appears in UIs. Must be\nunique per project and between 4 and 30 characters in length.\n  - `force_destroy` (`bool`): When deleting a spanner instance, this boolean option will delete all backups of this instance.\nThis must be set to true if you created a backup manually in the console. When `null`, the `force_destroy` field will be omitted from the resulting object.\n  - `labels` (`obj`): An object containing a list of \u0026#34;key\u0026#34;: value pairs.\nExample: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): A unique identifier for the instance, which cannot be changed after\nthe instance is created. The name must be between 6 and 30 characters\nin length.\n\n\nIf not provided, a random string starting with \u0026#39;tf-\u0026#39; will be selected. When `null`, the `name` field will be omitted from the resulting object.\n  - `num_nodes` (`number`): The number of nodes allocated to this instance. Exactly one of either node_count or processing_units\nmust be present in terraform. When `null`, the `num_nodes` field will be omitted from the resulting object.\n  - `processing_units` (`number`): The number of processing units allocated to this instance. Exactly one of processing_units\nor node_count must be present in terraform. When `null`, the `processing_units` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.spanner_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.spanner_instance.new` injects a new `google_spanner_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.spanner_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.spanner_instance` using the reference:\n\n    $._ref.google_spanner_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_spanner_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `config` (`string`): The name of the instance\u0026#39;s configuration (similar but not\nquite the same as a region) which defines the geographic placement and\nreplication of your databases in this instance. It determines where your data\nis stored. Values are typically of the form \u0026#39;regional-europe-west1\u0026#39; , \u0026#39;us-central\u0026#39; etc.\nIn order to obtain a valid list please consult the\n[Configuration section of the docs](https://cloud.google.com/spanner/docs/instances).\n  - `display_name` (`string`): The descriptive name for this instance as it appears in UIs. Must be\nunique per project and between 4 and 30 characters in length.\n  - `force_destroy` (`bool`): When deleting a spanner instance, this boolean option will delete all backups of this instance.\nThis must be set to true if you created a backup manually in the console. When `null`, the `force_destroy` field will be omitted from the resulting object.\n  - `labels` (`obj`): An object containing a list of \u0026#34;key\u0026#34;: value pairs.\nExample: { \u0026#34;name\u0026#34;: \u0026#34;wrench\u0026#34;, \u0026#34;mass\u0026#34;: \u0026#34;1.3kg\u0026#34;, \u0026#34;count\u0026#34;: \u0026#34;3\u0026#34; }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): A unique identifier for the instance, which cannot be changed after\nthe instance is created. The name must be between 6 and 30 characters\nin length.\n\n\nIf not provided, a random string starting with \u0026#39;tf-\u0026#39; will be selected. When `null`, the `name` field will be omitted from the resulting object.\n  - `num_nodes` (`number`): The number of nodes allocated to this instance. Exactly one of either node_count or processing_units\nmust be present in terraform. When `null`, the `num_nodes` field will be omitted from the resulting object.\n  - `processing_units` (`number`): The number of processing units allocated to this instance. Exactly one of processing_units\nor node_count must be present in terraform. When `null`, the `processing_units` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.spanner_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     config,
@@ -31,7 +31,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.spanner_instance.newAttrs` constructs a new object with attributes and blocks configured for the `spanner_instance`\nTerraform resource.\n\nUnlike [google.spanner_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `config` (`string`): The name of the instance's configuration (similar but not\nquite the same as a region) which defines the geographic placement and\nreplication of your databases in this instance. It determines where your data\nis stored. Values are typically of the form 'regional-europe-west1' , 'us-central' etc.\nIn order to obtain a valid list please consult the\n[Configuration section of the docs](https://cloud.google.com/spanner/docs/instances).\n  - `display_name` (`string`): The descriptive name for this instance as it appears in UIs. Must be\nunique per project and between 4 and 30 characters in length.\n  - `force_destroy` (`bool`): When deleting a spanner instance, this boolean option will delete all backups of this instance.\nThis must be set to true if you created a backup manually in the console. When `null`, the `force_destroy` field will be omitted from the resulting object.\n  - `labels` (`obj`): An object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): A unique identifier for the instance, which cannot be changed after\nthe instance is created. The name must be between 6 and 30 characters\nin length.\n\n\nIf not provided, a random string starting with 'tf-' will be selected. When `null`, the `name` field will be omitted from the resulting object.\n  - `num_nodes` (`number`): The number of nodes allocated to this instance. Exactly one of either node_count or processing_units\nmust be present in terraform. When `null`, the `num_nodes` field will be omitted from the resulting object.\n  - `processing_units` (`number`): The number of processing units allocated to this instance. Exactly one of processing_units\nor node_count must be present in terraform. When `null`, the `processing_units` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.spanner_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `spanner_instance` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.spanner_instance.newAttrs` constructs a new object with attributes and blocks configured for the `spanner_instance`\nTerraform resource.\n\nUnlike [google.spanner_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `config` (`string`): The name of the instance's configuration (similar but not\nquite the same as a region) which defines the geographic placement and\nreplication of your databases in this instance. It determines where your data\nis stored. Values are typically of the form 'regional-europe-west1' , 'us-central' etc.\nIn order to obtain a valid list please consult the\n[Configuration section of the docs](https://cloud.google.com/spanner/docs/instances).\n  - `display_name` (`string`): The descriptive name for this instance as it appears in UIs. Must be\nunique per project and between 4 and 30 characters in length.\n  - `force_destroy` (`bool`): When deleting a spanner instance, this boolean option will delete all backups of this instance.\nThis must be set to true if you created a backup manually in the console. When `null`, the `force_destroy` field will be omitted from the resulting object.\n  - `labels` (`obj`): An object containing a list of "key": value pairs.\nExample: { "name": "wrench", "mass": "1.3kg", "count": "3" }.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): A unique identifier for the instance, which cannot be changed after\nthe instance is created. The name must be between 6 and 30 characters\nin length.\n\n\nIf not provided, a random string starting with 'tf-' will be selected. When `null`, the `name` field will be omitted from the resulting object.\n  - `num_nodes` (`number`): The number of nodes allocated to this instance. Exactly one of either node_count or processing_units\nmust be present in terraform. When `null`, the `num_nodes` field will be omitted from the resulting object.\n  - `processing_units` (`number`): The number of processing units allocated to this instance. Exactly one of processing_units\nor node_count must be present in terraform. When `null`, the `processing_units` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.spanner_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `spanner_instance` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     config,
     display_name,
diff --git a/4.x/_gen/resources/sql_database_instance.libsonnet b/4.x/_gen/resources/sql_database_instance.libsonnet
index 7c64a0d5..6c809b99 100644
--- a/4.x/_gen/resources/sql_database_instance.libsonnet
+++ b/4.x/_gen/resources/sql_database_instance.libsonnet
@@ -3,16 +3,18 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='sql_database_instance', url='', help='`sql_database_instance` represents the `google_sql_database_instance` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
   clone:: {
-    '#new':: d.fn(help='\n`google.sql_database_instance.clone.new` constructs a new object with attributes and blocks configured for the `clone`\nTerraform sub block.\n\n\n\n**Args**:\n  - `allocated_ip_range` (`string`): The name of the allocated ip range for the private ip CloudSQL instance. For example: "google-managed-services-default". If set, the cloned instance ip will be created in the allocated range. The range name must comply with [RFC 1035](https://tools.ietf.org/html/rfc1035). Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. When `null`, the `allocated_ip_range` field will be omitted from the resulting object.\n  - `database_names` (`list`): (SQL Server only, use with point_in_time) clone only the specified databases from the source instance. Clone all databases if empty. When `null`, the `database_names` field will be omitted from the resulting object.\n  - `point_in_time` (`string`): The timestamp of the point in time that should be restored. When `null`, the `point_in_time` field will be omitted from the resulting object.\n  - `source_instance_name` (`string`): The name of the instance from which the point in time should be restored.\n\n**Returns**:\n  - An attribute object that represents the `clone` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.sql_database_instance.clone.new` constructs a new object with attributes and blocks configured for the `clone`\nTerraform sub block.\n\n\n\n**Args**:\n  - `allocated_ip_range` (`string`): The name of the allocated ip range for the private ip CloudSQL instance. For example: "google-managed-services-default". If set, the cloned instance ip will be created in the allocated range. The range name must comply with [RFC 1035](https://tools.ietf.org/html/rfc1035). Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. When `null`, the `allocated_ip_range` field will be omitted from the resulting object.\n  - `database_names` (`list`): (SQL Server only, use with point_in_time) clone only the specified databases from the source instance. Clone all databases if empty. When `null`, the `database_names` field will be omitted from the resulting object.\n  - `point_in_time` (`string`): The timestamp of the point in time that should be restored. When `null`, the `point_in_time` field will be omitted from the resulting object.\n  - `preferred_zone` (`string`): (Point-in-time recovery for PostgreSQL only) Clone to an instance in the specified zone. If no zone is specified, clone to the same zone as the source instance. When `null`, the `preferred_zone` field will be omitted from the resulting object.\n  - `source_instance_name` (`string`): The name of the instance from which the point in time should be restored.\n\n**Returns**:\n  - An attribute object that represents the `clone` sub block.\n', args=[]),
     new(
       source_instance_name,
       allocated_ip_range=null,
       database_names=null,
-      point_in_time=null
+      point_in_time=null,
+      preferred_zone=null
     ):: std.prune(a={
       allocated_ip_range: allocated_ip_range,
       database_names: database_names,
       point_in_time: point_in_time,
+      preferred_zone: preferred_zone,
       source_instance_name: source_instance_name,
     }),
   },
diff --git a/4.x/_gen/resources/sql_source_representation_instance.libsonnet b/4.x/_gen/resources/sql_source_representation_instance.libsonnet
index 5923e06c..2debf336 100644
--- a/4.x/_gen/resources/sql_source_representation_instance.libsonnet
+++ b/4.x/_gen/resources/sql_source_representation_instance.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='sql_source_representation_instance', url='', help='`sql_source_representation_instance` represents the `google_sql_source_representation_instance` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.sql_source_representation_instance.new` injects a new `google_sql_source_representation_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.sql_source_representation_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.sql_source_representation_instance` using the reference:\n\n    $._ref.google_sql_source_representation_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_sql_source_representation_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `ca_certificate` (`string`): The CA certificate on the external server. Include only if SSL/TLS is used on the external server. When `null`, the `ca_certificate` field will be omitted from the resulting object.\n  - `client_certificate` (`string`): The client certificate on the external server. Required only for server-client authentication. Include only if SSL/TLS is used on the external server. When `null`, the `client_certificate` field will be omitted from the resulting object.\n  - `client_key` (`string`): The private key file for the client certificate on the external server. Required only for server-client authentication. Include only if SSL/TLS is used on the external server. When `null`, the `client_key` field will be omitted from the resulting object.\n  - `database_version` (`string`): The MySQL version running on your source database server. Possible values: [\u0026#34;MYSQL_5_6\u0026#34;, \u0026#34;MYSQL_5_7\u0026#34;, \u0026#34;MYSQL_8_0\u0026#34;, \u0026#34;POSTGRES_9_6\u0026#34;, \u0026#34;POSTGRES_10\u0026#34;, \u0026#34;POSTGRES_11\u0026#34;, \u0026#34;POSTGRES_12\u0026#34;, \u0026#34;POSTGRES_13\u0026#34;, \u0026#34;POSTGRES_14\u0026#34;]\n  - `dump_file_path` (`string`): A file in the bucket that contains the data from the external server. When `null`, the `dump_file_path` field will be omitted from the resulting object.\n  - `host` (`string`): The externally accessible IPv4 address for the source database server.\n  - `name` (`string`): The name of the source representation instance. Use any valid Cloud SQL instance name.\n  - `password` (`string`): The password for the replication user account. When `null`, the `password` field will be omitted from the resulting object.\n  - `port` (`number`): The externally accessible port for the source database server.\nDefaults to 3306. When `null`, the `port` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The Region in which the created instance should reside.\nIf it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `username` (`string`): The replication user account on the external server. When `null`, the `username` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.sql_source_representation_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.sql_source_representation_instance.new` injects a new `google_sql_source_representation_instance` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.sql_source_representation_instance.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.sql_source_representation_instance` using the reference:\n\n    $._ref.google_sql_source_representation_instance.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_sql_source_representation_instance.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `ca_certificate` (`string`): The CA certificate on the external server. Include only if SSL/TLS is used on the external server. When `null`, the `ca_certificate` field will be omitted from the resulting object.\n  - `client_certificate` (`string`): The client certificate on the external server. Required only for server-client authentication. Include only if SSL/TLS is used on the external server. When `null`, the `client_certificate` field will be omitted from the resulting object.\n  - `client_key` (`string`): The private key file for the client certificate on the external server. Required only for server-client authentication. Include only if SSL/TLS is used on the external server. When `null`, the `client_key` field will be omitted from the resulting object.\n  - `database_version` (`string`): The MySQL version running on your source database server. Possible values: [\u0026#34;MYSQL_5_6\u0026#34;, \u0026#34;MYSQL_5_7\u0026#34;, \u0026#34;MYSQL_8_0\u0026#34;, \u0026#34;POSTGRES_9_6\u0026#34;, \u0026#34;POSTGRES_10\u0026#34;, \u0026#34;POSTGRES_11\u0026#34;, \u0026#34;POSTGRES_12\u0026#34;, \u0026#34;POSTGRES_13\u0026#34;, \u0026#34;POSTGRES_14\u0026#34;]\n  - `dump_file_path` (`string`): A file in the bucket that contains the data from the external server. When `null`, the `dump_file_path` field will be omitted from the resulting object.\n  - `host` (`string`): The IPv4 address and port for the external server, or the the DNS address for the external server. If the external server is hosted on Cloud SQL, the port is 5432.\n  - `name` (`string`): The name of the source representation instance. Use any valid Cloud SQL instance name.\n  - `password` (`string`): The password for the replication user account. When `null`, the `password` field will be omitted from the resulting object.\n  - `port` (`number`): The externally accessible port for the source database server.\nDefaults to 3306. When `null`, the `port` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The Region in which the created instance should reside.\nIf it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `username` (`string`): The replication user account on the external server. When `null`, the `username` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.sql_source_representation_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     database_version,
@@ -39,7 +39,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.sql_source_representation_instance.newAttrs` constructs a new object with attributes and blocks configured for the `sql_source_representation_instance`\nTerraform resource.\n\nUnlike [google.sql_source_representation_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `ca_certificate` (`string`): The CA certificate on the external server. Include only if SSL/TLS is used on the external server. When `null`, the `ca_certificate` field will be omitted from the resulting object.\n  - `client_certificate` (`string`): The client certificate on the external server. Required only for server-client authentication. Include only if SSL/TLS is used on the external server. When `null`, the `client_certificate` field will be omitted from the resulting object.\n  - `client_key` (`string`): The private key file for the client certificate on the external server. Required only for server-client authentication. Include only if SSL/TLS is used on the external server. When `null`, the `client_key` field will be omitted from the resulting object.\n  - `database_version` (`string`): The MySQL version running on your source database server. Possible values: ["MYSQL_5_6", "MYSQL_5_7", "MYSQL_8_0", "POSTGRES_9_6", "POSTGRES_10", "POSTGRES_11", "POSTGRES_12", "POSTGRES_13", "POSTGRES_14"]\n  - `dump_file_path` (`string`): A file in the bucket that contains the data from the external server. When `null`, the `dump_file_path` field will be omitted from the resulting object.\n  - `host` (`string`): The externally accessible IPv4 address for the source database server.\n  - `name` (`string`): The name of the source representation instance. Use any valid Cloud SQL instance name.\n  - `password` (`string`): The password for the replication user account. When `null`, the `password` field will be omitted from the resulting object.\n  - `port` (`number`): The externally accessible port for the source database server.\nDefaults to 3306. When `null`, the `port` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The Region in which the created instance should reside.\nIf it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `username` (`string`): The replication user account on the external server. When `null`, the `username` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.sql_source_representation_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `sql_source_representation_instance` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.sql_source_representation_instance.newAttrs` constructs a new object with attributes and blocks configured for the `sql_source_representation_instance`\nTerraform resource.\n\nUnlike [google.sql_source_representation_instance.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `ca_certificate` (`string`): The CA certificate on the external server. Include only if SSL/TLS is used on the external server. When `null`, the `ca_certificate` field will be omitted from the resulting object.\n  - `client_certificate` (`string`): The client certificate on the external server. Required only for server-client authentication. Include only if SSL/TLS is used on the external server. When `null`, the `client_certificate` field will be omitted from the resulting object.\n  - `client_key` (`string`): The private key file for the client certificate on the external server. Required only for server-client authentication. Include only if SSL/TLS is used on the external server. When `null`, the `client_key` field will be omitted from the resulting object.\n  - `database_version` (`string`): The MySQL version running on your source database server. Possible values: ["MYSQL_5_6", "MYSQL_5_7", "MYSQL_8_0", "POSTGRES_9_6", "POSTGRES_10", "POSTGRES_11", "POSTGRES_12", "POSTGRES_13", "POSTGRES_14"]\n  - `dump_file_path` (`string`): A file in the bucket that contains the data from the external server. When `null`, the `dump_file_path` field will be omitted from the resulting object.\n  - `host` (`string`): The IPv4 address and port for the external server, or the the DNS address for the external server. If the external server is hosted on Cloud SQL, the port is 5432.\n  - `name` (`string`): The name of the source representation instance. Use any valid Cloud SQL instance name.\n  - `password` (`string`): The password for the replication user account. When `null`, the `password` field will be omitted from the resulting object.\n  - `port` (`number`): The externally accessible port for the source database server.\nDefaults to 3306. When `null`, the `port` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The Region in which the created instance should reside.\nIf it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.\n  - `username` (`string`): The replication user account on the external server. When `null`, the `username` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.sql_source_representation_instance.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `sql_source_representation_instance` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     database_version,
     host,
diff --git a/4.x/_gen/resources/storage_bucket.libsonnet b/4.x/_gen/resources/storage_bucket.libsonnet
index cf5410b9..ee15ce49 100644
--- a/4.x/_gen/resources/storage_bucket.libsonnet
+++ b/4.x/_gen/resources/storage_bucket.libsonnet
@@ -3,11 +3,13 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='storage_bucket', url='', help='`storage_bucket` represents the `google_storage_bucket` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
   autoclass:: {
-    '#new':: d.fn(help='\n`google.storage_bucket.autoclass.new` constructs a new object with attributes and blocks configured for the `autoclass`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): While set to true, autoclass automatically transitions objects in your bucket to appropriate storage classes based on each object's access pattern.\n\n**Returns**:\n  - An attribute object that represents the `autoclass` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.storage_bucket.autoclass.new` constructs a new object with attributes and blocks configured for the `autoclass`\nTerraform sub block.\n\n\n\n**Args**:\n  - `enabled` (`bool`): While set to true, autoclass automatically transitions objects in your bucket to appropriate storage classes based on each object's access pattern.\n  - `terminal_storage_class` (`string`): The storage class that objects in the bucket eventually transition to if they are not read for a certain length of time. Supported values include: NEARLINE, ARCHIVE. When `null`, the `terminal_storage_class` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `autoclass` sub block.\n', args=[]),
     new(
-      enabled
+      enabled,
+      terminal_storage_class=null
     ):: std.prune(a={
       enabled: enabled,
+      terminal_storage_class: terminal_storage_class,
     }),
   },
   cors:: {
@@ -98,7 +100,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       log_object_prefix: log_object_prefix,
     }),
   },
-  '#new':: d.fn(help="\n`google.storage_bucket.new` injects a new `google_storage_bucket` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.storage_bucket.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.storage_bucket` using the reference:\n\n    $._ref.google_storage_bucket.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_storage_bucket.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `default_event_based_hold` (`bool`): Whether or not to automatically apply an eventBasedHold to new objects added to the bucket. When `null`, the `default_event_based_hold` field will be omitted from the resulting object.\n  - `force_destroy` (`bool`): When deleting a bucket, this boolean option will delete all contained objects. If you try to delete a bucket that contains objects, Terraform will fail that run. When `null`, the `force_destroy` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to the bucket. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The Google Cloud Storage location\n  - `name` (`string`): The name of the bucket.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_access_prevention` (`string`): Prevents public access to a bucket. When `null`, the `public_access_prevention` field will be omitted from the resulting object.\n  - `requester_pays` (`bool`): Enables Requester Pays on a storage bucket. When `null`, the `requester_pays` field will be omitted from the resulting object.\n  - `storage_class` (`string`): The Storage Class of the new bucket. Supported values include: STANDARD, MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE. When `null`, the `storage_class` field will be omitted from the resulting object.\n  - `uniform_bucket_level_access` (`bool`): Enables uniform bucket-level access on a bucket. When `null`, the `uniform_bucket_level_access` field will be omitted from the resulting object.\n  - `autoclass` (`list[obj]`): The bucket\u0026#39;s autoclass configuration. When `null`, the `autoclass` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.autoclass.new](#fn-autoclassnew) constructor.\n  - `cors` (`list[obj]`): The bucket\u0026#39;s Cross-Origin Resource Sharing (CORS) configuration. When `null`, the `cors` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.cors.new](#fn-corsnew) constructor.\n  - `custom_placement_config` (`list[obj]`): The bucket\u0026#39;s custom location configuration, which specifies the individual regions that comprise a dual-region bucket. If the bucket is designated a single or multi-region, the parameters are empty. When `null`, the `custom_placement_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.custom_placement_config.new](#fn-custom_placement_confignew) constructor.\n  - `encryption` (`list[obj]`): The bucket\u0026#39;s encryption configuration. When `null`, the `encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.encryption.new](#fn-encryptionnew) constructor.\n  - `lifecycle_rule` (`list[obj]`): The bucket\u0026#39;s Lifecycle Rules configuration. When `null`, the `lifecycle_rule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.lifecycle_rule.new](#fn-lifecycle_rulenew) constructor.\n  - `logging` (`list[obj]`): The bucket\u0026#39;s Access \u0026amp; Storage Logs configuration. When `null`, the `logging` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.logging.new](#fn-loggingnew) constructor.\n  - `retention_policy` (`list[obj]`): Configuration of the bucket\u0026#39;s data retention policy for how long objects in the bucket should be retained. When `null`, the `retention_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.retention_policy.new](#fn-retention_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.timeouts.new](#fn-timeoutsnew) constructor.\n  - `versioning` (`list[obj]`): The bucket\u0026#39;s Versioning configuration. When `null`, the `versioning` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.versioning.new](#fn-versioningnew) constructor.\n  - `website` (`list[obj]`): Configuration if the bucket acts as a website. When `null`, the `website` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.website.new](#fn-websitenew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.storage_bucket.new` injects a new `google_storage_bucket` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.storage_bucket.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.storage_bucket` using the reference:\n\n    $._ref.google_storage_bucket.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_storage_bucket.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `default_event_based_hold` (`bool`): Whether or not to automatically apply an eventBasedHold to new objects added to the bucket. When `null`, the `default_event_based_hold` field will be omitted from the resulting object.\n  - `enable_object_retention` (`bool`): Enables each object in the bucket to have its own retention policy, which prevents deletion until stored for a specific length of time. When `null`, the `enable_object_retention` field will be omitted from the resulting object.\n  - `force_destroy` (`bool`): When deleting a bucket, this boolean option will delete all contained objects. If you try to delete a bucket that contains objects, Terraform will fail that run. When `null`, the `force_destroy` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to the bucket. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The Google Cloud Storage location\n  - `name` (`string`): The name of the bucket.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_access_prevention` (`string`): Prevents public access to a bucket. When `null`, the `public_access_prevention` field will be omitted from the resulting object.\n  - `requester_pays` (`bool`): Enables Requester Pays on a storage bucket. When `null`, the `requester_pays` field will be omitted from the resulting object.\n  - `storage_class` (`string`): The Storage Class of the new bucket. Supported values include: STANDARD, MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE. When `null`, the `storage_class` field will be omitted from the resulting object.\n  - `uniform_bucket_level_access` (`bool`): Enables uniform bucket-level access on a bucket. When `null`, the `uniform_bucket_level_access` field will be omitted from the resulting object.\n  - `autoclass` (`list[obj]`): The bucket\u0026#39;s autoclass configuration. When `null`, the `autoclass` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.autoclass.new](#fn-autoclassnew) constructor.\n  - `cors` (`list[obj]`): The bucket\u0026#39;s Cross-Origin Resource Sharing (CORS) configuration. When `null`, the `cors` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.cors.new](#fn-corsnew) constructor.\n  - `custom_placement_config` (`list[obj]`): The bucket\u0026#39;s custom location configuration, which specifies the individual regions that comprise a dual-region bucket. If the bucket is designated a single or multi-region, the parameters are empty. When `null`, the `custom_placement_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.custom_placement_config.new](#fn-custom_placement_confignew) constructor.\n  - `encryption` (`list[obj]`): The bucket\u0026#39;s encryption configuration. When `null`, the `encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.encryption.new](#fn-encryptionnew) constructor.\n  - `lifecycle_rule` (`list[obj]`): The bucket\u0026#39;s Lifecycle Rules configuration. When `null`, the `lifecycle_rule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.lifecycle_rule.new](#fn-lifecycle_rulenew) constructor.\n  - `logging` (`list[obj]`): The bucket\u0026#39;s Access \u0026amp; Storage Logs configuration. When `null`, the `logging` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.logging.new](#fn-loggingnew) constructor.\n  - `retention_policy` (`list[obj]`): Configuration of the bucket\u0026#39;s data retention policy for how long objects in the bucket should be retained. When `null`, the `retention_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.retention_policy.new](#fn-retention_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.timeouts.new](#fn-timeoutsnew) constructor.\n  - `versioning` (`list[obj]`): The bucket\u0026#39;s Versioning configuration. When `null`, the `versioning` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.versioning.new](#fn-versioningnew) constructor.\n  - `website` (`list[obj]`): Configuration if the bucket acts as a website. When `null`, the `website` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.website.new](#fn-websitenew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     location,
@@ -107,6 +109,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     cors=null,
     custom_placement_config=null,
     default_event_based_hold=null,
+    enable_object_retention=null,
     encryption=null,
     force_destroy=null,
     labels=null,
@@ -130,6 +133,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       cors=cors,
       custom_placement_config=custom_placement_config,
       default_event_based_hold=default_event_based_hold,
+      enable_object_retention=enable_object_retention,
       encryption=encryption,
       force_destroy=force_destroy,
       labels=labels,
@@ -149,7 +153,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.storage_bucket.newAttrs` constructs a new object with attributes and blocks configured for the `storage_bucket`\nTerraform resource.\n\nUnlike [google.storage_bucket.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `default_event_based_hold` (`bool`): Whether or not to automatically apply an eventBasedHold to new objects added to the bucket. When `null`, the `default_event_based_hold` field will be omitted from the resulting object.\n  - `force_destroy` (`bool`): When deleting a bucket, this boolean option will delete all contained objects. If you try to delete a bucket that contains objects, Terraform will fail that run. When `null`, the `force_destroy` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to the bucket. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The Google Cloud Storage location\n  - `name` (`string`): The name of the bucket.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_access_prevention` (`string`): Prevents public access to a bucket. When `null`, the `public_access_prevention` field will be omitted from the resulting object.\n  - `requester_pays` (`bool`): Enables Requester Pays on a storage bucket. When `null`, the `requester_pays` field will be omitted from the resulting object.\n  - `storage_class` (`string`): The Storage Class of the new bucket. Supported values include: STANDARD, MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE. When `null`, the `storage_class` field will be omitted from the resulting object.\n  - `uniform_bucket_level_access` (`bool`): Enables uniform bucket-level access on a bucket. When `null`, the `uniform_bucket_level_access` field will be omitted from the resulting object.\n  - `autoclass` (`list[obj]`): The bucket's autoclass configuration. When `null`, the `autoclass` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.autoclass.new](#fn-autoclassnew) constructor.\n  - `cors` (`list[obj]`): The bucket's Cross-Origin Resource Sharing (CORS) configuration. When `null`, the `cors` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.cors.new](#fn-corsnew) constructor.\n  - `custom_placement_config` (`list[obj]`): The bucket's custom location configuration, which specifies the individual regions that comprise a dual-region bucket. If the bucket is designated a single or multi-region, the parameters are empty. When `null`, the `custom_placement_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.custom_placement_config.new](#fn-custom_placement_confignew) constructor.\n  - `encryption` (`list[obj]`): The bucket's encryption configuration. When `null`, the `encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.encryption.new](#fn-encryptionnew) constructor.\n  - `lifecycle_rule` (`list[obj]`): The bucket's Lifecycle Rules configuration. When `null`, the `lifecycle_rule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.lifecycle_rule.new](#fn-lifecycle_rulenew) constructor.\n  - `logging` (`list[obj]`): The bucket's Access & Storage Logs configuration. When `null`, the `logging` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.logging.new](#fn-loggingnew) constructor.\n  - `retention_policy` (`list[obj]`): Configuration of the bucket's data retention policy for how long objects in the bucket should be retained. When `null`, the `retention_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.retention_policy.new](#fn-retention_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.timeouts.new](#fn-timeoutsnew) constructor.\n  - `versioning` (`list[obj]`): The bucket's Versioning configuration. When `null`, the `versioning` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.versioning.new](#fn-versioningnew) constructor.\n  - `website` (`list[obj]`): Configuration if the bucket acts as a website. When `null`, the `website` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.website.new](#fn-websitenew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `storage_bucket` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.storage_bucket.newAttrs` constructs a new object with attributes and blocks configured for the `storage_bucket`\nTerraform resource.\n\nUnlike [google.storage_bucket.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `default_event_based_hold` (`bool`): Whether or not to automatically apply an eventBasedHold to new objects added to the bucket. When `null`, the `default_event_based_hold` field will be omitted from the resulting object.\n  - `enable_object_retention` (`bool`): Enables each object in the bucket to have its own retention policy, which prevents deletion until stored for a specific length of time. When `null`, the `enable_object_retention` field will be omitted from the resulting object.\n  - `force_destroy` (`bool`): When deleting a bucket, this boolean option will delete all contained objects. If you try to delete a bucket that contains objects, Terraform will fail that run. When `null`, the `force_destroy` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to the bucket. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The Google Cloud Storage location\n  - `name` (`string`): The name of the bucket.\n  - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_access_prevention` (`string`): Prevents public access to a bucket. When `null`, the `public_access_prevention` field will be omitted from the resulting object.\n  - `requester_pays` (`bool`): Enables Requester Pays on a storage bucket. When `null`, the `requester_pays` field will be omitted from the resulting object.\n  - `storage_class` (`string`): The Storage Class of the new bucket. Supported values include: STANDARD, MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE. When `null`, the `storage_class` field will be omitted from the resulting object.\n  - `uniform_bucket_level_access` (`bool`): Enables uniform bucket-level access on a bucket. When `null`, the `uniform_bucket_level_access` field will be omitted from the resulting object.\n  - `autoclass` (`list[obj]`): The bucket's autoclass configuration. When `null`, the `autoclass` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.autoclass.new](#fn-autoclassnew) constructor.\n  - `cors` (`list[obj]`): The bucket's Cross-Origin Resource Sharing (CORS) configuration. When `null`, the `cors` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.cors.new](#fn-corsnew) constructor.\n  - `custom_placement_config` (`list[obj]`): The bucket's custom location configuration, which specifies the individual regions that comprise a dual-region bucket. If the bucket is designated a single or multi-region, the parameters are empty. When `null`, the `custom_placement_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.custom_placement_config.new](#fn-custom_placement_confignew) constructor.\n  - `encryption` (`list[obj]`): The bucket's encryption configuration. When `null`, the `encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.encryption.new](#fn-encryptionnew) constructor.\n  - `lifecycle_rule` (`list[obj]`): The bucket's Lifecycle Rules configuration. When `null`, the `lifecycle_rule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.lifecycle_rule.new](#fn-lifecycle_rulenew) constructor.\n  - `logging` (`list[obj]`): The bucket's Access & Storage Logs configuration. When `null`, the `logging` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.logging.new](#fn-loggingnew) constructor.\n  - `retention_policy` (`list[obj]`): Configuration of the bucket's data retention policy for how long objects in the bucket should be retained. When `null`, the `retention_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.retention_policy.new](#fn-retention_policynew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.timeouts.new](#fn-timeoutsnew) constructor.\n  - `versioning` (`list[obj]`): The bucket's Versioning configuration. When `null`, the `versioning` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.versioning.new](#fn-versioningnew) constructor.\n  - `website` (`list[obj]`): Configuration if the bucket acts as a website. When `null`, the `website` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket.website.new](#fn-websitenew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `storage_bucket` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     location,
     name,
@@ -157,6 +161,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     cors=null,
     custom_placement_config=null,
     default_event_based_hold=null,
+    enable_object_retention=null,
     encryption=null,
     force_destroy=null,
     labels=null,
@@ -176,6 +181,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     cors: cors,
     custom_placement_config: custom_placement_config,
     default_event_based_hold: default_event_based_hold,
+    enable_object_retention: enable_object_retention,
     encryption: encryption,
     force_destroy: force_destroy,
     labels: labels,
@@ -303,6 +309,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withEnableObjectRetention':: d.fn(help='`google.bool.withEnableObjectRetention` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the enable_object_retention field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `enable_object_retention` field.\n', args=[]),
+  withEnableObjectRetention(resourceLabel, value): {
+    resource+: {
+      google_storage_bucket+: {
+        [resourceLabel]+: {
+          enable_object_retention: value,
+        },
+      },
+    },
+  },
   '#withEncryption':: d.fn(help='`google.list[obj].withEncryption` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the encryption field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withEncryptionMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `encryption` field.\n', args=[]),
   withEncryption(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/storage_bucket_object.libsonnet b/4.x/_gen/resources/storage_bucket_object.libsonnet
index 9c91ffeb..a61ecdd3 100644
--- a/4.x/_gen/resources/storage_bucket_object.libsonnet
+++ b/4.x/_gen/resources/storage_bucket_object.libsonnet
@@ -12,7 +12,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       encryption_key: encryption_key,
     }),
   },
-  '#new':: d.fn(help="\n`google.storage_bucket_object.new` injects a new `google_storage_bucket_object` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.storage_bucket_object.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.storage_bucket_object` using the reference:\n\n    $._ref.google_storage_bucket_object.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_storage_bucket_object.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `bucket` (`string`): The name of the containing bucket.\n  - `cache_control` (`string`): Cache-Control directive to specify caching behavior of object data. If omitted and object is accessible to all anonymous users, the default will be public, max-age=3600 When `null`, the `cache_control` field will be omitted from the resulting object.\n  - `content` (`string`): Data as string to be uploaded. Must be defined if source is not. Note: The content field is marked as sensitive. To view the raw contents of the object, please define an output. When `null`, the `content` field will be omitted from the resulting object.\n  - `content_disposition` (`string`): Content-Disposition of the object data. When `null`, the `content_disposition` field will be omitted from the resulting object.\n  - `content_encoding` (`string`): Content-Encoding of the object data. When `null`, the `content_encoding` field will be omitted from the resulting object.\n  - `content_language` (`string`): Content-Language of the object data. When `null`, the `content_language` field will be omitted from the resulting object.\n  - `content_type` (`string`): Content-Type of the object data. Defaults to \u0026#34;application/octet-stream\u0026#34; or \u0026#34;text/plain; charset=utf-8\u0026#34;. When `null`, the `content_type` field will be omitted from the resulting object.\n  - `detect_md5hash` (`string`): Set the `detect_md5hash` field on the resulting resource block. When `null`, the `detect_md5hash` field will be omitted from the resulting object.\n  - `event_based_hold` (`bool`): Whether an object is under event-based hold. Event-based hold is a way to retain objects until an event occurs, which is signified by the hold\u0026#39;s release (i.e. this value is set to false). After being released (set to false), such objects will be subject to bucket-level retention (if any). When `null`, the `event_based_hold` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): Resource name of the Cloud KMS key that will be used to encrypt the object. Overrides the object metadata\u0026#39;s kmsKeyName value, if any. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `metadata` (`obj`): User-provided metadata, in key/value pairs. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the object. If you\u0026#39;re interpolating the name of this object, see output_name instead.\n  - `source` (`string`): A path to the data you want to upload. Must be defined if content is not. When `null`, the `source` field will be omitted from the resulting object.\n  - `storage_class` (`string`): The StorageClass of the new bucket object. Supported values include: MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE. If not provided, this defaults to the bucket\u0026#39;s default storage class or to a standard class. When `null`, the `storage_class` field will be omitted from the resulting object.\n  - `temporary_hold` (`bool`): Whether an object is under temporary hold. While this flag is set to true, the object is protected against deletion and overwrites. When `null`, the `temporary_hold` field will be omitted from the resulting object.\n  - `customer_encryption` (`list[obj]`): Encryption key; encoded using base64. When `null`, the `customer_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket_object.customer_encryption.new](#fn-customer_encryptionnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket_object.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.storage_bucket_object.new` injects a new `google_storage_bucket_object` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.storage_bucket_object.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.storage_bucket_object` using the reference:\n\n    $._ref.google_storage_bucket_object.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_storage_bucket_object.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `bucket` (`string`): The name of the containing bucket.\n  - `cache_control` (`string`): Cache-Control directive to specify caching behavior of object data. If omitted and object is accessible to all anonymous users, the default will be public, max-age=3600 When `null`, the `cache_control` field will be omitted from the resulting object.\n  - `content` (`string`): Data as string to be uploaded. Must be defined if source is not. Note: The content field is marked as sensitive. To view the raw contents of the object, please define an output. When `null`, the `content` field will be omitted from the resulting object.\n  - `content_disposition` (`string`): Content-Disposition of the object data. When `null`, the `content_disposition` field will be omitted from the resulting object.\n  - `content_encoding` (`string`): Content-Encoding of the object data. When `null`, the `content_encoding` field will be omitted from the resulting object.\n  - `content_language` (`string`): Content-Language of the object data. When `null`, the `content_language` field will be omitted from the resulting object.\n  - `content_type` (`string`): Content-Type of the object data. Defaults to \u0026#34;application/octet-stream\u0026#34; or \u0026#34;text/plain; charset=utf-8\u0026#34;. When `null`, the `content_type` field will be omitted from the resulting object.\n  - `detect_md5hash` (`string`): Set the `detect_md5hash` field on the resulting resource block. When `null`, the `detect_md5hash` field will be omitted from the resulting object.\n  - `event_based_hold` (`bool`): Whether an object is under event-based hold. Event-based hold is a way to retain objects until an event occurs, which is signified by the hold\u0026#39;s release (i.e. this value is set to false). After being released (set to false), such objects will be subject to bucket-level retention (if any). When `null`, the `event_based_hold` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): Resource name of the Cloud KMS key that will be used to encrypt the object. Overrides the object metadata\u0026#39;s kmsKeyName value, if any. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `metadata` (`obj`): User-provided metadata, in key/value pairs. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the object. If you\u0026#39;re interpolating the name of this object, see output_name instead.\n  - `source` (`string`): A path to the data you want to upload. Must be defined if content is not. When `null`, the `source` field will be omitted from the resulting object.\n  - `storage_class` (`string`): The StorageClass of the new bucket object. Supported values include: MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE. If not provided, this defaults to the bucket\u0026#39;s default storage class or to a standard class. When `null`, the `storage_class` field will be omitted from the resulting object.\n  - `temporary_hold` (`bool`): Whether an object is under temporary hold. While this flag is set to true, the object is protected against deletion and overwrites. When `null`, the `temporary_hold` field will be omitted from the resulting object.\n  - `customer_encryption` (`list[obj]`): Encryption key; encoded using base64. When `null`, the `customer_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket_object.customer_encryption.new](#fn-customer_encryptionnew) constructor.\n  - `retention` (`list[obj]`): Object level retention configuration. When `null`, the `retention` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket_object.retention.new](#fn-retentionnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket_object.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     bucket,
@@ -28,6 +28,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     event_based_hold=null,
     kms_key_name=null,
     metadata=null,
+    retention=null,
     source=null,
     storage_class=null,
     temporary_hold=null,
@@ -50,6 +51,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       kms_key_name=kms_key_name,
       metadata=metadata,
       name=name,
+      retention=retention,
       source=source,
       storage_class=storage_class,
       temporary_hold=temporary_hold,
@@ -57,7 +59,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.storage_bucket_object.newAttrs` constructs a new object with attributes and blocks configured for the `storage_bucket_object`\nTerraform resource.\n\nUnlike [google.storage_bucket_object.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `bucket` (`string`): The name of the containing bucket.\n  - `cache_control` (`string`): Cache-Control directive to specify caching behavior of object data. If omitted and object is accessible to all anonymous users, the default will be public, max-age=3600 When `null`, the `cache_control` field will be omitted from the resulting object.\n  - `content` (`string`): Data as string to be uploaded. Must be defined if source is not. Note: The content field is marked as sensitive. To view the raw contents of the object, please define an output. When `null`, the `content` field will be omitted from the resulting object.\n  - `content_disposition` (`string`): Content-Disposition of the object data. When `null`, the `content_disposition` field will be omitted from the resulting object.\n  - `content_encoding` (`string`): Content-Encoding of the object data. When `null`, the `content_encoding` field will be omitted from the resulting object.\n  - `content_language` (`string`): Content-Language of the object data. When `null`, the `content_language` field will be omitted from the resulting object.\n  - `content_type` (`string`): Content-Type of the object data. Defaults to "application/octet-stream" or "text/plain; charset=utf-8". When `null`, the `content_type` field will be omitted from the resulting object.\n  - `detect_md5hash` (`string`): Set the `detect_md5hash` field on the resulting object. When `null`, the `detect_md5hash` field will be omitted from the resulting object.\n  - `event_based_hold` (`bool`): Whether an object is under event-based hold. Event-based hold is a way to retain objects until an event occurs, which is signified by the hold's release (i.e. this value is set to false). After being released (set to false), such objects will be subject to bucket-level retention (if any). When `null`, the `event_based_hold` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): Resource name of the Cloud KMS key that will be used to encrypt the object. Overrides the object metadata's kmsKeyName value, if any. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `metadata` (`obj`): User-provided metadata, in key/value pairs. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the object. If you're interpolating the name of this object, see output_name instead.\n  - `source` (`string`): A path to the data you want to upload. Must be defined if content is not. When `null`, the `source` field will be omitted from the resulting object.\n  - `storage_class` (`string`): The StorageClass of the new bucket object. Supported values include: MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE. If not provided, this defaults to the bucket's default storage class or to a standard class. When `null`, the `storage_class` field will be omitted from the resulting object.\n  - `temporary_hold` (`bool`): Whether an object is under temporary hold. While this flag is set to true, the object is protected against deletion and overwrites. When `null`, the `temporary_hold` field will be omitted from the resulting object.\n  - `customer_encryption` (`list[obj]`): Encryption key; encoded using base64. When `null`, the `customer_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket_object.customer_encryption.new](#fn-customer_encryptionnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket_object.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `storage_bucket_object` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.storage_bucket_object.newAttrs` constructs a new object with attributes and blocks configured for the `storage_bucket_object`\nTerraform resource.\n\nUnlike [google.storage_bucket_object.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `bucket` (`string`): The name of the containing bucket.\n  - `cache_control` (`string`): Cache-Control directive to specify caching behavior of object data. If omitted and object is accessible to all anonymous users, the default will be public, max-age=3600 When `null`, the `cache_control` field will be omitted from the resulting object.\n  - `content` (`string`): Data as string to be uploaded. Must be defined if source is not. Note: The content field is marked as sensitive. To view the raw contents of the object, please define an output. When `null`, the `content` field will be omitted from the resulting object.\n  - `content_disposition` (`string`): Content-Disposition of the object data. When `null`, the `content_disposition` field will be omitted from the resulting object.\n  - `content_encoding` (`string`): Content-Encoding of the object data. When `null`, the `content_encoding` field will be omitted from the resulting object.\n  - `content_language` (`string`): Content-Language of the object data. When `null`, the `content_language` field will be omitted from the resulting object.\n  - `content_type` (`string`): Content-Type of the object data. Defaults to "application/octet-stream" or "text/plain; charset=utf-8". When `null`, the `content_type` field will be omitted from the resulting object.\n  - `detect_md5hash` (`string`): Set the `detect_md5hash` field on the resulting object. When `null`, the `detect_md5hash` field will be omitted from the resulting object.\n  - `event_based_hold` (`bool`): Whether an object is under event-based hold. Event-based hold is a way to retain objects until an event occurs, which is signified by the hold's release (i.e. this value is set to false). After being released (set to false), such objects will be subject to bucket-level retention (if any). When `null`, the `event_based_hold` field will be omitted from the resulting object.\n  - `kms_key_name` (`string`): Resource name of the Cloud KMS key that will be used to encrypt the object. Overrides the object metadata's kmsKeyName value, if any. When `null`, the `kms_key_name` field will be omitted from the resulting object.\n  - `metadata` (`obj`): User-provided metadata, in key/value pairs. When `null`, the `metadata` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the object. If you're interpolating the name of this object, see output_name instead.\n  - `source` (`string`): A path to the data you want to upload. Must be defined if content is not. When `null`, the `source` field will be omitted from the resulting object.\n  - `storage_class` (`string`): The StorageClass of the new bucket object. Supported values include: MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE. If not provided, this defaults to the bucket's default storage class or to a standard class. When `null`, the `storage_class` field will be omitted from the resulting object.\n  - `temporary_hold` (`bool`): Whether an object is under temporary hold. While this flag is set to true, the object is protected against deletion and overwrites. When `null`, the `temporary_hold` field will be omitted from the resulting object.\n  - `customer_encryption` (`list[obj]`): Encryption key; encoded using base64. When `null`, the `customer_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket_object.customer_encryption.new](#fn-customer_encryptionnew) constructor.\n  - `retention` (`list[obj]`): Object level retention configuration. When `null`, the `retention` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket_object.retention.new](#fn-retentionnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket_object.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `storage_bucket_object` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     bucket,
     name,
@@ -72,6 +74,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     event_based_hold=null,
     kms_key_name=null,
     metadata=null,
+    retention=null,
     source=null,
     storage_class=null,
     temporary_hold=null,
@@ -90,11 +93,22 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     kms_key_name: kms_key_name,
     metadata: metadata,
     name: name,
+    retention: retention,
     source: source,
     storage_class: storage_class,
     temporary_hold: temporary_hold,
     timeouts: timeouts,
   }),
+  retention:: {
+    '#new':: d.fn(help='\n`google.storage_bucket_object.retention.new` constructs a new object with attributes and blocks configured for the `retention`\nTerraform sub block.\n\n\n\n**Args**:\n  - `mode` (`string`): The object retention mode. Supported values include: "Unlocked", "Locked".\n  - `retain_until_time` (`string`): Time in RFC 3339 (e.g. 2030-01-01T02:03:04Z) until which object retention protects this object.\n\n**Returns**:\n  - An attribute object that represents the `retention` sub block.\n', args=[]),
+    new(
+      mode,
+      retain_until_time
+    ):: std.prune(a={
+      mode: mode,
+      retain_until_time: retain_until_time,
+    }),
+  },
   timeouts:: {
     '#new':: d.fn(help='\n`google.storage_bucket_object.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`\nTerraform sub block.\n\n\n\n**Args**:\n  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.\n  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.\n  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `timeouts` sub block.\n', args=[]),
     new(
@@ -247,6 +261,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withRetention':: d.fn(help='`google.list[obj].withRetention` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the retention field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withRetentionMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `retention` field.\n', args=[]),
+  withRetention(resourceLabel, value): {
+    resource+: {
+      google_storage_bucket_object+: {
+        [resourceLabel]+: {
+          retention: value,
+        },
+      },
+    },
+  },
+  '#withRetentionMixin':: d.fn(help='`google.list[obj].withRetentionMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the retention field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withRetention](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `retention` field.\n', args=[]),
+  withRetentionMixin(resourceLabel, value): {
+    resource+: {
+      google_storage_bucket_object+: {
+        [resourceLabel]+: {
+          retention+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withSource':: d.fn(help='`google.string.withSource` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the source field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `source` field.\n', args=[]),
   withSource(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/storage_transfer_job.libsonnet b/4.x/_gen/resources/storage_transfer_job.libsonnet
index a80d8605..83cd096e 100644
--- a/4.x/_gen/resources/storage_transfer_job.libsonnet
+++ b/4.x/_gen/resources/storage_transfer_job.libsonnet
@@ -2,10 +2,23 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='storage_transfer_job', url='', help='`storage_transfer_job` represents the `google_storage_transfer_job` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.storage_transfer_job.new` injects a new `google_storage_transfer_job` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.storage_transfer_job.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.storage_transfer_job` using the reference:\n\n    $._ref.google_storage_transfer_job.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_storage_transfer_job.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Unique description to identify the Transfer Job.\n  - `project` (`string`): The project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `status` (`string`): Status of the job. Default: ENABLED. NOTE: The effect of the new job status takes place during a subsequent job run. For example, if you change the job status from ENABLED to DISABLED, and an operation spawned by the transfer is running, the status change would not affect the current operation. When `null`, the `status` field will be omitted from the resulting object.\n  - `notification_config` (`list[obj]`): Notification configuration. When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.notification_config.new](#fn-notification_confignew) constructor.\n  - `schedule` (`list[obj]`): Schedule specification defining when the Transfer Job should be scheduled to start, end and what time to run. When `null`, the `schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.schedule.new](#fn-schedulenew) constructor.\n  - `transfer_spec` (`list[obj]`): Transfer specification. When `null`, the `transfer_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.transfer_spec.new](#fn-transfer_specnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  event_stream:: {
+    '#new':: d.fn(help='\n`google.storage_transfer_job.event_stream.new` constructs a new object with attributes and blocks configured for the `event_stream`\nTerraform sub block.\n\n\n\n**Args**:\n  - `event_stream_expiration_time` (`string`): Specifies the data and time at which Storage Transfer Service stops listening for events from this stream. After this time, any transfers in progress will complete, but no new transfers are initiated When `null`, the `event_stream_expiration_time` field will be omitted from the resulting object.\n  - `event_stream_start_time` (`string`): Specifies the date and time that Storage Transfer Service starts listening for events from this stream. If no start time is specified or start time is in the past, Storage Transfer Service starts listening immediately When `null`, the `event_stream_start_time` field will be omitted from the resulting object.\n  - `name` (`string`): Specifies a unique name of the resource such as AWS SQS ARN in the form 'arn:aws:sqs:region:account_id:queue_name', or Pub/Sub subscription resource name in the form 'projects/{project}/subscriptions/{sub}'\n\n**Returns**:\n  - An attribute object that represents the `event_stream` sub block.\n', args=[]),
+    new(
+      name,
+      event_stream_expiration_time=null,
+      event_stream_start_time=null
+    ):: std.prune(a={
+      event_stream_expiration_time: event_stream_expiration_time,
+      event_stream_start_time: event_stream_start_time,
+      name: name,
+    }),
+  },
+  '#new':: d.fn(help="\n`google.storage_transfer_job.new` injects a new `google_storage_transfer_job` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.storage_transfer_job.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.storage_transfer_job` using the reference:\n\n    $._ref.google_storage_transfer_job.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_storage_transfer_job.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Unique description to identify the Transfer Job.\n  - `project` (`string`): The project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `status` (`string`): Status of the job. Default: ENABLED. NOTE: The effect of the new job status takes place during a subsequent job run. For example, if you change the job status from ENABLED to DISABLED, and an operation spawned by the transfer is running, the status change would not affect the current operation. When `null`, the `status` field will be omitted from the resulting object.\n  - `event_stream` (`list[obj]`): Set the `event_stream` field on the resulting resource block. When `null`, the `event_stream` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.event_stream.new](#fn-event_streamnew) constructor.\n  - `notification_config` (`list[obj]`): Notification configuration. When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.notification_config.new](#fn-notification_confignew) constructor.\n  - `schedule` (`list[obj]`): Schedule specification defining when the Transfer Job should be scheduled to start, end and what time to run. When `null`, the `schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.schedule.new](#fn-schedulenew) constructor.\n  - `transfer_spec` (`list[obj]`): Transfer specification. When `null`, the `transfer_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.transfer_spec.new](#fn-transfer_specnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     description,
+    event_stream=null,
     notification_config=null,
     project=null,
     schedule=null,
@@ -17,6 +30,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     label=resourceLabel,
     attrs=self.newAttrs(
       description=description,
+      event_stream=event_stream,
       notification_config=notification_config,
       project=project,
       schedule=schedule,
@@ -25,9 +39,10 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.storage_transfer_job.newAttrs` constructs a new object with attributes and blocks configured for the `storage_transfer_job`\nTerraform resource.\n\nUnlike [google.storage_transfer_job.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Unique description to identify the Transfer Job.\n  - `project` (`string`): The project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `status` (`string`): Status of the job. Default: ENABLED. NOTE: The effect of the new job status takes place during a subsequent job run. For example, if you change the job status from ENABLED to DISABLED, and an operation spawned by the transfer is running, the status change would not affect the current operation. When `null`, the `status` field will be omitted from the resulting object.\n  - `notification_config` (`list[obj]`): Notification configuration. When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.notification_config.new](#fn-notification_confignew) constructor.\n  - `schedule` (`list[obj]`): Schedule specification defining when the Transfer Job should be scheduled to start, end and what time to run. When `null`, the `schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.schedule.new](#fn-schedulenew) constructor.\n  - `transfer_spec` (`list[obj]`): Transfer specification. When `null`, the `transfer_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.transfer_spec.new](#fn-transfer_specnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `storage_transfer_job` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.storage_transfer_job.newAttrs` constructs a new object with attributes and blocks configured for the `storage_transfer_job`\nTerraform resource.\n\nUnlike [google.storage_transfer_job.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Unique description to identify the Transfer Job.\n  - `project` (`string`): The project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.\n  - `status` (`string`): Status of the job. Default: ENABLED. NOTE: The effect of the new job status takes place during a subsequent job run. For example, if you change the job status from ENABLED to DISABLED, and an operation spawned by the transfer is running, the status change would not affect the current operation. When `null`, the `status` field will be omitted from the resulting object.\n  - `event_stream` (`list[obj]`): Set the `event_stream` field on the resulting object. When `null`, the `event_stream` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.event_stream.new](#fn-event_streamnew) constructor.\n  - `notification_config` (`list[obj]`): Notification configuration. When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.notification_config.new](#fn-notification_confignew) constructor.\n  - `schedule` (`list[obj]`): Schedule specification defining when the Transfer Job should be scheduled to start, end and what time to run. When `null`, the `schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.schedule.new](#fn-schedulenew) constructor.\n  - `transfer_spec` (`list[obj]`): Transfer specification. When `null`, the `transfer_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.transfer_spec.new](#fn-transfer_specnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `storage_transfer_job` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     description,
+    event_stream=null,
     notification_config=null,
     project=null,
     schedule=null,
@@ -35,6 +50,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     transfer_spec=null
   ):: std.prune(a={
     description: description,
+    event_stream: event_stream,
     notification_config: notification_config,
     project: project,
     schedule: schedule,
@@ -265,6 +281,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withEventStream':: d.fn(help='`google.list[obj].withEventStream` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the event_stream field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withEventStreamMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `event_stream` field.\n', args=[]),
+  withEventStream(resourceLabel, value): {
+    resource+: {
+      google_storage_transfer_job+: {
+        [resourceLabel]+: {
+          event_stream: value,
+        },
+      },
+    },
+  },
+  '#withEventStreamMixin':: d.fn(help='`google.list[obj].withEventStreamMixin` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the event_stream field.\n\nThis function will append the passed in array or object to the existing array. If you wish\nto instead replace the array with the passed in `value`, use the [google.list[obj].withEventStream](TODO)\nfunction.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `event_stream` field.\n', args=[]),
+  withEventStreamMixin(resourceLabel, value): {
+    resource+: {
+      google_storage_transfer_job+: {
+        [resourceLabel]+: {
+          event_stream+: if std.isArray(v=value) then value else [value],
+        },
+      },
+    },
+  },
   '#withNotificationConfig':: d.fn(help='`google.list[obj].withNotificationConfig` constructs a mixin object that can be merged into the `list[obj]`\nTerraform resource block to set or update the notification_config field.\n\nThis function will replace the array with the passed in `value`. If you wish to instead append the\npassed in value to the existing array, use the [google.list[obj].withNotificationConfigMixin](TODO) function.\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list[obj]`): The value to set for the `notification_config` field.\n', args=[]),
   withNotificationConfig(resourceLabel, value): {
     resource+: {
diff --git a/4.x/_gen/resources/tpu_node.libsonnet b/4.x/_gen/resources/tpu_node.libsonnet
index e2e234d2..00463195 100644
--- a/4.x/_gen/resources/tpu_node.libsonnet
+++ b/4.x/_gen/resources/tpu_node.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='tpu_node', url='', help='`tpu_node` represents the `google_tpu_node` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.tpu_node.new` injects a new `google_tpu_node` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.tpu_node.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.tpu_node` using the reference:\n\n    $._ref.google_tpu_node.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_tpu_node.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `accelerator_type` (`string`): The type of hardware accelerators associated with this node.\n  - `cidr_block` (`string`): The CIDR block that the TPU node will use when selecting an IP\naddress. This CIDR block must be a /29 block; the Compute Engine\nnetworks API forbids a smaller block, and using a larger block would\nbe wasteful (a node can only consume one IP address).\n\nErrors will occur if the CIDR block has already been used for a\ncurrently existing TPU node, the CIDR block conflicts with any\nsubnetworks in the user\u0026#39;s provided network, or the provided network\nis peered with another network that is using that CIDR block. When `null`, the `cidr_block` field will be omitted from the resulting object.\n  - `description` (`string`): The user-supplied description of the TPU. Maximum of 512 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The immutable name of the TPU.\n  - `network` (`string`): The name of a network to peer the TPU node to. It must be a\npreexisting Compute Engine network inside of the project on which\nthis API has been activated. If none is provided, \u0026#34;default\u0026#34; will be\nused. When `null`, the `network` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `tensorflow_version` (`string`): The version of Tensorflow running in the Node.\n  - `use_service_networking` (`bool`): Whether the VPC peering for the node is set up through Service Networking API.\nThe VPC Peering should be set up before provisioning the node. If this field is set,\ncidr_block field should not be specified. If the network that you want to peer the\nTPU Node to is a Shared VPC network, the node must be created with this this field enabled. When `null`, the `use_service_networking` field will be omitted from the resulting object.\n  - `zone` (`string`): The GCP location for the TPU. If it is not provided, the provider zone is used. When `null`, the `zone` field will be omitted from the resulting object.\n  - `scheduling_config` (`list[obj]`): Sets the scheduling options for this TPU instance. When `null`, the `scheduling_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.tpu_node.scheduling_config.new](#fn-scheduling_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.tpu_node.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.tpu_node.new` injects a new `google_tpu_node` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.tpu_node.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.tpu_node` using the reference:\n\n    $._ref.google_tpu_node.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_tpu_node.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `accelerator_type` (`string`): The type of hardware accelerators associated with this node.\n  - `cidr_block` (`string`): The CIDR block that the TPU node will use when selecting an IP\naddress. This CIDR block must be a /29 block; the Compute Engine\nnetworks API forbids a smaller block, and using a larger block would\nbe wasteful (a node can only consume one IP address).\n\nErrors will occur if the CIDR block has already been used for a\ncurrently existing TPU node, the CIDR block conflicts with any\nsubnetworks in the user\u0026#39;s provided network, or the provided network\nis peered with another network that is using that CIDR block. When `null`, the `cidr_block` field will be omitted from the resulting object.\n  - `description` (`string`): The user-supplied description of the TPU. Maximum of 512 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The immutable name of the TPU.\n  - `network` (`string`): The name of a network to peer the TPU node to. It must be a\npreexisting Compute Engine network inside of the project on which\nthis API has been activated. If none is provided, \u0026#34;default\u0026#34; will be\nused. When `null`, the `network` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `tensorflow_version` (`string`): The version of Tensorflow running in the Node.\n  - `use_service_networking` (`bool`): Whether the VPC peering for the node is set up through Service Networking API.\nThe VPC Peering should be set up before provisioning the node. If this field is set,\ncidr_block field should not be specified. If the network that you want to peer the\nTPU Node to is a Shared VPC network, the node must be created with this this field enabled. When `null`, the `use_service_networking` field will be omitted from the resulting object.\n  - `zone` (`string`): The GCP location for the TPU. If it is not provided, the provider zone is used. When `null`, the `zone` field will be omitted from the resulting object.\n  - `scheduling_config` (`list[obj]`): Sets the scheduling options for this TPU instance. When `null`, the `scheduling_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.tpu_node.scheduling_config.new](#fn-scheduling_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.tpu_node.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     accelerator_type,
@@ -37,7 +37,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.tpu_node.newAttrs` constructs a new object with attributes and blocks configured for the `tpu_node`\nTerraform resource.\n\nUnlike [google.tpu_node.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `accelerator_type` (`string`): The type of hardware accelerators associated with this node.\n  - `cidr_block` (`string`): The CIDR block that the TPU node will use when selecting an IP\naddress. This CIDR block must be a /29 block; the Compute Engine\nnetworks API forbids a smaller block, and using a larger block would\nbe wasteful (a node can only consume one IP address).\n\nErrors will occur if the CIDR block has already been used for a\ncurrently existing TPU node, the CIDR block conflicts with any\nsubnetworks in the user's provided network, or the provided network\nis peered with another network that is using that CIDR block. When `null`, the `cidr_block` field will be omitted from the resulting object.\n  - `description` (`string`): The user-supplied description of the TPU. Maximum of 512 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The immutable name of the TPU.\n  - `network` (`string`): The name of a network to peer the TPU node to. It must be a\npreexisting Compute Engine network inside of the project on which\nthis API has been activated. If none is provided, "default" will be\nused. When `null`, the `network` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `tensorflow_version` (`string`): The version of Tensorflow running in the Node.\n  - `use_service_networking` (`bool`): Whether the VPC peering for the node is set up through Service Networking API.\nThe VPC Peering should be set up before provisioning the node. If this field is set,\ncidr_block field should not be specified. If the network that you want to peer the\nTPU Node to is a Shared VPC network, the node must be created with this this field enabled. When `null`, the `use_service_networking` field will be omitted from the resulting object.\n  - `zone` (`string`): The GCP location for the TPU. If it is not provided, the provider zone is used. When `null`, the `zone` field will be omitted from the resulting object.\n  - `scheduling_config` (`list[obj]`): Sets the scheduling options for this TPU instance. When `null`, the `scheduling_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.tpu_node.scheduling_config.new](#fn-scheduling_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.tpu_node.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `tpu_node` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.tpu_node.newAttrs` constructs a new object with attributes and blocks configured for the `tpu_node`\nTerraform resource.\n\nUnlike [google.tpu_node.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `accelerator_type` (`string`): The type of hardware accelerators associated with this node.\n  - `cidr_block` (`string`): The CIDR block that the TPU node will use when selecting an IP\naddress. This CIDR block must be a /29 block; the Compute Engine\nnetworks API forbids a smaller block, and using a larger block would\nbe wasteful (a node can only consume one IP address).\n\nErrors will occur if the CIDR block has already been used for a\ncurrently existing TPU node, the CIDR block conflicts with any\nsubnetworks in the user's provided network, or the provided network\nis peered with another network that is using that CIDR block. When `null`, the `cidr_block` field will be omitted from the resulting object.\n  - `description` (`string`): The user-supplied description of the TPU. Maximum of 512 characters. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): Resource labels to represent user provided metadata.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The immutable name of the TPU.\n  - `network` (`string`): The name of a network to peer the TPU node to. It must be a\npreexisting Compute Engine network inside of the project on which\nthis API has been activated. If none is provided, "default" will be\nused. When `null`, the `network` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `tensorflow_version` (`string`): The version of Tensorflow running in the Node.\n  - `use_service_networking` (`bool`): Whether the VPC peering for the node is set up through Service Networking API.\nThe VPC Peering should be set up before provisioning the node. If this field is set,\ncidr_block field should not be specified. If the network that you want to peer the\nTPU Node to is a Shared VPC network, the node must be created with this this field enabled. When `null`, the `use_service_networking` field will be omitted from the resulting object.\n  - `zone` (`string`): The GCP location for the TPU. If it is not provided, the provider zone is used. When `null`, the `zone` field will be omitted from the resulting object.\n  - `scheduling_config` (`list[obj]`): Sets the scheduling options for this TPU instance. When `null`, the `scheduling_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.tpu_node.scheduling_config.new](#fn-scheduling_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.tpu_node.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `tpu_node` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     accelerator_type,
     name,
diff --git a/4.x/_gen/resources/vertex_ai_dataset.libsonnet b/4.x/_gen/resources/vertex_ai_dataset.libsonnet
index ee64c5ff..054022b1 100644
--- a/4.x/_gen/resources/vertex_ai_dataset.libsonnet
+++ b/4.x/_gen/resources/vertex_ai_dataset.libsonnet
@@ -10,7 +10,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       kms_key_name: kms_key_name,
     }),
   },
-  '#new':: d.fn(help="\n`google.vertex_ai_dataset.new` injects a new `google_vertex_ai_dataset` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_dataset.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_dataset` using the reference:\n\n    $._ref.google_vertex_ai_dataset.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_dataset.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `display_name` (`string`): The user-defined name of the Dataset. The name can be up to 128 characters long and can be consist of any UTF-8 characters.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Workflow. When `null`, the `labels` field will be omitted from the resulting object.\n  - `metadata_schema_uri` (`string`): Points to a YAML file stored on Google Cloud Storage describing additional information about the Dataset. The schema is defined as an OpenAPI 3.0.2 Schema Object. The schema files that can be used here are found in gs://google-cloud-aiplatform/schema/dataset/metadata/.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the dataset. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `encryption_spec` (`list[obj]`): Customer-managed encryption key spec for a Dataset. If set, this Dataset and all sub-resources of this Dataset will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_dataset.encryption_spec.new](#fn-encryption_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_dataset.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.vertex_ai_dataset.new` injects a new `google_vertex_ai_dataset` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_dataset.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_dataset` using the reference:\n\n    $._ref.google_vertex_ai_dataset.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_dataset.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `display_name` (`string`): The user-defined name of the Dataset. The name can be up to 128 characters long and can be consist of any UTF-8 characters.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Workflow.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `metadata_schema_uri` (`string`): Points to a YAML file stored on Google Cloud Storage describing additional information about the Dataset. The schema is defined as an OpenAPI 3.0.2 Schema Object. The schema files that can be used here are found in gs://google-cloud-aiplatform/schema/dataset/metadata/.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the dataset. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `encryption_spec` (`list[obj]`): Customer-managed encryption key spec for a Dataset. If set, this Dataset and all sub-resources of this Dataset will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_dataset.encryption_spec.new](#fn-encryption_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_dataset.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     display_name,
@@ -35,7 +35,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.vertex_ai_dataset.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_dataset`\nTerraform resource.\n\nUnlike [google.vertex_ai_dataset.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `display_name` (`string`): The user-defined name of the Dataset. The name can be up to 128 characters long and can be consist of any UTF-8 characters.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Workflow. When `null`, the `labels` field will be omitted from the resulting object.\n  - `metadata_schema_uri` (`string`): Points to a YAML file stored on Google Cloud Storage describing additional information about the Dataset. The schema is defined as an OpenAPI 3.0.2 Schema Object. The schema files that can be used here are found in gs://google-cloud-aiplatform/schema/dataset/metadata/.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the dataset. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `encryption_spec` (`list[obj]`): Customer-managed encryption key spec for a Dataset. If set, this Dataset and all sub-resources of this Dataset will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_dataset.encryption_spec.new](#fn-encryption_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_dataset.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_dataset` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.vertex_ai_dataset.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_dataset`\nTerraform resource.\n\nUnlike [google.vertex_ai_dataset.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `display_name` (`string`): The user-defined name of the Dataset. The name can be up to 128 characters long and can be consist of any UTF-8 characters.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Workflow.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `metadata_schema_uri` (`string`): Points to a YAML file stored on Google Cloud Storage describing additional information about the Dataset. The schema is defined as an OpenAPI 3.0.2 Schema Object. The schema files that can be used here are found in gs://google-cloud-aiplatform/schema/dataset/metadata/.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the dataset. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `encryption_spec` (`list[obj]`): Customer-managed encryption key spec for a Dataset. If set, this Dataset and all sub-resources of this Dataset will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_dataset.encryption_spec.new](#fn-encryption_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_dataset.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_dataset` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     display_name,
     metadata_schema_uri,
diff --git a/4.x/_gen/resources/vertex_ai_endpoint.libsonnet b/4.x/_gen/resources/vertex_ai_endpoint.libsonnet
index e11209a8..2bbaeb11 100644
--- a/4.x/_gen/resources/vertex_ai_endpoint.libsonnet
+++ b/4.x/_gen/resources/vertex_ai_endpoint.libsonnet
@@ -10,7 +10,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       kms_key_name: kms_key_name,
     }),
   },
-  '#new':: d.fn(help="\n`google.vertex_ai_endpoint.new` injects a new `google_vertex_ai_endpoint` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_endpoint.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_endpoint` using the reference:\n\n    $._ref.google_vertex_ai_endpoint.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_endpoint.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): The description of the Endpoint. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Required. The display name of the Endpoint. The name can be up to 128 characters long and can consist of any UTF-8 characters.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your Endpoints. Label keys and values can be no longer than 64 characters (Unicode codepoints), can only contain lowercase letters, numeric characters, underscores and dashes. International characters are allowed. See https://goo.gl/xmQnxf for more information and examples of labels. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The resource name of the Endpoint. The name must be numeric with no leading zeros and can be at most 10 digits.\n  - `network` (`string`): The full name of the Google Compute Engine [network](https://cloud.google.com//compute/docs/networks-and-firewalls#networks) to which the Endpoint should be peered. Private services access must already be configured for the network. If left unspecified, the Endpoint is not peered with any network. Only one of the fields, network or enable_private_service_connect, can be set. [Format](https://cloud.google.com/compute/docs/reference/rest/v1/networks/insert): \u0026#39;projects/{project}/global/networks/{network}\u0026#39;. Where \u0026#39;{project}\u0026#39; is a project number, as in \u0026#39;12345\u0026#39;, and \u0026#39;{network}\u0026#39; is network name. When `null`, the `network` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region for the resource When `null`, the `region` field will be omitted from the resulting object.\n  - `encryption_spec` (`list[obj]`): Customer-managed encryption key spec for an Endpoint. If set, this Endpoint and all sub-resources of this Endpoint will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_endpoint.encryption_spec.new](#fn-encryption_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_endpoint.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.vertex_ai_endpoint.new` injects a new `google_vertex_ai_endpoint` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_endpoint.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_endpoint` using the reference:\n\n    $._ref.google_vertex_ai_endpoint.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_endpoint.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): The description of the Endpoint. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Required. The display name of the Endpoint. The name can be up to 128 characters long and can consist of any UTF-8 characters.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your Endpoints. Label keys and values can be no longer than 64 characters (Unicode codepoints), can only contain lowercase letters, numeric characters, underscores and dashes. International characters are allowed. See https://goo.gl/xmQnxf for more information and examples of labels.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The resource name of the Endpoint. The name must be numeric with no leading zeros and can be at most 10 digits.\n  - `network` (`string`): The full name of the Google Compute Engine [network](https://cloud.google.com//compute/docs/networks-and-firewalls#networks) to which the Endpoint should be peered. Private services access must already be configured for the network. If left unspecified, the Endpoint is not peered with any network. Only one of the fields, network or enable_private_service_connect, can be set. [Format](https://cloud.google.com/compute/docs/reference/rest/v1/networks/insert): \u0026#39;projects/{project}/global/networks/{network}\u0026#39;. Where \u0026#39;{project}\u0026#39; is a project number, as in \u0026#39;12345\u0026#39;, and \u0026#39;{network}\u0026#39; is network name. When `null`, the `network` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region for the resource When `null`, the `region` field will be omitted from the resulting object.\n  - `encryption_spec` (`list[obj]`): Customer-managed encryption key spec for an Endpoint. If set, this Endpoint and all sub-resources of this Endpoint will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_endpoint.encryption_spec.new](#fn-encryption_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_endpoint.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     display_name,
@@ -41,7 +41,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.vertex_ai_endpoint.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_endpoint`\nTerraform resource.\n\nUnlike [google.vertex_ai_endpoint.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): The description of the Endpoint. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Required. The display name of the Endpoint. The name can be up to 128 characters long and can consist of any UTF-8 characters.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your Endpoints. Label keys and values can be no longer than 64 characters (Unicode codepoints), can only contain lowercase letters, numeric characters, underscores and dashes. International characters are allowed. See https://goo.gl/xmQnxf for more information and examples of labels. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The resource name of the Endpoint. The name must be numeric with no leading zeros and can be at most 10 digits.\n  - `network` (`string`): The full name of the Google Compute Engine [network](https://cloud.google.com//compute/docs/networks-and-firewalls#networks) to which the Endpoint should be peered. Private services access must already be configured for the network. If left unspecified, the Endpoint is not peered with any network. Only one of the fields, network or enable_private_service_connect, can be set. [Format](https://cloud.google.com/compute/docs/reference/rest/v1/networks/insert): 'projects/{project}/global/networks/{network}'. Where '{project}' is a project number, as in '12345', and '{network}' is network name. When `null`, the `network` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region for the resource When `null`, the `region` field will be omitted from the resulting object.\n  - `encryption_spec` (`list[obj]`): Customer-managed encryption key spec for an Endpoint. If set, this Endpoint and all sub-resources of this Endpoint will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_endpoint.encryption_spec.new](#fn-encryption_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_endpoint.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_endpoint` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.vertex_ai_endpoint.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_endpoint`\nTerraform resource.\n\nUnlike [google.vertex_ai_endpoint.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): The description of the Endpoint. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): Required. The display name of the Endpoint. The name can be up to 128 characters long and can consist of any UTF-8 characters.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your Endpoints. Label keys and values can be no longer than 64 characters (Unicode codepoints), can only contain lowercase letters, numeric characters, underscores and dashes. International characters are allowed. See https://goo.gl/xmQnxf for more information and examples of labels.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `location` (`string`): The location for the resource\n  - `name` (`string`): The resource name of the Endpoint. The name must be numeric with no leading zeros and can be at most 10 digits.\n  - `network` (`string`): The full name of the Google Compute Engine [network](https://cloud.google.com//compute/docs/networks-and-firewalls#networks) to which the Endpoint should be peered. Private services access must already be configured for the network. If left unspecified, the Endpoint is not peered with any network. Only one of the fields, network or enable_private_service_connect, can be set. [Format](https://cloud.google.com/compute/docs/reference/rest/v1/networks/insert): 'projects/{project}/global/networks/{network}'. Where '{project}' is a project number, as in '12345', and '{network}' is network name. When `null`, the `network` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region for the resource When `null`, the `region` field will be omitted from the resulting object.\n  - `encryption_spec` (`list[obj]`): Customer-managed encryption key spec for an Endpoint. If set, this Endpoint and all sub-resources of this Endpoint will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_endpoint.encryption_spec.new](#fn-encryption_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_endpoint.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_endpoint` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     display_name,
     location,
diff --git a/4.x/_gen/resources/vertex_ai_featurestore.libsonnet b/4.x/_gen/resources/vertex_ai_featurestore.libsonnet
index e2d40614..ee1c0ab7 100644
--- a/4.x/_gen/resources/vertex_ai_featurestore.libsonnet
+++ b/4.x/_gen/resources/vertex_ai_featurestore.libsonnet
@@ -10,7 +10,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       kms_key_name: kms_key_name,
     }),
   },
-  '#new':: d.fn(help="\n`google.vertex_ai_featurestore.new` injects a new `google_vertex_ai_featurestore` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_featurestore.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_featurestore` using the reference:\n\n    $._ref.google_vertex_ai_featurestore.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_featurestore.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `force_destroy` (`bool`): If set to true, any EntityTypes and Features for this Featurestore will also be deleted When `null`, the `force_destroy` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Featurestore. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the Featurestore. This value may be up to 60 characters, and valid characters are [a-z0-9_]. The first character cannot be a number. When `null`, the `name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the dataset. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `encryption_spec` (`list[obj]`): If set, both of the online and offline data storage will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore.encryption_spec.new](#fn-encryption_specnew) constructor.\n  - `online_serving_config` (`list[obj]`): Config for online serving resources. When `null`, the `online_serving_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore.online_serving_config.new](#fn-online_serving_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.vertex_ai_featurestore.new` injects a new `google_vertex_ai_featurestore` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_featurestore.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_featurestore` using the reference:\n\n    $._ref.google_vertex_ai_featurestore.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_featurestore.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `force_destroy` (`bool`): If set to true, any EntityTypes and Features for this Featurestore will also be deleted When `null`, the `force_destroy` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Featurestore.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the Featurestore. This value may be up to 60 characters, and valid characters are [a-z0-9_]. The first character cannot be a number. When `null`, the `name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the dataset. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `encryption_spec` (`list[obj]`): If set, both of the online and offline data storage will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore.encryption_spec.new](#fn-encryption_specnew) constructor.\n  - `online_serving_config` (`list[obj]`): Config for online serving resources. When `null`, the `online_serving_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore.online_serving_config.new](#fn-online_serving_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     encryption_spec=null,
@@ -37,7 +37,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.vertex_ai_featurestore.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_featurestore`\nTerraform resource.\n\nUnlike [google.vertex_ai_featurestore.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `force_destroy` (`bool`): If set to true, any EntityTypes and Features for this Featurestore will also be deleted When `null`, the `force_destroy` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Featurestore. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the Featurestore. This value may be up to 60 characters, and valid characters are [a-z0-9_]. The first character cannot be a number. When `null`, the `name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the dataset. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `encryption_spec` (`list[obj]`): If set, both of the online and offline data storage will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore.encryption_spec.new](#fn-encryption_specnew) constructor.\n  - `online_serving_config` (`list[obj]`): Config for online serving resources. When `null`, the `online_serving_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore.online_serving_config.new](#fn-online_serving_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_featurestore` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.vertex_ai_featurestore.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_featurestore`\nTerraform resource.\n\nUnlike [google.vertex_ai_featurestore.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `force_destroy` (`bool`): If set to true, any EntityTypes and Features for this Featurestore will also be deleted When `null`, the `force_destroy` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Featurestore.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the Featurestore. This value may be up to 60 characters, and valid characters are [a-z0-9_]. The first character cannot be a number. When `null`, the `name` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the dataset. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `encryption_spec` (`list[obj]`): If set, both of the online and offline data storage will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore.encryption_spec.new](#fn-encryption_specnew) constructor.\n  - `online_serving_config` (`list[obj]`): Config for online serving resources. When `null`, the `online_serving_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore.online_serving_config.new](#fn-online_serving_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_featurestore` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     encryption_spec=null,
     force_destroy=null,
diff --git a/4.x/_gen/resources/vertex_ai_featurestore_entitytype.libsonnet b/4.x/_gen/resources/vertex_ai_featurestore_entitytype.libsonnet
index 34fb0412..8456874a 100644
--- a/4.x/_gen/resources/vertex_ai_featurestore_entitytype.libsonnet
+++ b/4.x/_gen/resources/vertex_ai_featurestore_entitytype.libsonnet
@@ -54,7 +54,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       }),
     },
   },
-  '#new':: d.fn(help="\n`google.vertex_ai_featurestore_entitytype.new` injects a new `google_vertex_ai_featurestore_entitytype` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_featurestore_entitytype.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_featurestore_entitytype` using the reference:\n\n    $._ref.google_vertex_ai_featurestore_entitytype.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_featurestore_entitytype.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Optional. Description of the EntityType. When `null`, the `description` field will be omitted from the resulting object.\n  - `featurestore` (`string`): The name of the Featurestore to use, in the format projects/{project}/locations/{location}/featurestores/{featurestore}.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this EntityType. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the EntityType. This value may be up to 60 characters, and valid characters are [a-z0-9_]. The first character cannot be a number. When `null`, the `name` field will be omitted from the resulting object.\n  - `monitoring_config` (`list[obj]`): The default monitoring configuration for all Features under this EntityType.\n\nIf this is populated with [FeaturestoreMonitoringConfig.monitoring_interval] specified, snapshot analysis monitoring is enabled. Otherwise, snapshot analysis monitoring is disabled. When `null`, the `monitoring_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore_entitytype.monitoring_config.new](#fn-monitoring_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore_entitytype.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.vertex_ai_featurestore_entitytype.new` injects a new `google_vertex_ai_featurestore_entitytype` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_featurestore_entitytype.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_featurestore_entitytype` using the reference:\n\n    $._ref.google_vertex_ai_featurestore_entitytype.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_featurestore_entitytype.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Optional. Description of the EntityType. When `null`, the `description` field will be omitted from the resulting object.\n  - `featurestore` (`string`): The name of the Featurestore to use, in the format projects/{project}/locations/{location}/featurestores/{featurestore}.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this EntityType.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the EntityType. This value may be up to 60 characters, and valid characters are [a-z0-9_]. The first character cannot be a number. When `null`, the `name` field will be omitted from the resulting object.\n  - `monitoring_config` (`list[obj]`): The default monitoring configuration for all Features under this EntityType.\n\nIf this is populated with [FeaturestoreMonitoringConfig.monitoring_interval] specified, snapshot analysis monitoring is enabled. Otherwise, snapshot analysis monitoring is disabled. When `null`, the `monitoring_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore_entitytype.monitoring_config.new](#fn-monitoring_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore_entitytype.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     featurestore,
@@ -77,7 +77,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.vertex_ai_featurestore_entitytype.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_featurestore_entitytype`\nTerraform resource.\n\nUnlike [google.vertex_ai_featurestore_entitytype.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Optional. Description of the EntityType. When `null`, the `description` field will be omitted from the resulting object.\n  - `featurestore` (`string`): The name of the Featurestore to use, in the format projects/{project}/locations/{location}/featurestores/{featurestore}.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this EntityType. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the EntityType. This value may be up to 60 characters, and valid characters are [a-z0-9_]. The first character cannot be a number. When `null`, the `name` field will be omitted from the resulting object.\n  - `monitoring_config` (`list[obj]`): The default monitoring configuration for all Features under this EntityType.\n\nIf this is populated with [FeaturestoreMonitoringConfig.monitoring_interval] specified, snapshot analysis monitoring is enabled. Otherwise, snapshot analysis monitoring is disabled. When `null`, the `monitoring_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore_entitytype.monitoring_config.new](#fn-monitoring_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore_entitytype.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_featurestore_entitytype` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.vertex_ai_featurestore_entitytype.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_featurestore_entitytype`\nTerraform resource.\n\nUnlike [google.vertex_ai_featurestore_entitytype.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Optional. Description of the EntityType. When `null`, the `description` field will be omitted from the resulting object.\n  - `featurestore` (`string`): The name of the Featurestore to use, in the format projects/{project}/locations/{location}/featurestores/{featurestore}.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this EntityType.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the EntityType. This value may be up to 60 characters, and valid characters are [a-z0-9_]. The first character cannot be a number. When `null`, the `name` field will be omitted from the resulting object.\n  - `monitoring_config` (`list[obj]`): The default monitoring configuration for all Features under this EntityType.\n\nIf this is populated with [FeaturestoreMonitoringConfig.monitoring_interval] specified, snapshot analysis monitoring is enabled. Otherwise, snapshot analysis monitoring is disabled. When `null`, the `monitoring_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore_entitytype.monitoring_config.new](#fn-monitoring_confignew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore_entitytype.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_featurestore_entitytype` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     featurestore,
     description=null,
diff --git a/4.x/_gen/resources/vertex_ai_featurestore_entitytype_feature.libsonnet b/4.x/_gen/resources/vertex_ai_featurestore_entitytype_feature.libsonnet
index b3c52eac..659610c6 100644
--- a/4.x/_gen/resources/vertex_ai_featurestore_entitytype_feature.libsonnet
+++ b/4.x/_gen/resources/vertex_ai_featurestore_entitytype_feature.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='vertex_ai_featurestore_entitytype_feature', url='', help='`vertex_ai_featurestore_entitytype_feature` represents the `google_vertex_ai_featurestore_entitytype_feature` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.vertex_ai_featurestore_entitytype_feature.new` injects a new `google_vertex_ai_featurestore_entitytype_feature` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_featurestore_entitytype_feature.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_featurestore_entitytype_feature` using the reference:\n\n    $._ref.google_vertex_ai_featurestore_entitytype_feature.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_featurestore_entitytype_feature.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Description of the feature. When `null`, the `description` field will be omitted from the resulting object.\n  - `entitytype` (`string`): The name of the Featurestore to use, in the format projects/{project}/locations/{location}/featurestores/{featurestore}/entityTypes/{entitytype}.\n  - `labels` (`obj`): A set of key/value label pairs to assign to the feature. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the feature. The feature can be up to 64 characters long and can consist only of ASCII Latin letters A-Z and a-z, underscore(_), and ASCII digits 0-9 starting with a letter. The value will be unique given an entity type. When `null`, the `name` field will be omitted from the resulting object.\n  - `value_type` (`string`): Type of Feature value. Immutable. https://cloud.google.com/vertex-ai/docs/reference/rest/v1/projects.locations.featurestores.entityTypes.features#ValueType\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore_entitytype_feature.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.vertex_ai_featurestore_entitytype_feature.new` injects a new `google_vertex_ai_featurestore_entitytype_feature` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_featurestore_entitytype_feature.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_featurestore_entitytype_feature` using the reference:\n\n    $._ref.google_vertex_ai_featurestore_entitytype_feature.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_featurestore_entitytype_feature.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Description of the feature. When `null`, the `description` field will be omitted from the resulting object.\n  - `entitytype` (`string`): The name of the Featurestore to use, in the format projects/{project}/locations/{location}/featurestores/{featurestore}/entityTypes/{entitytype}.\n  - `labels` (`obj`): A set of key/value label pairs to assign to the feature.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the feature. The feature can be up to 64 characters long and can consist only of ASCII Latin letters A-Z and a-z, underscore(_), and ASCII digits 0-9 starting with a letter. The value will be unique given an entity type. When `null`, the `name` field will be omitted from the resulting object.\n  - `value_type` (`string`): Type of Feature value. Immutable. https://cloud.google.com/vertex-ai/docs/reference/rest/v1/projects.locations.featurestores.entityTypes.features#ValueType\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore_entitytype_feature.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     entitytype,
@@ -25,7 +25,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.vertex_ai_featurestore_entitytype_feature.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_featurestore_entitytype_feature`\nTerraform resource.\n\nUnlike [google.vertex_ai_featurestore_entitytype_feature.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Description of the feature. When `null`, the `description` field will be omitted from the resulting object.\n  - `entitytype` (`string`): The name of the Featurestore to use, in the format projects/{project}/locations/{location}/featurestores/{featurestore}/entityTypes/{entitytype}.\n  - `labels` (`obj`): A set of key/value label pairs to assign to the feature. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the feature. The feature can be up to 64 characters long and can consist only of ASCII Latin letters A-Z and a-z, underscore(_), and ASCII digits 0-9 starting with a letter. The value will be unique given an entity type. When `null`, the `name` field will be omitted from the resulting object.\n  - `value_type` (`string`): Type of Feature value. Immutable. https://cloud.google.com/vertex-ai/docs/reference/rest/v1/projects.locations.featurestores.entityTypes.features#ValueType\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore_entitytype_feature.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_featurestore_entitytype_feature` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.vertex_ai_featurestore_entitytype_feature.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_featurestore_entitytype_feature`\nTerraform resource.\n\nUnlike [google.vertex_ai_featurestore_entitytype_feature.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Description of the feature. When `null`, the `description` field will be omitted from the resulting object.\n  - `entitytype` (`string`): The name of the Featurestore to use, in the format projects/{project}/locations/{location}/featurestores/{featurestore}/entityTypes/{entitytype}.\n  - `labels` (`obj`): A set of key/value label pairs to assign to the feature.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): The name of the feature. The feature can be up to 64 characters long and can consist only of ASCII Latin letters A-Z and a-z, underscore(_), and ASCII digits 0-9 starting with a letter. The value will be unique given an entity type. When `null`, the `name` field will be omitted from the resulting object.\n  - `value_type` (`string`): Type of Feature value. Immutable. https://cloud.google.com/vertex-ai/docs/reference/rest/v1/projects.locations.featurestores.entityTypes.features#ValueType\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore_entitytype_feature.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_featurestore_entitytype_feature` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     entitytype,
     value_type,
diff --git a/4.x/_gen/resources/vertex_ai_index.libsonnet b/4.x/_gen/resources/vertex_ai_index.libsonnet
index f3c83a5a..43cd73c5 100644
--- a/4.x/_gen/resources/vertex_ai_index.libsonnet
+++ b/4.x/_gen/resources/vertex_ai_index.libsonnet
@@ -47,10 +47,10 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
         shard_size: shard_size,
       }),
     },
-    '#new':: d.fn(help='\n`google.vertex_ai_index.metadata.new` constructs a new object with attributes and blocks configured for the `metadata`\nTerraform sub block.\n\n\n\n**Args**:\n  - `contents_delta_uri` (`string`): Allows inserting, updating  or deleting the contents of the Matching Engine Index.\nThe string must be a valid Cloud Storage directory path. If this\nfield is set when calling IndexService.UpdateIndex, then no other\nIndex field can be also updated as part of the same call.\nThe expected structure and format of the files this URI points to is\ndescribed at https://cloud.google.com/vertex-ai/docs/matching-engine/using-matching-engine#input-data-format When `null`, the `contents_delta_uri` field will be omitted from the resulting object.\n  - `is_complete_overwrite` (`bool`): If this field is set together with contentsDeltaUri when calling IndexService.UpdateIndex,\nthen existing content of the Index will be replaced by the data from the contentsDeltaUri. When `null`, the `is_complete_overwrite` field will be omitted from the resulting object.\n  - `config` (`list[obj]`): The configuration of the Matching Engine Index. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index.metadata.config.new](#fn-metadataconfignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `metadata` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`google.vertex_ai_index.metadata.new` constructs a new object with attributes and blocks configured for the `metadata`\nTerraform sub block.\n\n\n\n**Args**:\n  - `contents_delta_uri` (`string`): Allows inserting, updating  or deleting the contents of the Matching Engine Index.\nThe string must be a valid Cloud Storage directory path. If this\nfield is set when calling IndexService.UpdateIndex, then no other\nIndex field can be also updated as part of the same call.\nThe expected structure and format of the files this URI points to is\ndescribed at https://cloud.google.com/vertex-ai/docs/matching-engine/using-matching-engine#input-data-format\n  - `is_complete_overwrite` (`bool`): If this field is set together with contentsDeltaUri when calling IndexService.UpdateIndex,\nthen existing content of the Index will be replaced by the data from the contentsDeltaUri. When `null`, the `is_complete_overwrite` field will be omitted from the resulting object.\n  - `config` (`list[obj]`): The configuration of the Matching Engine Index. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index.metadata.config.new](#fn-metadataconfignew) constructor.\n\n**Returns**:\n  - An attribute object that represents the `metadata` sub block.\n', args=[]),
     new(
+      contents_delta_uri,
       config=null,
-      contents_delta_uri=null,
       is_complete_overwrite=null
     ):: std.prune(a={
       config: config,
@@ -58,7 +58,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       is_complete_overwrite: is_complete_overwrite,
     }),
   },
-  '#new':: d.fn(help="\n`google.vertex_ai_index.new` injects a new `google_vertex_ai_index` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_index.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_index` using the reference:\n\n    $._ref.google_vertex_ai_index.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_index.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): The description of the Index. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The display name of the Index. The name can be up to 128 characters long and can consist of any UTF-8 characters.\n  - `index_update_method` (`string`): The update method to use with this Index. The value must be the followings. If not set, BATCH_UPDATE will be used by default.\n* BATCH_UPDATE: user can call indexes.patch with files on Cloud Storage of datapoints to update.\n* STREAM_UPDATE: user can call indexes.upsertDatapoints/DeleteDatapoints to update the Index and the updates will be applied in corresponding DeployedIndexes in nearly real-time. When `null`, the `index_update_method` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your Indexes. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the index. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `metadata` (`list[obj]`): An additional information about the Index When `null`, the `metadata` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index.metadata.new](#fn-metadatanew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.vertex_ai_index.new` injects a new `google_vertex_ai_index` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_index.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_index` using the reference:\n\n    $._ref.google_vertex_ai_index.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_index.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): The description of the Index. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The display name of the Index. The name can be up to 128 characters long and can consist of any UTF-8 characters.\n  - `index_update_method` (`string`): The update method to use with this Index. The value must be the followings. If not set, BATCH_UPDATE will be used by default.\n* BATCH_UPDATE: user can call indexes.patch with files on Cloud Storage of datapoints to update.\n* STREAM_UPDATE: user can call indexes.upsertDatapoints/DeleteDatapoints to update the Index and the updates will be applied in corresponding DeployedIndexes in nearly real-time. When `null`, the `index_update_method` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your Indexes.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the index. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `metadata` (`list[obj]`): An additional information about the Index When `null`, the `metadata` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index.metadata.new](#fn-metadatanew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     display_name,
@@ -85,7 +85,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.vertex_ai_index.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_index`\nTerraform resource.\n\nUnlike [google.vertex_ai_index.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): The description of the Index. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The display name of the Index. The name can be up to 128 characters long and can consist of any UTF-8 characters.\n  - `index_update_method` (`string`): The update method to use with this Index. The value must be the followings. If not set, BATCH_UPDATE will be used by default.\n* BATCH_UPDATE: user can call indexes.patch with files on Cloud Storage of datapoints to update.\n* STREAM_UPDATE: user can call indexes.upsertDatapoints/DeleteDatapoints to update the Index and the updates will be applied in corresponding DeployedIndexes in nearly real-time. When `null`, the `index_update_method` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your Indexes. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the index. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `metadata` (`list[obj]`): An additional information about the Index When `null`, the `metadata` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index.metadata.new](#fn-metadatanew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_index` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.vertex_ai_index.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_index`\nTerraform resource.\n\nUnlike [google.vertex_ai_index.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): The description of the Index. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The display name of the Index. The name can be up to 128 characters long and can consist of any UTF-8 characters.\n  - `index_update_method` (`string`): The update method to use with this Index. The value must be the followings. If not set, BATCH_UPDATE will be used by default.\n* BATCH_UPDATE: user can call indexes.patch with files on Cloud Storage of datapoints to update.\n* STREAM_UPDATE: user can call indexes.upsertDatapoints/DeleteDatapoints to update the Index and the updates will be applied in corresponding DeployedIndexes in nearly real-time. When `null`, the `index_update_method` field will be omitted from the resulting object.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your Indexes.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the index. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `metadata` (`list[obj]`): An additional information about the Index When `null`, the `metadata` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index.metadata.new](#fn-metadatanew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_index` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     display_name,
     description=null,
diff --git a/4.x/_gen/resources/vertex_ai_index_endpoint.libsonnet b/4.x/_gen/resources/vertex_ai_index_endpoint.libsonnet
index 7fd896a1..986c7328 100644
--- a/4.x/_gen/resources/vertex_ai_index_endpoint.libsonnet
+++ b/4.x/_gen/resources/vertex_ai_index_endpoint.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='vertex_ai_index_endpoint', url='', help='`vertex_ai_index_endpoint` represents the `google_vertex_ai_index_endpoint` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.vertex_ai_index_endpoint.new` injects a new `google_vertex_ai_index_endpoint` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_index_endpoint.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_index_endpoint` using the reference:\n\n    $._ref.google_vertex_ai_index_endpoint.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_index_endpoint.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): The description of the Index. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The display name of the Index. The name can be up to 128 characters long and can consist of any UTF-8 characters.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your Indexes. When `null`, the `labels` field will be omitted from the resulting object.\n  - `network` (`string`): The full name of the Google Compute Engine [network](https://cloud.google.com//compute/docs/networks-and-firewalls#networks) to which the index endpoint should be peered.\nPrivate services access must already be configured for the network. If left unspecified, the index endpoint is not peered with any network.\n[Format](https://cloud.google.com/compute/docs/reference/rest/v1/networks/insert): \u0026#39;projects/{project}/global/networks/{network}\u0026#39;.\nWhere \u0026#39;{project}\u0026#39; is a project number, as in \u0026#39;12345\u0026#39;, and \u0026#39;{network}\u0026#39; is network name. When `null`, the `network` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_endpoint_enabled` (`bool`): If true, the deployed index will be accessible through public endpoint. When `null`, the `public_endpoint_enabled` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the index endpoint. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index_endpoint.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.vertex_ai_index_endpoint.new` injects a new `google_vertex_ai_index_endpoint` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_index_endpoint.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_index_endpoint` using the reference:\n\n    $._ref.google_vertex_ai_index_endpoint.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_index_endpoint.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): The description of the Index. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The display name of the Index. The name can be up to 128 characters long and can consist of any UTF-8 characters.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your Indexes.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `network` (`string`): The full name of the Google Compute Engine [network](https://cloud.google.com//compute/docs/networks-and-firewalls#networks) to which the index endpoint should be peered.\nPrivate services access must already be configured for the network. If left unspecified, the index endpoint is not peered with any network.\n[Format](https://cloud.google.com/compute/docs/reference/rest/v1/networks/insert): \u0026#39;projects/{project}/global/networks/{network}\u0026#39;.\nWhere \u0026#39;{project}\u0026#39; is a project number, as in \u0026#39;12345\u0026#39;, and \u0026#39;{network}\u0026#39; is network name. When `null`, the `network` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_endpoint_enabled` (`bool`): If true, the deployed index will be accessible through public endpoint. When `null`, the `public_endpoint_enabled` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the index endpoint. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index_endpoint.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     display_name,
@@ -29,7 +29,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.vertex_ai_index_endpoint.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_index_endpoint`\nTerraform resource.\n\nUnlike [google.vertex_ai_index_endpoint.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): The description of the Index. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The display name of the Index. The name can be up to 128 characters long and can consist of any UTF-8 characters.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your Indexes. When `null`, the `labels` field will be omitted from the resulting object.\n  - `network` (`string`): The full name of the Google Compute Engine [network](https://cloud.google.com//compute/docs/networks-and-firewalls#networks) to which the index endpoint should be peered.\nPrivate services access must already be configured for the network. If left unspecified, the index endpoint is not peered with any network.\n[Format](https://cloud.google.com/compute/docs/reference/rest/v1/networks/insert): 'projects/{project}/global/networks/{network}'.\nWhere '{project}' is a project number, as in '12345', and '{network}' is network name. When `null`, the `network` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_endpoint_enabled` (`bool`): If true, the deployed index will be accessible through public endpoint. When `null`, the `public_endpoint_enabled` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the index endpoint. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index_endpoint.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_index_endpoint` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.vertex_ai_index_endpoint.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_index_endpoint`\nTerraform resource.\n\nUnlike [google.vertex_ai_index_endpoint.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): The description of the Index. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): The display name of the Index. The name can be up to 128 characters long and can consist of any UTF-8 characters.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your Indexes.\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `network` (`string`): The full name of the Google Compute Engine [network](https://cloud.google.com//compute/docs/networks-and-firewalls#networks) to which the index endpoint should be peered.\nPrivate services access must already be configured for the network. If left unspecified, the index endpoint is not peered with any network.\n[Format](https://cloud.google.com/compute/docs/reference/rest/v1/networks/insert): 'projects/{project}/global/networks/{network}'.\nWhere '{project}' is a project number, as in '12345', and '{network}' is network name. When `null`, the `network` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `public_endpoint_enabled` (`bool`): If true, the deployed index will be accessible through public endpoint. When `null`, the `public_endpoint_enabled` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the index endpoint. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index_endpoint.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_index_endpoint` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     display_name,
     description=null,
diff --git a/4.x/_gen/resources/vertex_ai_tensorboard.libsonnet b/4.x/_gen/resources/vertex_ai_tensorboard.libsonnet
index d33ddb68..b6c42701 100644
--- a/4.x/_gen/resources/vertex_ai_tensorboard.libsonnet
+++ b/4.x/_gen/resources/vertex_ai_tensorboard.libsonnet
@@ -10,7 +10,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       kms_key_name: kms_key_name,
     }),
   },
-  '#new':: d.fn(help="\n`google.vertex_ai_tensorboard.new` injects a new `google_vertex_ai_tensorboard` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_tensorboard.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_tensorboard` using the reference:\n\n    $._ref.google_vertex_ai_tensorboard.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_tensorboard.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Description of this Tensorboard. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User provided name of this Tensorboard.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your Tensorboards. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the tensorboard. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `encryption_spec` (`list[obj]`): Customer-managed encryption key spec for a Tensorboard. If set, this Tensorboard and all sub-resources of this Tensorboard will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_tensorboard.encryption_spec.new](#fn-encryption_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_tensorboard.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.vertex_ai_tensorboard.new` injects a new `google_vertex_ai_tensorboard` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.vertex_ai_tensorboard.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.vertex_ai_tensorboard` using the reference:\n\n    $._ref.google_vertex_ai_tensorboard.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_vertex_ai_tensorboard.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `description` (`string`): Description of this Tensorboard. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User provided name of this Tensorboard.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your Tensorboards.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the tensorboard. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `encryption_spec` (`list[obj]`): Customer-managed encryption key spec for a Tensorboard. If set, this Tensorboard and all sub-resources of this Tensorboard will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_tensorboard.encryption_spec.new](#fn-encryption_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_tensorboard.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     display_name,
@@ -35,7 +35,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.vertex_ai_tensorboard.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_tensorboard`\nTerraform resource.\n\nUnlike [google.vertex_ai_tensorboard.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Description of this Tensorboard. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User provided name of this Tensorboard.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your Tensorboards. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the tensorboard. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `encryption_spec` (`list[obj]`): Customer-managed encryption key spec for a Tensorboard. If set, this Tensorboard and all sub-resources of this Tensorboard will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_tensorboard.encryption_spec.new](#fn-encryption_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_tensorboard.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_tensorboard` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.vertex_ai_tensorboard.newAttrs` constructs a new object with attributes and blocks configured for the `vertex_ai_tensorboard`\nTerraform resource.\n\nUnlike [google.vertex_ai_tensorboard.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `description` (`string`): Description of this Tensorboard. When `null`, the `description` field will be omitted from the resulting object.\n  - `display_name` (`string`): User provided name of this Tensorboard.\n  - `labels` (`obj`): The labels with user-defined metadata to organize your Tensorboards.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the tensorboard. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.\n  - `encryption_spec` (`list[obj]`): Customer-managed encryption key spec for a Tensorboard. If set, this Tensorboard and all sub-resources of this Tensorboard will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_tensorboard.encryption_spec.new](#fn-encryption_specnew) constructor.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_tensorboard.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `vertex_ai_tensorboard` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     display_name,
     description=null,
diff --git a/4.x/_gen/resources/workflows_workflow.libsonnet b/4.x/_gen/resources/workflows_workflow.libsonnet
index 9faaae1e..29e03e7f 100644
--- a/4.x/_gen/resources/workflows_workflow.libsonnet
+++ b/4.x/_gen/resources/workflows_workflow.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='workflows_workflow', url='', help='`workflows_workflow` represents the `google_workflows_workflow` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`google.workflows_workflow.new` injects a new `google_workflows_workflow` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.workflows_workflow.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.workflows_workflow` using the reference:\n\n    $._ref.google_workflows_workflow.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_workflows_workflow.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `crypto_key_name` (`string`): The KMS key used to encrypt workflow and execution data.\n\nFormat: projects/{project}/locations/{location}/keyRings/{keyRing}/cryptoKeys/{cryptoKey} When `null`, the `crypto_key_name` field will be omitted from the resulting object.\n  - `description` (`string`): Description of the workflow provided by the user. Must be at most 1000 unicode characters long. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Workflow. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the Workflow. When `null`, the `name` field will be omitted from the resulting object.\n  - `name_prefix` (`string`): Set the `name_prefix` field on the resulting resource block. When `null`, the `name_prefix` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the workflow. When `null`, the `region` field will be omitted from the resulting object.\n  - `service_account` (`string`): Name of the service account associated with the latest workflow version. This service\naccount represents the identity of the workflow and determines what permissions the workflow has.\nFormat: projects/{project}/serviceAccounts/{account} or {account}.\nUsing - as a wildcard for the {project} or not providing one at all will infer the project from the account.\nThe {account} value can be the email address or the unique_id of the service account.\nIf not provided, workflow will use the project\u0026#39;s default service account.\nModifying this field for an existing workflow results in a new workflow revision. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `source_contents` (`string`): Workflow code to be executed. The size limit is 32KB. When `null`, the `source_contents` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workflows_workflow.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`google.workflows_workflow.new` injects a new `google_workflows_workflow` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    google.workflows_workflow.new('some_id')\n\nYou can get the reference to the `id` field of the created `google.workflows_workflow` using the reference:\n\n    $._ref.google_workflows_workflow.some_id.get('id')\n\nThis is the same as directly entering `\"${ google_workflows_workflow.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `crypto_key_name` (`string`): The KMS key used to encrypt workflow and execution data.\n\nFormat: projects/{project}/locations/{location}/keyRings/{keyRing}/cryptoKeys/{cryptoKey} When `null`, the `crypto_key_name` field will be omitted from the resulting object.\n  - `description` (`string`): Description of the workflow provided by the user. Must be at most 1000 unicode characters long. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Workflow.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field \u0026#39;effective_labels\u0026#39; for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the Workflow. When `null`, the `name` field will be omitted from the resulting object.\n  - `name_prefix` (`string`): Set the `name_prefix` field on the resulting resource block. When `null`, the `name_prefix` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the workflow. When `null`, the `region` field will be omitted from the resulting object.\n  - `service_account` (`string`): Name of the service account associated with the latest workflow version. This service\naccount represents the identity of the workflow and determines what permissions the workflow has.\nFormat: projects/{project}/serviceAccounts/{account} or {account}.\nUsing - as a wildcard for the {project} or not providing one at all will infer the project from the account.\nThe {account} value can be the email address or the unique_id of the service account.\nIf not provided, workflow will use the project\u0026#39;s default service account.\nModifying this field for an existing workflow results in a new workflow revision. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `source_contents` (`string`): Workflow code to be executed. The size limit is 32KB. When `null`, the `source_contents` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workflows_workflow.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     crypto_key_name=null,
@@ -33,7 +33,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`google.workflows_workflow.newAttrs` constructs a new object with attributes and blocks configured for the `workflows_workflow`\nTerraform resource.\n\nUnlike [google.workflows_workflow.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `crypto_key_name` (`string`): The KMS key used to encrypt workflow and execution data.\n\nFormat: projects/{project}/locations/{location}/keyRings/{keyRing}/cryptoKeys/{cryptoKey} When `null`, the `crypto_key_name` field will be omitted from the resulting object.\n  - `description` (`string`): Description of the workflow provided by the user. Must be at most 1000 unicode characters long. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Workflow. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the Workflow. When `null`, the `name` field will be omitted from the resulting object.\n  - `name_prefix` (`string`): Set the `name_prefix` field on the resulting object. When `null`, the `name_prefix` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the workflow. When `null`, the `region` field will be omitted from the resulting object.\n  - `service_account` (`string`): Name of the service account associated with the latest workflow version. This service\naccount represents the identity of the workflow and determines what permissions the workflow has.\nFormat: projects/{project}/serviceAccounts/{account} or {account}.\nUsing - as a wildcard for the {project} or not providing one at all will infer the project from the account.\nThe {account} value can be the email address or the unique_id of the service account.\nIf not provided, workflow will use the project's default service account.\nModifying this field for an existing workflow results in a new workflow revision. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `source_contents` (`string`): Workflow code to be executed. The size limit is 32KB. When `null`, the `source_contents` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workflows_workflow.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `workflows_workflow` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`google.workflows_workflow.newAttrs` constructs a new object with attributes and blocks configured for the `workflows_workflow`\nTerraform resource.\n\nUnlike [google.workflows_workflow.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `crypto_key_name` (`string`): The KMS key used to encrypt workflow and execution data.\n\nFormat: projects/{project}/locations/{location}/keyRings/{keyRing}/cryptoKeys/{cryptoKey} When `null`, the `crypto_key_name` field will be omitted from the resulting object.\n  - `description` (`string`): Description of the workflow provided by the user. Must be at most 1000 unicode characters long. When `null`, the `description` field will be omitted from the resulting object.\n  - `labels` (`obj`): A set of key/value label pairs to assign to this Workflow.\n\n\n**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.\nPlease refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the Workflow. When `null`, the `name` field will be omitted from the resulting object.\n  - `name_prefix` (`string`): Set the `name_prefix` field on the resulting object. When `null`, the `name_prefix` field will be omitted from the resulting object.\n  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.\n  - `region` (`string`): The region of the workflow. When `null`, the `region` field will be omitted from the resulting object.\n  - `service_account` (`string`): Name of the service account associated with the latest workflow version. This service\naccount represents the identity of the workflow and determines what permissions the workflow has.\nFormat: projects/{project}/serviceAccounts/{account} or {account}.\nUsing - as a wildcard for the {project} or not providing one at all will infer the project from the account.\nThe {account} value can be the email address or the unique_id of the service account.\nIf not provided, workflow will use the project's default service account.\nModifying this field for an existing workflow results in a new workflow revision. When `null`, the `service_account` field will be omitted from the resulting object.\n  - `source_contents` (`string`): Workflow code to be executed. The size limit is 32KB. When `null`, the `source_contents` field will be omitted from the resulting object.\n  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.workflows_workflow.timeouts.new](#fn-timeoutsnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `workflows_workflow` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     crypto_key_name=null,
     description=null,
diff --git a/docs/4.x/README.md b/docs/4.x/README.md
index d451320c..bc5a5af1 100644
--- a/docs/4.x/README.md
+++ b/docs/4.x/README.md
@@ -32,6 +32,7 @@ project.
 * [alloydb_backup](alloydb_backup.md)
 * [alloydb_cluster](alloydb_cluster.md)
 * [alloydb_instance](alloydb_instance.md)
+* [alloydb_user](alloydb_user.md)
 * [apigee_addons_config](apigee_addons_config.md)
 * [apigee_endpoint_attachment](apigee_endpoint_attachment.md)
 * [apigee_env_keystore](apigee_env_keystore.md)
@@ -175,11 +176,6 @@ project.
 * [cloudfunctions_function_iam_binding](cloudfunctions_function_iam_binding.md)
 * [cloudfunctions_function_iam_member](cloudfunctions_function_iam_member.md)
 * [cloudfunctions_function_iam_policy](cloudfunctions_function_iam_policy.md)
-* [cloudiot_device](cloudiot_device.md)
-* [cloudiot_registry](cloudiot_registry.md)
-* [cloudiot_registry_iam_binding](cloudiot_registry_iam_binding.md)
-* [cloudiot_registry_iam_member](cloudiot_registry_iam_member.md)
-* [cloudiot_registry_iam_policy](cloudiot_registry_iam_policy.md)
 * [composer_environment](composer_environment.md)
 * [compute_address](compute_address.md)
 * [compute_attached_disk](compute_attached_disk.md)
@@ -337,6 +333,7 @@ project.
 * [data_loss_prevention_stored_info_type](data_loss_prevention_stored_info_type.md)
 * [data_pipeline_pipeline](data_pipeline_pipeline.md)
 * [database_migration_service_connection_profile](database_migration_service_connection_profile.md)
+* [database_migration_service_private_connection](database_migration_service_private_connection.md)
 * [dataflow_job](dataflow_job.md)
 * [dataplex_asset](dataplex_asset.md)
 * [dataplex_asset_iam_binding](dataplex_asset_iam_binding.md)
@@ -406,6 +403,9 @@ project.
 * [document_ai_processor_default_version](document_ai_processor_default_version.md)
 * [document_ai_warehouse_document_schema](document_ai_warehouse_document_schema.md)
 * [document_ai_warehouse_location](document_ai_warehouse_location.md)
+* [edgecontainer_cluster](edgecontainer_cluster.md)
+* [edgecontainer_node_pool](edgecontainer_node_pool.md)
+* [edgecontainer_vpn_connection](edgecontainer_vpn_connection.md)
 * [edgenetwork_network](edgenetwork_network.md)
 * [edgenetwork_subnet](edgenetwork_subnet.md)
 * [endpoints_service](endpoints_service.md)
@@ -424,6 +424,7 @@ project.
 * [filestore_snapshot](filestore_snapshot.md)
 * [firebaserules_release](firebaserules_release.md)
 * [firebaserules_ruleset](firebaserules_ruleset.md)
+* [firestore_backup_schedule](firestore_backup_schedule.md)
 * [firestore_database](firestore_database.md)
 * [firestore_document](firestore_document.md)
 * [firestore_field](firestore_field.md)
@@ -435,11 +436,6 @@ project.
 * [folder_iam_member](folder_iam_member.md)
 * [folder_iam_policy](folder_iam_policy.md)
 * [folder_organization_policy](folder_organization_policy.md)
-* [game_services_game_server_cluster](game_services_game_server_cluster.md)
-* [game_services_game_server_config](game_services_game_server_config.md)
-* [game_services_game_server_deployment](game_services_game_server_deployment.md)
-* [game_services_game_server_deployment_rollout](game_services_game_server_deployment_rollout.md)
-* [game_services_realm](game_services_realm.md)
 * [gke_backup_backup_plan](gke_backup_backup_plan.md)
 * [gke_backup_backup_plan_iam_binding](gke_backup_backup_plan_iam_binding.md)
 * [gke_backup_backup_plan_iam_member](gke_backup_backup_plan_iam_member.md)
@@ -453,6 +449,7 @@ project.
 * [gke_hub_feature_iam_member](gke_hub_feature_iam_member.md)
 * [gke_hub_feature_iam_policy](gke_hub_feature_iam_policy.md)
 * [gke_hub_feature_membership](gke_hub_feature_membership.md)
+* [gke_hub_fleet](gke_hub_fleet.md)
 * [gke_hub_membership](gke_hub_membership.md)
 * [gke_hub_membership_binding](gke_hub_membership_binding.md)
 * [gke_hub_membership_iam_binding](gke_hub_membership_iam_binding.md)
@@ -464,6 +461,11 @@ project.
 * [gke_hub_scope_iam_member](gke_hub_scope_iam_member.md)
 * [gke_hub_scope_iam_policy](gke_hub_scope_iam_policy.md)
 * [gke_hub_scope_rbac_role_binding](gke_hub_scope_rbac_role_binding.md)
+* [gkeonprem_bare_metal_admin_cluster](gkeonprem_bare_metal_admin_cluster.md)
+* [gkeonprem_bare_metal_cluster](gkeonprem_bare_metal_cluster.md)
+* [gkeonprem_bare_metal_node_pool](gkeonprem_bare_metal_node_pool.md)
+* [gkeonprem_vmware_cluster](gkeonprem_vmware_cluster.md)
+* [gkeonprem_vmware_node_pool](gkeonprem_vmware_node_pool.md)
 * [healthcare_consent_store](healthcare_consent_store.md)
 * [healthcare_consent_store_iam_binding](healthcare_consent_store_iam_binding.md)
 * [healthcare_consent_store_iam_member](healthcare_consent_store_iam_member.md)
@@ -568,6 +570,7 @@ project.
 * [monitoring_slo](monitoring_slo.md)
 * [monitoring_uptime_check_config](monitoring_uptime_check_config.md)
 * [network_connectivity_hub](network_connectivity_hub.md)
+* [network_connectivity_policy_based_route](network_connectivity_policy_based_route.md)
 * [network_connectivity_service_connection_policy](network_connectivity_service_connection_policy.md)
 * [network_connectivity_spoke](network_connectivity_spoke.md)
 * [network_management_connectivity_test](network_management_connectivity_test.md)
@@ -589,6 +592,7 @@ project.
 * [notebooks_runtime_iam_binding](notebooks_runtime_iam_binding.md)
 * [notebooks_runtime_iam_member](notebooks_runtime_iam_member.md)
 * [notebooks_runtime_iam_policy](notebooks_runtime_iam_policy.md)
+* [org_policy_custom_constraint](org_policy_custom_constraint.md)
 * [org_policy_policy](org_policy_policy.md)
 * [organization_access_approval_settings](organization_access_approval_settings.md)
 * [organization_iam_audit_config](organization_iam_audit_config.md)
@@ -627,6 +631,9 @@ project.
 * [pubsub_lite_subscription](pubsub_lite_subscription.md)
 * [pubsub_lite_topic](pubsub_lite_topic.md)
 * [pubsub_schema](pubsub_schema.md)
+* [pubsub_schema_iam_binding](pubsub_schema_iam_binding.md)
+* [pubsub_schema_iam_member](pubsub_schema_iam_member.md)
+* [pubsub_schema_iam_policy](pubsub_schema_iam_policy.md)
 * [pubsub_subscription](pubsub_subscription.md)
 * [pubsub_subscription_iam_binding](pubsub_subscription_iam_binding.md)
 * [pubsub_subscription_iam_member](pubsub_subscription_iam_member.md)
@@ -636,10 +643,13 @@ project.
 * [pubsub_topic_iam_member](pubsub_topic_iam_member.md)
 * [pubsub_topic_iam_policy](pubsub_topic_iam_policy.md)
 * [recaptcha_enterprise_key](recaptcha_enterprise_key.md)
+* [redis_cluster](redis_cluster.md)
 * [redis_instance](redis_instance.md)
 * [resource_manager_lien](resource_manager_lien.md)
+* [scc_folder_custom_module](scc_folder_custom_module.md)
 * [scc_mute_config](scc_mute_config.md)
 * [scc_notification_config](scc_notification_config.md)
+* [scc_organization_custom_module](scc_organization_custom_module.md)
 * [scc_project_custom_module](scc_project_custom_module.md)
 * [scc_source](scc_source.md)
 * [scc_source_iam_binding](scc_source_iam_binding.md)
diff --git a/docs/4.x/access_context_manager_access_level.md b/docs/4.x/access_context_manager_access_level.md
index cdb5dda9..e6012799 100644
--- a/docs/4.x/access_context_manager_access_level.md
+++ b/docs/4.x/access_context_manager_access_level.md
@@ -33,6 +33,10 @@ This package contains functions and utilities for setting up the resource using
       * [`fn new()`](#fn-basicconditionsdevice_policynew)
       * [`obj basic.conditions.device_policy.os_constraints`](#obj-basicconditionsdevice_policyos_constraints)
         * [`fn new()`](#fn-basicconditionsdevice_policyos_constraintsnew)
+    * [`obj basic.conditions.vpc_network_sources`](#obj-basicconditionsvpc_network_sources)
+      * [`fn new()`](#fn-basicconditionsvpc_network_sourcesnew)
+      * [`obj basic.conditions.vpc_network_sources.vpc_subnetwork`](#obj-basicconditionsvpc_network_sourcesvpc_subnetwork)
+        * [`fn new()`](#fn-basicconditionsvpc_network_sourcesvpc_subnetworknew)
 * [`obj custom`](#obj-custom)
   * [`fn new()`](#fn-customnew)
   * [`obj custom.expr`](#obj-customexpr)
@@ -370,6 +374,7 @@ Format: accessPolicies/{policy_id}/accessLevels/{short_name} When `null`, the `r
   - `device_policy` (`list[obj]`): Device specific restrictions, all restrictions must hold for
 the Condition to be true. If not specified, all devices are
 allowed. When `null`, the `device_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level.basic.conditions.device_policy.new](#fn-basicbasicdevice_policynew) constructor.
+  - `vpc_network_sources` (`list[obj]`): The request must originate from one of the provided VPC networks in Google Cloud. Cannot specify this field together with 'ip_subnetworks'. When `null`, the `vpc_network_sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level.basic.conditions.vpc_network_sources.new](#fn-basicbasicvpc_network_sourcesnew) constructor.
 
 **Returns**:
   - An attribute object that represents the `conditions` sub block.
@@ -434,6 +439,53 @@ Format: "major.minor.patch" such as "10.5.301", "9.2.1".
   - An attribute object that represents the `os_constraints` sub block.
 
 
+## obj basic.conditions.vpc_network_sources
+
+
+
+### fn basic.conditions.vpc_network_sources.new
+
+```ts
+new()
+```
+
+
+`google.access_context_manager_access_level.basic.conditions.vpc_network_sources.new` constructs a new object with attributes and blocks configured for the `vpc_network_sources`
+Terraform sub block.
+
+
+
+**Args**:
+  - `vpc_subnetwork` (`list[obj]`): Sub networks within a VPC network. When `null`, the `vpc_subnetwork` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level.basic.conditions.vpc_network_sources.vpc_subnetwork.new](#fn-basicbasicconditionsvpc_subnetworknew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `vpc_network_sources` sub block.
+
+
+## obj basic.conditions.vpc_network_sources.vpc_subnetwork
+
+
+
+### fn basic.conditions.vpc_network_sources.vpc_subnetwork.new
+
+```ts
+new()
+```
+
+
+`google.access_context_manager_access_level.basic.conditions.vpc_network_sources.vpc_subnetwork.new` constructs a new object with attributes and blocks configured for the `vpc_subnetwork`
+Terraform sub block.
+
+
+
+**Args**:
+  - `network` (`string`): Required. Network name to be allowed by this Access Level. Networks of foreign organizations requires 'compute.network.get' permission to be granted to caller.
+  - `vpc_ip_subnetworks` (`list`): CIDR block IP subnetwork specification. Must be IPv4. When `null`, the `vpc_ip_subnetworks` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `vpc_subnetwork` sub block.
+
+
 ## obj custom
 
 
diff --git a/docs/4.x/access_context_manager_access_level_condition.md b/docs/4.x/access_context_manager_access_level_condition.md
index e448f1ba..1d79e5fd 100644
--- a/docs/4.x/access_context_manager_access_level_condition.md
+++ b/docs/4.x/access_context_manager_access_level_condition.md
@@ -25,12 +25,18 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withRequiredAccessLevels()`](#fn-withrequiredaccesslevels)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withVpcNetworkSources()`](#fn-withvpcnetworksources)
+* [`fn withVpcNetworkSourcesMixin()`](#fn-withvpcnetworksourcesmixin)
 * [`obj device_policy`](#obj-device_policy)
   * [`fn new()`](#fn-device_policynew)
   * [`obj device_policy.os_constraints`](#obj-device_policyos_constraints)
     * [`fn new()`](#fn-device_policyos_constraintsnew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
+* [`obj vpc_network_sources`](#obj-vpc_network_sources)
+  * [`fn new()`](#fn-vpc_network_sourcesnew)
+  * [`obj vpc_network_sources.vpc_subnetwork`](#obj-vpc_network_sourcesvpc_subnetwork)
+    * [`fn new()`](#fn-vpc_network_sourcesvpc_subnetworknew)
 
 ## Fields
 
@@ -95,6 +101,7 @@ Format: accessPolicies/{policy_id}/accessLevels/{short_name} When `null`, the `r
 the Condition to be true. If not specified, all devices are
 allowed. When `null`, the `device_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.device_policy.new](#fn-device_policynew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.timeouts.new](#fn-timeoutsnew) constructor.
+  - `vpc_network_sources` (`list[obj]`): The request must originate from one of the provided VPC networks in Google Cloud. Cannot specify this field together with 'ip_subnetworks'. When `null`, the `vpc_network_sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.vpc_network_sources.new](#fn-vpc_network_sourcesnew) constructor.
 
 **Returns**:
 - A mixin object that injects the new resource into the root Terraform configuration.
@@ -152,6 +159,7 @@ Format: accessPolicies/{policy_id}/accessLevels/{short_name} When `null`, the `r
 the Condition to be true. If not specified, all devices are
 allowed. When `null`, the `device_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.device_policy.new](#fn-device_policynew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.timeouts.new](#fn-timeoutsnew) constructor.
+  - `vpc_network_sources` (`list[obj]`): The request must originate from one of the provided VPC networks in Google Cloud. Cannot specify this field together with 'ip_subnetworks'. When `null`, the `vpc_network_sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.vpc_network_sources.new](#fn-vpc_network_sourcesnew) constructor.
 
 **Returns**:
   - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `access_context_manager_access_level_condition` resource into the root Terraform configuration.
@@ -326,6 +334,43 @@ function.
   - `value` (`obj`): The value to set for the `timeouts` field.
 
 
+### fn withVpcNetworkSources
+
+```ts
+withVpcNetworkSources()
+```
+
+`google.list[obj].withVpcNetworkSources` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the vpc_network_sources field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withVpcNetworkSourcesMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `vpc_network_sources` field.
+
+
+### fn withVpcNetworkSourcesMixin
+
+```ts
+withVpcNetworkSourcesMixin()
+```
+
+`google.list[obj].withVpcNetworkSourcesMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the vpc_network_sources field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withVpcNetworkSources](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `vpc_network_sources` field.
+
+
 ## obj device_policy
 
 
@@ -406,3 +451,50 @@ Terraform sub block.
 
 **Returns**:
   - An attribute object that represents the `timeouts` sub block.
+
+
+## obj vpc_network_sources
+
+
+
+### fn vpc_network_sources.new
+
+```ts
+new()
+```
+
+
+`google.access_context_manager_access_level_condition.vpc_network_sources.new` constructs a new object with attributes and blocks configured for the `vpc_network_sources`
+Terraform sub block.
+
+
+
+**Args**:
+  - `vpc_subnetwork` (`list[obj]`): Sub networks within a VPC network. When `null`, the `vpc_subnetwork` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_level_condition.vpc_network_sources.vpc_subnetwork.new](#fn-vpc_network_sourcesvpc_subnetworknew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `vpc_network_sources` sub block.
+
+
+## obj vpc_network_sources.vpc_subnetwork
+
+
+
+### fn vpc_network_sources.vpc_subnetwork.new
+
+```ts
+new()
+```
+
+
+`google.access_context_manager_access_level_condition.vpc_network_sources.vpc_subnetwork.new` constructs a new object with attributes and blocks configured for the `vpc_subnetwork`
+Terraform sub block.
+
+
+
+**Args**:
+  - `network` (`string`): Required. Network name to be allowed by this Access Level. Networks of foreign organizations requires 'compute.network.get' permission to be granted to caller.
+  - `vpc_ip_subnetworks` (`list`): CIDR block IP subnetwork specification. Must be IPv4. When `null`, the `vpc_ip_subnetworks` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `vpc_subnetwork` sub block.
diff --git a/docs/4.x/access_context_manager_access_levels.md b/docs/4.x/access_context_manager_access_levels.md
index 19d08f34..671106cd 100644
--- a/docs/4.x/access_context_manager_access_levels.md
+++ b/docs/4.x/access_context_manager_access_levels.md
@@ -30,6 +30,10 @@ This package contains functions and utilities for setting up the resource using
         * [`fn new()`](#fn-access_levelsbasicconditionsdevice_policynew)
         * [`obj access_levels.basic.conditions.device_policy.os_constraints`](#obj-access_levelsbasicconditionsdevice_policyos_constraints)
           * [`fn new()`](#fn-access_levelsbasicconditionsdevice_policyos_constraintsnew)
+      * [`obj access_levels.basic.conditions.vpc_network_sources`](#obj-access_levelsbasicconditionsvpc_network_sources)
+        * [`fn new()`](#fn-access_levelsbasicconditionsvpc_network_sourcesnew)
+        * [`obj access_levels.basic.conditions.vpc_network_sources.vpc_subnetwork`](#obj-access_levelsbasicconditionsvpc_network_sourcesvpc_subnetwork)
+          * [`fn new()`](#fn-access_levelsbasicconditionsvpc_network_sourcesvpc_subnetworknew)
   * [`obj access_levels.custom`](#obj-access_levelscustom)
     * [`fn new()`](#fn-access_levelscustomnew)
     * [`obj access_levels.custom.expr`](#obj-access_levelscustomexpr)
@@ -298,6 +302,7 @@ Format: accessPolicies/{policy_id}/accessLevels/{short_name} When `null`, the `r
   - `device_policy` (`list[obj]`): Device specific restrictions, all restrictions must hold for
 the Condition to be true. If not specified, all devices are
 allowed. When `null`, the `device_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_levels.access_levels.basic.conditions.device_policy.new](#fn-access_levelsaccess_levelsbasicdevice_policynew) constructor.
+  - `vpc_network_sources` (`list[obj]`): The request must originate from one of the provided VPC networks in Google Cloud. Cannot specify this field together with 'ip_subnetworks'. When `null`, the `vpc_network_sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_levels.access_levels.basic.conditions.vpc_network_sources.new](#fn-access_levelsaccess_levelsbasicvpc_network_sourcesnew) constructor.
 
 **Returns**:
   - An attribute object that represents the `conditions` sub block.
@@ -361,6 +366,53 @@ Format: "major.minor.patch" such as "10.5.301", "9.2.1".
   - An attribute object that represents the `os_constraints` sub block.
 
 
+## obj access_levels.basic.conditions.vpc_network_sources
+
+
+
+### fn access_levels.basic.conditions.vpc_network_sources.new
+
+```ts
+new()
+```
+
+
+`google.access_context_manager_access_levels.access_levels.basic.conditions.vpc_network_sources.new` constructs a new object with attributes and blocks configured for the `vpc_network_sources`
+Terraform sub block.
+
+
+
+**Args**:
+  - `vpc_subnetwork` (`list[obj]`): Sub networks within a VPC network. When `null`, the `vpc_subnetwork` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_access_levels.access_levels.basic.conditions.vpc_network_sources.vpc_subnetwork.new](#fn-access_levelsaccess_levelsbasicconditionsvpc_subnetworknew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `vpc_network_sources` sub block.
+
+
+## obj access_levels.basic.conditions.vpc_network_sources.vpc_subnetwork
+
+
+
+### fn access_levels.basic.conditions.vpc_network_sources.vpc_subnetwork.new
+
+```ts
+new()
+```
+
+
+`google.access_context_manager_access_levels.access_levels.basic.conditions.vpc_network_sources.vpc_subnetwork.new` constructs a new object with attributes and blocks configured for the `vpc_subnetwork`
+Terraform sub block.
+
+
+
+**Args**:
+  - `network` (`string`): Required. Network name to be allowed by this Access Level. Networks of foreign organizations requires 'compute.network.get' permission to be granted to caller.
+  - `vpc_ip_subnetworks` (`list`): CIDR block IP subnetwork specification. Must be IPv4. When `null`, the `vpc_ip_subnetworks` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `vpc_subnetwork` sub block.
+
+
 ## obj access_levels.custom
 
 
diff --git a/docs/4.x/access_context_manager_service_perimeter.md b/docs/4.x/access_context_manager_service_perimeter.md
index 84806e69..b89eb75d 100644
--- a/docs/4.x/access_context_manager_service_perimeter.md
+++ b/docs/4.x/access_context_manager_service_perimeter.md
@@ -33,6 +33,8 @@ This package contains functions and utilities for setting up the resource using
     * [`fn new()`](#fn-specegress_policiesnew)
     * [`obj spec.egress_policies.egress_from`](#obj-specegress_policiesegress_from)
       * [`fn new()`](#fn-specegress_policiesegress_fromnew)
+      * [`obj spec.egress_policies.egress_from.sources`](#obj-specegress_policiesegress_fromsources)
+        * [`fn new()`](#fn-specegress_policiesegress_fromsourcesnew)
     * [`obj spec.egress_policies.egress_to`](#obj-specegress_policiesegress_to)
       * [`fn new()`](#fn-specegress_policiesegress_tonew)
       * [`obj spec.egress_policies.egress_to.operations`](#obj-specegress_policiesegress_tooperations)
@@ -59,6 +61,8 @@ This package contains functions and utilities for setting up the resource using
     * [`fn new()`](#fn-statusegress_policiesnew)
     * [`obj status.egress_policies.egress_from`](#obj-statusegress_policiesegress_from)
       * [`fn new()`](#fn-statusegress_policiesegress_fromnew)
+      * [`obj status.egress_policies.egress_from.sources`](#obj-statusegress_policiesegress_fromsources)
+        * [`fn new()`](#fn-statusegress_policiesegress_fromsourcesnew)
     * [`obj status.egress_policies.egress_to`](#obj-statusegress_policiesegress_to)
       * [`fn new()`](#fn-statusegress_policiesegress_tonew)
       * [`obj status.egress_policies.egress_to.operations`](#obj-statusegress_policiesegress_tooperations)
@@ -525,11 +529,36 @@ represent individual user or service account only. When `null`, the `identities`
   - `identity_type` (`string`): Specifies the type of identities that are allowed access to outside the
 perimeter. If left unspecified, then members of 'identities' field will
 be allowed access. Possible values: ["IDENTITY_TYPE_UNSPECIFIED", "ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"] When `null`, the `identity_type` field will be omitted from the resulting object.
+  - `source_restriction` (`string`): Whether to enforce traffic restrictions based on 'sources' field. If the 'sources' field is non-empty, then this field must be set to 'SOURCE_RESTRICTION_ENABLED'. Possible values: ["SOURCE_RESTRICTION_UNSPECIFIED", "SOURCE_RESTRICTION_ENABLED", "SOURCE_RESTRICTION_DISABLED"] When `null`, the `source_restriction` field will be omitted from the resulting object.
+  - `sources` (`list[obj]`): Sources that this EgressPolicy authorizes access from. When `null`, the `sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter.spec.egress_policies.egress_from.sources.new](#fn-specspecegress_policiessourcesnew) constructor.
 
 **Returns**:
   - An attribute object that represents the `egress_from` sub block.
 
 
+## obj spec.egress_policies.egress_from.sources
+
+
+
+### fn spec.egress_policies.egress_from.sources.new
+
+```ts
+new()
+```
+
+
+`google.access_context_manager_service_perimeter.spec.egress_policies.egress_from.sources.new` constructs a new object with attributes and blocks configured for the `sources`
+Terraform sub block.
+
+
+
+**Args**:
+  - `access_level` (`string`): An AccessLevel resource name that allows resources outside the ServicePerimeter to be accessed from the inside. When `null`, the `access_level` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `sources` sub block.
+
+
 ## obj spec.egress_policies.egress_to
 
 
@@ -921,11 +950,36 @@ represent individual user or service account only. When `null`, the `identities`
   - `identity_type` (`string`): Specifies the type of identities that are allowed access to outside the
 perimeter. If left unspecified, then members of 'identities' field will
 be allowed access. Possible values: ["IDENTITY_TYPE_UNSPECIFIED", "ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"] When `null`, the `identity_type` field will be omitted from the resulting object.
+  - `source_restriction` (`string`): Whether to enforce traffic restrictions based on 'sources' field. If the 'sources' field is non-empty, then this field must be set to 'SOURCE_RESTRICTION_ENABLED'. Possible values: ["SOURCE_RESTRICTION_UNSPECIFIED", "SOURCE_RESTRICTION_ENABLED", "SOURCE_RESTRICTION_DISABLED"] When `null`, the `source_restriction` field will be omitted from the resulting object.
+  - `sources` (`list[obj]`): Sources that this EgressPolicy authorizes access from. When `null`, the `sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter.status.egress_policies.egress_from.sources.new](#fn-statusstatusegress_policiessourcesnew) constructor.
 
 **Returns**:
   - An attribute object that represents the `egress_from` sub block.
 
 
+## obj status.egress_policies.egress_from.sources
+
+
+
+### fn status.egress_policies.egress_from.sources.new
+
+```ts
+new()
+```
+
+
+`google.access_context_manager_service_perimeter.status.egress_policies.egress_from.sources.new` constructs a new object with attributes and blocks configured for the `sources`
+Terraform sub block.
+
+
+
+**Args**:
+  - `access_level` (`string`): An AccessLevel resource name that allows resources outside the ServicePerimeter to be accessed from the inside. When `null`, the `access_level` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `sources` sub block.
+
+
 ## obj status.egress_policies.egress_to
 
 
diff --git a/docs/4.x/access_context_manager_service_perimeter_egress_policy.md b/docs/4.x/access_context_manager_service_perimeter_egress_policy.md
index b77be377..ab94bad1 100644
--- a/docs/4.x/access_context_manager_service_perimeter_egress_policy.md
+++ b/docs/4.x/access_context_manager_service_perimeter_egress_policy.md
@@ -24,6 +24,8 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
 * [`obj egress_from`](#obj-egress_from)
   * [`fn new()`](#fn-egress_fromnew)
+  * [`obj egress_from.sources`](#obj-egress_fromsources)
+    * [`fn new()`](#fn-egress_fromsourcesnew)
 * [`obj egress_to`](#obj-egress_to)
   * [`fn new()`](#fn-egress_tonew)
   * [`obj egress_to.operations`](#obj-egress_tooperations)
@@ -249,11 +251,36 @@ represent individual user or service account only. When `null`, the `identities`
   - `identity_type` (`string`): Specifies the type of identities that are allowed access to outside the
 perimeter. If left unspecified, then members of 'identities' field will
 be allowed access. Possible values: ["ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"] When `null`, the `identity_type` field will be omitted from the resulting object.
+  - `source_restriction` (`string`): Whether to enforce traffic restrictions based on 'sources' field. If the 'sources' field is non-empty, then this field must be set to 'SOURCE_RESTRICTION_ENABLED'. Possible values: ["SOURCE_RESTRICTION_UNSPECIFIED", "SOURCE_RESTRICTION_ENABLED", "SOURCE_RESTRICTION_DISABLED"] When `null`, the `source_restriction` field will be omitted from the resulting object.
+  - `sources` (`list[obj]`): Sources that this EgressPolicy authorizes access from. When `null`, the `sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeter_egress_policy.egress_from.sources.new](#fn-egress_fromsourcesnew) constructor.
 
 **Returns**:
   - An attribute object that represents the `egress_from` sub block.
 
 
+## obj egress_from.sources
+
+
+
+### fn egress_from.sources.new
+
+```ts
+new()
+```
+
+
+`google.access_context_manager_service_perimeter_egress_policy.egress_from.sources.new` constructs a new object with attributes and blocks configured for the `sources`
+Terraform sub block.
+
+
+
+**Args**:
+  - `access_level` (`string`): An AccessLevel resource name that allows resources outside the ServicePerimeter to be accessed from the inside. When `null`, the `access_level` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `sources` sub block.
+
+
 ## obj egress_to
 
 
diff --git a/docs/4.x/access_context_manager_service_perimeters.md b/docs/4.x/access_context_manager_service_perimeters.md
index cf5750db..0412fe41 100644
--- a/docs/4.x/access_context_manager_service_perimeters.md
+++ b/docs/4.x/access_context_manager_service_perimeters.md
@@ -28,6 +28,8 @@ This package contains functions and utilities for setting up the resource using
       * [`fn new()`](#fn-service_perimetersspecegress_policiesnew)
       * [`obj service_perimeters.spec.egress_policies.egress_from`](#obj-service_perimetersspecegress_policiesegress_from)
         * [`fn new()`](#fn-service_perimetersspecegress_policiesegress_fromnew)
+        * [`obj service_perimeters.spec.egress_policies.egress_from.sources`](#obj-service_perimetersspecegress_policiesegress_fromsources)
+          * [`fn new()`](#fn-service_perimetersspecegress_policiesegress_fromsourcesnew)
       * [`obj service_perimeters.spec.egress_policies.egress_to`](#obj-service_perimetersspecegress_policiesegress_to)
         * [`fn new()`](#fn-service_perimetersspecegress_policiesegress_tonew)
         * [`obj service_perimeters.spec.egress_policies.egress_to.operations`](#obj-service_perimetersspecegress_policiesegress_tooperations)
@@ -54,6 +56,8 @@ This package contains functions and utilities for setting up the resource using
       * [`fn new()`](#fn-service_perimetersstatusegress_policiesnew)
       * [`obj service_perimeters.status.egress_policies.egress_from`](#obj-service_perimetersstatusegress_policiesegress_from)
         * [`fn new()`](#fn-service_perimetersstatusegress_policiesegress_fromnew)
+        * [`obj service_perimeters.status.egress_policies.egress_from.sources`](#obj-service_perimetersstatusegress_policiesegress_fromsources)
+          * [`fn new()`](#fn-service_perimetersstatusegress_policiesegress_fromsourcesnew)
       * [`obj service_perimeters.status.egress_policies.egress_to`](#obj-service_perimetersstatusegress_policiesegress_to)
         * [`fn new()`](#fn-service_perimetersstatusegress_policiesegress_tonew)
         * [`obj service_perimeters.status.egress_policies.egress_to.operations`](#obj-service_perimetersstatusegress_policiesegress_tooperations)
@@ -389,11 +393,36 @@ represent individual user or service account only. When `null`, the `identities`
   - `identity_type` (`string`): Specifies the type of identities that are allowed access to outside the
 perimeter. If left unspecified, then members of 'identities' field will
 be allowed access. Possible values: ["IDENTITY_TYPE_UNSPECIFIED", "ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"] When `null`, the `identity_type` field will be omitted from the resulting object.
+  - `source_restriction` (`string`): Whether to enforce traffic restrictions based on 'sources' field. If the 'sources' field is non-empty, then this field must be set to 'SOURCE_RESTRICTION_ENABLED'. Possible values: ["SOURCE_RESTRICTION_UNSPECIFIED", "SOURCE_RESTRICTION_ENABLED", "SOURCE_RESTRICTION_DISABLED"] When `null`, the `source_restriction` field will be omitted from the resulting object.
+  - `sources` (`list[obj]`): Sources that this EgressPolicy authorizes access from. When `null`, the `sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeters.service_perimeters.spec.egress_policies.egress_from.sources.new](#fn-service_perimetersservice_perimetersspecegress_policiessourcesnew) constructor.
 
 **Returns**:
   - An attribute object that represents the `egress_from` sub block.
 
 
+## obj service_perimeters.spec.egress_policies.egress_from.sources
+
+
+
+### fn service_perimeters.spec.egress_policies.egress_from.sources.new
+
+```ts
+new()
+```
+
+
+`google.access_context_manager_service_perimeters.service_perimeters.spec.egress_policies.egress_from.sources.new` constructs a new object with attributes and blocks configured for the `sources`
+Terraform sub block.
+
+
+
+**Args**:
+  - `access_level` (`string`): An AccessLevel resource name that allows resources outside the ServicePerimeter to be accessed from the inside. When `null`, the `access_level` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `sources` sub block.
+
+
 ## obj service_perimeters.spec.egress_policies.egress_to
 
 
@@ -785,11 +814,36 @@ represent individual user or service account only. When `null`, the `identities`
   - `identity_type` (`string`): Specifies the type of identities that are allowed access to outside the
 perimeter. If left unspecified, then members of 'identities' field will
 be allowed access. Possible values: ["IDENTITY_TYPE_UNSPECIFIED", "ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"] When `null`, the `identity_type` field will be omitted from the resulting object.
+  - `source_restriction` (`string`): Whether to enforce traffic restrictions based on 'sources' field. If the 'sources' field is non-empty, then this field must be set to 'SOURCE_RESTRICTION_ENABLED'. Possible values: ["SOURCE_RESTRICTION_UNSPECIFIED", "SOURCE_RESTRICTION_ENABLED", "SOURCE_RESTRICTION_DISABLED"] When `null`, the `source_restriction` field will be omitted from the resulting object.
+  - `sources` (`list[obj]`): Sources that this EgressPolicy authorizes access from. When `null`, the `sources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.access_context_manager_service_perimeters.service_perimeters.status.egress_policies.egress_from.sources.new](#fn-service_perimetersservice_perimetersstatusegress_policiessourcesnew) constructor.
 
 **Returns**:
   - An attribute object that represents the `egress_from` sub block.
 
 
+## obj service_perimeters.status.egress_policies.egress_from.sources
+
+
+
+### fn service_perimeters.status.egress_policies.egress_from.sources.new
+
+```ts
+new()
+```
+
+
+`google.access_context_manager_service_perimeters.service_perimeters.status.egress_policies.egress_from.sources.new` constructs a new object with attributes and blocks configured for the `sources`
+Terraform sub block.
+
+
+
+**Args**:
+  - `access_level` (`string`): An AccessLevel resource name that allows resources outside the ServicePerimeter to be accessed from the inside. When `null`, the `access_level` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `sources` sub block.
+
+
 ## obj service_perimeters.status.egress_policies.egress_to
 
 
diff --git a/docs/4.x/active_directory_domain.md b/docs/4.x/active_directory_domain.md
index 7c7e947f..21f2a6ad 100644
--- a/docs/4.x/active_directory_domain.md
+++ b/docs/4.x/active_directory_domain.md
@@ -62,7 +62,10 @@ If not specified, setupadmin will be used. When `null`, the `admin` field will b
 If CIDR subnets overlap between networks, domain creation will fail. When `null`, the `authorized_networks` field will be omitted from the resulting object.
   - `domain_name` (`string`): The fully qualified domain name. e.g. mydomain.myorganization.com, with the restrictions,
 https://cloud.google.com/managed-microsoft-ad/reference/rest/v1/projects.locations.global.domains.
-  - `labels` (`obj`): Resource labels that can contain user-provided metadata When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels that can contain user-provided metadata
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `locations` (`list`): Locations where domain needs to be provisioned. [regions][compute/docs/regions-zones/]
 e.g. us-west1 or us-east4 Service supports up to 4 locations at once. Each location will use a /26 block.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
@@ -98,7 +101,10 @@ If not specified, setupadmin will be used. When `null`, the `admin` field will b
 If CIDR subnets overlap between networks, domain creation will fail. When `null`, the `authorized_networks` field will be omitted from the resulting object.
   - `domain_name` (`string`): The fully qualified domain name. e.g. mydomain.myorganization.com, with the restrictions,
 https://cloud.google.com/managed-microsoft-ad/reference/rest/v1/projects.locations.global.domains.
-  - `labels` (`obj`): Resource labels that can contain user-provided metadata When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels that can contain user-provided metadata
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `locations` (`list`): Locations where domain needs to be provisioned. [regions][compute/docs/regions-zones/]
 e.g. us-west1 or us-east4 Service supports up to 4 locations at once. Each location will use a /26 block.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
diff --git a/docs/4.x/alloydb_backup.md b/docs/4.x/alloydb_backup.md
index 2a2ea6f2..24fc2034 100644
--- a/docs/4.x/alloydb_backup.md
+++ b/docs/4.x/alloydb_backup.md
@@ -15,9 +15,11 @@ This package contains functions and utilities for setting up the resource using
 
 * [`fn new()`](#fn-new)
 * [`fn newAttrs()`](#fn-newattrs)
+* [`fn withAnnotations()`](#fn-withannotations)
 * [`fn withBackupId()`](#fn-withbackupid)
 * [`fn withClusterName()`](#fn-withclustername)
 * [`fn withDescription()`](#fn-withdescription)
+* [`fn withDisplayName()`](#fn-withdisplayname)
 * [`fn withEncryptionConfig()`](#fn-withencryptionconfig)
 * [`fn withEncryptionConfigMixin()`](#fn-withencryptionconfigmixin)
 * [`fn withLabels()`](#fn-withlabels)
@@ -25,6 +27,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withProject()`](#fn-withproject)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withType()`](#fn-withtype)
 * [`obj encryption_config`](#obj-encryption_config)
   * [`fn new()`](#fn-encryption_confignew)
 * [`obj timeouts`](#obj-timeouts)
@@ -59,12 +62,24 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
+  - `annotations` (`obj`): Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels. https://google.aip.dev/128
+An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `backup_id` (`string`): The ID of the alloydb backup.
   - `cluster_name` (`string`): The full resource name of the backup source cluster (e.g., projects/{project}/locations/{location}/clusters/{clusterId}).
   - `description` (`string`): User-provided description of the backup. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): User-defined labels for the alloydb backup. When `null`, the `labels` field will be omitted from the resulting object.
+  - `display_name` (`string`): User-settable and human-readable display name for the Backup. When `null`, the `display_name` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels for the alloydb backup. An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location where the alloydb backup should reside.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `type` (`string`): The backup type, which suggests the trigger for the backup. Possible values: ["TYPE_UNSPECIFIED", "ON_DEMAND", "AUTOMATED", "CONTINUOUS"] When `null`, the `type` field will be omitted from the resulting object.
   - `encryption_config` (`list[obj]`): EncryptionConfig describes the encryption config of a cluster or a backup that is encrypted with a CMEK (customer-managed encryption key). When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_backup.encryption_config.new](#fn-encryption_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_backup.timeouts.new](#fn-timeoutsnew) constructor.
 
@@ -90,12 +105,24 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
+  - `annotations` (`obj`): Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels. https://google.aip.dev/128
+An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `backup_id` (`string`): The ID of the alloydb backup.
   - `cluster_name` (`string`): The full resource name of the backup source cluster (e.g., projects/{project}/locations/{location}/clusters/{clusterId}).
   - `description` (`string`): User-provided description of the backup. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): User-defined labels for the alloydb backup. When `null`, the `labels` field will be omitted from the resulting object.
+  - `display_name` (`string`): User-settable and human-readable display name for the Backup. When `null`, the `display_name` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels for the alloydb backup. An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location where the alloydb backup should reside.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `type` (`string`): The backup type, which suggests the trigger for the backup. Possible values: ["TYPE_UNSPECIFIED", "ON_DEMAND", "AUTOMATED", "CONTINUOUS"] When `null`, the `type` field will be omitted from the resulting object.
   - `encryption_config` (`list[obj]`): EncryptionConfig describes the encryption config of a cluster or a backup that is encrypted with a CMEK (customer-managed encryption key). When `null`, the `encryption_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_backup.encryption_config.new](#fn-encryption_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_backup.timeouts.new](#fn-timeoutsnew) constructor.
 
@@ -103,6 +130,22 @@ injecting into a complete block.
   - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `alloydb_backup` resource into the root Terraform configuration.
 
 
+### fn withAnnotations
+
+```ts
+withAnnotations()
+```
+
+`google.obj.withAnnotations` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the annotations field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `annotations` field.
+
+
 ### fn withBackupId
 
 ```ts
@@ -151,6 +194,22 @@ Terraform resource block to set or update the description field.
   - `value` (`string`): The value to set for the `description` field.
 
 
+### fn withDisplayName
+
+```ts
+withDisplayName()
+```
+
+`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the display_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `display_name` field.
+
+
 ### fn withEncryptionConfig
 
 ```ts
@@ -272,6 +331,22 @@ function.
   - `value` (`obj`): The value to set for the `timeouts` field.
 
 
+### fn withType
+
+```ts
+withType()
+```
+
+`google.string.withType` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the type field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `type` field.
+
+
 ## obj encryption_config
 
 
diff --git a/docs/4.x/alloydb_cluster.md b/docs/4.x/alloydb_cluster.md
index 2a95eca2..f221e4c1 100644
--- a/docs/4.x/alloydb_cluster.md
+++ b/docs/4.x/alloydb_cluster.md
@@ -15,14 +15,18 @@ This package contains functions and utilities for setting up the resource using
 
 * [`fn new()`](#fn-new)
 * [`fn newAttrs()`](#fn-newattrs)
+* [`fn withAnnotations()`](#fn-withannotations)
 * [`fn withAutomatedBackupPolicy()`](#fn-withautomatedbackuppolicy)
 * [`fn withAutomatedBackupPolicyMixin()`](#fn-withautomatedbackuppolicymixin)
 * [`fn withClusterId()`](#fn-withclusterid)
+* [`fn withClusterType()`](#fn-withclustertype)
 * [`fn withContinuousBackupConfig()`](#fn-withcontinuousbackupconfig)
 * [`fn withContinuousBackupConfigMixin()`](#fn-withcontinuousbackupconfigmixin)
+* [`fn withDeletionPolicy()`](#fn-withdeletionpolicy)
 * [`fn withDisplayName()`](#fn-withdisplayname)
 * [`fn withEncryptionConfig()`](#fn-withencryptionconfig)
 * [`fn withEncryptionConfigMixin()`](#fn-withencryptionconfigmixin)
+* [`fn withEtag()`](#fn-withetag)
 * [`fn withInitialUser()`](#fn-withinitialuser)
 * [`fn withInitialUserMixin()`](#fn-withinitialusermixin)
 * [`fn withLabels()`](#fn-withlabels)
@@ -35,6 +39,8 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withRestoreBackupSourceMixin()`](#fn-withrestorebackupsourcemixin)
 * [`fn withRestoreContinuousBackupSource()`](#fn-withrestorecontinuousbackupsource)
 * [`fn withRestoreContinuousBackupSourceMixin()`](#fn-withrestorecontinuousbackupsourcemixin)
+* [`fn withSecondaryConfig()`](#fn-withsecondaryconfig)
+* [`fn withSecondaryConfigMixin()`](#fn-withsecondaryconfigmixin)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
 * [`obj automated_backup_policy`](#obj-automated_backup_policy)
@@ -63,6 +69,8 @@ This package contains functions and utilities for setting up the resource using
   * [`fn new()`](#fn-restore_backup_sourcenew)
 * [`obj restore_continuous_backup_source`](#obj-restore_continuous_backup_source)
   * [`fn new()`](#fn-restore_continuous_backup_sourcenew)
+* [`obj secondary_config`](#obj-secondary_config)
+  * [`fn new()`](#fn-secondary_confignew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 
@@ -95,9 +103,23 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
+  - `annotations` (`obj`): Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels. https://google.aip.dev/128
+An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `cluster_id` (`string`): The ID of the alloydb cluster.
+  - `cluster_type` (`string`): The type of cluster. If not set, defaults to PRIMARY. Default value: "PRIMARY" Possible values: ["PRIMARY", "SECONDARY"] When `null`, the `cluster_type` field will be omitted from the resulting object.
+  - `deletion_policy` (`string`): Policy to determine if the cluster should be deleted forcefully.
+Deleting a cluster forcefully, deletes the cluster and all its associated instances within the cluster.
+Deleting a Secondary cluster with a secondary instance REQUIRES setting deletion_policy = "FORCE" otherwise an error is returned. This is needed as there is no support to delete just the secondary instance, and the only way to delete secondary instance is to delete the associated secondary cluster forcefully which also deletes the secondary instance. When `null`, the `deletion_policy` field will be omitted from the resulting object.
   - `display_name` (`string`): User-settable and human-readable display name for the Cluster. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): User-defined labels for the alloydb cluster. When `null`, the `labels` field will be omitted from the resulting object.
+  - `etag` (`string`): For Resource freshness validation (https://google.aip.dev/154) When `null`, the `etag` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels for the alloydb cluster.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location where the alloydb cluster should reside.
   - `network` (`string`): The relative resource name of the VPC network on which the instance can be accessed. It is specified in the following form:
 
@@ -112,6 +134,7 @@ If no policy is provided then the default policy will be used. The default polic
   - `network_config` (`list[obj]`): Metadata related to network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.network_config.new](#fn-network_confignew) constructor.
   - `restore_backup_source` (`list[obj]`): The source when restoring from a backup. Conflicts with 'restore_continuous_backup_source', both can't be set together. When `null`, the `restore_backup_source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.restore_backup_source.new](#fn-restore_backup_sourcenew) constructor.
   - `restore_continuous_backup_source` (`list[obj]`): The source when restoring via point in time recovery (PITR). Conflicts with 'restore_backup_source', both can't be set together. When `null`, the `restore_continuous_backup_source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.restore_continuous_backup_source.new](#fn-restore_continuous_backup_sourcenew) constructor.
+  - `secondary_config` (`list[obj]`): Configuration of the secondary cluster for Cross Region Replication. This should be set if and only if the cluster is of type SECONDARY. When `null`, the `secondary_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.secondary_config.new](#fn-secondary_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -136,9 +159,23 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
+  - `annotations` (`obj`): Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels. https://google.aip.dev/128
+An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `cluster_id` (`string`): The ID of the alloydb cluster.
+  - `cluster_type` (`string`): The type of cluster. If not set, defaults to PRIMARY. Default value: "PRIMARY" Possible values: ["PRIMARY", "SECONDARY"] When `null`, the `cluster_type` field will be omitted from the resulting object.
+  - `deletion_policy` (`string`): Policy to determine if the cluster should be deleted forcefully.
+Deleting a cluster forcefully, deletes the cluster and all its associated instances within the cluster.
+Deleting a Secondary cluster with a secondary instance REQUIRES setting deletion_policy = "FORCE" otherwise an error is returned. This is needed as there is no support to delete just the secondary instance, and the only way to delete secondary instance is to delete the associated secondary cluster forcefully which also deletes the secondary instance. When `null`, the `deletion_policy` field will be omitted from the resulting object.
   - `display_name` (`string`): User-settable and human-readable display name for the Cluster. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): User-defined labels for the alloydb cluster. When `null`, the `labels` field will be omitted from the resulting object.
+  - `etag` (`string`): For Resource freshness validation (https://google.aip.dev/154) When `null`, the `etag` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels for the alloydb cluster.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location where the alloydb cluster should reside.
   - `network` (`string`): The relative resource name of the VPC network on which the instance can be accessed. It is specified in the following form:
 
@@ -153,12 +190,29 @@ If no policy is provided then the default policy will be used. The default polic
   - `network_config` (`list[obj]`): Metadata related to network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.network_config.new](#fn-network_confignew) constructor.
   - `restore_backup_source` (`list[obj]`): The source when restoring from a backup. Conflicts with 'restore_continuous_backup_source', both can't be set together. When `null`, the `restore_backup_source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.restore_backup_source.new](#fn-restore_backup_sourcenew) constructor.
   - `restore_continuous_backup_source` (`list[obj]`): The source when restoring via point in time recovery (PITR). Conflicts with 'restore_backup_source', both can't be set together. When `null`, the `restore_continuous_backup_source` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.restore_continuous_backup_source.new](#fn-restore_continuous_backup_sourcenew) constructor.
+  - `secondary_config` (`list[obj]`): Configuration of the secondary cluster for Cross Region Replication. This should be set if and only if the cluster is of type SECONDARY. When `null`, the `secondary_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.secondary_config.new](#fn-secondary_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_cluster.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
   - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `alloydb_cluster` resource into the root Terraform configuration.
 
 
+### fn withAnnotations
+
+```ts
+withAnnotations()
+```
+
+`google.obj.withAnnotations` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the annotations field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `annotations` field.
+
+
 ### fn withAutomatedBackupPolicy
 
 ```ts
@@ -212,6 +266,22 @@ Terraform resource block to set or update the cluster_id field.
   - `value` (`string`): The value to set for the `cluster_id` field.
 
 
+### fn withClusterType
+
+```ts
+withClusterType()
+```
+
+`google.string.withClusterType` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the cluster_type field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `cluster_type` field.
+
+
 ### fn withContinuousBackupConfig
 
 ```ts
@@ -249,6 +319,22 @@ function.
   - `value` (`list[obj]`): The value to set for the `continuous_backup_config` field.
 
 
+### fn withDeletionPolicy
+
+```ts
+withDeletionPolicy()
+```
+
+`google.string.withDeletionPolicy` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the deletion_policy field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `deletion_policy` field.
+
+
 ### fn withDisplayName
 
 ```ts
@@ -302,6 +388,22 @@ function.
   - `value` (`list[obj]`): The value to set for the `encryption_config` field.
 
 
+### fn withEtag
+
+```ts
+withEtag()
+```
+
+`google.string.withEtag` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the etag field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `etag` field.
+
+
 ### fn withInitialUser
 
 ```ts
@@ -514,6 +616,43 @@ function.
   - `value` (`list[obj]`): The value to set for the `restore_continuous_backup_source` field.
 
 
+### fn withSecondaryConfig
+
+```ts
+withSecondaryConfig()
+```
+
+`google.list[obj].withSecondaryConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the secondary_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withSecondaryConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `secondary_config` field.
+
+
+### fn withSecondaryConfigMixin
+
+```ts
+withSecondaryConfigMixin()
+```
+
+`google.list[obj].withSecondaryConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the secondary_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withSecondaryConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `secondary_config` field.
+
+
 ### fn withTimeouts
 
 ```ts
@@ -874,6 +1013,30 @@ Terraform sub block.
   - An attribute object that represents the `restore_continuous_backup_source` sub block.
 
 
+## obj secondary_config
+
+
+
+### fn secondary_config.new
+
+```ts
+new()
+```
+
+
+`google.alloydb_cluster.secondary_config.new` constructs a new object with attributes and blocks configured for the `secondary_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `primary_cluster_name` (`string`): Name of the primary cluster must be in the format
+'projects/{project}/locations/{location}/clusters/{cluster_id}'
+
+**Returns**:
+  - An attribute object that represents the `secondary_config` sub block.
+
+
 ## obj timeouts
 
 
diff --git a/docs/4.x/alloydb_instance.md b/docs/4.x/alloydb_instance.md
index 7dcca7c6..a5faa829 100644
--- a/docs/4.x/alloydb_instance.md
+++ b/docs/4.x/alloydb_instance.md
@@ -17,6 +17,8 @@ This package contains functions and utilities for setting up the resource using
 * [`fn newAttrs()`](#fn-newattrs)
 * [`fn withAnnotations()`](#fn-withannotations)
 * [`fn withAvailabilityType()`](#fn-withavailabilitytype)
+* [`fn withClientConnectionConfig()`](#fn-withclientconnectionconfig)
+* [`fn withClientConnectionConfigMixin()`](#fn-withclientconnectionconfigmixin)
 * [`fn withCluster()`](#fn-withcluster)
 * [`fn withDatabaseFlags()`](#fn-withdatabaseflags)
 * [`fn withDisplayName()`](#fn-withdisplayname)
@@ -26,12 +28,20 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withLabels()`](#fn-withlabels)
 * [`fn withMachineConfig()`](#fn-withmachineconfig)
 * [`fn withMachineConfigMixin()`](#fn-withmachineconfigmixin)
+* [`fn withQueryInsightsConfig()`](#fn-withqueryinsightsconfig)
+* [`fn withQueryInsightsConfigMixin()`](#fn-withqueryinsightsconfigmixin)
 * [`fn withReadPoolConfig()`](#fn-withreadpoolconfig)
 * [`fn withReadPoolConfigMixin()`](#fn-withreadpoolconfigmixin)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj client_connection_config`](#obj-client_connection_config)
+  * [`fn new()`](#fn-client_connection_confignew)
+  * [`obj client_connection_config.ssl_config`](#obj-client_connection_configssl_config)
+    * [`fn new()`](#fn-client_connection_configssl_confignew)
 * [`obj machine_config`](#obj-machine_config)
   * [`fn new()`](#fn-machine_confignew)
+* [`obj query_insights_config`](#obj-query_insights_config)
+  * [`fn new()`](#fn-query_insights_confignew)
 * [`obj read_pool_config`](#obj-read_pool_config)
   * [`fn new()`](#fn-read_pool_confignew)
 * [`obj timeouts`](#obj-timeouts)
@@ -66,7 +76,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `annotations` (`obj`): Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `availability_type` (`string`): 'Availability type of an Instance. Defaults to REGIONAL for both primary and read instances.
 Note that primary and read instances can have different availability types.
 Only READ_POOL instance supports ZONAL type. Users can't specify the zone for READ_POOL instance.
@@ -79,9 +92,20 @@ can have regional availability (nodes are present in 2 or more zones in a region
   - `display_name` (`string`): User-settable and human-readable display name for the Instance. When `null`, the `display_name` field will be omitted from the resulting object.
   - `gce_zone` (`string`): The Compute Engine zone that the instance should serve from, per https://cloud.google.com/compute/docs/regions-zones This can ONLY be specified for ZONAL instances. If present for a REGIONAL instance, an error will be thrown. If this is absent for a ZONAL instance, instance is created in a random zone with available capacity. When `null`, the `gce_zone` field will be omitted from the resulting object.
   - `instance_id` (`string`): The ID of the alloydb instance.
-  - `instance_type` (`string`): The type of the instance. If the instance type is READ_POOL, provide the associated PRIMARY instance in the 'depends_on' meta-data attribute. Possible values: ["PRIMARY", "READ_POOL"]
-  - `labels` (`obj`): User-defined labels for the alloydb instance. When `null`, the `labels` field will be omitted from the resulting object.
+  - `instance_type` (`string`): The type of the instance.
+If the instance type is READ_POOL, provide the associated PRIMARY/SECONDARY instance in the 'depends_on' meta-data attribute.
+If the instance type is SECONDARY, point to the cluster_type of the associated secondary cluster instead of mentioning SECONDARY.
+Example: {instance_type = google_alloydb_cluster.<secondary_cluster_name>.cluster_type} instead of {instance_type = SECONDARY}
+If the instance type is SECONDARY, the terraform delete instance operation does not delete the secondary instance but abandons it instead.
+Use deletion_policy = "FORCE" in the associated secondary cluster and delete the cluster forcefully to delete the secondary cluster as well its associated secondary instance.
+Users can undo the delete secondary instance action by importing the deleted secondary instance by calling terraform import. Possible values: ["PRIMARY", "READ_POOL", "SECONDARY"]
+  - `labels` (`obj`): User-defined labels for the alloydb instance.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `client_connection_config` (`list[obj]`): Client connection specific configurations. When `null`, the `client_connection_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.client_connection_config.new](#fn-client_connection_confignew) constructor.
   - `machine_config` (`list[obj]`): Configurations for the machines that host the underlying database engine. When `null`, the `machine_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.machine_config.new](#fn-machine_confignew) constructor.
+  - `query_insights_config` (`list[obj]`): Configuration for query insights. When `null`, the `query_insights_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.query_insights_config.new](#fn-query_insights_confignew) constructor.
   - `read_pool_config` (`list[obj]`): Read pool specific config. If the instance type is READ_POOL, this configuration must be provided. When `null`, the `read_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.read_pool_config.new](#fn-read_pool_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.timeouts.new](#fn-timeoutsnew) constructor.
 
@@ -107,7 +131,10 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `annotations` (`obj`): Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `availability_type` (`string`): 'Availability type of an Instance. Defaults to REGIONAL for both primary and read instances.
 Note that primary and read instances can have different availability types.
 Only READ_POOL instance supports ZONAL type. Users can't specify the zone for READ_POOL instance.
@@ -120,9 +147,20 @@ can have regional availability (nodes are present in 2 or more zones in a region
   - `display_name` (`string`): User-settable and human-readable display name for the Instance. When `null`, the `display_name` field will be omitted from the resulting object.
   - `gce_zone` (`string`): The Compute Engine zone that the instance should serve from, per https://cloud.google.com/compute/docs/regions-zones This can ONLY be specified for ZONAL instances. If present for a REGIONAL instance, an error will be thrown. If this is absent for a ZONAL instance, instance is created in a random zone with available capacity. When `null`, the `gce_zone` field will be omitted from the resulting object.
   - `instance_id` (`string`): The ID of the alloydb instance.
-  - `instance_type` (`string`): The type of the instance. If the instance type is READ_POOL, provide the associated PRIMARY instance in the 'depends_on' meta-data attribute. Possible values: ["PRIMARY", "READ_POOL"]
-  - `labels` (`obj`): User-defined labels for the alloydb instance. When `null`, the `labels` field will be omitted from the resulting object.
+  - `instance_type` (`string`): The type of the instance.
+If the instance type is READ_POOL, provide the associated PRIMARY/SECONDARY instance in the 'depends_on' meta-data attribute.
+If the instance type is SECONDARY, point to the cluster_type of the associated secondary cluster instead of mentioning SECONDARY.
+Example: {instance_type = google_alloydb_cluster.<secondary_cluster_name>.cluster_type} instead of {instance_type = SECONDARY}
+If the instance type is SECONDARY, the terraform delete instance operation does not delete the secondary instance but abandons it instead.
+Use deletion_policy = "FORCE" in the associated secondary cluster and delete the cluster forcefully to delete the secondary cluster as well its associated secondary instance.
+Users can undo the delete secondary instance action by importing the deleted secondary instance by calling terraform import. Possible values: ["PRIMARY", "READ_POOL", "SECONDARY"]
+  - `labels` (`obj`): User-defined labels for the alloydb instance.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `client_connection_config` (`list[obj]`): Client connection specific configurations. When `null`, the `client_connection_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.client_connection_config.new](#fn-client_connection_confignew) constructor.
   - `machine_config` (`list[obj]`): Configurations for the machines that host the underlying database engine. When `null`, the `machine_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.machine_config.new](#fn-machine_confignew) constructor.
+  - `query_insights_config` (`list[obj]`): Configuration for query insights. When `null`, the `query_insights_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.query_insights_config.new](#fn-query_insights_confignew) constructor.
   - `read_pool_config` (`list[obj]`): Read pool specific config. If the instance type is READ_POOL, this configuration must be provided. When `null`, the `read_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.read_pool_config.new](#fn-read_pool_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.timeouts.new](#fn-timeoutsnew) constructor.
 
@@ -162,6 +200,43 @@ Terraform resource block to set or update the availability_type field.
   - `value` (`string`): The value to set for the `availability_type` field.
 
 
+### fn withClientConnectionConfig
+
+```ts
+withClientConnectionConfig()
+```
+
+`google.list[obj].withClientConnectionConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the client_connection_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withClientConnectionConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `client_connection_config` field.
+
+
+### fn withClientConnectionConfigMixin
+
+```ts
+withClientConnectionConfigMixin()
+```
+
+`google.list[obj].withClientConnectionConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the client_connection_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withClientConnectionConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `client_connection_config` field.
+
+
 ### fn withCluster
 
 ```ts
@@ -311,6 +386,43 @@ function.
   - `value` (`list[obj]`): The value to set for the `machine_config` field.
 
 
+### fn withQueryInsightsConfig
+
+```ts
+withQueryInsightsConfig()
+```
+
+`google.list[obj].withQueryInsightsConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the query_insights_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withQueryInsightsConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `query_insights_config` field.
+
+
+### fn withQueryInsightsConfigMixin
+
+```ts
+withQueryInsightsConfigMixin()
+```
+
+`google.list[obj].withQueryInsightsConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the query_insights_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withQueryInsightsConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `query_insights_config` field.
+
+
 ### fn withReadPoolConfig
 
 ```ts
@@ -384,6 +496,53 @@ function.
   - `value` (`obj`): The value to set for the `timeouts` field.
 
 
+## obj client_connection_config
+
+
+
+### fn client_connection_config.new
+
+```ts
+new()
+```
+
+
+`google.alloydb_instance.client_connection_config.new` constructs a new object with attributes and blocks configured for the `client_connection_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `require_connectors` (`bool`): Configuration to enforce connectors only (ex: AuthProxy) connections to the database. When `null`, the `require_connectors` field will be omitted from the resulting object.
+  - `ssl_config` (`list[obj]`): SSL config option for this instance. When `null`, the `ssl_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_instance.client_connection_config.ssl_config.new](#fn-client_connection_configssl_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `client_connection_config` sub block.
+
+
+## obj client_connection_config.ssl_config
+
+
+
+### fn client_connection_config.ssl_config.new
+
+```ts
+new()
+```
+
+
+`google.alloydb_instance.client_connection_config.ssl_config.new` constructs a new object with attributes and blocks configured for the `ssl_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `ssl_mode` (`string`): SSL mode. Specifies client-server SSL/TLS connection behavior. Possible values: ["ENCRYPTED_ONLY", "ALLOW_UNENCRYPTED_AND_ENCRYPTED"] When `null`, the `ssl_mode` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `ssl_config` sub block.
+
+
 ## obj machine_config
 
 
@@ -407,6 +566,32 @@ Terraform sub block.
   - An attribute object that represents the `machine_config` sub block.
 
 
+## obj query_insights_config
+
+
+
+### fn query_insights_config.new
+
+```ts
+new()
+```
+
+
+`google.alloydb_instance.query_insights_config.new` constructs a new object with attributes and blocks configured for the `query_insights_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `query_plans_per_minute` (`number`): Number of query execution plans captured by Insights per minute for all queries combined. The default value is 5. Any integer between 0 and 20 is considered valid. When `null`, the `query_plans_per_minute` field will be omitted from the resulting object.
+  - `query_string_length` (`number`): Query string length. The default value is 1024. Any integer between 256 and 4500 is considered valid. When `null`, the `query_string_length` field will be omitted from the resulting object.
+  - `record_application_tags` (`bool`): Record application tags for an instance. This flag is turned "on" by default. When `null`, the `record_application_tags` field will be omitted from the resulting object.
+  - `record_client_address` (`bool`): Record client address for an instance. Client address is PII information. This flag is turned "on" by default. When `null`, the `record_client_address` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `query_insights_config` sub block.
+
+
 ## obj read_pool_config
 
 
diff --git a/docs/4.x/alloydb_user.md b/docs/4.x/alloydb_user.md
new file mode 100644
index 00000000..2bf21287
--- /dev/null
+++ b/docs/4.x/alloydb_user.md
@@ -0,0 +1,237 @@
+---
+permalink: /alloydb_user/
+---
+
+# alloydb_user
+
+`alloydb_user` represents the `google_alloydb_user` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withCluster()`](#fn-withcluster)
+* [`fn withDatabaseRoles()`](#fn-withdatabaseroles)
+* [`fn withPassword()`](#fn-withpassword)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withUserId()`](#fn-withuserid)
+* [`fn withUserType()`](#fn-withusertype)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.alloydb_user.new` injects a new `google_alloydb_user` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.alloydb_user.new('some_id')
+
+You can get the reference to the `id` field of the created `google.alloydb_user` using the reference:
+
+    $._ref.google_alloydb_user.some_id.get('id')
+
+This is the same as directly entering `"${ google_alloydb_user.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `cluster` (`string`): Identifies the alloydb cluster. Must be in the format
+'projects/{project}/locations/{location}/clusters/{cluster_id}'
+  - `database_roles` (`list`): List of database roles this database user has. When `null`, the `database_roles` field will be omitted from the resulting object.
+  - `password` (`string`): Password for this database user. When `null`, the `password` field will be omitted from the resulting object.
+  - `user_id` (`string`): The database role name of the user.
+  - `user_type` (`string`): The type of this user. Possible values: ["ALLOYDB_BUILT_IN", "ALLOYDB_IAM_USER"]
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_user.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.alloydb_user.newAttrs` constructs a new object with attributes and blocks configured for the `alloydb_user`
+Terraform resource.
+
+Unlike [google.alloydb_user.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `cluster` (`string`): Identifies the alloydb cluster. Must be in the format
+'projects/{project}/locations/{location}/clusters/{cluster_id}'
+  - `database_roles` (`list`): List of database roles this database user has. When `null`, the `database_roles` field will be omitted from the resulting object.
+  - `password` (`string`): Password for this database user. When `null`, the `password` field will be omitted from the resulting object.
+  - `user_id` (`string`): The database role name of the user.
+  - `user_type` (`string`): The type of this user. Possible values: ["ALLOYDB_BUILT_IN", "ALLOYDB_IAM_USER"]
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.alloydb_user.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `alloydb_user` resource into the root Terraform configuration.
+
+
+### fn withCluster
+
+```ts
+withCluster()
+```
+
+`google.string.withCluster` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the cluster field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `cluster` field.
+
+
+### fn withDatabaseRoles
+
+```ts
+withDatabaseRoles()
+```
+
+`google.list.withDatabaseRoles` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the database_roles field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `database_roles` field.
+
+
+### fn withPassword
+
+```ts
+withPassword()
+```
+
+`google.string.withPassword` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the password field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `password` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withUserId
+
+```ts
+withUserId()
+```
+
+`google.string.withUserId` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the user_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `user_id` field.
+
+
+### fn withUserType
+
+```ts
+withUserType()
+```
+
+`google.string.withUserType` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the user_type field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `user_type` field.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.alloydb_user.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/apigee_environment.md b/docs/4.x/apigee_environment.md
index b56ba5e3..0380cdba 100644
--- a/docs/4.x/apigee_environment.md
+++ b/docs/4.x/apigee_environment.md
@@ -25,6 +25,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withOrgId()`](#fn-withorgid)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withType()`](#fn-withtype)
 * [`obj node_config`](#obj-node_config)
   * [`fn new()`](#fn-node_confignew)
 * [`obj timeouts`](#obj-timeouts)
@@ -73,6 +74,10 @@ Creating, updating, or deleting target servers. Possible values: ["DEPLOYMEN
   - `name` (`string`): The resource ID of the environment.
   - `org_id` (`string`): The Apigee Organization associated with the Apigee environment,
 in the format 'organizations/{{org_name}}'.
+  - `type` (`string`): Types that can be selected for an Environment. Each of the types are
+limited by capability and capacity. Refer to Apigee's public documentation
+to understand about each of these types in details.
+An Apigee org can support heterogeneous Environments. Possible values: ["ENVIRONMENT_TYPE_UNSPECIFIED", "BASE", "INTERMEDIATE", "COMPREHENSIVE"] When `null`, the `type` field will be omitted from the resulting object.
   - `node_config` (`list[obj]`): NodeConfig for setting the min/max number of nodes associated with the environment. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.apigee_environment.node_config.new](#fn-node_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.apigee_environment.timeouts.new](#fn-timeoutsnew) constructor.
 
@@ -112,6 +117,10 @@ Creating, updating, or deleting target servers. Possible values: ["DEPLOYMEN
   - `name` (`string`): The resource ID of the environment.
   - `org_id` (`string`): The Apigee Organization associated with the Apigee environment,
 in the format 'organizations/{{org_name}}'.
+  - `type` (`string`): Types that can be selected for an Environment. Each of the types are
+limited by capability and capacity. Refer to Apigee's public documentation
+to understand about each of these types in details.
+An Apigee org can support heterogeneous Environments. Possible values: ["ENVIRONMENT_TYPE_UNSPECIFIED", "BASE", "INTERMEDIATE", "COMPREHENSIVE"] When `null`, the `type` field will be omitted from the resulting object.
   - `node_config` (`list[obj]`): NodeConfig for setting the min/max number of nodes associated with the environment. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.apigee_environment.node_config.new](#fn-node_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.apigee_environment.timeouts.new](#fn-timeoutsnew) constructor.
 
@@ -288,6 +297,22 @@ function.
   - `value` (`obj`): The value to set for the `timeouts` field.
 
 
+### fn withType
+
+```ts
+withType()
+```
+
+`google.string.withType` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the type field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `type` field.
+
+
 ## obj node_config
 
 
diff --git a/docs/4.x/artifact_registry_repository.md b/docs/4.x/artifact_registry_repository.md
index 11f0b72c..203feb1c 100644
--- a/docs/4.x/artifact_registry_repository.md
+++ b/docs/4.x/artifact_registry_repository.md
@@ -39,6 +39,10 @@ This package contains functions and utilities for setting up the resource using
   * [`fn new()`](#fn-maven_confignew)
 * [`obj remote_repository_config`](#obj-remote_repository_config)
   * [`fn new()`](#fn-remote_repository_confignew)
+  * [`obj remote_repository_config.apt_repository`](#obj-remote_repository_configapt_repository)
+    * [`fn new()`](#fn-remote_repository_configapt_repositorynew)
+    * [`obj remote_repository_config.apt_repository.public_repository`](#obj-remote_repository_configapt_repositorypublic_repository)
+      * [`fn new()`](#fn-remote_repository_configapt_repositorypublic_repositorynew)
   * [`obj remote_repository_config.docker_repository`](#obj-remote_repository_configdocker_repository)
     * [`fn new()`](#fn-remote_repository_configdocker_repositorynew)
   * [`obj remote_repository_config.maven_repository`](#obj-remote_repository_configmaven_repository)
@@ -47,6 +51,10 @@ This package contains functions and utilities for setting up the resource using
     * [`fn new()`](#fn-remote_repository_confignpm_repositorynew)
   * [`obj remote_repository_config.python_repository`](#obj-remote_repository_configpython_repository)
     * [`fn new()`](#fn-remote_repository_configpython_repositorynew)
+  * [`obj remote_repository_config.yum_repository`](#obj-remote_repository_configyum_repository)
+    * [`fn new()`](#fn-remote_repository_configyum_repositorynew)
+    * [`obj remote_repository_config.yum_repository.public_repository`](#obj-remote_repository_configyum_repositorypublic_repository)
+      * [`fn new()`](#fn-remote_repository_configyum_repositorypublic_repositorynew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 * [`obj virtual_repository_config`](#obj-virtual_repository_config)
@@ -96,7 +104,11 @@ This value may not be changed after the Repository has been created. When `null`
 This field may contain up to 64 entries. Label keys and values may be no
 longer than 63 characters. Label keys must begin with a lowercase letter
 and may only contain lowercase letters, numeric characters, underscores,
-and dashes. When `null`, the `labels` field will be omitted from the resulting object.
+and dashes.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The name of the location this repository is located in. When `null`, the `location` field will be omitted from the resulting object.
   - `mode` (`string`): The mode configures the repository to serve artifacts from different sources. Default value: "STANDARD_REPOSITORY" Possible values: ["STANDARD_REPOSITORY", "VIRTUAL_REPOSITORY", "REMOTE_REPOSITORY"] When `null`, the `mode` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
@@ -145,7 +157,11 @@ This value may not be changed after the Repository has been created. When `null`
 This field may contain up to 64 entries. Label keys and values may be no
 longer than 63 characters. Label keys must begin with a lowercase letter
 and may only contain lowercase letters, numeric characters, underscores,
-and dashes. When `null`, the `labels` field will be omitted from the resulting object.
+and dashes.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The name of the location this repository is located in. When `null`, the `location` field will be omitted from the resulting object.
   - `mode` (`string`): The mode configures the repository to serve artifacts from different sources. Default value: "STANDARD_REPOSITORY" Possible values: ["STANDARD_REPOSITORY", "VIRTUAL_REPOSITORY", "REMOTE_REPOSITORY"] When `null`, the `mode` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
@@ -541,15 +557,64 @@ Terraform sub block.
 
 **Args**:
   - `description` (`string`): The description of the remote source. When `null`, the `description` field will be omitted from the resulting object.
+  - `apt_repository` (`list[obj]`): Specific settings for an Apt remote repository. When `null`, the `apt_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.apt_repository.new](#fn-remote_repository_configapt_repositorynew) constructor.
   - `docker_repository` (`list[obj]`): Specific settings for a Docker remote repository. When `null`, the `docker_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.docker_repository.new](#fn-remote_repository_configdocker_repositorynew) constructor.
   - `maven_repository` (`list[obj]`): Specific settings for a Maven remote repository. When `null`, the `maven_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.maven_repository.new](#fn-remote_repository_configmaven_repositorynew) constructor.
   - `npm_repository` (`list[obj]`): Specific settings for an Npm remote repository. When `null`, the `npm_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.npm_repository.new](#fn-remote_repository_confignpm_repositorynew) constructor.
   - `python_repository` (`list[obj]`): Specific settings for a Python remote repository. When `null`, the `python_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.python_repository.new](#fn-remote_repository_configpython_repositorynew) constructor.
+  - `yum_repository` (`list[obj]`): Specific settings for an Yum remote repository. When `null`, the `yum_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.yum_repository.new](#fn-remote_repository_configyum_repositorynew) constructor.
 
 **Returns**:
   - An attribute object that represents the `remote_repository_config` sub block.
 
 
+## obj remote_repository_config.apt_repository
+
+
+
+### fn remote_repository_config.apt_repository.new
+
+```ts
+new()
+```
+
+
+`google.artifact_registry_repository.remote_repository_config.apt_repository.new` constructs a new object with attributes and blocks configured for the `apt_repository`
+Terraform sub block.
+
+
+
+**Args**:
+  - `public_repository` (`list[obj]`): One of the publicly available Apt repositories supported by Artifact Registry. When `null`, the `public_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.apt_repository.public_repository.new](#fn-remote_repository_configremote_repository_configpublic_repositorynew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `apt_repository` sub block.
+
+
+## obj remote_repository_config.apt_repository.public_repository
+
+
+
+### fn remote_repository_config.apt_repository.public_repository.new
+
+```ts
+new()
+```
+
+
+`google.artifact_registry_repository.remote_repository_config.apt_repository.public_repository.new` constructs a new object with attributes and blocks configured for the `public_repository`
+Terraform sub block.
+
+
+
+**Args**:
+  - `repository_base` (`string`): A common public repository base for Apt, e.g. '"debian/dists/buster"' Possible values: ["DEBIAN", "UBUNTU"]
+  - `repository_path` (`string`): Specific repository from the base.
+
+**Returns**:
+  - An attribute object that represents the `public_repository` sub block.
+
+
 ## obj remote_repository_config.docker_repository
 
 
@@ -642,6 +707,53 @@ Terraform sub block.
   - An attribute object that represents the `python_repository` sub block.
 
 
+## obj remote_repository_config.yum_repository
+
+
+
+### fn remote_repository_config.yum_repository.new
+
+```ts
+new()
+```
+
+
+`google.artifact_registry_repository.remote_repository_config.yum_repository.new` constructs a new object with attributes and blocks configured for the `yum_repository`
+Terraform sub block.
+
+
+
+**Args**:
+  - `public_repository` (`list[obj]`): One of the publicly available Yum repositories supported by Artifact Registry. When `null`, the `public_repository` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.artifact_registry_repository.remote_repository_config.yum_repository.public_repository.new](#fn-remote_repository_configremote_repository_configpublic_repositorynew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `yum_repository` sub block.
+
+
+## obj remote_repository_config.yum_repository.public_repository
+
+
+
+### fn remote_repository_config.yum_repository.public_repository.new
+
+```ts
+new()
+```
+
+
+`google.artifact_registry_repository.remote_repository_config.yum_repository.public_repository.new` constructs a new object with attributes and blocks configured for the `public_repository`
+Terraform sub block.
+
+
+
+**Args**:
+  - `repository_base` (`string`): A common public repository base for Yum. Possible values: ["CENTOS", "CENTOS_DEBUG", "CENTOS_VAULT", "CENTOS_STREAM", "ROCKY", "EPEL"]
+  - `repository_path` (`string`): Specific repository from the base, e.g. '"centos/8-stream/BaseOS/x86_64/os"'
+
+**Returns**:
+  - An attribute object that represents the `public_repository` sub block.
+
+
 ## obj timeouts
 
 
diff --git a/docs/4.x/assured_workloads_workload.md b/docs/4.x/assured_workloads_workload.md
index 8c992455..37522b6c 100644
--- a/docs/4.x/assured_workloads_workload.md
+++ b/docs/4.x/assured_workloads_workload.md
@@ -67,7 +67,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `billing_account` (`string`): Required. Input only. The billing account used for the resources which are direct children of workload. This billing account is initially associated with the resources created as part of Workload creation. After the initial creation of these resources, the customer can change the assigned billing account. The resource name has the form `billingAccounts/{billing_account_id}`. For example, 'billingAccounts/012345-567890-ABCDEF`.
   - `compliance_regime` (`string`): Required. Immutable. Compliance Regime associated with this workload. Possible values: COMPLIANCE_REGIME_UNSPECIFIED, IL4, CJIS, FEDRAMP_HIGH, FEDRAMP_MODERATE, US_REGIONAL_ACCESS, HIPAA, EU_REGIONS_AND_SUPPORT, CA_REGIONS_AND_SUPPORT, ITAR, AU_REGIONS_AND_US_SUPPORT, ASSURED_WORKLOADS_FOR_PARTNERS
   - `display_name` (`string`): Required. The user-assigned display name of the Workload. When present it must be between 4 to 30 characters. Allowed characters are: lowercase and uppercase letters, numbers, hyphen, and spaces. Example: My Workload
-  - `labels` (`obj`): Optional. Labels applied to the workload. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. Labels applied to the workload.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `organization` (`string`): The organization for the resource
   - `provisioned_resources_parent` (`string`): Input only. The parent resource for the resources managed by this Assured Workload. May be either an organization or a folder. Must be the same or a child of the Workload parent. If not specified all resources are created under the Workload parent. Formats: folders/{folder_id}, organizations/{organization_id} When `null`, the `provisioned_resources_parent` field will be omitted from the resulting object.
@@ -100,7 +103,10 @@ injecting into a complete block.
   - `billing_account` (`string`): Required. Input only. The billing account used for the resources which are direct children of workload. This billing account is initially associated with the resources created as part of Workload creation. After the initial creation of these resources, the customer can change the assigned billing account. The resource name has the form `billingAccounts/{billing_account_id}`. For example, 'billingAccounts/012345-567890-ABCDEF`.
   - `compliance_regime` (`string`): Required. Immutable. Compliance Regime associated with this workload. Possible values: COMPLIANCE_REGIME_UNSPECIFIED, IL4, CJIS, FEDRAMP_HIGH, FEDRAMP_MODERATE, US_REGIONAL_ACCESS, HIPAA, EU_REGIONS_AND_SUPPORT, CA_REGIONS_AND_SUPPORT, ITAR, AU_REGIONS_AND_US_SUPPORT, ASSURED_WORKLOADS_FOR_PARTNERS
   - `display_name` (`string`): Required. The user-assigned display name of the Workload. When present it must be between 4 to 30 characters. Allowed characters are: lowercase and uppercase letters, numbers, hyphen, and spaces. Example: My Workload
-  - `labels` (`obj`): Optional. Labels applied to the workload. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. Labels applied to the workload.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `organization` (`string`): The organization for the resource
   - `provisioned_resources_parent` (`string`): Input only. The parent resource for the resources managed by this Assured Workload. May be either an organization or a folder. Must be the same or a child of the Workload parent. If not specified all resources are created under the Workload parent. Formats: folders/{folder_id}, organizations/{organization_id} When `null`, the `provisioned_resources_parent` field will be omitted from the resulting object.
diff --git a/docs/4.x/beyondcorp_app_connection.md b/docs/4.x/beyondcorp_app_connection.md
index 422d8851..b4412ae6 100644
--- a/docs/4.x/beyondcorp_app_connection.md
+++ b/docs/4.x/beyondcorp_app_connection.md
@@ -66,7 +66,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `connectors` (`list`): List of AppConnectors that are authorised to be associated with this AppConnection When `null`, the `connectors` field will be omitted from the resulting object.
   - `display_name` (`string`): An arbitrary user-provided name for the AppConnection. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): ID of the AppConnection.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region of the AppConnection. When `null`, the `region` field will be omitted from the resulting object.
@@ -101,7 +105,11 @@ injecting into a complete block.
 **Args**:
   - `connectors` (`list`): List of AppConnectors that are authorised to be associated with this AppConnection When `null`, the `connectors` field will be omitted from the resulting object.
   - `display_name` (`string`): An arbitrary user-provided name for the AppConnection. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): ID of the AppConnection.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region of the AppConnection. When `null`, the `region` field will be omitted from the resulting object.
diff --git a/docs/4.x/beyondcorp_app_connector.md b/docs/4.x/beyondcorp_app_connector.md
index b3635f1c..80b23d94 100644
--- a/docs/4.x/beyondcorp_app_connector.md
+++ b/docs/4.x/beyondcorp_app_connector.md
@@ -61,7 +61,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `display_name` (`string`): An arbitrary user-provided name for the AppConnector. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): ID of the AppConnector.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region of the AppConnector. When `null`, the `region` field will be omitted from the resulting object.
@@ -91,7 +95,11 @@ injecting into a complete block.
 
 **Args**:
   - `display_name` (`string`): An arbitrary user-provided name for the AppConnector. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): ID of the AppConnector.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region of the AppConnector. When `null`, the `region` field will be omitted from the resulting object.
diff --git a/docs/4.x/beyondcorp_app_gateway.md b/docs/4.x/beyondcorp_app_gateway.md
index c40d79ab..c902bc4e 100644
--- a/docs/4.x/beyondcorp_app_gateway.md
+++ b/docs/4.x/beyondcorp_app_gateway.md
@@ -58,7 +58,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `display_name` (`string`): An arbitrary user-provided name for the AppGateway. When `null`, the `display_name` field will be omitted from the resulting object.
   - `host_type` (`string`): The type of hosting used by the AppGateway. Default value: "HOST_TYPE_UNSPECIFIED" Possible values: ["HOST_TYPE_UNSPECIFIED", "GCP_REGIONAL_MIG"] When `null`, the `host_type` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): ID of the AppGateway.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region of the AppGateway. When `null`, the `region` field will be omitted from the resulting object.
@@ -89,7 +93,11 @@ injecting into a complete block.
 **Args**:
   - `display_name` (`string`): An arbitrary user-provided name for the AppGateway. When `null`, the `display_name` field will be omitted from the resulting object.
   - `host_type` (`string`): The type of hosting used by the AppGateway. Default value: "HOST_TYPE_UNSPECIFIED" Possible values: ["HOST_TYPE_UNSPECIFIED", "GCP_REGIONAL_MIG"] When `null`, the `host_type` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): ID of the AppGateway.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region of the AppGateway. When `null`, the `region` field will be omitted from the resulting object.
diff --git a/docs/4.x/bigquery_capacity_commitment.md b/docs/4.x/bigquery_capacity_commitment.md
index 4c1c06c1..abffc147 100644
--- a/docs/4.x/bigquery_capacity_commitment.md
+++ b/docs/4.x/bigquery_capacity_commitment.md
@@ -67,7 +67,7 @@ or merged. When `null`, the `capacity_commitment_id` field will be omitted from
 Examples: US, EU, asia-northeast1. The default value is US. When `null`, the `location` field will be omitted from the resulting object.
   - `plan` (`string`): Capacity commitment plan. Valid values are at https://cloud.google.com/bigquery/docs/reference/reservations/rpc/google.cloud.bigquery.reservation.v1#commitmentplan
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
-  - `renewal_plan` (`string`): The plan this capacity commitment is converted to after commitmentEndTime passes. Once the plan is changed, committed period is extended according to commitment plan. Only applicable some commitment plans. When `null`, the `renewal_plan` field will be omitted from the resulting object.
+  - `renewal_plan` (`string`): The plan this capacity commitment is converted to after commitmentEndTime passes. Once the plan is changed, committed period is extended according to commitment plan. Only applicable for some commitment plans. When `null`, the `renewal_plan` field will be omitted from the resulting object.
   - `slot_count` (`number`): Number of slots in this commitment.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_capacity_commitment.timeouts.new](#fn-timeoutsnew) constructor.
 
@@ -103,7 +103,7 @@ or merged. When `null`, the `capacity_commitment_id` field will be omitted from
 Examples: US, EU, asia-northeast1. The default value is US. When `null`, the `location` field will be omitted from the resulting object.
   - `plan` (`string`): Capacity commitment plan. Valid values are at https://cloud.google.com/bigquery/docs/reference/reservations/rpc/google.cloud.bigquery.reservation.v1#commitmentplan
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
-  - `renewal_plan` (`string`): The plan this capacity commitment is converted to after commitmentEndTime passes. Once the plan is changed, committed period is extended according to commitment plan. Only applicable some commitment plans. When `null`, the `renewal_plan` field will be omitted from the resulting object.
+  - `renewal_plan` (`string`): The plan this capacity commitment is converted to after commitmentEndTime passes. Once the plan is changed, committed period is extended according to commitment plan. Only applicable for some commitment plans. When `null`, the `renewal_plan` field will be omitted from the resulting object.
   - `slot_count` (`number`): Number of slots in this commitment.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_capacity_commitment.timeouts.new](#fn-timeoutsnew) constructor.
 
diff --git a/docs/4.x/bigquery_connection.md b/docs/4.x/bigquery_connection.md
index 795fcec7..1be4f18d 100644
--- a/docs/4.x/bigquery_connection.md
+++ b/docs/4.x/bigquery_connection.md
@@ -548,9 +548,12 @@ Terraform sub block.
 
 
 **Args**:
-  - `database` (`string`): Cloud Spanner database in the form 'project/instance/database'
-  - `use_parallelism` (`bool`): If parallelism should be used when reading from Cloud Spanner When `null`, the `use_parallelism` field will be omitted from the resulting object.
-  - `use_serverless_analytics` (`bool`): If the serverless analytics service should be used to read data from Cloud Spanner. useParallelism must be set when using serverless analytics When `null`, the `use_serverless_analytics` field will be omitted from the resulting object.
+  - `database` (`string`): Cloud Spanner database in the form 'project/instance/database'.
+  - `database_role` (`string`): Cloud Spanner database role for fine-grained access control. The Cloud Spanner admin should have provisioned the database role with appropriate permissions, such as 'SELECT' and 'INSERT'. Other users should only use roles provided by their Cloud Spanner admins. The database role name must start with a letter, and can only contain letters, numbers, and underscores. For more details, see https://cloud.google.com/spanner/docs/fgac-about. When `null`, the `database_role` field will be omitted from the resulting object.
+  - `max_parallelism` (`number`): Allows setting max parallelism per query when executing on Spanner independent compute resources. If unspecified, default values of parallelism are chosen that are dependent on the Cloud Spanner instance configuration. 'useParallelism' and 'useDataBoost' must be set when setting max parallelism. When `null`, the `max_parallelism` field will be omitted from the resulting object.
+  - `use_data_boost` (`bool`): If set, the request will be executed via Spanner independent compute resources. 'use_parallelism' must be set when using data boost. When `null`, the `use_data_boost` field will be omitted from the resulting object.
+  - `use_parallelism` (`bool`): If parallelism should be used when reading from Cloud Spanner. When `null`, the `use_parallelism` field will be omitted from the resulting object.
+  - `use_serverless_analytics` (`bool`): If the serverless analytics service should be used to read data from Cloud Spanner. 'useParallelism' must be set when using serverless analytics. When `null`, the `use_serverless_analytics` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `cloud_spanner` sub block.
diff --git a/docs/4.x/bigquery_dataset.md b/docs/4.x/bigquery_dataset.md
index 6fadc9d9..8990a062 100644
--- a/docs/4.x/bigquery_dataset.md
+++ b/docs/4.x/bigquery_dataset.md
@@ -128,7 +128,11 @@ destroying the resource will fail if tables are present. When `null`, the `delet
 By default, this is FALSE, which means the dataset and its table names are
 case-sensitive. This field does not affect routine references. When `null`, the `is_case_insensitive` field will be omitted from the resulting object.
   - `labels` (`obj`): The labels associated with this dataset. You can use these to
-organize and group your datasets When `null`, the `labels` field will be omitted from the resulting object.
+organize and group your datasets.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The geographic location where the dataset should reside.
 See [official docs](https://cloud.google.com/bigquery/docs/dataset-locations).
 
@@ -226,7 +230,11 @@ destroying the resource will fail if tables are present. When `null`, the `delet
 By default, this is FALSE, which means the dataset and its table names are
 case-sensitive. This field does not affect routine references. When `null`, the `is_case_insensitive` field will be omitted from the resulting object.
   - `labels` (`obj`): The labels associated with this dataset. You can use these to
-organize and group your datasets When `null`, the `labels` field will be omitted from the resulting object.
+organize and group your datasets.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The geographic location where the dataset should reside.
 See [official docs](https://cloud.google.com/bigquery/docs/dataset-locations).
 
@@ -594,6 +602,8 @@ Terraform sub block.
   - `domain` (`string`): A domain to grant access to. Any users signed in with the
 domain specified will be granted the specified access When `null`, the `domain` field will be omitted from the resulting object.
   - `group_by_email` (`string`): An email address of a Google Group to grant access to. When `null`, the `group_by_email` field will be omitted from the resulting object.
+  - `iam_member` (`string`): Some other type of member that appears in the IAM Policy but isn't a user,
+group, domain, or special group. For example: 'allUsers' When `null`, the `iam_member` field will be omitted from the resulting object.
   - `role` (`string`): Describes the rights granted to the user specified by the other
 member of the access object. Basic, predefined, and custom roles
 are supported. Predefined roles that have equivalent basic roles
diff --git a/docs/4.x/bigquery_job.md b/docs/4.x/bigquery_job.md
index c1bc5de8..e9601b32 100644
--- a/docs/4.x/bigquery_job.md
+++ b/docs/4.x/bigquery_job.md
@@ -100,7 +100,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `job_id` (`string`): The ID of the job. The ID must contain only letters (a-z, A-Z), numbers (0-9), underscores (_), or dashes (-). The maximum length is 1,024 characters.
   - `job_timeout_ms` (`string`): Job timeout in milliseconds. If this time limit is exceeded, BigQuery may attempt to terminate the job. When `null`, the `job_timeout_ms` field will be omitted from the resulting object.
-  - `labels` (`obj`): The labels associated with this job. You can use these to organize and group your jobs. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): The labels associated with this job. You can use these to organize and group your jobs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The geographic location of the job. The default value is US. When `null`, the `location` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `copy` (`list[obj]`): Copies a table. When `null`, the `copy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.copy.new](#fn-copynew) constructor.
@@ -133,7 +137,11 @@ injecting into a complete block.
 **Args**:
   - `job_id` (`string`): The ID of the job. The ID must contain only letters (a-z, A-Z), numbers (0-9), underscores (_), or dashes (-). The maximum length is 1,024 characters.
   - `job_timeout_ms` (`string`): Job timeout in milliseconds. If this time limit is exceeded, BigQuery may attempt to terminate the job. When `null`, the `job_timeout_ms` field will be omitted from the resulting object.
-  - `labels` (`obj`): The labels associated with this job. You can use these to organize and group your jobs. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): The labels associated with this job. You can use these to organize and group your jobs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The geographic location of the job. The default value is US. When `null`, the `location` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `copy` (`list[obj]`): Copies a table. When `null`, the `copy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_job.copy.new](#fn-copynew) constructor.
diff --git a/docs/4.x/bigquery_routine.md b/docs/4.x/bigquery_routine.md
index b4dcb059..8940d08c 100644
--- a/docs/4.x/bigquery_routine.md
+++ b/docs/4.x/bigquery_routine.md
@@ -88,7 +88,7 @@ d the order of values or replaced STRUCT field type with RECORD field type, we c
 cannot suppress the recurring diff this causes. As a workaround, we recommend using
 the schema as returned by the API. When `null`, the `return_type` field will be omitted from the resulting object.
   - `routine_id` (`string`): The ID of the the routine. The ID must contain only letters (a-z, A-Z), numbers (0-9), or underscores (_). The maximum length is 256 characters.
-  - `routine_type` (`string`): The type of routine. Possible values: ["SCALAR_FUNCTION", "PROCEDURE", "TABLE_VALUED_FUNCTION"] When `null`, the `routine_type` field will be omitted from the resulting object.
+  - `routine_type` (`string`): The type of routine. Possible values: ["SCALAR_FUNCTION", "PROCEDURE", "TABLE_VALUED_FUNCTION"]
   - `arguments` (`list[obj]`): Input/output argument of a function or a stored procedure. When `null`, the `arguments` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_routine.arguments.new](#fn-argumentsnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_routine.timeouts.new](#fn-timeoutsnew) constructor.
 
@@ -138,7 +138,7 @@ d the order of values or replaced STRUCT field type with RECORD field type, we c
 cannot suppress the recurring diff this causes. As a workaround, we recommend using
 the schema as returned by the API. When `null`, the `return_type` field will be omitted from the resulting object.
   - `routine_id` (`string`): The ID of the the routine. The ID must contain only letters (a-z, A-Z), numbers (0-9), or underscores (_). The maximum length is 256 characters.
-  - `routine_type` (`string`): The type of routine. Possible values: ["SCALAR_FUNCTION", "PROCEDURE", "TABLE_VALUED_FUNCTION"] When `null`, the `routine_type` field will be omitted from the resulting object.
+  - `routine_type` (`string`): The type of routine. Possible values: ["SCALAR_FUNCTION", "PROCEDURE", "TABLE_VALUED_FUNCTION"]
   - `arguments` (`list[obj]`): Input/output argument of a function or a stored procedure. When `null`, the `arguments` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_routine.arguments.new](#fn-argumentsnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_routine.timeouts.new](#fn-timeoutsnew) constructor.
 
diff --git a/docs/4.x/bigquery_table.md b/docs/4.x/bigquery_table.md
index eae0d083..9ee18154 100644
--- a/docs/4.x/bigquery_table.md
+++ b/docs/4.x/bigquery_table.md
@@ -32,6 +32,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withProject()`](#fn-withproject)
 * [`fn withRangePartitioning()`](#fn-withrangepartitioning)
 * [`fn withRangePartitioningMixin()`](#fn-withrangepartitioningmixin)
+* [`fn withRequirePartitionFilter()`](#fn-withrequirepartitionfilter)
 * [`fn withSchema()`](#fn-withschema)
 * [`fn withTableConstraints()`](#fn-withtableconstraints)
 * [`fn withTableConstraintsMixin()`](#fn-withtableconstraintsmixin)
@@ -112,9 +113,13 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `description` (`string`): The field description. When `null`, the `description` field will be omitted from the resulting object.
   - `expiration_time` (`number`): The time when this table expires, in milliseconds since the epoch. If not present, the table will persist indefinitely. Expired tables will be deleted and their storage reclaimed. When `null`, the `expiration_time` field will be omitted from the resulting object.
   - `friendly_name` (`string`): A descriptive name for the table. When `null`, the `friendly_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): A mapping of labels to assign to the resource. When `null`, the `labels` field will be omitted from the resulting object.
-  - `max_staleness` (`string`): The maximum staleness of data that could be returned when the table (or stale MV) is queried. Staleness encoded as a string encoding of sql IntervalValue type. When `null`, the `max_staleness` field will be omitted from the resulting object.
+  - `labels` (`obj`): A mapping of labels to assign to the resource.
+
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `max_staleness` (`string`): The maximum staleness of data that could be returned when the table (or stale MV) is queried. Staleness encoded as a string encoding of [SQL IntervalValue type](https://cloud.google.com/bigquery/docs/reference/standard-sql/data-types#interval_type). When `null`, the `max_staleness` field will be omitted from the resulting object.
   - `project` (`string`): The ID of the project in which the resource belongs. When `null`, the `project` field will be omitted from the resulting object.
+  - `require_partition_filter` (`bool`): If set to true, queries over this table require a partition filter that can be used for partition elimination to be specified. When `null`, the `require_partition_filter` field will be omitted from the resulting object.
   - `schema` (`string`): A JSON schema for the table. When `null`, the `schema` field will be omitted from the resulting object.
   - `table_id` (`string`): A unique ID for the resource. Changing this forces a new resource to be created.
   - `encryption_configuration` (`list[obj]`): Specifies how the table should be encrypted. If left blank, the table will be encrypted with a Google-managed key; that process is transparent to the user. When `null`, the `encryption_configuration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.encryption_configuration.new](#fn-encryption_configurationnew) constructor.
@@ -153,9 +158,13 @@ injecting into a complete block.
   - `description` (`string`): The field description. When `null`, the `description` field will be omitted from the resulting object.
   - `expiration_time` (`number`): The time when this table expires, in milliseconds since the epoch. If not present, the table will persist indefinitely. Expired tables will be deleted and their storage reclaimed. When `null`, the `expiration_time` field will be omitted from the resulting object.
   - `friendly_name` (`string`): A descriptive name for the table. When `null`, the `friendly_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): A mapping of labels to assign to the resource. When `null`, the `labels` field will be omitted from the resulting object.
-  - `max_staleness` (`string`): The maximum staleness of data that could be returned when the table (or stale MV) is queried. Staleness encoded as a string encoding of sql IntervalValue type. When `null`, the `max_staleness` field will be omitted from the resulting object.
+  - `labels` (`obj`): A mapping of labels to assign to the resource.
+
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `max_staleness` (`string`): The maximum staleness of data that could be returned when the table (or stale MV) is queried. Staleness encoded as a string encoding of [SQL IntervalValue type](https://cloud.google.com/bigquery/docs/reference/standard-sql/data-types#interval_type). When `null`, the `max_staleness` field will be omitted from the resulting object.
   - `project` (`string`): The ID of the project in which the resource belongs. When `null`, the `project` field will be omitted from the resulting object.
+  - `require_partition_filter` (`bool`): If set to true, queries over this table require a partition filter that can be used for partition elimination to be specified. When `null`, the `require_partition_filter` field will be omitted from the resulting object.
   - `schema` (`string`): A JSON schema for the table. When `null`, the `schema` field will be omitted from the resulting object.
   - `table_id` (`string`): A unique ID for the resource. Changing this forces a new resource to be created.
   - `encryption_configuration` (`list[obj]`): Specifies how the table should be encrypted. If left blank, the table will be encrypted with a Google-managed key; that process is transparent to the user. When `null`, the `encryption_configuration` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigquery_table.encryption_configuration.new](#fn-encryption_configurationnew) constructor.
@@ -462,6 +471,22 @@ function.
   - `value` (`list[obj]`): The value to set for the `range_partitioning` field.
 
 
+### fn withRequirePartitionFilter
+
+```ts
+withRequirePartitionFilter()
+```
+
+`google.bool.withRequirePartitionFilter` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the require_partition_filter field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `require_partition_filter` field.
+
+
 ### fn withSchema
 
 ```ts
diff --git a/docs/4.x/bigtable_instance.md b/docs/4.x/bigtable_instance.md
index b1b92f44..36b84206 100644
--- a/docs/4.x/bigtable_instance.md
+++ b/docs/4.x/bigtable_instance.md
@@ -64,7 +64,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the instance. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the instance will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.
   - `display_name` (`string`): The human-readable display name of the Bigtable instance. Defaults to the instance name. When `null`, the `display_name` field will be omitted from the resulting object.
   - `instance_type` (`string`): The instance type to create. One of "DEVELOPMENT" or "PRODUCTION". Defaults to "PRODUCTION". When `null`, the `instance_type` field will be omitted from the resulting object.
-  - `labels` (`obj`): A mapping of labels to assign to the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A mapping of labels to assign to the resource.
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The name (also called Instance Id in the Cloud Console) of the Cloud Bigtable instance. Must be 6-33 characters and must only contain hyphens, lowercase letters and numbers.
   - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.
   - `cluster` (`list[obj]`): A block of cluster configuration options. This can be specified at least once. When `null`, the `cluster` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_instance.cluster.new](#fn-clusternew) constructor.
@@ -95,7 +98,10 @@ injecting into a complete block.
   - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the instance. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the instance will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.
   - `display_name` (`string`): The human-readable display name of the Bigtable instance. Defaults to the instance name. When `null`, the `display_name` field will be omitted from the resulting object.
   - `instance_type` (`string`): The instance type to create. One of "DEVELOPMENT" or "PRODUCTION". Defaults to "PRODUCTION". When `null`, the `instance_type` field will be omitted from the resulting object.
-  - `labels` (`obj`): A mapping of labels to assign to the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A mapping of labels to assign to the resource.
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The name (also called Instance Id in the Cloud Console) of the Cloud Bigtable instance. Must be 6-33 characters and must only contain hyphens, lowercase letters and numbers.
   - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.
   - `cluster` (`list[obj]`): A block of cluster configuration options. This can be specified at least once. When `null`, the `cluster` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.bigtable_instance.cluster.new](#fn-clusternew) constructor.
diff --git a/docs/4.x/certificate_manager_certificate.md b/docs/4.x/certificate_manager_certificate.md
index 2d9ced8a..a5ccf2f3 100644
--- a/docs/4.x/certificate_manager_certificate.md
+++ b/docs/4.x/certificate_manager_certificate.md
@@ -64,7 +64,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Set of label tags associated with the Certificate resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Set of label tags associated with the Certificate resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The Certificate Manager location. If not specified, "global" is used. When `null`, the `location` field will be omitted from the resulting object.
   - `name` (`string`): A user-defined name of the certificate. Certificate names must be unique
 The name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,
@@ -75,11 +78,11 @@ and all following characters must be a dash, underscore, letter or digit.
 DEFAULT: Certificates with default scope are served from core Google data centers.
 If unsure, choose this option.
 
-EDGE_CACHE: Certificates with scope EDGE_CACHE are special-purposed certificates,
-served from non-core Google data centers.
+EDGE_CACHE: Certificates with scope EDGE_CACHE are special-purposed certificates, served from Edge Points of Presence.
+See https://cloud.google.com/vpc/docs/edge-locations.
 
 ALL_REGIONS: Certificates with ALL_REGIONS scope are served from all GCP regions (You can only use ALL_REGIONS with global certs).
-see https://cloud.google.com/compute/docs/regions-zones When `null`, the `scope` field will be omitted from the resulting object.
+See https://cloud.google.com/compute/docs/regions-zones When `null`, the `scope` field will be omitted from the resulting object.
   - `managed` (`list[obj]`): Configuration and state of a Managed Certificate.
 Certificate Manager provisions and renews Managed Certificates
 automatically, for as long as it's authorized to do so. When `null`, the `managed` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate.managed.new](#fn-managednew) constructor.
@@ -111,7 +114,10 @@ injecting into a complete block.
 
 **Args**:
   - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Set of label tags associated with the Certificate resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Set of label tags associated with the Certificate resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The Certificate Manager location. If not specified, "global" is used. When `null`, the `location` field will be omitted from the resulting object.
   - `name` (`string`): A user-defined name of the certificate. Certificate names must be unique
 The name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,
@@ -122,11 +128,11 @@ and all following characters must be a dash, underscore, letter or digit.
 DEFAULT: Certificates with default scope are served from core Google data centers.
 If unsure, choose this option.
 
-EDGE_CACHE: Certificates with scope EDGE_CACHE are special-purposed certificates,
-served from non-core Google data centers.
+EDGE_CACHE: Certificates with scope EDGE_CACHE are special-purposed certificates, served from Edge Points of Presence.
+See https://cloud.google.com/vpc/docs/edge-locations.
 
 ALL_REGIONS: Certificates with ALL_REGIONS scope are served from all GCP regions (You can only use ALL_REGIONS with global certs).
-see https://cloud.google.com/compute/docs/regions-zones When `null`, the `scope` field will be omitted from the resulting object.
+See https://cloud.google.com/compute/docs/regions-zones When `null`, the `scope` field will be omitted from the resulting object.
   - `managed` (`list[obj]`): Configuration and state of a Managed Certificate.
 Certificate Manager provisions and renews Managed Certificates
 automatically, for as long as it's authorized to do so. When `null`, the `managed` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.certificate_manager_certificate.managed.new](#fn-managednew) constructor.
diff --git a/docs/4.x/certificate_manager_certificate_issuance_config.md b/docs/4.x/certificate_manager_certificate_issuance_config.md
index 6b3b7c04..c4f431bc 100644
--- a/docs/4.x/certificate_manager_certificate_issuance_config.md
+++ b/docs/4.x/certificate_manager_certificate_issuance_config.md
@@ -66,7 +66,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `description` (`string`): One or more paragraphs of text description of a CertificateIssuanceConfig. When `null`, the `description` field will be omitted from the resulting object.
   - `key_algorithm` (`string`): Key algorithm to use when generating the private key. Possible values: ["RSA_2048", "ECDSA_P256"]
   - `labels` (`obj`): 'Set of label tags associated with the CertificateIssuanceConfig resource.
- An object containing a list of "key": value pairs. Example: { "name": "wrench", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+ An object containing a list of "key": value pairs. Example: { "name": "wrench", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `lifetime` (`string`): Lifetime of issued certificates. A duration in seconds with up to nine fractional digits, ending with 's'.
 Example: "1814400s". Valid values are from 21 days (1814400s) to 30 days (2592000s)
   - `location` (`string`): The Certificate Manager location. If not specified, "global" is used. When `null`, the `location` field will be omitted from the resulting object.
@@ -105,7 +109,11 @@ injecting into a complete block.
   - `description` (`string`): One or more paragraphs of text description of a CertificateIssuanceConfig. When `null`, the `description` field will be omitted from the resulting object.
   - `key_algorithm` (`string`): Key algorithm to use when generating the private key. Possible values: ["RSA_2048", "ECDSA_P256"]
   - `labels` (`obj`): 'Set of label tags associated with the CertificateIssuanceConfig resource.
- An object containing a list of "key": value pairs. Example: { "name": "wrench", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+ An object containing a list of "key": value pairs. Example: { "name": "wrench", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `lifetime` (`string`): Lifetime of issued certificates. A duration in seconds with up to nine fractional digits, ending with 's'.
 Example: "1814400s". Valid values are from 21 days (1814400s) to 30 days (2592000s)
   - `location` (`string`): The Certificate Manager location. If not specified, "global" is used. When `null`, the `location` field will be omitted from the resulting object.
diff --git a/docs/4.x/certificate_manager_certificate_map.md b/docs/4.x/certificate_manager_certificate_map.md
index 510efe99..d5fe702b 100644
--- a/docs/4.x/certificate_manager_certificate_map.md
+++ b/docs/4.x/certificate_manager_certificate_map.md
@@ -54,7 +54,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Set of labels associated with a Certificate Map resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Set of labels associated with a Certificate Map resource.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): A user-defined name of the Certificate Map. Certificate Map names must be unique
 globally and match the pattern 'projects/*/locations/*/certificateMaps/*'.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
@@ -83,7 +87,11 @@ injecting into a complete block.
 
 **Args**:
   - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Set of labels associated with a Certificate Map resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Set of labels associated with a Certificate Map resource.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): A user-defined name of the Certificate Map. Certificate Map names must be unique
 globally and match the pattern 'projects/*/locations/*/certificateMaps/*'.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
diff --git a/docs/4.x/certificate_manager_certificate_map_entry.md b/docs/4.x/certificate_manager_certificate_map_entry.md
index 06ecbf03..d84dfea3 100644
--- a/docs/4.x/certificate_manager_certificate_map_entry.md
+++ b/docs/4.x/certificate_manager_certificate_map_entry.md
@@ -66,7 +66,11 @@ for a set of hostnames with common suffix. Used as Server Name Indication (SNI)
 selecting a proper certificate. When `null`, the `hostname` field will be omitted from the resulting object.
   - `labels` (`obj`): Set of labels associated with a Certificate Map Entry.
 An object containing a list of "key": value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `map` (`string`): A map entry that is inputted into the cetrificate map
   - `matcher` (`string`): A predefined matcher for particular cases, other than SNI selection When `null`, the `matcher` field will be omitted from the resulting object.
   - `name` (`string`): A user-defined name of the Certificate Map Entry. Certificate Map Entry
@@ -106,7 +110,11 @@ for a set of hostnames with common suffix. Used as Server Name Indication (SNI)
 selecting a proper certificate. When `null`, the `hostname` field will be omitted from the resulting object.
   - `labels` (`obj`): Set of labels associated with a Certificate Map Entry.
 An object containing a list of "key": value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `map` (`string`): A map entry that is inputted into the cetrificate map
   - `matcher` (`string`): A predefined matcher for particular cases, other than SNI selection When `null`, the `matcher` field will be omitted from the resulting object.
   - `name` (`string`): A user-defined name of the Certificate Map Entry. Certificate Map Entry
diff --git a/docs/4.x/certificate_manager_dns_authorization.md b/docs/4.x/certificate_manager_dns_authorization.md
index 0fb1de40..c8ea0d75 100644
--- a/docs/4.x/certificate_manager_dns_authorization.md
+++ b/docs/4.x/certificate_manager_dns_authorization.md
@@ -58,7 +58,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `domain` (`string`): A domain which is being authorized. A DnsAuthorization resource covers a
 single domain and its wildcard, e.g. authorization for "example.com" can
 be used to issue certificates for "example.com" and "*.example.com".
-  - `labels` (`obj`): Set of label tags associated with the DNS Authorization resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Set of label tags associated with the DNS Authorization resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource; provided by the client when the resource is created.
 The name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,
 and all following characters must be a dash, underscore, letter or digit.
@@ -91,7 +94,10 @@ injecting into a complete block.
   - `domain` (`string`): A domain which is being authorized. A DnsAuthorization resource covers a
 single domain and its wildcard, e.g. authorization for "example.com" can
 be used to issue certificates for "example.com" and "*.example.com".
-  - `labels` (`obj`): Set of label tags associated with the DNS Authorization resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Set of label tags associated with the DNS Authorization resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource; provided by the client when the resource is created.
 The name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,
 and all following characters must be a dash, underscore, letter or digit.
diff --git a/docs/4.x/certificate_manager_trust_config.md b/docs/4.x/certificate_manager_trust_config.md
index d0fa3cf7..48c20f1a 100644
--- a/docs/4.x/certificate_manager_trust_config.md
+++ b/docs/4.x/certificate_manager_trust_config.md
@@ -63,7 +63,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): One or more paragraphs of text description of a trust config. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Set of label tags associated with the trust config. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Set of label tags associated with the trust config.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The trust config location.
   - `name` (`string`): A user-defined name of the trust config. Trust config names must be unique globally.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
@@ -94,7 +97,10 @@ injecting into a complete block.
 
 **Args**:
   - `description` (`string`): One or more paragraphs of text description of a trust config. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Set of label tags associated with the trust config. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Set of label tags associated with the trust config.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The trust config location.
   - `name` (`string`): A user-defined name of the trust config. Trust config names must be unique globally.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
diff --git a/docs/4.x/cloud_run_domain_mapping.md b/docs/4.x/cloud_run_domain_mapping.md
index 18b8a930..907c39b5 100644
--- a/docs/4.x/cloud_run_domain_mapping.md
+++ b/docs/4.x/cloud_run_domain_mapping.md
@@ -281,11 +281,17 @@ info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotati
 
 **Note**: The Cloud Run API may add additional annotations that were not provided in your config.
 If terraform plan shows a diff where a server-side annotation is added, you can add it to your config
-or apply the lifecycle.ignore_changes rule to the metadata.0.annotations field. When `null`, the `annotations` field will be omitted from the resulting object.
+or apply the lifecycle.ignore_changes rule to the metadata.0.annotations field.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `labels` (`obj`): Map of string keys and values that can be used to organize and categorize
 (scope and select) objects. May match selectors of replication controllers
 and routes.
-More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels When `null`, the `labels` field will be omitted from the resulting object.
+More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `namespace` (`string`): In Cloud Run the namespace must be equal to either the
 project ID or project number.
 
diff --git a/docs/4.x/cloud_run_service.md b/docs/4.x/cloud_run_service.md
index ed37c4fc..765bfb88 100644
--- a/docs/4.x/cloud_run_service.md
+++ b/docs/4.x/cloud_run_service.md
@@ -445,10 +445,16 @@ keys to configure features on a Service:
 - 'run.googleapis.com/ingress' sets the [ingress settings](https://cloud.google.com/sdk/gcloud/reference/run/deploy#--ingress)
   for the Service. For example, '"run.googleapis.com/ingress" = "all"'.
 - 'run.googleapis.com/launch-stage' sets the [launch stage](https://cloud.google.com/run/docs/troubleshooting#launch-stage-validation)
-  when a preview feature is used. For example, '"run.googleapis.com/launch-stage": "BETA"' When `null`, the `annotations` field will be omitted from the resulting object.
+  when a preview feature is used. For example, '"run.googleapis.com/launch-stage": "BETA"'
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `labels` (`obj`): Map of string keys and values that can be used to organize and categorize
 (scope and select) objects. May match selectors of replication controllers
-and routes. When `null`, the `labels` field will be omitted from the resulting object.
+and routes.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `namespace` (`string`): In Cloud Run the namespace must be equal to either the
 project ID or project number. When `null`, the `namespace` field will be omitted from the resulting object.
 
diff --git a/docs/4.x/cloud_run_v2_job.md b/docs/4.x/cloud_run_v2_job.md
index 272718cf..bbed832a 100644
--- a/docs/4.x/cloud_run_v2_job.md
+++ b/docs/4.x/cloud_run_v2_job.md
@@ -43,26 +43,10 @@ This package contains functions and utilities for setting up the resource using
           * [`fn new()`](#fn-templatetemplatecontainersenvvalue_sourcenew)
           * [`obj template.template.containers.env.value_source.secret_key_ref`](#obj-templatetemplatecontainersenvvalue_sourcesecret_key_ref)
             * [`fn new()`](#fn-templatetemplatecontainersenvvalue_sourcesecret_key_refnew)
-      * [`obj template.template.containers.liveness_probe`](#obj-templatetemplatecontainersliveness_probe)
-        * [`fn new()`](#fn-templatetemplatecontainersliveness_probenew)
-        * [`obj template.template.containers.liveness_probe.http_get`](#obj-templatetemplatecontainersliveness_probehttp_get)
-          * [`fn new()`](#fn-templatetemplatecontainersliveness_probehttp_getnew)
-          * [`obj template.template.containers.liveness_probe.http_get.http_headers`](#obj-templatetemplatecontainersliveness_probehttp_gethttp_headers)
-            * [`fn new()`](#fn-templatetemplatecontainersliveness_probehttp_gethttp_headersnew)
-        * [`obj template.template.containers.liveness_probe.tcp_socket`](#obj-templatetemplatecontainersliveness_probetcp_socket)
-          * [`fn new()`](#fn-templatetemplatecontainersliveness_probetcp_socketnew)
       * [`obj template.template.containers.ports`](#obj-templatetemplatecontainersports)
         * [`fn new()`](#fn-templatetemplatecontainersportsnew)
       * [`obj template.template.containers.resources`](#obj-templatetemplatecontainersresources)
         * [`fn new()`](#fn-templatetemplatecontainersresourcesnew)
-      * [`obj template.template.containers.startup_probe`](#obj-templatetemplatecontainersstartup_probe)
-        * [`fn new()`](#fn-templatetemplatecontainersstartup_probenew)
-        * [`obj template.template.containers.startup_probe.http_get`](#obj-templatetemplatecontainersstartup_probehttp_get)
-          * [`fn new()`](#fn-templatetemplatecontainersstartup_probehttp_getnew)
-          * [`obj template.template.containers.startup_probe.http_get.http_headers`](#obj-templatetemplatecontainersstartup_probehttp_gethttp_headers)
-            * [`fn new()`](#fn-templatetemplatecontainersstartup_probehttp_gethttp_headersnew)
-        * [`obj template.template.containers.startup_probe.tcp_socket`](#obj-templatetemplatecontainersstartup_probetcp_socket)
-          * [`fn new()`](#fn-templatetemplatecontainersstartup_probetcp_socketnew)
       * [`obj template.template.containers.volume_mounts`](#obj-templatetemplatecontainersvolume_mounts)
         * [`fn new()`](#fn-templatetemplatecontainersvolume_mountsnew)
     * [`obj template.template.volumes`](#obj-templatetemplatevolumes)
@@ -114,19 +98,25 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 Cloud Run API v2 does not support annotations with 'run.googleapis.com', 'cloud.googleapis.com', 'serving.knative.dev', or 'autoscaling.knative.dev' namespaces, and they will be rejected on new resources.
 All system annotations in v1 now have a corresponding field in v2 Job.
 
-This field follows Kubernetes annotations' namespacing, limits, and rules. When `null`, the `annotations` field will be omitted from the resulting object.
+This field follows Kubernetes annotations' namespacing, limits, and rules.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `client` (`string`): Arbitrary identifier for the API client. When `null`, the `client` field will be omitted from the resulting object.
   - `client_version` (`string`): Arbitrary version identifier for the API client. When `null`, the `client_version` field will be omitted from the resulting object.
   - `labels` (`obj`): Unstructured key value map that can be used to organize and categorize objects. User-provided labels are shared with Google's billing system, so they can be used to filter, or break down billing charges by team, component,
 environment, state, etc. For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or https://cloud.google.com/run/docs/configuring/labels.
 
 Cloud Run API v2 does not support labels with 'run.googleapis.com', 'cloud.googleapis.com', 'serving.knative.dev', or 'autoscaling.knative.dev' namespaces, and they will be rejected.
-All system labels in v1 now have a corresponding field in v2 Job. When `null`, the `labels` field will be omitted from the resulting object.
+All system labels in v1 now have a corresponding field in v2 Job.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `launch_stage` (`string`): The launch stage as defined by [Google Cloud Platform Launch Stages](https://cloud.google.com/products#product-launch-stages). Cloud Run supports ALPHA, BETA, and GA.
 If no value is specified, GA is assumed. Set the launch stage to a preview stage on input to allow use of preview features in that stage. On read (or output), describes whether the resource uses preview features.
 
 For example, if ALPHA is provided as input, but only BETA and GA-level features are used, this field will be BETA on output. Possible values: ["UNIMPLEMENTED", "PRELAUNCH", "EARLY_ACCESS", "ALPHA", "BETA", "GA", "DEPRECATED"] When `null`, the `launch_stage` field will be omitted from the resulting object.
-  - `location` (`string`): The location of the cloud run job When `null`, the `location` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the cloud run job
   - `name` (`string`): Name of the Job.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `binary_authorization` (`list[obj]`): Settings for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.binary_authorization.new](#fn-binary_authorizationnew) constructor.
@@ -160,19 +150,25 @@ injecting into a complete block.
 Cloud Run API v2 does not support annotations with 'run.googleapis.com', 'cloud.googleapis.com', 'serving.knative.dev', or 'autoscaling.knative.dev' namespaces, and they will be rejected on new resources.
 All system annotations in v1 now have a corresponding field in v2 Job.
 
-This field follows Kubernetes annotations' namespacing, limits, and rules. When `null`, the `annotations` field will be omitted from the resulting object.
+This field follows Kubernetes annotations' namespacing, limits, and rules.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `client` (`string`): Arbitrary identifier for the API client. When `null`, the `client` field will be omitted from the resulting object.
   - `client_version` (`string`): Arbitrary version identifier for the API client. When `null`, the `client_version` field will be omitted from the resulting object.
   - `labels` (`obj`): Unstructured key value map that can be used to organize and categorize objects. User-provided labels are shared with Google's billing system, so they can be used to filter, or break down billing charges by team, component,
 environment, state, etc. For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or https://cloud.google.com/run/docs/configuring/labels.
 
 Cloud Run API v2 does not support labels with 'run.googleapis.com', 'cloud.googleapis.com', 'serving.knative.dev', or 'autoscaling.knative.dev' namespaces, and they will be rejected.
-All system labels in v1 now have a corresponding field in v2 Job. When `null`, the `labels` field will be omitted from the resulting object.
+All system labels in v1 now have a corresponding field in v2 Job.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `launch_stage` (`string`): The launch stage as defined by [Google Cloud Platform Launch Stages](https://cloud.google.com/products#product-launch-stages). Cloud Run supports ALPHA, BETA, and GA.
 If no value is specified, GA is assumed. Set the launch stage to a preview stage on input to allow use of preview features in that stage. On read (or output), describes whether the resource uses preview features.
 
 For example, if ALPHA is provided as input, but only BETA and GA-level features are used, this field will be BETA on output. Possible values: ["UNIMPLEMENTED", "PRELAUNCH", "EARLY_ACCESS", "ALPHA", "BETA", "GA", "DEPRECATED"] When `null`, the `launch_stage` field will be omitted from the resulting object.
-  - `location` (`string`): The location of the cloud run job When `null`, the `location` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the cloud run job
   - `name` (`string`): Name of the Job.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `binary_authorization` (`list[obj]`): Settings for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.binary_authorization.new](#fn-binary_authorizationnew) constructor.
@@ -537,14 +533,10 @@ Terraform sub block.
   - `name` (`string`): Name of the container specified as a DNS_LABEL. When `null`, the `name` field will be omitted from the resulting object.
   - `working_dir` (`string`): Container's working directory. If not specified, the container runtime's default will be used, which might be configured in the container image. When `null`, the `working_dir` field will be omitted from the resulting object.
   - `env` (`list[obj]`): List of environment variables to set in the container. When `null`, the `env` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.env.new](#fn-templatetemplatetemplateenvnew) constructor.
-  - `liveness_probe` (`list[obj]`): Periodic probe of container liveness. Container will be restarted if the probe fails. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
-This field is not supported in Cloud Run Job currently. When `null`, the `liveness_probe` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.liveness_probe.new](#fn-templatetemplatetemplateliveness_probenew) constructor.
   - `ports` (`list[obj]`): List of ports to expose from the container. Only a single port can be specified. The specified ports must be listening on all interfaces (0.0.0.0) within the container to be accessible.
 
 If omitted, a port number will be chosen and passed to the container through the PORT environment variable for the container to listen on When `null`, the `ports` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.ports.new](#fn-templatetemplatetemplateportsnew) constructor.
   - `resources` (`list[obj]`): Compute Resource requirements by this container. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources When `null`, the `resources` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.resources.new](#fn-templatetemplatetemplateresourcesnew) constructor.
-  - `startup_probe` (`list[obj]`): Startup probe of application within the container. All other probes are disabled if a startup probe is provided, until it succeeds. Container will not be added to service endpoints if the probe fails. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
-This field is not supported in Cloud Run Job currently. When `null`, the `startup_probe` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.startup_probe.new](#fn-templatetemplatetemplatestartup_probenew) constructor.
   - `volume_mounts` (`list[obj]`): Volume to mount into the container's filesystem. When `null`, the `volume_mounts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.volume_mounts.new](#fn-templatetemplatetemplatevolume_mountsnew) constructor.
 
 **Returns**:
@@ -623,105 +615,6 @@ Terraform sub block.
   - An attribute object that represents the `secret_key_ref` sub block.
 
 
-## obj template.template.containers.liveness_probe
-
-
-
-### fn template.template.containers.liveness_probe.new
-
-```ts
-new()
-```
-
-
-`google.cloud_run_v2_job.template.template.containers.liveness_probe.new` constructs a new object with attributes and blocks configured for the `liveness_probe`
-Terraform sub block.
-
-
-
-**Args**:
-  - `failure_threshold` (`number`): Minimum consecutive failures for the probe to be considered failed after having succeeded. Defaults to 3. Minimum value is 1. When `null`, the `failure_threshold` field will be omitted from the resulting object.
-  - `initial_delay_seconds` (`number`): Number of seconds after the container has started before the probe is initiated. Defaults to 0 seconds. Minimum value is 0. Maximum value for liveness probe is 3600. Maximum value for startup probe is 240. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes When `null`, the `initial_delay_seconds` field will be omitted from the resulting object.
-  - `period_seconds` (`number`): How often (in seconds) to perform the probe. Default to 10 seconds. Minimum value is 1. Maximum value for liveness probe is 3600. Maximum value for startup probe is 240. Must be greater or equal than timeoutSeconds When `null`, the `period_seconds` field will be omitted from the resulting object.
-  - `timeout_seconds` (`number`): Number of seconds after which the probe times out. Defaults to 1 second. Minimum value is 1. Maximum value is 3600. Must be smaller than periodSeconds. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes When `null`, the `timeout_seconds` field will be omitted from the resulting object.
-  - `http_get` (`list[obj]`): HTTPGet specifies the http request to perform. Exactly one of HTTPGet or TCPSocket must be specified. When `null`, the `http_get` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.liveness_probe.http_get.new](#fn-templatetemplatetemplatecontainershttp_getnew) constructor.
-  - `tcp_socket` (`list[obj]`): TCPSocket specifies an action involving a TCP port. Exactly one of HTTPGet or TCPSocket must be specified. When `null`, the `tcp_socket` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.liveness_probe.tcp_socket.new](#fn-templatetemplatetemplatecontainerstcp_socketnew) constructor.
-
-**Returns**:
-  - An attribute object that represents the `liveness_probe` sub block.
-
-
-## obj template.template.containers.liveness_probe.http_get
-
-
-
-### fn template.template.containers.liveness_probe.http_get.new
-
-```ts
-new()
-```
-
-
-`google.cloud_run_v2_job.template.template.containers.liveness_probe.http_get.new` constructs a new object with attributes and blocks configured for the `http_get`
-Terraform sub block.
-
-
-
-**Args**:
-  - `path` (`string`): Path to access on the HTTP server. Defaults to '/'. When `null`, the `path` field will be omitted from the resulting object.
-  - `http_headers` (`list[obj]`): Custom headers to set in the request. HTTP allows repeated headers. When `null`, the `http_headers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.liveness_probe.http_get.http_headers.new](#fn-templatetemplatetemplatecontainersliveness_probehttp_headersnew) constructor.
-
-**Returns**:
-  - An attribute object that represents the `http_get` sub block.
-
-
-## obj template.template.containers.liveness_probe.http_get.http_headers
-
-
-
-### fn template.template.containers.liveness_probe.http_get.http_headers.new
-
-```ts
-new()
-```
-
-
-`google.cloud_run_v2_job.template.template.containers.liveness_probe.http_get.http_headers.new` constructs a new object with attributes and blocks configured for the `http_headers`
-Terraform sub block.
-
-
-
-**Args**:
-  - `name` (`string`): The header field name
-  - `value` (`string`): The header field value When `null`, the `value` field will be omitted from the resulting object.
-
-**Returns**:
-  - An attribute object that represents the `http_headers` sub block.
-
-
-## obj template.template.containers.liveness_probe.tcp_socket
-
-
-
-### fn template.template.containers.liveness_probe.tcp_socket.new
-
-```ts
-new()
-```
-
-
-`google.cloud_run_v2_job.template.template.containers.liveness_probe.tcp_socket.new` constructs a new object with attributes and blocks configured for the `tcp_socket`
-Terraform sub block.
-
-
-
-**Args**:
-  - `port` (`number`): Port number to access on the container. Must be in the range 1 to 65535. If not specified, defaults to 8080. When `null`, the `port` field will be omitted from the resulting object.
-
-**Returns**:
-  - An attribute object that represents the `tcp_socket` sub block.
-
-
 ## obj template.template.containers.ports
 
 
@@ -769,105 +662,6 @@ Terraform sub block.
   - An attribute object that represents the `resources` sub block.
 
 
-## obj template.template.containers.startup_probe
-
-
-
-### fn template.template.containers.startup_probe.new
-
-```ts
-new()
-```
-
-
-`google.cloud_run_v2_job.template.template.containers.startup_probe.new` constructs a new object with attributes and blocks configured for the `startup_probe`
-Terraform sub block.
-
-
-
-**Args**:
-  - `failure_threshold` (`number`): Minimum consecutive failures for the probe to be considered failed after having succeeded. Defaults to 3. Minimum value is 1. When `null`, the `failure_threshold` field will be omitted from the resulting object.
-  - `initial_delay_seconds` (`number`): Number of seconds after the container has started before the probe is initiated. Defaults to 0 seconds. Minimum value is 0. Maximum value for liveness probe is 3600. Maximum value for startup probe is 240. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes When `null`, the `initial_delay_seconds` field will be omitted from the resulting object.
-  - `period_seconds` (`number`): How often (in seconds) to perform the probe. Default to 10 seconds. Minimum value is 1. Maximum value for liveness probe is 3600. Maximum value for startup probe is 240. Must be greater or equal than timeoutSeconds When `null`, the `period_seconds` field will be omitted from the resulting object.
-  - `timeout_seconds` (`number`): Number of seconds after which the probe times out. Defaults to 1 second. Minimum value is 1. Maximum value is 3600. Must be smaller than periodSeconds. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes When `null`, the `timeout_seconds` field will be omitted from the resulting object.
-  - `http_get` (`list[obj]`): HTTPGet specifies the http request to perform. Exactly one of HTTPGet or TCPSocket must be specified. When `null`, the `http_get` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.startup_probe.http_get.new](#fn-templatetemplatetemplatecontainershttp_getnew) constructor.
-  - `tcp_socket` (`list[obj]`): TCPSocket specifies an action involving a TCP port. Exactly one of HTTPGet or TCPSocket must be specified. When `null`, the `tcp_socket` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.startup_probe.tcp_socket.new](#fn-templatetemplatetemplatecontainerstcp_socketnew) constructor.
-
-**Returns**:
-  - An attribute object that represents the `startup_probe` sub block.
-
-
-## obj template.template.containers.startup_probe.http_get
-
-
-
-### fn template.template.containers.startup_probe.http_get.new
-
-```ts
-new()
-```
-
-
-`google.cloud_run_v2_job.template.template.containers.startup_probe.http_get.new` constructs a new object with attributes and blocks configured for the `http_get`
-Terraform sub block.
-
-
-
-**Args**:
-  - `path` (`string`): Path to access on the HTTP server. Defaults to '/'. When `null`, the `path` field will be omitted from the resulting object.
-  - `http_headers` (`list[obj]`): Custom headers to set in the request. HTTP allows repeated headers. When `null`, the `http_headers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_job.template.template.containers.startup_probe.http_get.http_headers.new](#fn-templatetemplatetemplatecontainersstartup_probehttp_headersnew) constructor.
-
-**Returns**:
-  - An attribute object that represents the `http_get` sub block.
-
-
-## obj template.template.containers.startup_probe.http_get.http_headers
-
-
-
-### fn template.template.containers.startup_probe.http_get.http_headers.new
-
-```ts
-new()
-```
-
-
-`google.cloud_run_v2_job.template.template.containers.startup_probe.http_get.http_headers.new` constructs a new object with attributes and blocks configured for the `http_headers`
-Terraform sub block.
-
-
-
-**Args**:
-  - `name` (`string`): The header field name
-  - `value` (`string`): The header field value When `null`, the `value` field will be omitted from the resulting object.
-
-**Returns**:
-  - An attribute object that represents the `http_headers` sub block.
-
-
-## obj template.template.containers.startup_probe.tcp_socket
-
-
-
-### fn template.template.containers.startup_probe.tcp_socket.new
-
-```ts
-new()
-```
-
-
-`google.cloud_run_v2_job.template.template.containers.startup_probe.tcp_socket.new` constructs a new object with attributes and blocks configured for the `tcp_socket`
-Terraform sub block.
-
-
-
-**Args**:
-  - `port` (`number`): Port number to access on the container. Must be in the range 1 to 65535. If not specified, defaults to 8080. When `null`, the `port` field will be omitted from the resulting object.
-
-**Returns**:
-  - An attribute object that represents the `tcp_socket` sub block.
-
-
 ## obj template.template.containers.volume_mounts
 
 
diff --git a/docs/4.x/cloud_run_v2_service.md b/docs/4.x/cloud_run_v2_service.md
index 43aaa411..6f169902 100644
--- a/docs/4.x/cloud_run_v2_service.md
+++ b/docs/4.x/cloud_run_v2_service.md
@@ -53,8 +53,6 @@ This package contains functions and utilities for setting up the resource using
         * [`fn new()`](#fn-templatecontainersliveness_probehttp_getnew)
         * [`obj template.containers.liveness_probe.http_get.http_headers`](#obj-templatecontainersliveness_probehttp_gethttp_headers)
           * [`fn new()`](#fn-templatecontainersliveness_probehttp_gethttp_headersnew)
-      * [`obj template.containers.liveness_probe.tcp_socket`](#obj-templatecontainersliveness_probetcp_socket)
-        * [`fn new()`](#fn-templatecontainersliveness_probetcp_socketnew)
     * [`obj template.containers.ports`](#obj-templatecontainersports)
       * [`fn new()`](#fn-templatecontainersportsnew)
     * [`obj template.containers.resources`](#obj-templatecontainersresources)
@@ -124,7 +122,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 Cloud Run API v2 does not support annotations with 'run.googleapis.com', 'cloud.googleapis.com', 'serving.knative.dev', or 'autoscaling.knative.dev' namespaces, and they will be rejected in new resources.
 All system annotations in v1 now have a corresponding field in v2 Service.
 
-This field follows Kubernetes annotations' namespacing, limits, and rules. When `null`, the `annotations` field will be omitted from the resulting object.
+This field follows Kubernetes annotations' namespacing, limits, and rules.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `client` (`string`): Arbitrary identifier for the API client. When `null`, the `client` field will be omitted from the resulting object.
   - `client_version` (`string`): Arbitrary version identifier for the API client. When `null`, the `client_version` field will be omitted from the resulting object.
   - `description` (`string`): User-provided description of the Service. This field currently has a 512-character limit. When `null`, the `description` field will be omitted from the resulting object.
@@ -133,12 +134,15 @@ This field follows Kubernetes annotations' namespacing, limits, and rules. W
 environment, state, etc. For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or https://cloud.google.com/run/docs/configuring/labels.
 
 Cloud Run API v2 does not support labels with  'run.googleapis.com', 'cloud.googleapis.com', 'serving.knative.dev', or 'autoscaling.knative.dev' namespaces, and they will be rejected.
-All system labels in v1 now have a corresponding field in v2 Service. When `null`, the `labels` field will be omitted from the resulting object.
+All system labels in v1 now have a corresponding field in v2 Service.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `launch_stage` (`string`): The launch stage as defined by [Google Cloud Platform Launch Stages](https://cloud.google.com/products#product-launch-stages). Cloud Run supports ALPHA, BETA, and GA.
 If no value is specified, GA is assumed. Set the launch stage to a preview stage on input to allow use of preview features in that stage. On read (or output), describes whether the resource uses preview features.
 
 For example, if ALPHA is provided as input, but only BETA and GA-level features are used, this field will be BETA on output. Possible values: ["UNIMPLEMENTED", "PRELAUNCH", "EARLY_ACCESS", "ALPHA", "BETA", "GA", "DEPRECATED"] When `null`, the `launch_stage` field will be omitted from the resulting object.
-  - `location` (`string`): The location of the cloud run service When `null`, the `location` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the cloud run service
   - `name` (`string`): Name of the Service.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `binary_authorization` (`list[obj]`): Settings for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.binary_authorization.new](#fn-binary_authorizationnew) constructor.
@@ -173,7 +177,10 @@ injecting into a complete block.
 Cloud Run API v2 does not support annotations with 'run.googleapis.com', 'cloud.googleapis.com', 'serving.knative.dev', or 'autoscaling.knative.dev' namespaces, and they will be rejected in new resources.
 All system annotations in v1 now have a corresponding field in v2 Service.
 
-This field follows Kubernetes annotations' namespacing, limits, and rules. When `null`, the `annotations` field will be omitted from the resulting object.
+This field follows Kubernetes annotations' namespacing, limits, and rules.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `client` (`string`): Arbitrary identifier for the API client. When `null`, the `client` field will be omitted from the resulting object.
   - `client_version` (`string`): Arbitrary version identifier for the API client. When `null`, the `client_version` field will be omitted from the resulting object.
   - `description` (`string`): User-provided description of the Service. This field currently has a 512-character limit. When `null`, the `description` field will be omitted from the resulting object.
@@ -182,12 +189,15 @@ This field follows Kubernetes annotations' namespacing, limits, and rules. W
 environment, state, etc. For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or https://cloud.google.com/run/docs/configuring/labels.
 
 Cloud Run API v2 does not support labels with  'run.googleapis.com', 'cloud.googleapis.com', 'serving.knative.dev', or 'autoscaling.knative.dev' namespaces, and they will be rejected.
-All system labels in v1 now have a corresponding field in v2 Service. When `null`, the `labels` field will be omitted from the resulting object.
+All system labels in v1 now have a corresponding field in v2 Service.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `launch_stage` (`string`): The launch stage as defined by [Google Cloud Platform Launch Stages](https://cloud.google.com/products#product-launch-stages). Cloud Run supports ALPHA, BETA, and GA.
 If no value is specified, GA is assumed. Set the launch stage to a preview stage on input to allow use of preview features in that stage. On read (or output), describes whether the resource uses preview features.
 
 For example, if ALPHA is provided as input, but only BETA and GA-level features are used, this field will be BETA on output. Possible values: ["UNIMPLEMENTED", "PRELAUNCH", "EARLY_ACCESS", "ALPHA", "BETA", "GA", "DEPRECATED"] When `null`, the `launch_stage` field will be omitted from the resulting object.
-  - `location` (`string`): The location of the cloud run service When `null`, the `location` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the cloud run service
   - `name` (`string`): Name of the Service.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `binary_authorization` (`list[obj]`): Settings for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.binary_authorization.new](#fn-binary_authorizationnew) constructor.
@@ -706,7 +716,6 @@ Terraform sub block.
   - `timeout_seconds` (`number`): Number of seconds after which the probe times out. Defaults to 1 second. Minimum value is 1. Maximum value is 3600. Must be smaller than periodSeconds. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes When `null`, the `timeout_seconds` field will be omitted from the resulting object.
   - `grpc` (`list[obj]`): GRPC specifies an action involving a GRPC port. When `null`, the `grpc` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.liveness_probe.grpc.new](#fn-templatetemplatecontainersgrpcnew) constructor.
   - `http_get` (`list[obj]`): HTTPGet specifies the http request to perform. When `null`, the `http_get` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.liveness_probe.http_get.new](#fn-templatetemplatecontainershttp_getnew) constructor.
-  - `tcp_socket` (`list[obj]`): TCPSocket specifies an action involving a TCP port. This field is not supported in liveness probe currently. When `null`, the `tcp_socket` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloud_run_v2_service.template.containers.liveness_probe.tcp_socket.new](#fn-templatetemplatecontainerstcp_socketnew) constructor.
 
 **Returns**:
   - An attribute object that represents the `liveness_probe` sub block.
@@ -789,29 +798,6 @@ Terraform sub block.
   - An attribute object that represents the `http_headers` sub block.
 
 
-## obj template.containers.liveness_probe.tcp_socket
-
-
-
-### fn template.containers.liveness_probe.tcp_socket.new
-
-```ts
-new()
-```
-
-
-`google.cloud_run_v2_service.template.containers.liveness_probe.tcp_socket.new` constructs a new object with attributes and blocks configured for the `tcp_socket`
-Terraform sub block.
-
-
-
-**Args**:
-  - `port` (`number`): Port number to access on the container. Must be in the range 1 to 65535. If not specified, defaults to 8080. When `null`, the `port` field will be omitted from the resulting object.
-
-**Returns**:
-  - An attribute object that represents the `tcp_socket` sub block.
-
-
 ## obj template.containers.ports
 
 
diff --git a/docs/4.x/cloudbuild_worker_pool.md b/docs/4.x/cloudbuild_worker_pool.md
index e993c601..f17287da 100644
--- a/docs/4.x/cloudbuild_worker_pool.md
+++ b/docs/4.x/cloudbuild_worker_pool.md
@@ -62,7 +62,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `annotations` (`obj`): User specified annotations. See https://google.aip.dev/128#annotations for more details such as format and size limitations. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): User specified annotations. See https://google.aip.dev/128#annotations for more details such as format and size limitations.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `display_name` (`string`): A user-specified, human-readable name for the `WorkerPool`. If provided, this value must be 1-63 characters. When `null`, the `display_name` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): User-defined name of the `WorkerPool`.
@@ -93,7 +96,10 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `annotations` (`obj`): User specified annotations. See https://google.aip.dev/128#annotations for more details such as format and size limitations. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): User specified annotations. See https://google.aip.dev/128#annotations for more details such as format and size limitations.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `display_name` (`string`): A user-specified, human-readable name for the `WorkerPool`. If provided, this value must be 1-63 characters. When `null`, the `display_name` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): User-defined name of the `WorkerPool`.
diff --git a/docs/4.x/cloudbuildv2_connection.md b/docs/4.x/cloudbuildv2_connection.md
index 7a41b17f..768758fa 100644
--- a/docs/4.x/cloudbuildv2_connection.md
+++ b/docs/4.x/cloudbuildv2_connection.md
@@ -76,7 +76,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `annotations` (`obj`): Allows clients to store small amounts of arbitrary data. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): Allows clients to store small amounts of arbitrary data.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `disabled` (`bool`): If disabled is set to true, functionality is disabled for this connection. Repository based API methods and webhooks processing for repositories in this connection will be disabled. When `null`, the `disabled` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): Immutable. The resource name of the connection, in the format `projects/{project}/locations/{location}/connections/{connection_id}`.
@@ -108,7 +111,10 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `annotations` (`obj`): Allows clients to store small amounts of arbitrary data. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): Allows clients to store small amounts of arbitrary data.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `disabled` (`bool`): If disabled is set to true, functionality is disabled for this connection. Repository based API methods and webhooks processing for repositories in this connection will be disabled. When `null`, the `disabled` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): Immutable. The resource name of the connection, in the format `projects/{project}/locations/{location}/connections/{connection_id}`.
diff --git a/docs/4.x/cloudbuildv2_repository.md b/docs/4.x/cloudbuildv2_repository.md
index 2b78e6bb..f3d652ee 100644
--- a/docs/4.x/cloudbuildv2_repository.md
+++ b/docs/4.x/cloudbuildv2_repository.md
@@ -55,7 +55,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `annotations` (`obj`): Allows clients to store small amounts of arbitrary data. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): Allows clients to store small amounts of arbitrary data.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource When `null`, the `location` field will be omitted from the resulting object.
   - `name` (`string`): Name of the repository.
   - `parent_connection` (`string`): The connection for the resource
@@ -85,7 +88,10 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `annotations` (`obj`): Allows clients to store small amounts of arbitrary data. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): Allows clients to store small amounts of arbitrary data.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource When `null`, the `location` field will be omitted from the resulting object.
   - `name` (`string`): Name of the repository.
   - `parent_connection` (`string`): The connection for the resource
diff --git a/docs/4.x/clouddeploy_delivery_pipeline.md b/docs/4.x/clouddeploy_delivery_pipeline.md
index 682a2d58..697cd38b 100644
--- a/docs/4.x/clouddeploy_delivery_pipeline.md
+++ b/docs/4.x/clouddeploy_delivery_pipeline.md
@@ -86,9 +86,15 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `annotations` (`obj`): User annotations. These attributes can only be set and used by the user, and not by Google Cloud Deploy. See https://google.aip.dev/128#annotations for more details such as format and size limitations. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): User annotations. These attributes can only be set and used by the user, and not by Google Cloud Deploy. See https://google.aip.dev/128#annotations for more details such as format and size limitations.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `description` (`string`): Description of the `DeliveryPipeline`. Max length is 255 characters. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels are attributes that can be set and used by both the user and by Google Cloud Deploy. Labels must meet the following constraints: * Keys and values can contain only lowercase letters, numeric characters, underscores, and dashes. * All characters must use UTF-8 encoding, and international characters are allowed. * Keys must start with a lowercase letter or international character. * Each resource is limited to a maximum of 64 labels. Both keys and values are additionally constrained to be <= 128 bytes. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels are attributes that can be set and used by both the user and by Google Cloud Deploy. Labels must meet the following constraints: * Keys and values can contain only lowercase letters, numeric characters, underscores, and dashes. * All characters must use UTF-8 encoding, and international characters are allowed. * Keys must start with a lowercase letter or international character. * Each resource is limited to a maximum of 64 labels. Both keys and values are additionally constrained to be <= 128 bytes.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): Name of the `DeliveryPipeline`. Format is [a-z][a-z0-9\-]{0,62}.
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
@@ -118,9 +124,15 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `annotations` (`obj`): User annotations. These attributes can only be set and used by the user, and not by Google Cloud Deploy. See https://google.aip.dev/128#annotations for more details such as format and size limitations. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): User annotations. These attributes can only be set and used by the user, and not by Google Cloud Deploy. See https://google.aip.dev/128#annotations for more details such as format and size limitations.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `description` (`string`): Description of the `DeliveryPipeline`. Max length is 255 characters. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels are attributes that can be set and used by both the user and by Google Cloud Deploy. Labels must meet the following constraints: * Keys and values can contain only lowercase letters, numeric characters, underscores, and dashes. * All characters must use UTF-8 encoding, and international characters are allowed. * Keys must start with a lowercase letter or international character. * Each resource is limited to a maximum of 64 labels. Both keys and values are additionally constrained to be <= 128 bytes. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels are attributes that can be set and used by both the user and by Google Cloud Deploy. Labels must meet the following constraints: * Keys and values can contain only lowercase letters, numeric characters, underscores, and dashes. * All characters must use UTF-8 encoding, and international characters are allowed. * Keys must start with a lowercase letter or international character. * Each resource is limited to a maximum of 64 labels. Both keys and values are additionally constrained to be <= 128 bytes.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): Name of the `DeliveryPipeline`. Format is [a-z][a-z0-9\-]{0,62}.
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
diff --git a/docs/4.x/clouddeploy_target.md b/docs/4.x/clouddeploy_target.md
index b81667cc..74e7ddcd 100644
--- a/docs/4.x/clouddeploy_target.md
+++ b/docs/4.x/clouddeploy_target.md
@@ -77,10 +77,16 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `annotations` (`obj`): Optional. User annotations. These attributes can only be set and used by the user, and not by Google Cloud Deploy. See https://google.aip.dev/128#annotations for more details such as format and size limitations. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): Optional. User annotations. These attributes can only be set and used by the user, and not by Google Cloud Deploy. See https://google.aip.dev/128#annotations for more details such as format and size limitations.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `deploy_parameters` (`obj`): Optional. The deploy parameters to use for this target. When `null`, the `deploy_parameters` field will be omitted from the resulting object.
   - `description` (`string`): Optional. Description of the `Target`. Max length is 255 characters. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional. Labels are attributes that can be set and used by both the user and by Google Cloud Deploy. Labels must meet the following constraints: * Keys and values can contain only lowercase letters, numeric characters, underscores, and dashes. * All characters must use UTF-8 encoding, and international characters are allowed. * Keys must start with a lowercase letter or international character. * Each resource is limited to a maximum of 64 labels. Both keys and values are additionally constrained to be <= 128 bytes. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. Labels are attributes that can be set and used by both the user and by Google Cloud Deploy. Labels must meet the following constraints: * Keys and values can contain only lowercase letters, numeric characters, underscores, and dashes. * All characters must use UTF-8 encoding, and international characters are allowed. * Keys must start with a lowercase letter or international character. * Each resource is limited to a maximum of 64 labels. Both keys and values are additionally constrained to be <= 128 bytes.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): Name of the `Target`. Format is [a-z][a-z0-9\-]{0,62}.
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
@@ -114,10 +120,16 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `annotations` (`obj`): Optional. User annotations. These attributes can only be set and used by the user, and not by Google Cloud Deploy. See https://google.aip.dev/128#annotations for more details such as format and size limitations. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): Optional. User annotations. These attributes can only be set and used by the user, and not by Google Cloud Deploy. See https://google.aip.dev/128#annotations for more details such as format and size limitations.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `deploy_parameters` (`obj`): Optional. The deploy parameters to use for this target. When `null`, the `deploy_parameters` field will be omitted from the resulting object.
   - `description` (`string`): Optional. Description of the `Target`. Max length is 255 characters. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional. Labels are attributes that can be set and used by both the user and by Google Cloud Deploy. Labels must meet the following constraints: * Keys and values can contain only lowercase letters, numeric characters, underscores, and dashes. * All characters must use UTF-8 encoding, and international characters are allowed. * Keys must start with a lowercase letter or international character. * Each resource is limited to a maximum of 64 labels. Both keys and values are additionally constrained to be <= 128 bytes. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. Labels are attributes that can be set and used by both the user and by Google Cloud Deploy. Labels must meet the following constraints: * Keys and values can contain only lowercase letters, numeric characters, underscores, and dashes. * All characters must use UTF-8 encoding, and international characters are allowed. * Keys must start with a lowercase letter or international character. * Each resource is limited to a maximum of 64 labels. Both keys and values are additionally constrained to be <= 128 bytes.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): Name of the `Target`. Format is [a-z][a-z0-9\-]{0,62}.
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
diff --git a/docs/4.x/cloudfunctions2_function.md b/docs/4.x/cloudfunctions2_function.md
index c02528fe..d6884c87 100644
--- a/docs/4.x/cloudfunctions2_function.md
+++ b/docs/4.x/cloudfunctions2_function.md
@@ -84,8 +84,12 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `description` (`string`): User-provided description of a function. When `null`, the `description` field will be omitted from the resulting object.
   - `kms_key_name` (`string`): Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources.
 It must match the pattern projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}. When `null`, the `kms_key_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs associated with this Cloud Function. When `null`, the `labels` field will be omitted from the resulting object.
-  - `location` (`string`): The location of this cloud function. When `null`, the `location` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs associated with this Cloud Function.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): The location of this cloud function.
   - `name` (`string`): A user-defined name of the function. Function names must
 be unique globally and match pattern 'projects/*/locations/*/functions/*'.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
@@ -121,8 +125,12 @@ injecting into a complete block.
   - `description` (`string`): User-provided description of a function. When `null`, the `description` field will be omitted from the resulting object.
   - `kms_key_name` (`string`): Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources.
 It must match the pattern projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}. When `null`, the `kms_key_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs associated with this Cloud Function. When `null`, the `labels` field will be omitted from the resulting object.
-  - `location` (`string`): The location of this cloud function. When `null`, the `location` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs associated with this Cloud Function.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): The location of this cloud function.
   - `name` (`string`): A user-defined name of the function. Function names must
 be unique globally and match pattern 'projects/*/locations/*/functions/*'.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
diff --git a/docs/4.x/cloudfunctions_function.md b/docs/4.x/cloudfunctions_function.md
index 9fb8488e..e85d2a46 100644
--- a/docs/4.x/cloudfunctions_function.md
+++ b/docs/4.x/cloudfunctions_function.md
@@ -107,7 +107,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `https_trigger_url` (`string`): URL which triggers function execution. Returned only if trigger_http is used. When `null`, the `https_trigger_url` field will be omitted from the resulting object.
   - `ingress_settings` (`string`): String value that controls what traffic can reach the function. Allowed values are ALLOW_ALL and ALLOW_INTERNAL_ONLY. Changes to this field will recreate the cloud function. When `null`, the `ingress_settings` field will be omitted from the resulting object.
   - `kms_key_name` (`string`): Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources. When `null`, the `kms_key_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to the function. Label keys must follow the requirements at https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to the function. Label keys must follow the requirements at https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements.
+
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `max_instances` (`number`): The limit on the maximum number of function instances that may coexist at a given time. When `null`, the `max_instances` field will be omitted from the resulting object.
   - `min_instances` (`number`): The limit on the minimum number of function instances that may coexist at a given time. When `null`, the `min_instances` field will be omitted from the resulting object.
   - `name` (`string`): A user-defined name of the function. Function names must be unique globally.
@@ -161,7 +164,10 @@ injecting into a complete block.
   - `https_trigger_url` (`string`): URL which triggers function execution. Returned only if trigger_http is used. When `null`, the `https_trigger_url` field will be omitted from the resulting object.
   - `ingress_settings` (`string`): String value that controls what traffic can reach the function. Allowed values are ALLOW_ALL and ALLOW_INTERNAL_ONLY. Changes to this field will recreate the cloud function. When `null`, the `ingress_settings` field will be omitted from the resulting object.
   - `kms_key_name` (`string`): Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources. When `null`, the `kms_key_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to the function. Label keys must follow the requirements at https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to the function. Label keys must follow the requirements at https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements.
+
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `max_instances` (`number`): The limit on the maximum number of function instances that may coexist at a given time. When `null`, the `max_instances` field will be omitted from the resulting object.
   - `min_instances` (`number`): The limit on the minimum number of function instances that may coexist at a given time. When `null`, the `min_instances` field will be omitted from the resulting object.
   - `name` (`string`): A user-defined name of the function. Function names must be unique globally.
diff --git a/docs/4.x/cloudiot_device.md b/docs/4.x/cloudiot_device.md
deleted file mode 100644
index f1fa710f..00000000
--- a/docs/4.x/cloudiot_device.md
+++ /dev/null
@@ -1,395 +0,0 @@
----
-permalink: /cloudiot_device/
----
-
-# cloudiot_device
-
-`cloudiot_device` represents the `google_cloudiot_device` Terraform resource.
-
-
-
-This package contains functions and utilities for setting up the resource using Jsonnet code.
-
-
-## Index
-
-* [`fn new()`](#fn-new)
-* [`fn newAttrs()`](#fn-newattrs)
-* [`fn withBlocked()`](#fn-withblocked)
-* [`fn withCredentials()`](#fn-withcredentials)
-* [`fn withCredentialsMixin()`](#fn-withcredentialsmixin)
-* [`fn withGatewayConfig()`](#fn-withgatewayconfig)
-* [`fn withGatewayConfigMixin()`](#fn-withgatewayconfigmixin)
-* [`fn withLogLevel()`](#fn-withloglevel)
-* [`fn withMetadata()`](#fn-withmetadata)
-* [`fn withName()`](#fn-withname)
-* [`fn withRegistry()`](#fn-withregistry)
-* [`fn withTimeouts()`](#fn-withtimeouts)
-* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
-* [`obj credentials`](#obj-credentials)
-  * [`fn new()`](#fn-credentialsnew)
-  * [`obj credentials.public_key`](#obj-credentialspublic_key)
-    * [`fn new()`](#fn-credentialspublic_keynew)
-* [`obj gateway_config`](#obj-gateway_config)
-  * [`fn new()`](#fn-gateway_confignew)
-* [`obj timeouts`](#obj-timeouts)
-  * [`fn new()`](#fn-timeoutsnew)
-
-## Fields
-
-### fn new
-
-```ts
-new()
-```
-
-
-`google.cloudiot_device.new` injects a new `google_cloudiot_device` Terraform `resource`
-block into the root module document.
-
-Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
-resource. For example, if you added a new instance to the root using:
-
-    # arguments omitted for brevity
-    google.cloudiot_device.new('some_id')
-
-You can get the reference to the `id` field of the created `google.cloudiot_device` using the reference:
-
-    $._ref.google_cloudiot_device.some_id.get('id')
-
-This is the same as directly entering `"${ google_cloudiot_device.some_id.id }"` as the value.
-
-NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
-or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block.
-  - `blocked` (`bool`): If a device is blocked, connections or requests from this device will fail. When `null`, the `blocked` field will be omitted from the resulting object.
-  - `log_level` (`string`): The logging verbosity for device activity. Possible values: ["NONE", "ERROR", "INFO", "DEBUG"] When `null`, the `log_level` field will be omitted from the resulting object.
-  - `metadata` (`obj`): The metadata key-value pairs assigned to the device. When `null`, the `metadata` field will be omitted from the resulting object.
-  - `name` (`string`): A unique name for the resource.
-  - `registry` (`string`): The name of the device registry where this device should be created.
-  - `credentials` (`list[obj]`): The credentials used to authenticate this device. When `null`, the `credentials` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_device.credentials.new](#fn-credentialsnew) constructor.
-  - `gateway_config` (`list[obj]`): Gateway-related configuration and state. When `null`, the `gateway_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_device.gateway_config.new](#fn-gateway_confignew) constructor.
-  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_device.timeouts.new](#fn-timeoutsnew) constructor.
-
-**Returns**:
-- A mixin object that injects the new resource into the root Terraform configuration.
-
-
-### fn newAttrs
-
-```ts
-newAttrs()
-```
-
-
-`google.cloudiot_device.newAttrs` constructs a new object with attributes and blocks configured for the `cloudiot_device`
-Terraform resource.
-
-Unlike [google.cloudiot_device.new](#fn-new), this function will not inject the `resource`
-block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
-[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
-
-This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
-injecting into a complete block.
-
-**Args**:
-  - `blocked` (`bool`): If a device is blocked, connections or requests from this device will fail. When `null`, the `blocked` field will be omitted from the resulting object.
-  - `log_level` (`string`): The logging verbosity for device activity. Possible values: ["NONE", "ERROR", "INFO", "DEBUG"] When `null`, the `log_level` field will be omitted from the resulting object.
-  - `metadata` (`obj`): The metadata key-value pairs assigned to the device. When `null`, the `metadata` field will be omitted from the resulting object.
-  - `name` (`string`): A unique name for the resource.
-  - `registry` (`string`): The name of the device registry where this device should be created.
-  - `credentials` (`list[obj]`): The credentials used to authenticate this device. When `null`, the `credentials` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_device.credentials.new](#fn-credentialsnew) constructor.
-  - `gateway_config` (`list[obj]`): Gateway-related configuration and state. When `null`, the `gateway_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_device.gateway_config.new](#fn-gateway_confignew) constructor.
-  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_device.timeouts.new](#fn-timeoutsnew) constructor.
-
-**Returns**:
-  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudiot_device` resource into the root Terraform configuration.
-
-
-### fn withBlocked
-
-```ts
-withBlocked()
-```
-
-`google.bool.withBlocked` constructs a mixin object that can be merged into the `bool`
-Terraform resource block to set or update the blocked field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`bool`): The value to set for the `blocked` field.
-
-
-### fn withCredentials
-
-```ts
-withCredentials()
-```
-
-`google.list[obj].withCredentials` constructs a mixin object that can be merged into the `list[obj]`
-Terraform resource block to set or update the credentials field.
-
-This function will replace the array with the passed in `value`. If you wish to instead append the
-passed in value to the existing array, use the [google.list[obj].withCredentialsMixin](TODO) function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`list[obj]`): The value to set for the `credentials` field.
-
-
-### fn withCredentialsMixin
-
-```ts
-withCredentialsMixin()
-```
-
-`google.list[obj].withCredentialsMixin` constructs a mixin object that can be merged into the `list[obj]`
-Terraform resource block to set or update the credentials field.
-
-This function will append the passed in array or object to the existing array. If you wish
-to instead replace the array with the passed in `value`, use the [google.list[obj].withCredentials](TODO)
-function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`list[obj]`): The value to set for the `credentials` field.
-
-
-### fn withGatewayConfig
-
-```ts
-withGatewayConfig()
-```
-
-`google.list[obj].withGatewayConfig` constructs a mixin object that can be merged into the `list[obj]`
-Terraform resource block to set or update the gateway_config field.
-
-This function will replace the array with the passed in `value`. If you wish to instead append the
-passed in value to the existing array, use the [google.list[obj].withGatewayConfigMixin](TODO) function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`list[obj]`): The value to set for the `gateway_config` field.
-
-
-### fn withGatewayConfigMixin
-
-```ts
-withGatewayConfigMixin()
-```
-
-`google.list[obj].withGatewayConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
-Terraform resource block to set or update the gateway_config field.
-
-This function will append the passed in array or object to the existing array. If you wish
-to instead replace the array with the passed in `value`, use the [google.list[obj].withGatewayConfig](TODO)
-function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`list[obj]`): The value to set for the `gateway_config` field.
-
-
-### fn withLogLevel
-
-```ts
-withLogLevel()
-```
-
-`google.string.withLogLevel` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the log_level field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `log_level` field.
-
-
-### fn withMetadata
-
-```ts
-withMetadata()
-```
-
-`google.obj.withMetadata` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the metadata field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `metadata` field.
-
-
-### fn withName
-
-```ts
-withName()
-```
-
-`google.string.withName` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the name field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `name` field.
-
-
-### fn withRegistry
-
-```ts
-withRegistry()
-```
-
-`google.string.withRegistry` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the registry field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `registry` field.
-
-
-### fn withTimeouts
-
-```ts
-withTimeouts()
-```
-
-`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the timeouts field.
-
-This function will replace the map with the passed in `value`. If you wish to instead merge the
-passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `timeouts` field.
-
-
-### fn withTimeoutsMixin
-
-```ts
-withTimeoutsMixin()
-```
-
-`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the timeouts field.
-
-This function will merge the passed in value to the existing map. If you wish
-to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
-function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `timeouts` field.
-
-
-## obj credentials
-
-
-
-### fn credentials.new
-
-```ts
-new()
-```
-
-
-`google.cloudiot_device.credentials.new` constructs a new object with attributes and blocks configured for the `credentials`
-Terraform sub block.
-
-
-
-**Args**:
-  - `expiration_time` (`string`): The time at which this credential becomes invalid. When `null`, the `expiration_time` field will be omitted from the resulting object.
-  - `public_key` (`list[obj]`): A public key used to verify the signature of JSON Web Tokens (JWTs). When `null`, the `public_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_device.credentials.public_key.new](#fn-credentialspublic_keynew) constructor.
-
-**Returns**:
-  - An attribute object that represents the `credentials` sub block.
-
-
-## obj credentials.public_key
-
-
-
-### fn credentials.public_key.new
-
-```ts
-new()
-```
-
-
-`google.cloudiot_device.credentials.public_key.new` constructs a new object with attributes and blocks configured for the `public_key`
-Terraform sub block.
-
-
-
-**Args**:
-  - `format` (`string`): The format of the key. Possible values: ["RSA_PEM", "RSA_X509_PEM", "ES256_PEM", "ES256_X509_PEM"]
-  - `key` (`string`): The key data.
-
-**Returns**:
-  - An attribute object that represents the `public_key` sub block.
-
-
-## obj gateway_config
-
-
-
-### fn gateway_config.new
-
-```ts
-new()
-```
-
-
-`google.cloudiot_device.gateway_config.new` constructs a new object with attributes and blocks configured for the `gateway_config`
-Terraform sub block.
-
-
-
-**Args**:
-  - `gateway_auth_method` (`string`): Indicates whether the device is a gateway. Possible values: ["ASSOCIATION_ONLY", "DEVICE_AUTH_TOKEN_ONLY", "ASSOCIATION_AND_DEVICE_AUTH_TOKEN"] When `null`, the `gateway_auth_method` field will be omitted from the resulting object.
-  - `gateway_type` (`string`): Indicates whether the device is a gateway. Default value: "NON_GATEWAY" Possible values: ["GATEWAY", "NON_GATEWAY"] When `null`, the `gateway_type` field will be omitted from the resulting object.
-
-**Returns**:
-  - An attribute object that represents the `gateway_config` sub block.
-
-
-## obj timeouts
-
-
-
-### fn timeouts.new
-
-```ts
-new()
-```
-
-
-`google.cloudiot_device.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
-Terraform sub block.
-
-
-
-**Args**:
-  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
-  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
-  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
-
-**Returns**:
-  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/cloudiot_registry.md b/docs/4.x/cloudiot_registry.md
deleted file mode 100644
index f8f91901..00000000
--- a/docs/4.x/cloudiot_registry.md
+++ /dev/null
@@ -1,422 +0,0 @@
----
-permalink: /cloudiot_registry/
----
-
-# cloudiot_registry
-
-`cloudiot_registry` represents the `google_cloudiot_registry` Terraform resource.
-
-
-
-This package contains functions and utilities for setting up the resource using Jsonnet code.
-
-
-## Index
-
-* [`fn new()`](#fn-new)
-* [`fn newAttrs()`](#fn-newattrs)
-* [`fn withCredentials()`](#fn-withcredentials)
-* [`fn withCredentialsMixin()`](#fn-withcredentialsmixin)
-* [`fn withEventNotificationConfigs()`](#fn-witheventnotificationconfigs)
-* [`fn withEventNotificationConfigsMixin()`](#fn-witheventnotificationconfigsmixin)
-* [`fn withHttpConfig()`](#fn-withhttpconfig)
-* [`fn withLogLevel()`](#fn-withloglevel)
-* [`fn withMqttConfig()`](#fn-withmqttconfig)
-* [`fn withName()`](#fn-withname)
-* [`fn withProject()`](#fn-withproject)
-* [`fn withRegion()`](#fn-withregion)
-* [`fn withStateNotificationConfig()`](#fn-withstatenotificationconfig)
-* [`fn withTimeouts()`](#fn-withtimeouts)
-* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
-* [`obj credentials`](#obj-credentials)
-  * [`fn new()`](#fn-credentialsnew)
-* [`obj event_notification_configs`](#obj-event_notification_configs)
-  * [`fn new()`](#fn-event_notification_configsnew)
-* [`obj timeouts`](#obj-timeouts)
-  * [`fn new()`](#fn-timeoutsnew)
-
-## Fields
-
-### fn new
-
-```ts
-new()
-```
-
-
-`google.cloudiot_registry.new` injects a new `google_cloudiot_registry` Terraform `resource`
-block into the root module document.
-
-Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
-resource. For example, if you added a new instance to the root using:
-
-    # arguments omitted for brevity
-    google.cloudiot_registry.new('some_id')
-
-You can get the reference to the `id` field of the created `google.cloudiot_registry` using the reference:
-
-    $._ref.google_cloudiot_registry.some_id.get('id')
-
-This is the same as directly entering `"${ google_cloudiot_registry.some_id.id }"` as the value.
-
-NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
-or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block.
-  - `http_config` (`obj`): Activate or deactivate HTTP. When `null`, the `http_config` field will be omitted from the resulting object.
-  - `log_level` (`string`): The default logging verbosity for activity from devices in this
-registry. Specifies which events should be written to logs. For
-example, if the LogLevel is ERROR, only events that terminate in
-errors will be logged. LogLevel is inclusive; enabling INFO logging
-will also enable ERROR logging. Default value: "NONE" Possible values: ["NONE", "ERROR", "INFO", "DEBUG"] When `null`, the `log_level` field will be omitted from the resulting object.
-  - `mqtt_config` (`obj`): Activate or deactivate MQTT. When `null`, the `mqtt_config` field will be omitted from the resulting object.
-  - `name` (`string`): A unique name for the resource, required by device registry.
-  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
-  - `region` (`string`): The region in which the created registry should reside.
-If it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.
-  - `state_notification_config` (`obj`): A PubSub topic to publish device state updates. When `null`, the `state_notification_config` field will be omitted from the resulting object.
-  - `credentials` (`list[obj]`): List of public key certificates to authenticate devices. When `null`, the `credentials` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry.credentials.new](#fn-credentialsnew) constructor.
-  - `event_notification_configs` (`list[obj]`): List of configurations for event notifications, such as PubSub topics
-to publish device events to. When `null`, the `event_notification_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry.event_notification_configs.new](#fn-event_notification_configsnew) constructor.
-  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry.timeouts.new](#fn-timeoutsnew) constructor.
-
-**Returns**:
-- A mixin object that injects the new resource into the root Terraform configuration.
-
-
-### fn newAttrs
-
-```ts
-newAttrs()
-```
-
-
-`google.cloudiot_registry.newAttrs` constructs a new object with attributes and blocks configured for the `cloudiot_registry`
-Terraform resource.
-
-Unlike [google.cloudiot_registry.new](#fn-new), this function will not inject the `resource`
-block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
-[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
-
-This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
-injecting into a complete block.
-
-**Args**:
-  - `http_config` (`obj`): Activate or deactivate HTTP. When `null`, the `http_config` field will be omitted from the resulting object.
-  - `log_level` (`string`): The default logging verbosity for activity from devices in this
-registry. Specifies which events should be written to logs. For
-example, if the LogLevel is ERROR, only events that terminate in
-errors will be logged. LogLevel is inclusive; enabling INFO logging
-will also enable ERROR logging. Default value: "NONE" Possible values: ["NONE", "ERROR", "INFO", "DEBUG"] When `null`, the `log_level` field will be omitted from the resulting object.
-  - `mqtt_config` (`obj`): Activate or deactivate MQTT. When `null`, the `mqtt_config` field will be omitted from the resulting object.
-  - `name` (`string`): A unique name for the resource, required by device registry.
-  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
-  - `region` (`string`): The region in which the created registry should reside.
-If it is not provided, the provider region is used. When `null`, the `region` field will be omitted from the resulting object.
-  - `state_notification_config` (`obj`): A PubSub topic to publish device state updates. When `null`, the `state_notification_config` field will be omitted from the resulting object.
-  - `credentials` (`list[obj]`): List of public key certificates to authenticate devices. When `null`, the `credentials` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry.credentials.new](#fn-credentialsnew) constructor.
-  - `event_notification_configs` (`list[obj]`): List of configurations for event notifications, such as PubSub topics
-to publish device events to. When `null`, the `event_notification_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry.event_notification_configs.new](#fn-event_notification_configsnew) constructor.
-  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry.timeouts.new](#fn-timeoutsnew) constructor.
-
-**Returns**:
-  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudiot_registry` resource into the root Terraform configuration.
-
-
-### fn withCredentials
-
-```ts
-withCredentials()
-```
-
-`google.list[obj].withCredentials` constructs a mixin object that can be merged into the `list[obj]`
-Terraform resource block to set or update the credentials field.
-
-This function will replace the array with the passed in `value`. If you wish to instead append the
-passed in value to the existing array, use the [google.list[obj].withCredentialsMixin](TODO) function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`list[obj]`): The value to set for the `credentials` field.
-
-
-### fn withCredentialsMixin
-
-```ts
-withCredentialsMixin()
-```
-
-`google.list[obj].withCredentialsMixin` constructs a mixin object that can be merged into the `list[obj]`
-Terraform resource block to set or update the credentials field.
-
-This function will append the passed in array or object to the existing array. If you wish
-to instead replace the array with the passed in `value`, use the [google.list[obj].withCredentials](TODO)
-function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`list[obj]`): The value to set for the `credentials` field.
-
-
-### fn withEventNotificationConfigs
-
-```ts
-withEventNotificationConfigs()
-```
-
-`google.list[obj].withEventNotificationConfigs` constructs a mixin object that can be merged into the `list[obj]`
-Terraform resource block to set or update the event_notification_configs field.
-
-This function will replace the array with the passed in `value`. If you wish to instead append the
-passed in value to the existing array, use the [google.list[obj].withEventNotificationConfigsMixin](TODO) function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`list[obj]`): The value to set for the `event_notification_configs` field.
-
-
-### fn withEventNotificationConfigsMixin
-
-```ts
-withEventNotificationConfigsMixin()
-```
-
-`google.list[obj].withEventNotificationConfigsMixin` constructs a mixin object that can be merged into the `list[obj]`
-Terraform resource block to set or update the event_notification_configs field.
-
-This function will append the passed in array or object to the existing array. If you wish
-to instead replace the array with the passed in `value`, use the [google.list[obj].withEventNotificationConfigs](TODO)
-function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`list[obj]`): The value to set for the `event_notification_configs` field.
-
-
-### fn withHttpConfig
-
-```ts
-withHttpConfig()
-```
-
-`google.obj.withHttpConfig` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the http_config field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `http_config` field.
-
-
-### fn withLogLevel
-
-```ts
-withLogLevel()
-```
-
-`google.string.withLogLevel` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the log_level field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `log_level` field.
-
-
-### fn withMqttConfig
-
-```ts
-withMqttConfig()
-```
-
-`google.obj.withMqttConfig` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the mqtt_config field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `mqtt_config` field.
-
-
-### fn withName
-
-```ts
-withName()
-```
-
-`google.string.withName` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the name field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `name` field.
-
-
-### fn withProject
-
-```ts
-withProject()
-```
-
-`google.string.withProject` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the project field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `project` field.
-
-
-### fn withRegion
-
-```ts
-withRegion()
-```
-
-`google.string.withRegion` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the region field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `region` field.
-
-
-### fn withStateNotificationConfig
-
-```ts
-withStateNotificationConfig()
-```
-
-`google.obj.withStateNotificationConfig` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the state_notification_config field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `state_notification_config` field.
-
-
-### fn withTimeouts
-
-```ts
-withTimeouts()
-```
-
-`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the timeouts field.
-
-This function will replace the map with the passed in `value`. If you wish to instead merge the
-passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `timeouts` field.
-
-
-### fn withTimeoutsMixin
-
-```ts
-withTimeoutsMixin()
-```
-
-`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the timeouts field.
-
-This function will merge the passed in value to the existing map. If you wish
-to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
-function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `timeouts` field.
-
-
-## obj credentials
-
-
-
-### fn credentials.new
-
-```ts
-new()
-```
-
-
-`google.cloudiot_registry.credentials.new` constructs a new object with attributes and blocks configured for the `credentials`
-Terraform sub block.
-
-
-
-**Args**:
-  - `public_key_certificate` (`obj`): A public key certificate format and data.
-
-**Returns**:
-  - An attribute object that represents the `credentials` sub block.
-
-
-## obj event_notification_configs
-
-
-
-### fn event_notification_configs.new
-
-```ts
-new()
-```
-
-
-`google.cloudiot_registry.event_notification_configs.new` constructs a new object with attributes and blocks configured for the `event_notification_configs`
-Terraform sub block.
-
-
-
-**Args**:
-  - `pubsub_topic_name` (`string`): PubSub topic name to publish device events.
-  - `subfolder_matches` (`string`): If the subfolder name matches this string exactly, this
-configuration will be used. The string must not include the
-leading '/' character. If empty, all strings are matched. Empty
-value can only be used for the last 'event_notification_configs'
-item. When `null`, the `subfolder_matches` field will be omitted from the resulting object.
-
-**Returns**:
-  - An attribute object that represents the `event_notification_configs` sub block.
-
-
-## obj timeouts
-
-
-
-### fn timeouts.new
-
-```ts
-new()
-```
-
-
-`google.cloudiot_registry.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
-Terraform sub block.
-
-
-
-**Args**:
-  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
-  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
-  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
-
-**Returns**:
-  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/composer_environment.md b/docs/4.x/composer_environment.md
index 81ed5e7f..7bc92075 100644
--- a/docs/4.x/composer_environment.md
+++ b/docs/4.x/composer_environment.md
@@ -55,6 +55,8 @@ This package contains functions and utilities for setting up the resource using
     * [`fn new()`](#fn-configworkloads_confignew)
     * [`obj config.workloads_config.scheduler`](#obj-configworkloads_configscheduler)
       * [`fn new()`](#fn-configworkloads_configschedulernew)
+    * [`obj config.workloads_config.triggerer`](#obj-configworkloads_configtriggerer)
+      * [`fn new()`](#fn-configworkloads_configtriggerernew)
     * [`obj config.workloads_config.web_server`](#obj-configworkloads_configweb_server)
       * [`fn new()`](#fn-configworkloads_configweb_servernew)
     * [`obj config.workloads_config.worker`](#obj-configworkloads_configworker)
@@ -91,7 +93,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `labels` (`obj`): User-defined labels for this environment. The labels map can contain no more than 64 entries. Entries of the labels map are UTF8 strings that comply with the following restrictions: Label keys must be between 1 and 63 characters long and must conform to the following regular expression: [a-z]([-a-z0-9]*[a-z0-9])?. Label values must be between 0 and 63 characters long and must conform to the regular expression ([a-z]([-a-z0-9]*[a-z0-9])?)?. No more than 64 labels can be associated with a given environment. Both keys and values must be <= 128 bytes in size. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels for this environment. The labels map can contain no more than 64 entries. Entries of the labels map are UTF8 strings that comply with the following restrictions: Label keys must be between 1 and 63 characters long and must conform to the following regular expression: [a-z]([-a-z0-9]*[a-z0-9])?. Label values must be between 0 and 63 characters long and must conform to the regular expression ([a-z]([-a-z0-9]*[a-z0-9])?)?. No more than 64 labels can be associated with a given environment. Both keys and values must be <= 128 bytes in size.
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Name of the environment.
   - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The location or Compute Engine region for the environment. When `null`, the `region` field will be omitted from the resulting object.
@@ -120,7 +125,10 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `labels` (`obj`): User-defined labels for this environment. The labels map can contain no more than 64 entries. Entries of the labels map are UTF8 strings that comply with the following restrictions: Label keys must be between 1 and 63 characters long and must conform to the following regular expression: [a-z]([-a-z0-9]*[a-z0-9])?. Label values must be between 0 and 63 characters long and must conform to the regular expression ([a-z]([-a-z0-9]*[a-z0-9])?)?. No more than 64 labels can be associated with a given environment. Both keys and values must be <= 128 bytes in size. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels for this environment. The labels map can contain no more than 64 entries. Entries of the labels map are UTF8 strings that comply with the following restrictions: Label keys must be between 1 and 63 characters long and must conform to the following regular expression: [a-z]([-a-z0-9]*[a-z0-9])?. Label values must be between 0 and 63 characters long and must conform to the regular expression ([a-z]([-a-z0-9]*[a-z0-9])?)?. No more than 64 labels can be associated with a given environment. Both keys and values must be <= 128 bytes in size.
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Name of the environment.
   - `project` (`string`): The ID of the project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The location or Compute Engine region for the environment. When `null`, the `region` field will be omitted from the resulting object.
@@ -650,6 +658,7 @@ Terraform sub block.
 
 **Args**:
   - `scheduler` (`list[obj]`): Configuration for resources used by Airflow schedulers. When `null`, the `scheduler` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.workloads_config.scheduler.new](#fn-configconfigschedulernew) constructor.
+  - `triggerer` (`list[obj]`): Configuration for resources used by Airflow triggerers. When `null`, the `triggerer` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.workloads_config.triggerer.new](#fn-configconfigtriggerernew) constructor.
   - `web_server` (`list[obj]`): Configuration for resources used by Airflow web server. When `null`, the `web_server` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.workloads_config.web_server.new](#fn-configconfigweb_servernew) constructor.
   - `worker` (`list[obj]`): Configuration for resources used by Airflow workers. When `null`, the `worker` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.composer_environment.config.workloads_config.worker.new](#fn-configconfigworkernew) constructor.
 
@@ -683,6 +692,31 @@ Terraform sub block.
   - An attribute object that represents the `scheduler` sub block.
 
 
+## obj config.workloads_config.triggerer
+
+
+
+### fn config.workloads_config.triggerer.new
+
+```ts
+new()
+```
+
+
+`google.composer_environment.config.workloads_config.triggerer.new` constructs a new object with attributes and blocks configured for the `triggerer`
+Terraform sub block.
+
+
+
+**Args**:
+  - `count` (`number`): The number of triggerers.
+  - `cpu` (`number`): CPU request and limit for a single Airflow triggerer replica.
+  - `memory_gb` (`number`): Memory (GB) request and limit for a single Airflow triggerer replica.
+
+**Returns**:
+  - An attribute object that represents the `triggerer` sub block.
+
+
 ## obj config.workloads_config.web_server
 
 
diff --git a/docs/4.x/compute_address.md b/docs/4.x/compute_address.md
index 0011a1d2..eccb87dc 100644
--- a/docs/4.x/compute_address.md
+++ b/docs/4.x/compute_address.md
@@ -20,6 +20,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withDescription()`](#fn-withdescription)
 * [`fn withIpVersion()`](#fn-withipversion)
 * [`fn withIpv6EndpointType()`](#fn-withipv6endpointtype)
+* [`fn withLabels()`](#fn-withlabels)
 * [`fn withName()`](#fn-withname)
 * [`fn withNetwork()`](#fn-withnetwork)
 * [`fn withNetworkTier()`](#fn-withnetworktier)
@@ -72,6 +73,11 @@ Note: if you set this argument's value as 'INTERNAL' you need to lea
   - `ipv6_endpoint_type` (`string`): The endpoint type of this address, which should be VM or NETLB. This is
 used for deciding which type of endpoint this address can be used after
 the external IPv6 address reservation. Possible values: ["VM", "NETLB"] When `null`, the `ipv6_endpoint_type` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels to apply to this address.  A list of key->value pairs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource. The name must be 1-63 characters long, and
 comply with RFC1035. Specifically, the name must be 1-63 characters
 long and match the regular expression '[a-z]([-a-z0-9]*[a-z0-9])?'
@@ -146,6 +152,11 @@ Note: if you set this argument's value as 'INTERNAL' you need to lea
   - `ipv6_endpoint_type` (`string`): The endpoint type of this address, which should be VM or NETLB. This is
 used for deciding which type of endpoint this address can be used after
 the external IPv6 address reservation. Possible values: ["VM", "NETLB"] When `null`, the `ipv6_endpoint_type` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels to apply to this address.  A list of key->value pairs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource. The name must be 1-63 characters long, and
 comply with RFC1035. Specifically, the name must be 1-63 characters
 long and match the regular expression '[a-z]([-a-z0-9]*[a-z0-9])?'
@@ -272,6 +283,22 @@ Terraform resource block to set or update the ipv6_endpoint_type field.
   - `value` (`string`): The value to set for the `ipv6_endpoint_type` field.
 
 
+### fn withLabels
+
+```ts
+withLabels()
+```
+
+`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the labels field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `labels` field.
+
+
 ### fn withName
 
 ```ts
@@ -455,6 +482,7 @@ Terraform sub block.
 **Args**:
   - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
   - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/compute_disk.md b/docs/4.x/compute_disk.md
index 484c5c64..8f53d5be 100644
--- a/docs/4.x/compute_disk.md
+++ b/docs/4.x/compute_disk.md
@@ -94,7 +94,11 @@ images names must include the family name. If they don't, use the
 [google_compute_image data source](/docs/providers/google/d/compute_image.html).
 For instance, the image 'centos-6-v20180104' includes its family name 'centos-6'.
 These images can be referred by family name here. When `null`, the `image` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels to apply to this disk.  A list of key->value pairs. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels to apply to this disk.  A list of key->value pairs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource. Provided by the client when the resource is
 created. The name must be 1-63 characters long, and comply with
@@ -204,7 +208,11 @@ images names must include the family name. If they don't, use the
 [google_compute_image data source](/docs/providers/google/d/compute_image.html).
 For instance, the image 'centos-6-v20180104' includes its family name 'centos-6'.
 These images can be referred by family name here. When `null`, the `image` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels to apply to this disk.  A list of key->value pairs. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels to apply to this disk.  A list of key->value pairs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource. Provided by the client when the resource is
 created. The name must be 1-63 characters long, and comply with
diff --git a/docs/4.x/compute_external_vpn_gateway.md b/docs/4.x/compute_external_vpn_gateway.md
index 372c3cda..7d64d699 100644
--- a/docs/4.x/compute_external_vpn_gateway.md
+++ b/docs/4.x/compute_external_vpn_gateway.md
@@ -59,7 +59,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels for the external VPN gateway resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels for the external VPN gateway resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource. Provided by the client when the resource is
 created. The name must be 1-63 characters long, and comply with
 RFC1035.  Specifically, the name must be 1-63 characters long and
@@ -95,7 +98,10 @@ injecting into a complete block.
 
 **Args**:
   - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels for the external VPN gateway resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels for the external VPN gateway resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource. Provided by the client when the resource is
 created. The name must be 1-63 characters long, and comply with
 RFC1035.  Specifically, the name must be 1-63 characters long and
diff --git a/docs/4.x/compute_forwarding_rule.md b/docs/4.x/compute_forwarding_rule.md
index a3d26fd4..d17dab3e 100644
--- a/docs/4.x/compute_forwarding_rule.md
+++ b/docs/4.x/compute_forwarding_rule.md
@@ -33,6 +33,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withPortRange()`](#fn-withportrange)
 * [`fn withPorts()`](#fn-withports)
 * [`fn withProject()`](#fn-withproject)
+* [`fn withRecreateClosedPsc()`](#fn-withrecreateclosedpsc)
 * [`fn withRegion()`](#fn-withregion)
 * [`fn withServiceDirectoryRegistrations()`](#fn-withservicedirectoryregistrations)
 * [`fn withServiceDirectoryRegistrationsMixin()`](#fn-withservicedirectoryregistrationsmixin)
@@ -76,21 +77,21 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `all_ports` (`bool`): This field can only be used:
-* If 'IPProtocol' is one of TCP, UDP, or SCTP.
-* By internal TCP/UDP load balancers, backend service-based network load
-balancers, and internal and external protocol forwarding.
-
-This option should be set to TRUE when the Forwarding Rule
-IPProtocol is set to L3_DEFAULT.
-
-Set this field to true to allow packets addressed to any port or packets
+  - `all_ports` (`bool`): The 'ports', 'portRange', and 'allPorts' fields are mutually exclusive.
+Only packets addressed to ports in the specified range will be forwarded
+to the backends configured with this forwarding rule.
+
+The 'allPorts' field has the following limitations:
+* It requires that the forwarding rule 'IPProtocol' be TCP, UDP, SCTP, or
+L3_DEFAULT.
+* It's applicable only to the following products: internal passthrough
+Network Load Balancers, backend service-based external passthrough Network
+Load Balancers, and internal and external protocol forwarding.
+* Set this field to true to allow packets addressed to any port or packets
 lacking destination port information (for example, UDP fragments after the
 first fragment) to be forwarded to the backends configured with this
-forwarding rule.
-
-The 'ports', 'port_range', and
-'allPorts' fields are mutually exclusive. When `null`, the `all_ports` field will be omitted from the resulting object.
+forwarding rule. The L3_DEFAULT protocol requires 'allPorts' be set to
+true. When `null`, the `all_ports` field will be omitted from the resulting object.
   - `allow_global_access` (`bool`): This field is used along with the 'backend_service' field for
 internal load balancing or with the 'target' field for internal
 TargetInstance.
@@ -172,7 +173,11 @@ load balancer will not have their traffic mirrored even if a
 
 This can only be set to true for load balancers that have their
 'loadBalancingScheme' set to 'INTERNAL'. When `null`, the `is_mirroring_collector` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels to apply to this forwarding rule.  A list of key->value pairs. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels to apply to this forwarding rule.  A list of key->value pairs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `load_balancing_scheme` (`string`): Specifies the forwarding rule type.
 
 For more information about forwarding rules, refer to
@@ -212,51 +217,54 @@ If this field is not specified, it is assumed to be 'PREMIUM'.
 If 'IPAddress' is specified, this value must be equal to the
 networkTier of the Address. Possible values: ["PREMIUM", "STANDARD"] When `null`, the `network_tier` field will be omitted from the resulting object.
   - `no_automate_dns_zone` (`bool`): This is used in PSC consumer ForwardingRule to control whether it should try to auto-generate a DNS zone or not. Non-PSC forwarding rules do not use this field. When `null`, the `no_automate_dns_zone` field will be omitted from the resulting object.
-  - `port_range` (`string`): This field can only be used:
-
-* If 'IPProtocol' is one of TCP, UDP, or SCTP.
-* By backend service-based network load balancers, target pool-based
-network load balancers, internal proxy load balancers, external proxy load
-balancers, Traffic Director, external protocol forwarding, and Classic VPN.
-Some products have restrictions on what ports can be used. See
+  - `port_range` (`string`): The 'ports', 'portRange', and 'allPorts' fields are mutually exclusive.
+Only packets addressed to ports in the specified range will be forwarded
+to the backends configured with this forwarding rule.
+
+The 'portRange' field has the following limitations:
+* It requires that the forwarding rule 'IPProtocol' be TCP, UDP, or SCTP,
+and
+* It's applicable only to the following products: external passthrough
+Network Load Balancers, internal and external proxy Network Load
+Balancers, internal and external Application Load Balancers, external
+protocol forwarding, and Classic VPN.
+* Some products have restrictions on what ports can be used. See
 [port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#port_specifications)
 for details.
 
-
-Only packets addressed to ports in the specified range will be forwarded to
-the backends configured with this forwarding rule.
-
-The 'ports' and 'port_range' fields are mutually exclusive.
-
 For external forwarding rules, two or more forwarding rules cannot use the
-same '[IPAddress, IPProtocol]' pair, and cannot have
-overlapping 'portRange's.
+same '[IPAddress, IPProtocol]' pair, and cannot have overlapping
+'portRange's.
 
 For internal forwarding rules within the same VPC network, two or more
-forwarding rules cannot use the same '[IPAddress, IPProtocol]'
-pair, and cannot have overlapping 'portRange's. When `null`, the `port_range` field will be omitted from the resulting object.
-  - `ports` (`list`): This field can only be used:
-
-* If 'IPProtocol' is one of TCP, UDP, or SCTP.
-* By internal TCP/UDP load balancers, backend service-based network load
-balancers, internal protocol forwarding and when protocol is not L3_DEFAULT.
-
-
-You can specify a list of up to five ports by number, separated by commas.
-The ports can be contiguous or discontiguous. Only packets addressed to
-these ports will be forwarded to the backends configured with this
-forwarding rule.
+forwarding rules cannot use the same '[IPAddress, IPProtocol]' pair, and
+cannot have overlapping 'portRange's.
+
+@pattern: \d+(?:-\d+)? When `null`, the `port_range` field will be omitted from the resulting object.
+  - `ports` (`list`): The 'ports', 'portRange', and 'allPorts' fields are mutually exclusive.
+Only packets addressed to ports in the specified range will be forwarded
+to the backends configured with this forwarding rule.
+
+The 'ports' field has the following limitations:
+* It requires that the forwarding rule 'IPProtocol' be TCP, UDP, or SCTP,
+and
+* It's applicable only to the following products: internal passthrough
+Network Load Balancers, backend service-based external passthrough Network
+Load Balancers, and internal protocol forwarding.
+* You can specify a list of up to five ports by number, separated by
+commas. The ports can be contiguous or discontiguous.
 
 For external forwarding rules, two or more forwarding rules cannot use the
-same '[IPAddress, IPProtocol]' pair, and cannot share any values
-defined in 'ports'.
+same '[IPAddress, IPProtocol]' pair if they share at least one port
+number.
 
 For internal forwarding rules within the same VPC network, two or more
-forwarding rules cannot use the same '[IPAddress, IPProtocol]'
-pair, and cannot share any values defined in 'ports'.
+forwarding rules cannot use the same '[IPAddress, IPProtocol]' pair if
+they share at least one port number.
 
-The 'ports' and 'port_range' fields are mutually exclusive. When `null`, the `ports` field will be omitted from the resulting object.
+@pattern: \d+(?:-\d+)? When `null`, the `ports` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `recreate_closed_psc` (`bool`): This is used in PSC consumer ForwardingRule to make terraform recreate the ForwardingRule when the status is closed When `null`, the `recreate_closed_psc` field will be omitted from the resulting object.
   - `region` (`string`): A reference to the region where the regional forwarding rule resides.
 
 This field is not applicable to global forwarding rules. When `null`, the `region` field will be omitted from the resulting object.
@@ -320,21 +328,21 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `all_ports` (`bool`): This field can only be used:
-* If 'IPProtocol' is one of TCP, UDP, or SCTP.
-* By internal TCP/UDP load balancers, backend service-based network load
-balancers, and internal and external protocol forwarding.
-
-This option should be set to TRUE when the Forwarding Rule
-IPProtocol is set to L3_DEFAULT.
-
-Set this field to true to allow packets addressed to any port or packets
+  - `all_ports` (`bool`): The 'ports', 'portRange', and 'allPorts' fields are mutually exclusive.
+Only packets addressed to ports in the specified range will be forwarded
+to the backends configured with this forwarding rule.
+
+The 'allPorts' field has the following limitations:
+* It requires that the forwarding rule 'IPProtocol' be TCP, UDP, SCTP, or
+L3_DEFAULT.
+* It's applicable only to the following products: internal passthrough
+Network Load Balancers, backend service-based external passthrough Network
+Load Balancers, and internal and external protocol forwarding.
+* Set this field to true to allow packets addressed to any port or packets
 lacking destination port information (for example, UDP fragments after the
 first fragment) to be forwarded to the backends configured with this
-forwarding rule.
-
-The 'ports', 'port_range', and
-'allPorts' fields are mutually exclusive. When `null`, the `all_ports` field will be omitted from the resulting object.
+forwarding rule. The L3_DEFAULT protocol requires 'allPorts' be set to
+true. When `null`, the `all_ports` field will be omitted from the resulting object.
   - `allow_global_access` (`bool`): This field is used along with the 'backend_service' field for
 internal load balancing or with the 'target' field for internal
 TargetInstance.
@@ -416,7 +424,11 @@ load balancer will not have their traffic mirrored even if a
 
 This can only be set to true for load balancers that have their
 'loadBalancingScheme' set to 'INTERNAL'. When `null`, the `is_mirroring_collector` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels to apply to this forwarding rule.  A list of key->value pairs. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels to apply to this forwarding rule.  A list of key->value pairs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `load_balancing_scheme` (`string`): Specifies the forwarding rule type.
 
 For more information about forwarding rules, refer to
@@ -456,51 +468,54 @@ If this field is not specified, it is assumed to be 'PREMIUM'.
 If 'IPAddress' is specified, this value must be equal to the
 networkTier of the Address. Possible values: ["PREMIUM", "STANDARD"] When `null`, the `network_tier` field will be omitted from the resulting object.
   - `no_automate_dns_zone` (`bool`): This is used in PSC consumer ForwardingRule to control whether it should try to auto-generate a DNS zone or not. Non-PSC forwarding rules do not use this field. When `null`, the `no_automate_dns_zone` field will be omitted from the resulting object.
-  - `port_range` (`string`): This field can only be used:
-
-* If 'IPProtocol' is one of TCP, UDP, or SCTP.
-* By backend service-based network load balancers, target pool-based
-network load balancers, internal proxy load balancers, external proxy load
-balancers, Traffic Director, external protocol forwarding, and Classic VPN.
-Some products have restrictions on what ports can be used. See
+  - `port_range` (`string`): The 'ports', 'portRange', and 'allPorts' fields are mutually exclusive.
+Only packets addressed to ports in the specified range will be forwarded
+to the backends configured with this forwarding rule.
+
+The 'portRange' field has the following limitations:
+* It requires that the forwarding rule 'IPProtocol' be TCP, UDP, or SCTP,
+and
+* It's applicable only to the following products: external passthrough
+Network Load Balancers, internal and external proxy Network Load
+Balancers, internal and external Application Load Balancers, external
+protocol forwarding, and Classic VPN.
+* Some products have restrictions on what ports can be used. See
 [port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#port_specifications)
 for details.
 
-
-Only packets addressed to ports in the specified range will be forwarded to
-the backends configured with this forwarding rule.
-
-The 'ports' and 'port_range' fields are mutually exclusive.
-
 For external forwarding rules, two or more forwarding rules cannot use the
-same '[IPAddress, IPProtocol]' pair, and cannot have
-overlapping 'portRange's.
+same '[IPAddress, IPProtocol]' pair, and cannot have overlapping
+'portRange's.
 
 For internal forwarding rules within the same VPC network, two or more
-forwarding rules cannot use the same '[IPAddress, IPProtocol]'
-pair, and cannot have overlapping 'portRange's. When `null`, the `port_range` field will be omitted from the resulting object.
-  - `ports` (`list`): This field can only be used:
-
-* If 'IPProtocol' is one of TCP, UDP, or SCTP.
-* By internal TCP/UDP load balancers, backend service-based network load
-balancers, internal protocol forwarding and when protocol is not L3_DEFAULT.
-
-
-You can specify a list of up to five ports by number, separated by commas.
-The ports can be contiguous or discontiguous. Only packets addressed to
-these ports will be forwarded to the backends configured with this
-forwarding rule.
+forwarding rules cannot use the same '[IPAddress, IPProtocol]' pair, and
+cannot have overlapping 'portRange's.
+
+@pattern: \d+(?:-\d+)? When `null`, the `port_range` field will be omitted from the resulting object.
+  - `ports` (`list`): The 'ports', 'portRange', and 'allPorts' fields are mutually exclusive.
+Only packets addressed to ports in the specified range will be forwarded
+to the backends configured with this forwarding rule.
+
+The 'ports' field has the following limitations:
+* It requires that the forwarding rule 'IPProtocol' be TCP, UDP, or SCTP,
+and
+* It's applicable only to the following products: internal passthrough
+Network Load Balancers, backend service-based external passthrough Network
+Load Balancers, and internal protocol forwarding.
+* You can specify a list of up to five ports by number, separated by
+commas. The ports can be contiguous or discontiguous.
 
 For external forwarding rules, two or more forwarding rules cannot use the
-same '[IPAddress, IPProtocol]' pair, and cannot share any values
-defined in 'ports'.
+same '[IPAddress, IPProtocol]' pair if they share at least one port
+number.
 
 For internal forwarding rules within the same VPC network, two or more
-forwarding rules cannot use the same '[IPAddress, IPProtocol]'
-pair, and cannot share any values defined in 'ports'.
+forwarding rules cannot use the same '[IPAddress, IPProtocol]' pair if
+they share at least one port number.
 
-The 'ports' and 'port_range' fields are mutually exclusive. When `null`, the `ports` field will be omitted from the resulting object.
+@pattern: \d+(?:-\d+)? When `null`, the `ports` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `recreate_closed_psc` (`bool`): This is used in PSC consumer ForwardingRule to make terraform recreate the ForwardingRule when the status is closed When `null`, the `recreate_closed_psc` field will be omitted from the resulting object.
   - `region` (`string`): A reference to the region where the regional forwarding rule resides.
 
 This field is not applicable to global forwarding rules. When `null`, the `region` field will be omitted from the resulting object.
@@ -834,6 +849,22 @@ Terraform resource block to set or update the project field.
   - `value` (`string`): The value to set for the `project` field.
 
 
+### fn withRecreateClosedPsc
+
+```ts
+withRecreateClosedPsc()
+```
+
+`google.bool.withRecreateClosedPsc` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the recreate_closed_psc field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `recreate_closed_psc` field.
+
+
 ### fn withRegion
 
 ```ts
diff --git a/docs/4.x/compute_global_forwarding_rule.md b/docs/4.x/compute_global_forwarding_rule.md
index 15227055..d9b3d650 100644
--- a/docs/4.x/compute_global_forwarding_rule.md
+++ b/docs/4.x/compute_global_forwarding_rule.md
@@ -122,7 +122,11 @@ The valid IP protocols are different for different load balancing products
 as described in [Load balancing
 features](https://cloud.google.com/load-balancing/docs/features#protocols_from_the_load_balancer_to_the_backends). Possible values: ["TCP", "UDP", "ESP", "AH", "SCTP", "ICMP"] When `null`, the `ip_protocol` field will be omitted from the resulting object.
   - `ip_version` (`string`): The IP Version that will be used by this global forwarding rule. Possible values: ["IPV4", "IPV6"] When `null`, the `ip_version` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels to apply to this forwarding rule.  A list of key->value pairs. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels to apply to this forwarding rule.  A list of key->value pairs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `load_balancing_scheme` (`string`): Specifies the forwarding rule type.
 
 For more information about forwarding rules, refer to
@@ -151,24 +155,26 @@ be used.
 For Private Service Connect forwarding rules that forward traffic to Google
 APIs, a network must be provided. When `null`, the `network` field will be omitted from the resulting object.
   - `no_automate_dns_zone` (`bool`): This is used in PSC consumer ForwardingRule to control whether it should try to auto-generate a DNS zone or not. Non-PSC forwarding rules do not use this field. When `null`, the `no_automate_dns_zone` field will be omitted from the resulting object.
-  - `port_range` (`string`): This field can only be used:
-
-* If 'IPProtocol' is one of TCP, UDP, or SCTP.
-* By backend service-based network load balancers, target pool-based
-network load balancers, internal proxy load balancers, external proxy load
-balancers, Traffic Director, external protocol forwarding, and Classic VPN.
-Some products have restrictions on what ports can be used. See
+  - `port_range` (`string`): The 'portRange' field has the following limitations:
+* It requires that the forwarding rule 'IPProtocol' be TCP, UDP, or SCTP,
+and
+* It's applicable only to the following products: external passthrough
+Network Load Balancers, internal and external proxy Network Load
+Balancers, internal and external Application Load Balancers, external
+protocol forwarding, and Classic VPN.
+* Some products have restrictions on what ports can be used. See
 [port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#port_specifications)
 for details.
 
+For external forwarding rules, two or more forwarding rules cannot use the
+same '[IPAddress, IPProtocol]' pair, and cannot have overlapping
+'portRange's.
+
+For internal forwarding rules within the same VPC network, two or more
+forwarding rules cannot use the same '[IPAddress, IPProtocol]' pair, and
+cannot have overlapping 'portRange's.
 
-* TargetHttpProxy: 80, 8080
-* TargetHttpsProxy: 443
-* TargetTcpProxy: 25, 43, 110, 143, 195, 443, 465, 587, 700, 993, 995,
-                  1883, 5222
-* TargetSslProxy: 25, 43, 110, 143, 195, 443, 465, 587, 700, 993, 995,
-                  1883, 5222
-* TargetVpnGateway: 500, 4500 When `null`, the `port_range` field will be omitted from the resulting object.
+@pattern: \d+(?:-\d+)? When `null`, the `port_range` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `source_ip_ranges` (`list`): If not empty, this Forwarding Rule will only forward the traffic when the source IP address matches one of the IP addresses or CIDR ranges set here. Note that a Forwarding Rule can only have up to 64 source IP ranges, and this field can only be used with a regional Forwarding Rule whose scheme is EXTERNAL. Each sourceIpRange entry should be either an IP address (for example, 1.2.3.4) or a CIDR range (for example, 1.2.3.0/24). When `null`, the `source_ip_ranges` field will be omitted from the resulting object.
   - `subnetwork` (`string`): This field identifies the subnetwork that the load balanced IP should
@@ -285,7 +291,11 @@ The valid IP protocols are different for different load balancing products
 as described in [Load balancing
 features](https://cloud.google.com/load-balancing/docs/features#protocols_from_the_load_balancer_to_the_backends). Possible values: ["TCP", "UDP", "ESP", "AH", "SCTP", "ICMP"] When `null`, the `ip_protocol` field will be omitted from the resulting object.
   - `ip_version` (`string`): The IP Version that will be used by this global forwarding rule. Possible values: ["IPV4", "IPV6"] When `null`, the `ip_version` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels to apply to this forwarding rule.  A list of key->value pairs. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels to apply to this forwarding rule.  A list of key->value pairs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `load_balancing_scheme` (`string`): Specifies the forwarding rule type.
 
 For more information about forwarding rules, refer to
@@ -314,24 +324,26 @@ be used.
 For Private Service Connect forwarding rules that forward traffic to Google
 APIs, a network must be provided. When `null`, the `network` field will be omitted from the resulting object.
   - `no_automate_dns_zone` (`bool`): This is used in PSC consumer ForwardingRule to control whether it should try to auto-generate a DNS zone or not. Non-PSC forwarding rules do not use this field. When `null`, the `no_automate_dns_zone` field will be omitted from the resulting object.
-  - `port_range` (`string`): This field can only be used:
-
-* If 'IPProtocol' is one of TCP, UDP, or SCTP.
-* By backend service-based network load balancers, target pool-based
-network load balancers, internal proxy load balancers, external proxy load
-balancers, Traffic Director, external protocol forwarding, and Classic VPN.
-Some products have restrictions on what ports can be used. See
+  - `port_range` (`string`): The 'portRange' field has the following limitations:
+* It requires that the forwarding rule 'IPProtocol' be TCP, UDP, or SCTP,
+and
+* It's applicable only to the following products: external passthrough
+Network Load Balancers, internal and external proxy Network Load
+Balancers, internal and external Application Load Balancers, external
+protocol forwarding, and Classic VPN.
+* Some products have restrictions on what ports can be used. See
 [port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#port_specifications)
 for details.
 
+For external forwarding rules, two or more forwarding rules cannot use the
+same '[IPAddress, IPProtocol]' pair, and cannot have overlapping
+'portRange's.
+
+For internal forwarding rules within the same VPC network, two or more
+forwarding rules cannot use the same '[IPAddress, IPProtocol]' pair, and
+cannot have overlapping 'portRange's.
 
-* TargetHttpProxy: 80, 8080
-* TargetHttpsProxy: 443
-* TargetTcpProxy: 25, 43, 110, 143, 195, 443, 465, 587, 700, 993, 995,
-                  1883, 5222
-* TargetSslProxy: 25, 43, 110, 143, 195, 443, 465, 587, 700, 993, 995,
-                  1883, 5222
-* TargetVpnGateway: 500, 4500 When `null`, the `port_range` field will be omitted from the resulting object.
+@pattern: \d+(?:-\d+)? When `null`, the `port_range` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `source_ip_ranges` (`list`): If not empty, this Forwarding Rule will only forward the traffic when the source IP address matches one of the IP addresses or CIDR ranges set here. Note that a Forwarding Rule can only have up to 64 source IP ranges, and this field can only be used with a regional Forwarding Rule whose scheme is EXTERNAL. Each sourceIpRange entry should be either an IP address (for example, 1.2.3.4) or a CIDR range (for example, 1.2.3.0/24). When `null`, the `source_ip_ranges` field will be omitted from the resulting object.
   - `subnetwork` (`string`): This field identifies the subnetwork that the load balanced IP should
diff --git a/docs/4.x/compute_image.md b/docs/4.x/compute_image.md
index ea01ee09..d48bf252 100644
--- a/docs/4.x/compute_image.md
+++ b/docs/4.x/compute_image.md
@@ -80,7 +80,10 @@ create disks by specifying an image family instead of a specific
 image name. The image family always returns its latest image that is
 not deprecated. The name of the image family must comply with
 RFC1035. When `null`, the `family` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels to apply to this Image. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels to apply to this Image.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource; provided by the client when the resource is
 created. The name must be 1-63 characters long, and comply with
@@ -152,7 +155,10 @@ create disks by specifying an image family instead of a specific
 image name. The image family always returns its latest image that is
 not deprecated. The name of the image family must comply with
 RFC1035. When `null`, the `family` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels to apply to this Image. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels to apply to this Image.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource; provided by the client when the resource is
 created. The name must be 1-63 characters long, and comply with
@@ -538,7 +544,7 @@ Terraform sub block.
 
 
 **Args**:
-  - `type` (`string`): The type of supported feature. Read [Enabling guest operating system features](https://cloud.google.com/compute/docs/images/create-delete-deprecate-private-images#guest-os-features) to see a list of available options. Possible values: ["MULTI_IP_SUBNET", "SECURE_BOOT", "SEV_CAPABLE", "UEFI_COMPATIBLE", "VIRTIO_SCSI_MULTIQUEUE", "WINDOWS", "GVNIC", "SEV_LIVE_MIGRATABLE", "SEV_SNP_CAPABLE", "SUSPEND_RESUME_COMPATIBLE", "TDX_CAPABLE"]
+  - `type` (`string`): The type of supported feature. Read [Enabling guest operating system features](https://cloud.google.com/compute/docs/images/create-delete-deprecate-private-images#guest-os-features) to see a list of available options. Possible values: ["MULTI_IP_SUBNET", "SECURE_BOOT", "SEV_CAPABLE", "UEFI_COMPATIBLE", "VIRTIO_SCSI_MULTIQUEUE", "WINDOWS", "GVNIC", "SEV_LIVE_MIGRATABLE", "SEV_SNP_CAPABLE", "SUSPEND_RESUME_COMPATIBLE", "TDX_CAPABLE", "SEV_LIVE_MIGRATABLE_V2"]
 
 **Returns**:
   - An attribute object that represents the `guest_os_features` sub block.
diff --git a/docs/4.x/compute_instance.md b/docs/4.x/compute_instance.md
index 2281be8f..a45e1d7a 100644
--- a/docs/4.x/compute_instance.md
+++ b/docs/4.x/compute_instance.md
@@ -137,7 +137,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `enable_display` (`bool`): Whether the instance has virtual displays enabled. When `null`, the `enable_display` field will be omitted from the resulting object.
   - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.
   - `hostname` (`string`): A custom hostname for the instance. Must be a fully qualified DNS name and RFC-1035-valid. Valid format is a series of labels 1-63 characters long matching the regular expression [a-z]([-a-z0-9]*[a-z0-9]), concatenated with periods. The entire hostname must not exceed 253 characters. Changing this forces a new resource to be created. When `null`, the `hostname` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs assigned to the instance. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs assigned to the instance.
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `machine_type` (`string`): The machine type to create.
   - `metadata` (`obj`): Metadata key/value pairs made available within the instance. When `null`, the `metadata` field will be omitted from the resulting object.
   - `metadata_startup_script` (`string`): Metadata startup scripts made available within the instance. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.
@@ -191,7 +194,10 @@ injecting into a complete block.
   - `enable_display` (`bool`): Whether the instance has virtual displays enabled. When `null`, the `enable_display` field will be omitted from the resulting object.
   - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.
   - `hostname` (`string`): A custom hostname for the instance. Must be a fully qualified DNS name and RFC-1035-valid. Valid format is a series of labels 1-63 characters long matching the regular expression [a-z]([-a-z0-9]*[a-z0-9]), concatenated with periods. The entire hostname must not exceed 253 characters. Changing this forces a new resource to be created. When `null`, the `hostname` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs assigned to the instance. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs assigned to the instance.
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `machine_type` (`string`): The machine type to create.
   - `metadata` (`obj`): Metadata key/value pairs made available within the instance. When `null`, the `metadata` field will be omitted from the resulting object.
   - `metadata_startup_script` (`string`): Metadata startup scripts made available within the instance. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.
@@ -1425,6 +1431,7 @@ Terraform sub block.
 
 
 **Args**:
+  - `device_name` (`string`): Name with which the attached disk is accessible under /dev/disk/by-id/ When `null`, the `device_name` field will be omitted from the resulting object.
   - `interface` (`string`): The disk interface used for attaching this disk. One of SCSI or NVME.
   - `size` (`number`): The size of the disk in gigabytes. One of 375 or 3000. When `null`, the `size` field will be omitted from the resulting object.
 
diff --git a/docs/4.x/compute_instance_from_template.md b/docs/4.x/compute_instance_from_template.md
index b8177a71..f7014ffa 100644
--- a/docs/4.x/compute_instance_from_template.md
+++ b/docs/4.x/compute_instance_from_template.md
@@ -126,7 +126,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `enable_display` (`bool`): Whether the instance has virtual displays enabled. When `null`, the `enable_display` field will be omitted from the resulting object.
   - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.
   - `hostname` (`string`): A custom hostname for the instance. Must be a fully qualified DNS name and RFC-1035-valid. Valid format is a series of labels 1-63 characters long matching the regular expression [a-z]([-a-z0-9]*[a-z0-9]), concatenated with periods. The entire hostname must not exceed 253 characters. Changing this forces a new resource to be created. When `null`, the `hostname` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs assigned to the instance. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs assigned to the instance.
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `machine_type` (`string`): The machine type to create. When `null`, the `machine_type` field will be omitted from the resulting object.
   - `metadata` (`obj`): Metadata key/value pairs made available within the instance. When `null`, the `metadata` field will be omitted from the resulting object.
   - `metadata_startup_script` (`string`): Metadata startup scripts made available within the instance. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.
@@ -181,7 +184,10 @@ injecting into a complete block.
   - `enable_display` (`bool`): Whether the instance has virtual displays enabled. When `null`, the `enable_display` field will be omitted from the resulting object.
   - `guest_accelerator` (`list`): List of the type and count of accelerator cards attached to the instance. When `null`, the `guest_accelerator` field will be omitted from the resulting object.
   - `hostname` (`string`): A custom hostname for the instance. Must be a fully qualified DNS name and RFC-1035-valid. Valid format is a series of labels 1-63 characters long matching the regular expression [a-z]([-a-z0-9]*[a-z0-9]), concatenated with periods. The entire hostname must not exceed 253 characters. Changing this forces a new resource to be created. When `null`, the `hostname` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs assigned to the instance. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs assigned to the instance.
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `machine_type` (`string`): The machine type to create. When `null`, the `machine_type` field will be omitted from the resulting object.
   - `metadata` (`obj`): Metadata key/value pairs made available within the instance. When `null`, the `metadata` field will be omitted from the resulting object.
   - `metadata_startup_script` (`string`): Metadata startup scripts made available within the instance. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.
diff --git a/docs/4.x/compute_instance_group_manager.md b/docs/4.x/compute_instance_group_manager.md
index 33ea6603..3f274b58 100644
--- a/docs/4.x/compute_instance_group_manager.md
+++ b/docs/4.x/compute_instance_group_manager.md
@@ -28,6 +28,10 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withProject()`](#fn-withproject)
 * [`fn withStatefulDisk()`](#fn-withstatefuldisk)
 * [`fn withStatefulDiskMixin()`](#fn-withstatefuldiskmixin)
+* [`fn withStatefulExternalIp()`](#fn-withstatefulexternalip)
+* [`fn withStatefulExternalIpMixin()`](#fn-withstatefulexternalipmixin)
+* [`fn withStatefulInternalIp()`](#fn-withstatefulinternalip)
+* [`fn withStatefulInternalIpMixin()`](#fn-withstatefulinternalipmixin)
 * [`fn withTargetPools()`](#fn-withtargetpools)
 * [`fn withTargetSize()`](#fn-withtargetsize)
 * [`fn withTimeouts()`](#fn-withtimeouts)
@@ -47,6 +51,10 @@ This package contains functions and utilities for setting up the resource using
   * [`fn new()`](#fn-named_portnew)
 * [`obj stateful_disk`](#obj-stateful_disk)
   * [`fn new()`](#fn-stateful_disknew)
+* [`obj stateful_external_ip`](#obj-stateful_external_ip)
+  * [`fn new()`](#fn-stateful_external_ipnew)
+* [`obj stateful_internal_ip`](#obj-stateful_internal_ip)
+  * [`fn new()`](#fn-stateful_internal_ipnew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 * [`obj update_policy`](#obj-update_policy)
@@ -99,6 +107,8 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `instance_lifecycle_policy` (`list[obj]`): The instance lifecycle policy for this managed instance group. When `null`, the `instance_lifecycle_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.instance_lifecycle_policy.new](#fn-instance_lifecycle_policynew) constructor.
   - `named_port` (`list[obj]`): The named port configuration. When `null`, the `named_port` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.named_port.new](#fn-named_portnew) constructor.
   - `stateful_disk` (`list[obj]`): Disks created on the instances that will be preserved on instance delete, update, etc. When `null`, the `stateful_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.stateful_disk.new](#fn-stateful_disknew) constructor.
+  - `stateful_external_ip` (`list[obj]`): External IPs considered stateful by the instance group.  When `null`, the `stateful_external_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.stateful_external_ip.new](#fn-stateful_external_ipnew) constructor.
+  - `stateful_internal_ip` (`list[obj]`): External IPs considered stateful by the instance group.  When `null`, the `stateful_internal_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.stateful_internal_ip.new](#fn-stateful_internal_ipnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.timeouts.new](#fn-timeoutsnew) constructor.
   - `update_policy` (`list[obj]`): The update policy for this managed instance group. When `null`, the `update_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.update_policy.new](#fn-update_policynew) constructor.
   - `version` (`list[obj]`): Application versions managed by this instance group. Each version deals with a specific instance template, allowing canary release scenarios. When `null`, the `version` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.version.new](#fn-versionnew) constructor.
@@ -139,6 +149,8 @@ injecting into a complete block.
   - `instance_lifecycle_policy` (`list[obj]`): The instance lifecycle policy for this managed instance group. When `null`, the `instance_lifecycle_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.instance_lifecycle_policy.new](#fn-instance_lifecycle_policynew) constructor.
   - `named_port` (`list[obj]`): The named port configuration. When `null`, the `named_port` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.named_port.new](#fn-named_portnew) constructor.
   - `stateful_disk` (`list[obj]`): Disks created on the instances that will be preserved on instance delete, update, etc. When `null`, the `stateful_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.stateful_disk.new](#fn-stateful_disknew) constructor.
+  - `stateful_external_ip` (`list[obj]`): External IPs considered stateful by the instance group.  When `null`, the `stateful_external_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.stateful_external_ip.new](#fn-stateful_external_ipnew) constructor.
+  - `stateful_internal_ip` (`list[obj]`): External IPs considered stateful by the instance group.  When `null`, the `stateful_internal_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.stateful_internal_ip.new](#fn-stateful_internal_ipnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.timeouts.new](#fn-timeoutsnew) constructor.
   - `update_policy` (`list[obj]`): The update policy for this managed instance group. When `null`, the `update_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.update_policy.new](#fn-update_policynew) constructor.
   - `version` (`list[obj]`): Application versions managed by this instance group. Each version deals with a specific instance template, allowing canary release scenarios. When `null`, the `version` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_instance_group_manager.version.new](#fn-versionnew) constructor.
@@ -375,6 +387,80 @@ function.
   - `value` (`list[obj]`): The value to set for the `stateful_disk` field.
 
 
+### fn withStatefulExternalIp
+
+```ts
+withStatefulExternalIp()
+```
+
+`google.list[obj].withStatefulExternalIp` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the stateful_external_ip field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withStatefulExternalIpMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `stateful_external_ip` field.
+
+
+### fn withStatefulExternalIpMixin
+
+```ts
+withStatefulExternalIpMixin()
+```
+
+`google.list[obj].withStatefulExternalIpMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the stateful_external_ip field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withStatefulExternalIp](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `stateful_external_ip` field.
+
+
+### fn withStatefulInternalIp
+
+```ts
+withStatefulInternalIp()
+```
+
+`google.list[obj].withStatefulInternalIp` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the stateful_internal_ip field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withStatefulInternalIpMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `stateful_internal_ip` field.
+
+
+### fn withStatefulInternalIpMixin
+
+```ts
+withStatefulInternalIpMixin()
+```
+
+`google.list[obj].withStatefulInternalIpMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the stateful_internal_ip field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withStatefulInternalIp](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `stateful_internal_ip` field.
+
+
 ### fn withTargetPools
 
 ```ts
@@ -660,6 +746,54 @@ Terraform sub block.
   - An attribute object that represents the `stateful_disk` sub block.
 
 
+## obj stateful_external_ip
+
+
+
+### fn stateful_external_ip.new
+
+```ts
+new()
+```
+
+
+`google.compute_instance_group_manager.stateful_external_ip.new` constructs a new object with attributes and blocks configured for the `stateful_external_ip`
+Terraform sub block.
+
+
+
+**Args**:
+  - `delete_rule` (`string`): A value that prescribes what should happen to an associated static Address resource when a VM instance is permanently deleted. The available options are NEVER and ON_PERMANENT_INSTANCE_DELETION. NEVER - detach the IP when the VM is deleted, but do not delete the address resource. ON_PERMANENT_INSTANCE_DELETION will delete the stateful address when the VM is permanently deleted from the instance group. The default is NEVER. When `null`, the `delete_rule` field will be omitted from the resulting object.
+  - `interface_name` (`string`): The network interface name When `null`, the `interface_name` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `stateful_external_ip` sub block.
+
+
+## obj stateful_internal_ip
+
+
+
+### fn stateful_internal_ip.new
+
+```ts
+new()
+```
+
+
+`google.compute_instance_group_manager.stateful_internal_ip.new` constructs a new object with attributes and blocks configured for the `stateful_internal_ip`
+Terraform sub block.
+
+
+
+**Args**:
+  - `delete_rule` (`string`): A value that prescribes what should happen to an associated static Address resource when a VM instance is permanently deleted. The available options are NEVER and ON_PERMANENT_INSTANCE_DELETION. NEVER - detach the IP when the VM is deleted, but do not delete the address resource. ON_PERMANENT_INSTANCE_DELETION will delete the stateful address when the VM is permanently deleted from the instance group. The default is NEVER. When `null`, the `delete_rule` field will be omitted from the resulting object.
+  - `interface_name` (`string`): The network interface name When `null`, the `interface_name` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `stateful_internal_ip` sub block.
+
+
 ## obj timeouts
 
 
diff --git a/docs/4.x/compute_instance_template.md b/docs/4.x/compute_instance_template.md
index 45d20384..5a9fe58a 100644
--- a/docs/4.x/compute_instance_template.md
+++ b/docs/4.x/compute_instance_template.md
@@ -124,7 +124,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `can_ip_forward` (`bool`): Whether to allow sending and receiving of packets with non-matching source or destination IPs. This defaults to false. When `null`, the `can_ip_forward` field will be omitted from the resulting object.
   - `description` (`string`): A brief description of this resource. When `null`, the `description` field will be omitted from the resulting object.
   - `instance_description` (`string`): A description of the instance. When `null`, the `instance_description` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to instances created from this template, When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to instances created from this template.
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `machine_type` (`string`): The machine type to create. To create a machine with a custom type (such as extended memory), format the value like custom-VCPUS-MEM_IN_MB like custom-6-20480 for 6 vCPU and 20GB of RAM.
   - `metadata` (`obj`): Metadata key/value pairs to make available from within instances created from this template. When `null`, the `metadata` field will be omitted from the resulting object.
   - `metadata_startup_script` (`string`): An alternative to using the startup-script metadata key, mostly to match the compute_instance resource. This replaces the startup-script metadata key on the created instance and thus the two mechanisms are not allowed to be used simultaneously. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.
@@ -172,7 +175,10 @@ injecting into a complete block.
   - `can_ip_forward` (`bool`): Whether to allow sending and receiving of packets with non-matching source or destination IPs. This defaults to false. When `null`, the `can_ip_forward` field will be omitted from the resulting object.
   - `description` (`string`): A brief description of this resource. When `null`, the `description` field will be omitted from the resulting object.
   - `instance_description` (`string`): A description of the instance. When `null`, the `instance_description` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to instances created from this template, When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to instances created from this template.
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `machine_type` (`string`): The machine type to create. To create a machine with a custom type (such as extended memory), format the value like custom-VCPUS-MEM_IN_MB like custom-6-20480 for 6 vCPU and 20GB of RAM.
   - `metadata` (`obj`): Metadata key/value pairs to make available from within instances created from this template. When `null`, the `metadata` field will be omitted from the resulting object.
   - `metadata_startup_script` (`string`): An alternative to using the startup-script metadata key, mostly to match the compute_instance resource. This replaces the startup-script metadata key on the created instance and thus the two mechanisms are not allowed to be used simultaneously. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.
diff --git a/docs/4.x/compute_network_endpoint_group.md b/docs/4.x/compute_network_endpoint_group.md
index 9b9fdc21..cc580f77 100644
--- a/docs/4.x/compute_network_endpoint_group.md
+++ b/docs/4.x/compute_network_endpoint_group.md
@@ -78,7 +78,7 @@ that 1) have the following load balancing schemes: EXTERNAL, EXTERNAL_MANAGED,
 INTERNAL_MANAGED, and INTERNAL_SELF_MANAGED and 2) support the RATE or
 CONNECTION balancing modes.
 
-Possible values include: GCE_VM_IP, GCE_VM_IP_PORT, and NON_GCP_PRIVATE_IP_PORT. Default value: "GCE_VM_IP_PORT" Possible values: ["GCE_VM_IP", "GCE_VM_IP_PORT", "NON_GCP_PRIVATE_IP_PORT"] When `null`, the `network_endpoint_type` field will be omitted from the resulting object.
+Possible values include: GCE_VM_IP, GCE_VM_IP_PORT, NON_GCP_PRIVATE_IP_PORT, INTERNET_IP_PORT, INTERNET_FQDN_PORT, SERVERLESS, and PRIVATE_SERVICE_CONNECT. Default value: "GCE_VM_IP_PORT" Possible values: ["GCE_VM_IP", "GCE_VM_IP_PORT", "NON_GCP_PRIVATE_IP_PORT", "INTERNET_IP_PORT", "INTERNET_FQDN_PORT", "SERVERLESS", "PRIVATE_SERVICE_CONNECT"] When `null`, the `network_endpoint_type` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `subnetwork` (`string`): Optional subnetwork to which all network endpoints in the NEG belong. When `null`, the `subnetwork` field will be omitted from the resulting object.
   - `zone` (`string`): Zone where the network endpoint group is located. When `null`, the `zone` field will be omitted from the resulting object.
@@ -127,7 +127,7 @@ that 1) have the following load balancing schemes: EXTERNAL, EXTERNAL_MANAGED,
 INTERNAL_MANAGED, and INTERNAL_SELF_MANAGED and 2) support the RATE or
 CONNECTION balancing modes.
 
-Possible values include: GCE_VM_IP, GCE_VM_IP_PORT, and NON_GCP_PRIVATE_IP_PORT. Default value: "GCE_VM_IP_PORT" Possible values: ["GCE_VM_IP", "GCE_VM_IP_PORT", "NON_GCP_PRIVATE_IP_PORT"] When `null`, the `network_endpoint_type` field will be omitted from the resulting object.
+Possible values include: GCE_VM_IP, GCE_VM_IP_PORT, NON_GCP_PRIVATE_IP_PORT, INTERNET_IP_PORT, INTERNET_FQDN_PORT, SERVERLESS, and PRIVATE_SERVICE_CONNECT. Default value: "GCE_VM_IP_PORT" Possible values: ["GCE_VM_IP", "GCE_VM_IP_PORT", "NON_GCP_PRIVATE_IP_PORT", "INTERNET_IP_PORT", "INTERNET_FQDN_PORT", "SERVERLESS", "PRIVATE_SERVICE_CONNECT"] When `null`, the `network_endpoint_type` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `subnetwork` (`string`): Optional subnetwork to which all network endpoints in the NEG belong. When `null`, the `subnetwork` field will be omitted from the resulting object.
   - `zone` (`string`): Zone where the network endpoint group is located. When `null`, the `zone` field will be omitted from the resulting object.
diff --git a/docs/4.x/compute_node_group.md b/docs/4.x/compute_node_group.md
index 2476442d..84d161ac 100644
--- a/docs/4.x/compute_node_group.md
+++ b/docs/4.x/compute_node_group.md
@@ -27,7 +27,6 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withProject()`](#fn-withproject)
 * [`fn withShareSettings()`](#fn-withsharesettings)
 * [`fn withShareSettingsMixin()`](#fn-withsharesettingsmixin)
-* [`fn withSize()`](#fn-withsize)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
 * [`fn withZone()`](#fn-withzone)
@@ -72,15 +71,16 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): An optional textual description of the resource. When `null`, the `description` field will be omitted from the resulting object.
-  - `initial_size` (`number`): The initial number of nodes in the node group. One of 'initial_size' or 'size' must be specified. When `null`, the `initial_size` field will be omitted from the resulting object.
+  - `initial_size` (`number`): The initial number of nodes in the node group. One of 'initial_size' or 'autoscaling_policy' must be configured on resource creation. When `null`, the `initial_size` field will be omitted from the resulting object.
   - `maintenance_policy` (`string`): Specifies how to handle instances when a node in the group undergoes maintenance. Set to one of: DEFAULT, RESTART_IN_PLACE, or MIGRATE_WITHIN_NODE_GROUP. The default value is DEFAULT. When `null`, the `maintenance_policy` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource. When `null`, the `name` field will be omitted from the resulting object.
   - `node_template` (`string`): The URL of the node template to which this node group belongs.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
-  - `size` (`number`): The total number of nodes in the node group. One of 'initial_size' or 'size' must be specified. When `null`, the `size` field will be omitted from the resulting object.
   - `zone` (`string`): Zone where this node group is located When `null`, the `zone` field will be omitted from the resulting object.
   - `autoscaling_policy` (`list[obj]`): If you use sole-tenant nodes for your workloads, you can use the node
-group autoscaler to automatically manage the sizes of your node groups. When `null`, the `autoscaling_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.autoscaling_policy.new](#fn-autoscaling_policynew) constructor.
+group autoscaler to automatically manage the sizes of your node groups.
+
+One of 'initial_size' or 'autoscaling_policy' must be configured on resource creation. When `null`, the `autoscaling_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.autoscaling_policy.new](#fn-autoscaling_policynew) constructor.
   - `maintenance_window` (`list[obj]`): contains properties for the timeframe of maintenance When `null`, the `maintenance_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.maintenance_window.new](#fn-maintenance_windownew) constructor.
   - `share_settings` (`list[obj]`): Share settings for the node group. When `null`, the `share_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.share_settings.new](#fn-share_settingsnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.timeouts.new](#fn-timeoutsnew) constructor.
@@ -108,15 +108,16 @@ injecting into a complete block.
 
 **Args**:
   - `description` (`string`): An optional textual description of the resource. When `null`, the `description` field will be omitted from the resulting object.
-  - `initial_size` (`number`): The initial number of nodes in the node group. One of 'initial_size' or 'size' must be specified. When `null`, the `initial_size` field will be omitted from the resulting object.
+  - `initial_size` (`number`): The initial number of nodes in the node group. One of 'initial_size' or 'autoscaling_policy' must be configured on resource creation. When `null`, the `initial_size` field will be omitted from the resulting object.
   - `maintenance_policy` (`string`): Specifies how to handle instances when a node in the group undergoes maintenance. Set to one of: DEFAULT, RESTART_IN_PLACE, or MIGRATE_WITHIN_NODE_GROUP. The default value is DEFAULT. When `null`, the `maintenance_policy` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource. When `null`, the `name` field will be omitted from the resulting object.
   - `node_template` (`string`): The URL of the node template to which this node group belongs.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
-  - `size` (`number`): The total number of nodes in the node group. One of 'initial_size' or 'size' must be specified. When `null`, the `size` field will be omitted from the resulting object.
   - `zone` (`string`): Zone where this node group is located When `null`, the `zone` field will be omitted from the resulting object.
   - `autoscaling_policy` (`list[obj]`): If you use sole-tenant nodes for your workloads, you can use the node
-group autoscaler to automatically manage the sizes of your node groups. When `null`, the `autoscaling_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.autoscaling_policy.new](#fn-autoscaling_policynew) constructor.
+group autoscaler to automatically manage the sizes of your node groups.
+
+One of 'initial_size' or 'autoscaling_policy' must be configured on resource creation. When `null`, the `autoscaling_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.autoscaling_policy.new](#fn-autoscaling_policynew) constructor.
   - `maintenance_window` (`list[obj]`): contains properties for the timeframe of maintenance When `null`, the `maintenance_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.maintenance_window.new](#fn-maintenance_windownew) constructor.
   - `share_settings` (`list[obj]`): Share settings for the node group. When `null`, the `share_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.share_settings.new](#fn-share_settingsnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_node_group.timeouts.new](#fn-timeoutsnew) constructor.
@@ -332,22 +333,6 @@ function.
   - `value` (`list[obj]`): The value to set for the `share_settings` field.
 
 
-### fn withSize
-
-```ts
-withSize()
-```
-
-`google.number.withSize` constructs a mixin object that can be merged into the `number`
-Terraform resource block to set or update the size field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`number`): The value to set for the `size` field.
-
-
 ### fn withTimeouts
 
 ```ts
diff --git a/docs/4.x/compute_per_instance_config.md b/docs/4.x/compute_per_instance_config.md
index 8ff0e892..21da3a9e 100644
--- a/docs/4.x/compute_per_instance_config.md
+++ b/docs/4.x/compute_per_instance_config.md
@@ -30,6 +30,14 @@ This package contains functions and utilities for setting up the resource using
   * [`fn new()`](#fn-preserved_statenew)
   * [`obj preserved_state.disk`](#obj-preserved_statedisk)
     * [`fn new()`](#fn-preserved_statedisknew)
+  * [`obj preserved_state.external_ip`](#obj-preserved_stateexternal_ip)
+    * [`fn new()`](#fn-preserved_stateexternal_ipnew)
+    * [`obj preserved_state.external_ip.ip_address`](#obj-preserved_stateexternal_ipip_address)
+      * [`fn new()`](#fn-preserved_stateexternal_ipip_addressnew)
+  * [`obj preserved_state.internal_ip`](#obj-preserved_stateinternal_ip)
+    * [`fn new()`](#fn-preserved_stateinternal_ipnew)
+    * [`obj preserved_state.internal_ip.ip_address`](#obj-preserved_stateinternal_ipip_address)
+      * [`fn new()`](#fn-preserved_stateinternal_ipip_addressnew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 
@@ -336,6 +344,8 @@ Terraform sub block.
 **Args**:
   - `metadata` (`obj`): Preserved metadata defined for this instance. This is a list of key->value pairs. When `null`, the `metadata` field will be omitted from the resulting object.
   - `disk` (`list[obj]`): Stateful disks for the instance. When `null`, the `disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_per_instance_config.preserved_state.disk.new](#fn-preserved_statedisknew) constructor.
+  - `external_ip` (`list[obj]`): Preserved external IPs defined for this instance. This map is keyed with the name of the network interface. When `null`, the `external_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_per_instance_config.preserved_state.external_ip.new](#fn-preserved_stateexternal_ipnew) constructor.
+  - `internal_ip` (`list[obj]`): Preserved internal IPs defined for this instance. This map is keyed with the name of the network interface. When `null`, the `internal_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_per_instance_config.preserved_state.internal_ip.new](#fn-preserved_stateinternal_ipnew) constructor.
 
 **Returns**:
   - An attribute object that represents the `preserved_state` sub block.
@@ -372,6 +382,102 @@ deleted from the instance group. Default value: "NEVER" Possible values:
   - An attribute object that represents the `disk` sub block.
 
 
+## obj preserved_state.external_ip
+
+
+
+### fn preserved_state.external_ip.new
+
+```ts
+new()
+```
+
+
+`google.compute_per_instance_config.preserved_state.external_ip.new` constructs a new object with attributes and blocks configured for the `external_ip`
+Terraform sub block.
+
+
+
+**Args**:
+  - `auto_delete` (`string`): These stateful IPs will never be released during autohealing, update or VM instance recreate operations. This flag is used to configure if the IP reservation should be deleted after it is no longer used by the group, e.g. when the given instance or the whole group is deleted. Default value: "NEVER" Possible values: ["NEVER", "ON_PERMANENT_INSTANCE_DELETION"] When `null`, the `auto_delete` field will be omitted from the resulting object.
+  - `interface_name` (`string`): Set the `interface_name` field on the resulting object.
+  - `ip_address` (`list[obj]`): Ip address representation When `null`, the `ip_address` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_per_instance_config.preserved_state.external_ip.ip_address.new](#fn-preserved_statepreserved_stateip_addressnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `external_ip` sub block.
+
+
+## obj preserved_state.external_ip.ip_address
+
+
+
+### fn preserved_state.external_ip.ip_address.new
+
+```ts
+new()
+```
+
+
+`google.compute_per_instance_config.preserved_state.external_ip.ip_address.new` constructs a new object with attributes and blocks configured for the `ip_address`
+Terraform sub block.
+
+
+
+**Args**:
+  - `address` (`string`): The URL of the reservation for this IP address. When `null`, the `address` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `ip_address` sub block.
+
+
+## obj preserved_state.internal_ip
+
+
+
+### fn preserved_state.internal_ip.new
+
+```ts
+new()
+```
+
+
+`google.compute_per_instance_config.preserved_state.internal_ip.new` constructs a new object with attributes and blocks configured for the `internal_ip`
+Terraform sub block.
+
+
+
+**Args**:
+  - `auto_delete` (`string`): These stateful IPs will never be released during autohealing, update or VM instance recreate operations. This flag is used to configure if the IP reservation should be deleted after it is no longer used by the group, e.g. when the given instance or the whole group is deleted. Default value: "NEVER" Possible values: ["NEVER", "ON_PERMANENT_INSTANCE_DELETION"] When `null`, the `auto_delete` field will be omitted from the resulting object.
+  - `interface_name` (`string`): Set the `interface_name` field on the resulting object.
+  - `ip_address` (`list[obj]`): Ip address representation When `null`, the `ip_address` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_per_instance_config.preserved_state.internal_ip.ip_address.new](#fn-preserved_statepreserved_stateip_addressnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `internal_ip` sub block.
+
+
+## obj preserved_state.internal_ip.ip_address
+
+
+
+### fn preserved_state.internal_ip.ip_address.new
+
+```ts
+new()
+```
+
+
+`google.compute_per_instance_config.preserved_state.internal_ip.ip_address.new` constructs a new object with attributes and blocks configured for the `ip_address`
+Terraform sub block.
+
+
+
+**Args**:
+  - `address` (`string`): The URL of the reservation for this IP address. When `null`, the `address` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `ip_address` sub block.
+
+
 ## obj timeouts
 
 
diff --git a/docs/4.x/compute_region_disk.md b/docs/4.x/compute_region_disk.md
index 03e082de..688828ea 100644
--- a/docs/4.x/compute_region_disk.md
+++ b/docs/4.x/compute_region_disk.md
@@ -79,7 +79,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): An optional description of this resource. Provide this property when
 you create the resource. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels to apply to this disk.  A list of key->value pairs. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels to apply to this disk.  A list of key->value pairs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource. Provided by the client when the resource is
 created. The name must be 1-63 characters long, and comply with
@@ -167,7 +171,11 @@ injecting into a complete block.
 **Args**:
   - `description` (`string`): An optional description of this resource. Provide this property when
 you create the resource. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels to apply to this disk.  A list of key->value pairs. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels to apply to this disk.  A list of key->value pairs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `licenses` (`list`): Any applicable license URI. When `null`, the `licenses` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource. Provided by the client when the resource is
 created. The name must be 1-63 characters long, and comply with
diff --git a/docs/4.x/compute_region_instance_group_manager.md b/docs/4.x/compute_region_instance_group_manager.md
index 5ce6b902..27a149dc 100644
--- a/docs/4.x/compute_region_instance_group_manager.md
+++ b/docs/4.x/compute_region_instance_group_manager.md
@@ -31,6 +31,10 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withRegion()`](#fn-withregion)
 * [`fn withStatefulDisk()`](#fn-withstatefuldisk)
 * [`fn withStatefulDiskMixin()`](#fn-withstatefuldiskmixin)
+* [`fn withStatefulExternalIp()`](#fn-withstatefulexternalip)
+* [`fn withStatefulExternalIpMixin()`](#fn-withstatefulexternalipmixin)
+* [`fn withStatefulInternalIp()`](#fn-withstatefulinternalip)
+* [`fn withStatefulInternalIpMixin()`](#fn-withstatefulinternalipmixin)
 * [`fn withTargetPools()`](#fn-withtargetpools)
 * [`fn withTargetSize()`](#fn-withtargetsize)
 * [`fn withTimeouts()`](#fn-withtimeouts)
@@ -49,6 +53,10 @@ This package contains functions and utilities for setting up the resource using
   * [`fn new()`](#fn-named_portnew)
 * [`obj stateful_disk`](#obj-stateful_disk)
   * [`fn new()`](#fn-stateful_disknew)
+* [`obj stateful_external_ip`](#obj-stateful_external_ip)
+  * [`fn new()`](#fn-stateful_external_ipnew)
+* [`obj stateful_internal_ip`](#obj-stateful_internal_ip)
+  * [`fn new()`](#fn-stateful_internal_ipnew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 * [`obj update_policy`](#obj-update_policy)
@@ -103,6 +111,8 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `instance_lifecycle_policy` (`list[obj]`): The instance lifecycle policy for this managed instance group. When `null`, the `instance_lifecycle_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.instance_lifecycle_policy.new](#fn-instance_lifecycle_policynew) constructor.
   - `named_port` (`list[obj]`): The named port configuration. When `null`, the `named_port` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.named_port.new](#fn-named_portnew) constructor.
   - `stateful_disk` (`list[obj]`): Disks created on the instances that will be preserved on instance delete, update, etc. Structure is documented below. For more information see the official documentation. Proactive cross zone instance redistribution must be disabled before you can update stateful disks on existing instance group managers. This can be controlled via the update_policy. When `null`, the `stateful_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.stateful_disk.new](#fn-stateful_disknew) constructor.
+  - `stateful_external_ip` (`list[obj]`): External IPs considered stateful by the instance group.  When `null`, the `stateful_external_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.stateful_external_ip.new](#fn-stateful_external_ipnew) constructor.
+  - `stateful_internal_ip` (`list[obj]`): External IPs considered stateful by the instance group.  When `null`, the `stateful_internal_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.stateful_internal_ip.new](#fn-stateful_internal_ipnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.timeouts.new](#fn-timeoutsnew) constructor.
   - `update_policy` (`list[obj]`): The update policy for this managed instance group. When `null`, the `update_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.update_policy.new](#fn-update_policynew) constructor.
   - `version` (`list[obj]`): Application versions managed by this instance group. Each version deals with a specific instance template, allowing canary release scenarios. When `null`, the `version` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.version.new](#fn-versionnew) constructor.
@@ -145,6 +155,8 @@ injecting into a complete block.
   - `instance_lifecycle_policy` (`list[obj]`): The instance lifecycle policy for this managed instance group. When `null`, the `instance_lifecycle_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.instance_lifecycle_policy.new](#fn-instance_lifecycle_policynew) constructor.
   - `named_port` (`list[obj]`): The named port configuration. When `null`, the `named_port` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.named_port.new](#fn-named_portnew) constructor.
   - `stateful_disk` (`list[obj]`): Disks created on the instances that will be preserved on instance delete, update, etc. Structure is documented below. For more information see the official documentation. Proactive cross zone instance redistribution must be disabled before you can update stateful disks on existing instance group managers. This can be controlled via the update_policy. When `null`, the `stateful_disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.stateful_disk.new](#fn-stateful_disknew) constructor.
+  - `stateful_external_ip` (`list[obj]`): External IPs considered stateful by the instance group.  When `null`, the `stateful_external_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.stateful_external_ip.new](#fn-stateful_external_ipnew) constructor.
+  - `stateful_internal_ip` (`list[obj]`): External IPs considered stateful by the instance group.  When `null`, the `stateful_internal_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.stateful_internal_ip.new](#fn-stateful_internal_ipnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.timeouts.new](#fn-timeoutsnew) constructor.
   - `update_policy` (`list[obj]`): The update policy for this managed instance group. When `null`, the `update_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.update_policy.new](#fn-update_policynew) constructor.
   - `version` (`list[obj]`): Application versions managed by this instance group. Each version deals with a specific instance template, allowing canary release scenarios. When `null`, the `version` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_instance_group_manager.version.new](#fn-versionnew) constructor.
@@ -429,6 +441,80 @@ function.
   - `value` (`list[obj]`): The value to set for the `stateful_disk` field.
 
 
+### fn withStatefulExternalIp
+
+```ts
+withStatefulExternalIp()
+```
+
+`google.list[obj].withStatefulExternalIp` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the stateful_external_ip field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withStatefulExternalIpMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `stateful_external_ip` field.
+
+
+### fn withStatefulExternalIpMixin
+
+```ts
+withStatefulExternalIpMixin()
+```
+
+`google.list[obj].withStatefulExternalIpMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the stateful_external_ip field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withStatefulExternalIp](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `stateful_external_ip` field.
+
+
+### fn withStatefulInternalIp
+
+```ts
+withStatefulInternalIp()
+```
+
+`google.list[obj].withStatefulInternalIp` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the stateful_internal_ip field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withStatefulInternalIpMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `stateful_internal_ip` field.
+
+
+### fn withStatefulInternalIpMixin
+
+```ts
+withStatefulInternalIpMixin()
+```
+
+`google.list[obj].withStatefulInternalIpMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the stateful_internal_ip field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withStatefulInternalIp](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `stateful_internal_ip` field.
+
+
 ### fn withTargetPools
 
 ```ts
@@ -698,6 +784,54 @@ Terraform sub block.
   - An attribute object that represents the `stateful_disk` sub block.
 
 
+## obj stateful_external_ip
+
+
+
+### fn stateful_external_ip.new
+
+```ts
+new()
+```
+
+
+`google.compute_region_instance_group_manager.stateful_external_ip.new` constructs a new object with attributes and blocks configured for the `stateful_external_ip`
+Terraform sub block.
+
+
+
+**Args**:
+  - `delete_rule` (`string`): A value that prescribes what should happen to an associated static Address resource when a VM instance is permanently deleted. The available options are NEVER and ON_PERMANENT_INSTANCE_DELETION. NEVER - detach the IP when the VM is deleted, but do not delete the address resource. ON_PERMANENT_INSTANCE_DELETION will delete the stateful address when the VM is permanently deleted from the instance group. The default is NEVER. When `null`, the `delete_rule` field will be omitted from the resulting object.
+  - `interface_name` (`string`): The network interface name When `null`, the `interface_name` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `stateful_external_ip` sub block.
+
+
+## obj stateful_internal_ip
+
+
+
+### fn stateful_internal_ip.new
+
+```ts
+new()
+```
+
+
+`google.compute_region_instance_group_manager.stateful_internal_ip.new` constructs a new object with attributes and blocks configured for the `stateful_internal_ip`
+Terraform sub block.
+
+
+
+**Args**:
+  - `delete_rule` (`string`): A value that prescribes what should happen to an associated static Address resource when a VM instance is permanently deleted. The available options are NEVER and ON_PERMANENT_INSTANCE_DELETION. NEVER - detach the IP when the VM is deleted, but do not delete the address resource. ON_PERMANENT_INSTANCE_DELETION will delete the stateful address when the VM is permanently deleted from the instance group. The default is NEVER. When `null`, the `delete_rule` field will be omitted from the resulting object.
+  - `interface_name` (`string`): The network interface name When `null`, the `interface_name` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `stateful_internal_ip` sub block.
+
+
 ## obj timeouts
 
 
diff --git a/docs/4.x/compute_region_instance_template.md b/docs/4.x/compute_region_instance_template.md
index 07bbfe99..19664372 100644
--- a/docs/4.x/compute_region_instance_template.md
+++ b/docs/4.x/compute_region_instance_template.md
@@ -124,7 +124,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `can_ip_forward` (`bool`): Whether to allow sending and receiving of packets with non-matching source or destination IPs. This defaults to false. When `null`, the `can_ip_forward` field will be omitted from the resulting object.
   - `description` (`string`): A brief description of this resource. When `null`, the `description` field will be omitted from the resulting object.
   - `instance_description` (`string`): A description of the instance. When `null`, the `instance_description` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to instances created from this template, When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to instances created from this template,
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `machine_type` (`string`): The machine type to create. To create a machine with a custom type (such as extended memory), format the value like custom-VCPUS-MEM_IN_MB like custom-6-20480 for 6 vCPU and 20GB of RAM.
   - `metadata` (`obj`): Metadata key/value pairs to make available from within instances created from this template. When `null`, the `metadata` field will be omitted from the resulting object.
   - `metadata_startup_script` (`string`): An alternative to using the startup-script metadata key, mostly to match the compute_instance resource. This replaces the startup-script metadata key on the created instance and thus the two mechanisms are not allowed to be used simultaneously. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.
@@ -172,7 +175,10 @@ injecting into a complete block.
   - `can_ip_forward` (`bool`): Whether to allow sending and receiving of packets with non-matching source or destination IPs. This defaults to false. When `null`, the `can_ip_forward` field will be omitted from the resulting object.
   - `description` (`string`): A brief description of this resource. When `null`, the `description` field will be omitted from the resulting object.
   - `instance_description` (`string`): A description of the instance. When `null`, the `instance_description` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to instances created from this template, When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to instances created from this template,
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `machine_type` (`string`): The machine type to create. To create a machine with a custom type (such as extended memory), format the value like custom-VCPUS-MEM_IN_MB like custom-6-20480 for 6 vCPU and 20GB of RAM.
   - `metadata` (`obj`): Metadata key/value pairs to make available from within instances created from this template. When `null`, the `metadata` field will be omitted from the resulting object.
   - `metadata_startup_script` (`string`): An alternative to using the startup-script metadata key, mostly to match the compute_instance resource. This replaces the startup-script metadata key on the created instance and thus the two mechanisms are not allowed to be used simultaneously. When `null`, the `metadata_startup_script` field will be omitted from the resulting object.
diff --git a/docs/4.x/compute_region_per_instance_config.md b/docs/4.x/compute_region_per_instance_config.md
index 8a330a6d..eee74c03 100644
--- a/docs/4.x/compute_region_per_instance_config.md
+++ b/docs/4.x/compute_region_per_instance_config.md
@@ -30,6 +30,14 @@ This package contains functions and utilities for setting up the resource using
   * [`fn new()`](#fn-preserved_statenew)
   * [`obj preserved_state.disk`](#obj-preserved_statedisk)
     * [`fn new()`](#fn-preserved_statedisknew)
+  * [`obj preserved_state.external_ip`](#obj-preserved_stateexternal_ip)
+    * [`fn new()`](#fn-preserved_stateexternal_ipnew)
+    * [`obj preserved_state.external_ip.ip_address`](#obj-preserved_stateexternal_ipip_address)
+      * [`fn new()`](#fn-preserved_stateexternal_ipip_addressnew)
+  * [`obj preserved_state.internal_ip`](#obj-preserved_stateinternal_ip)
+    * [`fn new()`](#fn-preserved_stateinternal_ipnew)
+    * [`obj preserved_state.internal_ip.ip_address`](#obj-preserved_stateinternal_ipip_address)
+      * [`fn new()`](#fn-preserved_stateinternal_ipip_addressnew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 
@@ -336,6 +344,8 @@ Terraform sub block.
 **Args**:
   - `metadata` (`obj`): Preserved metadata defined for this instance. This is a list of key->value pairs. When `null`, the `metadata` field will be omitted from the resulting object.
   - `disk` (`list[obj]`): Stateful disks for the instance. When `null`, the `disk` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_per_instance_config.preserved_state.disk.new](#fn-preserved_statedisknew) constructor.
+  - `external_ip` (`list[obj]`): Preserved external IPs defined for this instance. This map is keyed with the name of the network interface. When `null`, the `external_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_per_instance_config.preserved_state.external_ip.new](#fn-preserved_stateexternal_ipnew) constructor.
+  - `internal_ip` (`list[obj]`): Preserved internal IPs defined for this instance. This map is keyed with the name of the network interface. When `null`, the `internal_ip` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_per_instance_config.preserved_state.internal_ip.new](#fn-preserved_stateinternal_ipnew) constructor.
 
 **Returns**:
   - An attribute object that represents the `preserved_state` sub block.
@@ -372,6 +382,102 @@ deleted from the instance group. Default value: "NEVER" Possible values:
   - An attribute object that represents the `disk` sub block.
 
 
+## obj preserved_state.external_ip
+
+
+
+### fn preserved_state.external_ip.new
+
+```ts
+new()
+```
+
+
+`google.compute_region_per_instance_config.preserved_state.external_ip.new` constructs a new object with attributes and blocks configured for the `external_ip`
+Terraform sub block.
+
+
+
+**Args**:
+  - `auto_delete` (`string`): These stateful IPs will never be released during autohealing, update or VM instance recreate operations. This flag is used to configure if the IP reservation should be deleted after it is no longer used by the group, e.g. when the given instance or the whole group is deleted. Default value: "NEVER" Possible values: ["NEVER", "ON_PERMANENT_INSTANCE_DELETION"] When `null`, the `auto_delete` field will be omitted from the resulting object.
+  - `interface_name` (`string`): Set the `interface_name` field on the resulting object.
+  - `ip_address` (`list[obj]`): Ip address representation When `null`, the `ip_address` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_per_instance_config.preserved_state.external_ip.ip_address.new](#fn-preserved_statepreserved_stateip_addressnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `external_ip` sub block.
+
+
+## obj preserved_state.external_ip.ip_address
+
+
+
+### fn preserved_state.external_ip.ip_address.new
+
+```ts
+new()
+```
+
+
+`google.compute_region_per_instance_config.preserved_state.external_ip.ip_address.new` constructs a new object with attributes and blocks configured for the `ip_address`
+Terraform sub block.
+
+
+
+**Args**:
+  - `address` (`string`): The URL of the reservation for this IP address. When `null`, the `address` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `ip_address` sub block.
+
+
+## obj preserved_state.internal_ip
+
+
+
+### fn preserved_state.internal_ip.new
+
+```ts
+new()
+```
+
+
+`google.compute_region_per_instance_config.preserved_state.internal_ip.new` constructs a new object with attributes and blocks configured for the `internal_ip`
+Terraform sub block.
+
+
+
+**Args**:
+  - `auto_delete` (`string`): These stateful IPs will never be released during autohealing, update or VM instance recreate operations. This flag is used to configure if the IP reservation should be deleted after it is no longer used by the group, e.g. when the given instance or the whole group is deleted. Default value: "NEVER" Possible values: ["NEVER", "ON_PERMANENT_INSTANCE_DELETION"] When `null`, the `auto_delete` field will be omitted from the resulting object.
+  - `interface_name` (`string`): Set the `interface_name` field on the resulting object.
+  - `ip_address` (`list[obj]`): Ip address representation When `null`, the `ip_address` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.compute_region_per_instance_config.preserved_state.internal_ip.ip_address.new](#fn-preserved_statepreserved_stateip_addressnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `internal_ip` sub block.
+
+
+## obj preserved_state.internal_ip.ip_address
+
+
+
+### fn preserved_state.internal_ip.ip_address.new
+
+```ts
+new()
+```
+
+
+`google.compute_region_per_instance_config.preserved_state.internal_ip.ip_address.new` constructs a new object with attributes and blocks configured for the `ip_address`
+Terraform sub block.
+
+
+
+**Args**:
+  - `address` (`string`): The URL of the reservation for this IP address. When `null`, the `address` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `ip_address` sub block.
+
+
 ## obj timeouts
 
 
diff --git a/docs/4.x/compute_router_nat.md b/docs/4.x/compute_router_nat.md
index 55344632..1d3c29a3 100644
--- a/docs/4.x/compute_router_nat.md
+++ b/docs/4.x/compute_router_nat.md
@@ -89,8 +89,8 @@ If maxPortsPerVm is set, maxPortsPerVm must be set to a power of two greater tha
 If maxPortsPerVm is not set, a maximum of 65536 ports will be allocated to a VM from this NAT config.
 
 Mutually exclusive with enableEndpointIndependentMapping. When `null`, the `enable_dynamic_port_allocation` field will be omitted from the resulting object.
-  - `enable_endpoint_independent_mapping` (`bool`): Specifies if endpoint independent mapping is enabled. This is enabled by default. For more information
-see the [official documentation](https://cloud.google.com/nat/docs/overview#specs-rfcs). When `null`, the `enable_endpoint_independent_mapping` field will be omitted from the resulting object.
+  - `enable_endpoint_independent_mapping` (`bool`): Enable endpoint independent mapping.
+For more information see the [official documentation](https://cloud.google.com/nat/docs/overview#specs-rfcs). When `null`, the `enable_endpoint_independent_mapping` field will be omitted from the resulting object.
   - `icmp_idle_timeout_sec` (`number`): Timeout (in seconds) for ICMP connections. Defaults to 30s if not set. When `null`, the `icmp_idle_timeout_sec` field will be omitted from the resulting object.
   - `max_ports_per_vm` (`number`): Maximum number of ports allocated to a VM from this NAT.
 This field can only be set when enableDynamicPortAllocation is enabled. When `null`, the `max_ports_per_vm` field will be omitted from the resulting object.
@@ -99,7 +99,7 @@ This field can only be set when enableDynamicPortAllocation is enabled. When `nu
 comply with RFC1035.
   - `nat_ip_allocate_option` (`string`): How external IPs should be allocated for this NAT. Valid values are
 'AUTO_ONLY' for only allowing NAT IPs allocated by Google Cloud
-Platform, or 'MANUAL_ONLY' for only user-allocated NAT IP addresses. Possible values: ["MANUAL_ONLY", "AUTO_ONLY"]
+Platform, or 'MANUAL_ONLY' for only user-allocated NAT IP addresses. Possible values: ["MANUAL_ONLY", "AUTO_ONLY"] When `null`, the `nat_ip_allocate_option` field will be omitted from the resulting object.
   - `nat_ips` (`list`): Self-links of NAT IPs. Only valid if natIpAllocateOption
 is set to MANUAL_ONLY. When `null`, the `nat_ips` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
@@ -159,8 +159,8 @@ If maxPortsPerVm is set, maxPortsPerVm must be set to a power of two greater tha
 If maxPortsPerVm is not set, a maximum of 65536 ports will be allocated to a VM from this NAT config.
 
 Mutually exclusive with enableEndpointIndependentMapping. When `null`, the `enable_dynamic_port_allocation` field will be omitted from the resulting object.
-  - `enable_endpoint_independent_mapping` (`bool`): Specifies if endpoint independent mapping is enabled. This is enabled by default. For more information
-see the [official documentation](https://cloud.google.com/nat/docs/overview#specs-rfcs). When `null`, the `enable_endpoint_independent_mapping` field will be omitted from the resulting object.
+  - `enable_endpoint_independent_mapping` (`bool`): Enable endpoint independent mapping.
+For more information see the [official documentation](https://cloud.google.com/nat/docs/overview#specs-rfcs). When `null`, the `enable_endpoint_independent_mapping` field will be omitted from the resulting object.
   - `icmp_idle_timeout_sec` (`number`): Timeout (in seconds) for ICMP connections. Defaults to 30s if not set. When `null`, the `icmp_idle_timeout_sec` field will be omitted from the resulting object.
   - `max_ports_per_vm` (`number`): Maximum number of ports allocated to a VM from this NAT.
 This field can only be set when enableDynamicPortAllocation is enabled. When `null`, the `max_ports_per_vm` field will be omitted from the resulting object.
@@ -169,7 +169,7 @@ This field can only be set when enableDynamicPortAllocation is enabled. When `nu
 comply with RFC1035.
   - `nat_ip_allocate_option` (`string`): How external IPs should be allocated for this NAT. Valid values are
 'AUTO_ONLY' for only allowing NAT IPs allocated by Google Cloud
-Platform, or 'MANUAL_ONLY' for only user-allocated NAT IP addresses. Possible values: ["MANUAL_ONLY", "AUTO_ONLY"]
+Platform, or 'MANUAL_ONLY' for only user-allocated NAT IP addresses. Possible values: ["MANUAL_ONLY", "AUTO_ONLY"] When `null`, the `nat_ip_allocate_option` field will be omitted from the resulting object.
   - `nat_ips` (`list`): Self-links of NAT IPs. Only valid if natIpAllocateOption
 is set to MANUAL_ONLY. When `null`, the `nat_ips` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
diff --git a/docs/4.x/compute_service_attachment.md b/docs/4.x/compute_service_attachment.md
index c7236dec..2e7b977b 100644
--- a/docs/4.x/compute_service_attachment.md
+++ b/docs/4.x/compute_service_attachment.md
@@ -87,9 +87,7 @@ except the last character, which cannot be a dash.
   - `reconcile_connections` (`bool`): This flag determines whether a consumer accept/reject list change can reconcile the statuses of existing ACCEPTED or REJECTED PSC endpoints.
 
 If false, connection policy update will only affect existing PENDING PSC endpoints. Existing ACCEPTED/REJECTED endpoints will remain untouched regardless how the connection policy is modified .
-If true, update will affect both PENDING and ACCEPTED/REJECTED PSC endpoints. For example, an ACCEPTED PSC endpoint will be moved to REJECTED if its project is added to the reject list.
-
-For newly created service attachment, this boolean defaults to true. When `null`, the `reconcile_connections` field will be omitted from the resulting object.
+If true, update will affect both PENDING and ACCEPTED/REJECTED PSC endpoints. For example, an ACCEPTED PSC endpoint will be moved to REJECTED if its project is added to the reject list. When `null`, the `reconcile_connections` field will be omitted from the resulting object.
   - `region` (`string`): URL of the region where the resource resides. When `null`, the `region` field will be omitted from the resulting object.
   - `target_service` (`string`): The URL of a forwarding rule that represents the service identified by
 this service attachment.
@@ -142,9 +140,7 @@ except the last character, which cannot be a dash.
   - `reconcile_connections` (`bool`): This flag determines whether a consumer accept/reject list change can reconcile the statuses of existing ACCEPTED or REJECTED PSC endpoints.
 
 If false, connection policy update will only affect existing PENDING PSC endpoints. Existing ACCEPTED/REJECTED endpoints will remain untouched regardless how the connection policy is modified .
-If true, update will affect both PENDING and ACCEPTED/REJECTED PSC endpoints. For example, an ACCEPTED PSC endpoint will be moved to REJECTED if its project is added to the reject list.
-
-For newly created service attachment, this boolean defaults to true. When `null`, the `reconcile_connections` field will be omitted from the resulting object.
+If true, update will affect both PENDING and ACCEPTED/REJECTED PSC endpoints. For example, an ACCEPTED PSC endpoint will be moved to REJECTED if its project is added to the reject list. When `null`, the `reconcile_connections` field will be omitted from the resulting object.
   - `region` (`string`): URL of the region where the resource resides. When `null`, the `region` field will be omitted from the resulting object.
   - `target_service` (`string`): The URL of a forwarding rule that represents the service identified by
 this service attachment.
diff --git a/docs/4.x/compute_snapshot.md b/docs/4.x/compute_snapshot.md
index d482b744..17af0f7a 100644
--- a/docs/4.x/compute_snapshot.md
+++ b/docs/4.x/compute_snapshot.md
@@ -72,7 +72,10 @@ service owners who needs to create separate snapshot chains, for
 example, for chargeback tracking.  When you describe your snapshot
 resource, this field is visible only if it has a non-empty value. When `null`, the `chain_name` field will be omitted from the resulting object.
   - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels to apply to this Snapshot. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels to apply to this Snapshot.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource; provided by the client when the resource is
 created. The name must be 1-63 characters long, and comply with
 RFC1035. Specifically, the name must be 1-63 characters long and match
@@ -131,7 +134,10 @@ service owners who needs to create separate snapshot chains, for
 example, for chargeback tracking.  When you describe your snapshot
 resource, this field is visible only if it has a non-empty value. When `null`, the `chain_name` field will be omitted from the resulting object.
   - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels to apply to this Snapshot. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels to apply to this Snapshot.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource; provided by the client when the resource is
 created. The name must be 1-63 characters long, and comply with
 RFC1035. Specifically, the name must be 1-63 characters long and match
diff --git a/docs/4.x/compute_subnetwork.md b/docs/4.x/compute_subnetwork.md
index 64136a14..89e12287 100644
--- a/docs/4.x/compute_subnetwork.md
+++ b/docs/4.x/compute_subnetwork.md
@@ -89,10 +89,11 @@ Only networks that are in the distributed mode can have subnetworks.
 access Google APIs and services by using Private Google Access. When `null`, the `private_ip_google_access` field will be omitted from the resulting object.
   - `private_ipv6_google_access` (`string`): The private IPv6 google access type for the VMs in this subnet. When `null`, the `private_ipv6_google_access` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
-  - `purpose` (`string`): The purpose of the resource. This field can be either 'PRIVATE_RFC_1918', 'REGIONAL_MANAGED_PROXY', 'GLOBAL_MANAGED_PROXY', or 'PRIVATE_SERVICE_CONNECT'.
+  - `purpose` (`string`): The purpose of the resource. This field can be either 'PRIVATE_RFC_1918', 'REGIONAL_MANAGED_PROXY', 'GLOBAL_MANAGED_PROXY', 'PRIVATE_SERVICE_CONNECT' or 'PRIVATE_NAT'([Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html)).
 A subnet with purpose set to 'REGIONAL_MANAGED_PROXY' is a user-created subnetwork that is reserved for regional Envoy-based load balancers.
 A subnetwork in a given region with purpose set to 'GLOBAL_MANAGED_PROXY' is a proxy-only subnet and is shared between all the cross-regional Envoy-based load balancers.
 A subnetwork with purpose set to 'PRIVATE_SERVICE_CONNECT' reserves the subnet for hosting a Private Service Connect published service.
+A subnetwork with purpose set to 'PRIVATE_NAT' is used as source range for Private NAT gateways.
 Note that 'REGIONAL_MANAGED_PROXY' is the preferred setting for all regional Envoy load balancers.
 If unspecified, the purpose defaults to 'PRIVATE_RFC_1918'. When `null`, the `purpose` field will be omitted from the resulting object.
   - `region` (`string`): The GCP region for this subnetwork. When `null`, the `region` field will be omitted from the resulting object.
@@ -164,10 +165,11 @@ Only networks that are in the distributed mode can have subnetworks.
 access Google APIs and services by using Private Google Access. When `null`, the `private_ip_google_access` field will be omitted from the resulting object.
   - `private_ipv6_google_access` (`string`): The private IPv6 google access type for the VMs in this subnet. When `null`, the `private_ipv6_google_access` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
-  - `purpose` (`string`): The purpose of the resource. This field can be either 'PRIVATE_RFC_1918', 'REGIONAL_MANAGED_PROXY', 'GLOBAL_MANAGED_PROXY', or 'PRIVATE_SERVICE_CONNECT'.
+  - `purpose` (`string`): The purpose of the resource. This field can be either 'PRIVATE_RFC_1918', 'REGIONAL_MANAGED_PROXY', 'GLOBAL_MANAGED_PROXY', 'PRIVATE_SERVICE_CONNECT' or 'PRIVATE_NAT'([Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html)).
 A subnet with purpose set to 'REGIONAL_MANAGED_PROXY' is a user-created subnetwork that is reserved for regional Envoy-based load balancers.
 A subnetwork in a given region with purpose set to 'GLOBAL_MANAGED_PROXY' is a proxy-only subnet and is shared between all the cross-regional Envoy-based load balancers.
 A subnetwork with purpose set to 'PRIVATE_SERVICE_CONNECT' reserves the subnet for hosting a Private Service Connect published service.
+A subnetwork with purpose set to 'PRIVATE_NAT' is used as source range for Private NAT gateways.
 Note that 'REGIONAL_MANAGED_PROXY' is the preferred setting for all regional Envoy load balancers.
 If unspecified, the purpose defaults to 'PRIVATE_RFC_1918'. When `null`, the `purpose` field will be omitted from the resulting object.
   - `region` (`string`): The GCP region for this subnetwork. When `null`, the `region` field will be omitted from the resulting object.
diff --git a/docs/4.x/compute_target_https_proxy.md b/docs/4.x/compute_target_https_proxy.md
index 21b13c5f..e42b8c38 100644
--- a/docs/4.x/compute_target_https_proxy.md
+++ b/docs/4.x/compute_target_https_proxy.md
@@ -15,6 +15,7 @@ This package contains functions and utilities for setting up the resource using
 
 * [`fn new()`](#fn-new)
 * [`fn newAttrs()`](#fn-newattrs)
+* [`fn withCertificateManagerCertificates()`](#fn-withcertificatemanagercertificates)
 * [`fn withCertificateMap()`](#fn-withcertificatemap)
 * [`fn withDescription()`](#fn-withdescription)
 * [`fn withHttpKeepAliveTimeoutSec()`](#fn-withhttpkeepalivetimeoutsec)
@@ -60,6 +61,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
+  - `certificate_manager_certificates` (`list`): URLs to certificate manager certificate resources that are used to authenticate connections between users and the load balancer.
+Currently, you may specify up to 15 certificates. Certificate manager certificates do not apply when the load balancing scheme is set to INTERNAL_SELF_MANAGED.
+sslCertificates and certificateManagerCertificates fields can not be defined together.
+Accepted format is '//certificatemanager.googleapis.com/projects/{project}/locations/{location}/certificates/{resourceName}' or just the self_link 'projects/{project}/locations/{location}/certificates/{resourceName}' When `null`, the `certificate_manager_certificates` field will be omitted from the resulting object.
   - `certificate_map` (`string`): A reference to the CertificateMap resource uri that identifies a certificate map
 associated with the given target proxy. This field can only be set for global target proxies.
 Accepted format is '//certificatemanager.googleapis.com/projects/{project}/locations/{location}/certificateMaps/{resourceName}'. When `null`, the `certificate_map` field will be omitted from the resulting object.
@@ -93,8 +98,9 @@ For details which ServerTlsPolicy resources are accepted with
 INTERNAL_SELF_MANAGED and which with EXTERNAL, EXTERNAL_MANAGED
 loadBalancingScheme consult ServerTlsPolicy documentation.
 If left blank, communications are not encrypted. When `null`, the `server_tls_policy` field will be omitted from the resulting object.
-  - `ssl_certificates` (`list`): A list of SslCertificate resource URLs or Certificate Manager certificate URLs that are used to authenticate
-connections between users and the load balancer. At least one resource must be specified. When `null`, the `ssl_certificates` field will be omitted from the resulting object.
+  - `ssl_certificates` (`list`): URLs to SslCertificate resources that are used to authenticate connections between users and the load balancer.
+Currently, you may specify up to 15 SSL certificates. sslCertificates do not apply when the load balancing scheme is set to INTERNAL_SELF_MANAGED.
+sslCertificates and certificateManagerCertificates can not be defined together. When `null`, the `ssl_certificates` field will be omitted from the resulting object.
   - `ssl_policy` (`string`): A reference to the SslPolicy resource that will be associated with
 the TargetHttpsProxy resource. If not set, the TargetHttpsProxy
 resource will not have any SSL policy configured. When `null`, the `ssl_policy` field will be omitted from the resulting object.
@@ -124,6 +130,10 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
+  - `certificate_manager_certificates` (`list`): URLs to certificate manager certificate resources that are used to authenticate connections between users and the load balancer.
+Currently, you may specify up to 15 certificates. Certificate manager certificates do not apply when the load balancing scheme is set to INTERNAL_SELF_MANAGED.
+sslCertificates and certificateManagerCertificates fields can not be defined together.
+Accepted format is '//certificatemanager.googleapis.com/projects/{project}/locations/{location}/certificates/{resourceName}' or just the self_link 'projects/{project}/locations/{location}/certificates/{resourceName}' When `null`, the `certificate_manager_certificates` field will be omitted from the resulting object.
   - `certificate_map` (`string`): A reference to the CertificateMap resource uri that identifies a certificate map
 associated with the given target proxy. This field can only be set for global target proxies.
 Accepted format is '//certificatemanager.googleapis.com/projects/{project}/locations/{location}/certificateMaps/{resourceName}'. When `null`, the `certificate_map` field will be omitted from the resulting object.
@@ -157,8 +167,9 @@ For details which ServerTlsPolicy resources are accepted with
 INTERNAL_SELF_MANAGED and which with EXTERNAL, EXTERNAL_MANAGED
 loadBalancingScheme consult ServerTlsPolicy documentation.
 If left blank, communications are not encrypted. When `null`, the `server_tls_policy` field will be omitted from the resulting object.
-  - `ssl_certificates` (`list`): A list of SslCertificate resource URLs or Certificate Manager certificate URLs that are used to authenticate
-connections between users and the load balancer. At least one resource must be specified. When `null`, the `ssl_certificates` field will be omitted from the resulting object.
+  - `ssl_certificates` (`list`): URLs to SslCertificate resources that are used to authenticate connections between users and the load balancer.
+Currently, you may specify up to 15 SSL certificates. sslCertificates do not apply when the load balancing scheme is set to INTERNAL_SELF_MANAGED.
+sslCertificates and certificateManagerCertificates can not be defined together. When `null`, the `ssl_certificates` field will be omitted from the resulting object.
   - `ssl_policy` (`string`): A reference to the SslPolicy resource that will be associated with
 the TargetHttpsProxy resource. If not set, the TargetHttpsProxy
 resource will not have any SSL policy configured. When `null`, the `ssl_policy` field will be omitted from the resulting object.
@@ -170,6 +181,22 @@ to the BackendService.
   - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `compute_target_https_proxy` resource into the root Terraform configuration.
 
 
+### fn withCertificateManagerCertificates
+
+```ts
+withCertificateManagerCertificates()
+```
+
+`google.list.withCertificateManagerCertificates` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the certificate_manager_certificates field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `certificate_manager_certificates` field.
+
+
 ### fn withCertificateMap
 
 ```ts
diff --git a/docs/4.x/container_attached_cluster.md b/docs/4.x/container_attached_cluster.md
index e5aa0112..d0ef4e96 100644
--- a/docs/4.x/container_attached_cluster.md
+++ b/docs/4.x/container_attached_cluster.md
@@ -90,7 +90,11 @@ restrictions as Kubernetes annotations. The total size of all keys and
 values combined is limited to 256k. Key can have 2 segments: prefix (optional)
 and name (required), separated by a slash (/). Prefix must be a DNS subdomain.
 Name must be 63 characters or less, begin and end with alphanumerics,
-with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.
+with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `deletion_policy` (`string`): Policy to determine what flags to send on delete. When `null`, the `deletion_policy` field will be omitted from the resulting object.
   - `description` (`string`): A human readable description of this attached cluster. Cannot be longer
 than 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.
@@ -145,7 +149,11 @@ restrictions as Kubernetes annotations. The total size of all keys and
 values combined is limited to 256k. Key can have 2 segments: prefix (optional)
 and name (required), separated by a slash (/). Prefix must be a DNS subdomain.
 Name must be 63 characters or less, begin and end with alphanumerics,
-with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.
+with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `deletion_policy` (`string`): Policy to determine what flags to send on delete. When `null`, the `deletion_policy` field will be omitted from the resulting object.
   - `description` (`string`): A human readable description of this attached cluster. Cannot be longer
 than 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.
@@ -580,6 +588,12 @@ Terraform sub block.
 
 
 **Args**:
+  - `admin_groups` (`list`): Groups that can perform operations as a cluster admin. A managed
+ClusterRoleBinding will be created to grant the 'cluster-admin' ClusterRole
+to the groups. Up to ten admin groups can be provided.
+
+For more info on RBAC, see
+https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles When `null`, the `admin_groups` field will be omitted from the resulting object.
   - `admin_users` (`list`): Users that can perform operations as a cluster admin. A managed
 ClusterRoleBinding will be created to grant the 'cluster-admin' ClusterRole
 to the users. Up to ten admin users can be provided.
diff --git a/docs/4.x/container_aws_cluster.md b/docs/4.x/container_aws_cluster.md
index 92bf34bb..d61cd202 100644
--- a/docs/4.x/container_aws_cluster.md
+++ b/docs/4.x/container_aws_cluster.md
@@ -19,6 +19,8 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withAuthorization()`](#fn-withauthorization)
 * [`fn withAuthorizationMixin()`](#fn-withauthorizationmixin)
 * [`fn withAwsRegion()`](#fn-withawsregion)
+* [`fn withBinaryAuthorization()`](#fn-withbinaryauthorization)
+* [`fn withBinaryAuthorizationMixin()`](#fn-withbinaryauthorizationmixin)
 * [`fn withControlPlane()`](#fn-withcontrolplane)
 * [`fn withControlPlaneMixin()`](#fn-withcontrolplanemixin)
 * [`fn withDescription()`](#fn-withdescription)
@@ -35,6 +37,8 @@ This package contains functions and utilities for setting up the resource using
   * [`fn new()`](#fn-authorizationnew)
   * [`obj authorization.admin_users`](#obj-authorizationadmin_users)
     * [`fn new()`](#fn-authorizationadmin_usersnew)
+* [`obj binary_authorization`](#obj-binary_authorization)
+  * [`fn new()`](#fn-binary_authorizationnew)
 * [`obj control_plane`](#obj-control_plane)
   * [`fn new()`](#fn-control_planenew)
   * [`obj control_plane.aws_services_authentication`](#obj-control_planeaws_services_authentication)
@@ -87,13 +91,17 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `aws_region` (`string`): The AWS region where the cluster runs. Each Google Cloud region supports a subset of nearby AWS regions. You can call to list all supported AWS regions within a given Google Cloud region.
   - `description` (`string`): Optional. A human readable description of this cluster. Cannot be longer than 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): The name of this resource.
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
   - `authorization` (`list[obj]`): Configuration related to the cluster RBAC settings. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.authorization.new](#fn-authorizationnew) constructor.
+  - `binary_authorization` (`list[obj]`): Configuration options for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.binary_authorization.new](#fn-binary_authorizationnew) constructor.
   - `control_plane` (`list[obj]`): Configuration related to the cluster control plane. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.control_plane.new](#fn-control_planenew) constructor.
   - `fleet` (`list[obj]`): Fleet configuration. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.fleet.new](#fn-fleetnew) constructor.
   - `networking` (`list[obj]`): Cluster-wide networking configuration. When `null`, the `networking` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.networking.new](#fn-networkingnew) constructor.
@@ -121,13 +129,17 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `aws_region` (`string`): The AWS region where the cluster runs. Each Google Cloud region supports a subset of nearby AWS regions. You can call to list all supported AWS regions within a given Google Cloud region.
   - `description` (`string`): Optional. A human readable description of this cluster. Cannot be longer than 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): The name of this resource.
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
   - `authorization` (`list[obj]`): Configuration related to the cluster RBAC settings. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.authorization.new](#fn-authorizationnew) constructor.
+  - `binary_authorization` (`list[obj]`): Configuration options for the Binary Authorization feature. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.binary_authorization.new](#fn-binary_authorizationnew) constructor.
   - `control_plane` (`list[obj]`): Configuration related to the cluster control plane. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.control_plane.new](#fn-control_planenew) constructor.
   - `fleet` (`list[obj]`): Fleet configuration. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.fleet.new](#fn-fleetnew) constructor.
   - `networking` (`list[obj]`): Cluster-wide networking configuration. When `null`, the `networking` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_aws_cluster.networking.new](#fn-networkingnew) constructor.
@@ -206,6 +218,43 @@ Terraform resource block to set or update the aws_region field.
   - `value` (`string`): The value to set for the `aws_region` field.
 
 
+### fn withBinaryAuthorization
+
+```ts
+withBinaryAuthorization()
+```
+
+`google.list[obj].withBinaryAuthorization` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the binary_authorization field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withBinaryAuthorizationMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `binary_authorization` field.
+
+
+### fn withBinaryAuthorizationMixin
+
+```ts
+withBinaryAuthorizationMixin()
+```
+
+`google.list[obj].withBinaryAuthorizationMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the binary_authorization field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withBinaryAuthorization](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `binary_authorization` field.
+
+
 ### fn withControlPlane
 
 ```ts
@@ -463,6 +512,29 @@ Terraform sub block.
   - An attribute object that represents the `admin_users` sub block.
 
 
+## obj binary_authorization
+
+
+
+### fn binary_authorization.new
+
+```ts
+new()
+```
+
+
+`google.container_aws_cluster.binary_authorization.new` constructs a new object with attributes and blocks configured for the `binary_authorization`
+Terraform sub block.
+
+
+
+**Args**:
+  - `evaluation_mode` (`string`): Mode of operation for Binary Authorization policy evaluation. Possible values: DISABLED, PROJECT_SINGLETON_POLICY_ENFORCE When `null`, the `evaluation_mode` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `binary_authorization` sub block.
+
+
 ## obj control_plane
 
 
diff --git a/docs/4.x/container_aws_node_pool.md b/docs/4.x/container_aws_node_pool.md
index c97759e9..f09bc822 100644
--- a/docs/4.x/container_aws_node_pool.md
+++ b/docs/4.x/container_aws_node_pool.md
@@ -84,7 +84,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `annotations` (`obj`): Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `cluster` (`string`): The awsCluster for the resource
   - `location` (`string`): The location for the resource
   - `name` (`string`): The name of this resource.
@@ -119,7 +122,10 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `annotations` (`obj`): Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `cluster` (`string`): The awsCluster for the resource
   - `location` (`string`): The location for the resource
   - `name` (`string`): The name of this resource.
diff --git a/docs/4.x/container_azure_cluster.md b/docs/4.x/container_azure_cluster.md
index aca8914a..c1a0e935 100644
--- a/docs/4.x/container_azure_cluster.md
+++ b/docs/4.x/container_azure_cluster.md
@@ -91,7 +91,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `azure_region` (`string`): The Azure region where the cluster runs. Each Google Cloud region supports a subset of nearby Azure regions. You can call to list all supported Azure regions within a given Google Cloud region.
   - `client` (`string`): Name of the AzureClient. The `AzureClient` resource must reside on the same GCP project and region as the `AzureCluster`. `AzureClient` names are formatted as `projects/<project-number>/locations/<region>/azureClients/<client-id>`. See Resource Names (https:cloud.google.com/apis/design/resource_names) for more details on Google Cloud resource names. When `null`, the `client` field will be omitted from the resulting object.
   - `description` (`string`): Optional. A human readable description of this cluster. Cannot be longer than 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.
@@ -128,7 +131,10 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `azure_region` (`string`): The Azure region where the cluster runs. Each Google Cloud region supports a subset of nearby Azure regions. You can call to list all supported Azure regions within a given Google Cloud region.
   - `client` (`string`): Name of the AzureClient. The `AzureClient` resource must reside on the same GCP project and region as the `AzureCluster`. `AzureClient` names are formatted as `projects/<project-number>/locations/<region>/azureClients/<client-id>`. See Resource Names (https:cloud.google.com/apis/design/resource_names) for more details on Google Cloud resource names. When `null`, the `client` field will be omitted from the resulting object.
   - `description` (`string`): Optional. A human readable description of this cluster. Cannot be longer than 255 UTF-8 encoded bytes. When `null`, the `description` field will be omitted from the resulting object.
diff --git a/docs/4.x/container_azure_node_pool.md b/docs/4.x/container_azure_node_pool.md
index 44c904e6..8edc4d17 100644
--- a/docs/4.x/container_azure_node_pool.md
+++ b/docs/4.x/container_azure_node_pool.md
@@ -79,7 +79,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `annotations` (`obj`): Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `azure_availability_zone` (`string`): Optional. The Azure availability zone of the nodes in this nodepool. When unspecified, it defaults to `1`. When `null`, the `azure_availability_zone` field will be omitted from the resulting object.
   - `cluster` (`string`): The azureCluster for the resource
   - `location` (`string`): The location for the resource
@@ -115,7 +118,10 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `annotations` (`obj`): Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `annotations` (`obj`): Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field `effective_annotations` for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `azure_availability_zone` (`string`): Optional. The Azure availability zone of the nodes in this nodepool. When unspecified, it defaults to `1`. When `null`, the `azure_availability_zone` field will be omitted from the resulting object.
   - `cluster` (`string`): The azureCluster for the resource
   - `location` (`string`): The location for the resource
diff --git a/docs/4.x/container_cluster.md b/docs/4.x/container_cluster.md
index e504c90c..5a613e3b 100644
--- a/docs/4.x/container_cluster.md
+++ b/docs/4.x/container_cluster.md
@@ -35,11 +35,11 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withDefaultMaxPodsPerNode()`](#fn-withdefaultmaxpodspernode)
 * [`fn withDefaultSnatStatus()`](#fn-withdefaultsnatstatus)
 * [`fn withDefaultSnatStatusMixin()`](#fn-withdefaultsnatstatusmixin)
+* [`fn withDeletionProtection()`](#fn-withdeletionprotection)
 * [`fn withDescription()`](#fn-withdescription)
 * [`fn withDnsConfig()`](#fn-withdnsconfig)
 * [`fn withDnsConfigMixin()`](#fn-withdnsconfigmixin)
 * [`fn withEnableAutopilot()`](#fn-withenableautopilot)
-* [`fn withEnableBinaryAuthorization()`](#fn-withenablebinaryauthorization)
 * [`fn withEnableIntranodeVisibility()`](#fn-withenableintranodevisibility)
 * [`fn withEnableK8SBetaApis()`](#fn-withenablek8sbetaapis)
 * [`fn withEnableK8SBetaApisMixin()`](#fn-withenablek8sbetaapismixin)
@@ -50,6 +50,8 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withEnableTpu()`](#fn-withenabletpu)
 * [`fn withGatewayApiConfig()`](#fn-withgatewayapiconfig)
 * [`fn withGatewayApiConfigMixin()`](#fn-withgatewayapiconfigmixin)
+* [`fn withIdentityServiceConfig()`](#fn-withidentityserviceconfig)
+* [`fn withIdentityServiceConfigMixin()`](#fn-withidentityserviceconfigmixin)
 * [`fn withInitialNodeCount()`](#fn-withinitialnodecount)
 * [`fn withIpAllocationPolicy()`](#fn-withipallocationpolicy)
 * [`fn withIpAllocationPolicyMixin()`](#fn-withipallocationpolicymixin)
@@ -163,6 +165,8 @@ This package contains functions and utilities for setting up the resource using
   * [`fn new()`](#fn-enable_k8s_beta_apisnew)
 * [`obj gateway_api_config`](#obj-gateway_api_config)
   * [`fn new()`](#fn-gateway_api_confignew)
+* [`obj identity_service_config`](#obj-identity_service_config)
+  * [`fn new()`](#fn-identity_service_confignew)
 * [`obj ip_allocation_policy`](#obj-ip_allocation_policy)
   * [`fn new()`](#fn-ip_allocation_policynew)
   * [`obj ip_allocation_policy.additional_pod_ranges_config`](#obj-ip_allocation_policyadditional_pod_ranges_config)
@@ -229,6 +233,8 @@ This package contains functions and utilities for setting up the resource using
     * [`fn new()`](#fn-node_configsole_tenant_confignew)
     * [`obj node_config.sole_tenant_config.node_affinity`](#obj-node_configsole_tenant_confignode_affinity)
       * [`fn new()`](#fn-node_configsole_tenant_confignode_affinitynew)
+  * [`obj node_config.taint`](#obj-node_configtaint)
+    * [`fn new()`](#fn-node_configtaintnew)
   * [`obj node_config.workload_metadata_config`](#obj-node_configworkload_metadata_config)
     * [`fn new()`](#fn-node_configworkload_metadata_confignew)
 * [`obj node_pool`](#obj-node_pool)
@@ -271,6 +277,8 @@ This package contains functions and utilities for setting up the resource using
       * [`fn new()`](#fn-node_poolnode_configsole_tenant_confignew)
       * [`obj node_pool.node_config.sole_tenant_config.node_affinity`](#obj-node_poolnode_configsole_tenant_confignode_affinity)
         * [`fn new()`](#fn-node_poolnode_configsole_tenant_confignode_affinitynew)
+    * [`obj node_pool.node_config.taint`](#obj-node_poolnode_configtaint)
+      * [`fn new()`](#fn-node_poolnode_configtaintnew)
     * [`obj node_pool.node_config.workload_metadata_config`](#obj-node_poolnode_configworkload_metadata_config)
       * [`fn new()`](#fn-node_poolnode_configworkload_metadata_confignew)
   * [`obj node_pool.placement_policy`](#obj-node_poolplacement_policy)
@@ -349,9 +357,9 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `cluster_ipv4_cidr` (`string`): The IP address range of the Kubernetes pods in this cluster in CIDR notation (e.g. 10.96.0.0/14). Leave blank to have one automatically chosen or specify a /14 block in 10.0.0.0/8. This field will only work for routes-based clusters, where ip_allocation_policy is not defined. When `null`, the `cluster_ipv4_cidr` field will be omitted from the resulting object.
   - `datapath_provider` (`string`): The desired datapath provider for this cluster. By default, uses the IPTables-based kube-proxy implementation. When `null`, the `datapath_provider` field will be omitted from the resulting object.
   - `default_max_pods_per_node` (`number`): The default maximum number of pods per node in this cluster. This doesn't work on "routes-based" clusters, clusters that don't have IP Aliasing enabled. When `null`, the `default_max_pods_per_node` field will be omitted from the resulting object.
+  - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the instance. Defaults to true. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the cluster will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.
   - `description` (`string`):  Description of the cluster. When `null`, the `description` field will be omitted from the resulting object.
   - `enable_autopilot` (`bool`): Enable Autopilot for this cluster. When `null`, the `enable_autopilot` field will be omitted from the resulting object.
-  - `enable_binary_authorization` (`bool`): Enable Binary Authorization for this cluster. If enabled, all container images will be validated by Google Binary Authorization. When `null`, the `enable_binary_authorization` field will be omitted from the resulting object.
   - `enable_intranode_visibility` (`bool`): Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network. When `null`, the `enable_intranode_visibility` field will be omitted from the resulting object.
   - `enable_kubernetes_alpha` (`bool`): Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. When `null`, the `enable_kubernetes_alpha` field will be omitted from the resulting object.
   - `enable_l4_ilb_subsetting` (`bool`): Whether L4ILB Subsetting is enabled for this cluster. When `null`, the `enable_l4_ilb_subsetting` field will be omitted from the resulting object.
@@ -365,7 +373,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `monitoring_service` (`string`): The monitoring service that the cluster should write metrics to. Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API. VM metrics will be collected by Google Compute Engine regardless of this setting Available options include monitoring.googleapis.com(Legacy Stackdriver), monitoring.googleapis.com/kubernetes(Stackdriver Kubernetes Engine Monitoring), and none. Defaults to monitoring.googleapis.com/kubernetes. When `null`, the `monitoring_service` field will be omitted from the resulting object.
   - `name` (`string`): The name of the cluster, unique within the project and location.
   - `network` (`string`): The name or self_link of the Google Compute Engine network to which the cluster is connected. For Shared VPC, set this to the self link of the shared network. When `null`, the `network` field will be omitted from the resulting object.
-  - `networking_mode` (`string`): Determines whether alias IPs or routes will be used for pod IPs in the cluster. When `null`, the `networking_mode` field will be omitted from the resulting object.
+  - `networking_mode` (`string`): Determines whether alias IPs or routes will be used for pod IPs in the cluster. Defaults to VPC_NATIVE for new clusters. When `null`, the `networking_mode` field will be omitted from the resulting object.
   - `node_locations` (`list`): The list of zones in which the cluster's nodes are located. Nodes must be in the region of their regional cluster or in the same region as their cluster's zone for zonal clusters. If this is specified for a zonal cluster, omit the cluster's zone. When `null`, the `node_locations` field will be omitted from the resulting object.
   - `node_version` (`string`): The Kubernetes version on the nodes. Must either be unset or set to the same value as min_master_version on create. Defaults to the default version set by GKE which is not necessarily the latest version. This only affects nodes in the default node pool. While a fuzzy version can be specified, it's recommended that you specify explicit versions as Terraform will see spurious diffs when fuzzy versions are used. See the google_container_engine_versions data source's version_prefix field to approximate fuzzy versions in a Terraform-compatible way. To update nodes in other node pools, use the version attribute on the node pool. When `null`, the `node_version` field will be omitted from the resulting object.
   - `private_ipv6_google_access` (`string`): The desired state of IPv6 connectivity to Google Services. By default, no private IPv6 access to or from Google Services (all access will be via IPv4). When `null`, the `private_ipv6_google_access` field will be omitted from the resulting object.
@@ -384,6 +392,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `dns_config` (`list[obj]`): Configuration for Cloud DNS for Kubernetes Engine. When `null`, the `dns_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.dns_config.new](#fn-dns_confignew) constructor.
   - `enable_k8s_beta_apis` (`list[obj]`): Configuration for Kubernetes Beta APIs. When `null`, the `enable_k8s_beta_apis` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.enable_k8s_beta_apis.new](#fn-enable_k8s_beta_apisnew) constructor.
   - `gateway_api_config` (`list[obj]`): Configuration for GKE Gateway API controller. When `null`, the `gateway_api_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.gateway_api_config.new](#fn-gateway_api_confignew) constructor.
+  - `identity_service_config` (`list[obj]`): Configuration for Identity Service which allows customers to use external identity providers with the K8S API. When `null`, the `identity_service_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.identity_service_config.new](#fn-identity_service_confignew) constructor.
   - `ip_allocation_policy` (`list[obj]`): Configuration of cluster IP allocation for VPC-native clusters. Adding this block enables IP aliasing, making the cluster VPC-native instead of routes-based. When `null`, the `ip_allocation_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.ip_allocation_policy.new](#fn-ip_allocation_policynew) constructor.
   - `logging_config` (`list[obj]`): Logging configuration for the cluster. When `null`, the `logging_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.logging_config.new](#fn-logging_confignew) constructor.
   - `maintenance_policy` (`list[obj]`): The maintenance policy to use for the cluster. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.maintenance_policy.new](#fn-maintenance_policynew) constructor.
@@ -432,9 +441,9 @@ injecting into a complete block.
   - `cluster_ipv4_cidr` (`string`): The IP address range of the Kubernetes pods in this cluster in CIDR notation (e.g. 10.96.0.0/14). Leave blank to have one automatically chosen or specify a /14 block in 10.0.0.0/8. This field will only work for routes-based clusters, where ip_allocation_policy is not defined. When `null`, the `cluster_ipv4_cidr` field will be omitted from the resulting object.
   - `datapath_provider` (`string`): The desired datapath provider for this cluster. By default, uses the IPTables-based kube-proxy implementation. When `null`, the `datapath_provider` field will be omitted from the resulting object.
   - `default_max_pods_per_node` (`number`): The default maximum number of pods per node in this cluster. This doesn't work on "routes-based" clusters, clusters that don't have IP Aliasing enabled. When `null`, the `default_max_pods_per_node` field will be omitted from the resulting object.
+  - `deletion_protection` (`bool`): Whether or not to allow Terraform to destroy the instance. Defaults to true. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the cluster will fail. When `null`, the `deletion_protection` field will be omitted from the resulting object.
   - `description` (`string`):  Description of the cluster. When `null`, the `description` field will be omitted from the resulting object.
   - `enable_autopilot` (`bool`): Enable Autopilot for this cluster. When `null`, the `enable_autopilot` field will be omitted from the resulting object.
-  - `enable_binary_authorization` (`bool`): Enable Binary Authorization for this cluster. If enabled, all container images will be validated by Google Binary Authorization. When `null`, the `enable_binary_authorization` field will be omitted from the resulting object.
   - `enable_intranode_visibility` (`bool`): Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network. When `null`, the `enable_intranode_visibility` field will be omitted from the resulting object.
   - `enable_kubernetes_alpha` (`bool`): Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. When `null`, the `enable_kubernetes_alpha` field will be omitted from the resulting object.
   - `enable_l4_ilb_subsetting` (`bool`): Whether L4ILB Subsetting is enabled for this cluster. When `null`, the `enable_l4_ilb_subsetting` field will be omitted from the resulting object.
@@ -448,7 +457,7 @@ injecting into a complete block.
   - `monitoring_service` (`string`): The monitoring service that the cluster should write metrics to. Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API. VM metrics will be collected by Google Compute Engine regardless of this setting Available options include monitoring.googleapis.com(Legacy Stackdriver), monitoring.googleapis.com/kubernetes(Stackdriver Kubernetes Engine Monitoring), and none. Defaults to monitoring.googleapis.com/kubernetes. When `null`, the `monitoring_service` field will be omitted from the resulting object.
   - `name` (`string`): The name of the cluster, unique within the project and location.
   - `network` (`string`): The name or self_link of the Google Compute Engine network to which the cluster is connected. For Shared VPC, set this to the self link of the shared network. When `null`, the `network` field will be omitted from the resulting object.
-  - `networking_mode` (`string`): Determines whether alias IPs or routes will be used for pod IPs in the cluster. When `null`, the `networking_mode` field will be omitted from the resulting object.
+  - `networking_mode` (`string`): Determines whether alias IPs or routes will be used for pod IPs in the cluster. Defaults to VPC_NATIVE for new clusters. When `null`, the `networking_mode` field will be omitted from the resulting object.
   - `node_locations` (`list`): The list of zones in which the cluster's nodes are located. Nodes must be in the region of their regional cluster or in the same region as their cluster's zone for zonal clusters. If this is specified for a zonal cluster, omit the cluster's zone. When `null`, the `node_locations` field will be omitted from the resulting object.
   - `node_version` (`string`): The Kubernetes version on the nodes. Must either be unset or set to the same value as min_master_version on create. Defaults to the default version set by GKE which is not necessarily the latest version. This only affects nodes in the default node pool. While a fuzzy version can be specified, it's recommended that you specify explicit versions as Terraform will see spurious diffs when fuzzy versions are used. See the google_container_engine_versions data source's version_prefix field to approximate fuzzy versions in a Terraform-compatible way. To update nodes in other node pools, use the version attribute on the node pool. When `null`, the `node_version` field will be omitted from the resulting object.
   - `private_ipv6_google_access` (`string`): The desired state of IPv6 connectivity to Google Services. By default, no private IPv6 access to or from Google Services (all access will be via IPv4). When `null`, the `private_ipv6_google_access` field will be omitted from the resulting object.
@@ -467,6 +476,7 @@ injecting into a complete block.
   - `dns_config` (`list[obj]`): Configuration for Cloud DNS for Kubernetes Engine. When `null`, the `dns_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.dns_config.new](#fn-dns_confignew) constructor.
   - `enable_k8s_beta_apis` (`list[obj]`): Configuration for Kubernetes Beta APIs. When `null`, the `enable_k8s_beta_apis` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.enable_k8s_beta_apis.new](#fn-enable_k8s_beta_apisnew) constructor.
   - `gateway_api_config` (`list[obj]`): Configuration for GKE Gateway API controller. When `null`, the `gateway_api_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.gateway_api_config.new](#fn-gateway_api_confignew) constructor.
+  - `identity_service_config` (`list[obj]`): Configuration for Identity Service which allows customers to use external identity providers with the K8S API. When `null`, the `identity_service_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.identity_service_config.new](#fn-identity_service_confignew) constructor.
   - `ip_allocation_policy` (`list[obj]`): Configuration of cluster IP allocation for VPC-native clusters. Adding this block enables IP aliasing, making the cluster VPC-native instead of routes-based. When `null`, the `ip_allocation_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.ip_allocation_policy.new](#fn-ip_allocation_policynew) constructor.
   - `logging_config` (`list[obj]`): Logging configuration for the cluster. When `null`, the `logging_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.logging_config.new](#fn-logging_confignew) constructor.
   - `maintenance_policy` (`list[obj]`): The maintenance policy to use for the cluster. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.maintenance_policy.new](#fn-maintenance_policynew) constructor.
@@ -853,6 +863,22 @@ function.
   - `value` (`list[obj]`): The value to set for the `default_snat_status` field.
 
 
+### fn withDeletionProtection
+
+```ts
+withDeletionProtection()
+```
+
+`google.bool.withDeletionProtection` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the deletion_protection field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `deletion_protection` field.
+
+
 ### fn withDescription
 
 ```ts
@@ -922,22 +948,6 @@ Terraform resource block to set or update the enable_autopilot field.
   - `value` (`bool`): The value to set for the `enable_autopilot` field.
 
 
-### fn withEnableBinaryAuthorization
-
-```ts
-withEnableBinaryAuthorization()
-```
-
-`google.bool.withEnableBinaryAuthorization` constructs a mixin object that can be merged into the `bool`
-Terraform resource block to set or update the enable_binary_authorization field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`bool`): The value to set for the `enable_binary_authorization` field.
-
-
 ### fn withEnableIntranodeVisibility
 
 ```ts
@@ -1108,6 +1118,43 @@ function.
   - `value` (`list[obj]`): The value to set for the `gateway_api_config` field.
 
 
+### fn withIdentityServiceConfig
+
+```ts
+withIdentityServiceConfig()
+```
+
+`google.list[obj].withIdentityServiceConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the identity_service_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withIdentityServiceConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `identity_service_config` field.
+
+
+### fn withIdentityServiceConfigMixin
+
+```ts
+withIdentityServiceConfigMixin()
+```
+
+`google.list[obj].withIdentityServiceConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the identity_service_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withIdentityServiceConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `identity_service_config` field.
+
+
 ### fn withInitialNodeCount
 
 ```ts
@@ -2807,6 +2854,29 @@ Terraform sub block.
   - An attribute object that represents the `gateway_api_config` sub block.
 
 
+## obj identity_service_config
+
+
+
+### fn identity_service_config.new
+
+```ts
+new()
+```
+
+
+`google.container_cluster.identity_service_config.new` constructs a new object with attributes and blocks configured for the `identity_service_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enabled` (`bool`): Whether to enable the Identity Service component. When `null`, the `enabled` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `identity_service_config` sub block.
+
+
 ## obj ip_allocation_policy
 
 
@@ -3234,7 +3304,7 @@ Terraform sub block.
 
 **Args**:
   - `enabled` (`bool`): Whether network policy is enabled on the cluster.
-  - `provider` (`string`): The selected network policy provider. Defaults to PROVIDER_UNSPECIFIED. When `null`, the `provider` field will be omitted from the resulting object.
+  - `provider` (`string`): The selected network policy provider. When `null`, the `provider` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `network_policy` sub block.
@@ -3275,7 +3345,6 @@ Terraform sub block.
   - `service_account` (`string`): The Google Cloud Platform Service Account to be used by the node VMs. When `null`, the `service_account` field will be omitted from the resulting object.
   - `spot` (`bool`): Whether the nodes are created as spot VM instances. When `null`, the `spot` field will be omitted from the resulting object.
   - `tags` (`list`): The list of instance tags applied to all nodes. When `null`, the `tags` field will be omitted from the resulting object.
-  - `taint` (`list`): List of Kubernetes taints to be applied to each node. When `null`, the `taint` field will be omitted from the resulting object.
   - `advanced_machine_features` (`list[obj]`): Specifies options for controlling advanced machine features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.advanced_machine_features.new](#fn-node_configadvanced_machine_featuresnew) constructor.
   - `confidential_nodes` (`list[obj]`): Configuration for the confidential nodes feature, which makes nodes run on confidential VMs. Warning: This configuration can't be changed (or added/removed) after pool creation without deleting and recreating the entire pool. When `null`, the `confidential_nodes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.confidential_nodes.new](#fn-node_configconfidential_nodesnew) constructor.
   - `ephemeral_storage_local_ssd_config` (`list[obj]`): Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk. When `null`, the `ephemeral_storage_local_ssd_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.ephemeral_storage_local_ssd_config.new](#fn-node_configephemeral_storage_local_ssd_confignew) constructor.
@@ -3289,6 +3358,7 @@ Terraform sub block.
   - `reservation_affinity` (`list[obj]`): The reservation affinity configuration for the node pool. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.reservation_affinity.new](#fn-node_configreservation_affinitynew) constructor.
   - `shielded_instance_config` (`list[obj]`): Shielded Instance options. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.shielded_instance_config.new](#fn-node_configshielded_instance_confignew) constructor.
   - `sole_tenant_config` (`list[obj]`): Node affinity options for sole tenant node pools. When `null`, the `sole_tenant_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.sole_tenant_config.new](#fn-node_configsole_tenant_confignew) constructor.
+  - `taint` (`list[obj]`): List of Kubernetes taints to be applied to each node. When `null`, the `taint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.taint.new](#fn-node_configtaintnew) constructor.
   - `workload_metadata_config` (`list[obj]`): The workload metadata configuration for this node. When `null`, the `workload_metadata_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_config.workload_metadata_config.new](#fn-node_configworkload_metadata_confignew) constructor.
 
 **Returns**:
@@ -3499,7 +3569,8 @@ Terraform sub block.
 
 
 **Args**:
-  - `sysctls` (`obj`): The Linux kernel parameters to be applied to the nodes and all pods running on the nodes.
+  - `cgroup_mode` (`string`): cgroupMode specifies the cgroup mode to be used on the node. When `null`, the `cgroup_mode` field will be omitted from the resulting object.
+  - `sysctls` (`obj`): The Linux kernel parameters to be applied to the nodes and all pods running on the nodes. When `null`, the `sysctls` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `linux_node_config` sub block.
@@ -3625,6 +3696,31 @@ Terraform sub block.
   - An attribute object that represents the `node_affinity` sub block.
 
 
+## obj node_config.taint
+
+
+
+### fn node_config.taint.new
+
+```ts
+new()
+```
+
+
+`google.container_cluster.node_config.taint.new` constructs a new object with attributes and blocks configured for the `taint`
+Terraform sub block.
+
+
+
+**Args**:
+  - `effect` (`string`): Effect for taint.
+  - `key` (`string`): Key for taint.
+  - `value` (`string`): Value for taint.
+
+**Returns**:
+  - An attribute object that represents the `taint` sub block.
+
+
 ## obj node_config.workload_metadata_config
 
 
@@ -3727,8 +3823,8 @@ Terraform sub block.
 
 
 **Args**:
-  - `auto_repair` (`bool`): Whether the nodes will be automatically repaired. When `null`, the `auto_repair` field will be omitted from the resulting object.
-  - `auto_upgrade` (`bool`): Whether the nodes will be automatically upgraded. When `null`, the `auto_upgrade` field will be omitted from the resulting object.
+  - `auto_repair` (`bool`): Whether the nodes will be automatically repaired. Enabled by default. When `null`, the `auto_repair` field will be omitted from the resulting object.
+  - `auto_upgrade` (`bool`): Whether the nodes will be automatically upgraded. Enabled by default. When `null`, the `auto_upgrade` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `management` sub block.
@@ -3819,7 +3915,6 @@ Terraform sub block.
   - `service_account` (`string`): The Google Cloud Platform Service Account to be used by the node VMs. When `null`, the `service_account` field will be omitted from the resulting object.
   - `spot` (`bool`): Whether the nodes are created as spot VM instances. When `null`, the `spot` field will be omitted from the resulting object.
   - `tags` (`list`): The list of instance tags applied to all nodes. When `null`, the `tags` field will be omitted from the resulting object.
-  - `taint` (`list`): List of Kubernetes taints to be applied to each node. When `null`, the `taint` field will be omitted from the resulting object.
   - `advanced_machine_features` (`list[obj]`): Specifies options for controlling advanced machine features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.advanced_machine_features.new](#fn-node_poolnode_pooladvanced_machine_featuresnew) constructor.
   - `confidential_nodes` (`list[obj]`): Configuration for the confidential nodes feature, which makes nodes run on confidential VMs. Warning: This configuration can't be changed (or added/removed) after pool creation without deleting and recreating the entire pool. When `null`, the `confidential_nodes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.confidential_nodes.new](#fn-node_poolnode_poolconfidential_nodesnew) constructor.
   - `ephemeral_storage_local_ssd_config` (`list[obj]`): Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk. When `null`, the `ephemeral_storage_local_ssd_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.ephemeral_storage_local_ssd_config.new](#fn-node_poolnode_poolephemeral_storage_local_ssd_confignew) constructor.
@@ -3833,6 +3928,7 @@ Terraform sub block.
   - `reservation_affinity` (`list[obj]`): The reservation affinity configuration for the node pool. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.reservation_affinity.new](#fn-node_poolnode_poolreservation_affinitynew) constructor.
   - `shielded_instance_config` (`list[obj]`): Shielded Instance options. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.shielded_instance_config.new](#fn-node_poolnode_poolshielded_instance_confignew) constructor.
   - `sole_tenant_config` (`list[obj]`): Node affinity options for sole tenant node pools. When `null`, the `sole_tenant_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.sole_tenant_config.new](#fn-node_poolnode_poolsole_tenant_confignew) constructor.
+  - `taint` (`list[obj]`): List of Kubernetes taints to be applied to each node. When `null`, the `taint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.taint.new](#fn-node_poolnode_pooltaintnew) constructor.
   - `workload_metadata_config` (`list[obj]`): The workload metadata configuration for this node. When `null`, the `workload_metadata_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_cluster.node_pool.node_config.workload_metadata_config.new](#fn-node_poolnode_poolworkload_metadata_confignew) constructor.
 
 **Returns**:
@@ -4043,7 +4139,8 @@ Terraform sub block.
 
 
 **Args**:
-  - `sysctls` (`obj`): The Linux kernel parameters to be applied to the nodes and all pods running on the nodes.
+  - `cgroup_mode` (`string`): cgroupMode specifies the cgroup mode to be used on the node. When `null`, the `cgroup_mode` field will be omitted from the resulting object.
+  - `sysctls` (`obj`): The Linux kernel parameters to be applied to the nodes and all pods running on the nodes. When `null`, the `sysctls` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `linux_node_config` sub block.
@@ -4169,6 +4266,31 @@ Terraform sub block.
   - An attribute object that represents the `node_affinity` sub block.
 
 
+## obj node_pool.node_config.taint
+
+
+
+### fn node_pool.node_config.taint.new
+
+```ts
+new()
+```
+
+
+`google.container_cluster.node_pool.node_config.taint.new` constructs a new object with attributes and blocks configured for the `taint`
+Terraform sub block.
+
+
+
+**Args**:
+  - `effect` (`string`): Effect for taint.
+  - `key` (`string`): Key for taint.
+  - `value` (`string`): Value for taint.
+
+**Returns**:
+  - An attribute object that represents the `taint` sub block.
+
+
 ## obj node_pool.node_config.workload_metadata_config
 
 
@@ -4598,7 +4720,7 @@ Terraform sub block.
 
 **Args**:
   - `mode` (`string`): Sets the mode of the Kubernetes security posture API's off-cluster features. Available options include DISABLED and BASIC. When `null`, the `mode` field will be omitted from the resulting object.
-  - `vulnerability_mode` (`string`): Sets the mode of the Kubernetes security posture API's workload vulnerability scanning. Available options include VULNERABILITY_DISABLED and VULNERABILITY_BASIC. When `null`, the `vulnerability_mode` field will be omitted from the resulting object.
+  - `vulnerability_mode` (`string`): Sets the mode of the Kubernetes security posture API's workload vulnerability scanning. Available options include VULNERABILITY_DISABLED, VULNERABILITY_BASIC and VULNERABILITY_ENTERPRISE. When `null`, the `vulnerability_mode` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `security_posture_config` sub block.
diff --git a/docs/4.x/container_node_pool.md b/docs/4.x/container_node_pool.md
index c88332fb..f18cc9b9 100644
--- a/docs/4.x/container_node_pool.md
+++ b/docs/4.x/container_node_pool.md
@@ -77,6 +77,8 @@ This package contains functions and utilities for setting up the resource using
     * [`fn new()`](#fn-node_configsole_tenant_confignew)
     * [`obj node_config.sole_tenant_config.node_affinity`](#obj-node_configsole_tenant_confignode_affinity)
       * [`fn new()`](#fn-node_configsole_tenant_confignode_affinitynew)
+  * [`obj node_config.taint`](#obj-node_configtaint)
+    * [`fn new()`](#fn-node_configtaintnew)
   * [`obj node_config.workload_metadata_config`](#obj-node_configworkload_metadata_config)
     * [`fn new()`](#fn-node_configworkload_metadata_confignew)
 * [`obj placement_policy`](#obj-placement_policy)
@@ -643,8 +645,8 @@ Terraform sub block.
 
 
 **Args**:
-  - `auto_repair` (`bool`): Whether the nodes will be automatically repaired. When `null`, the `auto_repair` field will be omitted from the resulting object.
-  - `auto_upgrade` (`bool`): Whether the nodes will be automatically upgraded. When `null`, the `auto_upgrade` field will be omitted from the resulting object.
+  - `auto_repair` (`bool`): Whether the nodes will be automatically repaired. Enabled by default. When `null`, the `auto_repair` field will be omitted from the resulting object.
+  - `auto_upgrade` (`bool`): Whether the nodes will be automatically upgraded. Enabled by default. When `null`, the `auto_upgrade` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `management` sub block.
@@ -735,7 +737,6 @@ Terraform sub block.
   - `service_account` (`string`): The Google Cloud Platform Service Account to be used by the node VMs. When `null`, the `service_account` field will be omitted from the resulting object.
   - `spot` (`bool`): Whether the nodes are created as spot VM instances. When `null`, the `spot` field will be omitted from the resulting object.
   - `tags` (`list`): The list of instance tags applied to all nodes. When `null`, the `tags` field will be omitted from the resulting object.
-  - `taint` (`list`): List of Kubernetes taints to be applied to each node. When `null`, the `taint` field will be omitted from the resulting object.
   - `advanced_machine_features` (`list[obj]`): Specifies options for controlling advanced machine features. When `null`, the `advanced_machine_features` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.advanced_machine_features.new](#fn-node_configadvanced_machine_featuresnew) constructor.
   - `confidential_nodes` (`list[obj]`): Configuration for the confidential nodes feature, which makes nodes run on confidential VMs. Warning: This configuration can't be changed (or added/removed) after pool creation without deleting and recreating the entire pool. When `null`, the `confidential_nodes` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.confidential_nodes.new](#fn-node_configconfidential_nodesnew) constructor.
   - `ephemeral_storage_local_ssd_config` (`list[obj]`): Parameters for the ephemeral storage filesystem. If unspecified, ephemeral storage is backed by the boot disk. When `null`, the `ephemeral_storage_local_ssd_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.ephemeral_storage_local_ssd_config.new](#fn-node_configephemeral_storage_local_ssd_confignew) constructor.
@@ -749,6 +750,7 @@ Terraform sub block.
   - `reservation_affinity` (`list[obj]`): The reservation affinity configuration for the node pool. When `null`, the `reservation_affinity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.reservation_affinity.new](#fn-node_configreservation_affinitynew) constructor.
   - `shielded_instance_config` (`list[obj]`): Shielded Instance options. When `null`, the `shielded_instance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.shielded_instance_config.new](#fn-node_configshielded_instance_confignew) constructor.
   - `sole_tenant_config` (`list[obj]`): Node affinity options for sole tenant node pools. When `null`, the `sole_tenant_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.sole_tenant_config.new](#fn-node_configsole_tenant_confignew) constructor.
+  - `taint` (`list[obj]`): List of Kubernetes taints to be applied to each node. When `null`, the `taint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.taint.new](#fn-node_configtaintnew) constructor.
   - `workload_metadata_config` (`list[obj]`): The workload metadata configuration for this node. When `null`, the `workload_metadata_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.container_node_pool.node_config.workload_metadata_config.new](#fn-node_configworkload_metadata_confignew) constructor.
 
 **Returns**:
@@ -959,7 +961,8 @@ Terraform sub block.
 
 
 **Args**:
-  - `sysctls` (`obj`): The Linux kernel parameters to be applied to the nodes and all pods running on the nodes.
+  - `cgroup_mode` (`string`): cgroupMode specifies the cgroup mode to be used on the node. When `null`, the `cgroup_mode` field will be omitted from the resulting object.
+  - `sysctls` (`obj`): The Linux kernel parameters to be applied to the nodes and all pods running on the nodes. When `null`, the `sysctls` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `linux_node_config` sub block.
@@ -1085,6 +1088,31 @@ Terraform sub block.
   - An attribute object that represents the `node_affinity` sub block.
 
 
+## obj node_config.taint
+
+
+
+### fn node_config.taint.new
+
+```ts
+new()
+```
+
+
+`google.container_node_pool.node_config.taint.new` constructs a new object with attributes and blocks configured for the `taint`
+Terraform sub block.
+
+
+
+**Args**:
+  - `effect` (`string`): Effect for taint.
+  - `key` (`string`): Key for taint.
+  - `value` (`string`): Value for taint.
+
+**Returns**:
+  - An attribute object that represents the `taint` sub block.
+
+
 ## obj node_config.workload_metadata_config
 
 
diff --git a/docs/4.x/data/bigquery_dataset.md b/docs/4.x/data/bigquery_dataset.md
new file mode 100644
index 00000000..8fb20b86
--- /dev/null
+++ b/docs/4.x/data/bigquery_dataset.md
@@ -0,0 +1,115 @@
+---
+permalink: /data/bigquery_dataset/
+---
+
+# data.bigquery_dataset
+
+`bigquery_dataset` represents the `google_bigquery_dataset` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withDatasetId()`](#fn-withdatasetid)
+* [`fn withProject()`](#fn-withproject)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.data.bigquery_dataset.new` injects a new `data_google_bigquery_dataset` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.data.bigquery_dataset.new('some_id')
+
+You can get the reference to the `id` field of the created `google.data.bigquery_dataset` using the reference:
+
+    $._ref.data_google_bigquery_dataset.some_id.get('id')
+
+This is the same as directly entering `"${ data_google_bigquery_dataset.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `dataset_id` (`string`): A unique ID for this dataset, without the project name. The ID
+must contain only letters (a-z, A-Z), numbers (0-9), or
+underscores (_). The maximum length is 1,024 characters.
+  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.data.bigquery_dataset.newAttrs` constructs a new object with attributes and blocks configured for the `bigquery_dataset`
+Terraform data source.
+
+Unlike [google.data.bigquery_dataset.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `dataset_id` (`string`): A unique ID for this dataset, without the project name. The ID
+must contain only letters (a-z, A-Z), numbers (0-9), or
+underscores (_). The maximum length is 1,024 characters.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `bigquery_dataset` data source into the root Terraform configuration.
+
+
+### fn withDatasetId
+
+```ts
+withDatasetId()
+```
+
+`google.string.withDatasetId` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the dataset_id field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `dataset_id` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the project field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
diff --git a/docs/4.x/data/cloud_identity_group_lookup.md b/docs/4.x/data/cloud_identity_group_lookup.md
new file mode 100644
index 00000000..79d36873
--- /dev/null
+++ b/docs/4.x/data/cloud_identity_group_lookup.md
@@ -0,0 +1,144 @@
+---
+permalink: /data/cloud_identity_group_lookup/
+---
+
+# data.cloud_identity_group_lookup
+
+`cloud_identity_group_lookup` represents the `google_cloud_identity_group_lookup` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withGroupKey()`](#fn-withgroupkey)
+* [`fn withGroupKeyMixin()`](#fn-withgroupkeymixin)
+* [`obj group_key`](#obj-group_key)
+  * [`fn new()`](#fn-group_keynew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.data.cloud_identity_group_lookup.new` injects a new `data_google_cloud_identity_group_lookup` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.data.cloud_identity_group_lookup.new('some_id')
+
+You can get the reference to the `id` field of the created `google.data.cloud_identity_group_lookup` using the reference:
+
+    $._ref.data_google_cloud_identity_group_lookup.some_id.get('id')
+
+This is the same as directly entering `"${ data_google_cloud_identity_group_lookup.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `group_key` (`list[obj]`): The EntityKey of the Group to lookup. A unique identifier for an entity in the Cloud Identity Groups API.
+An entity can represent either a group with an optional namespace or a user without a namespace.
+The combination of id and namespace must be unique; however, the same id can be used with different namespaces. When `null`, the `group_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data.cloud_identity_group_lookup.group_key.new](#fn-group_keynew) constructor.
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.data.cloud_identity_group_lookup.newAttrs` constructs a new object with attributes and blocks configured for the `cloud_identity_group_lookup`
+Terraform data source.
+
+Unlike [google.data.cloud_identity_group_lookup.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `group_key` (`list[obj]`): The EntityKey of the Group to lookup. A unique identifier for an entity in the Cloud Identity Groups API.
+An entity can represent either a group with an optional namespace or a user without a namespace.
+The combination of id and namespace must be unique; however, the same id can be used with different namespaces. When `null`, the `group_key` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.data.cloud_identity_group_lookup.group_key.new](#fn-group_keynew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `cloud_identity_group_lookup` data source into the root Terraform configuration.
+
+
+### fn withGroupKey
+
+```ts
+withGroupKey()
+```
+
+`google.list[obj].withGroupKey` constructs a mixin object that can be merged into the `list[obj]`
+Terraform data source block to set or update the group_key field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withGroupKeyMixin](TODO) function.
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `group_key` field.
+
+
+### fn withGroupKeyMixin
+
+```ts
+withGroupKeyMixin()
+```
+
+`google.list[obj].withGroupKeyMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform data source block to set or update the group_key field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withGroupKey](TODO)
+function.
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `group_key` field.
+
+
+## obj group_key
+
+
+
+### fn group_key.new
+
+```ts
+new()
+```
+
+
+`google.cloud_identity_group_lookup.group_key.new` constructs a new object with attributes and blocks configured for the `group_key`
+Terraform sub block.
+
+
+
+**Args**:
+  - `namespace` (`string`): The namespace in which the entity exists. If not specified, the EntityKey represents a Google-managed entity such as a Google user or a Google Group.
+If specified, the EntityKey represents an external-identity-mapped group. The namespace must correspond to an identity source created in Admin Console and must be in the form of identitysources/{identity_source}. When `null`, the `namespace` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `group_key` sub block.
diff --git a/docs/4.x/data/cloudiot_registry_iam_policy.md b/docs/4.x/data/cloud_run_v2_job.md
similarity index 61%
rename from docs/4.x/data/cloudiot_registry_iam_policy.md
rename to docs/4.x/data/cloud_run_v2_job.md
index 0968c511..7a20a837 100644
--- a/docs/4.x/data/cloudiot_registry_iam_policy.md
+++ b/docs/4.x/data/cloud_run_v2_job.md
@@ -1,10 +1,10 @@
 ---
-permalink: /data/cloudiot_registry_iam_policy/
+permalink: /data/cloud_run_v2_job/
 ---
 
-# data.cloudiot_registry_iam_policy
+# data.cloud_run_v2_job
 
-`cloudiot_registry_iam_policy` represents the `google_cloudiot_registry_iam_policy` Terraform data source.
+`cloud_run_v2_job` represents the `google_cloud_run_v2_job` Terraform data source.
 
 
 
@@ -15,9 +15,9 @@ This package contains functions and utilities for setting up the data source usi
 
 * [`fn new()`](#fn-new)
 * [`fn newAttrs()`](#fn-newattrs)
+* [`fn withLocation()`](#fn-withlocation)
 * [`fn withName()`](#fn-withname)
 * [`fn withProject()`](#fn-withproject)
-* [`fn withRegion()`](#fn-withregion)
 
 ## Fields
 
@@ -28,29 +28,29 @@ new()
 ```
 
 
-`google.data.cloudiot_registry_iam_policy.new` injects a new `data_google_cloudiot_registry_iam_policy` Terraform `data source`
+`google.data.cloud_run_v2_job.new` injects a new `data_google_cloud_run_v2_job` Terraform `data source`
 block into the root module document.
 
 Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
 resource. For example, if you added a new instance to the root using:
 
     # arguments omitted for brevity
-    google.data.cloudiot_registry_iam_policy.new('some_id')
+    google.data.cloud_run_v2_job.new('some_id')
 
-You can get the reference to the `id` field of the created `google.data.cloudiot_registry_iam_policy` using the reference:
+You can get the reference to the `id` field of the created `google.data.cloud_run_v2_job` using the reference:
 
-    $._ref.data_google_cloudiot_registry_iam_policy.some_id.get('id')
+    $._ref.data_google_cloud_run_v2_job.some_id.get('id')
 
-This is the same as directly entering `"${ data_google_cloudiot_registry_iam_policy.some_id.id }"` as the value.
+This is the same as directly entering `"${ data_google_cloud_run_v2_job.some_id.id }"` as the value.
 
 NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
 or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
 
 **Args**:
   - `dataSrcLabel` (`string`): The name label of the block.
-  - `name` (`string`): Set the `name` field on the resulting data source block.
+  - `location` (`string`): The location of the cloud run job When `null`, the `location` field will be omitted from the resulting object.
+  - `name` (`string`): Name of the Job.
   - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.
-  - `region` (`string`): Set the `region` field on the resulting data source block. When `null`, the `region` field will be omitted from the resulting object.
 
 **Returns**:
 - A mixin object that injects the new data source into the root Terraform configuration.
@@ -63,10 +63,10 @@ newAttrs()
 ```
 
 
-`google.data.cloudiot_registry_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `cloudiot_registry_iam_policy`
+`google.data.cloud_run_v2_job.newAttrs` constructs a new object with attributes and blocks configured for the `cloud_run_v2_job`
 Terraform data source.
 
-Unlike [google.data.cloudiot_registry_iam_policy.new](#fn-new), this function will not inject the `data source`
+Unlike [google.data.cloud_run_v2_job.new](#fn-new), this function will not inject the `data source`
 block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
 [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
 
@@ -74,57 +74,57 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `name` (`string`): Set the `name` field on the resulting object.
+  - `location` (`string`): The location of the cloud run job When `null`, the `location` field will be omitted from the resulting object.
+  - `name` (`string`): Name of the Job.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
-  - `region` (`string`): Set the `region` field on the resulting object. When `null`, the `region` field will be omitted from the resulting object.
 
 **Returns**:
-  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `cloudiot_registry_iam_policy` data source into the root Terraform configuration.
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `cloud_run_v2_job` data source into the root Terraform configuration.
 
 
-### fn withName
+### fn withLocation
 
 ```ts
-withName()
+withLocation()
 ```
 
-`google.string.withName` constructs a mixin object that can be merged into the `string`
-Terraform data source block to set or update the name field.
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the location field.
 
 
 
 **Args**:
   - `dataSrcLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `name` field.
+  - `value` (`string`): The value to set for the `location` field.
 
 
-### fn withProject
+### fn withName
 
 ```ts
-withProject()
+withName()
 ```
 
-`google.string.withProject` constructs a mixin object that can be merged into the `string`
-Terraform data source block to set or update the project field.
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the name field.
 
 
 
 **Args**:
   - `dataSrcLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `project` field.
+  - `value` (`string`): The value to set for the `name` field.
 
 
-### fn withRegion
+### fn withProject
 
 ```ts
-withRegion()
+withProject()
 ```
 
-`google.string.withRegion` constructs a mixin object that can be merged into the `string`
-Terraform data source block to set or update the region field.
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the project field.
 
 
 
 **Args**:
   - `dataSrcLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `region` field.
+  - `value` (`string`): The value to set for the `project` field.
diff --git a/docs/4.x/data/cloud_run_v2_service.md b/docs/4.x/data/cloud_run_v2_service.md
new file mode 100644
index 00000000..f5ef0e2c
--- /dev/null
+++ b/docs/4.x/data/cloud_run_v2_service.md
@@ -0,0 +1,130 @@
+---
+permalink: /data/cloud_run_v2_service/
+---
+
+# data.cloud_run_v2_service
+
+`cloud_run_v2_service` represents the `google_cloud_run_v2_service` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withName()`](#fn-withname)
+* [`fn withProject()`](#fn-withproject)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.data.cloud_run_v2_service.new` injects a new `data_google_cloud_run_v2_service` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.data.cloud_run_v2_service.new('some_id')
+
+You can get the reference to the `id` field of the created `google.data.cloud_run_v2_service` using the reference:
+
+    $._ref.data_google_cloud_run_v2_service.some_id.get('id')
+
+This is the same as directly entering `"${ data_google_cloud_run_v2_service.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `location` (`string`): The location of the cloud run service When `null`, the `location` field will be omitted from the resulting object.
+  - `name` (`string`): Name of the Service.
+  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.data.cloud_run_v2_service.newAttrs` constructs a new object with attributes and blocks configured for the `cloud_run_v2_service`
+Terraform data source.
+
+Unlike [google.data.cloud_run_v2_service.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `location` (`string`): The location of the cloud run service When `null`, the `location` field will be omitted from the resulting object.
+  - `name` (`string`): Name of the Service.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `cloud_run_v2_service` data source into the root Terraform configuration.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the location field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the name field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the project field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
diff --git a/docs/4.x/data/compute_networks.md b/docs/4.x/data/compute_networks.md
new file mode 100644
index 00000000..0ff5be0f
--- /dev/null
+++ b/docs/4.x/data/compute_networks.md
@@ -0,0 +1,92 @@
+---
+permalink: /data/compute_networks/
+---
+
+# data.compute_networks
+
+`compute_networks` represents the `google_compute_networks` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withProject()`](#fn-withproject)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.data.compute_networks.new` injects a new `data_google_compute_networks` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.data.compute_networks.new('some_id')
+
+You can get the reference to the `id` field of the created `google.data.compute_networks` using the reference:
+
+    $._ref.data_google_compute_networks.some_id.get('id')
+
+This is the same as directly entering `"${ data_google_compute_networks.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.data.compute_networks.newAttrs` constructs a new object with attributes and blocks configured for the `compute_networks`
+Terraform data source.
+
+Unlike [google.data.compute_networks.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `compute_networks` data source into the root Terraform configuration.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the project field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
diff --git a/docs/4.x/data/game_services_game_server_deployment_rollout.md b/docs/4.x/data/game_services_game_server_deployment_rollout.md
deleted file mode 100644
index 765128e7..00000000
--- a/docs/4.x/data/game_services_game_server_deployment_rollout.md
+++ /dev/null
@@ -1,92 +0,0 @@
----
-permalink: /data/game_services_game_server_deployment_rollout/
----
-
-# data.game_services_game_server_deployment_rollout
-
-`game_services_game_server_deployment_rollout` represents the `google_game_services_game_server_deployment_rollout` Terraform data source.
-
-
-
-This package contains functions and utilities for setting up the data source using Jsonnet code.
-
-
-## Index
-
-* [`fn new()`](#fn-new)
-* [`fn newAttrs()`](#fn-newattrs)
-* [`fn withDeploymentId()`](#fn-withdeploymentid)
-
-## Fields
-
-### fn new
-
-```ts
-new()
-```
-
-
-`google.data.game_services_game_server_deployment_rollout.new` injects a new `data_google_game_services_game_server_deployment_rollout` Terraform `data source`
-block into the root module document.
-
-Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
-resource. For example, if you added a new instance to the root using:
-
-    # arguments omitted for brevity
-    google.data.game_services_game_server_deployment_rollout.new('some_id')
-
-You can get the reference to the `id` field of the created `google.data.game_services_game_server_deployment_rollout` using the reference:
-
-    $._ref.data_google_game_services_game_server_deployment_rollout.some_id.get('id')
-
-This is the same as directly entering `"${ data_google_game_services_game_server_deployment_rollout.some_id.id }"` as the value.
-
-NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
-or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
-
-**Args**:
-  - `dataSrcLabel` (`string`): The name label of the block.
-  - `deployment_id` (`string`): The deployment to rollout the new config to. Only 1 rollout must be associated with each deployment.
-
-**Returns**:
-- A mixin object that injects the new data source into the root Terraform configuration.
-
-
-### fn newAttrs
-
-```ts
-newAttrs()
-```
-
-
-`google.data.game_services_game_server_deployment_rollout.newAttrs` constructs a new object with attributes and blocks configured for the `game_services_game_server_deployment_rollout`
-Terraform data source.
-
-Unlike [google.data.game_services_game_server_deployment_rollout.new](#fn-new), this function will not inject the `data source`
-block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
-[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
-
-This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
-injecting into a complete block.
-
-**Args**:
-  - `deployment_id` (`string`): The deployment to rollout the new config to. Only 1 rollout must be associated with each deployment.
-
-**Returns**:
-  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `game_services_game_server_deployment_rollout` data source into the root Terraform configuration.
-
-
-### fn withDeploymentId
-
-```ts
-withDeploymentId()
-```
-
-`google.string.withDeploymentId` constructs a mixin object that can be merged into the `string`
-Terraform data source block to set or update the deployment_id field.
-
-
-
-**Args**:
-  - `dataSrcLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `deployment_id` field.
diff --git a/docs/4.x/data/gke_hub_membership_iam_policy.md b/docs/4.x/data/gke_hub_membership_iam_policy.md
index 9a0c2d08..58ab9ae8 100644
--- a/docs/4.x/data/gke_hub_membership_iam_policy.md
+++ b/docs/4.x/data/gke_hub_membership_iam_policy.md
@@ -15,6 +15,7 @@ This package contains functions and utilities for setting up the data source usi
 
 * [`fn new()`](#fn-new)
 * [`fn newAttrs()`](#fn-newattrs)
+* [`fn withLocation()`](#fn-withlocation)
 * [`fn withMembershipId()`](#fn-withmembershipid)
 * [`fn withProject()`](#fn-withproject)
 
@@ -47,6 +48,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `dataSrcLabel` (`string`): The name label of the block.
+  - `location` (`string`): Set the `location` field on the resulting data source block. When `null`, the `location` field will be omitted from the resulting object.
   - `membership_id` (`string`): Set the `membership_id` field on the resulting data source block.
   - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.
 
@@ -72,6 +74,7 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
+  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.
   - `membership_id` (`string`): Set the `membership_id` field on the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
 
@@ -79,6 +82,22 @@ injecting into a complete block.
   - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `gke_hub_membership_iam_policy` data source into the root Terraform configuration.
 
 
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the location field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
 ### fn withMembershipId
 
 ```ts
diff --git a/docs/4.x/data/index.md b/docs/4.x/data/index.md
index 27402ae4..cde02819 100644
--- a/docs/4.x/data/index.md
+++ b/docs/4.x/data/index.md
@@ -24,6 +24,7 @@ permalink: /data/
 * [bigquery_analytics_hub_listing_iam_policy](bigquery_analytics_hub_listing_iam_policy.md)
 * [bigquery_connection_iam_policy](bigquery_connection_iam_policy.md)
 * [bigquery_datapolicy_data_policy_iam_policy](bigquery_datapolicy_data_policy_iam_policy.md)
+* [bigquery_dataset](bigquery_dataset.md)
 * [bigquery_dataset_iam_policy](bigquery_dataset_iam_policy.md)
 * [bigquery_default_service_account](bigquery_default_service_account.md)
 * [bigquery_table_iam_policy](bigquery_table_iam_policy.md)
@@ -35,12 +36,15 @@ permalink: /data/
 * [certificate_manager_certificate_map](certificate_manager_certificate_map.md)
 * [client_config](client_config.md)
 * [client_openid_userinfo](client_openid_userinfo.md)
+* [cloud_identity_group_lookup](cloud_identity_group_lookup.md)
 * [cloud_identity_group_memberships](cloud_identity_group_memberships.md)
 * [cloud_identity_groups](cloud_identity_groups.md)
 * [cloud_run_locations](cloud_run_locations.md)
 * [cloud_run_service](cloud_run_service.md)
 * [cloud_run_service_iam_policy](cloud_run_service_iam_policy.md)
+* [cloud_run_v2_job](cloud_run_v2_job.md)
 * [cloud_run_v2_job_iam_policy](cloud_run_v2_job_iam_policy.md)
+* [cloud_run_v2_service](cloud_run_v2_service.md)
 * [cloud_run_v2_service_iam_policy](cloud_run_v2_service_iam_policy.md)
 * [cloud_tasks_queue_iam_policy](cloud_tasks_queue_iam_policy.md)
 * [cloudbuild_trigger](cloudbuild_trigger.md)
@@ -49,7 +53,6 @@ permalink: /data/
 * [cloudfunctions2_function_iam_policy](cloudfunctions2_function_iam_policy.md)
 * [cloudfunctions_function](cloudfunctions_function.md)
 * [cloudfunctions_function_iam_policy](cloudfunctions_function_iam_policy.md)
-* [cloudiot_registry_iam_policy](cloudiot_registry_iam_policy.md)
 * [composer_environment](composer_environment.md)
 * [composer_image_versions](composer_image_versions.md)
 * [compute_address](compute_address.md)
@@ -76,6 +79,7 @@ permalink: /data/
 * [compute_network](compute_network.md)
 * [compute_network_endpoint_group](compute_network_endpoint_group.md)
 * [compute_network_peering](compute_network_peering.md)
+* [compute_networks](compute_networks.md)
 * [compute_node_types](compute_node_types.md)
 * [compute_region_disk_iam_policy](compute_region_disk_iam_policy.md)
 * [compute_region_instance_group](compute_region_instance_group.md)
@@ -130,7 +134,6 @@ permalink: /data/
 * [folder_iam_policy](folder_iam_policy.md)
 * [folder_organization_policy](folder_organization_policy.md)
 * [folders](folders.md)
-* [game_services_game_server_deployment_rollout](game_services_game_server_deployment_rollout.md)
 * [gke_backup_backup_plan_iam_policy](gke_backup_backup_plan_iam_policy.md)
 * [gke_backup_restore_plan_iam_policy](gke_backup_restore_plan_iam_policy.md)
 * [gke_hub_feature_iam_policy](gke_hub_feature_iam_policy.md)
@@ -182,6 +185,7 @@ permalink: /data/
 * [project_organization_policy](project_organization_policy.md)
 * [project_service](project_service.md)
 * [projects](projects.md)
+* [pubsub_schema_iam_policy](pubsub_schema_iam_policy.md)
 * [pubsub_subscription](pubsub_subscription.md)
 * [pubsub_subscription_iam_policy](pubsub_subscription_iam_policy.md)
 * [pubsub_topic](pubsub_topic.md)
@@ -192,6 +196,7 @@ permalink: /data/
 * [secret_manager_secret_iam_policy](secret_manager_secret_iam_policy.md)
 * [secret_manager_secret_version](secret_manager_secret_version.md)
 * [secret_manager_secret_version_access](secret_manager_secret_version_access.md)
+* [secret_manager_secrets](secret_manager_secrets.md)
 * [service_account](service_account.md)
 * [service_account_access_token](service_account_access_token.md)
 * [service_account_iam_policy](service_account_iam_policy.md)
diff --git a/docs/4.x/data/pubsub_schema_iam_policy.md b/docs/4.x/data/pubsub_schema_iam_policy.md
new file mode 100644
index 00000000..576ec84c
--- /dev/null
+++ b/docs/4.x/data/pubsub_schema_iam_policy.md
@@ -0,0 +1,111 @@
+---
+permalink: /data/pubsub_schema_iam_policy/
+---
+
+# data.pubsub_schema_iam_policy
+
+`pubsub_schema_iam_policy` represents the `google_pubsub_schema_iam_policy` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withSchema()`](#fn-withschema)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.data.pubsub_schema_iam_policy.new` injects a new `data_google_pubsub_schema_iam_policy` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.data.pubsub_schema_iam_policy.new('some_id')
+
+You can get the reference to the `id` field of the created `google.data.pubsub_schema_iam_policy` using the reference:
+
+    $._ref.data_google_pubsub_schema_iam_policy.some_id.get('id')
+
+This is the same as directly entering `"${ data_google_pubsub_schema_iam_policy.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.
+  - `schema` (`string`): Set the `schema` field on the resulting data source block.
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.data.pubsub_schema_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `pubsub_schema_iam_policy`
+Terraform data source.
+
+Unlike [google.data.pubsub_schema_iam_policy.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `schema` (`string`): Set the `schema` field on the resulting object.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `pubsub_schema_iam_policy` data source into the root Terraform configuration.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the project field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withSchema
+
+```ts
+withSchema()
+```
+
+`google.string.withSchema` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the schema field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `schema` field.
diff --git a/docs/4.x/data/secret_manager_secrets.md b/docs/4.x/data/secret_manager_secrets.md
new file mode 100644
index 00000000..10babf87
--- /dev/null
+++ b/docs/4.x/data/secret_manager_secrets.md
@@ -0,0 +1,113 @@
+---
+permalink: /data/secret_manager_secrets/
+---
+
+# data.secret_manager_secrets
+
+`secret_manager_secrets` represents the `google_secret_manager_secrets` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withFilter()`](#fn-withfilter)
+* [`fn withProject()`](#fn-withproject)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.data.secret_manager_secrets.new` injects a new `data_google_secret_manager_secrets` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.data.secret_manager_secrets.new('some_id')
+
+You can get the reference to the `id` field of the created `google.data.secret_manager_secrets` using the reference:
+
+    $._ref.data_google_secret_manager_secrets.some_id.get('id')
+
+This is the same as directly entering `"${ data_google_secret_manager_secrets.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `filter` (`string`): Filter string, adhering to the rules in List-operation filtering (https://cloud.google.com/secret-manager/docs/filtering).
+List only secrets matching the filter. If filter is empty, all secrets are listed. When `null`, the `filter` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting data source block. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.data.secret_manager_secrets.newAttrs` constructs a new object with attributes and blocks configured for the `secret_manager_secrets`
+Terraform data source.
+
+Unlike [google.data.secret_manager_secrets.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `filter` (`string`): Filter string, adhering to the rules in List-operation filtering (https://cloud.google.com/secret-manager/docs/filtering).
+List only secrets matching the filter. If filter is empty, all secrets are listed. When `null`, the `filter` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `secret_manager_secrets` data source into the root Terraform configuration.
+
+
+### fn withFilter
+
+```ts
+withFilter()
+```
+
+`google.string.withFilter` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the filter field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `filter` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the project field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
diff --git a/docs/4.x/data_fusion_instance.md b/docs/4.x/data_fusion_instance.md
index eb0e6fb2..b32cf9af 100644
--- a/docs/4.x/data_fusion_instance.md
+++ b/docs/4.x/data_fusion_instance.md
@@ -87,7 +87,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `enable_stackdriver_logging` (`bool`): Option to enable Stackdriver Logging. When `null`, the `enable_stackdriver_logging` field will be omitted from the resulting object.
   - `enable_stackdriver_monitoring` (`bool`): Option to enable Stackdriver Monitoring. When `null`, the `enable_stackdriver_monitoring` field will be omitted from the resulting object.
   - `labels` (`obj`): The resource labels for instance to use to annotate any related underlying resources,
-such as Compute Engine VMs. When `null`, the `labels` field will be omitted from the resulting object.
+such as Compute Engine VMs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The ID of the instance or a fully qualified identifier for the instance.
   - `options` (`obj`): Map of additional options used to configure the behavior of Data Fusion instance. When `null`, the `options` field will be omitted from the resulting object.
   - `private_instance` (`bool`): Specifies whether the Data Fusion instance should be private. If set to
@@ -145,7 +149,11 @@ injecting into a complete block.
   - `enable_stackdriver_logging` (`bool`): Option to enable Stackdriver Logging. When `null`, the `enable_stackdriver_logging` field will be omitted from the resulting object.
   - `enable_stackdriver_monitoring` (`bool`): Option to enable Stackdriver Monitoring. When `null`, the `enable_stackdriver_monitoring` field will be omitted from the resulting object.
   - `labels` (`obj`): The resource labels for instance to use to annotate any related underlying resources,
-such as Compute Engine VMs. When `null`, the `labels` field will be omitted from the resulting object.
+such as Compute Engine VMs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The ID of the instance or a fully qualified identifier for the instance.
   - `options` (`obj`): Map of additional options used to configure the behavior of Data Fusion instance. When `null`, the `options` field will be omitted from the resulting object.
   - `private_instance` (`bool`): Specifies whether the Data Fusion instance should be private. If set to
diff --git a/docs/4.x/database_migration_service_connection_profile.md b/docs/4.x/database_migration_service_connection_profile.md
index 95edcae0..a5026a34 100644
--- a/docs/4.x/database_migration_service_connection_profile.md
+++ b/docs/4.x/database_migration_service_connection_profile.md
@@ -25,6 +25,8 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withLocation()`](#fn-withlocation)
 * [`fn withMysql()`](#fn-withmysql)
 * [`fn withMysqlMixin()`](#fn-withmysqlmixin)
+* [`fn withOracle()`](#fn-withoracle)
+* [`fn withOracleMixin()`](#fn-withoraclemixin)
 * [`fn withPostgresql()`](#fn-withpostgresql)
 * [`fn withPostgresqlMixin()`](#fn-withpostgresqlmixin)
 * [`fn withProject()`](#fn-withproject)
@@ -52,6 +54,16 @@ This package contains functions and utilities for setting up the resource using
   * [`fn new()`](#fn-mysqlnew)
   * [`obj mysql.ssl`](#obj-mysqlssl)
     * [`fn new()`](#fn-mysqlsslnew)
+* [`obj oracle`](#obj-oracle)
+  * [`fn new()`](#fn-oraclenew)
+  * [`obj oracle.forward_ssh_connectivity`](#obj-oracleforward_ssh_connectivity)
+    * [`fn new()`](#fn-oracleforward_ssh_connectivitynew)
+  * [`obj oracle.private_connectivity`](#obj-oracleprivate_connectivity)
+    * [`fn new()`](#fn-oracleprivate_connectivitynew)
+  * [`obj oracle.ssl`](#obj-oraclessl)
+    * [`fn new()`](#fn-oraclesslnew)
+  * [`obj oracle.static_service_ip_connectivity`](#obj-oraclestatic_service_ip_connectivity)
+    * [`fn new()`](#fn-oraclestatic_service_ip_connectivitynew)
 * [`obj postgresql`](#obj-postgresql)
   * [`fn new()`](#fn-postgresqlnew)
   * [`obj postgresql.ssl`](#obj-postgresqlssl)
@@ -90,12 +102,17 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `connection_profile_id` (`string`): The ID of the connection profile.
   - `display_name` (`string`): The connection profile display name. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): The resource labels for connection profile to use to annotate any related underlying resources such as Compute Engine VMs. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): The resource labels for connection profile to use to annotate any related underlying resources such as Compute Engine VMs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location where the connection profile should reside. When `null`, the `location` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `alloydb` (`list[obj]`): Specifies required connection parameters, and the parameters required to create an AlloyDB destination cluster. When `null`, the `alloydb` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.alloydb.new](#fn-alloydbnew) constructor.
   - `cloudsql` (`list[obj]`): Specifies required connection parameters, and, optionally, the parameters required to create a Cloud SQL destination database instance. When `null`, the `cloudsql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.cloudsql.new](#fn-cloudsqlnew) constructor.
   - `mysql` (`list[obj]`): Specifies connection parameters required specifically for MySQL databases. When `null`, the `mysql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.mysql.new](#fn-mysqlnew) constructor.
+  - `oracle` (`list[obj]`): Specifies connection parameters required specifically for Oracle databases. When `null`, the `oracle` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.oracle.new](#fn-oraclenew) constructor.
   - `postgresql` (`list[obj]`): Specifies connection parameters required specifically for PostgreSQL databases. When `null`, the `postgresql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.postgresql.new](#fn-postgresqlnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.timeouts.new](#fn-timeoutsnew) constructor.
 
@@ -123,12 +140,17 @@ injecting into a complete block.
 **Args**:
   - `connection_profile_id` (`string`): The ID of the connection profile.
   - `display_name` (`string`): The connection profile display name. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): The resource labels for connection profile to use to annotate any related underlying resources such as Compute Engine VMs. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): The resource labels for connection profile to use to annotate any related underlying resources such as Compute Engine VMs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location where the connection profile should reside. When `null`, the `location` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `alloydb` (`list[obj]`): Specifies required connection parameters, and the parameters required to create an AlloyDB destination cluster. When `null`, the `alloydb` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.alloydb.new](#fn-alloydbnew) constructor.
   - `cloudsql` (`list[obj]`): Specifies required connection parameters, and, optionally, the parameters required to create a Cloud SQL destination database instance. When `null`, the `cloudsql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.cloudsql.new](#fn-cloudsqlnew) constructor.
   - `mysql` (`list[obj]`): Specifies connection parameters required specifically for MySQL databases. When `null`, the `mysql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.mysql.new](#fn-mysqlnew) constructor.
+  - `oracle` (`list[obj]`): Specifies connection parameters required specifically for Oracle databases. When `null`, the `oracle` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.oracle.new](#fn-oraclenew) constructor.
   - `postgresql` (`list[obj]`): Specifies connection parameters required specifically for PostgreSQL databases. When `null`, the `postgresql` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.postgresql.new](#fn-postgresqlnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.timeouts.new](#fn-timeoutsnew) constructor.
 
@@ -311,6 +333,43 @@ function.
   - `value` (`list[obj]`): The value to set for the `mysql` field.
 
 
+### fn withOracle
+
+```ts
+withOracle()
+```
+
+`google.list[obj].withOracle` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the oracle field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withOracleMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `oracle` field.
+
+
+### fn withOracleMixin
+
+```ts
+withOracleMixin()
+```
+
+`google.list[obj].withOracleMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the oracle field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withOracle](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `oracle` field.
+
+
 ### fn withPostgresql
 
 ```ts
@@ -697,6 +756,138 @@ If this field is used then the 'clientCertificate' field is mandatory. W
   - An attribute object that represents the `ssl` sub block.
 
 
+## obj oracle
+
+
+
+### fn oracle.new
+
+```ts
+new()
+```
+
+
+`google.database_migration_service_connection_profile.oracle.new` constructs a new object with attributes and blocks configured for the `oracle`
+Terraform sub block.
+
+
+
+**Args**:
+  - `database_service` (`string`): Required. Database service for the Oracle connection.
+  - `host` (`string`): Required. The IP or hostname of the source Oracle database.
+  - `password` (`string`): Required. Input only. The password for the user that Database Migration Service will be using to connect to the database.
+This field is not returned on request, and the value is encrypted when stored in Database Migration Service.
+  - `port` (`number`): Required. The network port of the source Oracle database.
+  - `username` (`string`): Required. The username that Database Migration Service will use to connect to the database. The value is encrypted when stored in Database Migration Service.
+  - `forward_ssh_connectivity` (`list[obj]`): SSL configuration for the destination to connect to the source database. When `null`, the `forward_ssh_connectivity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.oracle.forward_ssh_connectivity.new](#fn-oracleforward_ssh_connectivitynew) constructor.
+  - `private_connectivity` (`list[obj]`): Configuration for using a private network to communicate with the source database When `null`, the `private_connectivity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.oracle.private_connectivity.new](#fn-oracleprivate_connectivitynew) constructor.
+  - `ssl` (`list[obj]`): SSL configuration for the destination to connect to the source database. When `null`, the `ssl` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.oracle.ssl.new](#fn-oraclesslnew) constructor.
+  - `static_service_ip_connectivity` (`list[obj]`): This object has no nested fields.
+
+Static IP address connectivity configured on service project. When `null`, the `static_service_ip_connectivity` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_connection_profile.oracle.static_service_ip_connectivity.new](#fn-oraclestatic_service_ip_connectivitynew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `oracle` sub block.
+
+
+## obj oracle.forward_ssh_connectivity
+
+
+
+### fn oracle.forward_ssh_connectivity.new
+
+```ts
+new()
+```
+
+
+`google.database_migration_service_connection_profile.oracle.forward_ssh_connectivity.new` constructs a new object with attributes and blocks configured for the `forward_ssh_connectivity`
+Terraform sub block.
+
+
+
+**Args**:
+  - `hostname` (`string`): Required. Hostname for the SSH tunnel.
+  - `password` (`string`): Input only. SSH password. Only one of 'password' and 'private_key' can be configured. When `null`, the `password` field will be omitted from the resulting object.
+  - `port` (`number`): Port for the SSH tunnel, default value is 22.
+  - `private_key` (`string`): Input only. SSH private key. Only one of 'password' and 'private_key' can be configured. When `null`, the `private_key` field will be omitted from the resulting object.
+  - `username` (`string`): Required. Username for the SSH tunnel.
+
+**Returns**:
+  - An attribute object that represents the `forward_ssh_connectivity` sub block.
+
+
+## obj oracle.private_connectivity
+
+
+
+### fn oracle.private_connectivity.new
+
+```ts
+new()
+```
+
+
+`google.database_migration_service_connection_profile.oracle.private_connectivity.new` constructs a new object with attributes and blocks configured for the `private_connectivity`
+Terraform sub block.
+
+
+
+**Args**:
+  - `private_connection` (`string`): Required. The resource name (URI) of the private connection.
+
+**Returns**:
+  - An attribute object that represents the `private_connectivity` sub block.
+
+
+## obj oracle.ssl
+
+
+
+### fn oracle.ssl.new
+
+```ts
+new()
+```
+
+
+`google.database_migration_service_connection_profile.oracle.ssl.new` constructs a new object with attributes and blocks configured for the `ssl`
+Terraform sub block.
+
+
+
+**Args**:
+  - `ca_certificate` (`string`): Required. Input only. The x509 PEM-encoded certificate of the CA that signed the source database server's certificate.
+The replica will use this certificate to verify it's connecting to the right host.
+  - `client_certificate` (`string`): Input only. The x509 PEM-encoded certificate that will be used by the replica to authenticate against the source database server.
+If this field is used then the 'clientKey' field is mandatory When `null`, the `client_certificate` field will be omitted from the resulting object.
+  - `client_key` (`string`): Input only. The unencrypted PKCS#1 or PKCS#8 PEM-encoded private key associated with the Client Certificate.
+If this field is used then the 'clientCertificate' field is mandatory. When `null`, the `client_key` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `ssl` sub block.
+
+
+## obj oracle.static_service_ip_connectivity
+
+
+
+### fn oracle.static_service_ip_connectivity.new
+
+```ts
+new()
+```
+
+
+`google.database_migration_service_connection_profile.oracle.static_service_ip_connectivity.new` constructs a new object with attributes and blocks configured for the `static_service_ip_connectivity`
+Terraform sub block.
+
+
+
+**Returns**:
+  - An attribute object that represents the `static_service_ip_connectivity` sub block.
+
+
 ## obj postgresql
 
 
diff --git a/docs/4.x/database_migration_service_private_connection.md b/docs/4.x/database_migration_service_private_connection.md
new file mode 100644
index 00000000..314a171f
--- /dev/null
+++ b/docs/4.x/database_migration_service_private_connection.md
@@ -0,0 +1,310 @@
+---
+permalink: /database_migration_service_private_connection/
+---
+
+# database_migration_service_private_connection
+
+`database_migration_service_private_connection` represents the `google_database_migration_service_private_connection` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withDisplayName()`](#fn-withdisplayname)
+* [`fn withLabels()`](#fn-withlabels)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withPrivateConnectionId()`](#fn-withprivateconnectionid)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withVpcPeeringConfig()`](#fn-withvpcpeeringconfig)
+* [`fn withVpcPeeringConfigMixin()`](#fn-withvpcpeeringconfigmixin)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+* [`obj vpc_peering_config`](#obj-vpc_peering_config)
+  * [`fn new()`](#fn-vpc_peering_confignew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.database_migration_service_private_connection.new` injects a new `google_database_migration_service_private_connection` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.database_migration_service_private_connection.new('some_id')
+
+You can get the reference to the `id` field of the created `google.database_migration_service_private_connection` using the reference:
+
+    $._ref.google_database_migration_service_private_connection.some_id.get('id')
+
+This is the same as directly entering `"${ google_database_migration_service_private_connection.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `display_name` (`string`): Display name. When `null`, the `display_name` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): The name of the location this private connection is located in.
+  - `private_connection_id` (`string`): The private connectivity identifier.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_private_connection.timeouts.new](#fn-timeoutsnew) constructor.
+  - `vpc_peering_config` (`list[obj]`): The VPC Peering configuration is used to create VPC peering
+between databasemigrationservice and the consumer's VPC. When `null`, the `vpc_peering_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_private_connection.vpc_peering_config.new](#fn-vpc_peering_confignew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.database_migration_service_private_connection.newAttrs` constructs a new object with attributes and blocks configured for the `database_migration_service_private_connection`
+Terraform resource.
+
+Unlike [google.database_migration_service_private_connection.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `display_name` (`string`): Display name. When `null`, the `display_name` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): The name of the location this private connection is located in.
+  - `private_connection_id` (`string`): The private connectivity identifier.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_private_connection.timeouts.new](#fn-timeoutsnew) constructor.
+  - `vpc_peering_config` (`list[obj]`): The VPC Peering configuration is used to create VPC peering
+between databasemigrationservice and the consumer's VPC. When `null`, the `vpc_peering_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.database_migration_service_private_connection.vpc_peering_config.new](#fn-vpc_peering_confignew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `database_migration_service_private_connection` resource into the root Terraform configuration.
+
+
+### fn withDisplayName
+
+```ts
+withDisplayName()
+```
+
+`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the display_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `display_name` field.
+
+
+### fn withLabels
+
+```ts
+withLabels()
+```
+
+`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the labels field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `labels` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withPrivateConnectionId
+
+```ts
+withPrivateConnectionId()
+```
+
+`google.string.withPrivateConnectionId` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the private_connection_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `private_connection_id` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withVpcPeeringConfig
+
+```ts
+withVpcPeeringConfig()
+```
+
+`google.list[obj].withVpcPeeringConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the vpc_peering_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withVpcPeeringConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `vpc_peering_config` field.
+
+
+### fn withVpcPeeringConfigMixin
+
+```ts
+withVpcPeeringConfigMixin()
+```
+
+`google.list[obj].withVpcPeeringConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the vpc_peering_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withVpcPeeringConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `vpc_peering_config` field.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.database_migration_service_private_connection.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
+
+
+## obj vpc_peering_config
+
+
+
+### fn vpc_peering_config.new
+
+```ts
+new()
+```
+
+
+`google.database_migration_service_private_connection.vpc_peering_config.new` constructs a new object with attributes and blocks configured for the `vpc_peering_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `subnet` (`string`): A free subnet for peering. (CIDR of /29)
+  - `vpc_name` (`string`): Fully qualified name of the VPC that Database Migration Service will peer to.
+Format: projects/{project}/global/{networks}/{name}
+
+**Returns**:
+  - An attribute object that represents the `vpc_peering_config` sub block.
diff --git a/docs/4.x/dataflow_job.md b/docs/4.x/dataflow_job.md
index c9fa9092..314883a8 100644
--- a/docs/4.x/dataflow_job.md
+++ b/docs/4.x/dataflow_job.md
@@ -73,7 +73,8 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `enable_streaming_engine` (`bool`): Indicates if the job should use the streaming engine feature. When `null`, the `enable_streaming_engine` field will be omitted from the resulting object.
   - `ip_configuration` (`string`): The configuration for VM IPs. Options are "WORKER_IP_PUBLIC" or "WORKER_IP_PRIVATE". When `null`, the `ip_configuration` field will be omitted from the resulting object.
   - `kms_key_name` (`string`): The name for the Cloud KMS key for the job. Key format is: projects/PROJECT_ID/locations/LOCATION/keyRings/KEY_RING/cryptoKeys/KEY When `null`, the `kms_key_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): User labels to be specified for the job. Keys and values should follow the restrictions specified in the labeling restrictions page. NOTE: Google-provided Dataflow templates often provide default labels that begin with goog-dataflow-provided. Unless explicitly set in config, these labels will be ignored to prevent diffs on re-apply. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): User labels to be specified for the job. Keys and values should follow the restrictions specified in the labeling restrictions page. NOTE: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `machine_type` (`string`): The machine type to use for the job. When `null`, the `machine_type` field will be omitted from the resulting object.
   - `max_workers` (`number`): The number of workers permitted to work on the job. More workers may improve processing speed at additional cost. When `null`, the `max_workers` field will be omitted from the resulting object.
   - `name` (`string`): A unique name for the resource, required by Dataflow.
@@ -117,7 +118,8 @@ injecting into a complete block.
   - `enable_streaming_engine` (`bool`): Indicates if the job should use the streaming engine feature. When `null`, the `enable_streaming_engine` field will be omitted from the resulting object.
   - `ip_configuration` (`string`): The configuration for VM IPs. Options are "WORKER_IP_PUBLIC" or "WORKER_IP_PRIVATE". When `null`, the `ip_configuration` field will be omitted from the resulting object.
   - `kms_key_name` (`string`): The name for the Cloud KMS key for the job. Key format is: projects/PROJECT_ID/locations/LOCATION/keyRings/KEY_RING/cryptoKeys/KEY When `null`, the `kms_key_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): User labels to be specified for the job. Keys and values should follow the restrictions specified in the labeling restrictions page. NOTE: Google-provided Dataflow templates often provide default labels that begin with goog-dataflow-provided. Unless explicitly set in config, these labels will be ignored to prevent diffs on re-apply. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): User labels to be specified for the job. Keys and values should follow the restrictions specified in the labeling restrictions page. NOTE: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `machine_type` (`string`): The machine type to use for the job. When `null`, the `machine_type` field will be omitted from the resulting object.
   - `max_workers` (`number`): The number of workers permitted to work on the job. More workers may improve processing speed at additional cost. When `null`, the `max_workers` field will be omitted from the resulting object.
   - `name` (`string`): A unique name for the resource, required by Dataflow.
diff --git a/docs/4.x/dataplex_asset.md b/docs/4.x/dataplex_asset.md
index bd2b5cdc..4cb93140 100644
--- a/docs/4.x/dataplex_asset.md
+++ b/docs/4.x/dataplex_asset.md
@@ -72,7 +72,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `dataplex_zone` (`string`): The zone for the resource
   - `description` (`string`): Optional. Description of the asset. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional. User defined labels for the asset. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. User defined labels for the asset.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `lake` (`string`): The lake for the resource
   - `location` (`string`): The location for the resource
   - `name` (`string`): The name of the asset.
@@ -106,7 +109,10 @@ injecting into a complete block.
   - `dataplex_zone` (`string`): The zone for the resource
   - `description` (`string`): Optional. Description of the asset. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional. User defined labels for the asset. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. User defined labels for the asset.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `lake` (`string`): The lake for the resource
   - `location` (`string`): The location for the resource
   - `name` (`string`): The name of the asset.
diff --git a/docs/4.x/dataplex_datascan.md b/docs/4.x/dataplex_datascan.md
index 30c3af4f..86576a25 100644
--- a/docs/4.x/dataplex_datascan.md
+++ b/docs/4.x/dataplex_datascan.md
@@ -110,7 +110,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `data_scan_id` (`string`): DataScan identifier. Must contain only lowercase letters, numbers and hyphens. Must start with a letter. Must end with a number or a letter.
   - `description` (`string`): Description of the scan. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): User-defined labels for the scan. A list of key->value pairs. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels for the scan. A list of key->value pairs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location where the data scan should reside.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `data` (`list[obj]`): The data source for DataScan. When `null`, the `data` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data.new](#fn-datanew) constructor.
@@ -144,7 +148,11 @@ injecting into a complete block.
   - `data_scan_id` (`string`): DataScan identifier. Must contain only lowercase letters, numbers and hyphens. Must start with a letter. Must end with a number or a letter.
   - `description` (`string`): Description of the scan. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): User-defined labels for the scan. A list of key->value pairs. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels for the scan. A list of key->value pairs.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location where the data scan should reside.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `data` (`list[obj]`): The data source for DataScan. When `null`, the `data` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataplex_datascan.data.new](#fn-datanew) constructor.
diff --git a/docs/4.x/dataplex_lake.md b/docs/4.x/dataplex_lake.md
index 8eb20d76..6c30d6cb 100644
--- a/docs/4.x/dataplex_lake.md
+++ b/docs/4.x/dataplex_lake.md
@@ -61,7 +61,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): Optional. Description of the lake. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional. User-defined labels for the lake. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. User-defined labels for the lake.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): The name of the lake.
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
@@ -92,7 +95,10 @@ injecting into a complete block.
 **Args**:
   - `description` (`string`): Optional. Description of the lake. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional. User-defined labels for the lake. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. User-defined labels for the lake.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): The name of the lake.
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
diff --git a/docs/4.x/dataplex_task.md b/docs/4.x/dataplex_task.md
index 6fe5170b..d25bd3f3 100644
--- a/docs/4.x/dataplex_task.md
+++ b/docs/4.x/dataplex_task.md
@@ -90,7 +90,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): User-provided description of the task. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): User-defined labels for the task. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels for the task.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `lake` (`string`): The lake in which the task will be created in. When `null`, the `lake` field will be omitted from the resulting object.
   - `location` (`string`): The location in which the task will be created in. When `null`, the `location` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
@@ -125,7 +129,11 @@ injecting into a complete block.
 **Args**:
   - `description` (`string`): User-provided description of the task. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): User-defined labels for the task. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels for the task.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `lake` (`string`): The lake in which the task will be created in. When `null`, the `lake` field will be omitted from the resulting object.
   - `location` (`string`): The location in which the task will be created in. When `null`, the `location` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
diff --git a/docs/4.x/dataplex_zone.md b/docs/4.x/dataplex_zone.md
index d349df2f..5bbb32da 100644
--- a/docs/4.x/dataplex_zone.md
+++ b/docs/4.x/dataplex_zone.md
@@ -71,7 +71,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): Optional. Description of the zone. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional. User defined labels for the zone. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. User defined labels for the zone.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `lake` (`string`): The lake for the resource
   - `location` (`string`): The location for the resource
   - `name` (`string`): The name of the zone.
@@ -105,7 +108,10 @@ injecting into a complete block.
 **Args**:
   - `description` (`string`): Optional. Description of the zone. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): Optional. User friendly display name. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional. User defined labels for the zone. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. User defined labels for the zone.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `lake` (`string`): The lake for the resource
   - `location` (`string`): The location for the resource
   - `name` (`string`): The name of the zone.
diff --git a/docs/4.x/dataproc_cluster.md b/docs/4.x/dataproc_cluster.md
index 65be6c2b..5cdf389b 100644
--- a/docs/4.x/dataproc_cluster.md
+++ b/docs/4.x/dataproc_cluster.md
@@ -62,6 +62,10 @@ This package contains functions and utilities for setting up the resource using
     * [`fn new()`](#fn-cluster_configpreemptible_worker_confignew)
     * [`obj cluster_config.preemptible_worker_config.disk_config`](#obj-cluster_configpreemptible_worker_configdisk_config)
       * [`fn new()`](#fn-cluster_configpreemptible_worker_configdisk_confignew)
+    * [`obj cluster_config.preemptible_worker_config.instance_flexibility_policy`](#obj-cluster_configpreemptible_worker_configinstance_flexibility_policy)
+      * [`fn new()`](#fn-cluster_configpreemptible_worker_configinstance_flexibility_policynew)
+      * [`obj cluster_config.preemptible_worker_config.instance_flexibility_policy.instance_selection_list`](#obj-cluster_configpreemptible_worker_configinstance_flexibility_policyinstance_selection_list)
+        * [`fn new()`](#fn-cluster_configpreemptible_worker_configinstance_flexibility_policyinstance_selection_listnew)
   * [`obj cluster_config.security_config`](#obj-cluster_configsecurity_config)
     * [`fn new()`](#fn-cluster_configsecurity_confignew)
     * [`obj cluster_config.security_config.kerberos_config`](#obj-cluster_configsecurity_configkerberos_config)
@@ -129,7 +133,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `graceful_decommission_timeout` (`string`): The timeout duration which allows graceful decomissioning when you change the number of worker nodes directly through a terraform apply When `null`, the `graceful_decommission_timeout` field will be omitted from the resulting object.
-  - `labels` (`obj`): The list of labels (key/value pairs) to be applied to instances in the cluster. GCP generates some itself including goog-dataproc-cluster-name which is the name of the cluster. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): The list of the labels (key/value pairs) configured on the resource and to be applied to instances in the cluster.
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The name of the cluster, unique within the project and zone.
   - `project` (`string`): The ID of the project in which the cluster will exist. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region in which the cluster and associated nodes will be created in. Defaults to global. When `null`, the `region` field will be omitted from the resulting object.
@@ -160,7 +167,10 @@ injecting into a complete block.
 
 **Args**:
   - `graceful_decommission_timeout` (`string`): The timeout duration which allows graceful decomissioning when you change the number of worker nodes directly through a terraform apply When `null`, the `graceful_decommission_timeout` field will be omitted from the resulting object.
-  - `labels` (`obj`): The list of labels (key/value pairs) to be applied to instances in the cluster. GCP generates some itself including goog-dataproc-cluster-name which is the name of the cluster. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): The list of the labels (key/value pairs) configured on the resource and to be applied to instances in the cluster.
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The name of the cluster, unique within the project and zone.
   - `project` (`string`): The ID of the project in which the cluster will exist. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region in which the cluster and associated nodes will be created in. Defaults to global. When `null`, the `region` field will be omitted from the resulting object.
@@ -388,12 +398,12 @@ Terraform sub block.
   - `gce_cluster_config` (`list[obj]`): Common config settings for resources of Google Compute Engine cluster instances, applicable to all instances in the cluster. When `null`, the `gce_cluster_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.gce_cluster_config.new](#fn-cluster_configgce_cluster_confignew) constructor.
   - `initialization_action` (`list[obj]`): Commands to execute on each node after config is completed. You can specify multiple versions of these. When `null`, the `initialization_action` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.initialization_action.new](#fn-cluster_configinitialization_actionnew) constructor.
   - `lifecycle_config` (`list[obj]`): The settings for auto deletion cluster schedule. When `null`, the `lifecycle_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.lifecycle_config.new](#fn-cluster_configlifecycle_confignew) constructor.
-  - `master_config` (`list[obj]`): The Google Compute Engine config settings for the master/worker instances in a cluster. When `null`, the `master_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.master_config.new](#fn-cluster_configmaster_confignew) constructor.
+  - `master_config` (`list[obj]`): The Compute Engine config settings for the cluster's master instance. When `null`, the `master_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.master_config.new](#fn-cluster_configmaster_confignew) constructor.
   - `metastore_config` (`list[obj]`): Specifies a Metastore configuration. When `null`, the `metastore_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.metastore_config.new](#fn-cluster_configmetastore_confignew) constructor.
   - `preemptible_worker_config` (`list[obj]`): The Google Compute Engine config settings for the additional (aka preemptible) instances in a cluster. When `null`, the `preemptible_worker_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.preemptible_worker_config.new](#fn-cluster_configpreemptible_worker_confignew) constructor.
   - `security_config` (`list[obj]`): Security related configuration. When `null`, the `security_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.security_config.new](#fn-cluster_configsecurity_confignew) constructor.
   - `software_config` (`list[obj]`): The config settings for software inside the cluster. When `null`, the `software_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.software_config.new](#fn-cluster_configsoftware_confignew) constructor.
-  - `worker_config` (`list[obj]`): The Google Compute Engine config settings for the master/worker instances in a cluster. When `null`, the `worker_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.worker_config.new](#fn-cluster_configworker_confignew) constructor.
+  - `worker_config` (`list[obj]`): The Compute Engine config settings for the cluster's worker instances. When `null`, the `worker_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.worker_config.new](#fn-cluster_configworker_confignew) constructor.
 
 **Returns**:
   - An attribute object that represents the `cluster_config` sub block.
@@ -686,10 +696,10 @@ Terraform sub block.
 
 
 **Args**:
-  - `image_uri` (`string`): The URI for the image to use for this master/worker When `null`, the `image_uri` field will be omitted from the resulting object.
-  - `machine_type` (`string`): The name of a Google Compute Engine machine type to create for the master/worker When `null`, the `machine_type` field will be omitted from the resulting object.
-  - `min_cpu_platform` (`string`): The name of a minimum generation of CPU family for the master/worker. If not specified, GCP will default to a predetermined computed value for each zone. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.
-  - `num_instances` (`number`): Specifies the number of master/worker nodes to create. If not specified, GCP will default to a predetermined computed value. When `null`, the `num_instances` field will be omitted from the resulting object.
+  - `image_uri` (`string`): The URI for the image to use for this master When `null`, the `image_uri` field will be omitted from the resulting object.
+  - `machine_type` (`string`): The name of a Google Compute Engine machine type to create for the master When `null`, the `machine_type` field will be omitted from the resulting object.
+  - `min_cpu_platform` (`string`): The name of a minimum generation of CPU family for the master. If not specified, GCP will default to a predetermined computed value for each zone. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.
+  - `num_instances` (`number`): Specifies the number of master nodes to create. If not specified, GCP will default to a predetermined computed value. When `null`, the `num_instances` field will be omitted from the resulting object.
   - `accelerators` (`list[obj]`): The Compute Engine accelerator (GPU) configuration for these instances. Can be specified multiple times. When `null`, the `accelerators` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.master_config.accelerators.new](#fn-cluster_configcluster_configacceleratorsnew) constructor.
   - `disk_config` (`list[obj]`): Disk Config When `null`, the `disk_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.master_config.disk_config.new](#fn-cluster_configcluster_configdisk_confignew) constructor.
 
@@ -789,6 +799,7 @@ Terraform sub block.
   - `num_instances` (`number`): Specifies the number of preemptible nodes to create. Defaults to 0. When `null`, the `num_instances` field will be omitted from the resulting object.
   - `preemptibility` (`string`): Specifies the preemptibility of the secondary nodes. Defaults to PREEMPTIBLE. When `null`, the `preemptibility` field will be omitted from the resulting object.
   - `disk_config` (`list[obj]`): Disk Config When `null`, the `disk_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.preemptible_worker_config.disk_config.new](#fn-cluster_configcluster_configdisk_confignew) constructor.
+  - `instance_flexibility_policy` (`list[obj]`): Instance flexibility Policy allowing a mixture of VM shapes and provisioning models. When `null`, the `instance_flexibility_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.preemptible_worker_config.instance_flexibility_policy.new](#fn-cluster_configcluster_configinstance_flexibility_policynew) constructor.
 
 **Returns**:
   - An attribute object that represents the `preemptible_worker_config` sub block.
@@ -819,6 +830,53 @@ Terraform sub block.
   - An attribute object that represents the `disk_config` sub block.
 
 
+## obj cluster_config.preemptible_worker_config.instance_flexibility_policy
+
+
+
+### fn cluster_config.preemptible_worker_config.instance_flexibility_policy.new
+
+```ts
+new()
+```
+
+
+`google.dataproc_cluster.cluster_config.preemptible_worker_config.instance_flexibility_policy.new` constructs a new object with attributes and blocks configured for the `instance_flexibility_policy`
+Terraform sub block.
+
+
+
+**Args**:
+  - `instance_selection_list` (`list[obj]`): List of instance selection options that the group will use when creating new VMs. When `null`, the `instance_selection_list` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.preemptible_worker_config.instance_flexibility_policy.instance_selection_list.new](#fn-cluster_configcluster_configpreemptible_worker_configinstance_selection_listnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `instance_flexibility_policy` sub block.
+
+
+## obj cluster_config.preemptible_worker_config.instance_flexibility_policy.instance_selection_list
+
+
+
+### fn cluster_config.preemptible_worker_config.instance_flexibility_policy.instance_selection_list.new
+
+```ts
+new()
+```
+
+
+`google.dataproc_cluster.cluster_config.preemptible_worker_config.instance_flexibility_policy.instance_selection_list.new` constructs a new object with attributes and blocks configured for the `instance_selection_list`
+Terraform sub block.
+
+
+
+**Args**:
+  - `machine_types` (`list`): Full machine-type names, e.g. "n1-standard-16". When `null`, the `machine_types` field will be omitted from the resulting object.
+  - `rank` (`number`): Preference of this instance selection. Lower number means higher preference. Dataproc will first try to create a VM based on the machine-type with priority rank and fallback to next rank based on availability. Machine types and instance selections with the same priority have the same preference. When `null`, the `rank` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `instance_selection_list` sub block.
+
+
 ## obj cluster_config.security_config
 
 
@@ -927,7 +985,8 @@ Terraform sub block.
   - `image_uri` (`string`): The URI for the image to use for this master/worker When `null`, the `image_uri` field will be omitted from the resulting object.
   - `machine_type` (`string`): The name of a Google Compute Engine machine type to create for the master/worker When `null`, the `machine_type` field will be omitted from the resulting object.
   - `min_cpu_platform` (`string`): The name of a minimum generation of CPU family for the master/worker. If not specified, GCP will default to a predetermined computed value for each zone. When `null`, the `min_cpu_platform` field will be omitted from the resulting object.
-  - `num_instances` (`number`): Specifies the number of master/worker nodes to create. If not specified, GCP will default to a predetermined computed value. When `null`, the `num_instances` field will be omitted from the resulting object.
+  - `min_num_instances` (`number`): The minimum number of primary worker instances to create. When `null`, the `min_num_instances` field will be omitted from the resulting object.
+  - `num_instances` (`number`): Specifies the number of worker nodes to create. If not specified, GCP will default to a predetermined computed value. When `null`, the `num_instances` field will be omitted from the resulting object.
   - `accelerators` (`list[obj]`): The Compute Engine accelerator (GPU) configuration for these instances. Can be specified multiple times. When `null`, the `accelerators` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.worker_config.accelerators.new](#fn-cluster_configcluster_configacceleratorsnew) constructor.
   - `disk_config` (`list[obj]`): Disk Config When `null`, the `disk_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_cluster.cluster_config.worker_config.disk_config.new](#fn-cluster_configcluster_configdisk_confignew) constructor.
 
diff --git a/docs/4.x/dataproc_job.md b/docs/4.x/dataproc_job.md
index 5628996a..b403acca 100644
--- a/docs/4.x/dataproc_job.md
+++ b/docs/4.x/dataproc_job.md
@@ -106,7 +106,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `force_delete` (`bool`): By default, you can only delete inactive jobs within Dataproc. Setting this to true, and calling destroy, will ensure that the job is first cancelled before issuing the delete. When `null`, the `force_delete` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional. The labels to associate with this job. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. The labels to associate with this job.
+
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `project` (`string`): The project in which the cluster can be found and jobs subsequently run against. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The Cloud Dataproc region. This essentially determines which clusters are available for this job to be submitted to. If not specified, defaults to global. When `null`, the `region` field will be omitted from the resulting object.
   - `hadoop_config` (`list[obj]`): The config of Hadoop job When `null`, the `hadoop_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.hadoop_config.new](#fn-hadoop_confignew) constructor.
@@ -144,7 +147,10 @@ injecting into a complete block.
 
 **Args**:
   - `force_delete` (`bool`): By default, you can only delete inactive jobs within Dataproc. Setting this to true, and calling destroy, will ensure that the job is first cancelled before issuing the delete. When `null`, the `force_delete` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional. The labels to associate with this job. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. The labels to associate with this job.
+
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `project` (`string`): The project in which the cluster can be found and jobs subsequently run against. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The Cloud Dataproc region. This essentially determines which clusters are available for this job to be submitted to. If not specified, defaults to global. When `null`, the `region` field will be omitted from the resulting object.
   - `hadoop_config` (`list[obj]`): The config of Hadoop job When `null`, the `hadoop_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dataproc_job.hadoop_config.new](#fn-hadoop_confignew) constructor.
diff --git a/docs/4.x/dataproc_metastore_service.md b/docs/4.x/dataproc_metastore_service.md
index 90b54aec..cbf9618c 100644
--- a/docs/4.x/dataproc_metastore_service.md
+++ b/docs/4.x/dataproc_metastore_service.md
@@ -89,7 +89,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `database_type` (`string`): The database type that the Metastore service stores its data. Default value: "MYSQL" Possible values: ["MYSQL", "SPANNER"] When `null`, the `database_type` field will be omitted from the resulting object.
-  - `labels` (`obj`): User-defined labels for the metastore service. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels for the metastore service.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location where the metastore service should reside.
 The default value is 'global'. When `null`, the `location` field will be omitted from the resulting object.
   - `network` (`string`): The relative resource name of the VPC network on which the instance can be accessed. It is specified in the following form:
@@ -136,7 +139,10 @@ injecting into a complete block.
 
 **Args**:
   - `database_type` (`string`): The database type that the Metastore service stores its data. Default value: "MYSQL" Possible values: ["MYSQL", "SPANNER"] When `null`, the `database_type` field will be omitted from the resulting object.
-  - `labels` (`obj`): User-defined labels for the metastore service. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels for the metastore service.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location where the metastore service should reside.
 The default value is 'global'. When `null`, the `location` field will be omitted from the resulting object.
   - `network` (`string`): The relative resource name of the VPC network on which the instance can be accessed. It is specified in the following form:
diff --git a/docs/4.x/dataproc_workflow_template.md b/docs/4.x/dataproc_workflow_template.md
index e274141f..a1e65440 100644
--- a/docs/4.x/dataproc_workflow_template.md
+++ b/docs/4.x/dataproc_workflow_template.md
@@ -162,7 +162,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `dag_timeout` (`string`): Optional. Timeout duration for the DAG of jobs, expressed in seconds (see [JSON representation of duration](https://developers.google.com/protocol-buffers/docs/proto3#json)). The timeout duration must be from 10 minutes ("600s") to 24 hours ("86400s"). The timer begins when the first job is submitted. If the workflow is running at the end of the timeout period, any remaining jobs are cancelled, the workflow is ended, and if the workflow was running on a [managed cluster](/dataproc/docs/concepts/workflows/using-workflows#configuring_or_selecting_a_cluster), the cluster is deleted. When `null`, the `dag_timeout` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional. The labels to associate with this template. These labels will be propagated to all jobs and clusters created by the workflow instance. Label **keys** must contain 1 to 63 characters, and must conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). Label **values** may be empty, but, if present, must contain 1 to 63 characters, and must conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). No more than 32 labels can be associated with a template. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. The labels to associate with this template. These labels will be propagated to all jobs and clusters created by the workflow instance. Label **keys** must contain 1 to 63 characters, and must conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). Label **values** may be empty, but, if present, must contain 1 to 63 characters, and must conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). No more than 32 labels can be associated with a template.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): Output only. The resource name of the workflow template, as described in https://cloud.google.com/apis/design/resource_names. * For `projects.regions.workflowTemplates`, the resource name of the template has the following format: `projects/{project_id}/regions/{region}/workflowTemplates/{template_id}` * For `projects.locations.workflowTemplates`, the resource name of the template has the following format: `projects/{project_id}/locations/{location}/workflowTemplates/{template_id}`
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
@@ -195,7 +198,10 @@ injecting into a complete block.
 
 **Args**:
   - `dag_timeout` (`string`): Optional. Timeout duration for the DAG of jobs, expressed in seconds (see [JSON representation of duration](https://developers.google.com/protocol-buffers/docs/proto3#json)). The timeout duration must be from 10 minutes ("600s") to 24 hours ("86400s"). The timer begins when the first job is submitted. If the workflow is running at the end of the timeout period, any remaining jobs are cancelled, the workflow is ended, and if the workflow was running on a [managed cluster](/dataproc/docs/concepts/workflows/using-workflows#configuring_or_selecting_a_cluster), the cluster is deleted. When `null`, the `dag_timeout` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional. The labels to associate with this template. These labels will be propagated to all jobs and clusters created by the workflow instance. Label **keys** must contain 1 to 63 characters, and must conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). Label **values** may be empty, but, if present, must contain 1 to 63 characters, and must conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). No more than 32 labels can be associated with a template. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. The labels to associate with this template. These labels will be propagated to all jobs and clusters created by the workflow instance. Label **keys** must contain 1 to 63 characters, and must conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). Label **values** may be empty, but, if present, must contain 1 to 63 characters, and must conform to [RFC 1035](https://www.ietf.org/rfc/rfc1035.txt). No more than 32 labels can be associated with a template.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): Output only. The resource name of the workflow template, as described in https://cloud.google.com/apis/design/resource_names. * For `projects.regions.workflowTemplates`, the resource name of the template has the following format: `projects/{project_id}/regions/{region}/workflowTemplates/{template_id}` * For `projects.locations.workflowTemplates`, the resource name of the template has the following format: `projects/{project_id}/locations/{location}/workflowTemplates/{template_id}`
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
diff --git a/docs/4.x/datastream_connection_profile.md b/docs/4.x/datastream_connection_profile.md
index edf355c2..0b6e106e 100644
--- a/docs/4.x/datastream_connection_profile.md
+++ b/docs/4.x/datastream_connection_profile.md
@@ -86,7 +86,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `connection_profile_id` (`string`): The connection profile identifier.
   - `display_name` (`string`): Display name.
-  - `labels` (`obj`): Labels. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The name of the location this connection profile is located in.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `bigquery_profile` (`list[obj]`): BigQuery warehouse profile. When `null`, the `bigquery_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.bigquery_profile.new](#fn-bigquery_profilenew) constructor.
@@ -122,7 +125,10 @@ injecting into a complete block.
 **Args**:
   - `connection_profile_id` (`string`): The connection profile identifier.
   - `display_name` (`string`): Display name.
-  - `labels` (`obj`): Labels. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The name of the location this connection profile is located in.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `bigquery_profile` (`list[obj]`): BigQuery warehouse profile. When `null`, the `bigquery_profile` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.datastream_connection_profile.bigquery_profile.new](#fn-bigquery_profilenew) constructor.
diff --git a/docs/4.x/datastream_private_connection.md b/docs/4.x/datastream_private_connection.md
index 43863635..b6100dcf 100644
--- a/docs/4.x/datastream_private_connection.md
+++ b/docs/4.x/datastream_private_connection.md
@@ -59,7 +59,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `display_name` (`string`): Display name.
-  - `labels` (`obj`): Labels. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The name of the location this private connection is located in.
   - `private_connection_id` (`string`): The private connectivity identifier.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
@@ -90,7 +93,10 @@ injecting into a complete block.
 
 **Args**:
   - `display_name` (`string`): Display name.
-  - `labels` (`obj`): Labels. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The name of the location this private connection is located in.
   - `private_connection_id` (`string`): The private connectivity identifier.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
diff --git a/docs/4.x/datastream_stream.md b/docs/4.x/datastream_stream.md
index 9704cf29..efced10f 100644
--- a/docs/4.x/datastream_stream.md
+++ b/docs/4.x/datastream_stream.md
@@ -172,7 +172,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 will be encrypted using an internal Stream-specific encryption key provisioned through KMS. When `null`, the `customer_managed_encryption_key` field will be omitted from the resulting object.
   - `desired_state` (`string`): Desired state of the Stream. Set this field to 'RUNNING' to start the stream, and 'PAUSED' to pause the stream. When `null`, the `desired_state` field will be omitted from the resulting object.
   - `display_name` (`string`): Display name.
-  - `labels` (`obj`): Labels. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The name of the location this stream is located in.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `stream_id` (`string`): The stream identifier.
@@ -208,7 +211,10 @@ injecting into a complete block.
 will be encrypted using an internal Stream-specific encryption key provisioned through KMS. When `null`, the `customer_managed_encryption_key` field will be omitted from the resulting object.
   - `desired_state` (`string`): Desired state of the Stream. Set this field to 'RUNNING' to start the stream, and 'PAUSED' to pause the stream. When `null`, the `desired_state` field will be omitted from the resulting object.
   - `display_name` (`string`): Display name.
-  - `labels` (`obj`): Labels. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The name of the location this stream is located in.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `stream_id` (`string`): The stream identifier.
diff --git a/docs/4.x/dialogflow_cx_agent.md b/docs/4.x/dialogflow_cx_agent.md
index d85c62d7..e0cc86db 100644
--- a/docs/4.x/dialogflow_cx_agent.md
+++ b/docs/4.x/dialogflow_cx_agent.md
@@ -15,23 +15,41 @@ This package contains functions and utilities for setting up the resource using
 
 * [`fn new()`](#fn-new)
 * [`fn newAttrs()`](#fn-newattrs)
+* [`fn withAdvancedSettings()`](#fn-withadvancedsettings)
+* [`fn withAdvancedSettingsMixin()`](#fn-withadvancedsettingsmixin)
 * [`fn withAvatarUri()`](#fn-withavataruri)
 * [`fn withDefaultLanguageCode()`](#fn-withdefaultlanguagecode)
 * [`fn withDescription()`](#fn-withdescription)
 * [`fn withDisplayName()`](#fn-withdisplayname)
 * [`fn withEnableSpellCorrection()`](#fn-withenablespellcorrection)
 * [`fn withEnableStackdriverLogging()`](#fn-withenablestackdriverlogging)
+* [`fn withGitIntegrationSettings()`](#fn-withgitintegrationsettings)
+* [`fn withGitIntegrationSettingsMixin()`](#fn-withgitintegrationsettingsmixin)
 * [`fn withLocation()`](#fn-withlocation)
 * [`fn withProject()`](#fn-withproject)
 * [`fn withSecuritySettings()`](#fn-withsecuritysettings)
 * [`fn withSpeechToTextSettings()`](#fn-withspeechtotextsettings)
 * [`fn withSpeechToTextSettingsMixin()`](#fn-withspeechtotextsettingsmixin)
 * [`fn withSupportedLanguageCodes()`](#fn-withsupportedlanguagecodes)
+* [`fn withTextToSpeechSettings()`](#fn-withtexttospeechsettings)
+* [`fn withTextToSpeechSettingsMixin()`](#fn-withtexttospeechsettingsmixin)
 * [`fn withTimeZone()`](#fn-withtimezone)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj advanced_settings`](#obj-advanced_settings)
+  * [`fn new()`](#fn-advanced_settingsnew)
+  * [`obj advanced_settings.audio_export_gcs_destination`](#obj-advanced_settingsaudio_export_gcs_destination)
+    * [`fn new()`](#fn-advanced_settingsaudio_export_gcs_destinationnew)
+  * [`obj advanced_settings.dtmf_settings`](#obj-advanced_settingsdtmf_settings)
+    * [`fn new()`](#fn-advanced_settingsdtmf_settingsnew)
+* [`obj git_integration_settings`](#obj-git_integration_settings)
+  * [`fn new()`](#fn-git_integration_settingsnew)
+  * [`obj git_integration_settings.github_settings`](#obj-git_integration_settingsgithub_settings)
+    * [`fn new()`](#fn-git_integration_settingsgithub_settingsnew)
 * [`obj speech_to_text_settings`](#obj-speech_to_text_settings)
   * [`fn new()`](#fn-speech_to_text_settingsnew)
+* [`obj text_to_speech_settings`](#obj-text_to_speech_settings)
+  * [`fn new()`](#fn-text_to_speech_settingsnew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 
@@ -81,7 +99,11 @@ for a list of the currently supported language codes. This field cannot be updat
   - `supported_language_codes` (`list`): The list of all languages supported by this agent (except for the default_language_code). When `null`, the `supported_language_codes` field will be omitted from the resulting object.
   - `time_zone` (`string`): The time zone of this agent from the [time zone database](https://www.iana.org/time-zones), e.g., America/New_York,
 Europe/Paris.
+  - `advanced_settings` (`list[obj]`): Hierarchical advanced settings for this agent. The settings exposed at the lower level overrides the settings exposed at the higher level.
+Hierarchy: Agent->Flow->Page->Fulfillment/Parameter. When `null`, the `advanced_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.advanced_settings.new](#fn-advanced_settingsnew) constructor.
+  - `git_integration_settings` (`list[obj]`): Git integration settings for this agent. When `null`, the `git_integration_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.git_integration_settings.new](#fn-git_integration_settingsnew) constructor.
   - `speech_to_text_settings` (`list[obj]`): Settings related to speech recognition. When `null`, the `speech_to_text_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.speech_to_text_settings.new](#fn-speech_to_text_settingsnew) constructor.
+  - `text_to_speech_settings` (`list[obj]`): Settings related to speech synthesizing. When `null`, the `text_to_speech_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.text_to_speech_settings.new](#fn-text_to_speech_settingsnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -123,13 +145,54 @@ for a list of the currently supported language codes. This field cannot be updat
   - `supported_language_codes` (`list`): The list of all languages supported by this agent (except for the default_language_code). When `null`, the `supported_language_codes` field will be omitted from the resulting object.
   - `time_zone` (`string`): The time zone of this agent from the [time zone database](https://www.iana.org/time-zones), e.g., America/New_York,
 Europe/Paris.
+  - `advanced_settings` (`list[obj]`): Hierarchical advanced settings for this agent. The settings exposed at the lower level overrides the settings exposed at the higher level.
+Hierarchy: Agent->Flow->Page->Fulfillment/Parameter. When `null`, the `advanced_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.advanced_settings.new](#fn-advanced_settingsnew) constructor.
+  - `git_integration_settings` (`list[obj]`): Git integration settings for this agent. When `null`, the `git_integration_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.git_integration_settings.new](#fn-git_integration_settingsnew) constructor.
   - `speech_to_text_settings` (`list[obj]`): Settings related to speech recognition. When `null`, the `speech_to_text_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.speech_to_text_settings.new](#fn-speech_to_text_settingsnew) constructor.
+  - `text_to_speech_settings` (`list[obj]`): Settings related to speech synthesizing. When `null`, the `text_to_speech_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.text_to_speech_settings.new](#fn-text_to_speech_settingsnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
   - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dialogflow_cx_agent` resource into the root Terraform configuration.
 
 
+### fn withAdvancedSettings
+
+```ts
+withAdvancedSettings()
+```
+
+`google.list[obj].withAdvancedSettings` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the advanced_settings field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withAdvancedSettingsMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `advanced_settings` field.
+
+
+### fn withAdvancedSettingsMixin
+
+```ts
+withAdvancedSettingsMixin()
+```
+
+`google.list[obj].withAdvancedSettingsMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the advanced_settings field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withAdvancedSettings](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `advanced_settings` field.
+
+
 ### fn withAvatarUri
 
 ```ts
@@ -226,6 +289,43 @@ Terraform resource block to set or update the enable_stackdriver_logging field.
   - `value` (`bool`): The value to set for the `enable_stackdriver_logging` field.
 
 
+### fn withGitIntegrationSettings
+
+```ts
+withGitIntegrationSettings()
+```
+
+`google.list[obj].withGitIntegrationSettings` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the git_integration_settings field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withGitIntegrationSettingsMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `git_integration_settings` field.
+
+
+### fn withGitIntegrationSettingsMixin
+
+```ts
+withGitIntegrationSettingsMixin()
+```
+
+`google.list[obj].withGitIntegrationSettingsMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the git_integration_settings field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withGitIntegrationSettings](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `git_integration_settings` field.
+
+
 ### fn withLocation
 
 ```ts
@@ -327,6 +427,43 @@ Terraform resource block to set or update the supported_language_codes field.
   - `value` (`list`): The value to set for the `supported_language_codes` field.
 
 
+### fn withTextToSpeechSettings
+
+```ts
+withTextToSpeechSettings()
+```
+
+`google.list[obj].withTextToSpeechSettings` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the text_to_speech_settings field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withTextToSpeechSettingsMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `text_to_speech_settings` field.
+
+
+### fn withTextToSpeechSettingsMixin
+
+```ts
+withTextToSpeechSettingsMixin()
+```
+
+`google.list[obj].withTextToSpeechSettingsMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the text_to_speech_settings field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withTextToSpeechSettings](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `text_to_speech_settings` field.
+
+
 ### fn withTimeZone
 
 ```ts
@@ -379,6 +516,135 @@ function.
   - `value` (`obj`): The value to set for the `timeouts` field.
 
 
+## obj advanced_settings
+
+
+
+### fn advanced_settings.new
+
+```ts
+new()
+```
+
+
+`google.dialogflow_cx_agent.advanced_settings.new` constructs a new object with attributes and blocks configured for the `advanced_settings`
+Terraform sub block.
+
+
+
+**Args**:
+  - `audio_export_gcs_destination` (`list[obj]`): If present, incoming audio is exported by Dialogflow to the configured Google Cloud Storage destination. Exposed at the following levels:
+* Agent level
+* Flow level When `null`, the `audio_export_gcs_destination` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.advanced_settings.audio_export_gcs_destination.new](#fn-advanced_settingsaudio_export_gcs_destinationnew) constructor.
+  - `dtmf_settings` (`list[obj]`): Define behaviors for DTMF (dual tone multi frequency). DTMF settings does not override each other. DTMF settings set at different levels define DTMF detections running in parallel. Exposed at the following levels:
+* Agent level
+* Flow level
+* Page level
+* Parameter level When `null`, the `dtmf_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.advanced_settings.dtmf_settings.new](#fn-advanced_settingsdtmf_settingsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `advanced_settings` sub block.
+
+
+## obj advanced_settings.audio_export_gcs_destination
+
+
+
+### fn advanced_settings.audio_export_gcs_destination.new
+
+```ts
+new()
+```
+
+
+`google.dialogflow_cx_agent.advanced_settings.audio_export_gcs_destination.new` constructs a new object with attributes and blocks configured for the `audio_export_gcs_destination`
+Terraform sub block.
+
+
+
+**Args**:
+  - `uri` (`string`): The Google Cloud Storage URI for the exported objects. Whether a full object name, or just a prefix, its usage depends on the Dialogflow operation.
+Format: gs://bucket/object-name-or-prefix When `null`, the `uri` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `audio_export_gcs_destination` sub block.
+
+
+## obj advanced_settings.dtmf_settings
+
+
+
+### fn advanced_settings.dtmf_settings.new
+
+```ts
+new()
+```
+
+
+`google.dialogflow_cx_agent.advanced_settings.dtmf_settings.new` constructs a new object with attributes and blocks configured for the `dtmf_settings`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enabled` (`bool`): If true, incoming audio is processed for DTMF (dual tone multi frequency) events. For example, if the caller presses a button on their telephone keypad and DTMF processing is enabled, Dialogflow will detect the event (e.g. a "3" was pressed) in the incoming audio and pass the event to the bot to drive business logic (e.g. when 3 is pressed, return the account balance). When `null`, the `enabled` field will be omitted from the resulting object.
+  - `finish_digit` (`string`): The digit that terminates a DTMF digit sequence. When `null`, the `finish_digit` field will be omitted from the resulting object.
+  - `max_digits` (`number`): Max length of DTMF digits. When `null`, the `max_digits` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `dtmf_settings` sub block.
+
+
+## obj git_integration_settings
+
+
+
+### fn git_integration_settings.new
+
+```ts
+new()
+```
+
+
+`google.dialogflow_cx_agent.git_integration_settings.new` constructs a new object with attributes and blocks configured for the `git_integration_settings`
+Terraform sub block.
+
+
+
+**Args**:
+  - `github_settings` (`list[obj]`): Settings of integration with GitHub. When `null`, the `github_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_agent.git_integration_settings.github_settings.new](#fn-git_integration_settingsgithub_settingsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `git_integration_settings` sub block.
+
+
+## obj git_integration_settings.github_settings
+
+
+
+### fn git_integration_settings.github_settings.new
+
+```ts
+new()
+```
+
+
+`google.dialogflow_cx_agent.git_integration_settings.github_settings.new` constructs a new object with attributes and blocks configured for the `github_settings`
+Terraform sub block.
+
+
+
+**Args**:
+  - `access_token` (`string`): The access token used to authenticate the access to the GitHub repository. When `null`, the `access_token` field will be omitted from the resulting object.
+  - `branches` (`list`): A list of branches configured to be used from Dialogflow. When `null`, the `branches` field will be omitted from the resulting object.
+  - `display_name` (`string`): The unique repository display name for the GitHub repository. When `null`, the `display_name` field will be omitted from the resulting object.
+  - `repository_uri` (`string`): The GitHub repository URI related to the agent. When `null`, the `repository_uri` field will be omitted from the resulting object.
+  - `tracking_branch` (`string`): The branch of the GitHub repository tracked for this agent. When `null`, the `tracking_branch` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `github_settings` sub block.
+
+
 ## obj speech_to_text_settings
 
 
@@ -402,6 +668,32 @@ Terraform sub block.
   - An attribute object that represents the `speech_to_text_settings` sub block.
 
 
+## obj text_to_speech_settings
+
+
+
+### fn text_to_speech_settings.new
+
+```ts
+new()
+```
+
+
+`google.dialogflow_cx_agent.text_to_speech_settings.new` constructs a new object with attributes and blocks configured for the `text_to_speech_settings`
+Terraform sub block.
+
+
+
+**Args**:
+  - `synthesize_speech_configs` (`string`): Configuration of how speech should be synthesized, mapping from [language](https://cloud.google.com/dialogflow/cx/docs/reference/language) to [SynthesizeSpeechConfig](https://cloud.google.com/dialogflow/cx/docs/reference/rest/v3/projects.locations.agents#synthesizespeechconfig).
+These settings affect:
+* The phone gateway synthesize configuration set via Agent.text_to_speech_settings.
+* How speech is synthesized when invoking session APIs. 'Agent.text_to_speech_settings' only applies if 'OutputAudioConfig.synthesize_speech_config' is not specified. When `null`, the `synthesize_speech_configs` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `text_to_speech_settings` sub block.
+
+
 ## obj timeouts
 
 
diff --git a/docs/4.x/dialogflow_cx_flow.md b/docs/4.x/dialogflow_cx_flow.md
index 166f0907..b940a700 100644
--- a/docs/4.x/dialogflow_cx_flow.md
+++ b/docs/4.x/dialogflow_cx_flow.md
@@ -15,6 +15,8 @@ This package contains functions and utilities for setting up the resource using
 
 * [`fn new()`](#fn-new)
 * [`fn newAttrs()`](#fn-newattrs)
+* [`fn withAdvancedSettings()`](#fn-withadvancedsettings)
+* [`fn withAdvancedSettingsMixin()`](#fn-withadvancedsettingsmixin)
 * [`fn withDescription()`](#fn-withdescription)
 * [`fn withDisplayName()`](#fn-withdisplayname)
 * [`fn withEventHandlers()`](#fn-witheventhandlers)
@@ -28,6 +30,12 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withTransitionRouteGroups()`](#fn-withtransitionroutegroups)
 * [`fn withTransitionRoutes()`](#fn-withtransitionroutes)
 * [`fn withTransitionRoutesMixin()`](#fn-withtransitionroutesmixin)
+* [`obj advanced_settings`](#obj-advanced_settings)
+  * [`fn new()`](#fn-advanced_settingsnew)
+  * [`obj advanced_settings.audio_export_gcs_destination`](#obj-advanced_settingsaudio_export_gcs_destination)
+    * [`fn new()`](#fn-advanced_settingsaudio_export_gcs_destinationnew)
+  * [`obj advanced_settings.dtmf_settings`](#obj-advanced_settingsdtmf_settings)
+    * [`fn new()`](#fn-advanced_settingsdtmf_settingsnew)
 * [`obj event_handlers`](#obj-event_handlers)
   * [`fn new()`](#fn-event_handlersnew)
   * [`obj event_handlers.trigger_fulfillment`](#obj-event_handlerstrigger_fulfillment)
@@ -120,6 +128,8 @@ Format: projects/<Project ID>/locations/<Location ID>/agents/<Age
 They are responsible for matching the user's first utterances in the flow.
 They are inherited by every page's [transition route groups][Page.transition_route_groups]. Transition route groups defined in the page have higher priority than those defined in the flow.
 Format:projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/flows/<Flow ID>/transitionRouteGroups/<TransitionRouteGroup ID>. When `null`, the `transition_route_groups` field will be omitted from the resulting object.
+  - `advanced_settings` (`list[obj]`): Hierarchical advanced settings for this flow. The settings exposed at the lower level overrides the settings exposed at the higher level.
+Hierarchy: Agent->Flow->Page->Fulfillment/Parameter. When `null`, the `advanced_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.advanced_settings.new](#fn-advanced_settingsnew) constructor.
   - `event_handlers` (`list[obj]`): A flow's event handlers serve two purposes:
 They are responsible for handling events (e.g. no match, webhook errors) in the flow.
 They are inherited by every page's [event handlers][Page.event_handlers], which can be used to handle common events regardless of the current page. Event handlers defined in the page have higher priority than those defined in the flow.
@@ -171,6 +181,8 @@ Format: projects/<Project ID>/locations/<Location ID>/agents/<Age
 They are responsible for matching the user's first utterances in the flow.
 They are inherited by every page's [transition route groups][Page.transition_route_groups]. Transition route groups defined in the page have higher priority than those defined in the flow.
 Format:projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/flows/<Flow ID>/transitionRouteGroups/<TransitionRouteGroup ID>. When `null`, the `transition_route_groups` field will be omitted from the resulting object.
+  - `advanced_settings` (`list[obj]`): Hierarchical advanced settings for this flow. The settings exposed at the lower level overrides the settings exposed at the higher level.
+Hierarchy: Agent->Flow->Page->Fulfillment/Parameter. When `null`, the `advanced_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.advanced_settings.new](#fn-advanced_settingsnew) constructor.
   - `event_handlers` (`list[obj]`): A flow's event handlers serve two purposes:
 They are responsible for handling events (e.g. no match, webhook errors) in the flow.
 They are inherited by every page's [event handlers][Page.event_handlers], which can be used to handle common events regardless of the current page. Event handlers defined in the page have higher priority than those defined in the flow.
@@ -190,6 +202,43 @@ TransitionRoutes are evalauted in the following order:
   - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dialogflow_cx_flow` resource into the root Terraform configuration.
 
 
+### fn withAdvancedSettings
+
+```ts
+withAdvancedSettings()
+```
+
+`google.list[obj].withAdvancedSettings` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the advanced_settings field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withAdvancedSettingsMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `advanced_settings` field.
+
+
+### fn withAdvancedSettingsMixin
+
+```ts
+withAdvancedSettingsMixin()
+```
+
+`google.list[obj].withAdvancedSettingsMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the advanced_settings field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withAdvancedSettings](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `advanced_settings` field.
+
+
 ### fn withDescription
 
 ```ts
@@ -417,6 +466,85 @@ function.
   - `value` (`list[obj]`): The value to set for the `transition_routes` field.
 
 
+## obj advanced_settings
+
+
+
+### fn advanced_settings.new
+
+```ts
+new()
+```
+
+
+`google.dialogflow_cx_flow.advanced_settings.new` constructs a new object with attributes and blocks configured for the `advanced_settings`
+Terraform sub block.
+
+
+
+**Args**:
+  - `audio_export_gcs_destination` (`list[obj]`): If present, incoming audio is exported by Dialogflow to the configured Google Cloud Storage destination. Exposed at the following levels:
+* Agent level
+* Flow level When `null`, the `audio_export_gcs_destination` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.advanced_settings.audio_export_gcs_destination.new](#fn-advanced_settingsaudio_export_gcs_destinationnew) constructor.
+  - `dtmf_settings` (`list[obj]`): Define behaviors for DTMF (dual tone multi frequency). DTMF settings does not override each other. DTMF settings set at different levels define DTMF detections running in parallel. Exposed at the following levels:
+* Agent level
+* Flow level
+* Page level
+* Parameter level When `null`, the `dtmf_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_flow.advanced_settings.dtmf_settings.new](#fn-advanced_settingsdtmf_settingsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `advanced_settings` sub block.
+
+
+## obj advanced_settings.audio_export_gcs_destination
+
+
+
+### fn advanced_settings.audio_export_gcs_destination.new
+
+```ts
+new()
+```
+
+
+`google.dialogflow_cx_flow.advanced_settings.audio_export_gcs_destination.new` constructs a new object with attributes and blocks configured for the `audio_export_gcs_destination`
+Terraform sub block.
+
+
+
+**Args**:
+  - `uri` (`string`): The Google Cloud Storage URI for the exported objects. Whether a full object name, or just a prefix, its usage depends on the Dialogflow operation.
+Format: gs://bucket/object-name-or-prefix When `null`, the `uri` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `audio_export_gcs_destination` sub block.
+
+
+## obj advanced_settings.dtmf_settings
+
+
+
+### fn advanced_settings.dtmf_settings.new
+
+```ts
+new()
+```
+
+
+`google.dialogflow_cx_flow.advanced_settings.dtmf_settings.new` constructs a new object with attributes and blocks configured for the `dtmf_settings`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enabled` (`bool`): If true, incoming audio is processed for DTMF (dual tone multi frequency) events. For example, if the caller presses a button on their telephone keypad and DTMF processing is enabled, Dialogflow will detect the event (e.g. a "3" was pressed) in the incoming audio and pass the event to the bot to drive business logic (e.g. when 3 is pressed, return the account balance). When `null`, the `enabled` field will be omitted from the resulting object.
+  - `finish_digit` (`string`): The digit that terminates a DTMF digit sequence. When `null`, the `finish_digit` field will be omitted from the resulting object.
+  - `max_digits` (`number`): Max length of DTMF digits. When `null`, the `max_digits` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `dtmf_settings` sub block.
+
+
 ## obj event_handlers
 
 
diff --git a/docs/4.x/dialogflow_cx_intent.md b/docs/4.x/dialogflow_cx_intent.md
index 0c554f6b..050a59a7 100644
--- a/docs/4.x/dialogflow_cx_intent.md
+++ b/docs/4.x/dialogflow_cx_intent.md
@@ -72,7 +72,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 Adding training phrases to fallback intent is useful in the case of requests that are mistakenly matched, since training phrases assigned to fallback intents act as negative examples that triggers no-match event. When `null`, the `is_fallback` field will be omitted from the resulting object.
   - `labels` (`obj`): The key/value metadata to label an intent. Labels can contain lowercase letters, digits and the symbols '-' and '_'. International characters are allowed, including letters from unicase alphabets. Keys must start with a letter. Keys and values can be no longer than 63 characters and no more than 128 bytes.
 Prefix "sys-" is reserved for Dialogflow defined labels. Currently allowed Dialogflow defined labels include: * sys-head * sys-contextual The above labels do not require value. "sys-head" means the intent is a head intent. "sys.contextual" means the intent is a contextual intent.
-An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `language_code` (`string`): The language of the following fields in intent:
 Intent.training_phrases.parts.text
 If not specified, the agent's default language is used. Many languages are supported. Note: languages must be enabled in the agent before they can be used. When `null`, the `language_code` field will be omitted from the resulting object.
@@ -113,7 +117,11 @@ injecting into a complete block.
 Adding training phrases to fallback intent is useful in the case of requests that are mistakenly matched, since training phrases assigned to fallback intents act as negative examples that triggers no-match event. When `null`, the `is_fallback` field will be omitted from the resulting object.
   - `labels` (`obj`): The key/value metadata to label an intent. Labels can contain lowercase letters, digits and the symbols '-' and '_'. International characters are allowed, including letters from unicase alphabets. Keys must start with a letter. Keys and values can be no longer than 63 characters and no more than 128 bytes.
 Prefix "sys-" is reserved for Dialogflow defined labels. Currently allowed Dialogflow defined labels include: * sys-head * sys-contextual The above labels do not require value. "sys-head" means the intent is a head intent. "sys.contextual" means the intent is a contextual intent.
-An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `language_code` (`string`): The language of the following fields in intent:
 Intent.training_phrases.parts.text
 If not specified, the agent's default language is used. Many languages are supported. Note: languages must be enabled in the agent before they can be used. When `null`, the `language_code` field will be omitted from the resulting object.
diff --git a/docs/4.x/dialogflow_cx_page.md b/docs/4.x/dialogflow_cx_page.md
index 72a555cd..f4619676 100644
--- a/docs/4.x/dialogflow_cx_page.md
+++ b/docs/4.x/dialogflow_cx_page.md
@@ -15,6 +15,8 @@ This package contains functions and utilities for setting up the resource using
 
 * [`fn new()`](#fn-new)
 * [`fn newAttrs()`](#fn-newattrs)
+* [`fn withAdvancedSettings()`](#fn-withadvancedsettings)
+* [`fn withAdvancedSettingsMixin()`](#fn-withadvancedsettingsmixin)
 * [`fn withDisplayName()`](#fn-withdisplayname)
 * [`fn withEntryFulfillment()`](#fn-withentryfulfillment)
 * [`fn withEntryFulfillmentMixin()`](#fn-withentryfulfillmentmixin)
@@ -29,6 +31,10 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withTransitionRouteGroups()`](#fn-withtransitionroutegroups)
 * [`fn withTransitionRoutes()`](#fn-withtransitionroutes)
 * [`fn withTransitionRoutesMixin()`](#fn-withtransitionroutesmixin)
+* [`obj advanced_settings`](#obj-advanced_settings)
+  * [`fn new()`](#fn-advanced_settingsnew)
+  * [`obj advanced_settings.dtmf_settings`](#obj-advanced_settingsdtmf_settings)
+    * [`fn new()`](#fn-advanced_settingsdtmf_settingsnew)
 * [`obj entry_fulfillment`](#obj-entry_fulfillment)
   * [`fn new()`](#fn-entry_fulfillmentnew)
   * [`obj entry_fulfillment.conditional_cases`](#obj-entry_fulfillmentconditional_cases)
@@ -75,6 +81,10 @@ This package contains functions and utilities for setting up the resource using
   * [`fn new()`](#fn-formnew)
   * [`obj form.parameters`](#obj-formparameters)
     * [`fn new()`](#fn-formparametersnew)
+    * [`obj form.parameters.advanced_settings`](#obj-formparametersadvanced_settings)
+      * [`fn new()`](#fn-formparametersadvanced_settingsnew)
+      * [`obj form.parameters.advanced_settings.dtmf_settings`](#obj-formparametersadvanced_settingsdtmf_settings)
+        * [`fn new()`](#fn-formparametersadvanced_settingsdtmf_settingsnew)
     * [`obj form.parameters.fill_behavior`](#obj-formparametersfill_behavior)
       * [`fn new()`](#fn-formparametersfill_behaviornew)
       * [`obj form.parameters.fill_behavior.initial_prompt_fulfillment`](#obj-formparametersfill_behaviorinitial_prompt_fulfillment)
@@ -193,6 +203,8 @@ Format: projects/<Project ID>/locations/<Location ID>/agents/<Age
 If multiple transition routes within a page scope refer to the same intent, then the precedence order is: page's transition route -> page's transition route group -> flow's transition routes.
 If multiple transition route groups within a page contain the same intent, then the first group in the ordered list takes precedence.
 Format:projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/flows/<Flow ID>/transitionRouteGroups/<TransitionRouteGroup ID>. When `null`, the `transition_route_groups` field will be omitted from the resulting object.
+  - `advanced_settings` (`list[obj]`): Hierarchical advanced settings for this page. The settings exposed at the lower level overrides the settings exposed at the higher level.
+Hierarchy: Agent->Flow->Page->Fulfillment/Parameter. When `null`, the `advanced_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.advanced_settings.new](#fn-advanced_settingsnew) constructor.
   - `entry_fulfillment` (`list[obj]`): The fulfillment to call when the session is entering the page. When `null`, the `entry_fulfillment` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.entry_fulfillment.new](#fn-entry_fulfillmentnew) constructor.
   - `event_handlers` (`list[obj]`): Handlers associated with the page to handle events such as webhook errors, no match or no input. When `null`, the `event_handlers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.event_handlers.new](#fn-event_handlersnew) constructor.
   - `form` (`list[obj]`): The form associated with the page, used for collecting parameters relevant to the page. When `null`, the `form` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.form.new](#fn-formnew) constructor.
@@ -248,6 +260,8 @@ Format: projects/<Project ID>/locations/<Location ID>/agents/<Age
 If multiple transition routes within a page scope refer to the same intent, then the precedence order is: page's transition route -> page's transition route group -> flow's transition routes.
 If multiple transition route groups within a page contain the same intent, then the first group in the ordered list takes precedence.
 Format:projects/<Project ID>/locations/<Location ID>/agents/<Agent ID>/flows/<Flow ID>/transitionRouteGroups/<TransitionRouteGroup ID>. When `null`, the `transition_route_groups` field will be omitted from the resulting object.
+  - `advanced_settings` (`list[obj]`): Hierarchical advanced settings for this page. The settings exposed at the lower level overrides the settings exposed at the higher level.
+Hierarchy: Agent->Flow->Page->Fulfillment/Parameter. When `null`, the `advanced_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.advanced_settings.new](#fn-advanced_settingsnew) constructor.
   - `entry_fulfillment` (`list[obj]`): The fulfillment to call when the session is entering the page. When `null`, the `entry_fulfillment` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.entry_fulfillment.new](#fn-entry_fulfillmentnew) constructor.
   - `event_handlers` (`list[obj]`): Handlers associated with the page to handle events such as webhook errors, no match or no input. When `null`, the `event_handlers` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.event_handlers.new](#fn-event_handlersnew) constructor.
   - `form` (`list[obj]`): The form associated with the page, used for collecting parameters relevant to the page. When `null`, the `form` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.form.new](#fn-formnew) constructor.
@@ -265,6 +279,43 @@ TransitionRoutes defined in the transition route groups with only condition spec
   - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `dialogflow_cx_page` resource into the root Terraform configuration.
 
 
+### fn withAdvancedSettings
+
+```ts
+withAdvancedSettings()
+```
+
+`google.list[obj].withAdvancedSettings` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the advanced_settings field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withAdvancedSettingsMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `advanced_settings` field.
+
+
+### fn withAdvancedSettingsMixin
+
+```ts
+withAdvancedSettingsMixin()
+```
+
+`google.list[obj].withAdvancedSettingsMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the advanced_settings field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withAdvancedSettings](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `advanced_settings` field.
+
+
 ### fn withDisplayName
 
 ```ts
@@ -513,6 +564,58 @@ function.
   - `value` (`list[obj]`): The value to set for the `transition_routes` field.
 
 
+## obj advanced_settings
+
+
+
+### fn advanced_settings.new
+
+```ts
+new()
+```
+
+
+`google.dialogflow_cx_page.advanced_settings.new` constructs a new object with attributes and blocks configured for the `advanced_settings`
+Terraform sub block.
+
+
+
+**Args**:
+  - `dtmf_settings` (`list[obj]`): Define behaviors for DTMF (dual tone multi frequency). DTMF settings does not override each other. DTMF settings set at different levels define DTMF detections running in parallel. Exposed at the following levels:
+* Agent level
+* Flow level
+* Page level
+* Parameter level When `null`, the `dtmf_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.advanced_settings.dtmf_settings.new](#fn-advanced_settingsdtmf_settingsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `advanced_settings` sub block.
+
+
+## obj advanced_settings.dtmf_settings
+
+
+
+### fn advanced_settings.dtmf_settings.new
+
+```ts
+new()
+```
+
+
+`google.dialogflow_cx_page.advanced_settings.dtmf_settings.new` constructs a new object with attributes and blocks configured for the `dtmf_settings`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enabled` (`bool`): If true, incoming audio is processed for DTMF (dual tone multi frequency) events. For example, if the caller presses a button on their telephone keypad and DTMF processing is enabled, Dialogflow will detect the event (e.g. a "3" was pressed) in the incoming audio and pass the event to the bot to drive business logic (e.g. when 3 is pressed, return the account balance). When `null`, the `enabled` field will be omitted from the resulting object.
+  - `finish_digit` (`string`): The digit that terminates a DTMF digit sequence. When `null`, the `finish_digit` field will be omitted from the resulting object.
+  - `max_digits` (`number`): Max length of DTMF digits. When `null`, the `max_digits` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `dtmf_settings` sub block.
+
+
 ## obj entry_fulfillment
 
 
@@ -1096,12 +1199,66 @@ Format: projects/-/locations/-/agents/-/entityTypes/<System Entity Type ID&gt
 If redaction is enabled, the parameter content will be replaced by parameter name during logging. Note: the parameter content is subject to redaction if either parameter level redaction or entity type level redaction is enabled. When `null`, the `redact` field will be omitted from the resulting object.
   - `required` (`bool`): Indicates whether the parameter is required. Optional parameters will not trigger prompts; however, they are filled if the user specifies them.
 Required parameters must be filled before form filling concludes. When `null`, the `required` field will be omitted from the resulting object.
+  - `advanced_settings` (`list[obj]`): Hierarchical advanced settings for this parameter. The settings exposed at the lower level overrides the settings exposed at the higher level.
+Hierarchy: Agent->Flow->Page->Fulfillment/Parameter. When `null`, the `advanced_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.form.parameters.advanced_settings.new](#fn-formformadvanced_settingsnew) constructor.
   - `fill_behavior` (`list[obj]`): Defines fill behavior for the parameter. When `null`, the `fill_behavior` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.form.parameters.fill_behavior.new](#fn-formformfill_behaviornew) constructor.
 
 **Returns**:
   - An attribute object that represents the `parameters` sub block.
 
 
+## obj form.parameters.advanced_settings
+
+
+
+### fn form.parameters.advanced_settings.new
+
+```ts
+new()
+```
+
+
+`google.dialogflow_cx_page.form.parameters.advanced_settings.new` constructs a new object with attributes and blocks configured for the `advanced_settings`
+Terraform sub block.
+
+
+
+**Args**:
+  - `dtmf_settings` (`list[obj]`): Define behaviors for DTMF (dual tone multi frequency). DTMF settings does not override each other. DTMF settings set at different levels define DTMF detections running in parallel. Exposed at the following levels:
+* Agent level
+* Flow level
+* Page level
+* Parameter level When `null`, the `dtmf_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.dialogflow_cx_page.form.parameters.advanced_settings.dtmf_settings.new](#fn-formformparametersdtmf_settingsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `advanced_settings` sub block.
+
+
+## obj form.parameters.advanced_settings.dtmf_settings
+
+
+
+### fn form.parameters.advanced_settings.dtmf_settings.new
+
+```ts
+new()
+```
+
+
+`google.dialogflow_cx_page.form.parameters.advanced_settings.dtmf_settings.new` constructs a new object with attributes and blocks configured for the `dtmf_settings`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enabled` (`bool`): If true, incoming audio is processed for DTMF (dual tone multi frequency) events. For example, if the caller presses a button on their telephone keypad and DTMF processing is enabled, Dialogflow will detect the event (e.g. a "3" was pressed) in the incoming audio and pass the event to the bot to drive business logic (e.g. when 3 is pressed, return the account balance). When `null`, the `enabled` field will be omitted from the resulting object.
+  - `finish_digit` (`string`): The digit that terminates a DTMF digit sequence. When `null`, the `finish_digit` field will be omitted from the resulting object.
+  - `max_digits` (`number`): Max length of DTMF digits. When `null`, the `max_digits` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `dtmf_settings` sub block.
+
+
 ## obj form.parameters.fill_behavior
 
 
diff --git a/docs/4.x/dns_managed_zone.md b/docs/4.x/dns_managed_zone.md
index 587d3d6a..bec72cc8 100644
--- a/docs/4.x/dns_managed_zone.md
+++ b/docs/4.x/dns_managed_zone.md
@@ -89,7 +89,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `description` (`string`): A textual description field. Defaults to 'Managed by Terraform'. When `null`, the `description` field will be omitted from the resulting object.
   - `dns_name` (`string`): The DNS name of this managed zone, for instance "example.com.".
   - `force_destroy` (`bool`): Set this true to delete all records in the zone. When `null`, the `force_destroy` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to this ManagedZone. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to this ManagedZone.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): User assigned name for this resource.
 Must be unique within the project.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
@@ -131,7 +135,11 @@ injecting into a complete block.
   - `description` (`string`): A textual description field. Defaults to 'Managed by Terraform'. When `null`, the `description` field will be omitted from the resulting object.
   - `dns_name` (`string`): The DNS name of this managed zone, for instance "example.com.".
   - `force_destroy` (`bool`): Set this true to delete all records in the zone. When `null`, the `force_destroy` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to this ManagedZone. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to this ManagedZone.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): User assigned name for this resource.
 Must be unique within the project.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
diff --git a/docs/4.x/edgecontainer_cluster.md b/docs/4.x/edgecontainer_cluster.md
new file mode 100644
index 00000000..baaf4b83
--- /dev/null
+++ b/docs/4.x/edgecontainer_cluster.md
@@ -0,0 +1,990 @@
+---
+permalink: /edgecontainer_cluster/
+---
+
+# edgecontainer_cluster
+
+`edgecontainer_cluster` represents the `google_edgecontainer_cluster` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withAuthorization()`](#fn-withauthorization)
+* [`fn withAuthorizationMixin()`](#fn-withauthorizationmixin)
+* [`fn withControlPlane()`](#fn-withcontrolplane)
+* [`fn withControlPlaneEncryption()`](#fn-withcontrolplaneencryption)
+* [`fn withControlPlaneEncryptionMixin()`](#fn-withcontrolplaneencryptionmixin)
+* [`fn withControlPlaneMixin()`](#fn-withcontrolplanemixin)
+* [`fn withDefaultMaxPodsPerNode()`](#fn-withdefaultmaxpodspernode)
+* [`fn withExternalLoadBalancerIpv4AddressPools()`](#fn-withexternalloadbalanceripv4addresspools)
+* [`fn withFleet()`](#fn-withfleet)
+* [`fn withFleetMixin()`](#fn-withfleetmixin)
+* [`fn withLabels()`](#fn-withlabels)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withMaintenancePolicy()`](#fn-withmaintenancepolicy)
+* [`fn withMaintenancePolicyMixin()`](#fn-withmaintenancepolicymixin)
+* [`fn withName()`](#fn-withname)
+* [`fn withNetworking()`](#fn-withnetworking)
+* [`fn withNetworkingMixin()`](#fn-withnetworkingmixin)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withReleaseChannel()`](#fn-withreleasechannel)
+* [`fn withSystemAddonsConfig()`](#fn-withsystemaddonsconfig)
+* [`fn withSystemAddonsConfigMixin()`](#fn-withsystemaddonsconfigmixin)
+* [`fn withTargetVersion()`](#fn-withtargetversion)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj authorization`](#obj-authorization)
+  * [`fn new()`](#fn-authorizationnew)
+  * [`obj authorization.admin_users`](#obj-authorizationadmin_users)
+    * [`fn new()`](#fn-authorizationadmin_usersnew)
+* [`obj control_plane`](#obj-control_plane)
+  * [`fn new()`](#fn-control_planenew)
+  * [`obj control_plane.local`](#obj-control_planelocal)
+    * [`fn new()`](#fn-control_planelocalnew)
+  * [`obj control_plane.remote`](#obj-control_planeremote)
+    * [`fn new()`](#fn-control_planeremotenew)
+* [`obj control_plane_encryption`](#obj-control_plane_encryption)
+  * [`fn new()`](#fn-control_plane_encryptionnew)
+* [`obj fleet`](#obj-fleet)
+  * [`fn new()`](#fn-fleetnew)
+* [`obj maintenance_policy`](#obj-maintenance_policy)
+  * [`fn new()`](#fn-maintenance_policynew)
+  * [`obj maintenance_policy.window`](#obj-maintenance_policywindow)
+    * [`fn new()`](#fn-maintenance_policywindownew)
+    * [`obj maintenance_policy.window.recurring_window`](#obj-maintenance_policywindowrecurring_window)
+      * [`fn new()`](#fn-maintenance_policywindowrecurring_windownew)
+      * [`obj maintenance_policy.window.recurring_window.window`](#obj-maintenance_policywindowrecurring_windowwindow)
+        * [`fn new()`](#fn-maintenance_policywindowrecurring_windowwindownew)
+* [`obj networking`](#obj-networking)
+  * [`fn new()`](#fn-networkingnew)
+* [`obj system_addons_config`](#obj-system_addons_config)
+  * [`fn new()`](#fn-system_addons_confignew)
+  * [`obj system_addons_config.ingress`](#obj-system_addons_configingress)
+    * [`fn new()`](#fn-system_addons_configingressnew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_cluster.new` injects a new `google_edgecontainer_cluster` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.edgecontainer_cluster.new('some_id')
+
+You can get the reference to the `id` field of the created `google.edgecontainer_cluster` using the reference:
+
+    $._ref.google_edgecontainer_cluster.some_id.get('id')
+
+This is the same as directly entering `"${ google_edgecontainer_cluster.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `default_max_pods_per_node` (`number`): The default maximum number of pods per node used if a maximum value is not
+specified explicitly for a node pool in this cluster. If unspecified, the
+Kubernetes default value will be used. When `null`, the `default_max_pods_per_node` field will be omitted from the resulting object.
+  - `external_load_balancer_ipv4_address_pools` (`list`): Address pools for cluster data plane external load balancing. When `null`, the `external_load_balancer_ipv4_address_pools` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels for the edgecloud cluster.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the resource.
+  - `name` (`string`): The GDCE cluster name.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `release_channel` (`string`): The release channel a cluster is subscribed to. Possible values: ["RELEASE_CHANNEL_UNSPECIFIED", "NONE", "REGULAR"] When `null`, the `release_channel` field will be omitted from the resulting object.
+  - `target_version` (`string`): The target cluster version. For example: "1.5.0". When `null`, the `target_version` field will be omitted from the resulting object.
+  - `authorization` (`list[obj]`): RBAC policy that will be applied and managed by GEC. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.authorization.new](#fn-authorizationnew) constructor.
+  - `control_plane` (`list[obj]`): The configuration of the cluster control plane. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.control_plane.new](#fn-control_planenew) constructor.
+  - `control_plane_encryption` (`list[obj]`): Remote control plane disk encryption options. This field is only used when
+enabling CMEK support. When `null`, the `control_plane_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.control_plane_encryption.new](#fn-control_plane_encryptionnew) constructor.
+  - `fleet` (`list[obj]`): Fleet related configuration.
+Fleets are a Google Cloud concept for logically organizing clusters,
+letting you use and manage multi-cluster capabilities and apply
+consistent policies across your systems. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.fleet.new](#fn-fleetnew) constructor.
+  - `maintenance_policy` (`list[obj]`): Cluster-wide maintenance policy configuration. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.maintenance_policy.new](#fn-maintenance_policynew) constructor.
+  - `networking` (`list[obj]`): Fleet related configuration.
+Fleets are a Google Cloud concept for logically organizing clusters,
+letting you use and manage multi-cluster capabilities and apply
+consistent policies across your systems. When `null`, the `networking` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.networking.new](#fn-networkingnew) constructor.
+  - `system_addons_config` (`list[obj]`): Config that customers are allowed to define for GDCE system add-ons. When `null`, the `system_addons_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.system_addons_config.new](#fn-system_addons_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.edgecontainer_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `edgecontainer_cluster`
+Terraform resource.
+
+Unlike [google.edgecontainer_cluster.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `default_max_pods_per_node` (`number`): The default maximum number of pods per node used if a maximum value is not
+specified explicitly for a node pool in this cluster. If unspecified, the
+Kubernetes default value will be used. When `null`, the `default_max_pods_per_node` field will be omitted from the resulting object.
+  - `external_load_balancer_ipv4_address_pools` (`list`): Address pools for cluster data plane external load balancing. When `null`, the `external_load_balancer_ipv4_address_pools` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels for the edgecloud cluster.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the resource.
+  - `name` (`string`): The GDCE cluster name.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `release_channel` (`string`): The release channel a cluster is subscribed to. Possible values: ["RELEASE_CHANNEL_UNSPECIFIED", "NONE", "REGULAR"] When `null`, the `release_channel` field will be omitted from the resulting object.
+  - `target_version` (`string`): The target cluster version. For example: "1.5.0". When `null`, the `target_version` field will be omitted from the resulting object.
+  - `authorization` (`list[obj]`): RBAC policy that will be applied and managed by GEC. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.authorization.new](#fn-authorizationnew) constructor.
+  - `control_plane` (`list[obj]`): The configuration of the cluster control plane. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.control_plane.new](#fn-control_planenew) constructor.
+  - `control_plane_encryption` (`list[obj]`): Remote control plane disk encryption options. This field is only used when
+enabling CMEK support. When `null`, the `control_plane_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.control_plane_encryption.new](#fn-control_plane_encryptionnew) constructor.
+  - `fleet` (`list[obj]`): Fleet related configuration.
+Fleets are a Google Cloud concept for logically organizing clusters,
+letting you use and manage multi-cluster capabilities and apply
+consistent policies across your systems. When `null`, the `fleet` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.fleet.new](#fn-fleetnew) constructor.
+  - `maintenance_policy` (`list[obj]`): Cluster-wide maintenance policy configuration. When `null`, the `maintenance_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.maintenance_policy.new](#fn-maintenance_policynew) constructor.
+  - `networking` (`list[obj]`): Fleet related configuration.
+Fleets are a Google Cloud concept for logically organizing clusters,
+letting you use and manage multi-cluster capabilities and apply
+consistent policies across your systems. When `null`, the `networking` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.networking.new](#fn-networkingnew) constructor.
+  - `system_addons_config` (`list[obj]`): Config that customers are allowed to define for GDCE system add-ons. When `null`, the `system_addons_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.system_addons_config.new](#fn-system_addons_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `edgecontainer_cluster` resource into the root Terraform configuration.
+
+
+### fn withAuthorization
+
+```ts
+withAuthorization()
+```
+
+`google.list[obj].withAuthorization` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the authorization field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withAuthorizationMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `authorization` field.
+
+
+### fn withAuthorizationMixin
+
+```ts
+withAuthorizationMixin()
+```
+
+`google.list[obj].withAuthorizationMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the authorization field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withAuthorization](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `authorization` field.
+
+
+### fn withControlPlane
+
+```ts
+withControlPlane()
+```
+
+`google.list[obj].withControlPlane` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the control_plane field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withControlPlaneMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `control_plane` field.
+
+
+### fn withControlPlaneEncryption
+
+```ts
+withControlPlaneEncryption()
+```
+
+`google.list[obj].withControlPlaneEncryption` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the control_plane_encryption field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withControlPlaneEncryptionMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `control_plane_encryption` field.
+
+
+### fn withControlPlaneEncryptionMixin
+
+```ts
+withControlPlaneEncryptionMixin()
+```
+
+`google.list[obj].withControlPlaneEncryptionMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the control_plane_encryption field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withControlPlaneEncryption](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `control_plane_encryption` field.
+
+
+### fn withControlPlaneMixin
+
+```ts
+withControlPlaneMixin()
+```
+
+`google.list[obj].withControlPlaneMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the control_plane field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withControlPlane](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `control_plane` field.
+
+
+### fn withDefaultMaxPodsPerNode
+
+```ts
+withDefaultMaxPodsPerNode()
+```
+
+`google.number.withDefaultMaxPodsPerNode` constructs a mixin object that can be merged into the `number`
+Terraform resource block to set or update the default_max_pods_per_node field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`number`): The value to set for the `default_max_pods_per_node` field.
+
+
+### fn withExternalLoadBalancerIpv4AddressPools
+
+```ts
+withExternalLoadBalancerIpv4AddressPools()
+```
+
+`google.list.withExternalLoadBalancerIpv4AddressPools` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the external_load_balancer_ipv4_address_pools field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `external_load_balancer_ipv4_address_pools` field.
+
+
+### fn withFleet
+
+```ts
+withFleet()
+```
+
+`google.list[obj].withFleet` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the fleet field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withFleetMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `fleet` field.
+
+
+### fn withFleetMixin
+
+```ts
+withFleetMixin()
+```
+
+`google.list[obj].withFleetMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the fleet field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withFleet](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `fleet` field.
+
+
+### fn withLabels
+
+```ts
+withLabels()
+```
+
+`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the labels field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `labels` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withMaintenancePolicy
+
+```ts
+withMaintenancePolicy()
+```
+
+`google.list[obj].withMaintenancePolicy` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the maintenance_policy field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withMaintenancePolicyMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `maintenance_policy` field.
+
+
+### fn withMaintenancePolicyMixin
+
+```ts
+withMaintenancePolicyMixin()
+```
+
+`google.list[obj].withMaintenancePolicyMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the maintenance_policy field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withMaintenancePolicy](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `maintenance_policy` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withNetworking
+
+```ts
+withNetworking()
+```
+
+`google.list[obj].withNetworking` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the networking field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withNetworkingMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `networking` field.
+
+
+### fn withNetworkingMixin
+
+```ts
+withNetworkingMixin()
+```
+
+`google.list[obj].withNetworkingMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the networking field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withNetworking](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `networking` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withReleaseChannel
+
+```ts
+withReleaseChannel()
+```
+
+`google.string.withReleaseChannel` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the release_channel field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `release_channel` field.
+
+
+### fn withSystemAddonsConfig
+
+```ts
+withSystemAddonsConfig()
+```
+
+`google.list[obj].withSystemAddonsConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the system_addons_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withSystemAddonsConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `system_addons_config` field.
+
+
+### fn withSystemAddonsConfigMixin
+
+```ts
+withSystemAddonsConfigMixin()
+```
+
+`google.list[obj].withSystemAddonsConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the system_addons_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withSystemAddonsConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `system_addons_config` field.
+
+
+### fn withTargetVersion
+
+```ts
+withTargetVersion()
+```
+
+`google.string.withTargetVersion` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the target_version field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `target_version` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj authorization
+
+
+
+### fn authorization.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_cluster.authorization.new` constructs a new object with attributes and blocks configured for the `authorization`
+Terraform sub block.
+
+
+
+**Args**:
+  - `admin_users` (`list[obj]`): User that will be granted the cluster-admin role on the cluster, providing
+full access to the cluster. Currently, this is a singular field, but will
+be expanded to allow multiple admins in the future. When `null`, the `admin_users` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.authorization.admin_users.new](#fn-authorizationadmin_usersnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `authorization` sub block.
+
+
+## obj authorization.admin_users
+
+
+
+### fn authorization.admin_users.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_cluster.authorization.admin_users.new` constructs a new object with attributes and blocks configured for the `admin_users`
+Terraform sub block.
+
+
+
+**Args**:
+  - `username` (`string`): An active Google username.
+
+**Returns**:
+  - An attribute object that represents the `admin_users` sub block.
+
+
+## obj control_plane
+
+
+
+### fn control_plane.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_cluster.control_plane.new` constructs a new object with attributes and blocks configured for the `control_plane`
+Terraform sub block.
+
+
+
+**Args**:
+  - `local_` (`list[obj]`): Local control plane configuration. When `null`, the `local_` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.control_plane.local_.new](#fn-control_planelocal_new) constructor.
+  - `remote` (`list[obj]`): Remote control plane configuration. When `null`, the `remote` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.control_plane.remote.new](#fn-control_planeremotenew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `control_plane` sub block.
+
+
+## obj control_plane.local
+
+
+
+### fn control_plane.local.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_cluster.control_plane.local.new` constructs a new object with attributes and blocks configured for the `local`
+Terraform sub block.
+
+
+
+**Args**:
+  - `machine_filter` (`string`): Only machines matching this filter will be allowed to host control
+plane nodes. The filtering language accepts strings like "name=<name>",
+and is documented here: [AIP-160](https://google.aip.dev/160). When `null`, the `machine_filter` field will be omitted from the resulting object.
+  - `node_count` (`number`): The number of nodes to serve as replicas of the Control Plane.
+Only 1 and 3 are supported. When `null`, the `node_count` field will be omitted from the resulting object.
+  - `node_location` (`string`): Name of the Google Distributed Cloud Edge zones where this node pool
+will be created. For example: 'us-central1-edge-customer-a'. When `null`, the `node_location` field will be omitted from the resulting object.
+  - `shared_deployment_policy` (`string`): Policy configuration about how user applications are deployed. Possible values: ["SHARED_DEPLOYMENT_POLICY_UNSPECIFIED", "ALLOWED", "DISALLOWED"] When `null`, the `shared_deployment_policy` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `local` sub block.
+
+
+## obj control_plane.remote
+
+
+
+### fn control_plane.remote.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_cluster.control_plane.remote.new` constructs a new object with attributes and blocks configured for the `remote`
+Terraform sub block.
+
+
+
+**Args**:
+  - `node_location` (`string`): Name of the Google Distributed Cloud Edge zones where this node pool
+will be created. For example: 'us-central1-edge-customer-a'. When `null`, the `node_location` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `remote` sub block.
+
+
+## obj control_plane_encryption
+
+
+
+### fn control_plane_encryption.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_cluster.control_plane_encryption.new` constructs a new object with attributes and blocks configured for the `control_plane_encryption`
+Terraform sub block.
+
+
+
+**Args**:
+  - `kms_key` (`string`): The Cloud KMS CryptoKey e.g.
+projects/{project}/locations/{location}/keyRings/{keyRing}/cryptoKeys/{cryptoKey}
+to use for protecting control plane disks. If not specified, a
+Google-managed key will be used instead. When `null`, the `kms_key` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `control_plane_encryption` sub block.
+
+
+## obj fleet
+
+
+
+### fn fleet.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_cluster.fleet.new` constructs a new object with attributes and blocks configured for the `fleet`
+Terraform sub block.
+
+
+
+**Args**:
+  - `project` (`string`): The name of the Fleet host project where this cluster will be registered.
+Project names are formatted as
+'projects/<project-number>'.
+
+**Returns**:
+  - An attribute object that represents the `fleet` sub block.
+
+
+## obj maintenance_policy
+
+
+
+### fn maintenance_policy.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_cluster.maintenance_policy.new` constructs a new object with attributes and blocks configured for the `maintenance_policy`
+Terraform sub block.
+
+
+
+**Args**:
+  - `window` (`list[obj]`): Specifies the maintenance window in which maintenance may be performed. When `null`, the `window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.maintenance_policy.window.new](#fn-maintenance_policywindownew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `maintenance_policy` sub block.
+
+
+## obj maintenance_policy.window
+
+
+
+### fn maintenance_policy.window.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_cluster.maintenance_policy.window.new` constructs a new object with attributes and blocks configured for the `window`
+Terraform sub block.
+
+
+
+**Args**:
+  - `recurring_window` (`list[obj]`): Represents an arbitrary window of time that recurs. When `null`, the `recurring_window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.maintenance_policy.window.recurring_window.new](#fn-maintenance_policymaintenance_policyrecurring_windownew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `window` sub block.
+
+
+## obj maintenance_policy.window.recurring_window
+
+
+
+### fn maintenance_policy.window.recurring_window.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_cluster.maintenance_policy.window.recurring_window.new` constructs a new object with attributes and blocks configured for the `recurring_window`
+Terraform sub block.
+
+
+
+**Args**:
+  - `recurrence` (`string`): An RRULE (https://tools.ietf.org/html/rfc5545#section-3.8.5.3) for how
+this window recurs. They go on for the span of time between the start and
+end time. When `null`, the `recurrence` field will be omitted from the resulting object.
+  - `window` (`list[obj]`): Represents an arbitrary window of time. When `null`, the `window` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.maintenance_policy.window.recurring_window.window.new](#fn-maintenance_policymaintenance_policywindowwindownew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `recurring_window` sub block.
+
+
+## obj maintenance_policy.window.recurring_window.window
+
+
+
+### fn maintenance_policy.window.recurring_window.window.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_cluster.maintenance_policy.window.recurring_window.window.new` constructs a new object with attributes and blocks configured for the `window`
+Terraform sub block.
+
+
+
+**Args**:
+  - `end_time` (`string`): The time that the window ends. The end time must take place after the
+start time. When `null`, the `end_time` field will be omitted from the resulting object.
+  - `start_time` (`string`): The time that the window first starts. When `null`, the `start_time` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `window` sub block.
+
+
+## obj networking
+
+
+
+### fn networking.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_cluster.networking.new` constructs a new object with attributes and blocks configured for the `networking`
+Terraform sub block.
+
+
+
+**Args**:
+  - `cluster_ipv4_cidr_blocks` (`list`): All pods in the cluster are assigned an RFC1918 IPv4 address from these
+blocks. Only a single block is supported. This field cannot be changed
+after creation.
+  - `cluster_ipv6_cidr_blocks` (`list`): If specified, dual stack mode is enabled and all pods in the cluster are
+assigned an IPv6 address from these blocks alongside from an IPv4
+address. Only a single block is supported. This field cannot be changed
+after creation. When `null`, the `cluster_ipv6_cidr_blocks` field will be omitted from the resulting object.
+  - `services_ipv4_cidr_blocks` (`list`): All services in the cluster are assigned an RFC1918 IPv4 address from these
+blocks. Only a single block is supported. This field cannot be changed
+after creation.
+  - `services_ipv6_cidr_blocks` (`list`): If specified, dual stack mode is enabled and all services in the cluster are
+assigned an IPv6 address from these blocks alongside from an IPv4
+address. Only a single block is supported. This field cannot be changed
+after creation. When `null`, the `services_ipv6_cidr_blocks` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `networking` sub block.
+
+
+## obj system_addons_config
+
+
+
+### fn system_addons_config.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_cluster.system_addons_config.new` constructs a new object with attributes and blocks configured for the `system_addons_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `ingress` (`list[obj]`): Config for the Ingress add-on which allows customers to create an Ingress
+object to manage external access to the servers in a cluster. The add-on
+consists of istiod and istio-ingress. When `null`, the `ingress` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_cluster.system_addons_config.ingress.new](#fn-system_addons_configingressnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `system_addons_config` sub block.
+
+
+## obj system_addons_config.ingress
+
+
+
+### fn system_addons_config.ingress.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_cluster.system_addons_config.ingress.new` constructs a new object with attributes and blocks configured for the `ingress`
+Terraform sub block.
+
+
+
+**Args**:
+  - `disabled` (`bool`): Whether Ingress is disabled. When `null`, the `disabled` field will be omitted from the resulting object.
+  - `ipv4_vip` (`string`): Ingress VIP. When `null`, the `ipv4_vip` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `ingress` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_cluster.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/edgecontainer_node_pool.md b/docs/4.x/edgecontainer_node_pool.md
new file mode 100644
index 00000000..aaa9116e
--- /dev/null
+++ b/docs/4.x/edgecontainer_node_pool.md
@@ -0,0 +1,435 @@
+---
+permalink: /edgecontainer_node_pool/
+---
+
+# edgecontainer_node_pool
+
+`edgecontainer_node_pool` represents the `google_edgecontainer_node_pool` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withCluster()`](#fn-withcluster)
+* [`fn withLabels()`](#fn-withlabels)
+* [`fn withLocalDiskEncryption()`](#fn-withlocaldiskencryption)
+* [`fn withLocalDiskEncryptionMixin()`](#fn-withlocaldiskencryptionmixin)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withMachineFilter()`](#fn-withmachinefilter)
+* [`fn withName()`](#fn-withname)
+* [`fn withNodeConfig()`](#fn-withnodeconfig)
+* [`fn withNodeConfigMixin()`](#fn-withnodeconfigmixin)
+* [`fn withNodeCount()`](#fn-withnodecount)
+* [`fn withNodeLocation()`](#fn-withnodelocation)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj local_disk_encryption`](#obj-local_disk_encryption)
+  * [`fn new()`](#fn-local_disk_encryptionnew)
+* [`obj node_config`](#obj-node_config)
+  * [`fn new()`](#fn-node_confignew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_node_pool.new` injects a new `google_edgecontainer_node_pool` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.edgecontainer_node_pool.new('some_id')
+
+You can get the reference to the `id` field of the created `google.edgecontainer_node_pool` using the reference:
+
+    $._ref.google_edgecontainer_node_pool.some_id.get('id')
+
+This is the same as directly entering `"${ google_edgecontainer_node_pool.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `cluster` (`string`): The name of the target Distributed Cloud Edge Cluster.
+  - `labels` (`obj`): Labels associated with this resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the resource.
+  - `machine_filter` (`string`): Only machines matching this filter will be allowed to join the node pool.
+The filtering language accepts strings like "name=<name>", and is
+documented in more detail in [AIP-160](https://google.aip.dev/160). When `null`, the `machine_filter` field will be omitted from the resulting object.
+  - `name` (`string`): The resource name of the node pool.
+  - `node_count` (`number`): The number of nodes in the pool.
+  - `node_location` (`string`): Name of the Google Distributed Cloud Edge zone where this node pool will be created. For example: 'us-central1-edge-customer-a'.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `local_disk_encryption` (`list[obj]`): Local disk encryption options. This field is only used when enabling CMEK support. When `null`, the `local_disk_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_node_pool.local_disk_encryption.new](#fn-local_disk_encryptionnew) constructor.
+  - `node_config` (`list[obj]`): Configuration for each node in the NodePool When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_node_pool.node_config.new](#fn-node_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_node_pool.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.edgecontainer_node_pool.newAttrs` constructs a new object with attributes and blocks configured for the `edgecontainer_node_pool`
+Terraform resource.
+
+Unlike [google.edgecontainer_node_pool.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `cluster` (`string`): The name of the target Distributed Cloud Edge Cluster.
+  - `labels` (`obj`): Labels associated with this resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the resource.
+  - `machine_filter` (`string`): Only machines matching this filter will be allowed to join the node pool.
+The filtering language accepts strings like "name=<name>", and is
+documented in more detail in [AIP-160](https://google.aip.dev/160). When `null`, the `machine_filter` field will be omitted from the resulting object.
+  - `name` (`string`): The resource name of the node pool.
+  - `node_count` (`number`): The number of nodes in the pool.
+  - `node_location` (`string`): Name of the Google Distributed Cloud Edge zone where this node pool will be created. For example: 'us-central1-edge-customer-a'.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `local_disk_encryption` (`list[obj]`): Local disk encryption options. This field is only used when enabling CMEK support. When `null`, the `local_disk_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_node_pool.local_disk_encryption.new](#fn-local_disk_encryptionnew) constructor.
+  - `node_config` (`list[obj]`): Configuration for each node in the NodePool When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_node_pool.node_config.new](#fn-node_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_node_pool.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `edgecontainer_node_pool` resource into the root Terraform configuration.
+
+
+### fn withCluster
+
+```ts
+withCluster()
+```
+
+`google.string.withCluster` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the cluster field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `cluster` field.
+
+
+### fn withLabels
+
+```ts
+withLabels()
+```
+
+`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the labels field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `labels` field.
+
+
+### fn withLocalDiskEncryption
+
+```ts
+withLocalDiskEncryption()
+```
+
+`google.list[obj].withLocalDiskEncryption` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the local_disk_encryption field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withLocalDiskEncryptionMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `local_disk_encryption` field.
+
+
+### fn withLocalDiskEncryptionMixin
+
+```ts
+withLocalDiskEncryptionMixin()
+```
+
+`google.list[obj].withLocalDiskEncryptionMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the local_disk_encryption field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withLocalDiskEncryption](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `local_disk_encryption` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withMachineFilter
+
+```ts
+withMachineFilter()
+```
+
+`google.string.withMachineFilter` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the machine_filter field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `machine_filter` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withNodeConfig
+
+```ts
+withNodeConfig()
+```
+
+`google.list[obj].withNodeConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the node_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withNodeConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `node_config` field.
+
+
+### fn withNodeConfigMixin
+
+```ts
+withNodeConfigMixin()
+```
+
+`google.list[obj].withNodeConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the node_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withNodeConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `node_config` field.
+
+
+### fn withNodeCount
+
+```ts
+withNodeCount()
+```
+
+`google.number.withNodeCount` constructs a mixin object that can be merged into the `number`
+Terraform resource block to set or update the node_count field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`number`): The value to set for the `node_count` field.
+
+
+### fn withNodeLocation
+
+```ts
+withNodeLocation()
+```
+
+`google.string.withNodeLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the node_location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `node_location` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj local_disk_encryption
+
+
+
+### fn local_disk_encryption.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_node_pool.local_disk_encryption.new` constructs a new object with attributes and blocks configured for the `local_disk_encryption`
+Terraform sub block.
+
+
+
+**Args**:
+  - `kms_key` (`string`): The Cloud KMS CryptoKey e.g. projects/{project}/locations/{location}/keyRings/{keyRing}/cryptoKeys/{cryptoKey} to use for protecting node local disks.
+If not specified, a Google-managed key will be used instead. When `null`, the `kms_key` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `local_disk_encryption` sub block.
+
+
+## obj node_config
+
+
+
+### fn node_config.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_node_pool.node_config.new` constructs a new object with attributes and blocks configured for the `node_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `labels` (`obj`): "The Kubernetes node labels" When `null`, the `labels` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `node_config` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_node_pool.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/edgecontainer_vpn_connection.md b/docs/4.x/edgecontainer_vpn_connection.md
new file mode 100644
index 00000000..3a9bdbd8
--- /dev/null
+++ b/docs/4.x/edgecontainer_vpn_connection.md
@@ -0,0 +1,385 @@
+---
+permalink: /edgecontainer_vpn_connection/
+---
+
+# edgecontainer_vpn_connection
+
+`edgecontainer_vpn_connection` represents the `google_edgecontainer_vpn_connection` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withCluster()`](#fn-withcluster)
+* [`fn withEnableHighAvailability()`](#fn-withenablehighavailability)
+* [`fn withLabels()`](#fn-withlabels)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withName()`](#fn-withname)
+* [`fn withNatGatewayIp()`](#fn-withnatgatewayip)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withRouter()`](#fn-withrouter)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withVpc()`](#fn-withvpc)
+* [`fn withVpcProject()`](#fn-withvpcproject)
+* [`fn withVpcProjectMixin()`](#fn-withvpcprojectmixin)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+* [`obj vpc_project`](#obj-vpc_project)
+  * [`fn new()`](#fn-vpc_projectnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_vpn_connection.new` injects a new `google_edgecontainer_vpn_connection` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.edgecontainer_vpn_connection.new('some_id')
+
+You can get the reference to the `id` field of the created `google.edgecontainer_vpn_connection` using the reference:
+
+    $._ref.google_edgecontainer_vpn_connection.some_id.get('id')
+
+This is the same as directly entering `"${ google_edgecontainer_vpn_connection.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `cluster` (`string`): The canonical Cluster name to connect to. It is in the form of projects/{project}/locations/{location}/clusters/{cluster}.
+  - `enable_high_availability` (`bool`): Whether this VPN connection has HA enabled on cluster side. If enabled, when creating VPN connection we will attempt to use 2 ANG floating IPs. When `null`, the `enable_high_availability` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels associated with this resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): Google Cloud Platform location.
+  - `name` (`string`): The resource name of VPN connection
+  - `nat_gateway_ip` (`string`): NAT gateway IP, or WAN IP address. If a customer has multiple NAT IPs, the customer needs to configure NAT such that only one external IP maps to the GMEC Anthos cluster.
+This is empty if NAT is not used. When `null`, the `nat_gateway_ip` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `router` (`string`): The VPN connection Cloud Router name. When `null`, the `router` field will be omitted from the resulting object.
+  - `vpc` (`string`): The network ID of VPC to connect to. When `null`, the `vpc` field will be omitted from the resulting object.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_vpn_connection.timeouts.new](#fn-timeoutsnew) constructor.
+  - `vpc_project` (`list[obj]`): Project detail of the VPC network. Required if VPC is in a different project than the cluster project. When `null`, the `vpc_project` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_vpn_connection.vpc_project.new](#fn-vpc_projectnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.edgecontainer_vpn_connection.newAttrs` constructs a new object with attributes and blocks configured for the `edgecontainer_vpn_connection`
+Terraform resource.
+
+Unlike [google.edgecontainer_vpn_connection.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `cluster` (`string`): The canonical Cluster name to connect to. It is in the form of projects/{project}/locations/{location}/clusters/{cluster}.
+  - `enable_high_availability` (`bool`): Whether this VPN connection has HA enabled on cluster side. If enabled, when creating VPN connection we will attempt to use 2 ANG floating IPs. When `null`, the `enable_high_availability` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels associated with this resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): Google Cloud Platform location.
+  - `name` (`string`): The resource name of VPN connection
+  - `nat_gateway_ip` (`string`): NAT gateway IP, or WAN IP address. If a customer has multiple NAT IPs, the customer needs to configure NAT such that only one external IP maps to the GMEC Anthos cluster.
+This is empty if NAT is not used. When `null`, the `nat_gateway_ip` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `router` (`string`): The VPN connection Cloud Router name. When `null`, the `router` field will be omitted from the resulting object.
+  - `vpc` (`string`): The network ID of VPC to connect to. When `null`, the `vpc` field will be omitted from the resulting object.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_vpn_connection.timeouts.new](#fn-timeoutsnew) constructor.
+  - `vpc_project` (`list[obj]`): Project detail of the VPC network. Required if VPC is in a different project than the cluster project. When `null`, the `vpc_project` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.edgecontainer_vpn_connection.vpc_project.new](#fn-vpc_projectnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `edgecontainer_vpn_connection` resource into the root Terraform configuration.
+
+
+### fn withCluster
+
+```ts
+withCluster()
+```
+
+`google.string.withCluster` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the cluster field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `cluster` field.
+
+
+### fn withEnableHighAvailability
+
+```ts
+withEnableHighAvailability()
+```
+
+`google.bool.withEnableHighAvailability` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the enable_high_availability field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `enable_high_availability` field.
+
+
+### fn withLabels
+
+```ts
+withLabels()
+```
+
+`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the labels field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `labels` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withNatGatewayIp
+
+```ts
+withNatGatewayIp()
+```
+
+`google.string.withNatGatewayIp` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the nat_gateway_ip field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `nat_gateway_ip` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withRouter
+
+```ts
+withRouter()
+```
+
+`google.string.withRouter` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the router field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `router` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withVpc
+
+```ts
+withVpc()
+```
+
+`google.string.withVpc` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the vpc field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `vpc` field.
+
+
+### fn withVpcProject
+
+```ts
+withVpcProject()
+```
+
+`google.list[obj].withVpcProject` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the vpc_project field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withVpcProjectMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `vpc_project` field.
+
+
+### fn withVpcProjectMixin
+
+```ts
+withVpcProjectMixin()
+```
+
+`google.list[obj].withVpcProjectMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the vpc_project field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withVpcProject](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `vpc_project` field.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_vpn_connection.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
+
+
+## obj vpc_project
+
+
+
+### fn vpc_project.new
+
+```ts
+new()
+```
+
+
+`google.edgecontainer_vpn_connection.vpc_project.new` constructs a new object with attributes and blocks configured for the `vpc_project`
+Terraform sub block.
+
+
+
+**Args**:
+  - `project_id` (`string`): The project of the VPC to connect to. If not specified, it is the same as the cluster project. When `null`, the `project_id` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `vpc_project` sub block.
diff --git a/docs/4.x/eventarc_trigger.md b/docs/4.x/eventarc_trigger.md
index d54593a1..b8165494 100644
--- a/docs/4.x/eventarc_trigger.md
+++ b/docs/4.x/eventarc_trigger.md
@@ -76,7 +76,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `channel` (`string`): Optional. The name of the channel associated with the trigger in `projects/{project}/locations/{location}/channels/{channel}` format. You must provide a channel to receive events from Eventarc SaaS partners. When `null`, the `channel` field will be omitted from the resulting object.
   - `event_data_content_type` (`string`): Optional. EventDataContentType specifies the type of payload in MIME format that is expected from the CloudEvent data field. This is set to `application/json` if the value is not defined. When `null`, the `event_data_content_type` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional. User labels attached to the triggers that can be used to group resources. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. User labels attached to the triggers that can be used to group resources.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): Required. The resource name of the trigger. Must be unique within the location on the project.
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
@@ -110,7 +113,10 @@ injecting into a complete block.
 **Args**:
   - `channel` (`string`): Optional. The name of the channel associated with the trigger in `projects/{project}/locations/{location}/channels/{channel}` format. You must provide a channel to receive events from Eventarc SaaS partners. When `null`, the `channel` field will be omitted from the resulting object.
   - `event_data_content_type` (`string`): Optional. EventDataContentType specifies the type of payload in MIME format that is expected from the CloudEvent data field. This is set to `application/json` if the value is not defined. When `null`, the `event_data_content_type` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional. User labels attached to the triggers that can be used to group resources. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. User labels attached to the triggers that can be used to group resources.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): Required. The resource name of the trigger. Must be unique within the location on the project.
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
diff --git a/docs/4.x/filestore_backup.md b/docs/4.x/filestore_backup.md
index 351392bf..0b203eee 100644
--- a/docs/4.x/filestore_backup.md
+++ b/docs/4.x/filestore_backup.md
@@ -57,7 +57,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): A description of the backup with 2048 characters or less. Requests with longer descriptions will be rejected. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user-provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances.
   - `name` (`string`): The resource name of the backup. The name must be unique within the specified instance.
 
@@ -95,7 +99,11 @@ injecting into a complete block.
 
 **Args**:
   - `description` (`string`): A description of the backup with 2048 characters or less. Requests with longer descriptions will be rejected. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user-provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances.
   - `name` (`string`): The resource name of the backup. The name must be unique within the specified instance.
 
diff --git a/docs/4.x/filestore_instance.md b/docs/4.x/filestore_instance.md
index 2eaf1a46..e59d0ff8 100644
--- a/docs/4.x/filestore_instance.md
+++ b/docs/4.x/filestore_instance.md
@@ -69,7 +69,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): A description of the instance. When `null`, the `description` field will be omitted from the resulting object.
   - `kms_key_name` (`string`): KMS key name used for data encryption. When `null`, the `kms_key_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user-provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances. When `null`, the `location` field will be omitted from the resulting object.
   - `name` (`string`): The resource name of the instance.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
@@ -106,7 +110,11 @@ injecting into a complete block.
 **Args**:
   - `description` (`string`): A description of the instance. When `null`, the `description` field will be omitted from the resulting object.
   - `kms_key_name` (`string`): KMS key name used for data encryption. When `null`, the `kms_key_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user-provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances. When `null`, the `location` field will be omitted from the resulting object.
   - `name` (`string`): The resource name of the instance.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
diff --git a/docs/4.x/filestore_snapshot.md b/docs/4.x/filestore_snapshot.md
index ebf4776f..fbc9eb8a 100644
--- a/docs/4.x/filestore_snapshot.md
+++ b/docs/4.x/filestore_snapshot.md
@@ -57,7 +57,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): A description of the snapshot with 2048 characters or less. Requests with longer descriptions will be rejected. When `null`, the `description` field will be omitted from the resulting object.
   - `instance` (`string`): The resource name of the filestore instance.
-  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user-provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances.
   - `name` (`string`): The resource name of the snapshot. The name must be unique within the specified instance.
 
@@ -94,7 +98,11 @@ injecting into a complete block.
 **Args**:
   - `description` (`string`): A description of the snapshot with 2048 characters or less. Requests with longer descriptions will be rejected. When `null`, the `description` field will be omitted from the resulting object.
   - `instance` (`string`): The resource name of the filestore instance.
-  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user-provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The name of the location of the instance. This can be a region for ENTERPRISE tier instances.
   - `name` (`string`): The resource name of the snapshot. The name must be unique within the specified instance.
 
diff --git a/docs/4.x/firebaserules_release.md b/docs/4.x/firebaserules_release.md
index 8d5d344a..2e7bedc3 100644
--- a/docs/4.x/firebaserules_release.md
+++ b/docs/4.x/firebaserules_release.md
@@ -191,7 +191,6 @@ Terraform sub block.
 **Args**:
   - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
   - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
-  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/firestore_backup_schedule.md b/docs/4.x/firestore_backup_schedule.md
new file mode 100644
index 00000000..eacff645
--- /dev/null
+++ b/docs/4.x/firestore_backup_schedule.md
@@ -0,0 +1,332 @@
+---
+permalink: /firestore_backup_schedule/
+---
+
+# firestore_backup_schedule
+
+`firestore_backup_schedule` represents the `google_firestore_backup_schedule` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withDailyRecurrence()`](#fn-withdailyrecurrence)
+* [`fn withDailyRecurrenceMixin()`](#fn-withdailyrecurrencemixin)
+* [`fn withDatabase()`](#fn-withdatabase)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withRetention()`](#fn-withretention)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withWeeklyRecurrence()`](#fn-withweeklyrecurrence)
+* [`fn withWeeklyRecurrenceMixin()`](#fn-withweeklyrecurrencemixin)
+* [`obj daily_recurrence`](#obj-daily_recurrence)
+  * [`fn new()`](#fn-daily_recurrencenew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+* [`obj weekly_recurrence`](#obj-weekly_recurrence)
+  * [`fn new()`](#fn-weekly_recurrencenew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.firestore_backup_schedule.new` injects a new `google_firestore_backup_schedule` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.firestore_backup_schedule.new('some_id')
+
+You can get the reference to the `id` field of the created `google.firestore_backup_schedule` using the reference:
+
+    $._ref.google_firestore_backup_schedule.some_id.get('id')
+
+This is the same as directly entering `"${ google_firestore_backup_schedule.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `database` (`string`): The Firestore database id. Defaults to '"(default)"'. When `null`, the `database` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `retention` (`string`): At what relative time in the future, compared to its creation time, the backup should be deleted, e.g. keep backups for 7 days.
+A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".
+
+For a daily backup recurrence, set this to a value up to 7 days. If you set a weekly backup recurrence, set this to a value up to 14 weeks.
+  - `daily_recurrence` (`list[obj]`): For a schedule that runs daily at a specified time. When `null`, the `daily_recurrence` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_backup_schedule.daily_recurrence.new](#fn-daily_recurrencenew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_backup_schedule.timeouts.new](#fn-timeoutsnew) constructor.
+  - `weekly_recurrence` (`list[obj]`): For a schedule that runs weekly on a specific day and time. When `null`, the `weekly_recurrence` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_backup_schedule.weekly_recurrence.new](#fn-weekly_recurrencenew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.firestore_backup_schedule.newAttrs` constructs a new object with attributes and blocks configured for the `firestore_backup_schedule`
+Terraform resource.
+
+Unlike [google.firestore_backup_schedule.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `database` (`string`): The Firestore database id. Defaults to '"(default)"'. When `null`, the `database` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `retention` (`string`): At what relative time in the future, compared to its creation time, the backup should be deleted, e.g. keep backups for 7 days.
+A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".
+
+For a daily backup recurrence, set this to a value up to 7 days. If you set a weekly backup recurrence, set this to a value up to 14 weeks.
+  - `daily_recurrence` (`list[obj]`): For a schedule that runs daily at a specified time. When `null`, the `daily_recurrence` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_backup_schedule.daily_recurrence.new](#fn-daily_recurrencenew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_backup_schedule.timeouts.new](#fn-timeoutsnew) constructor.
+  - `weekly_recurrence` (`list[obj]`): For a schedule that runs weekly on a specific day and time. When `null`, the `weekly_recurrence` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_backup_schedule.weekly_recurrence.new](#fn-weekly_recurrencenew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `firestore_backup_schedule` resource into the root Terraform configuration.
+
+
+### fn withDailyRecurrence
+
+```ts
+withDailyRecurrence()
+```
+
+`google.list[obj].withDailyRecurrence` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the daily_recurrence field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withDailyRecurrenceMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `daily_recurrence` field.
+
+
+### fn withDailyRecurrenceMixin
+
+```ts
+withDailyRecurrenceMixin()
+```
+
+`google.list[obj].withDailyRecurrenceMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the daily_recurrence field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withDailyRecurrence](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `daily_recurrence` field.
+
+
+### fn withDatabase
+
+```ts
+withDatabase()
+```
+
+`google.string.withDatabase` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the database field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `database` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withRetention
+
+```ts
+withRetention()
+```
+
+`google.string.withRetention` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the retention field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `retention` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withWeeklyRecurrence
+
+```ts
+withWeeklyRecurrence()
+```
+
+`google.list[obj].withWeeklyRecurrence` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the weekly_recurrence field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withWeeklyRecurrenceMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `weekly_recurrence` field.
+
+
+### fn withWeeklyRecurrenceMixin
+
+```ts
+withWeeklyRecurrenceMixin()
+```
+
+`google.list[obj].withWeeklyRecurrenceMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the weekly_recurrence field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withWeeklyRecurrence](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `weekly_recurrence` field.
+
+
+## obj daily_recurrence
+
+
+
+### fn daily_recurrence.new
+
+```ts
+new()
+```
+
+
+`google.firestore_backup_schedule.daily_recurrence.new` constructs a new object with attributes and blocks configured for the `daily_recurrence`
+Terraform sub block.
+
+
+
+**Returns**:
+  - An attribute object that represents the `daily_recurrence` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.firestore_backup_schedule.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
+
+
+## obj weekly_recurrence
+
+
+
+### fn weekly_recurrence.new
+
+```ts
+new()
+```
+
+
+`google.firestore_backup_schedule.weekly_recurrence.new` constructs a new object with attributes and blocks configured for the `weekly_recurrence`
+Terraform sub block.
+
+
+
+**Args**:
+  - `day` (`string`): The day of week to run. Possible values: ["DAY_OF_WEEK_UNSPECIFIED", "MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY", "SUNDAY"] When `null`, the `day` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `weekly_recurrence` sub block.
diff --git a/docs/4.x/firestore_field.md b/docs/4.x/firestore_field.md
index 8698adb3..a900a787 100644
--- a/docs/4.x/firestore_field.md
+++ b/docs/4.x/firestore_field.md
@@ -72,7 +72,7 @@ Creating an index configuration for this field will override any inherited confi
 indexes specified. Configuring the index configuration with an empty block disables all indexes on
 the field. When `null`, the `index_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.index_config.new](#fn-index_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.timeouts.new](#fn-timeoutsnew) constructor.
-  - `ttl_config` (`list[obj]`): If set, this field is configured for TTL deletion. When `null`, the `ttl_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.ttl_config.new](#fn-ttl_confignew) constructor.
+  - `ttl_config` (`list[obj]`): The TTL configuration for this Field. If set to an empty block (i.e. 'ttl_config {}'), a TTL policy is configured based on the field. If unset, a TTL policy is not configured (or will be disabled upon updating the resource). When `null`, the `ttl_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.ttl_config.new](#fn-ttl_confignew) constructor.
 
 **Returns**:
 - A mixin object that injects the new resource into the root Terraform configuration.
@@ -105,7 +105,7 @@ Creating an index configuration for this field will override any inherited confi
 indexes specified. Configuring the index configuration with an empty block disables all indexes on
 the field. When `null`, the `index_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.index_config.new](#fn-index_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.timeouts.new](#fn-timeoutsnew) constructor.
-  - `ttl_config` (`list[obj]`): If set, this field is configured for TTL deletion. When `null`, the `ttl_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.ttl_config.new](#fn-ttl_confignew) constructor.
+  - `ttl_config` (`list[obj]`): The TTL configuration for this Field. If set to an empty block (i.e. 'ttl_config {}'), a TTL policy is configured based on the field. If unset, a TTL policy is not configured (or will be disabled upon updating the resource). When `null`, the `ttl_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.firestore_field.ttl_config.new](#fn-ttl_confignew) constructor.
 
 **Returns**:
   - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `firestore_field` resource into the root Terraform configuration.
diff --git a/docs/4.x/firestore_index.md b/docs/4.x/firestore_index.md
index 784a4120..9a52b295 100644
--- a/docs/4.x/firestore_index.md
+++ b/docs/4.x/firestore_index.md
@@ -15,6 +15,7 @@ This package contains functions and utilities for setting up the resource using
 
 * [`fn new()`](#fn-new)
 * [`fn newAttrs()`](#fn-newattrs)
+* [`fn withApiScope()`](#fn-withapiscope)
 * [`fn withCollection()`](#fn-withcollection)
 * [`fn withDatabase()`](#fn-withdatabase)
 * [`fn withFields()`](#fn-withfields)
@@ -57,10 +58,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
+  - `api_scope` (`string`): The API scope at which a query is run. Default value: "ANY_API" Possible values: ["ANY_API", "DATASTORE_MODE_API"] When `null`, the `api_scope` field will be omitted from the resulting object.
   - `collection` (`string`): The collection being indexed.
   - `database` (`string`): The Firestore database id. Defaults to '"(default)"'. When `null`, the `database` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
-  - `query_scope` (`string`): The scope at which a query is run. Default value: "COLLECTION" Possible values: ["COLLECTION", "COLLECTION_GROUP"] When `null`, the `query_scope` field will be omitted from the resulting object.
+  - `query_scope` (`string`): The scope at which a query is run. Default value: "COLLECTION" Possible values: ["COLLECTION", "COLLECTION_GROUP", "COLLECTION_RECURSIVE"] When `null`, the `query_scope` field will be omitted from the resulting object.
   - `fields` (`list[obj]`): The fields supported by this index. The last field entry is always for
 the field path '__name__'. If, on creation, '__name__' was not
 specified as the last field, it will be added automatically with the
@@ -91,10 +93,11 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
+  - `api_scope` (`string`): The API scope at which a query is run. Default value: "ANY_API" Possible values: ["ANY_API", "DATASTORE_MODE_API"] When `null`, the `api_scope` field will be omitted from the resulting object.
   - `collection` (`string`): The collection being indexed.
   - `database` (`string`): The Firestore database id. Defaults to '"(default)"'. When `null`, the `database` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
-  - `query_scope` (`string`): The scope at which a query is run. Default value: "COLLECTION" Possible values: ["COLLECTION", "COLLECTION_GROUP"] When `null`, the `query_scope` field will be omitted from the resulting object.
+  - `query_scope` (`string`): The scope at which a query is run. Default value: "COLLECTION" Possible values: ["COLLECTION", "COLLECTION_GROUP", "COLLECTION_RECURSIVE"] When `null`, the `query_scope` field will be omitted from the resulting object.
   - `fields` (`list[obj]`): The fields supported by this index. The last field entry is always for
 the field path '__name__'. If, on creation, '__name__' was not
 specified as the last field, it will be added automatically with the
@@ -107,6 +110,22 @@ ordered '"ASCENDING"' (unless explicitly specified otherwise). W
   - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `firestore_index` resource into the root Terraform configuration.
 
 
+### fn withApiScope
+
+```ts
+withApiScope()
+```
+
+`google.string.withApiScope` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the api_scope field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `api_scope` field.
+
+
 ### fn withCollection
 
 ```ts
diff --git a/docs/4.x/game_services_game_server_cluster.md b/docs/4.x/game_services_game_server_cluster.md
deleted file mode 100644
index d11c09f2..00000000
--- a/docs/4.x/game_services_game_server_cluster.md
+++ /dev/null
@@ -1,361 +0,0 @@
----
-permalink: /game_services_game_server_cluster/
----
-
-# game_services_game_server_cluster
-
-`game_services_game_server_cluster` represents the `google_game_services_game_server_cluster` Terraform resource.
-
-
-
-This package contains functions and utilities for setting up the resource using Jsonnet code.
-
-
-## Index
-
-* [`fn new()`](#fn-new)
-* [`fn newAttrs()`](#fn-newattrs)
-* [`fn withClusterId()`](#fn-withclusterid)
-* [`fn withConnectionInfo()`](#fn-withconnectioninfo)
-* [`fn withConnectionInfoMixin()`](#fn-withconnectioninfomixin)
-* [`fn withDescription()`](#fn-withdescription)
-* [`fn withLabels()`](#fn-withlabels)
-* [`fn withLocation()`](#fn-withlocation)
-* [`fn withProject()`](#fn-withproject)
-* [`fn withRealmId()`](#fn-withrealmid)
-* [`fn withTimeouts()`](#fn-withtimeouts)
-* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
-* [`obj connection_info`](#obj-connection_info)
-  * [`fn new()`](#fn-connection_infonew)
-  * [`obj connection_info.gke_cluster_reference`](#obj-connection_infogke_cluster_reference)
-    * [`fn new()`](#fn-connection_infogke_cluster_referencenew)
-* [`obj timeouts`](#obj-timeouts)
-  * [`fn new()`](#fn-timeoutsnew)
-
-## Fields
-
-### fn new
-
-```ts
-new()
-```
-
-
-`google.game_services_game_server_cluster.new` injects a new `google_game_services_game_server_cluster` Terraform `resource`
-block into the root module document.
-
-Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
-resource. For example, if you added a new instance to the root using:
-
-    # arguments omitted for brevity
-    google.game_services_game_server_cluster.new('some_id')
-
-You can get the reference to the `id` field of the created `google.game_services_game_server_cluster` using the reference:
-
-    $._ref.google_game_services_game_server_cluster.some_id.get('id')
-
-This is the same as directly entering `"${ google_game_services_game_server_cluster.some_id.id }"` as the value.
-
-NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
-or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block.
-  - `cluster_id` (`string`): Required. The resource name of the game server cluster
-  - `description` (`string`): Human readable description of the cluster. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): The labels associated with this game server cluster. Each label is a
-key-value pair. When `null`, the `labels` field will be omitted from the resulting object.
-  - `location` (`string`): Location of the Cluster. When `null`, the `location` field will be omitted from the resulting object.
-  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
-  - `realm_id` (`string`): The realm id of the game server realm.
-  - `connection_info` (`list[obj]`): Game server cluster connection information. This information is used to
-manage game server clusters. When `null`, the `connection_info` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_cluster.connection_info.new](#fn-connection_infonew) constructor.
-  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_cluster.timeouts.new](#fn-timeoutsnew) constructor.
-
-**Returns**:
-- A mixin object that injects the new resource into the root Terraform configuration.
-
-
-### fn newAttrs
-
-```ts
-newAttrs()
-```
-
-
-`google.game_services_game_server_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `game_services_game_server_cluster`
-Terraform resource.
-
-Unlike [google.game_services_game_server_cluster.new](#fn-new), this function will not inject the `resource`
-block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
-[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
-
-This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
-injecting into a complete block.
-
-**Args**:
-  - `cluster_id` (`string`): Required. The resource name of the game server cluster
-  - `description` (`string`): Human readable description of the cluster. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): The labels associated with this game server cluster. Each label is a
-key-value pair. When `null`, the `labels` field will be omitted from the resulting object.
-  - `location` (`string`): Location of the Cluster. When `null`, the `location` field will be omitted from the resulting object.
-  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
-  - `realm_id` (`string`): The realm id of the game server realm.
-  - `connection_info` (`list[obj]`): Game server cluster connection information. This information is used to
-manage game server clusters. When `null`, the `connection_info` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_cluster.connection_info.new](#fn-connection_infonew) constructor.
-  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_cluster.timeouts.new](#fn-timeoutsnew) constructor.
-
-**Returns**:
-  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `game_services_game_server_cluster` resource into the root Terraform configuration.
-
-
-### fn withClusterId
-
-```ts
-withClusterId()
-```
-
-`google.string.withClusterId` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the cluster_id field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `cluster_id` field.
-
-
-### fn withConnectionInfo
-
-```ts
-withConnectionInfo()
-```
-
-`google.list[obj].withConnectionInfo` constructs a mixin object that can be merged into the `list[obj]`
-Terraform resource block to set or update the connection_info field.
-
-This function will replace the array with the passed in `value`. If you wish to instead append the
-passed in value to the existing array, use the [google.list[obj].withConnectionInfoMixin](TODO) function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`list[obj]`): The value to set for the `connection_info` field.
-
-
-### fn withConnectionInfoMixin
-
-```ts
-withConnectionInfoMixin()
-```
-
-`google.list[obj].withConnectionInfoMixin` constructs a mixin object that can be merged into the `list[obj]`
-Terraform resource block to set or update the connection_info field.
-
-This function will append the passed in array or object to the existing array. If you wish
-to instead replace the array with the passed in `value`, use the [google.list[obj].withConnectionInfo](TODO)
-function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`list[obj]`): The value to set for the `connection_info` field.
-
-
-### fn withDescription
-
-```ts
-withDescription()
-```
-
-`google.string.withDescription` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the description field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `description` field.
-
-
-### fn withLabels
-
-```ts
-withLabels()
-```
-
-`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the labels field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `labels` field.
-
-
-### fn withLocation
-
-```ts
-withLocation()
-```
-
-`google.string.withLocation` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the location field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `location` field.
-
-
-### fn withProject
-
-```ts
-withProject()
-```
-
-`google.string.withProject` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the project field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `project` field.
-
-
-### fn withRealmId
-
-```ts
-withRealmId()
-```
-
-`google.string.withRealmId` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the realm_id field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `realm_id` field.
-
-
-### fn withTimeouts
-
-```ts
-withTimeouts()
-```
-
-`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the timeouts field.
-
-This function will replace the map with the passed in `value`. If you wish to instead merge the
-passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `timeouts` field.
-
-
-### fn withTimeoutsMixin
-
-```ts
-withTimeoutsMixin()
-```
-
-`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the timeouts field.
-
-This function will merge the passed in value to the existing map. If you wish
-to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
-function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `timeouts` field.
-
-
-## obj connection_info
-
-
-
-### fn connection_info.new
-
-```ts
-new()
-```
-
-
-`google.game_services_game_server_cluster.connection_info.new` constructs a new object with attributes and blocks configured for the `connection_info`
-Terraform sub block.
-
-
-
-**Args**:
-  - `namespace` (`string`): Namespace designated on the game server cluster where the game server
-instances will be created. The namespace existence will be validated
-during creation.
-  - `gke_cluster_reference` (`list[obj]`): Reference of the GKE cluster where the game servers are installed. When `null`, the `gke_cluster_reference` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_cluster.connection_info.gke_cluster_reference.new](#fn-connection_infogke_cluster_referencenew) constructor.
-
-**Returns**:
-  - An attribute object that represents the `connection_info` sub block.
-
-
-## obj connection_info.gke_cluster_reference
-
-
-
-### fn connection_info.gke_cluster_reference.new
-
-```ts
-new()
-```
-
-
-`google.game_services_game_server_cluster.connection_info.gke_cluster_reference.new` constructs a new object with attributes and blocks configured for the `gke_cluster_reference`
-Terraform sub block.
-
-
-
-**Args**:
-  - `cluster` (`string`): The full or partial name of a GKE cluster, using one of the following
-forms:
-
-* 'projects/{project_id}/locations/{location}/clusters/{cluster_id}'
-* 'locations/{location}/clusters/{cluster_id}'
-* '{cluster_id}'
-
-If project and location are not specified, the project and location of the
-GameServerCluster resource are used to generate the full name of the
-GKE cluster.
-
-**Returns**:
-  - An attribute object that represents the `gke_cluster_reference` sub block.
-
-
-## obj timeouts
-
-
-
-### fn timeouts.new
-
-```ts
-new()
-```
-
-
-`google.game_services_game_server_cluster.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
-Terraform sub block.
-
-
-
-**Args**:
-  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
-  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
-  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
-
-**Returns**:
-  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/game_services_game_server_config.md b/docs/4.x/game_services_game_server_config.md
deleted file mode 100644
index 4c69a354..00000000
--- a/docs/4.x/game_services_game_server_config.md
+++ /dev/null
@@ -1,467 +0,0 @@
----
-permalink: /game_services_game_server_config/
----
-
-# game_services_game_server_config
-
-`game_services_game_server_config` represents the `google_game_services_game_server_config` Terraform resource.
-
-
-
-This package contains functions and utilities for setting up the resource using Jsonnet code.
-
-
-## Index
-
-* [`fn new()`](#fn-new)
-* [`fn newAttrs()`](#fn-newattrs)
-* [`fn withConfigId()`](#fn-withconfigid)
-* [`fn withDeploymentId()`](#fn-withdeploymentid)
-* [`fn withDescription()`](#fn-withdescription)
-* [`fn withFleetConfigs()`](#fn-withfleetconfigs)
-* [`fn withFleetConfigsMixin()`](#fn-withfleetconfigsmixin)
-* [`fn withLabels()`](#fn-withlabels)
-* [`fn withLocation()`](#fn-withlocation)
-* [`fn withProject()`](#fn-withproject)
-* [`fn withScalingConfigs()`](#fn-withscalingconfigs)
-* [`fn withScalingConfigsMixin()`](#fn-withscalingconfigsmixin)
-* [`fn withTimeouts()`](#fn-withtimeouts)
-* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
-* [`obj fleet_configs`](#obj-fleet_configs)
-  * [`fn new()`](#fn-fleet_configsnew)
-* [`obj scaling_configs`](#obj-scaling_configs)
-  * [`fn new()`](#fn-scaling_configsnew)
-  * [`obj scaling_configs.schedules`](#obj-scaling_configsschedules)
-    * [`fn new()`](#fn-scaling_configsschedulesnew)
-  * [`obj scaling_configs.selectors`](#obj-scaling_configsselectors)
-    * [`fn new()`](#fn-scaling_configsselectorsnew)
-* [`obj timeouts`](#obj-timeouts)
-  * [`fn new()`](#fn-timeoutsnew)
-
-## Fields
-
-### fn new
-
-```ts
-new()
-```
-
-
-`google.game_services_game_server_config.new` injects a new `google_game_services_game_server_config` Terraform `resource`
-block into the root module document.
-
-Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
-resource. For example, if you added a new instance to the root using:
-
-    # arguments omitted for brevity
-    google.game_services_game_server_config.new('some_id')
-
-You can get the reference to the `id` field of the created `google.game_services_game_server_config` using the reference:
-
-    $._ref.google_game_services_game_server_config.some_id.get('id')
-
-This is the same as directly entering `"${ google_game_services_game_server_config.some_id.id }"` as the value.
-
-NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
-or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block.
-  - `config_id` (`string`): A unique id for the deployment config.
-  - `deployment_id` (`string`): A unique id for the deployment.
-  - `description` (`string`): The description of the game server config. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): The labels associated with this game server config. Each label is a
-key-value pair. When `null`, the `labels` field will be omitted from the resulting object.
-  - `location` (`string`): Location of the Deployment. When `null`, the `location` field will be omitted from the resulting object.
-  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
-  - `fleet_configs` (`list[obj]`): The fleet config contains list of fleet specs. In the Single Cloud, there
-will be only one. When `null`, the `fleet_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_config.fleet_configs.new](#fn-fleet_configsnew) constructor.
-  - `scaling_configs` (`list[obj]`): Optional. This contains the autoscaling settings. When `null`, the `scaling_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_config.scaling_configs.new](#fn-scaling_configsnew) constructor.
-  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_config.timeouts.new](#fn-timeoutsnew) constructor.
-
-**Returns**:
-- A mixin object that injects the new resource into the root Terraform configuration.
-
-
-### fn newAttrs
-
-```ts
-newAttrs()
-```
-
-
-`google.game_services_game_server_config.newAttrs` constructs a new object with attributes and blocks configured for the `game_services_game_server_config`
-Terraform resource.
-
-Unlike [google.game_services_game_server_config.new](#fn-new), this function will not inject the `resource`
-block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
-[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
-
-This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
-injecting into a complete block.
-
-**Args**:
-  - `config_id` (`string`): A unique id for the deployment config.
-  - `deployment_id` (`string`): A unique id for the deployment.
-  - `description` (`string`): The description of the game server config. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): The labels associated with this game server config. Each label is a
-key-value pair. When `null`, the `labels` field will be omitted from the resulting object.
-  - `location` (`string`): Location of the Deployment. When `null`, the `location` field will be omitted from the resulting object.
-  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
-  - `fleet_configs` (`list[obj]`): The fleet config contains list of fleet specs. In the Single Cloud, there
-will be only one. When `null`, the `fleet_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_config.fleet_configs.new](#fn-fleet_configsnew) constructor.
-  - `scaling_configs` (`list[obj]`): Optional. This contains the autoscaling settings. When `null`, the `scaling_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_config.scaling_configs.new](#fn-scaling_configsnew) constructor.
-  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_config.timeouts.new](#fn-timeoutsnew) constructor.
-
-**Returns**:
-  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `game_services_game_server_config` resource into the root Terraform configuration.
-
-
-### fn withConfigId
-
-```ts
-withConfigId()
-```
-
-`google.string.withConfigId` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the config_id field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `config_id` field.
-
-
-### fn withDeploymentId
-
-```ts
-withDeploymentId()
-```
-
-`google.string.withDeploymentId` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the deployment_id field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `deployment_id` field.
-
-
-### fn withDescription
-
-```ts
-withDescription()
-```
-
-`google.string.withDescription` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the description field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `description` field.
-
-
-### fn withFleetConfigs
-
-```ts
-withFleetConfigs()
-```
-
-`google.list[obj].withFleetConfigs` constructs a mixin object that can be merged into the `list[obj]`
-Terraform resource block to set or update the fleet_configs field.
-
-This function will replace the array with the passed in `value`. If you wish to instead append the
-passed in value to the existing array, use the [google.list[obj].withFleetConfigsMixin](TODO) function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`list[obj]`): The value to set for the `fleet_configs` field.
-
-
-### fn withFleetConfigsMixin
-
-```ts
-withFleetConfigsMixin()
-```
-
-`google.list[obj].withFleetConfigsMixin` constructs a mixin object that can be merged into the `list[obj]`
-Terraform resource block to set or update the fleet_configs field.
-
-This function will append the passed in array or object to the existing array. If you wish
-to instead replace the array with the passed in `value`, use the [google.list[obj].withFleetConfigs](TODO)
-function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`list[obj]`): The value to set for the `fleet_configs` field.
-
-
-### fn withLabels
-
-```ts
-withLabels()
-```
-
-`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the labels field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `labels` field.
-
-
-### fn withLocation
-
-```ts
-withLocation()
-```
-
-`google.string.withLocation` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the location field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `location` field.
-
-
-### fn withProject
-
-```ts
-withProject()
-```
-
-`google.string.withProject` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the project field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `project` field.
-
-
-### fn withScalingConfigs
-
-```ts
-withScalingConfigs()
-```
-
-`google.list[obj].withScalingConfigs` constructs a mixin object that can be merged into the `list[obj]`
-Terraform resource block to set or update the scaling_configs field.
-
-This function will replace the array with the passed in `value`. If you wish to instead append the
-passed in value to the existing array, use the [google.list[obj].withScalingConfigsMixin](TODO) function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`list[obj]`): The value to set for the `scaling_configs` field.
-
-
-### fn withScalingConfigsMixin
-
-```ts
-withScalingConfigsMixin()
-```
-
-`google.list[obj].withScalingConfigsMixin` constructs a mixin object that can be merged into the `list[obj]`
-Terraform resource block to set or update the scaling_configs field.
-
-This function will append the passed in array or object to the existing array. If you wish
-to instead replace the array with the passed in `value`, use the [google.list[obj].withScalingConfigs](TODO)
-function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`list[obj]`): The value to set for the `scaling_configs` field.
-
-
-### fn withTimeouts
-
-```ts
-withTimeouts()
-```
-
-`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the timeouts field.
-
-This function will replace the map with the passed in `value`. If you wish to instead merge the
-passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `timeouts` field.
-
-
-### fn withTimeoutsMixin
-
-```ts
-withTimeoutsMixin()
-```
-
-`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the timeouts field.
-
-This function will merge the passed in value to the existing map. If you wish
-to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
-function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `timeouts` field.
-
-
-## obj fleet_configs
-
-
-
-### fn fleet_configs.new
-
-```ts
-new()
-```
-
-
-`google.game_services_game_server_config.fleet_configs.new` constructs a new object with attributes and blocks configured for the `fleet_configs`
-Terraform sub block.
-
-
-
-**Args**:
-  - `fleet_spec` (`string`): The fleet spec, which is sent to Agones to configure fleet.
-The spec can be passed as inline json but it is recommended to use a file reference
-instead. File references can contain the json or yaml format of the fleet spec. Eg:
-
-* fleet_spec = jsonencode(yamldecode(file("fleet_configs.yaml")))
-* fleet_spec = file("fleet_configs.json")
-
-The format of the spec can be found :
-'https://agones.dev/site/docs/reference/fleet/'.
-  - `name` (`string`): The name of the FleetConfig. When `null`, the `name` field will be omitted from the resulting object.
-
-**Returns**:
-  - An attribute object that represents the `fleet_configs` sub block.
-
-
-## obj scaling_configs
-
-
-
-### fn scaling_configs.new
-
-```ts
-new()
-```
-
-
-`google.game_services_game_server_config.scaling_configs.new` constructs a new object with attributes and blocks configured for the `scaling_configs`
-Terraform sub block.
-
-
-
-**Args**:
-  - `fleet_autoscaler_spec` (`string`): Fleet autoscaler spec, which is sent to Agones.
-Example spec can be found :
-https://agones.dev/site/docs/reference/fleetautoscaler/
-  - `name` (`string`): The name of the ScalingConfig
-  - `schedules` (`list[obj]`): The schedules to which this scaling config applies. When `null`, the `schedules` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_config.scaling_configs.schedules.new](#fn-scaling_configsschedulesnew) constructor.
-  - `selectors` (`list[obj]`): Labels used to identify the clusters to which this scaling config
-applies. A cluster is subject to this scaling config if its labels match
-any of the selector entries. When `null`, the `selectors` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_config.scaling_configs.selectors.new](#fn-scaling_configsselectorsnew) constructor.
-
-**Returns**:
-  - An attribute object that represents the `scaling_configs` sub block.
-
-
-## obj scaling_configs.schedules
-
-
-
-### fn scaling_configs.schedules.new
-
-```ts
-new()
-```
-
-
-`google.game_services_game_server_config.scaling_configs.schedules.new` constructs a new object with attributes and blocks configured for the `schedules`
-Terraform sub block.
-
-
-
-**Args**:
-  - `cron_job_duration` (`string`): The duration for the cron job event. The duration of the event is effective
-after the cron job's start time.
-
-A duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s". When `null`, the `cron_job_duration` field will be omitted from the resulting object.
-  - `cron_spec` (`string`): The cron definition of the scheduled event. See
-https://en.wikipedia.org/wiki/Cron. Cron spec specifies the local time as
-defined by the realm. When `null`, the `cron_spec` field will be omitted from the resulting object.
-  - `end_time` (`string`): The end time of the event.
-
-A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z". When `null`, the `end_time` field will be omitted from the resulting object.
-  - `start_time` (`string`): The start time of the event.
-
-A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z". When `null`, the `start_time` field will be omitted from the resulting object.
-
-**Returns**:
-  - An attribute object that represents the `schedules` sub block.
-
-
-## obj scaling_configs.selectors
-
-
-
-### fn scaling_configs.selectors.new
-
-```ts
-new()
-```
-
-
-`google.game_services_game_server_config.scaling_configs.selectors.new` constructs a new object with attributes and blocks configured for the `selectors`
-Terraform sub block.
-
-
-
-**Args**:
-  - `labels` (`obj`): Set of labels to group by. When `null`, the `labels` field will be omitted from the resulting object.
-
-**Returns**:
-  - An attribute object that represents the `selectors` sub block.
-
-
-## obj timeouts
-
-
-
-### fn timeouts.new
-
-```ts
-new()
-```
-
-
-`google.game_services_game_server_config.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
-Terraform sub block.
-
-
-
-**Args**:
-  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
-  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
-
-**Returns**:
-  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/game_services_game_server_deployment_rollout.md b/docs/4.x/game_services_game_server_deployment_rollout.md
deleted file mode 100644
index 6a01c4a3..00000000
--- a/docs/4.x/game_services_game_server_deployment_rollout.md
+++ /dev/null
@@ -1,301 +0,0 @@
----
-permalink: /game_services_game_server_deployment_rollout/
----
-
-# game_services_game_server_deployment_rollout
-
-`game_services_game_server_deployment_rollout` represents the `google_game_services_game_server_deployment_rollout` Terraform resource.
-
-
-
-This package contains functions and utilities for setting up the resource using Jsonnet code.
-
-
-## Index
-
-* [`fn new()`](#fn-new)
-* [`fn newAttrs()`](#fn-newattrs)
-* [`fn withDefaultGameServerConfig()`](#fn-withdefaultgameserverconfig)
-* [`fn withDeploymentId()`](#fn-withdeploymentid)
-* [`fn withGameServerConfigOverrides()`](#fn-withgameserverconfigoverrides)
-* [`fn withGameServerConfigOverridesMixin()`](#fn-withgameserverconfigoverridesmixin)
-* [`fn withProject()`](#fn-withproject)
-* [`fn withTimeouts()`](#fn-withtimeouts)
-* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
-* [`obj game_server_config_overrides`](#obj-game_server_config_overrides)
-  * [`fn new()`](#fn-game_server_config_overridesnew)
-  * [`obj game_server_config_overrides.realms_selector`](#obj-game_server_config_overridesrealms_selector)
-    * [`fn new()`](#fn-game_server_config_overridesrealms_selectornew)
-* [`obj timeouts`](#obj-timeouts)
-  * [`fn new()`](#fn-timeoutsnew)
-
-## Fields
-
-### fn new
-
-```ts
-new()
-```
-
-
-`google.game_services_game_server_deployment_rollout.new` injects a new `google_game_services_game_server_deployment_rollout` Terraform `resource`
-block into the root module document.
-
-Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
-resource. For example, if you added a new instance to the root using:
-
-    # arguments omitted for brevity
-    google.game_services_game_server_deployment_rollout.new('some_id')
-
-You can get the reference to the `id` field of the created `google.game_services_game_server_deployment_rollout` using the reference:
-
-    $._ref.google_game_services_game_server_deployment_rollout.some_id.get('id')
-
-This is the same as directly entering `"${ google_game_services_game_server_deployment_rollout.some_id.id }"` as the value.
-
-NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
-or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block.
-  - `default_game_server_config` (`string`): This field points to the game server config that is
-applied by default to all realms and clusters. For example,
-
-'projects/my-project/locations/global/gameServerDeployments/my-game/configs/my-config'.
-  - `deployment_id` (`string`): The deployment to rollout the new config to. Only 1 rollout must be associated with each deployment.
-  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
-  - `game_server_config_overrides` (`list[obj]`): The game_server_config_overrides contains the per game server config
-overrides. The overrides are processed in the order they are listed. As
-soon as a match is found for a cluster, the rest of the list is not
-processed. When `null`, the `game_server_config_overrides` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_deployment_rollout.game_server_config_overrides.new](#fn-game_server_config_overridesnew) constructor.
-  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_deployment_rollout.timeouts.new](#fn-timeoutsnew) constructor.
-
-**Returns**:
-- A mixin object that injects the new resource into the root Terraform configuration.
-
-
-### fn newAttrs
-
-```ts
-newAttrs()
-```
-
-
-`google.game_services_game_server_deployment_rollout.newAttrs` constructs a new object with attributes and blocks configured for the `game_services_game_server_deployment_rollout`
-Terraform resource.
-
-Unlike [google.game_services_game_server_deployment_rollout.new](#fn-new), this function will not inject the `resource`
-block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
-[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
-
-This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
-injecting into a complete block.
-
-**Args**:
-  - `default_game_server_config` (`string`): This field points to the game server config that is
-applied by default to all realms and clusters. For example,
-
-'projects/my-project/locations/global/gameServerDeployments/my-game/configs/my-config'.
-  - `deployment_id` (`string`): The deployment to rollout the new config to. Only 1 rollout must be associated with each deployment.
-  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
-  - `game_server_config_overrides` (`list[obj]`): The game_server_config_overrides contains the per game server config
-overrides. The overrides are processed in the order they are listed. As
-soon as a match is found for a cluster, the rest of the list is not
-processed. When `null`, the `game_server_config_overrides` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_deployment_rollout.game_server_config_overrides.new](#fn-game_server_config_overridesnew) constructor.
-  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_deployment_rollout.timeouts.new](#fn-timeoutsnew) constructor.
-
-**Returns**:
-  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `game_services_game_server_deployment_rollout` resource into the root Terraform configuration.
-
-
-### fn withDefaultGameServerConfig
-
-```ts
-withDefaultGameServerConfig()
-```
-
-`google.string.withDefaultGameServerConfig` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the default_game_server_config field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `default_game_server_config` field.
-
-
-### fn withDeploymentId
-
-```ts
-withDeploymentId()
-```
-
-`google.string.withDeploymentId` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the deployment_id field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `deployment_id` field.
-
-
-### fn withGameServerConfigOverrides
-
-```ts
-withGameServerConfigOverrides()
-```
-
-`google.list[obj].withGameServerConfigOverrides` constructs a mixin object that can be merged into the `list[obj]`
-Terraform resource block to set or update the game_server_config_overrides field.
-
-This function will replace the array with the passed in `value`. If you wish to instead append the
-passed in value to the existing array, use the [google.list[obj].withGameServerConfigOverridesMixin](TODO) function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`list[obj]`): The value to set for the `game_server_config_overrides` field.
-
-
-### fn withGameServerConfigOverridesMixin
-
-```ts
-withGameServerConfigOverridesMixin()
-```
-
-`google.list[obj].withGameServerConfigOverridesMixin` constructs a mixin object that can be merged into the `list[obj]`
-Terraform resource block to set or update the game_server_config_overrides field.
-
-This function will append the passed in array or object to the existing array. If you wish
-to instead replace the array with the passed in `value`, use the [google.list[obj].withGameServerConfigOverrides](TODO)
-function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`list[obj]`): The value to set for the `game_server_config_overrides` field.
-
-
-### fn withProject
-
-```ts
-withProject()
-```
-
-`google.string.withProject` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the project field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `project` field.
-
-
-### fn withTimeouts
-
-```ts
-withTimeouts()
-```
-
-`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the timeouts field.
-
-This function will replace the map with the passed in `value`. If you wish to instead merge the
-passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `timeouts` field.
-
-
-### fn withTimeoutsMixin
-
-```ts
-withTimeoutsMixin()
-```
-
-`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the timeouts field.
-
-This function will merge the passed in value to the existing map. If you wish
-to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
-function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `timeouts` field.
-
-
-## obj game_server_config_overrides
-
-
-
-### fn game_server_config_overrides.new
-
-```ts
-new()
-```
-
-
-`google.game_services_game_server_deployment_rollout.game_server_config_overrides.new` constructs a new object with attributes and blocks configured for the `game_server_config_overrides`
-Terraform sub block.
-
-
-
-**Args**:
-  - `config_version` (`string`): Version of the configuration. When `null`, the `config_version` field will be omitted from the resulting object.
-  - `realms_selector` (`list[obj]`): Selection by realms. When `null`, the `realms_selector` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_deployment_rollout.game_server_config_overrides.realms_selector.new](#fn-game_server_config_overridesrealms_selectornew) constructor.
-
-**Returns**:
-  - An attribute object that represents the `game_server_config_overrides` sub block.
-
-
-## obj game_server_config_overrides.realms_selector
-
-
-
-### fn game_server_config_overrides.realms_selector.new
-
-```ts
-new()
-```
-
-
-`google.game_services_game_server_deployment_rollout.game_server_config_overrides.realms_selector.new` constructs a new object with attributes and blocks configured for the `realms_selector`
-Terraform sub block.
-
-
-
-**Args**:
-  - `realms` (`list`): List of realms to match against. When `null`, the `realms` field will be omitted from the resulting object.
-
-**Returns**:
-  - An attribute object that represents the `realms_selector` sub block.
-
-
-## obj timeouts
-
-
-
-### fn timeouts.new
-
-```ts
-new()
-```
-
-
-`google.game_services_game_server_deployment_rollout.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
-Terraform sub block.
-
-
-
-**Args**:
-  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
-  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
-  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
-
-**Returns**:
-  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/game_services_realm.md b/docs/4.x/game_services_realm.md
deleted file mode 100644
index 3a11fe9b..00000000
--- a/docs/4.x/game_services_realm.md
+++ /dev/null
@@ -1,258 +0,0 @@
----
-permalink: /game_services_realm/
----
-
-# game_services_realm
-
-`game_services_realm` represents the `google_game_services_realm` Terraform resource.
-
-
-
-This package contains functions and utilities for setting up the resource using Jsonnet code.
-
-
-## Index
-
-* [`fn new()`](#fn-new)
-* [`fn newAttrs()`](#fn-newattrs)
-* [`fn withDescription()`](#fn-withdescription)
-* [`fn withLabels()`](#fn-withlabels)
-* [`fn withLocation()`](#fn-withlocation)
-* [`fn withProject()`](#fn-withproject)
-* [`fn withRealmId()`](#fn-withrealmid)
-* [`fn withTimeZone()`](#fn-withtimezone)
-* [`fn withTimeouts()`](#fn-withtimeouts)
-* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
-* [`obj timeouts`](#obj-timeouts)
-  * [`fn new()`](#fn-timeoutsnew)
-
-## Fields
-
-### fn new
-
-```ts
-new()
-```
-
-
-`google.game_services_realm.new` injects a new `google_game_services_realm` Terraform `resource`
-block into the root module document.
-
-Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
-resource. For example, if you added a new instance to the root using:
-
-    # arguments omitted for brevity
-    google.game_services_realm.new('some_id')
-
-You can get the reference to the `id` field of the created `google.game_services_realm` using the reference:
-
-    $._ref.google_game_services_realm.some_id.get('id')
-
-This is the same as directly entering `"${ google_game_services_realm.some_id.id }"` as the value.
-
-NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
-or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block.
-  - `description` (`string`): Human readable description of the realm. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): The labels associated with this realm. Each label is a key-value pair. When `null`, the `labels` field will be omitted from the resulting object.
-  - `location` (`string`): Location of the Realm. When `null`, the `location` field will be omitted from the resulting object.
-  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
-  - `realm_id` (`string`): GCP region of the Realm.
-  - `time_zone` (`string`): Required. Time zone where all realm-specific policies are evaluated. The value of
-this field must be from the IANA time zone database:
-https://www.iana.org/time-zones.
-  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_realm.timeouts.new](#fn-timeoutsnew) constructor.
-
-**Returns**:
-- A mixin object that injects the new resource into the root Terraform configuration.
-
-
-### fn newAttrs
-
-```ts
-newAttrs()
-```
-
-
-`google.game_services_realm.newAttrs` constructs a new object with attributes and blocks configured for the `game_services_realm`
-Terraform resource.
-
-Unlike [google.game_services_realm.new](#fn-new), this function will not inject the `resource`
-block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
-[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
-
-This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
-injecting into a complete block.
-
-**Args**:
-  - `description` (`string`): Human readable description of the realm. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): The labels associated with this realm. Each label is a key-value pair. When `null`, the `labels` field will be omitted from the resulting object.
-  - `location` (`string`): Location of the Realm. When `null`, the `location` field will be omitted from the resulting object.
-  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
-  - `realm_id` (`string`): GCP region of the Realm.
-  - `time_zone` (`string`): Required. Time zone where all realm-specific policies are evaluated. The value of
-this field must be from the IANA time zone database:
-https://www.iana.org/time-zones.
-  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_realm.timeouts.new](#fn-timeoutsnew) constructor.
-
-**Returns**:
-  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `game_services_realm` resource into the root Terraform configuration.
-
-
-### fn withDescription
-
-```ts
-withDescription()
-```
-
-`google.string.withDescription` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the description field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `description` field.
-
-
-### fn withLabels
-
-```ts
-withLabels()
-```
-
-`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the labels field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `labels` field.
-
-
-### fn withLocation
-
-```ts
-withLocation()
-```
-
-`google.string.withLocation` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the location field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `location` field.
-
-
-### fn withProject
-
-```ts
-withProject()
-```
-
-`google.string.withProject` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the project field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `project` field.
-
-
-### fn withRealmId
-
-```ts
-withRealmId()
-```
-
-`google.string.withRealmId` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the realm_id field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `realm_id` field.
-
-
-### fn withTimeZone
-
-```ts
-withTimeZone()
-```
-
-`google.string.withTimeZone` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the time_zone field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `time_zone` field.
-
-
-### fn withTimeouts
-
-```ts
-withTimeouts()
-```
-
-`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the timeouts field.
-
-This function will replace the map with the passed in `value`. If you wish to instead merge the
-passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `timeouts` field.
-
-
-### fn withTimeoutsMixin
-
-```ts
-withTimeoutsMixin()
-```
-
-`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the timeouts field.
-
-This function will merge the passed in value to the existing map. If you wish
-to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
-function.
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `timeouts` field.
-
-
-## obj timeouts
-
-
-
-### fn timeouts.new
-
-```ts
-new()
-```
-
-
-`google.game_services_realm.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
-Terraform sub block.
-
-
-
-**Args**:
-  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
-  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
-  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
-
-**Returns**:
-  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/gke_backup_backup_plan.md b/docs/4.x/gke_backup_backup_plan.md
index 0e2badb1..34f850a8 100644
--- a/docs/4.x/gke_backup_backup_plan.md
+++ b/docs/4.x/gke_backup_backup_plan.md
@@ -84,7 +84,11 @@ from being created via this BackupPlan (including scheduled Backups). When `null
   - `description` (`string`): User specified descriptive string for this BackupPlan. When `null`, the `description` field will be omitted from the resulting object.
   - `labels` (`obj`): Description: A set of custom labels supplied by the user.
 A list of key->value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The region of the Backup Plan.
   - `name` (`string`): The full name of the BackupPlan Resource.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
@@ -123,7 +127,11 @@ from being created via this BackupPlan (including scheduled Backups). When `null
   - `description` (`string`): User specified descriptive string for this BackupPlan. When `null`, the `description` field will be omitted from the resulting object.
   - `labels` (`obj`): Description: A set of custom labels supplied by the user.
 A list of key->value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The region of the Backup Plan.
   - `name` (`string`): The full name of the BackupPlan Resource.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
diff --git a/docs/4.x/gke_backup_restore_plan.md b/docs/4.x/gke_backup_restore_plan.md
index 80509709..6df531fb 100644
--- a/docs/4.x/gke_backup_restore_plan.md
+++ b/docs/4.x/gke_backup_restore_plan.md
@@ -88,7 +88,11 @@ as the source for Restores created via this RestorePlan.
   - `description` (`string`): User specified descriptive string for this RestorePlan. When `null`, the `description` field will be omitted from the resulting object.
   - `labels` (`obj`): Description: A set of custom labels supplied by the user.
 A list of key->value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The region of the Restore Plan.
   - `name` (`string`): The full name of the BackupPlan Resource.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
@@ -123,7 +127,11 @@ as the source for Restores created via this RestorePlan.
   - `description` (`string`): User specified descriptive string for this RestorePlan. When `null`, the `description` field will be omitted from the resulting object.
   - `labels` (`obj`): Description: A set of custom labels supplied by the user.
 A list of key->value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The region of the Restore Plan.
   - `name` (`string`): The full name of the BackupPlan Resource.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
diff --git a/docs/4.x/gke_hub_feature.md b/docs/4.x/gke_hub_feature.md
index e8d95faa..b9e798b2 100644
--- a/docs/4.x/gke_hub_feature.md
+++ b/docs/4.x/gke_hub_feature.md
@@ -67,7 +67,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `labels` (`obj`): GCP labels for this Feature. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): GCP labels for this Feature.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): The full, unique name of this Feature resource When `null`, the `name` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
@@ -96,7 +99,10 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `labels` (`obj`): GCP labels for this Feature. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): GCP labels for this Feature.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): The full, unique name of this Feature resource When `null`, the `name` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
diff --git a/docs/4.x/game_services_game_server_deployment.md b/docs/4.x/gke_hub_fleet.md
similarity index 53%
rename from docs/4.x/game_services_game_server_deployment.md
rename to docs/4.x/gke_hub_fleet.md
index bc1b3247..0fd18aed 100644
--- a/docs/4.x/game_services_game_server_deployment.md
+++ b/docs/4.x/gke_hub_fleet.md
@@ -1,10 +1,10 @@
 ---
-permalink: /game_services_game_server_deployment/
+permalink: /gke_hub_fleet/
 ---
 
-# game_services_game_server_deployment
+# gke_hub_fleet
 
-`game_services_game_server_deployment` represents the `google_game_services_game_server_deployment` Terraform resource.
+`gke_hub_fleet` represents the `google_gke_hub_fleet` Terraform resource.
 
 
 
@@ -15,10 +15,7 @@ This package contains functions and utilities for setting up the resource using
 
 * [`fn new()`](#fn-new)
 * [`fn newAttrs()`](#fn-newattrs)
-* [`fn withDeploymentId()`](#fn-withdeploymentid)
-* [`fn withDescription()`](#fn-withdescription)
-* [`fn withLabels()`](#fn-withlabels)
-* [`fn withLocation()`](#fn-withlocation)
+* [`fn withDisplayName()`](#fn-withdisplayname)
 * [`fn withProject()`](#fn-withproject)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
@@ -34,33 +31,30 @@ new()
 ```
 
 
-`google.game_services_game_server_deployment.new` injects a new `google_game_services_game_server_deployment` Terraform `resource`
+`google.gke_hub_fleet.new` injects a new `google_gke_hub_fleet` Terraform `resource`
 block into the root module document.
 
 Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
 resource. For example, if you added a new instance to the root using:
 
     # arguments omitted for brevity
-    google.game_services_game_server_deployment.new('some_id')
+    google.gke_hub_fleet.new('some_id')
 
-You can get the reference to the `id` field of the created `google.game_services_game_server_deployment` using the reference:
+You can get the reference to the `id` field of the created `google.gke_hub_fleet` using the reference:
 
-    $._ref.google_game_services_game_server_deployment.some_id.get('id')
+    $._ref.google_gke_hub_fleet.some_id.get('id')
 
-This is the same as directly entering `"${ google_game_services_game_server_deployment.some_id.id }"` as the value.
+This is the same as directly entering `"${ google_gke_hub_fleet.some_id.id }"` as the value.
 
 NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
 or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `deployment_id` (`string`): A unique id for the deployment.
-  - `description` (`string`): Human readable description of the game server deployment. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): The labels associated with this game server deployment. Each label is a
-key-value pair. When `null`, the `labels` field will be omitted from the resulting object.
-  - `location` (`string`): Location of the Deployment. When `null`, the `location` field will be omitted from the resulting object.
+  - `display_name` (`string`): A user-assigned display name of the Fleet. When present, it must be between 4 to 30 characters.
+Allowed characters are: lowercase and uppercase letters, numbers, hyphen, single-quote, double-quote, space, and exclamation point. When `null`, the `display_name` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
-  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_deployment.timeouts.new](#fn-timeoutsnew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_fleet.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
 - A mixin object that injects the new resource into the root Terraform configuration.
@@ -73,10 +67,10 @@ newAttrs()
 ```
 
 
-`google.game_services_game_server_deployment.newAttrs` constructs a new object with attributes and blocks configured for the `game_services_game_server_deployment`
+`google.gke_hub_fleet.newAttrs` constructs a new object with attributes and blocks configured for the `gke_hub_fleet`
 Terraform resource.
 
-Unlike [google.game_services_game_server_deployment.new](#fn-new), this function will not inject the `resource`
+Unlike [google.gke_hub_fleet.new](#fn-new), this function will not inject the `resource`
 block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
 [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
 
@@ -84,80 +78,29 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `deployment_id` (`string`): A unique id for the deployment.
-  - `description` (`string`): Human readable description of the game server deployment. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): The labels associated with this game server deployment. Each label is a
-key-value pair. When `null`, the `labels` field will be omitted from the resulting object.
-  - `location` (`string`): Location of the Deployment. When `null`, the `location` field will be omitted from the resulting object.
+  - `display_name` (`string`): A user-assigned display name of the Fleet. When present, it must be between 4 to 30 characters.
+Allowed characters are: lowercase and uppercase letters, numbers, hyphen, single-quote, double-quote, space, and exclamation point. When `null`, the `display_name` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
-  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.game_services_game_server_deployment.timeouts.new](#fn-timeoutsnew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_fleet.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
-  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `game_services_game_server_deployment` resource into the root Terraform configuration.
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_fleet` resource into the root Terraform configuration.
 
 
-### fn withDeploymentId
+### fn withDisplayName
 
 ```ts
-withDeploymentId()
+withDisplayName()
 ```
 
-`google.string.withDeploymentId` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the deployment_id field.
+`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the display_name field.
 
 
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `deployment_id` field.
-
-
-### fn withDescription
-
-```ts
-withDescription()
-```
-
-`google.string.withDescription` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the description field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `description` field.
-
-
-### fn withLabels
-
-```ts
-withLabels()
-```
-
-`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
-Terraform resource block to set or update the labels field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`obj`): The value to set for the `labels` field.
-
-
-### fn withLocation
-
-```ts
-withLocation()
-```
-
-`google.string.withLocation` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the location field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `location` field.
+  - `value` (`string`): The value to set for the `display_name` field.
 
 
 ### fn withProject
@@ -223,7 +166,7 @@ new()
 ```
 
 
-`google.game_services_game_server_deployment.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+`google.gke_hub_fleet.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
 Terraform sub block.
 
 
diff --git a/docs/4.x/gke_hub_membership.md b/docs/4.x/gke_hub_membership.md
index a956d279..c4544519 100644
--- a/docs/4.x/gke_hub_membership.md
+++ b/docs/4.x/gke_hub_membership.md
@@ -20,6 +20,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withEndpoint()`](#fn-withendpoint)
 * [`fn withEndpointMixin()`](#fn-withendpointmixin)
 * [`fn withLabels()`](#fn-withlabels)
+* [`fn withLocation()`](#fn-withlocation)
 * [`fn withMembershipId()`](#fn-withmembershipid)
 * [`fn withProject()`](#fn-withproject)
 * [`fn withTimeouts()`](#fn-withtimeouts)
@@ -62,7 +63,13 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `labels` (`obj`): Labels to apply to this membership. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels to apply to this membership.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): Location of the membership.
+The default value is 'global'. When `null`, the `location` field will be omitted from the resulting object.
   - `membership_id` (`string`): The client-provided identifier of the membership.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `authority` (`list[obj]`): Authority encodes how Google will recognize identities from this Membership.
@@ -93,7 +100,13 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `labels` (`obj`): Labels to apply to this membership. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels to apply to this membership.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `location` (`string`): Location of the membership.
+The default value is 'global'. When `null`, the `location` field will be omitted from the resulting object.
   - `membership_id` (`string`): The client-provided identifier of the membership.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `authority` (`list[obj]`): Authority encodes how Google will recognize identities from this Membership.
@@ -196,6 +209,22 @@ Terraform resource block to set or update the labels field.
   - `value` (`obj`): The value to set for the `labels` field.
 
 
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
 ### fn withMembershipId
 
 ```ts
diff --git a/docs/4.x/gke_hub_membership_binding.md b/docs/4.x/gke_hub_membership_binding.md
index 16c2cbc5..9fcaba26 100644
--- a/docs/4.x/gke_hub_membership_binding.md
+++ b/docs/4.x/gke_hub_membership_binding.md
@@ -55,7 +55,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `labels` (`obj`): Labels for this Membership binding. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels for this Membership binding.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): Location of the membership
   - `membership_binding_id` (`string`): The client-provided identifier of the membership binding.
   - `membership_id` (`string`): Id of the membership
@@ -86,7 +90,11 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `labels` (`obj`): Labels for this Membership binding. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels for this Membership binding.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): Location of the membership
   - `membership_binding_id` (`string`): The client-provided identifier of the membership binding.
   - `membership_id` (`string`): Id of the membership
diff --git a/docs/4.x/gke_hub_membership_iam_binding.md b/docs/4.x/gke_hub_membership_iam_binding.md
index 4cb96e86..6ada917c 100644
--- a/docs/4.x/gke_hub_membership_iam_binding.md
+++ b/docs/4.x/gke_hub_membership_iam_binding.md
@@ -17,6 +17,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn newAttrs()`](#fn-newattrs)
 * [`fn withCondition()`](#fn-withcondition)
 * [`fn withConditionMixin()`](#fn-withconditionmixin)
+* [`fn withLocation()`](#fn-withlocation)
 * [`fn withMembers()`](#fn-withmembers)
 * [`fn withMembershipId()`](#fn-withmembershipid)
 * [`fn withProject()`](#fn-withproject)
@@ -53,6 +54,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
+  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.
   - `members` (`list`): Set the `members` field on the resulting resource block.
   - `membership_id` (`string`): Set the `membership_id` field on the resulting resource block.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
@@ -81,6 +83,7 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
+  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.
   - `members` (`list`): Set the `members` field on the resulting object.
   - `membership_id` (`string`): Set the `membership_id` field on the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
@@ -128,6 +131,22 @@ function.
   - `value` (`list[obj]`): The value to set for the `condition` field.
 
 
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
 ### fn withMembers
 
 ```ts
diff --git a/docs/4.x/gke_hub_membership_iam_member.md b/docs/4.x/gke_hub_membership_iam_member.md
index b73c3564..33247ae0 100644
--- a/docs/4.x/gke_hub_membership_iam_member.md
+++ b/docs/4.x/gke_hub_membership_iam_member.md
@@ -17,6 +17,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn newAttrs()`](#fn-newattrs)
 * [`fn withCondition()`](#fn-withcondition)
 * [`fn withConditionMixin()`](#fn-withconditionmixin)
+* [`fn withLocation()`](#fn-withlocation)
 * [`fn withMember()`](#fn-withmember)
 * [`fn withMembershipId()`](#fn-withmembershipid)
 * [`fn withProject()`](#fn-withproject)
@@ -53,6 +54,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
+  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.
   - `member` (`string`): Set the `member` field on the resulting resource block.
   - `membership_id` (`string`): Set the `membership_id` field on the resulting resource block.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
@@ -81,6 +83,7 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
+  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.
   - `member` (`string`): Set the `member` field on the resulting object.
   - `membership_id` (`string`): Set the `membership_id` field on the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
@@ -128,6 +131,22 @@ function.
   - `value` (`list[obj]`): The value to set for the `condition` field.
 
 
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
 ### fn withMember
 
 ```ts
diff --git a/docs/4.x/gke_hub_membership_iam_policy.md b/docs/4.x/gke_hub_membership_iam_policy.md
index dc334b68..80fc657c 100644
--- a/docs/4.x/gke_hub_membership_iam_policy.md
+++ b/docs/4.x/gke_hub_membership_iam_policy.md
@@ -15,6 +15,7 @@ This package contains functions and utilities for setting up the resource using
 
 * [`fn new()`](#fn-new)
 * [`fn newAttrs()`](#fn-newattrs)
+* [`fn withLocation()`](#fn-withlocation)
 * [`fn withMembershipId()`](#fn-withmembershipid)
 * [`fn withPolicyData()`](#fn-withpolicydata)
 * [`fn withProject()`](#fn-withproject)
@@ -48,6 +49,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
+  - `location` (`string`): Set the `location` field on the resulting resource block. When `null`, the `location` field will be omitted from the resulting object.
   - `membership_id` (`string`): Set the `membership_id` field on the resulting resource block.
   - `policy_data` (`string`): Set the `policy_data` field on the resulting resource block.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
@@ -74,6 +76,7 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
+  - `location` (`string`): Set the `location` field on the resulting object. When `null`, the `location` field will be omitted from the resulting object.
   - `membership_id` (`string`): Set the `membership_id` field on the resulting object.
   - `policy_data` (`string`): Set the `policy_data` field on the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
@@ -82,6 +85,22 @@ injecting into a complete block.
   - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gke_hub_membership_iam_policy` resource into the root Terraform configuration.
 
 
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
 ### fn withMembershipId
 
 ```ts
diff --git a/docs/4.x/gke_hub_namespace.md b/docs/4.x/gke_hub_namespace.md
index 0b9fd050..f259b8e3 100644
--- a/docs/4.x/gke_hub_namespace.md
+++ b/docs/4.x/gke_hub_namespace.md
@@ -55,7 +55,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `labels` (`obj`): Labels for this Namespace. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels for this Namespace.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `namespace_labels` (`obj`): Namespace-level cluster namespace labels. These labels are applied
 to the related namespace of the member clusters bound to the parent
 Scope. Scope-level labels ('namespace_labels' in the Fleet Scope
@@ -89,7 +93,11 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `labels` (`obj`): Labels for this Namespace. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels for this Namespace.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `namespace_labels` (`obj`): Namespace-level cluster namespace labels. These labels are applied
 to the related namespace of the member clusters bound to the parent
 Scope. Scope-level labels ('namespace_labels' in the Fleet Scope
diff --git a/docs/4.x/gke_hub_scope.md b/docs/4.x/gke_hub_scope.md
index 854a4a5c..1f0169ea 100644
--- a/docs/4.x/gke_hub_scope.md
+++ b/docs/4.x/gke_hub_scope.md
@@ -52,7 +52,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `labels` (`obj`): Labels for this Scope. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels for this Scope.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `scope_id` (`string`): The client-provided identifier of the scope.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_scope.timeouts.new](#fn-timeoutsnew) constructor.
@@ -79,7 +83,11 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `labels` (`obj`): Labels for this Scope. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels for this Scope.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `scope_id` (`string`): The client-provided identifier of the scope.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gke_hub_scope.timeouts.new](#fn-timeoutsnew) constructor.
diff --git a/docs/4.x/gke_hub_scope_rbac_role_binding.md b/docs/4.x/gke_hub_scope_rbac_role_binding.md
index 267a0bea..51ee0424 100644
--- a/docs/4.x/gke_hub_scope_rbac_role_binding.md
+++ b/docs/4.x/gke_hub_scope_rbac_role_binding.md
@@ -62,7 +62,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `group` (`string`): Principal that is be authorized in the cluster (at least of one the oneof
 is required). Updating one will unset the other automatically.
 group is the group, as seen by the kubernetes cluster. When `null`, the `group` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels for this ScopeRBACRoleBinding. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels for this ScopeRBACRoleBinding.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `scope_id` (`string`): Id of the scope
   - `scope_rbac_role_binding_id` (`string`): The client-provided identifier of the RBAC Role Binding.
@@ -98,7 +102,11 @@ injecting into a complete block.
   - `group` (`string`): Principal that is be authorized in the cluster (at least of one the oneof
 is required). Updating one will unset the other automatically.
 group is the group, as seen by the kubernetes cluster. When `null`, the `group` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels for this ScopeRBACRoleBinding. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels for this ScopeRBACRoleBinding.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `scope_id` (`string`): Id of the scope
   - `scope_rbac_role_binding_id` (`string`): The client-provided identifier of the RBAC Role Binding.
diff --git a/docs/4.x/gkeonprem_bare_metal_admin_cluster.md b/docs/4.x/gkeonprem_bare_metal_admin_cluster.md
new file mode 100644
index 00000000..a6a0f74d
--- /dev/null
+++ b/docs/4.x/gkeonprem_bare_metal_admin_cluster.md
@@ -0,0 +1,1337 @@
+---
+permalink: /gkeonprem_bare_metal_admin_cluster/
+---
+
+# gkeonprem_bare_metal_admin_cluster
+
+`gkeonprem_bare_metal_admin_cluster` represents the `google_gkeonprem_bare_metal_admin_cluster` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withAnnotations()`](#fn-withannotations)
+* [`fn withBareMetalVersion()`](#fn-withbaremetalversion)
+* [`fn withClusterOperations()`](#fn-withclusteroperations)
+* [`fn withClusterOperationsMixin()`](#fn-withclusteroperationsmixin)
+* [`fn withControlPlane()`](#fn-withcontrolplane)
+* [`fn withControlPlaneMixin()`](#fn-withcontrolplanemixin)
+* [`fn withDescription()`](#fn-withdescription)
+* [`fn withLoadBalancer()`](#fn-withloadbalancer)
+* [`fn withLoadBalancerMixin()`](#fn-withloadbalancermixin)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withMaintenanceConfig()`](#fn-withmaintenanceconfig)
+* [`fn withMaintenanceConfigMixin()`](#fn-withmaintenanceconfigmixin)
+* [`fn withName()`](#fn-withname)
+* [`fn withNetworkConfig()`](#fn-withnetworkconfig)
+* [`fn withNetworkConfigMixin()`](#fn-withnetworkconfigmixin)
+* [`fn withNodeAccessConfig()`](#fn-withnodeaccessconfig)
+* [`fn withNodeAccessConfigMixin()`](#fn-withnodeaccessconfigmixin)
+* [`fn withNodeConfig()`](#fn-withnodeconfig)
+* [`fn withNodeConfigMixin()`](#fn-withnodeconfigmixin)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withProxy()`](#fn-withproxy)
+* [`fn withProxyMixin()`](#fn-withproxymixin)
+* [`fn withSecurityConfig()`](#fn-withsecurityconfig)
+* [`fn withSecurityConfigMixin()`](#fn-withsecurityconfigmixin)
+* [`fn withStorage()`](#fn-withstorage)
+* [`fn withStorageMixin()`](#fn-withstoragemixin)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj cluster_operations`](#obj-cluster_operations)
+  * [`fn new()`](#fn-cluster_operationsnew)
+* [`obj control_plane`](#obj-control_plane)
+  * [`fn new()`](#fn-control_planenew)
+  * [`obj control_plane.api_server_args`](#obj-control_planeapi_server_args)
+    * [`fn new()`](#fn-control_planeapi_server_argsnew)
+  * [`obj control_plane.control_plane_node_pool_config`](#obj-control_planecontrol_plane_node_pool_config)
+    * [`fn new()`](#fn-control_planecontrol_plane_node_pool_confignew)
+    * [`obj control_plane.control_plane_node_pool_config.node_pool_config`](#obj-control_planecontrol_plane_node_pool_confignode_pool_config)
+      * [`fn new()`](#fn-control_planecontrol_plane_node_pool_confignode_pool_confignew)
+      * [`obj control_plane.control_plane_node_pool_config.node_pool_config.node_configs`](#obj-control_planecontrol_plane_node_pool_confignode_pool_confignode_configs)
+        * [`fn new()`](#fn-control_planecontrol_plane_node_pool_confignode_pool_confignode_configsnew)
+      * [`obj control_plane.control_plane_node_pool_config.node_pool_config.taints`](#obj-control_planecontrol_plane_node_pool_confignode_pool_configtaints)
+        * [`fn new()`](#fn-control_planecontrol_plane_node_pool_confignode_pool_configtaintsnew)
+* [`obj load_balancer`](#obj-load_balancer)
+  * [`fn new()`](#fn-load_balancernew)
+  * [`obj load_balancer.manual_lb_config`](#obj-load_balancermanual_lb_config)
+    * [`fn new()`](#fn-load_balancermanual_lb_confignew)
+  * [`obj load_balancer.port_config`](#obj-load_balancerport_config)
+    * [`fn new()`](#fn-load_balancerport_confignew)
+  * [`obj load_balancer.vip_config`](#obj-load_balancervip_config)
+    * [`fn new()`](#fn-load_balancervip_confignew)
+* [`obj maintenance_config`](#obj-maintenance_config)
+  * [`fn new()`](#fn-maintenance_confignew)
+* [`obj network_config`](#obj-network_config)
+  * [`fn new()`](#fn-network_confignew)
+  * [`obj network_config.island_mode_cidr`](#obj-network_configisland_mode_cidr)
+    * [`fn new()`](#fn-network_configisland_mode_cidrnew)
+* [`obj node_access_config`](#obj-node_access_config)
+  * [`fn new()`](#fn-node_access_confignew)
+* [`obj node_config`](#obj-node_config)
+  * [`fn new()`](#fn-node_confignew)
+* [`obj proxy`](#obj-proxy)
+  * [`fn new()`](#fn-proxynew)
+* [`obj security_config`](#obj-security_config)
+  * [`fn new()`](#fn-security_confignew)
+  * [`obj security_config.authorization`](#obj-security_configauthorization)
+    * [`fn new()`](#fn-security_configauthorizationnew)
+    * [`obj security_config.authorization.admin_users`](#obj-security_configauthorizationadmin_users)
+      * [`fn new()`](#fn-security_configauthorizationadmin_usersnew)
+* [`obj storage`](#obj-storage)
+  * [`fn new()`](#fn-storagenew)
+  * [`obj storage.lvp_node_mounts_config`](#obj-storagelvp_node_mounts_config)
+    * [`fn new()`](#fn-storagelvp_node_mounts_confignew)
+  * [`obj storage.lvp_share_config`](#obj-storagelvp_share_config)
+    * [`fn new()`](#fn-storagelvp_share_confignew)
+    * [`obj storage.lvp_share_config.lvp_config`](#obj-storagelvp_share_configlvp_config)
+      * [`fn new()`](#fn-storagelvp_share_configlvp_confignew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.new` injects a new `google_gkeonprem_bare_metal_admin_cluster` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.gkeonprem_bare_metal_admin_cluster.new('some_id')
+
+You can get the reference to the `id` field of the created `google.gkeonprem_bare_metal_admin_cluster` using the reference:
+
+    $._ref.google_gkeonprem_bare_metal_admin_cluster.some_id.get('id')
+
+This is the same as directly entering `"${ google_gkeonprem_bare_metal_admin_cluster.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `annotations` (`obj`): Annotations on the Bare Metal Admin Cluster.
+This field has the same restrictions as Kubernetes annotations.
+The total size of all keys and values combined is limited to 256k.
+Key can have 2 segments: prefix (optional) and name (required),
+separated by a slash (/).
+Prefix must be a DNS subdomain.
+Name must be 63 characters or less, begin and end with alphanumerics,
+with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `bare_metal_version` (`string`): A human readable description of this Bare Metal Admin Cluster. When `null`, the `bare_metal_version` field will be omitted from the resulting object.
+  - `description` (`string`): A human readable description of this Bare Metal Admin Cluster. When `null`, the `description` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the resource.
+  - `name` (`string`): The bare metal admin cluster name.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `cluster_operations` (`list[obj]`): Specifies the Admin Cluster's observability infrastructure. When `null`, the `cluster_operations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.cluster_operations.new](#fn-cluster_operationsnew) constructor.
+  - `control_plane` (`list[obj]`): Specifies the control plane configuration. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.control_plane.new](#fn-control_planenew) constructor.
+  - `load_balancer` (`list[obj]`): Specifies the load balancer configuration. When `null`, the `load_balancer` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.load_balancer.new](#fn-load_balancernew) constructor.
+  - `maintenance_config` (`list[obj]`): Specifies the workload node configurations. When `null`, the `maintenance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.maintenance_config.new](#fn-maintenance_confignew) constructor.
+  - `network_config` (`list[obj]`): Network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.network_config.new](#fn-network_confignew) constructor.
+  - `node_access_config` (`list[obj]`): Specifies the node access related settings for the bare metal user cluster. When `null`, the `node_access_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.node_access_config.new](#fn-node_access_confignew) constructor.
+  - `node_config` (`list[obj]`): Specifies the workload node configurations. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.node_config.new](#fn-node_confignew) constructor.
+  - `proxy` (`list[obj]`): Specifies the cluster proxy configuration. When `null`, the `proxy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.proxy.new](#fn-proxynew) constructor.
+  - `security_config` (`list[obj]`): Specifies the security related settings for the Bare Metal User Cluster. When `null`, the `security_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.security_config.new](#fn-security_confignew) constructor.
+  - `storage` (`list[obj]`): Specifies the cluster storage configuration. When `null`, the `storage` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.storage.new](#fn-storagenew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `gkeonprem_bare_metal_admin_cluster`
+Terraform resource.
+
+Unlike [google.gkeonprem_bare_metal_admin_cluster.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `annotations` (`obj`): Annotations on the Bare Metal Admin Cluster.
+This field has the same restrictions as Kubernetes annotations.
+The total size of all keys and values combined is limited to 256k.
+Key can have 2 segments: prefix (optional) and name (required),
+separated by a slash (/).
+Prefix must be a DNS subdomain.
+Name must be 63 characters or less, begin and end with alphanumerics,
+with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `bare_metal_version` (`string`): A human readable description of this Bare Metal Admin Cluster. When `null`, the `bare_metal_version` field will be omitted from the resulting object.
+  - `description` (`string`): A human readable description of this Bare Metal Admin Cluster. When `null`, the `description` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the resource.
+  - `name` (`string`): The bare metal admin cluster name.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `cluster_operations` (`list[obj]`): Specifies the Admin Cluster's observability infrastructure. When `null`, the `cluster_operations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.cluster_operations.new](#fn-cluster_operationsnew) constructor.
+  - `control_plane` (`list[obj]`): Specifies the control plane configuration. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.control_plane.new](#fn-control_planenew) constructor.
+  - `load_balancer` (`list[obj]`): Specifies the load balancer configuration. When `null`, the `load_balancer` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.load_balancer.new](#fn-load_balancernew) constructor.
+  - `maintenance_config` (`list[obj]`): Specifies the workload node configurations. When `null`, the `maintenance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.maintenance_config.new](#fn-maintenance_confignew) constructor.
+  - `network_config` (`list[obj]`): Network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.network_config.new](#fn-network_confignew) constructor.
+  - `node_access_config` (`list[obj]`): Specifies the node access related settings for the bare metal user cluster. When `null`, the `node_access_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.node_access_config.new](#fn-node_access_confignew) constructor.
+  - `node_config` (`list[obj]`): Specifies the workload node configurations. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.node_config.new](#fn-node_confignew) constructor.
+  - `proxy` (`list[obj]`): Specifies the cluster proxy configuration. When `null`, the `proxy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.proxy.new](#fn-proxynew) constructor.
+  - `security_config` (`list[obj]`): Specifies the security related settings for the Bare Metal User Cluster. When `null`, the `security_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.security_config.new](#fn-security_confignew) constructor.
+  - `storage` (`list[obj]`): Specifies the cluster storage configuration. When `null`, the `storage` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.storage.new](#fn-storagenew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gkeonprem_bare_metal_admin_cluster` resource into the root Terraform configuration.
+
+
+### fn withAnnotations
+
+```ts
+withAnnotations()
+```
+
+`google.obj.withAnnotations` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the annotations field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `annotations` field.
+
+
+### fn withBareMetalVersion
+
+```ts
+withBareMetalVersion()
+```
+
+`google.string.withBareMetalVersion` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the bare_metal_version field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `bare_metal_version` field.
+
+
+### fn withClusterOperations
+
+```ts
+withClusterOperations()
+```
+
+`google.list[obj].withClusterOperations` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the cluster_operations field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withClusterOperationsMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `cluster_operations` field.
+
+
+### fn withClusterOperationsMixin
+
+```ts
+withClusterOperationsMixin()
+```
+
+`google.list[obj].withClusterOperationsMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the cluster_operations field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withClusterOperations](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `cluster_operations` field.
+
+
+### fn withControlPlane
+
+```ts
+withControlPlane()
+```
+
+`google.list[obj].withControlPlane` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the control_plane field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withControlPlaneMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `control_plane` field.
+
+
+### fn withControlPlaneMixin
+
+```ts
+withControlPlaneMixin()
+```
+
+`google.list[obj].withControlPlaneMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the control_plane field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withControlPlane](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `control_plane` field.
+
+
+### fn withDescription
+
+```ts
+withDescription()
+```
+
+`google.string.withDescription` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the description field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `description` field.
+
+
+### fn withLoadBalancer
+
+```ts
+withLoadBalancer()
+```
+
+`google.list[obj].withLoadBalancer` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the load_balancer field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withLoadBalancerMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `load_balancer` field.
+
+
+### fn withLoadBalancerMixin
+
+```ts
+withLoadBalancerMixin()
+```
+
+`google.list[obj].withLoadBalancerMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the load_balancer field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withLoadBalancer](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `load_balancer` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withMaintenanceConfig
+
+```ts
+withMaintenanceConfig()
+```
+
+`google.list[obj].withMaintenanceConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the maintenance_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withMaintenanceConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `maintenance_config` field.
+
+
+### fn withMaintenanceConfigMixin
+
+```ts
+withMaintenanceConfigMixin()
+```
+
+`google.list[obj].withMaintenanceConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the maintenance_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withMaintenanceConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `maintenance_config` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withNetworkConfig
+
+```ts
+withNetworkConfig()
+```
+
+`google.list[obj].withNetworkConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the network_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withNetworkConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `network_config` field.
+
+
+### fn withNetworkConfigMixin
+
+```ts
+withNetworkConfigMixin()
+```
+
+`google.list[obj].withNetworkConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the network_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withNetworkConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `network_config` field.
+
+
+### fn withNodeAccessConfig
+
+```ts
+withNodeAccessConfig()
+```
+
+`google.list[obj].withNodeAccessConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the node_access_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withNodeAccessConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `node_access_config` field.
+
+
+### fn withNodeAccessConfigMixin
+
+```ts
+withNodeAccessConfigMixin()
+```
+
+`google.list[obj].withNodeAccessConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the node_access_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withNodeAccessConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `node_access_config` field.
+
+
+### fn withNodeConfig
+
+```ts
+withNodeConfig()
+```
+
+`google.list[obj].withNodeConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the node_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withNodeConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `node_config` field.
+
+
+### fn withNodeConfigMixin
+
+```ts
+withNodeConfigMixin()
+```
+
+`google.list[obj].withNodeConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the node_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withNodeConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `node_config` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withProxy
+
+```ts
+withProxy()
+```
+
+`google.list[obj].withProxy` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the proxy field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withProxyMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `proxy` field.
+
+
+### fn withProxyMixin
+
+```ts
+withProxyMixin()
+```
+
+`google.list[obj].withProxyMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the proxy field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withProxy](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `proxy` field.
+
+
+### fn withSecurityConfig
+
+```ts
+withSecurityConfig()
+```
+
+`google.list[obj].withSecurityConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the security_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withSecurityConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `security_config` field.
+
+
+### fn withSecurityConfigMixin
+
+```ts
+withSecurityConfigMixin()
+```
+
+`google.list[obj].withSecurityConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the security_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withSecurityConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `security_config` field.
+
+
+### fn withStorage
+
+```ts
+withStorage()
+```
+
+`google.list[obj].withStorage` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the storage field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withStorageMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `storage` field.
+
+
+### fn withStorageMixin
+
+```ts
+withStorageMixin()
+```
+
+`google.list[obj].withStorageMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the storage field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withStorage](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `storage` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj cluster_operations
+
+
+
+### fn cluster_operations.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.cluster_operations.new` constructs a new object with attributes and blocks configured for the `cluster_operations`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enable_application_logs` (`bool`): Whether collection of application logs/metrics should be enabled (in addition to system logs/metrics). When `null`, the `enable_application_logs` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `cluster_operations` sub block.
+
+
+## obj control_plane
+
+
+
+### fn control_plane.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.control_plane.new` constructs a new object with attributes and blocks configured for the `control_plane`
+Terraform sub block.
+
+
+
+**Args**:
+  - `api_server_args` (`list[obj]`): Customizes the default API server args. Only a subset of
+customized flags are supported. Please refer to the API server
+documentation below to know the exact format:
+https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/ When `null`, the `api_server_args` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.control_plane.api_server_args.new](#fn-control_planeapi_server_argsnew) constructor.
+  - `control_plane_node_pool_config` (`list[obj]`): Configures the node pool running the control plane. If specified the corresponding NodePool will be created for the cluster's control plane. The NodePool will have the same name and namespace as the cluster. When `null`, the `control_plane_node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.control_plane.control_plane_node_pool_config.new](#fn-control_planecontrol_plane_node_pool_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `control_plane` sub block.
+
+
+## obj control_plane.api_server_args
+
+
+
+### fn control_plane.api_server_args.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.control_plane.api_server_args.new` constructs a new object with attributes and blocks configured for the `api_server_args`
+Terraform sub block.
+
+
+
+**Args**:
+  - `argument` (`string`): The argument name as it appears on the API Server command line please make sure to remove the leading dashes.
+  - `value` (`string`): The value of the arg as it will be passed to the API Server command line.
+
+**Returns**:
+  - An attribute object that represents the `api_server_args` sub block.
+
+
+## obj control_plane.control_plane_node_pool_config
+
+
+
+### fn control_plane.control_plane_node_pool_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.control_plane.control_plane_node_pool_config.new` constructs a new object with attributes and blocks configured for the `control_plane_node_pool_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `node_pool_config` (`list[obj]`): The generic configuration for a node pool running the control plane. When `null`, the `node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.control_plane.control_plane_node_pool_config.node_pool_config.new](#fn-control_planecontrol_planenode_pool_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `control_plane_node_pool_config` sub block.
+
+
+## obj control_plane.control_plane_node_pool_config.node_pool_config
+
+
+
+### fn control_plane.control_plane_node_pool_config.node_pool_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.control_plane.control_plane_node_pool_config.node_pool_config.new` constructs a new object with attributes and blocks configured for the `node_pool_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to
+each node. These will added in addition to any default label(s)
+that Kubernetes may apply to the node. In case of conflict in
+label keys, the applied set may differ depending on the Kubernetes
+version -- it's best to assume the behavior is undefined and
+conflicts should be avoided. For more information, including usage
+and the valid values, see:
+  http://kubernetes.io/v1.1/docs/user-guide/labels.html
+An object containing a list of "key": value pairs.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+  - `operating_system` (`string`): Specifies the nodes operating system (default: LINUX). When `null`, the `operating_system` field will be omitted from the resulting object.
+  - `node_configs` (`list[obj]`): The list of machine addresses in the Bare Metal Node Pool. When `null`, the `node_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.control_plane.control_plane_node_pool_config.node_pool_config.node_configs.new](#fn-control_planecontrol_planecontrol_plane_node_pool_confignode_configsnew) constructor.
+  - `taints` (`list[obj]`): The initial taints assigned to nodes of this node pool. When `null`, the `taints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.control_plane.control_plane_node_pool_config.node_pool_config.taints.new](#fn-control_planecontrol_planecontrol_plane_node_pool_configtaintsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `node_pool_config` sub block.
+
+
+## obj control_plane.control_plane_node_pool_config.node_pool_config.node_configs
+
+
+
+### fn control_plane.control_plane_node_pool_config.node_pool_config.node_configs.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.control_plane.control_plane_node_pool_config.node_pool_config.node_configs.new` constructs a new object with attributes and blocks configured for the `node_configs`
+Terraform sub block.
+
+
+
+**Args**:
+  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to
+each node. These will added in addition to any default label(s)
+that Kubernetes may apply to the node. In case of conflict in
+label keys, the applied set may differ depending on the Kubernetes
+version -- it's best to assume the behavior is undefined and
+conflicts should be avoided. For more information, including usage
+and the valid values, see:
+  http://kubernetes.io/v1.1/docs/user-guide/labels.html
+An object containing a list of "key": value pairs.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+  - `node_ip` (`string`): The default IPv4 address for SSH access and Kubernetes node.
+Example: 192.168.0.1 When `null`, the `node_ip` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `node_configs` sub block.
+
+
+## obj control_plane.control_plane_node_pool_config.node_pool_config.taints
+
+
+
+### fn control_plane.control_plane_node_pool_config.node_pool_config.taints.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.control_plane.control_plane_node_pool_config.node_pool_config.taints.new` constructs a new object with attributes and blocks configured for the `taints`
+Terraform sub block.
+
+
+
+**Args**:
+  - `effect` (`string`): Specifies the nodes operating system (default: LINUX). Possible values: ["EFFECT_UNSPECIFIED", "PREFER_NO_SCHEDULE", "NO_EXECUTE"] When `null`, the `effect` field will be omitted from the resulting object.
+  - `key` (`string`): Key associated with the effect. When `null`, the `key` field will be omitted from the resulting object.
+  - `value` (`string`): Value associated with the effect. When `null`, the `value` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `taints` sub block.
+
+
+## obj load_balancer
+
+
+
+### fn load_balancer.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.load_balancer.new` constructs a new object with attributes and blocks configured for the `load_balancer`
+Terraform sub block.
+
+
+
+**Args**:
+  - `manual_lb_config` (`list[obj]`): A nested object resource When `null`, the `manual_lb_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.load_balancer.manual_lb_config.new](#fn-load_balancermanual_lb_confignew) constructor.
+  - `port_config` (`list[obj]`): Specifies the load balancer ports. When `null`, the `port_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.load_balancer.port_config.new](#fn-load_balancerport_confignew) constructor.
+  - `vip_config` (`list[obj]`): Specified the Bare Metal Load Balancer Config When `null`, the `vip_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.load_balancer.vip_config.new](#fn-load_balancervip_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `load_balancer` sub block.
+
+
+## obj load_balancer.manual_lb_config
+
+
+
+### fn load_balancer.manual_lb_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.load_balancer.manual_lb_config.new` constructs a new object with attributes and blocks configured for the `manual_lb_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enabled` (`bool`): Whether manual load balancing is enabled.
+
+**Returns**:
+  - An attribute object that represents the `manual_lb_config` sub block.
+
+
+## obj load_balancer.port_config
+
+
+
+### fn load_balancer.port_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.load_balancer.port_config.new` constructs a new object with attributes and blocks configured for the `port_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `control_plane_load_balancer_port` (`number`): The port that control plane hosted load balancers will listen on.
+
+**Returns**:
+  - An attribute object that represents the `port_config` sub block.
+
+
+## obj load_balancer.vip_config
+
+
+
+### fn load_balancer.vip_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.load_balancer.vip_config.new` constructs a new object with attributes and blocks configured for the `vip_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `control_plane_vip` (`string`): The VIP which you previously set aside for the Kubernetes API of this Bare Metal Admin Cluster.
+
+**Returns**:
+  - An attribute object that represents the `vip_config` sub block.
+
+
+## obj maintenance_config
+
+
+
+### fn maintenance_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.maintenance_config.new` constructs a new object with attributes and blocks configured for the `maintenance_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `maintenance_address_cidr_blocks` (`list`): All IPv4 address from these ranges will be placed into maintenance mode.
+Nodes in maintenance mode will be cordoned and drained. When both of these
+are true, the "baremetal.cluster.gke.io/maintenance" annotation will be set
+on the node resource.
+
+**Returns**:
+  - An attribute object that represents the `maintenance_config` sub block.
+
+
+## obj network_config
+
+
+
+### fn network_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.network_config.new` constructs a new object with attributes and blocks configured for the `network_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `island_mode_cidr` (`list[obj]`): A nested object resource When `null`, the `island_mode_cidr` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.network_config.island_mode_cidr.new](#fn-network_configisland_mode_cidrnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `network_config` sub block.
+
+
+## obj network_config.island_mode_cidr
+
+
+
+### fn network_config.island_mode_cidr.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.network_config.island_mode_cidr.new` constructs a new object with attributes and blocks configured for the `island_mode_cidr`
+Terraform sub block.
+
+
+
+**Args**:
+  - `pod_address_cidr_blocks` (`list`): All pods in the cluster are assigned an RFC1918 IPv4 address from these ranges. This field cannot be changed after creation.
+  - `service_address_cidr_blocks` (`list`): All services in the cluster are assigned an RFC1918 IPv4 address from these ranges. This field cannot be changed after creation.
+
+**Returns**:
+  - An attribute object that represents the `island_mode_cidr` sub block.
+
+
+## obj node_access_config
+
+
+
+### fn node_access_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.node_access_config.new` constructs a new object with attributes and blocks configured for the `node_access_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `login_user` (`string`): LoginUser is the user name used to access node machines.
+It defaults to "root" if not set. When `null`, the `login_user` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `node_access_config` sub block.
+
+
+## obj node_config
+
+
+
+### fn node_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.node_config.new` constructs a new object with attributes and blocks configured for the `node_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `max_pods_per_node` (`number`): The maximum number of pods a node can run. The size of the CIDR range
+assigned to the node will be derived from this parameter. When `null`, the `max_pods_per_node` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `node_config` sub block.
+
+
+## obj proxy
+
+
+
+### fn proxy.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.proxy.new` constructs a new object with attributes and blocks configured for the `proxy`
+Terraform sub block.
+
+
+
+**Args**:
+  - `no_proxy` (`list`): A list of IPs, hostnames, and domains that should skip the proxy.
+Examples: ["127.0.0.1", "example.com", ".corp", "localhost"]. When `null`, the `no_proxy` field will be omitted from the resulting object.
+  - `uri` (`string`): Specifies the address of your proxy server.
+Examples: http://domain
+WARNING: Do not provide credentials in the format
+http://(username:password@)domain these will be rejected by the server.
+
+**Returns**:
+  - An attribute object that represents the `proxy` sub block.
+
+
+## obj security_config
+
+
+
+### fn security_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.security_config.new` constructs a new object with attributes and blocks configured for the `security_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `authorization` (`list[obj]`): Configures user access to the Bare Metal User cluster. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.security_config.authorization.new](#fn-security_configauthorizationnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `security_config` sub block.
+
+
+## obj security_config.authorization
+
+
+
+### fn security_config.authorization.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.security_config.authorization.new` constructs a new object with attributes and blocks configured for the `authorization`
+Terraform sub block.
+
+
+
+**Args**:
+  - `admin_users` (`list[obj]`): Users that will be granted the cluster-admin role on the cluster, providing full access to the cluster. When `null`, the `admin_users` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.security_config.authorization.admin_users.new](#fn-security_configsecurity_configadmin_usersnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `authorization` sub block.
+
+
+## obj security_config.authorization.admin_users
+
+
+
+### fn security_config.authorization.admin_users.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.security_config.authorization.admin_users.new` constructs a new object with attributes and blocks configured for the `admin_users`
+Terraform sub block.
+
+
+
+**Args**:
+  - `username` (`string`): The name of the user, e.g. 'my-gcp-id@gmail.com'.
+
+**Returns**:
+  - An attribute object that represents the `admin_users` sub block.
+
+
+## obj storage
+
+
+
+### fn storage.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.storage.new` constructs a new object with attributes and blocks configured for the `storage`
+Terraform sub block.
+
+
+
+**Args**:
+  - `lvp_node_mounts_config` (`list[obj]`): Specifies the config for local PersistentVolumes backed
+by mounted node disks. These disks need to be formatted and mounted by the
+user, which can be done before or after cluster creation. When `null`, the `lvp_node_mounts_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.storage.lvp_node_mounts_config.new](#fn-storagelvp_node_mounts_confignew) constructor.
+  - `lvp_share_config` (`list[obj]`): Specifies the config for local PersistentVolumes backed by
+subdirectories in a shared filesystem. These subdirectores are
+automatically created during cluster creation. When `null`, the `lvp_share_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.storage.lvp_share_config.new](#fn-storagelvp_share_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `storage` sub block.
+
+
+## obj storage.lvp_node_mounts_config
+
+
+
+### fn storage.lvp_node_mounts_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.storage.lvp_node_mounts_config.new` constructs a new object with attributes and blocks configured for the `lvp_node_mounts_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `path` (`string`): The host machine path.
+  - `storage_class` (`string`): The StorageClass name that PVs will be created with.
+
+**Returns**:
+  - An attribute object that represents the `lvp_node_mounts_config` sub block.
+
+
+## obj storage.lvp_share_config
+
+
+
+### fn storage.lvp_share_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.storage.lvp_share_config.new` constructs a new object with attributes and blocks configured for the `lvp_share_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `shared_path_pv_count` (`number`): The number of subdirectories to create under path. When `null`, the `shared_path_pv_count` field will be omitted from the resulting object.
+  - `lvp_config` (`list[obj]`): Defines the machine path and storage class for the LVP Share. When `null`, the `lvp_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_admin_cluster.storage.lvp_share_config.lvp_config.new](#fn-storagestoragelvp_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `lvp_share_config` sub block.
+
+
+## obj storage.lvp_share_config.lvp_config
+
+
+
+### fn storage.lvp_share_config.lvp_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.storage.lvp_share_config.lvp_config.new` constructs a new object with attributes and blocks configured for the `lvp_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `path` (`string`): The host machine path.
+  - `storage_class` (`string`): The StorageClass name that PVs will be created with.
+
+**Returns**:
+  - An attribute object that represents the `lvp_config` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_admin_cluster.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/gkeonprem_bare_metal_cluster.md b/docs/4.x/gkeonprem_bare_metal_cluster.md
new file mode 100644
index 00000000..a935b900
--- /dev/null
+++ b/docs/4.x/gkeonprem_bare_metal_cluster.md
@@ -0,0 +1,2066 @@
+---
+permalink: /gkeonprem_bare_metal_cluster/
+---
+
+# gkeonprem_bare_metal_cluster
+
+`gkeonprem_bare_metal_cluster` represents the `google_gkeonprem_bare_metal_cluster` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withAdminClusterMembership()`](#fn-withadminclustermembership)
+* [`fn withAnnotations()`](#fn-withannotations)
+* [`fn withBareMetalVersion()`](#fn-withbaremetalversion)
+* [`fn withBinaryAuthorization()`](#fn-withbinaryauthorization)
+* [`fn withBinaryAuthorizationMixin()`](#fn-withbinaryauthorizationmixin)
+* [`fn withClusterOperations()`](#fn-withclusteroperations)
+* [`fn withClusterOperationsMixin()`](#fn-withclusteroperationsmixin)
+* [`fn withControlPlane()`](#fn-withcontrolplane)
+* [`fn withControlPlaneMixin()`](#fn-withcontrolplanemixin)
+* [`fn withDescription()`](#fn-withdescription)
+* [`fn withLoadBalancer()`](#fn-withloadbalancer)
+* [`fn withLoadBalancerMixin()`](#fn-withloadbalancermixin)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withMaintenanceConfig()`](#fn-withmaintenanceconfig)
+* [`fn withMaintenanceConfigMixin()`](#fn-withmaintenanceconfigmixin)
+* [`fn withName()`](#fn-withname)
+* [`fn withNetworkConfig()`](#fn-withnetworkconfig)
+* [`fn withNetworkConfigMixin()`](#fn-withnetworkconfigmixin)
+* [`fn withNodeAccessConfig()`](#fn-withnodeaccessconfig)
+* [`fn withNodeAccessConfigMixin()`](#fn-withnodeaccessconfigmixin)
+* [`fn withNodeConfig()`](#fn-withnodeconfig)
+* [`fn withNodeConfigMixin()`](#fn-withnodeconfigmixin)
+* [`fn withOsEnvironmentConfig()`](#fn-withosenvironmentconfig)
+* [`fn withOsEnvironmentConfigMixin()`](#fn-withosenvironmentconfigmixin)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withProxy()`](#fn-withproxy)
+* [`fn withProxyMixin()`](#fn-withproxymixin)
+* [`fn withSecurityConfig()`](#fn-withsecurityconfig)
+* [`fn withSecurityConfigMixin()`](#fn-withsecurityconfigmixin)
+* [`fn withStorage()`](#fn-withstorage)
+* [`fn withStorageMixin()`](#fn-withstoragemixin)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withUpgradePolicy()`](#fn-withupgradepolicy)
+* [`fn withUpgradePolicyMixin()`](#fn-withupgradepolicymixin)
+* [`obj binary_authorization`](#obj-binary_authorization)
+  * [`fn new()`](#fn-binary_authorizationnew)
+* [`obj cluster_operations`](#obj-cluster_operations)
+  * [`fn new()`](#fn-cluster_operationsnew)
+* [`obj control_plane`](#obj-control_plane)
+  * [`fn new()`](#fn-control_planenew)
+  * [`obj control_plane.api_server_args`](#obj-control_planeapi_server_args)
+    * [`fn new()`](#fn-control_planeapi_server_argsnew)
+  * [`obj control_plane.control_plane_node_pool_config`](#obj-control_planecontrol_plane_node_pool_config)
+    * [`fn new()`](#fn-control_planecontrol_plane_node_pool_confignew)
+    * [`obj control_plane.control_plane_node_pool_config.node_pool_config`](#obj-control_planecontrol_plane_node_pool_confignode_pool_config)
+      * [`fn new()`](#fn-control_planecontrol_plane_node_pool_confignode_pool_confignew)
+      * [`obj control_plane.control_plane_node_pool_config.node_pool_config.node_configs`](#obj-control_planecontrol_plane_node_pool_confignode_pool_confignode_configs)
+        * [`fn new()`](#fn-control_planecontrol_plane_node_pool_confignode_pool_confignode_configsnew)
+      * [`obj control_plane.control_plane_node_pool_config.node_pool_config.taints`](#obj-control_planecontrol_plane_node_pool_confignode_pool_configtaints)
+        * [`fn new()`](#fn-control_planecontrol_plane_node_pool_confignode_pool_configtaintsnew)
+* [`obj load_balancer`](#obj-load_balancer)
+  * [`fn new()`](#fn-load_balancernew)
+  * [`obj load_balancer.bgp_lb_config`](#obj-load_balancerbgp_lb_config)
+    * [`fn new()`](#fn-load_balancerbgp_lb_confignew)
+    * [`obj load_balancer.bgp_lb_config.address_pools`](#obj-load_balancerbgp_lb_configaddress_pools)
+      * [`fn new()`](#fn-load_balancerbgp_lb_configaddress_poolsnew)
+    * [`obj load_balancer.bgp_lb_config.bgp_peer_configs`](#obj-load_balancerbgp_lb_configbgp_peer_configs)
+      * [`fn new()`](#fn-load_balancerbgp_lb_configbgp_peer_configsnew)
+    * [`obj load_balancer.bgp_lb_config.load_balancer_node_pool_config`](#obj-load_balancerbgp_lb_configload_balancer_node_pool_config)
+      * [`fn new()`](#fn-load_balancerbgp_lb_configload_balancer_node_pool_confignew)
+      * [`obj load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config`](#obj-load_balancerbgp_lb_configload_balancer_node_pool_confignode_pool_config)
+        * [`fn new()`](#fn-load_balancerbgp_lb_configload_balancer_node_pool_confignode_pool_confignew)
+        * [`obj load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.kubelet_config`](#obj-load_balancerbgp_lb_configload_balancer_node_pool_confignode_pool_configkubelet_config)
+          * [`fn new()`](#fn-load_balancerbgp_lb_configload_balancer_node_pool_confignode_pool_configkubelet_confignew)
+        * [`obj load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.node_configs`](#obj-load_balancerbgp_lb_configload_balancer_node_pool_confignode_pool_confignode_configs)
+          * [`fn new()`](#fn-load_balancerbgp_lb_configload_balancer_node_pool_confignode_pool_confignode_configsnew)
+        * [`obj load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.taints`](#obj-load_balancerbgp_lb_configload_balancer_node_pool_confignode_pool_configtaints)
+          * [`fn new()`](#fn-load_balancerbgp_lb_configload_balancer_node_pool_confignode_pool_configtaintsnew)
+  * [`obj load_balancer.manual_lb_config`](#obj-load_balancermanual_lb_config)
+    * [`fn new()`](#fn-load_balancermanual_lb_confignew)
+  * [`obj load_balancer.metal_lb_config`](#obj-load_balancermetal_lb_config)
+    * [`fn new()`](#fn-load_balancermetal_lb_confignew)
+    * [`obj load_balancer.metal_lb_config.address_pools`](#obj-load_balancermetal_lb_configaddress_pools)
+      * [`fn new()`](#fn-load_balancermetal_lb_configaddress_poolsnew)
+    * [`obj load_balancer.metal_lb_config.load_balancer_node_pool_config`](#obj-load_balancermetal_lb_configload_balancer_node_pool_config)
+      * [`fn new()`](#fn-load_balancermetal_lb_configload_balancer_node_pool_confignew)
+      * [`obj load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config`](#obj-load_balancermetal_lb_configload_balancer_node_pool_confignode_pool_config)
+        * [`fn new()`](#fn-load_balancermetal_lb_configload_balancer_node_pool_confignode_pool_confignew)
+        * [`obj load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.node_configs`](#obj-load_balancermetal_lb_configload_balancer_node_pool_confignode_pool_confignode_configs)
+          * [`fn new()`](#fn-load_balancermetal_lb_configload_balancer_node_pool_confignode_pool_confignode_configsnew)
+        * [`obj load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.taints`](#obj-load_balancermetal_lb_configload_balancer_node_pool_confignode_pool_configtaints)
+          * [`fn new()`](#fn-load_balancermetal_lb_configload_balancer_node_pool_confignode_pool_configtaintsnew)
+  * [`obj load_balancer.port_config`](#obj-load_balancerport_config)
+    * [`fn new()`](#fn-load_balancerport_confignew)
+  * [`obj load_balancer.vip_config`](#obj-load_balancervip_config)
+    * [`fn new()`](#fn-load_balancervip_confignew)
+* [`obj maintenance_config`](#obj-maintenance_config)
+  * [`fn new()`](#fn-maintenance_confignew)
+* [`obj network_config`](#obj-network_config)
+  * [`fn new()`](#fn-network_confignew)
+  * [`obj network_config.island_mode_cidr`](#obj-network_configisland_mode_cidr)
+    * [`fn new()`](#fn-network_configisland_mode_cidrnew)
+  * [`obj network_config.multiple_network_interfaces_config`](#obj-network_configmultiple_network_interfaces_config)
+    * [`fn new()`](#fn-network_configmultiple_network_interfaces_confignew)
+  * [`obj network_config.sr_iov_config`](#obj-network_configsr_iov_config)
+    * [`fn new()`](#fn-network_configsr_iov_confignew)
+* [`obj node_access_config`](#obj-node_access_config)
+  * [`fn new()`](#fn-node_access_confignew)
+* [`obj node_config`](#obj-node_config)
+  * [`fn new()`](#fn-node_confignew)
+* [`obj os_environment_config`](#obj-os_environment_config)
+  * [`fn new()`](#fn-os_environment_confignew)
+* [`obj proxy`](#obj-proxy)
+  * [`fn new()`](#fn-proxynew)
+* [`obj security_config`](#obj-security_config)
+  * [`fn new()`](#fn-security_confignew)
+  * [`obj security_config.authorization`](#obj-security_configauthorization)
+    * [`fn new()`](#fn-security_configauthorizationnew)
+    * [`obj security_config.authorization.admin_users`](#obj-security_configauthorizationadmin_users)
+      * [`fn new()`](#fn-security_configauthorizationadmin_usersnew)
+* [`obj storage`](#obj-storage)
+  * [`fn new()`](#fn-storagenew)
+  * [`obj storage.lvp_node_mounts_config`](#obj-storagelvp_node_mounts_config)
+    * [`fn new()`](#fn-storagelvp_node_mounts_confignew)
+  * [`obj storage.lvp_share_config`](#obj-storagelvp_share_config)
+    * [`fn new()`](#fn-storagelvp_share_confignew)
+    * [`obj storage.lvp_share_config.lvp_config`](#obj-storagelvp_share_configlvp_config)
+      * [`fn new()`](#fn-storagelvp_share_configlvp_confignew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+* [`obj upgrade_policy`](#obj-upgrade_policy)
+  * [`fn new()`](#fn-upgrade_policynew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.new` injects a new `google_gkeonprem_bare_metal_cluster` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.gkeonprem_bare_metal_cluster.new('some_id')
+
+You can get the reference to the `id` field of the created `google.gkeonprem_bare_metal_cluster` using the reference:
+
+    $._ref.google_gkeonprem_bare_metal_cluster.some_id.get('id')
+
+This is the same as directly entering `"${ google_gkeonprem_bare_metal_cluster.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `admin_cluster_membership` (`string`): The Admin Cluster this Bare Metal User Cluster belongs to.
+This is the full resource name of the Admin Cluster's hub membership.
+  - `annotations` (`obj`): Annotations on the Bare Metal User Cluster.
+This field has the same restrictions as Kubernetes annotations.
+The total size of all keys and values combined is limited to 256k.
+Key can have 2 segments: prefix (optional) and name (required),
+separated by a slash (/).
+Prefix must be a DNS subdomain.
+Name must be 63 characters or less, begin and end with alphanumerics,
+with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `bare_metal_version` (`string`): A human readable description of this Bare Metal User Cluster.
+  - `description` (`string`): A human readable description of this Bare Metal User Cluster. When `null`, the `description` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the resource.
+  - `name` (`string`): The bare metal cluster name.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `binary_authorization` (`list[obj]`): Binary Authorization related configurations. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.binary_authorization.new](#fn-binary_authorizationnew) constructor.
+  - `cluster_operations` (`list[obj]`): Specifies the User Cluster's observability infrastructure. When `null`, the `cluster_operations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.cluster_operations.new](#fn-cluster_operationsnew) constructor.
+  - `control_plane` (`list[obj]`): Specifies the control plane configuration. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.control_plane.new](#fn-control_planenew) constructor.
+  - `load_balancer` (`list[obj]`): Specifies the load balancer configuration. When `null`, the `load_balancer` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.new](#fn-load_balancernew) constructor.
+  - `maintenance_config` (`list[obj]`): Specifies the workload node configurations. When `null`, the `maintenance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.maintenance_config.new](#fn-maintenance_confignew) constructor.
+  - `network_config` (`list[obj]`): Network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.network_config.new](#fn-network_confignew) constructor.
+  - `node_access_config` (`list[obj]`): Specifies the node access related settings for the bare metal user cluster. When `null`, the `node_access_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.node_access_config.new](#fn-node_access_confignew) constructor.
+  - `node_config` (`list[obj]`): Specifies the workload node configurations. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.node_config.new](#fn-node_confignew) constructor.
+  - `os_environment_config` (`list[obj]`): OS environment related configurations. When `null`, the `os_environment_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.os_environment_config.new](#fn-os_environment_confignew) constructor.
+  - `proxy` (`list[obj]`): Specifies the cluster proxy configuration. When `null`, the `proxy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.proxy.new](#fn-proxynew) constructor.
+  - `security_config` (`list[obj]`): Specifies the security related settings for the Bare Metal User Cluster. When `null`, the `security_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.security_config.new](#fn-security_confignew) constructor.
+  - `storage` (`list[obj]`): Specifies the cluster storage configuration. When `null`, the `storage` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.storage.new](#fn-storagenew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.timeouts.new](#fn-timeoutsnew) constructor.
+  - `upgrade_policy` (`list[obj]`): The cluster upgrade policy. When `null`, the `upgrade_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.upgrade_policy.new](#fn-upgrade_policynew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `gkeonprem_bare_metal_cluster`
+Terraform resource.
+
+Unlike [google.gkeonprem_bare_metal_cluster.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `admin_cluster_membership` (`string`): The Admin Cluster this Bare Metal User Cluster belongs to.
+This is the full resource name of the Admin Cluster's hub membership.
+  - `annotations` (`obj`): Annotations on the Bare Metal User Cluster.
+This field has the same restrictions as Kubernetes annotations.
+The total size of all keys and values combined is limited to 256k.
+Key can have 2 segments: prefix (optional) and name (required),
+separated by a slash (/).
+Prefix must be a DNS subdomain.
+Name must be 63 characters or less, begin and end with alphanumerics,
+with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `bare_metal_version` (`string`): A human readable description of this Bare Metal User Cluster.
+  - `description` (`string`): A human readable description of this Bare Metal User Cluster. When `null`, the `description` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the resource.
+  - `name` (`string`): The bare metal cluster name.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `binary_authorization` (`list[obj]`): Binary Authorization related configurations. When `null`, the `binary_authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.binary_authorization.new](#fn-binary_authorizationnew) constructor.
+  - `cluster_operations` (`list[obj]`): Specifies the User Cluster's observability infrastructure. When `null`, the `cluster_operations` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.cluster_operations.new](#fn-cluster_operationsnew) constructor.
+  - `control_plane` (`list[obj]`): Specifies the control plane configuration. When `null`, the `control_plane` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.control_plane.new](#fn-control_planenew) constructor.
+  - `load_balancer` (`list[obj]`): Specifies the load balancer configuration. When `null`, the `load_balancer` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.new](#fn-load_balancernew) constructor.
+  - `maintenance_config` (`list[obj]`): Specifies the workload node configurations. When `null`, the `maintenance_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.maintenance_config.new](#fn-maintenance_confignew) constructor.
+  - `network_config` (`list[obj]`): Network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.network_config.new](#fn-network_confignew) constructor.
+  - `node_access_config` (`list[obj]`): Specifies the node access related settings for the bare metal user cluster. When `null`, the `node_access_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.node_access_config.new](#fn-node_access_confignew) constructor.
+  - `node_config` (`list[obj]`): Specifies the workload node configurations. When `null`, the `node_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.node_config.new](#fn-node_confignew) constructor.
+  - `os_environment_config` (`list[obj]`): OS environment related configurations. When `null`, the `os_environment_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.os_environment_config.new](#fn-os_environment_confignew) constructor.
+  - `proxy` (`list[obj]`): Specifies the cluster proxy configuration. When `null`, the `proxy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.proxy.new](#fn-proxynew) constructor.
+  - `security_config` (`list[obj]`): Specifies the security related settings for the Bare Metal User Cluster. When `null`, the `security_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.security_config.new](#fn-security_confignew) constructor.
+  - `storage` (`list[obj]`): Specifies the cluster storage configuration. When `null`, the `storage` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.storage.new](#fn-storagenew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.timeouts.new](#fn-timeoutsnew) constructor.
+  - `upgrade_policy` (`list[obj]`): The cluster upgrade policy. When `null`, the `upgrade_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.upgrade_policy.new](#fn-upgrade_policynew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gkeonprem_bare_metal_cluster` resource into the root Terraform configuration.
+
+
+### fn withAdminClusterMembership
+
+```ts
+withAdminClusterMembership()
+```
+
+`google.string.withAdminClusterMembership` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the admin_cluster_membership field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `admin_cluster_membership` field.
+
+
+### fn withAnnotations
+
+```ts
+withAnnotations()
+```
+
+`google.obj.withAnnotations` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the annotations field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `annotations` field.
+
+
+### fn withBareMetalVersion
+
+```ts
+withBareMetalVersion()
+```
+
+`google.string.withBareMetalVersion` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the bare_metal_version field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `bare_metal_version` field.
+
+
+### fn withBinaryAuthorization
+
+```ts
+withBinaryAuthorization()
+```
+
+`google.list[obj].withBinaryAuthorization` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the binary_authorization field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withBinaryAuthorizationMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `binary_authorization` field.
+
+
+### fn withBinaryAuthorizationMixin
+
+```ts
+withBinaryAuthorizationMixin()
+```
+
+`google.list[obj].withBinaryAuthorizationMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the binary_authorization field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withBinaryAuthorization](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `binary_authorization` field.
+
+
+### fn withClusterOperations
+
+```ts
+withClusterOperations()
+```
+
+`google.list[obj].withClusterOperations` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the cluster_operations field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withClusterOperationsMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `cluster_operations` field.
+
+
+### fn withClusterOperationsMixin
+
+```ts
+withClusterOperationsMixin()
+```
+
+`google.list[obj].withClusterOperationsMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the cluster_operations field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withClusterOperations](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `cluster_operations` field.
+
+
+### fn withControlPlane
+
+```ts
+withControlPlane()
+```
+
+`google.list[obj].withControlPlane` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the control_plane field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withControlPlaneMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `control_plane` field.
+
+
+### fn withControlPlaneMixin
+
+```ts
+withControlPlaneMixin()
+```
+
+`google.list[obj].withControlPlaneMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the control_plane field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withControlPlane](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `control_plane` field.
+
+
+### fn withDescription
+
+```ts
+withDescription()
+```
+
+`google.string.withDescription` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the description field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `description` field.
+
+
+### fn withLoadBalancer
+
+```ts
+withLoadBalancer()
+```
+
+`google.list[obj].withLoadBalancer` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the load_balancer field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withLoadBalancerMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `load_balancer` field.
+
+
+### fn withLoadBalancerMixin
+
+```ts
+withLoadBalancerMixin()
+```
+
+`google.list[obj].withLoadBalancerMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the load_balancer field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withLoadBalancer](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `load_balancer` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withMaintenanceConfig
+
+```ts
+withMaintenanceConfig()
+```
+
+`google.list[obj].withMaintenanceConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the maintenance_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withMaintenanceConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `maintenance_config` field.
+
+
+### fn withMaintenanceConfigMixin
+
+```ts
+withMaintenanceConfigMixin()
+```
+
+`google.list[obj].withMaintenanceConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the maintenance_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withMaintenanceConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `maintenance_config` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withNetworkConfig
+
+```ts
+withNetworkConfig()
+```
+
+`google.list[obj].withNetworkConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the network_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withNetworkConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `network_config` field.
+
+
+### fn withNetworkConfigMixin
+
+```ts
+withNetworkConfigMixin()
+```
+
+`google.list[obj].withNetworkConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the network_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withNetworkConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `network_config` field.
+
+
+### fn withNodeAccessConfig
+
+```ts
+withNodeAccessConfig()
+```
+
+`google.list[obj].withNodeAccessConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the node_access_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withNodeAccessConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `node_access_config` field.
+
+
+### fn withNodeAccessConfigMixin
+
+```ts
+withNodeAccessConfigMixin()
+```
+
+`google.list[obj].withNodeAccessConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the node_access_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withNodeAccessConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `node_access_config` field.
+
+
+### fn withNodeConfig
+
+```ts
+withNodeConfig()
+```
+
+`google.list[obj].withNodeConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the node_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withNodeConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `node_config` field.
+
+
+### fn withNodeConfigMixin
+
+```ts
+withNodeConfigMixin()
+```
+
+`google.list[obj].withNodeConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the node_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withNodeConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `node_config` field.
+
+
+### fn withOsEnvironmentConfig
+
+```ts
+withOsEnvironmentConfig()
+```
+
+`google.list[obj].withOsEnvironmentConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the os_environment_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withOsEnvironmentConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `os_environment_config` field.
+
+
+### fn withOsEnvironmentConfigMixin
+
+```ts
+withOsEnvironmentConfigMixin()
+```
+
+`google.list[obj].withOsEnvironmentConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the os_environment_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withOsEnvironmentConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `os_environment_config` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withProxy
+
+```ts
+withProxy()
+```
+
+`google.list[obj].withProxy` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the proxy field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withProxyMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `proxy` field.
+
+
+### fn withProxyMixin
+
+```ts
+withProxyMixin()
+```
+
+`google.list[obj].withProxyMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the proxy field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withProxy](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `proxy` field.
+
+
+### fn withSecurityConfig
+
+```ts
+withSecurityConfig()
+```
+
+`google.list[obj].withSecurityConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the security_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withSecurityConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `security_config` field.
+
+
+### fn withSecurityConfigMixin
+
+```ts
+withSecurityConfigMixin()
+```
+
+`google.list[obj].withSecurityConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the security_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withSecurityConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `security_config` field.
+
+
+### fn withStorage
+
+```ts
+withStorage()
+```
+
+`google.list[obj].withStorage` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the storage field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withStorageMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `storage` field.
+
+
+### fn withStorageMixin
+
+```ts
+withStorageMixin()
+```
+
+`google.list[obj].withStorageMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the storage field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withStorage](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `storage` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withUpgradePolicy
+
+```ts
+withUpgradePolicy()
+```
+
+`google.list[obj].withUpgradePolicy` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the upgrade_policy field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withUpgradePolicyMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `upgrade_policy` field.
+
+
+### fn withUpgradePolicyMixin
+
+```ts
+withUpgradePolicyMixin()
+```
+
+`google.list[obj].withUpgradePolicyMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the upgrade_policy field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withUpgradePolicy](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `upgrade_policy` field.
+
+
+## obj binary_authorization
+
+
+
+### fn binary_authorization.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.binary_authorization.new` constructs a new object with attributes and blocks configured for the `binary_authorization`
+Terraform sub block.
+
+
+
+**Args**:
+  - `evaluation_mode` (`string`): Mode of operation for binauthz policy evaluation. If unspecified,
+defaults to DISABLED. Possible values: ["DISABLED", "PROJECT_SINGLETON_POLICY_ENFORCE"] When `null`, the `evaluation_mode` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `binary_authorization` sub block.
+
+
+## obj cluster_operations
+
+
+
+### fn cluster_operations.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.cluster_operations.new` constructs a new object with attributes and blocks configured for the `cluster_operations`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enable_application_logs` (`bool`): Whether collection of application logs/metrics should be enabled (in addition to system logs/metrics). When `null`, the `enable_application_logs` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `cluster_operations` sub block.
+
+
+## obj control_plane
+
+
+
+### fn control_plane.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.control_plane.new` constructs a new object with attributes and blocks configured for the `control_plane`
+Terraform sub block.
+
+
+
+**Args**:
+  - `api_server_args` (`list[obj]`): Customizes the default API server args. Only a subset of
+customized flags are supported. Please refer to the API server
+documentation below to know the exact format:
+https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/ When `null`, the `api_server_args` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.control_plane.api_server_args.new](#fn-control_planeapi_server_argsnew) constructor.
+  - `control_plane_node_pool_config` (`list[obj]`): Configures the node pool running the control plane. If specified the corresponding NodePool will be created for the cluster's control plane. The NodePool will have the same name and namespace as the cluster. When `null`, the `control_plane_node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.control_plane.control_plane_node_pool_config.new](#fn-control_planecontrol_plane_node_pool_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `control_plane` sub block.
+
+
+## obj control_plane.api_server_args
+
+
+
+### fn control_plane.api_server_args.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.control_plane.api_server_args.new` constructs a new object with attributes and blocks configured for the `api_server_args`
+Terraform sub block.
+
+
+
+**Args**:
+  - `argument` (`string`): The argument name as it appears on the API Server command line please make sure to remove the leading dashes.
+  - `value` (`string`): The value of the arg as it will be passed to the API Server command line.
+
+**Returns**:
+  - An attribute object that represents the `api_server_args` sub block.
+
+
+## obj control_plane.control_plane_node_pool_config
+
+
+
+### fn control_plane.control_plane_node_pool_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.control_plane.control_plane_node_pool_config.new` constructs a new object with attributes and blocks configured for the `control_plane_node_pool_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `node_pool_config` (`list[obj]`): The generic configuration for a node pool running the control plane. When `null`, the `node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.control_plane.control_plane_node_pool_config.node_pool_config.new](#fn-control_planecontrol_planenode_pool_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `control_plane_node_pool_config` sub block.
+
+
+## obj control_plane.control_plane_node_pool_config.node_pool_config
+
+
+
+### fn control_plane.control_plane_node_pool_config.node_pool_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.control_plane.control_plane_node_pool_config.node_pool_config.new` constructs a new object with attributes and blocks configured for the `node_pool_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to
+each node. These will added in addition to any default label(s)
+that Kubernetes may apply to the node. In case of conflict in
+label keys, the applied set may differ depending on the Kubernetes
+version -- it's best to assume the behavior is undefined and
+conflicts should be avoided. For more information, including usage
+and the valid values, see:
+  http://kubernetes.io/v1.1/docs/user-guide/labels.html
+An object containing a list of "key": value pairs.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+  - `operating_system` (`string`): Specifies the nodes operating system (default: LINUX). When `null`, the `operating_system` field will be omitted from the resulting object.
+  - `node_configs` (`list[obj]`): The list of machine addresses in the Bare Metal Node Pool. When `null`, the `node_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.control_plane.control_plane_node_pool_config.node_pool_config.node_configs.new](#fn-control_planecontrol_planecontrol_plane_node_pool_confignode_configsnew) constructor.
+  - `taints` (`list[obj]`): The initial taints assigned to nodes of this node pool. When `null`, the `taints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.control_plane.control_plane_node_pool_config.node_pool_config.taints.new](#fn-control_planecontrol_planecontrol_plane_node_pool_configtaintsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `node_pool_config` sub block.
+
+
+## obj control_plane.control_plane_node_pool_config.node_pool_config.node_configs
+
+
+
+### fn control_plane.control_plane_node_pool_config.node_pool_config.node_configs.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.control_plane.control_plane_node_pool_config.node_pool_config.node_configs.new` constructs a new object with attributes and blocks configured for the `node_configs`
+Terraform sub block.
+
+
+
+**Args**:
+  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to
+each node. These will added in addition to any default label(s)
+that Kubernetes may apply to the node. In case of conflict in
+label keys, the applied set may differ depending on the Kubernetes
+version -- it's best to assume the behavior is undefined and
+conflicts should be avoided. For more information, including usage
+and the valid values, see:
+  http://kubernetes.io/v1.1/docs/user-guide/labels.html
+An object containing a list of "key": value pairs.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+  - `node_ip` (`string`): The default IPv4 address for SSH access and Kubernetes node.
+Example: 192.168.0.1 When `null`, the `node_ip` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `node_configs` sub block.
+
+
+## obj control_plane.control_plane_node_pool_config.node_pool_config.taints
+
+
+
+### fn control_plane.control_plane_node_pool_config.node_pool_config.taints.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.control_plane.control_plane_node_pool_config.node_pool_config.taints.new` constructs a new object with attributes and blocks configured for the `taints`
+Terraform sub block.
+
+
+
+**Args**:
+  - `effect` (`string`): Specifies the nodes operating system (default: LINUX). Possible values: ["EFFECT_UNSPECIFIED", "PREFER_NO_SCHEDULE", "NO_EXECUTE"] When `null`, the `effect` field will be omitted from the resulting object.
+  - `key` (`string`): Key associated with the effect. When `null`, the `key` field will be omitted from the resulting object.
+  - `value` (`string`): Value associated with the effect. When `null`, the `value` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `taints` sub block.
+
+
+## obj load_balancer
+
+
+
+### fn load_balancer.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.new` constructs a new object with attributes and blocks configured for the `load_balancer`
+Terraform sub block.
+
+
+
+**Args**:
+  - `bgp_lb_config` (`list[obj]`): Configuration for BGP typed load balancers. When `null`, the `bgp_lb_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.new](#fn-load_balancerbgp_lb_confignew) constructor.
+  - `manual_lb_config` (`list[obj]`): A nested object resource When `null`, the `manual_lb_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.manual_lb_config.new](#fn-load_balancermanual_lb_confignew) constructor.
+  - `metal_lb_config` (`list[obj]`): A nested object resource When `null`, the `metal_lb_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.new](#fn-load_balancermetal_lb_confignew) constructor.
+  - `port_config` (`list[obj]`): Specifies the load balancer ports. When `null`, the `port_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.port_config.new](#fn-load_balancerport_confignew) constructor.
+  - `vip_config` (`list[obj]`): Specified the Bare Metal Load Balancer Config When `null`, the `vip_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.vip_config.new](#fn-load_balancervip_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `load_balancer` sub block.
+
+
+## obj load_balancer.bgp_lb_config
+
+
+
+### fn load_balancer.bgp_lb_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.new` constructs a new object with attributes and blocks configured for the `bgp_lb_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `asn` (`number`): BGP autonomous system number (ASN) of the cluster.
+This field can be updated after cluster creation.
+  - `address_pools` (`list[obj]`): AddressPools is a list of non-overlapping IP pools used by load balancer
+typed services. All addresses must be routable to load balancer nodes.
+IngressVIP must be included in the pools. When `null`, the `address_pools` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.address_pools.new](#fn-load_balancerload_balanceraddress_poolsnew) constructor.
+  - `bgp_peer_configs` (`list[obj]`): The list of BGP peers that the cluster will connect to.
+At least one peer must be configured for each control plane node.
+Control plane nodes will connect to these peers to advertise the control
+plane VIP. The Services load balancer also uses these peers by default.
+This field can be updated after cluster creation. When `null`, the `bgp_peer_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.bgp_peer_configs.new](#fn-load_balancerload_balancerbgp_peer_configsnew) constructor.
+  - `load_balancer_node_pool_config` (`list[obj]`): Specifies the node pool running data plane load balancing. L2 connectivity
+is required among nodes in this pool. If missing, the control plane node
+pool is used for data plane load balancing. When `null`, the `load_balancer_node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.new](#fn-load_balancerload_balancerload_balancer_node_pool_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `bgp_lb_config` sub block.
+
+
+## obj load_balancer.bgp_lb_config.address_pools
+
+
+
+### fn load_balancer.bgp_lb_config.address_pools.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.address_pools.new` constructs a new object with attributes and blocks configured for the `address_pools`
+Terraform sub block.
+
+
+
+**Args**:
+  - `addresses` (`list`): The addresses that are part of this pool. Each address must be either in the CIDR form (1.2.3.0/24) or range form (1.2.3.1-1.2.3.5).
+  - `avoid_buggy_ips` (`bool`): If true, avoid using IPs ending in .0 or .255.
+This avoids buggy consumer devices mistakenly dropping IPv4 traffic for those special IP addresses. When `null`, the `avoid_buggy_ips` field will be omitted from the resulting object.
+  - `manual_assign` (`string`): If true, prevent IP addresses from being automatically assigned. When `null`, the `manual_assign` field will be omitted from the resulting object.
+  - `pool` (`string`): The name of the address pool.
+
+**Returns**:
+  - An attribute object that represents the `address_pools` sub block.
+
+
+## obj load_balancer.bgp_lb_config.bgp_peer_configs
+
+
+
+### fn load_balancer.bgp_lb_config.bgp_peer_configs.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.bgp_peer_configs.new` constructs a new object with attributes and blocks configured for the `bgp_peer_configs`
+Terraform sub block.
+
+
+
+**Args**:
+  - `asn` (`number`): BGP autonomous system number (ASN) for the network that contains the
+external peer device.
+  - `control_plane_nodes` (`list`): The IP address of the control plane node that connects to the external
+peer.
+If you don't specify any control plane nodes, all control plane nodes
+can connect to the external peer. If you specify one or more IP addresses,
+only the nodes specified participate in peering sessions. When `null`, the `control_plane_nodes` field will be omitted from the resulting object.
+  - `ip_address` (`string`): The IP address of the external peer device.
+
+**Returns**:
+  - An attribute object that represents the `bgp_peer_configs` sub block.
+
+
+## obj load_balancer.bgp_lb_config.load_balancer_node_pool_config
+
+
+
+### fn load_balancer.bgp_lb_config.load_balancer_node_pool_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.new` constructs a new object with attributes and blocks configured for the `load_balancer_node_pool_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `node_pool_config` (`list[obj]`): The generic configuration for a node pool running a load balancer. When `null`, the `node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.new](#fn-load_balancerload_balancerbgp_lb_confignode_pool_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `load_balancer_node_pool_config` sub block.
+
+
+## obj load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config
+
+
+
+### fn load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.new` constructs a new object with attributes and blocks configured for the `node_pool_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to
+each node. These will added in addition to any default label(s)
+that Kubernetes may apply to the node. In case of conflict in
+label keys, the applied set may differ depending on the Kubernetes
+version -- it's best to assume the behavior is undefined and
+conflicts should be avoided. For more information, including usage
+and the valid values, see:
+  http://kubernetes.io/v1.1/docs/user-guide/labels.html
+An object containing a list of "key": value pairs.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+  - `operating_system` (`string`): Specifies the nodes operating system (default: LINUX). When `null`, the `operating_system` field will be omitted from the resulting object.
+  - `kubelet_config` (`list[obj]`): The modifiable kubelet configurations for the baremetal machines. When `null`, the `kubelet_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.kubelet_config.new](#fn-load_balancerload_balancerbgp_lb_configload_balancer_node_pool_configkubelet_confignew) constructor.
+  - `node_configs` (`list[obj]`): The list of machine addresses in the Bare Metal Node Pool. When `null`, the `node_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.node_configs.new](#fn-load_balancerload_balancerbgp_lb_configload_balancer_node_pool_confignode_configsnew) constructor.
+  - `taints` (`list[obj]`): The initial taints assigned to nodes of this node pool. When `null`, the `taints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.taints.new](#fn-load_balancerload_balancerbgp_lb_configload_balancer_node_pool_configtaintsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `node_pool_config` sub block.
+
+
+## obj load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.kubelet_config
+
+
+
+### fn load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.kubelet_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.kubelet_config.new` constructs a new object with attributes and blocks configured for the `kubelet_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `registry_burst` (`number`): The maximum size of bursty pulls, temporarily allows pulls to burst to this
+number, while still not exceeding registry_pull_qps.
+The value must not be a negative number.
+Updating this field may impact scalability by changing the amount of
+traffic produced by image pulls.
+Defaults to 10. When `null`, the `registry_burst` field will be omitted from the resulting object.
+  - `registry_pull_qps` (`number`): The limit of registry pulls per second.
+Setting this value to 0 means no limit.
+Updating this field may impact scalability by changing the amount of
+traffic produced by image pulls.
+Defaults to 5. When `null`, the `registry_pull_qps` field will be omitted from the resulting object.
+  - `serialize_image_pulls_disabled` (`bool`): Prevents the Kubelet from pulling multiple images at a time.
+We recommend *not* changing the default value on nodes that run docker
+daemon with version  < 1.9 or an Another Union File System (Aufs) storage
+backend. Issue https://github.com/kubernetes/kubernetes/issues/10959 has
+more details. When `null`, the `serialize_image_pulls_disabled` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `kubelet_config` sub block.
+
+
+## obj load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.node_configs
+
+
+
+### fn load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.node_configs.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.node_configs.new` constructs a new object with attributes and blocks configured for the `node_configs`
+Terraform sub block.
+
+
+
+**Args**:
+  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to
+each node. These will added in addition to any default label(s)
+that Kubernetes may apply to the node. In case of conflict in
+label keys, the applied set may differ depending on the Kubernetes
+version -- it's best to assume the behavior is undefined and
+conflicts should be avoided. For more information, including usage
+and the valid values, see:
+  http://kubernetes.io/v1.1/docs/user-guide/labels.html
+An object containing a list of "key": value pairs.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+  - `node_ip` (`string`): The default IPv4 address for SSH access and Kubernetes node.
+Example: 192.168.0.1 When `null`, the `node_ip` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `node_configs` sub block.
+
+
+## obj load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.taints
+
+
+
+### fn load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.taints.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.bgp_lb_config.load_balancer_node_pool_config.node_pool_config.taints.new` constructs a new object with attributes and blocks configured for the `taints`
+Terraform sub block.
+
+
+
+**Args**:
+  - `effect` (`string`): Specifies the nodes operating system (default: LINUX). Possible values: ["EFFECT_UNSPECIFIED", "PREFER_NO_SCHEDULE", "NO_EXECUTE"] When `null`, the `effect` field will be omitted from the resulting object.
+  - `key` (`string`): Key associated with the effect. When `null`, the `key` field will be omitted from the resulting object.
+  - `value` (`string`): Value associated with the effect. When `null`, the `value` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `taints` sub block.
+
+
+## obj load_balancer.manual_lb_config
+
+
+
+### fn load_balancer.manual_lb_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.manual_lb_config.new` constructs a new object with attributes and blocks configured for the `manual_lb_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enabled` (`bool`): Whether manual load balancing is enabled.
+
+**Returns**:
+  - An attribute object that represents the `manual_lb_config` sub block.
+
+
+## obj load_balancer.metal_lb_config
+
+
+
+### fn load_balancer.metal_lb_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.new` constructs a new object with attributes and blocks configured for the `metal_lb_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `address_pools` (`list[obj]`): AddressPools is a list of non-overlapping IP pools used by load balancer
+typed services. All addresses must be routable to load balancer nodes.
+IngressVIP must be included in the pools. When `null`, the `address_pools` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.address_pools.new](#fn-load_balancerload_balanceraddress_poolsnew) constructor.
+  - `load_balancer_node_pool_config` (`list[obj]`): Specifies the load balancer's node pool configuration. When `null`, the `load_balancer_node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.load_balancer_node_pool_config.new](#fn-load_balancerload_balancerload_balancer_node_pool_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `metal_lb_config` sub block.
+
+
+## obj load_balancer.metal_lb_config.address_pools
+
+
+
+### fn load_balancer.metal_lb_config.address_pools.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.address_pools.new` constructs a new object with attributes and blocks configured for the `address_pools`
+Terraform sub block.
+
+
+
+**Args**:
+  - `addresses` (`list`): The addresses that are part of this pool. Each address must be either in the CIDR form (1.2.3.0/24) or range form (1.2.3.1-1.2.3.5).
+  - `avoid_buggy_ips` (`bool`): If true, avoid using IPs ending in .0 or .255.
+This avoids buggy consumer devices mistakenly dropping IPv4 traffic for those special IP addresses. When `null`, the `avoid_buggy_ips` field will be omitted from the resulting object.
+  - `manual_assign` (`bool`): If true, prevent IP addresses from being automatically assigned. When `null`, the `manual_assign` field will be omitted from the resulting object.
+  - `pool` (`string`): The name of the address pool.
+
+**Returns**:
+  - An attribute object that represents the `address_pools` sub block.
+
+
+## obj load_balancer.metal_lb_config.load_balancer_node_pool_config
+
+
+
+### fn load_balancer.metal_lb_config.load_balancer_node_pool_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.load_balancer_node_pool_config.new` constructs a new object with attributes and blocks configured for the `load_balancer_node_pool_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `node_pool_config` (`list[obj]`): The generic configuration for a node pool running a load balancer. When `null`, the `node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.new](#fn-load_balancerload_balancermetal_lb_confignode_pool_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `load_balancer_node_pool_config` sub block.
+
+
+## obj load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config
+
+
+
+### fn load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.new` constructs a new object with attributes and blocks configured for the `node_pool_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to
+each node. These will added in addition to any default label(s)
+that Kubernetes may apply to the node. In case of conflict in
+label keys, the applied set may differ depending on the Kubernetes
+version -- it's best to assume the behavior is undefined and
+conflicts should be avoided. For more information, including usage
+and the valid values, see:
+  http://kubernetes.io/v1.1/docs/user-guide/labels.html
+An object containing a list of "key": value pairs.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+  - `operating_system` (`string`): Specifies the nodes operating system (default: LINUX). When `null`, the `operating_system` field will be omitted from the resulting object.
+  - `node_configs` (`list[obj]`): The list of machine addresses in the Bare Metal Node Pool. When `null`, the `node_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.node_configs.new](#fn-load_balancerload_balancermetal_lb_configload_balancer_node_pool_confignode_configsnew) constructor.
+  - `taints` (`list[obj]`): The initial taints assigned to nodes of this node pool. When `null`, the `taints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.taints.new](#fn-load_balancerload_balancermetal_lb_configload_balancer_node_pool_configtaintsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `node_pool_config` sub block.
+
+
+## obj load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.node_configs
+
+
+
+### fn load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.node_configs.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.node_configs.new` constructs a new object with attributes and blocks configured for the `node_configs`
+Terraform sub block.
+
+
+
+**Args**:
+  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to
+each node. These will added in addition to any default label(s)
+that Kubernetes may apply to the node. In case of conflict in
+label keys, the applied set may differ depending on the Kubernetes
+version -- it's best to assume the behavior is undefined and
+conflicts should be avoided. For more information, including usage
+and the valid values, see:
+  http://kubernetes.io/v1.1/docs/user-guide/labels.html
+An object containing a list of "key": value pairs.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+  - `node_ip` (`string`): The default IPv4 address for SSH access and Kubernetes node.
+Example: 192.168.0.1 When `null`, the `node_ip` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `node_configs` sub block.
+
+
+## obj load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.taints
+
+
+
+### fn load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.taints.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.metal_lb_config.load_balancer_node_pool_config.node_pool_config.taints.new` constructs a new object with attributes and blocks configured for the `taints`
+Terraform sub block.
+
+
+
+**Args**:
+  - `effect` (`string`): Specifies the nodes operating system (default: LINUX). Possible values: ["EFFECT_UNSPECIFIED", "PREFER_NO_SCHEDULE", "NO_EXECUTE"] When `null`, the `effect` field will be omitted from the resulting object.
+  - `key` (`string`): Key associated with the effect. When `null`, the `key` field will be omitted from the resulting object.
+  - `value` (`string`): Value associated with the effect. When `null`, the `value` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `taints` sub block.
+
+
+## obj load_balancer.port_config
+
+
+
+### fn load_balancer.port_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.port_config.new` constructs a new object with attributes and blocks configured for the `port_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `control_plane_load_balancer_port` (`number`): The port that control plane hosted load balancers will listen on.
+
+**Returns**:
+  - An attribute object that represents the `port_config` sub block.
+
+
+## obj load_balancer.vip_config
+
+
+
+### fn load_balancer.vip_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.load_balancer.vip_config.new` constructs a new object with attributes and blocks configured for the `vip_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `control_plane_vip` (`string`): The VIP which you previously set aside for the Kubernetes API of this Bare Metal User Cluster.
+  - `ingress_vip` (`string`): The VIP which you previously set aside for ingress traffic into this Bare Metal User Cluster.
+
+**Returns**:
+  - An attribute object that represents the `vip_config` sub block.
+
+
+## obj maintenance_config
+
+
+
+### fn maintenance_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.maintenance_config.new` constructs a new object with attributes and blocks configured for the `maintenance_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `maintenance_address_cidr_blocks` (`list`): All IPv4 address from these ranges will be placed into maintenance mode.
+Nodes in maintenance mode will be cordoned and drained. When both of these
+are true, the "baremetal.cluster.gke.io/maintenance" annotation will be set
+on the node resource.
+
+**Returns**:
+  - An attribute object that represents the `maintenance_config` sub block.
+
+
+## obj network_config
+
+
+
+### fn network_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.network_config.new` constructs a new object with attributes and blocks configured for the `network_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `advanced_networking` (`bool`): Enables the use of advanced Anthos networking features, such as Bundled
+Load Balancing with BGP or the egress NAT gateway.
+Setting configuration for advanced networking features will automatically
+set this flag. When `null`, the `advanced_networking` field will be omitted from the resulting object.
+  - `island_mode_cidr` (`list[obj]`): A nested object resource When `null`, the `island_mode_cidr` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.network_config.island_mode_cidr.new](#fn-network_configisland_mode_cidrnew) constructor.
+  - `multiple_network_interfaces_config` (`list[obj]`): Configuration for multiple network interfaces. When `null`, the `multiple_network_interfaces_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.network_config.multiple_network_interfaces_config.new](#fn-network_configmultiple_network_interfaces_confignew) constructor.
+  - `sr_iov_config` (`list[obj]`): Configuration for SR-IOV. When `null`, the `sr_iov_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.network_config.sr_iov_config.new](#fn-network_configsr_iov_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `network_config` sub block.
+
+
+## obj network_config.island_mode_cidr
+
+
+
+### fn network_config.island_mode_cidr.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.network_config.island_mode_cidr.new` constructs a new object with attributes and blocks configured for the `island_mode_cidr`
+Terraform sub block.
+
+
+
+**Args**:
+  - `pod_address_cidr_blocks` (`list`): All pods in the cluster are assigned an RFC1918 IPv4 address from these ranges. This field cannot be changed after creation.
+  - `service_address_cidr_blocks` (`list`): All services in the cluster are assigned an RFC1918 IPv4 address from these ranges. This field cannot be changed after creation.
+
+**Returns**:
+  - An attribute object that represents the `island_mode_cidr` sub block.
+
+
+## obj network_config.multiple_network_interfaces_config
+
+
+
+### fn network_config.multiple_network_interfaces_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.network_config.multiple_network_interfaces_config.new` constructs a new object with attributes and blocks configured for the `multiple_network_interfaces_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enabled` (`bool`): Whether to enable multiple network interfaces for your pods.
+When set network_config.advanced_networking is automatically
+set to true. When `null`, the `enabled` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `multiple_network_interfaces_config` sub block.
+
+
+## obj network_config.sr_iov_config
+
+
+
+### fn network_config.sr_iov_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.network_config.sr_iov_config.new` constructs a new object with attributes and blocks configured for the `sr_iov_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enabled` (`bool`): Whether to install the SR-IOV operator. When `null`, the `enabled` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `sr_iov_config` sub block.
+
+
+## obj node_access_config
+
+
+
+### fn node_access_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.node_access_config.new` constructs a new object with attributes and blocks configured for the `node_access_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `login_user` (`string`): LoginUser is the user name used to access node machines.
+It defaults to "root" if not set. When `null`, the `login_user` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `node_access_config` sub block.
+
+
+## obj node_config
+
+
+
+### fn node_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.node_config.new` constructs a new object with attributes and blocks configured for the `node_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `container_runtime` (`string`): The available runtimes that can be used to run containers in a Bare Metal User Cluster. Possible values: ["CONTAINER_RUNTIME_UNSPECIFIED", "DOCKER", "CONTAINERD"] When `null`, the `container_runtime` field will be omitted from the resulting object.
+  - `max_pods_per_node` (`number`): The maximum number of pods a node can run. The size of the CIDR range
+assigned to the node will be derived from this parameter. When `null`, the `max_pods_per_node` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `node_config` sub block.
+
+
+## obj os_environment_config
+
+
+
+### fn os_environment_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.os_environment_config.new` constructs a new object with attributes and blocks configured for the `os_environment_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `package_repo_excluded` (`bool`): Whether the package repo should not be included when initializing
+bare metal machines.
+
+**Returns**:
+  - An attribute object that represents the `os_environment_config` sub block.
+
+
+## obj proxy
+
+
+
+### fn proxy.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.proxy.new` constructs a new object with attributes and blocks configured for the `proxy`
+Terraform sub block.
+
+
+
+**Args**:
+  - `no_proxy` (`list`): A list of IPs, hostnames, and domains that should skip the proxy.
+Examples: ["127.0.0.1", "example.com", ".corp", "localhost"]. When `null`, the `no_proxy` field will be omitted from the resulting object.
+  - `uri` (`string`): Specifies the address of your proxy server.
+Examples: http://domain
+WARNING: Do not provide credentials in the format
+http://(username:password@)domain these will be rejected by the server.
+
+**Returns**:
+  - An attribute object that represents the `proxy` sub block.
+
+
+## obj security_config
+
+
+
+### fn security_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.security_config.new` constructs a new object with attributes and blocks configured for the `security_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `authorization` (`list[obj]`): Configures user access to the Bare Metal User cluster. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.security_config.authorization.new](#fn-security_configauthorizationnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `security_config` sub block.
+
+
+## obj security_config.authorization
+
+
+
+### fn security_config.authorization.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.security_config.authorization.new` constructs a new object with attributes and blocks configured for the `authorization`
+Terraform sub block.
+
+
+
+**Args**:
+  - `admin_users` (`list[obj]`): Users that will be granted the cluster-admin role on the cluster, providing full access to the cluster. When `null`, the `admin_users` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.security_config.authorization.admin_users.new](#fn-security_configsecurity_configadmin_usersnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `authorization` sub block.
+
+
+## obj security_config.authorization.admin_users
+
+
+
+### fn security_config.authorization.admin_users.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.security_config.authorization.admin_users.new` constructs a new object with attributes and blocks configured for the `admin_users`
+Terraform sub block.
+
+
+
+**Args**:
+  - `username` (`string`): The name of the user, e.g. 'my-gcp-id@gmail.com'.
+
+**Returns**:
+  - An attribute object that represents the `admin_users` sub block.
+
+
+## obj storage
+
+
+
+### fn storage.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.storage.new` constructs a new object with attributes and blocks configured for the `storage`
+Terraform sub block.
+
+
+
+**Args**:
+  - `lvp_node_mounts_config` (`list[obj]`): Specifies the config for local PersistentVolumes backed
+by mounted node disks. These disks need to be formatted and mounted by the
+user, which can be done before or after cluster creation. When `null`, the `lvp_node_mounts_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.storage.lvp_node_mounts_config.new](#fn-storagelvp_node_mounts_confignew) constructor.
+  - `lvp_share_config` (`list[obj]`): Specifies the config for local PersistentVolumes backed by
+subdirectories in a shared filesystem. These subdirectores are
+automatically created during cluster creation. When `null`, the `lvp_share_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.storage.lvp_share_config.new](#fn-storagelvp_share_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `storage` sub block.
+
+
+## obj storage.lvp_node_mounts_config
+
+
+
+### fn storage.lvp_node_mounts_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.storage.lvp_node_mounts_config.new` constructs a new object with attributes and blocks configured for the `lvp_node_mounts_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `path` (`string`): The host machine path.
+  - `storage_class` (`string`): The StorageClass name that PVs will be created with.
+
+**Returns**:
+  - An attribute object that represents the `lvp_node_mounts_config` sub block.
+
+
+## obj storage.lvp_share_config
+
+
+
+### fn storage.lvp_share_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.storage.lvp_share_config.new` constructs a new object with attributes and blocks configured for the `lvp_share_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `shared_path_pv_count` (`number`): The number of subdirectories to create under path. When `null`, the `shared_path_pv_count` field will be omitted from the resulting object.
+  - `lvp_config` (`list[obj]`): Defines the machine path and storage class for the LVP Share. When `null`, the `lvp_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_cluster.storage.lvp_share_config.lvp_config.new](#fn-storagestoragelvp_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `lvp_share_config` sub block.
+
+
+## obj storage.lvp_share_config.lvp_config
+
+
+
+### fn storage.lvp_share_config.lvp_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.storage.lvp_share_config.lvp_config.new` constructs a new object with attributes and blocks configured for the `lvp_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `path` (`string`): The host machine path.
+  - `storage_class` (`string`): The StorageClass name that PVs will be created with.
+
+**Returns**:
+  - An attribute object that represents the `lvp_config` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
+
+
+## obj upgrade_policy
+
+
+
+### fn upgrade_policy.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_cluster.upgrade_policy.new` constructs a new object with attributes and blocks configured for the `upgrade_policy`
+Terraform sub block.
+
+
+
+**Args**:
+  - `policy` (`string`): Specifies which upgrade policy to use. Possible values: ["SERIAL", "CONCURRENT"] When `null`, the `policy` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `upgrade_policy` sub block.
diff --git a/docs/4.x/gkeonprem_bare_metal_node_pool.md b/docs/4.x/gkeonprem_bare_metal_node_pool.md
new file mode 100644
index 00000000..72088b76
--- /dev/null
+++ b/docs/4.x/gkeonprem_bare_metal_node_pool.md
@@ -0,0 +1,417 @@
+---
+permalink: /gkeonprem_bare_metal_node_pool/
+---
+
+# gkeonprem_bare_metal_node_pool
+
+`gkeonprem_bare_metal_node_pool` represents the `google_gkeonprem_bare_metal_node_pool` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withAnnotations()`](#fn-withannotations)
+* [`fn withBareMetalCluster()`](#fn-withbaremetalcluster)
+* [`fn withDisplayName()`](#fn-withdisplayname)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withName()`](#fn-withname)
+* [`fn withNodePoolConfig()`](#fn-withnodepoolconfig)
+* [`fn withNodePoolConfigMixin()`](#fn-withnodepoolconfigmixin)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj node_pool_config`](#obj-node_pool_config)
+  * [`fn new()`](#fn-node_pool_confignew)
+  * [`obj node_pool_config.node_configs`](#obj-node_pool_confignode_configs)
+    * [`fn new()`](#fn-node_pool_confignode_configsnew)
+  * [`obj node_pool_config.taints`](#obj-node_pool_configtaints)
+    * [`fn new()`](#fn-node_pool_configtaintsnew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_node_pool.new` injects a new `google_gkeonprem_bare_metal_node_pool` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.gkeonprem_bare_metal_node_pool.new('some_id')
+
+You can get the reference to the `id` field of the created `google.gkeonprem_bare_metal_node_pool` using the reference:
+
+    $._ref.google_gkeonprem_bare_metal_node_pool.some_id.get('id')
+
+This is the same as directly entering `"${ google_gkeonprem_bare_metal_node_pool.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `annotations` (`obj`): Annotations on the Bare Metal Node Pool.
+This field has the same restrictions as Kubernetes annotations.
+The total size of all keys and values combined is limited to 256k.
+Key can have 2 segments: prefix (optional) and name (required),
+separated by a slash (/).
+Prefix must be a DNS subdomain.
+Name must be 63 characters or less, begin and end with alphanumerics,
+with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `bare_metal_cluster` (`string`): The cluster this node pool belongs to.
+  - `display_name` (`string`): The display name for the Bare Metal Node Pool. When `null`, the `display_name` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the resource.
+  - `name` (`string`): The bare metal node pool name.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `node_pool_config` (`list[obj]`): Node pool configuration. When `null`, the `node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_node_pool.node_pool_config.new](#fn-node_pool_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_node_pool.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.gkeonprem_bare_metal_node_pool.newAttrs` constructs a new object with attributes and blocks configured for the `gkeonprem_bare_metal_node_pool`
+Terraform resource.
+
+Unlike [google.gkeonprem_bare_metal_node_pool.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `annotations` (`obj`): Annotations on the Bare Metal Node Pool.
+This field has the same restrictions as Kubernetes annotations.
+The total size of all keys and values combined is limited to 256k.
+Key can have 2 segments: prefix (optional) and name (required),
+separated by a slash (/).
+Prefix must be a DNS subdomain.
+Name must be 63 characters or less, begin and end with alphanumerics,
+with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `bare_metal_cluster` (`string`): The cluster this node pool belongs to.
+  - `display_name` (`string`): The display name for the Bare Metal Node Pool. When `null`, the `display_name` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the resource.
+  - `name` (`string`): The bare metal node pool name.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `node_pool_config` (`list[obj]`): Node pool configuration. When `null`, the `node_pool_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_node_pool.node_pool_config.new](#fn-node_pool_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_node_pool.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gkeonprem_bare_metal_node_pool` resource into the root Terraform configuration.
+
+
+### fn withAnnotations
+
+```ts
+withAnnotations()
+```
+
+`google.obj.withAnnotations` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the annotations field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `annotations` field.
+
+
+### fn withBareMetalCluster
+
+```ts
+withBareMetalCluster()
+```
+
+`google.string.withBareMetalCluster` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the bare_metal_cluster field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `bare_metal_cluster` field.
+
+
+### fn withDisplayName
+
+```ts
+withDisplayName()
+```
+
+`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the display_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `display_name` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withNodePoolConfig
+
+```ts
+withNodePoolConfig()
+```
+
+`google.list[obj].withNodePoolConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the node_pool_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withNodePoolConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `node_pool_config` field.
+
+
+### fn withNodePoolConfigMixin
+
+```ts
+withNodePoolConfigMixin()
+```
+
+`google.list[obj].withNodePoolConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the node_pool_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withNodePoolConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `node_pool_config` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj node_pool_config
+
+
+
+### fn node_pool_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_node_pool.node_pool_config.new` constructs a new object with attributes and blocks configured for the `node_pool_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to
+each node. These will added in addition to any default label(s)
+that Kubernetes may apply to the node. In case of conflict in
+label keys, the applied set may differ depending on the Kubernetes
+version -- it's best to assume the behavior is undefined and
+conflicts should be avoided. For more information, including usage
+and the valid values, see:
+  http://kubernetes.io/v1.1/docs/user-guide/labels.html
+An object containing a list of "key": value pairs.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+  - `operating_system` (`string`): Specifies the nodes operating system (default: LINUX). When `null`, the `operating_system` field will be omitted from the resulting object.
+  - `node_configs` (`list[obj]`): The list of machine addresses in the Bare Metal Node Pool. When `null`, the `node_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_node_pool.node_pool_config.node_configs.new](#fn-node_pool_confignode_configsnew) constructor.
+  - `taints` (`list[obj]`): The initial taints assigned to nodes of this node pool. When `null`, the `taints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_bare_metal_node_pool.node_pool_config.taints.new](#fn-node_pool_configtaintsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `node_pool_config` sub block.
+
+
+## obj node_pool_config.node_configs
+
+
+
+### fn node_pool_config.node_configs.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_node_pool.node_pool_config.node_configs.new` constructs a new object with attributes and blocks configured for the `node_configs`
+Terraform sub block.
+
+
+
+**Args**:
+  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to
+each node. These will added in addition to any default label(s)
+that Kubernetes may apply to the node. In case of conflict in
+label keys, the applied set may differ depending on the Kubernetes
+version -- it's best to assume the behavior is undefined and
+conflicts should be avoided. For more information, including usage
+and the valid values, see:
+  http://kubernetes.io/v1.1/docs/user-guide/labels.html
+An object containing a list of "key": value pairs.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+  - `node_ip` (`string`): The default IPv4 address for SSH access and Kubernetes node.
+Example: 192.168.0.1 When `null`, the `node_ip` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `node_configs` sub block.
+
+
+## obj node_pool_config.taints
+
+
+
+### fn node_pool_config.taints.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_node_pool.node_pool_config.taints.new` constructs a new object with attributes and blocks configured for the `taints`
+Terraform sub block.
+
+
+
+**Args**:
+  - `effect` (`string`): Specifies the nodes operating system (default: LINUX). Possible values: ["EFFECT_UNSPECIFIED", "PREFER_NO_SCHEDULE", "NO_EXECUTE"] When `null`, the `effect` field will be omitted from the resulting object.
+  - `key` (`string`): Key associated with the effect. When `null`, the `key` field will be omitted from the resulting object.
+  - `value` (`string`): Value associated with the effect. When `null`, the `value` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `taints` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_bare_metal_node_pool.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/gkeonprem_vmware_cluster.md b/docs/4.x/gkeonprem_vmware_cluster.md
new file mode 100644
index 00000000..e3f44f27
--- /dev/null
+++ b/docs/4.x/gkeonprem_vmware_cluster.md
@@ -0,0 +1,1437 @@
+---
+permalink: /gkeonprem_vmware_cluster/
+---
+
+# gkeonprem_vmware_cluster
+
+`gkeonprem_vmware_cluster` represents the `google_gkeonprem_vmware_cluster` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withAdminClusterMembership()`](#fn-withadminclustermembership)
+* [`fn withAnnotations()`](#fn-withannotations)
+* [`fn withAntiAffinityGroups()`](#fn-withantiaffinitygroups)
+* [`fn withAntiAffinityGroupsMixin()`](#fn-withantiaffinitygroupsmixin)
+* [`fn withAuthorization()`](#fn-withauthorization)
+* [`fn withAuthorizationMixin()`](#fn-withauthorizationmixin)
+* [`fn withAutoRepairConfig()`](#fn-withautorepairconfig)
+* [`fn withAutoRepairConfigMixin()`](#fn-withautorepairconfigmixin)
+* [`fn withControlPlaneNode()`](#fn-withcontrolplanenode)
+* [`fn withControlPlaneNodeMixin()`](#fn-withcontrolplanenodemixin)
+* [`fn withDataplaneV2()`](#fn-withdataplanev2)
+* [`fn withDataplaneV2Mixin()`](#fn-withdataplanev2mixin)
+* [`fn withDescription()`](#fn-withdescription)
+* [`fn withEnableControlPlaneV2()`](#fn-withenablecontrolplanev2)
+* [`fn withLoadBalancer()`](#fn-withloadbalancer)
+* [`fn withLoadBalancerMixin()`](#fn-withloadbalancermixin)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withName()`](#fn-withname)
+* [`fn withNetworkConfig()`](#fn-withnetworkconfig)
+* [`fn withNetworkConfigMixin()`](#fn-withnetworkconfigmixin)
+* [`fn withOnPremVersion()`](#fn-withonpremversion)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withStorage()`](#fn-withstorage)
+* [`fn withStorageMixin()`](#fn-withstoragemixin)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withUpgradePolicy()`](#fn-withupgradepolicy)
+* [`fn withUpgradePolicyMixin()`](#fn-withupgradepolicymixin)
+* [`fn withVcenter()`](#fn-withvcenter)
+* [`fn withVcenterMixin()`](#fn-withvcentermixin)
+* [`fn withVmTrackingEnabled()`](#fn-withvmtrackingenabled)
+* [`obj anti_affinity_groups`](#obj-anti_affinity_groups)
+  * [`fn new()`](#fn-anti_affinity_groupsnew)
+* [`obj authorization`](#obj-authorization)
+  * [`fn new()`](#fn-authorizationnew)
+  * [`obj authorization.admin_users`](#obj-authorizationadmin_users)
+    * [`fn new()`](#fn-authorizationadmin_usersnew)
+* [`obj auto_repair_config`](#obj-auto_repair_config)
+  * [`fn new()`](#fn-auto_repair_confignew)
+* [`obj control_plane_node`](#obj-control_plane_node)
+  * [`fn new()`](#fn-control_plane_nodenew)
+  * [`obj control_plane_node.auto_resize_config`](#obj-control_plane_nodeauto_resize_config)
+    * [`fn new()`](#fn-control_plane_nodeauto_resize_confignew)
+* [`obj dataplane_v2`](#obj-dataplane_v2)
+  * [`fn new()`](#fn-dataplane_v2new)
+* [`obj load_balancer`](#obj-load_balancer)
+  * [`fn new()`](#fn-load_balancernew)
+  * [`obj load_balancer.f5_config`](#obj-load_balancerf5_config)
+    * [`fn new()`](#fn-load_balancerf5_confignew)
+  * [`obj load_balancer.manual_lb_config`](#obj-load_balancermanual_lb_config)
+    * [`fn new()`](#fn-load_balancermanual_lb_confignew)
+  * [`obj load_balancer.metal_lb_config`](#obj-load_balancermetal_lb_config)
+    * [`fn new()`](#fn-load_balancermetal_lb_confignew)
+    * [`obj load_balancer.metal_lb_config.address_pools`](#obj-load_balancermetal_lb_configaddress_pools)
+      * [`fn new()`](#fn-load_balancermetal_lb_configaddress_poolsnew)
+  * [`obj load_balancer.vip_config`](#obj-load_balancervip_config)
+    * [`fn new()`](#fn-load_balancervip_confignew)
+* [`obj network_config`](#obj-network_config)
+  * [`fn new()`](#fn-network_confignew)
+  * [`obj network_config.control_plane_v2_config`](#obj-network_configcontrol_plane_v2_config)
+    * [`fn new()`](#fn-network_configcontrol_plane_v2_confignew)
+    * [`obj network_config.control_plane_v2_config.control_plane_ip_block`](#obj-network_configcontrol_plane_v2_configcontrol_plane_ip_block)
+      * [`fn new()`](#fn-network_configcontrol_plane_v2_configcontrol_plane_ip_blocknew)
+      * [`obj network_config.control_plane_v2_config.control_plane_ip_block.ips`](#obj-network_configcontrol_plane_v2_configcontrol_plane_ip_blockips)
+        * [`fn new()`](#fn-network_configcontrol_plane_v2_configcontrol_plane_ip_blockipsnew)
+  * [`obj network_config.dhcp_ip_config`](#obj-network_configdhcp_ip_config)
+    * [`fn new()`](#fn-network_configdhcp_ip_confignew)
+  * [`obj network_config.host_config`](#obj-network_confighost_config)
+    * [`fn new()`](#fn-network_confighost_confignew)
+  * [`obj network_config.static_ip_config`](#obj-network_configstatic_ip_config)
+    * [`fn new()`](#fn-network_configstatic_ip_confignew)
+    * [`obj network_config.static_ip_config.ip_blocks`](#obj-network_configstatic_ip_configip_blocks)
+      * [`fn new()`](#fn-network_configstatic_ip_configip_blocksnew)
+      * [`obj network_config.static_ip_config.ip_blocks.ips`](#obj-network_configstatic_ip_configip_blocksips)
+        * [`fn new()`](#fn-network_configstatic_ip_configip_blocksipsnew)
+* [`obj storage`](#obj-storage)
+  * [`fn new()`](#fn-storagenew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+* [`obj upgrade_policy`](#obj-upgrade_policy)
+  * [`fn new()`](#fn-upgrade_policynew)
+* [`obj vcenter`](#obj-vcenter)
+  * [`fn new()`](#fn-vcenternew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.new` injects a new `google_gkeonprem_vmware_cluster` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.gkeonprem_vmware_cluster.new('some_id')
+
+You can get the reference to the `id` field of the created `google.gkeonprem_vmware_cluster` using the reference:
+
+    $._ref.google_gkeonprem_vmware_cluster.some_id.get('id')
+
+This is the same as directly entering `"${ google_gkeonprem_vmware_cluster.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `admin_cluster_membership` (`string`): The admin cluster this VMware User Cluster belongs to.
+This is the full resource name of the admin cluster's hub membership.
+In the future, references to other resource types might be allowed if
+admin clusters are modeled as their own resources.
+  - `annotations` (`obj`): Annotations on the VMware User Cluster.
+This field has the same restrictions as Kubernetes annotations.
+The total size of all keys and values combined is limited to 256k.
+Key can have 2 segments: prefix (optional) and name (required),
+separated by a slash (/).
+Prefix must be a DNS subdomain.
+Name must be 63 characters or less, begin and end with alphanumerics,
+with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `description` (`string`): A human readable description of this VMware User Cluster. When `null`, the `description` field will be omitted from the resulting object.
+  - `enable_control_plane_v2` (`bool`): Enable control plane V2. Default to false. When `null`, the `enable_control_plane_v2` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the resource.
+  - `name` (`string`): The VMware cluster name.
+  - `on_prem_version` (`string`): The Anthos clusters on the VMware version for your user cluster.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `vm_tracking_enabled` (`bool`): Enable VM tracking. When `null`, the `vm_tracking_enabled` field will be omitted from the resulting object.
+  - `anti_affinity_groups` (`list[obj]`): AAGConfig specifies whether to spread VMware User Cluster nodes across at
+least three physical hosts in the datacenter. When `null`, the `anti_affinity_groups` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.anti_affinity_groups.new](#fn-anti_affinity_groupsnew) constructor.
+  - `authorization` (`list[obj]`): RBAC policy that will be applied and managed by GKE On-Prem. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.authorization.new](#fn-authorizationnew) constructor.
+  - `auto_repair_config` (`list[obj]`): Configuration for auto repairing. When `null`, the `auto_repair_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.auto_repair_config.new](#fn-auto_repair_confignew) constructor.
+  - `control_plane_node` (`list[obj]`): VMware User Cluster control plane nodes must have either 1 or 3 replicas. When `null`, the `control_plane_node` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.control_plane_node.new](#fn-control_plane_nodenew) constructor.
+  - `dataplane_v2` (`list[obj]`): VmwareDataplaneV2Config specifies configuration for Dataplane V2. When `null`, the `dataplane_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.dataplane_v2.new](#fn-dataplane_v2new) constructor.
+  - `load_balancer` (`list[obj]`): Load Balancer configuration. When `null`, the `load_balancer` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.load_balancer.new](#fn-load_balancernew) constructor.
+  - `network_config` (`list[obj]`): The VMware User Cluster network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.new](#fn-network_confignew) constructor.
+  - `storage` (`list[obj]`): Storage configuration. When `null`, the `storage` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.storage.new](#fn-storagenew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.timeouts.new](#fn-timeoutsnew) constructor.
+  - `upgrade_policy` (`list[obj]`): Specifies upgrade policy for the cluster. When `null`, the `upgrade_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.upgrade_policy.new](#fn-upgrade_policynew) constructor.
+  - `vcenter` (`list[obj]`): VmwareVCenterConfig specifies vCenter config for the user cluster.
+Inherited from the admin cluster. When `null`, the `vcenter` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.vcenter.new](#fn-vcenternew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.gkeonprem_vmware_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `gkeonprem_vmware_cluster`
+Terraform resource.
+
+Unlike [google.gkeonprem_vmware_cluster.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `admin_cluster_membership` (`string`): The admin cluster this VMware User Cluster belongs to.
+This is the full resource name of the admin cluster's hub membership.
+In the future, references to other resource types might be allowed if
+admin clusters are modeled as their own resources.
+  - `annotations` (`obj`): Annotations on the VMware User Cluster.
+This field has the same restrictions as Kubernetes annotations.
+The total size of all keys and values combined is limited to 256k.
+Key can have 2 segments: prefix (optional) and name (required),
+separated by a slash (/).
+Prefix must be a DNS subdomain.
+Name must be 63 characters or less, begin and end with alphanumerics,
+with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `description` (`string`): A human readable description of this VMware User Cluster. When `null`, the `description` field will be omitted from the resulting object.
+  - `enable_control_plane_v2` (`bool`): Enable control plane V2. Default to false. When `null`, the `enable_control_plane_v2` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the resource.
+  - `name` (`string`): The VMware cluster name.
+  - `on_prem_version` (`string`): The Anthos clusters on the VMware version for your user cluster.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `vm_tracking_enabled` (`bool`): Enable VM tracking. When `null`, the `vm_tracking_enabled` field will be omitted from the resulting object.
+  - `anti_affinity_groups` (`list[obj]`): AAGConfig specifies whether to spread VMware User Cluster nodes across at
+least three physical hosts in the datacenter. When `null`, the `anti_affinity_groups` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.anti_affinity_groups.new](#fn-anti_affinity_groupsnew) constructor.
+  - `authorization` (`list[obj]`): RBAC policy that will be applied and managed by GKE On-Prem. When `null`, the `authorization` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.authorization.new](#fn-authorizationnew) constructor.
+  - `auto_repair_config` (`list[obj]`): Configuration for auto repairing. When `null`, the `auto_repair_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.auto_repair_config.new](#fn-auto_repair_confignew) constructor.
+  - `control_plane_node` (`list[obj]`): VMware User Cluster control plane nodes must have either 1 or 3 replicas. When `null`, the `control_plane_node` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.control_plane_node.new](#fn-control_plane_nodenew) constructor.
+  - `dataplane_v2` (`list[obj]`): VmwareDataplaneV2Config specifies configuration for Dataplane V2. When `null`, the `dataplane_v2` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.dataplane_v2.new](#fn-dataplane_v2new) constructor.
+  - `load_balancer` (`list[obj]`): Load Balancer configuration. When `null`, the `load_balancer` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.load_balancer.new](#fn-load_balancernew) constructor.
+  - `network_config` (`list[obj]`): The VMware User Cluster network configuration. When `null`, the `network_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.new](#fn-network_confignew) constructor.
+  - `storage` (`list[obj]`): Storage configuration. When `null`, the `storage` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.storage.new](#fn-storagenew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.timeouts.new](#fn-timeoutsnew) constructor.
+  - `upgrade_policy` (`list[obj]`): Specifies upgrade policy for the cluster. When `null`, the `upgrade_policy` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.upgrade_policy.new](#fn-upgrade_policynew) constructor.
+  - `vcenter` (`list[obj]`): VmwareVCenterConfig specifies vCenter config for the user cluster.
+Inherited from the admin cluster. When `null`, the `vcenter` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.vcenter.new](#fn-vcenternew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gkeonprem_vmware_cluster` resource into the root Terraform configuration.
+
+
+### fn withAdminClusterMembership
+
+```ts
+withAdminClusterMembership()
+```
+
+`google.string.withAdminClusterMembership` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the admin_cluster_membership field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `admin_cluster_membership` field.
+
+
+### fn withAnnotations
+
+```ts
+withAnnotations()
+```
+
+`google.obj.withAnnotations` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the annotations field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `annotations` field.
+
+
+### fn withAntiAffinityGroups
+
+```ts
+withAntiAffinityGroups()
+```
+
+`google.list[obj].withAntiAffinityGroups` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the anti_affinity_groups field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withAntiAffinityGroupsMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `anti_affinity_groups` field.
+
+
+### fn withAntiAffinityGroupsMixin
+
+```ts
+withAntiAffinityGroupsMixin()
+```
+
+`google.list[obj].withAntiAffinityGroupsMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the anti_affinity_groups field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withAntiAffinityGroups](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `anti_affinity_groups` field.
+
+
+### fn withAuthorization
+
+```ts
+withAuthorization()
+```
+
+`google.list[obj].withAuthorization` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the authorization field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withAuthorizationMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `authorization` field.
+
+
+### fn withAuthorizationMixin
+
+```ts
+withAuthorizationMixin()
+```
+
+`google.list[obj].withAuthorizationMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the authorization field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withAuthorization](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `authorization` field.
+
+
+### fn withAutoRepairConfig
+
+```ts
+withAutoRepairConfig()
+```
+
+`google.list[obj].withAutoRepairConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the auto_repair_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withAutoRepairConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `auto_repair_config` field.
+
+
+### fn withAutoRepairConfigMixin
+
+```ts
+withAutoRepairConfigMixin()
+```
+
+`google.list[obj].withAutoRepairConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the auto_repair_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withAutoRepairConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `auto_repair_config` field.
+
+
+### fn withControlPlaneNode
+
+```ts
+withControlPlaneNode()
+```
+
+`google.list[obj].withControlPlaneNode` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the control_plane_node field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withControlPlaneNodeMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `control_plane_node` field.
+
+
+### fn withControlPlaneNodeMixin
+
+```ts
+withControlPlaneNodeMixin()
+```
+
+`google.list[obj].withControlPlaneNodeMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the control_plane_node field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withControlPlaneNode](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `control_plane_node` field.
+
+
+### fn withDataplaneV2
+
+```ts
+withDataplaneV2()
+```
+
+`google.list[obj].withDataplaneV2` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the dataplane_v2 field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withDataplaneV2Mixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `dataplane_v2` field.
+
+
+### fn withDataplaneV2Mixin
+
+```ts
+withDataplaneV2Mixin()
+```
+
+`google.list[obj].withDataplaneV2Mixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the dataplane_v2 field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withDataplaneV2](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `dataplane_v2` field.
+
+
+### fn withDescription
+
+```ts
+withDescription()
+```
+
+`google.string.withDescription` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the description field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `description` field.
+
+
+### fn withEnableControlPlaneV2
+
+```ts
+withEnableControlPlaneV2()
+```
+
+`google.bool.withEnableControlPlaneV2` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the enable_control_plane_v2 field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `enable_control_plane_v2` field.
+
+
+### fn withLoadBalancer
+
+```ts
+withLoadBalancer()
+```
+
+`google.list[obj].withLoadBalancer` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the load_balancer field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withLoadBalancerMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `load_balancer` field.
+
+
+### fn withLoadBalancerMixin
+
+```ts
+withLoadBalancerMixin()
+```
+
+`google.list[obj].withLoadBalancerMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the load_balancer field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withLoadBalancer](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `load_balancer` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withNetworkConfig
+
+```ts
+withNetworkConfig()
+```
+
+`google.list[obj].withNetworkConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the network_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withNetworkConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `network_config` field.
+
+
+### fn withNetworkConfigMixin
+
+```ts
+withNetworkConfigMixin()
+```
+
+`google.list[obj].withNetworkConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the network_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withNetworkConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `network_config` field.
+
+
+### fn withOnPremVersion
+
+```ts
+withOnPremVersion()
+```
+
+`google.string.withOnPremVersion` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the on_prem_version field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `on_prem_version` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withStorage
+
+```ts
+withStorage()
+```
+
+`google.list[obj].withStorage` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the storage field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withStorageMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `storage` field.
+
+
+### fn withStorageMixin
+
+```ts
+withStorageMixin()
+```
+
+`google.list[obj].withStorageMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the storage field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withStorage](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `storage` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withUpgradePolicy
+
+```ts
+withUpgradePolicy()
+```
+
+`google.list[obj].withUpgradePolicy` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the upgrade_policy field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withUpgradePolicyMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `upgrade_policy` field.
+
+
+### fn withUpgradePolicyMixin
+
+```ts
+withUpgradePolicyMixin()
+```
+
+`google.list[obj].withUpgradePolicyMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the upgrade_policy field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withUpgradePolicy](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `upgrade_policy` field.
+
+
+### fn withVcenter
+
+```ts
+withVcenter()
+```
+
+`google.list[obj].withVcenter` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the vcenter field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withVcenterMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `vcenter` field.
+
+
+### fn withVcenterMixin
+
+```ts
+withVcenterMixin()
+```
+
+`google.list[obj].withVcenterMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the vcenter field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withVcenter](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `vcenter` field.
+
+
+### fn withVmTrackingEnabled
+
+```ts
+withVmTrackingEnabled()
+```
+
+`google.bool.withVmTrackingEnabled` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the vm_tracking_enabled field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `vm_tracking_enabled` field.
+
+
+## obj anti_affinity_groups
+
+
+
+### fn anti_affinity_groups.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.anti_affinity_groups.new` constructs a new object with attributes and blocks configured for the `anti_affinity_groups`
+Terraform sub block.
+
+
+
+**Args**:
+  - `aag_config_disabled` (`bool`): Spread nodes across at least three physical hosts (requires at least three
+hosts).
+Enabled by default.
+
+**Returns**:
+  - An attribute object that represents the `anti_affinity_groups` sub block.
+
+
+## obj authorization
+
+
+
+### fn authorization.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.authorization.new` constructs a new object with attributes and blocks configured for the `authorization`
+Terraform sub block.
+
+
+
+**Args**:
+  - `admin_users` (`list[obj]`): Users that will be granted the cluster-admin role on the cluster, providing
+full access to the cluster. When `null`, the `admin_users` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.authorization.admin_users.new](#fn-authorizationadmin_usersnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `authorization` sub block.
+
+
+## obj authorization.admin_users
+
+
+
+### fn authorization.admin_users.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.authorization.admin_users.new` constructs a new object with attributes and blocks configured for the `admin_users`
+Terraform sub block.
+
+
+
+**Args**:
+  - `username` (`string`): The name of the user, e.g. 'my-gcp-id@gmail.com'.
+
+**Returns**:
+  - An attribute object that represents the `admin_users` sub block.
+
+
+## obj auto_repair_config
+
+
+
+### fn auto_repair_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.auto_repair_config.new` constructs a new object with attributes and blocks configured for the `auto_repair_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enabled` (`bool`): Whether auto repair is enabled.
+
+**Returns**:
+  - An attribute object that represents the `auto_repair_config` sub block.
+
+
+## obj control_plane_node
+
+
+
+### fn control_plane_node.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.control_plane_node.new` constructs a new object with attributes and blocks configured for the `control_plane_node`
+Terraform sub block.
+
+
+
+**Args**:
+  - `cpus` (`number`): The number of CPUs for each admin cluster node that serve as control planes
+for this VMware User Cluster. (default: 4 CPUs) When `null`, the `cpus` field will be omitted from the resulting object.
+  - `memory` (`number`): The megabytes of memory for each admin cluster node that serves as a
+control plane for this VMware User Cluster (default: 8192 MB memory). When `null`, the `memory` field will be omitted from the resulting object.
+  - `replicas` (`number`): The number of control plane nodes for this VMware User Cluster.
+(default: 1 replica). When `null`, the `replicas` field will be omitted from the resulting object.
+  - `auto_resize_config` (`list[obj]`): AutoResizeConfig provides auto resizing configurations. When `null`, the `auto_resize_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.control_plane_node.auto_resize_config.new](#fn-control_plane_nodeauto_resize_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `control_plane_node` sub block.
+
+
+## obj control_plane_node.auto_resize_config
+
+
+
+### fn control_plane_node.auto_resize_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.control_plane_node.auto_resize_config.new` constructs a new object with attributes and blocks configured for the `auto_resize_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enabled` (`bool`): Whether to enable control plane node auto resizing.
+
+**Returns**:
+  - An attribute object that represents the `auto_resize_config` sub block.
+
+
+## obj dataplane_v2
+
+
+
+### fn dataplane_v2.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.dataplane_v2.new` constructs a new object with attributes and blocks configured for the `dataplane_v2`
+Terraform sub block.
+
+
+
+**Args**:
+  - `advanced_networking` (`bool`): Enable advanced networking which requires dataplane_v2_enabled to be set true. When `null`, the `advanced_networking` field will be omitted from the resulting object.
+  - `dataplane_v2_enabled` (`bool`): Enables Dataplane V2. When `null`, the `dataplane_v2_enabled` field will be omitted from the resulting object.
+  - `windows_dataplane_v2_enabled` (`bool`): Enable Dataplane V2 for clusters with Windows nodes. When `null`, the `windows_dataplane_v2_enabled` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `dataplane_v2` sub block.
+
+
+## obj load_balancer
+
+
+
+### fn load_balancer.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.load_balancer.new` constructs a new object with attributes and blocks configured for the `load_balancer`
+Terraform sub block.
+
+
+
+**Args**:
+  - `f5_config` (`list[obj]`): Configuration for F5 Big IP typed load balancers. When `null`, the `f5_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.load_balancer.f5_config.new](#fn-load_balancerf5_confignew) constructor.
+  - `manual_lb_config` (`list[obj]`): Manually configured load balancers. When `null`, the `manual_lb_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.load_balancer.manual_lb_config.new](#fn-load_balancermanual_lb_confignew) constructor.
+  - `metal_lb_config` (`list[obj]`): Configuration for MetalLB typed load balancers. When `null`, the `metal_lb_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.load_balancer.metal_lb_config.new](#fn-load_balancermetal_lb_confignew) constructor.
+  - `vip_config` (`list[obj]`): The VIPs used by the load balancer. When `null`, the `vip_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.load_balancer.vip_config.new](#fn-load_balancervip_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `load_balancer` sub block.
+
+
+## obj load_balancer.f5_config
+
+
+
+### fn load_balancer.f5_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.load_balancer.f5_config.new` constructs a new object with attributes and blocks configured for the `f5_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `address` (`string`): The load balancer's IP address. When `null`, the `address` field will be omitted from the resulting object.
+  - `partition` (`string`): he preexisting partition to be used by the load balancer. T
+his partition is usually created for the admin cluster for example:
+'my-f5-admin-partition'. When `null`, the `partition` field will be omitted from the resulting object.
+  - `snat_pool` (`string`): The pool name. Only necessary, if using SNAT. When `null`, the `snat_pool` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `f5_config` sub block.
+
+
+## obj load_balancer.manual_lb_config
+
+
+
+### fn load_balancer.manual_lb_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.load_balancer.manual_lb_config.new` constructs a new object with attributes and blocks configured for the `manual_lb_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `control_plane_node_port` (`number`): NodePort for control plane service. The Kubernetes API server in the admin
+cluster is implemented as a Service of type NodePort (ex. 30968). When `null`, the `control_plane_node_port` field will be omitted from the resulting object.
+  - `ingress_http_node_port` (`number`): NodePort for ingress service's http. The ingress service in the admin
+cluster is implemented as a Service of type NodePort (ex. 32527). When `null`, the `ingress_http_node_port` field will be omitted from the resulting object.
+  - `ingress_https_node_port` (`number`): NodePort for ingress service's https. The ingress service in the admin
+cluster is implemented as a Service of type NodePort (ex. 30139). When `null`, the `ingress_https_node_port` field will be omitted from the resulting object.
+  - `konnectivity_server_node_port` (`number`): NodePort for konnectivity server service running as a sidecar in each
+kube-apiserver pod (ex. 30564). When `null`, the `konnectivity_server_node_port` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `manual_lb_config` sub block.
+
+
+## obj load_balancer.metal_lb_config
+
+
+
+### fn load_balancer.metal_lb_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.load_balancer.metal_lb_config.new` constructs a new object with attributes and blocks configured for the `metal_lb_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `address_pools` (`list[obj]`): AddressPools is a list of non-overlapping IP pools used by load balancer
+typed services. All addresses must be routable to load balancer nodes.
+IngressVIP must be included in the pools. When `null`, the `address_pools` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.load_balancer.metal_lb_config.address_pools.new](#fn-load_balancerload_balanceraddress_poolsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `metal_lb_config` sub block.
+
+
+## obj load_balancer.metal_lb_config.address_pools
+
+
+
+### fn load_balancer.metal_lb_config.address_pools.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.load_balancer.metal_lb_config.address_pools.new` constructs a new object with attributes and blocks configured for the `address_pools`
+Terraform sub block.
+
+
+
+**Args**:
+  - `addresses` (`list`): The addresses that are part of this pool. Each address
+must be either in the CIDR form (1.2.3.0/24) or range
+form (1.2.3.1-1.2.3.5).
+  - `avoid_buggy_ips` (`bool`): If true, avoid using IPs ending in .0 or .255.
+This avoids buggy consumer devices mistakenly dropping IPv4 traffic for
+those special IP addresses. When `null`, the `avoid_buggy_ips` field will be omitted from the resulting object.
+  - `manual_assign` (`bool`): If true, prevent IP addresses from being automatically assigned. When `null`, the `manual_assign` field will be omitted from the resulting object.
+  - `pool` (`string`): The name of the address pool.
+
+**Returns**:
+  - An attribute object that represents the `address_pools` sub block.
+
+
+## obj load_balancer.vip_config
+
+
+
+### fn load_balancer.vip_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.load_balancer.vip_config.new` constructs a new object with attributes and blocks configured for the `vip_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `control_plane_vip` (`string`): The VIP which you previously set aside for the Kubernetes API of this cluster. When `null`, the `control_plane_vip` field will be omitted from the resulting object.
+  - `ingress_vip` (`string`): The VIP which you previously set aside for ingress traffic into this cluster. When `null`, the `ingress_vip` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `vip_config` sub block.
+
+
+## obj network_config
+
+
+
+### fn network_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.network_config.new` constructs a new object with attributes and blocks configured for the `network_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `pod_address_cidr_blocks` (`list`): All pods in the cluster are assigned an RFC1918 IPv4 address from these ranges.
+Only a single range is supported. This field cannot be changed after creation.
+  - `service_address_cidr_blocks` (`list`): All services in the cluster are assigned an RFC1918 IPv4 address
+from these ranges. Only a single range is supported.. This field
+cannot be changed after creation.
+  - `control_plane_v2_config` (`list[obj]`): Configuration for control plane V2 mode. When `null`, the `control_plane_v2_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.control_plane_v2_config.new](#fn-network_configcontrol_plane_v2_confignew) constructor.
+  - `dhcp_ip_config` (`list[obj]`): Configuration settings for a DHCP IP configuration. When `null`, the `dhcp_ip_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.dhcp_ip_config.new](#fn-network_configdhcp_ip_confignew) constructor.
+  - `host_config` (`list[obj]`): Represents common network settings irrespective of the host's IP address. When `null`, the `host_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.host_config.new](#fn-network_confighost_confignew) constructor.
+  - `static_ip_config` (`list[obj]`): Configuration settings for a static IP configuration. When `null`, the `static_ip_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.static_ip_config.new](#fn-network_configstatic_ip_confignew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `network_config` sub block.
+
+
+## obj network_config.control_plane_v2_config
+
+
+
+### fn network_config.control_plane_v2_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.network_config.control_plane_v2_config.new` constructs a new object with attributes and blocks configured for the `control_plane_v2_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `control_plane_ip_block` (`list[obj]`): Static IP addresses for the control plane nodes. When `null`, the `control_plane_ip_block` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.control_plane_v2_config.control_plane_ip_block.new](#fn-network_confignetwork_configcontrol_plane_ip_blocknew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `control_plane_v2_config` sub block.
+
+
+## obj network_config.control_plane_v2_config.control_plane_ip_block
+
+
+
+### fn network_config.control_plane_v2_config.control_plane_ip_block.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.network_config.control_plane_v2_config.control_plane_ip_block.new` constructs a new object with attributes and blocks configured for the `control_plane_ip_block`
+Terraform sub block.
+
+
+
+**Args**:
+  - `gateway` (`string`): The network gateway used by the VMware User Cluster. When `null`, the `gateway` field will be omitted from the resulting object.
+  - `netmask` (`string`): The netmask used by the VMware User Cluster. When `null`, the `netmask` field will be omitted from the resulting object.
+  - `ips` (`list[obj]`): The node's network configurations used by the VMware User Cluster. When `null`, the `ips` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.control_plane_v2_config.control_plane_ip_block.ips.new](#fn-network_confignetwork_configcontrol_plane_v2_configipsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `control_plane_ip_block` sub block.
+
+
+## obj network_config.control_plane_v2_config.control_plane_ip_block.ips
+
+
+
+### fn network_config.control_plane_v2_config.control_plane_ip_block.ips.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.network_config.control_plane_v2_config.control_plane_ip_block.ips.new` constructs a new object with attributes and blocks configured for the `ips`
+Terraform sub block.
+
+
+
+**Args**:
+  - `hostname` (`string`): Hostname of the machine. VM's name will be used if this field is empty. When `null`, the `hostname` field will be omitted from the resulting object.
+  - `ip` (`string`): IP could be an IP address (like 1.2.3.4) or a CIDR (like 1.2.3.0/24). When `null`, the `ip` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `ips` sub block.
+
+
+## obj network_config.dhcp_ip_config
+
+
+
+### fn network_config.dhcp_ip_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.network_config.dhcp_ip_config.new` constructs a new object with attributes and blocks configured for the `dhcp_ip_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `enabled` (`bool`): enabled is a flag to mark if DHCP IP allocation is
+used for VMware user clusters.
+
+**Returns**:
+  - An attribute object that represents the `dhcp_ip_config` sub block.
+
+
+## obj network_config.host_config
+
+
+
+### fn network_config.host_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.network_config.host_config.new` constructs a new object with attributes and blocks configured for the `host_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `dns_search_domains` (`list`): DNS search domains. When `null`, the `dns_search_domains` field will be omitted from the resulting object.
+  - `dns_servers` (`list`): DNS servers. When `null`, the `dns_servers` field will be omitted from the resulting object.
+  - `ntp_servers` (`list`): NTP servers. When `null`, the `ntp_servers` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `host_config` sub block.
+
+
+## obj network_config.static_ip_config
+
+
+
+### fn network_config.static_ip_config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.network_config.static_ip_config.new` constructs a new object with attributes and blocks configured for the `static_ip_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `ip_blocks` (`list[obj]`): Represents the configuration values for static IP allocation to nodes. When `null`, the `ip_blocks` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.static_ip_config.ip_blocks.new](#fn-network_confignetwork_configip_blocksnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `static_ip_config` sub block.
+
+
+## obj network_config.static_ip_config.ip_blocks
+
+
+
+### fn network_config.static_ip_config.ip_blocks.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.network_config.static_ip_config.ip_blocks.new` constructs a new object with attributes and blocks configured for the `ip_blocks`
+Terraform sub block.
+
+
+
+**Args**:
+  - `gateway` (`string`): The network gateway used by the VMware User Cluster.
+  - `netmask` (`string`): The netmask used by the VMware User Cluster.
+  - `ips` (`list[obj]`): The node's network configurations used by the VMware User Cluster. When `null`, the `ips` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_cluster.network_config.static_ip_config.ip_blocks.ips.new](#fn-network_confignetwork_configstatic_ip_configipsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `ip_blocks` sub block.
+
+
+## obj network_config.static_ip_config.ip_blocks.ips
+
+
+
+### fn network_config.static_ip_config.ip_blocks.ips.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.network_config.static_ip_config.ip_blocks.ips.new` constructs a new object with attributes and blocks configured for the `ips`
+Terraform sub block.
+
+
+
+**Args**:
+  - `hostname` (`string`): Hostname of the machine. VM's name will be used if this field is empty. When `null`, the `hostname` field will be omitted from the resulting object.
+  - `ip` (`string`): IP could be an IP address (like 1.2.3.4) or a CIDR (like 1.2.3.0/24).
+
+**Returns**:
+  - An attribute object that represents the `ips` sub block.
+
+
+## obj storage
+
+
+
+### fn storage.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.storage.new` constructs a new object with attributes and blocks configured for the `storage`
+Terraform sub block.
+
+
+
+**Args**:
+  - `vsphere_csi_disabled` (`bool`): Whether or not to deploy vSphere CSI components in the VMware User Cluster.
+Enabled by default.
+
+**Returns**:
+  - An attribute object that represents the `storage` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
+
+
+## obj upgrade_policy
+
+
+
+### fn upgrade_policy.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.upgrade_policy.new` constructs a new object with attributes and blocks configured for the `upgrade_policy`
+Terraform sub block.
+
+
+
+**Args**:
+  - `control_plane_only` (`bool`): Controls whether the upgrade applies to the control plane only. When `null`, the `control_plane_only` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `upgrade_policy` sub block.
+
+
+## obj vcenter
+
+
+
+### fn vcenter.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_cluster.vcenter.new` constructs a new object with attributes and blocks configured for the `vcenter`
+Terraform sub block.
+
+
+
+**Args**:
+  - `ca_cert_data` (`string`): Contains the vCenter CA certificate public key for SSL verification. When `null`, the `ca_cert_data` field will be omitted from the resulting object.
+  - `cluster` (`string`): The name of the vCenter cluster for the user cluster. When `null`, the `cluster` field will be omitted from the resulting object.
+  - `datacenter` (`string`): The name of the vCenter datacenter for the user cluster. When `null`, the `datacenter` field will be omitted from the resulting object.
+  - `datastore` (`string`): The name of the vCenter datastore for the user cluster. When `null`, the `datastore` field will be omitted from the resulting object.
+  - `folder` (`string`): The name of the vCenter folder for the user cluster. When `null`, the `folder` field will be omitted from the resulting object.
+  - `resource_pool` (`string`): The name of the vCenter resource pool for the user cluster. When `null`, the `resource_pool` field will be omitted from the resulting object.
+  - `storage_policy_name` (`string`): The name of the vCenter storage policy for the user cluster. When `null`, the `storage_policy_name` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `vcenter` sub block.
diff --git a/docs/4.x/gkeonprem_vmware_node_pool.md b/docs/4.x/gkeonprem_vmware_node_pool.md
new file mode 100644
index 00000000..d54130e1
--- /dev/null
+++ b/docs/4.x/gkeonprem_vmware_node_pool.md
@@ -0,0 +1,451 @@
+---
+permalink: /gkeonprem_vmware_node_pool/
+---
+
+# gkeonprem_vmware_node_pool
+
+`gkeonprem_vmware_node_pool` represents the `google_gkeonprem_vmware_node_pool` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withAnnotations()`](#fn-withannotations)
+* [`fn withConfig()`](#fn-withconfig)
+* [`fn withConfigMixin()`](#fn-withconfigmixin)
+* [`fn withDisplayName()`](#fn-withdisplayname)
+* [`fn withLocation()`](#fn-withlocation)
+* [`fn withName()`](#fn-withname)
+* [`fn withNodePoolAutoscaling()`](#fn-withnodepoolautoscaling)
+* [`fn withNodePoolAutoscalingMixin()`](#fn-withnodepoolautoscalingmixin)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withVmwareCluster()`](#fn-withvmwarecluster)
+* [`obj config`](#obj-config)
+  * [`fn new()`](#fn-confignew)
+  * [`obj config.taints`](#obj-configtaints)
+    * [`fn new()`](#fn-configtaintsnew)
+* [`obj node_pool_autoscaling`](#obj-node_pool_autoscaling)
+  * [`fn new()`](#fn-node_pool_autoscalingnew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_node_pool.new` injects a new `google_gkeonprem_vmware_node_pool` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.gkeonprem_vmware_node_pool.new('some_id')
+
+You can get the reference to the `id` field of the created `google.gkeonprem_vmware_node_pool` using the reference:
+
+    $._ref.google_gkeonprem_vmware_node_pool.some_id.get('id')
+
+This is the same as directly entering `"${ google_gkeonprem_vmware_node_pool.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `annotations` (`obj`): Annotations on the node Pool.
+This field has the same restrictions as Kubernetes annotations.
+The total size of all keys and values combined is limited to 256k.
+Key can have 2 segments: prefix (optional) and name (required),
+separated by a slash (/).
+Prefix must be a DNS subdomain.
+Name must be 63 characters or less, begin and end with alphanumerics,
+with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `display_name` (`string`): The display name for the node pool. When `null`, the `display_name` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the resource.
+  - `name` (`string`): The vmware node pool name.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `vmware_cluster` (`string`): The cluster this node pool belongs to.
+  - `config` (`list[obj]`): The node configuration of the node pool. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_node_pool.config.new](#fn-confignew) constructor.
+  - `node_pool_autoscaling` (`list[obj]`): Node Pool autoscaling config for the node pool. When `null`, the `node_pool_autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_node_pool.node_pool_autoscaling.new](#fn-node_pool_autoscalingnew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_node_pool.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.gkeonprem_vmware_node_pool.newAttrs` constructs a new object with attributes and blocks configured for the `gkeonprem_vmware_node_pool`
+Terraform resource.
+
+Unlike [google.gkeonprem_vmware_node_pool.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `annotations` (`obj`): Annotations on the node Pool.
+This field has the same restrictions as Kubernetes annotations.
+The total size of all keys and values combined is limited to 256k.
+Key can have 2 segments: prefix (optional) and name (required),
+separated by a slash (/).
+Prefix must be a DNS subdomain.
+Name must be 63 characters or less, begin and end with alphanumerics,
+with dashes (-), underscores (_), dots (.), and alphanumerics between.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
+  - `display_name` (`string`): The display name for the node pool. When `null`, the `display_name` field will be omitted from the resulting object.
+  - `location` (`string`): The location of the resource.
+  - `name` (`string`): The vmware node pool name.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `vmware_cluster` (`string`): The cluster this node pool belongs to.
+  - `config` (`list[obj]`): The node configuration of the node pool. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_node_pool.config.new](#fn-confignew) constructor.
+  - `node_pool_autoscaling` (`list[obj]`): Node Pool autoscaling config for the node pool. When `null`, the `node_pool_autoscaling` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_node_pool.node_pool_autoscaling.new](#fn-node_pool_autoscalingnew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_node_pool.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gkeonprem_vmware_node_pool` resource into the root Terraform configuration.
+
+
+### fn withAnnotations
+
+```ts
+withAnnotations()
+```
+
+`google.obj.withAnnotations` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the annotations field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `annotations` field.
+
+
+### fn withConfig
+
+```ts
+withConfig()
+```
+
+`google.list[obj].withConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `config` field.
+
+
+### fn withConfigMixin
+
+```ts
+withConfigMixin()
+```
+
+`google.list[obj].withConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `config` field.
+
+
+### fn withDisplayName
+
+```ts
+withDisplayName()
+```
+
+`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the display_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `display_name` field.
+
+
+### fn withLocation
+
+```ts
+withLocation()
+```
+
+`google.string.withLocation` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the location field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `location` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withNodePoolAutoscaling
+
+```ts
+withNodePoolAutoscaling()
+```
+
+`google.list[obj].withNodePoolAutoscaling` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the node_pool_autoscaling field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withNodePoolAutoscalingMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `node_pool_autoscaling` field.
+
+
+### fn withNodePoolAutoscalingMixin
+
+```ts
+withNodePoolAutoscalingMixin()
+```
+
+`google.list[obj].withNodePoolAutoscalingMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the node_pool_autoscaling field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withNodePoolAutoscaling](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `node_pool_autoscaling` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withVmwareCluster
+
+```ts
+withVmwareCluster()
+```
+
+`google.string.withVmwareCluster` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the vmware_cluster field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `vmware_cluster` field.
+
+
+## obj config
+
+
+
+### fn config.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_node_pool.config.new` constructs a new object with attributes and blocks configured for the `config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `boot_disk_size_gb` (`number`): VMware disk size to be used during creation. When `null`, the `boot_disk_size_gb` field will be omitted from the resulting object.
+  - `cpus` (`number`): The number of CPUs for each node in the node pool. When `null`, the `cpus` field will be omitted from the resulting object.
+  - `enable_load_balancer` (`bool`): Allow node pool traffic to be load balanced. Only works for clusters with
+MetalLB load balancers. When `null`, the `enable_load_balancer` field will be omitted from the resulting object.
+  - `image` (`string`): The OS image name in vCenter, only valid when using Windows. When `null`, the `image` field will be omitted from the resulting object.
+  - `image_type` (`string`): The OS image to be used for each node in a node pool.
+Currently 'cos', 'ubuntu', 'ubuntu_containerd' and 'windows' are supported.
+  - `labels` (`obj`): The map of Kubernetes labels (key/value pairs) to be applied to each node.
+These will added in addition to any default label(s) that
+Kubernetes may apply to the node.
+In case of conflict in label keys, the applied set may differ depending on
+the Kubernetes version -- it's best to assume the behavior is undefined
+and conflicts should be avoided. When `null`, the `labels` field will be omitted from the resulting object.
+  - `memory_mb` (`number`): The megabytes of memory for each node in the node pool. When `null`, the `memory_mb` field will be omitted from the resulting object.
+  - `replicas` (`number`): The number of nodes in the node pool. When `null`, the `replicas` field will be omitted from the resulting object.
+  - `taints` (`list[obj]`): The initial taints assigned to nodes of this node pool. When `null`, the `taints` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.gkeonprem_vmware_node_pool.config.taints.new](#fn-configtaintsnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `config` sub block.
+
+
+## obj config.taints
+
+
+
+### fn config.taints.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_node_pool.config.taints.new` constructs a new object with attributes and blocks configured for the `taints`
+Terraform sub block.
+
+
+
+**Args**:
+  - `effect` (`string`): Available taint effects. Possible values: ["EFFECT_UNSPECIFIED", "NO_SCHEDULE", "PREFER_NO_SCHEDULE", "NO_EXECUTE"] When `null`, the `effect` field will be omitted from the resulting object.
+  - `key` (`string`): Key associated with the effect.
+  - `value` (`string`): Value associated with the effect.
+
+**Returns**:
+  - An attribute object that represents the `taints` sub block.
+
+
+## obj node_pool_autoscaling
+
+
+
+### fn node_pool_autoscaling.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_node_pool.node_pool_autoscaling.new` constructs a new object with attributes and blocks configured for the `node_pool_autoscaling`
+Terraform sub block.
+
+
+
+**Args**:
+  - `max_replicas` (`number`): Maximum number of replicas in the NodePool.
+  - `min_replicas` (`number`): Minimum number of replicas in the NodePool.
+
+**Returns**:
+  - An attribute object that represents the `node_pool_autoscaling` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.gkeonprem_vmware_node_pool.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/healthcare_consent_store.md b/docs/4.x/healthcare_consent_store.md
index 62f167d0..f07142c4 100644
--- a/docs/4.x/healthcare_consent_store.md
+++ b/docs/4.x/healthcare_consent_store.md
@@ -71,7 +71,11 @@ bytes, and must conform to the following PCRE regular expression: '[\p{Ll}\p
 No more than 64 labels can be associated with a given store.
 
 An object containing a list of "key": value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The name of this ConsentStore, for example:
 "consent1"
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_consent_store.timeouts.new](#fn-timeoutsnew) constructor.
@@ -115,7 +119,11 @@ bytes, and must conform to the following PCRE regular expression: '[\p{Ll}\p
 No more than 64 labels can be associated with a given store.
 
 An object containing a list of "key": value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The name of this ConsentStore, for example:
 "consent1"
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.healthcare_consent_store.timeouts.new](#fn-timeoutsnew) constructor.
diff --git a/docs/4.x/healthcare_dicom_store.md b/docs/4.x/healthcare_dicom_store.md
index a47281b9..21d9b904 100644
--- a/docs/4.x/healthcare_dicom_store.md
+++ b/docs/4.x/healthcare_dicom_store.md
@@ -69,7 +69,11 @@ bytes, and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}\
 No more than 64 labels can be associated with a given store.
 
 An object containing a list of "key": value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The resource name for the DicomStore.
 
 ** Changing this property may recreate the Dicom store (removing all data) **
@@ -111,7 +115,11 @@ bytes, and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}\
 No more than 64 labels can be associated with a given store.
 
 An object containing a list of "key": value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The resource name for the DicomStore.
 
 ** Changing this property may recreate the Dicom store (removing all data) **
diff --git a/docs/4.x/healthcare_fhir_store.md b/docs/4.x/healthcare_fhir_store.md
index bb3957d5..2683d404 100644
--- a/docs/4.x/healthcare_fhir_store.md
+++ b/docs/4.x/healthcare_fhir_store.md
@@ -118,7 +118,11 @@ bytes, and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}\
 No more than 64 labels can be associated with a given store.
 
 An object containing a list of "key": value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The resource name for the FhirStore.
 
 ** Changing this property may recreate the FHIR store (removing all data) **
@@ -199,7 +203,11 @@ bytes, and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}\
 No more than 64 labels can be associated with a given store.
 
 An object containing a list of "key": value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The resource name for the FhirStore.
 
 ** Changing this property may recreate the FHIR store (removing all data) **
diff --git a/docs/4.x/healthcare_hl7_v2_store.md b/docs/4.x/healthcare_hl7_v2_store.md
index 59d6d37e..39887be1 100644
--- a/docs/4.x/healthcare_hl7_v2_store.md
+++ b/docs/4.x/healthcare_hl7_v2_store.md
@@ -77,7 +77,11 @@ bytes, and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}\
 No more than 64 labels can be associated with a given store.
 
 An object containing a list of "key": value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The resource name for the Hl7V2Store.
 
 ** Changing this property may recreate the Hl7v2 store (removing all data) **
@@ -123,7 +127,11 @@ bytes, and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}\
 No more than 64 labels can be associated with a given store.
 
 An object containing a list of "key": value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The resource name for the Hl7V2Store.
 
 ** Changing this property may recreate the Hl7v2 store (removing all data) **
diff --git a/docs/4.x/iam_workforce_pool_provider.md b/docs/4.x/iam_workforce_pool_provider.md
index b1605363..57fe1025 100644
--- a/docs/4.x/iam_workforce_pool_provider.md
+++ b/docs/4.x/iam_workforce_pool_provider.md
@@ -526,6 +526,29 @@ Terraform sub block.
 **Args**:
   - `client_id` (`string`): The client ID. Must match the audience claim of the JWT issued by the identity provider.
   - `issuer_uri` (`string`): The OIDC issuer URI. Must be a valid URI using the 'https' scheme.
+  - `jwks_json` (`string`): OIDC JWKs in JSON String format. For details on definition of a
+JWK, see https:tools.ietf.org/html/rfc7517. If not set, then we
+use the 'jwks_uri' from the discovery document fetched from the
+.well-known path for the 'issuer_uri'. Currently, RSA and EC asymmetric
+keys are supported. The JWK must use following format and include only
+the following fields:
+'''
+{
+  "keys": [
+    {
+          "kty": "RSA/EC",
+          "alg": "<algorithm>",
+          "use": "sig",
+          "kid": "<key-id>",
+          "n": "",
+          "e": "",
+          "x": "",
+          "y": "",
+          "crv": ""
+    }
+  ]
+}
+''' When `null`, the `jwks_json` field will be omitted from the resulting object.
   - `client_secret` (`list[obj]`): The optional client secret. Required to enable Authorization Code flow for web sign-in. When `null`, the `client_secret` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workforce_pool_provider.oidc.client_secret.new](#fn-oidcclient_secretnew) constructor.
   - `web_sso_config` (`list[obj]`): Configuration for web single sign-on for the OIDC provider. Here, web sign-in refers to console sign-in and gcloud sign-in through the browser. When `null`, the `web_sso_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.iam_workforce_pool_provider.oidc.web_sso_config.new](#fn-oidcweb_sso_confignew) constructor.
 
diff --git a/docs/4.x/identity_platform_config.md b/docs/4.x/identity_platform_config.md
index 3d15dacd..bcb2b3b2 100644
--- a/docs/4.x/identity_platform_config.md
+++ b/docs/4.x/identity_platform_config.md
@@ -24,6 +24,8 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withQuotaMixin()`](#fn-withquotamixin)
 * [`fn withSignIn()`](#fn-withsignin)
 * [`fn withSignInMixin()`](#fn-withsigninmixin)
+* [`fn withSmsRegionConfig()`](#fn-withsmsregionconfig)
+* [`fn withSmsRegionConfigMixin()`](#fn-withsmsregionconfigmixin)
 * [`fn withTimeouts()`](#fn-withtimeouts)
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
 * [`obj blocking_functions`](#obj-blocking_functions)
@@ -44,6 +46,12 @@ This package contains functions and utilities for setting up the resource using
     * [`fn new()`](#fn-sign_inemailnew)
   * [`obj sign_in.phone_number`](#obj-sign_inphone_number)
     * [`fn new()`](#fn-sign_inphone_numbernew)
+* [`obj sms_region_config`](#obj-sms_region_config)
+  * [`fn new()`](#fn-sms_region_confignew)
+  * [`obj sms_region_config.allow_by_default`](#obj-sms_region_configallow_by_default)
+    * [`fn new()`](#fn-sms_region_configallow_by_defaultnew)
+  * [`obj sms_region_config.allowlist_only`](#obj-sms_region_configallowlist_only)
+    * [`fn new()`](#fn-sms_region_configallowlist_onlynew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 
@@ -82,6 +90,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `blocking_functions` (`list[obj]`): Configuration related to blocking functions. When `null`, the `blocking_functions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.blocking_functions.new](#fn-blocking_functionsnew) constructor.
   - `quota` (`list[obj]`): Configuration related to quotas. When `null`, the `quota` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.quota.new](#fn-quotanew) constructor.
   - `sign_in` (`list[obj]`): Configuration related to local sign in methods. When `null`, the `sign_in` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.sign_in.new](#fn-sign_innew) constructor.
+  - `sms_region_config` (`list[obj]`): Configures the regions where users are allowed to send verification SMS for the project or tenant. This is based on the calling code of the destination phone number. When `null`, the `sms_region_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.sms_region_config.new](#fn-sms_region_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -112,6 +121,7 @@ injecting into a complete block.
   - `blocking_functions` (`list[obj]`): Configuration related to blocking functions. When `null`, the `blocking_functions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.blocking_functions.new](#fn-blocking_functionsnew) constructor.
   - `quota` (`list[obj]`): Configuration related to quotas. When `null`, the `quota` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.quota.new](#fn-quotanew) constructor.
   - `sign_in` (`list[obj]`): Configuration related to local sign in methods. When `null`, the `sign_in` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.sign_in.new](#fn-sign_innew) constructor.
+  - `sms_region_config` (`list[obj]`): Configures the regions where users are allowed to send verification SMS for the project or tenant. This is based on the calling code of the destination phone number. When `null`, the `sms_region_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.sms_region_config.new](#fn-sms_region_confignew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -277,6 +287,43 @@ function.
   - `value` (`list[obj]`): The value to set for the `sign_in` field.
 
 
+### fn withSmsRegionConfig
+
+```ts
+withSmsRegionConfig()
+```
+
+`google.list[obj].withSmsRegionConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the sms_region_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withSmsRegionConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `sms_region_config` field.
+
+
+### fn withSmsRegionConfigMixin
+
+```ts
+withSmsRegionConfigMixin()
+```
+
+`google.list[obj].withSmsRegionConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the sms_region_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withSmsRegionConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `sms_region_config` field.
+
+
 ### fn withTimeouts
 
 ```ts
@@ -533,6 +580,76 @@ Terraform sub block.
   - An attribute object that represents the `phone_number` sub block.
 
 
+## obj sms_region_config
+
+
+
+### fn sms_region_config.new
+
+```ts
+new()
+```
+
+
+`google.identity_platform_config.sms_region_config.new` constructs a new object with attributes and blocks configured for the `sms_region_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `allow_by_default` (`list[obj]`): A policy of allowing SMS to every region by default and adding disallowed regions to a disallow list. When `null`, the `allow_by_default` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.sms_region_config.allow_by_default.new](#fn-sms_region_configallow_by_defaultnew) constructor.
+  - `allowlist_only` (`list[obj]`): A policy of only allowing regions by explicitly adding them to an allowlist. When `null`, the `allowlist_only` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.identity_platform_config.sms_region_config.allowlist_only.new](#fn-sms_region_configallowlist_onlynew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `sms_region_config` sub block.
+
+
+## obj sms_region_config.allow_by_default
+
+
+
+### fn sms_region_config.allow_by_default.new
+
+```ts
+new()
+```
+
+
+`google.identity_platform_config.sms_region_config.allow_by_default.new` constructs a new object with attributes and blocks configured for the `allow_by_default`
+Terraform sub block.
+
+
+
+**Args**:
+  - `disallowed_regions` (`list`): Two letter unicode region codes to disallow as defined by https://cldr.unicode.org/ The full list of these region codes is here: https://github.com/unicode-cldr/cldr-localenames-full/blob/master/main/en/territories.json When `null`, the `disallowed_regions` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `allow_by_default` sub block.
+
+
+## obj sms_region_config.allowlist_only
+
+
+
+### fn sms_region_config.allowlist_only.new
+
+```ts
+new()
+```
+
+
+`google.identity_platform_config.sms_region_config.allowlist_only.new` constructs a new object with attributes and blocks configured for the `allowlist_only`
+Terraform sub block.
+
+
+
+**Args**:
+  - `allowed_regions` (`list`): Two letter unicode region codes to allow as defined by https://cldr.unicode.org/ The full list of these region codes is here: https://github.com/unicode-cldr/cldr-localenames-full/blob/master/main/en/territories.json When `null`, the `allowed_regions` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `allowlist_only` sub block.
+
+
 ## obj timeouts
 
 
diff --git a/docs/4.x/kms_crypto_key.md b/docs/4.x/kms_crypto_key.md
index d0ee381a..34e57ebb 100644
--- a/docs/4.x/kms_crypto_key.md
+++ b/docs/4.x/kms_crypto_key.md
@@ -66,7 +66,11 @@ If not specified at creation time, the default duration is 24 hours. When `null`
   - `import_only` (`bool`): Whether this key may contain imported versions only. When `null`, the `import_only` field will be omitted from the resulting object.
   - `key_ring` (`string`): The KeyRing that this key belongs to.
 Format: ''projects/{{project}}/locations/{{location}}/keyRings/{{keyRing}}''.
-  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The resource name for the CryptoKey.
   - `purpose` (`string`): The immutable purpose of this CryptoKey. See the
 [purpose reference](https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings.cryptoKeys#CryptoKeyPurpose)
@@ -108,7 +112,11 @@ If not specified at creation time, the default duration is 24 hours. When `null`
   - `import_only` (`bool`): Whether this key may contain imported versions only. When `null`, the `import_only` field will be omitted from the resulting object.
   - `key_ring` (`string`): The KeyRing that this key belongs to.
 Format: ''projects/{{project}}/locations/{{location}}/keyRings/{{keyRing}}''.
-  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The resource name for the CryptoKey.
   - `purpose` (`string`): The immutable purpose of this CryptoKey. See the
 [purpose reference](https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings.cryptoKeys#CryptoKeyPurpose)
diff --git a/docs/4.x/logging_metric.md b/docs/4.x/logging_metric.md
index f282097d..c47a9759 100644
--- a/docs/4.x/logging_metric.md
+++ b/docs/4.x/logging_metric.md
@@ -468,9 +468,9 @@ Terraform sub block.
 
 
 **Args**:
-  - `growth_factor` (`number`): Must be greater than 1. When `null`, the `growth_factor` field will be omitted from the resulting object.
-  - `num_finite_buckets` (`number`): Must be greater than 0. When `null`, the `num_finite_buckets` field will be omitted from the resulting object.
-  - `scale` (`number`): Must be greater than 0. When `null`, the `scale` field will be omitted from the resulting object.
+  - `growth_factor` (`number`): Must be greater than 1.
+  - `num_finite_buckets` (`number`): Must be greater than 0.
+  - `scale` (`number`): Must be greater than 0.
 
 **Returns**:
   - An attribute object that represents the `exponential_buckets` sub block.
@@ -493,9 +493,9 @@ Terraform sub block.
 
 
 **Args**:
-  - `num_finite_buckets` (`number`): Must be greater than 0. When `null`, the `num_finite_buckets` field will be omitted from the resulting object.
-  - `offset` (`number`): Lower bound of the first bucket. When `null`, the `offset` field will be omitted from the resulting object.
-  - `width` (`number`): Must be greater than 0. When `null`, the `width` field will be omitted from the resulting object.
+  - `num_finite_buckets` (`number`): Must be greater than 0.
+  - `offset` (`number`): Lower bound of the first bucket.
+  - `width` (`number`): Must be greater than 0.
 
 **Returns**:
   - An attribute object that represents the `linear_buckets` sub block.
diff --git a/docs/4.x/logging_project_sink.md b/docs/4.x/logging_project_sink.md
index ac4238c5..ad649b2f 100644
--- a/docs/4.x/logging_project_sink.md
+++ b/docs/4.x/logging_project_sink.md
@@ -17,6 +17,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn newAttrs()`](#fn-newattrs)
 * [`fn withBigqueryOptions()`](#fn-withbigqueryoptions)
 * [`fn withBigqueryOptionsMixin()`](#fn-withbigqueryoptionsmixin)
+* [`fn withCustomWriterIdentity()`](#fn-withcustomwriteridentity)
 * [`fn withDescription()`](#fn-withdescription)
 * [`fn withDestination()`](#fn-withdestination)
 * [`fn withDisabled()`](#fn-withdisabled)
@@ -60,13 +61,14 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
+  - `custom_writer_identity` (`string`): A service account provided by the caller that will be used to write the log entries. The format must be serviceAccount:some@email. This field can only be specified if you are routing logs to a destination outside this sink's project. If not specified, a Logging service account will automatically be generated. When `null`, the `custom_writer_identity` field will be omitted from the resulting object.
   - `description` (`string`): A description of this sink. The maximum length of the description is 8000 characters. When `null`, the `description` field will be omitted from the resulting object.
   - `destination` (`string`): The destination of the sink (or, in other words, where logs are written to). Can be a Cloud Storage bucket, a PubSub topic, or a BigQuery dataset. Examples: "storage.googleapis.com/[GCS_BUCKET]" "bigquery.googleapis.com/projects/[PROJECT_ID]/datasets/[DATASET]" "pubsub.googleapis.com/projects/[PROJECT_ID]/topics/[TOPIC_ID]" The writer associated with the sink must have access to write to the above resource.
   - `disabled` (`bool`): If set to True, then this sink is disabled and it does not export any log entries. When `null`, the `disabled` field will be omitted from the resulting object.
   - `filter` (`string`): The filter to apply when exporting logs. Only log entries that match the filter are exported. When `null`, the `filter` field will be omitted from the resulting object.
   - `name` (`string`): The name of the logging sink.
   - `project` (`string`): The ID of the project to create the sink in. If omitted, the project associated with the provider is used. When `null`, the `project` field will be omitted from the resulting object.
-  - `unique_writer_identity` (`bool`): Whether or not to create a unique identity associated with this sink. If false (the default), then the writer_identity used is serviceAccount:cloud-logs@system.gserviceaccount.com. If true, then a unique service account is created and used for this sink. If you wish to publish logs across projects, you must set unique_writer_identity to true. When `null`, the `unique_writer_identity` field will be omitted from the resulting object.
+  - `unique_writer_identity` (`bool`): Whether or not to create a unique identity associated with this sink. If false (the legacy behavior), then the writer_identity used is serviceAccount:cloud-logs@system.gserviceaccount.com. If true (default), then a unique service account is created and used for this sink. If you wish to publish logs across projects, you must set unique_writer_identity to true. When `null`, the `unique_writer_identity` field will be omitted from the resulting object.
   - `bigquery_options` (`list[obj]`): Options that affect sinks exporting data to BigQuery. When `null`, the `bigquery_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_project_sink.bigquery_options.new](#fn-bigquery_optionsnew) constructor.
   - `exclusions` (`list[obj]`): Log entries that match any of the exclusion filters will not be exported. If a log entry is matched by both filter and one of exclusion's filters, it will not be exported. When `null`, the `exclusions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_project_sink.exclusions.new](#fn-exclusionsnew) constructor.
 
@@ -92,13 +94,14 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
+  - `custom_writer_identity` (`string`): A service account provided by the caller that will be used to write the log entries. The format must be serviceAccount:some@email. This field can only be specified if you are routing logs to a destination outside this sink's project. If not specified, a Logging service account will automatically be generated. When `null`, the `custom_writer_identity` field will be omitted from the resulting object.
   - `description` (`string`): A description of this sink. The maximum length of the description is 8000 characters. When `null`, the `description` field will be omitted from the resulting object.
   - `destination` (`string`): The destination of the sink (or, in other words, where logs are written to). Can be a Cloud Storage bucket, a PubSub topic, or a BigQuery dataset. Examples: "storage.googleapis.com/[GCS_BUCKET]" "bigquery.googleapis.com/projects/[PROJECT_ID]/datasets/[DATASET]" "pubsub.googleapis.com/projects/[PROJECT_ID]/topics/[TOPIC_ID]" The writer associated with the sink must have access to write to the above resource.
   - `disabled` (`bool`): If set to True, then this sink is disabled and it does not export any log entries. When `null`, the `disabled` field will be omitted from the resulting object.
   - `filter` (`string`): The filter to apply when exporting logs. Only log entries that match the filter are exported. When `null`, the `filter` field will be omitted from the resulting object.
   - `name` (`string`): The name of the logging sink.
   - `project` (`string`): The ID of the project to create the sink in. If omitted, the project associated with the provider is used. When `null`, the `project` field will be omitted from the resulting object.
-  - `unique_writer_identity` (`bool`): Whether or not to create a unique identity associated with this sink. If false (the default), then the writer_identity used is serviceAccount:cloud-logs@system.gserviceaccount.com. If true, then a unique service account is created and used for this sink. If you wish to publish logs across projects, you must set unique_writer_identity to true. When `null`, the `unique_writer_identity` field will be omitted from the resulting object.
+  - `unique_writer_identity` (`bool`): Whether or not to create a unique identity associated with this sink. If false (the legacy behavior), then the writer_identity used is serviceAccount:cloud-logs@system.gserviceaccount.com. If true (default), then a unique service account is created and used for this sink. If you wish to publish logs across projects, you must set unique_writer_identity to true. When `null`, the `unique_writer_identity` field will be omitted from the resulting object.
   - `bigquery_options` (`list[obj]`): Options that affect sinks exporting data to BigQuery. When `null`, the `bigquery_options` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_project_sink.bigquery_options.new](#fn-bigquery_optionsnew) constructor.
   - `exclusions` (`list[obj]`): Log entries that match any of the exclusion filters will not be exported. If a log entry is matched by both filter and one of exclusion's filters, it will not be exported. When `null`, the `exclusions` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.logging_project_sink.exclusions.new](#fn-exclusionsnew) constructor.
 
@@ -143,6 +146,22 @@ function.
   - `value` (`list[obj]`): The value to set for the `bigquery_options` field.
 
 
+### fn withCustomWriterIdentity
+
+```ts
+withCustomWriterIdentity()
+```
+
+`google.string.withCustomWriterIdentity` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the custom_writer_identity field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `custom_writer_identity` field.
+
+
 ### fn withDescription
 
 ```ts
diff --git a/docs/4.x/looker_instance.md b/docs/4.x/looker_instance.md
index 57e244eb..07215f4f 100644
--- a/docs/4.x/looker_instance.md
+++ b/docs/4.x/looker_instance.md
@@ -98,8 +98,7 @@ project that is hosting the Looker Instance. When `null`, the `consumer_network`
 - LOOKER_CORE_STANDARD: pay as you go standard instance
 - LOOKER_CORE_STANDARD_ANNUAL: subscription standard instance
 - LOOKER_CORE_ENTERPRISE_ANNUAL: subscription enterprise instance
-- LOOKER_CORE_EMBED_ANNUAL: subscription embed instance
-- LOOKER_MODELER: standalone modeling service Default value: "LOOKER_CORE_TRIAL" Possible values: ["LOOKER_CORE_TRIAL", "LOOKER_CORE_STANDARD", "LOOKER_CORE_STANDARD_ANNUAL", "LOOKER_CORE_ENTERPRISE_ANNUAL", "LOOKER_CORE_EMBED_ANNUAL", "LOOKER_MODELER"] When `null`, the `platform_edition` field will be omitted from the resulting object.
+- LOOKER_CORE_EMBED_ANNUAL: subscription embed instance Default value: "LOOKER_CORE_TRIAL" Possible values: ["LOOKER_CORE_TRIAL", "LOOKER_CORE_STANDARD", "LOOKER_CORE_STANDARD_ANNUAL", "LOOKER_CORE_ENTERPRISE_ANNUAL", "LOOKER_CORE_EMBED_ANNUAL"] When `null`, the `platform_edition` field will be omitted from the resulting object.
   - `private_ip_enabled` (`bool`): Whether private IP is enabled on the Looker instance. When `null`, the `private_ip_enabled` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `public_ip_enabled` (`bool`): Whether public IP is enabled on the Looker instance. When `null`, the `public_ip_enabled` field will be omitted from the resulting object.
@@ -161,8 +160,7 @@ project that is hosting the Looker Instance. When `null`, the `consumer_network`
 - LOOKER_CORE_STANDARD: pay as you go standard instance
 - LOOKER_CORE_STANDARD_ANNUAL: subscription standard instance
 - LOOKER_CORE_ENTERPRISE_ANNUAL: subscription enterprise instance
-- LOOKER_CORE_EMBED_ANNUAL: subscription embed instance
-- LOOKER_MODELER: standalone modeling service Default value: "LOOKER_CORE_TRIAL" Possible values: ["LOOKER_CORE_TRIAL", "LOOKER_CORE_STANDARD", "LOOKER_CORE_STANDARD_ANNUAL", "LOOKER_CORE_ENTERPRISE_ANNUAL", "LOOKER_CORE_EMBED_ANNUAL", "LOOKER_MODELER"] When `null`, the `platform_edition` field will be omitted from the resulting object.
+- LOOKER_CORE_EMBED_ANNUAL: subscription embed instance Default value: "LOOKER_CORE_TRIAL" Possible values: ["LOOKER_CORE_TRIAL", "LOOKER_CORE_STANDARD", "LOOKER_CORE_STANDARD_ANNUAL", "LOOKER_CORE_ENTERPRISE_ANNUAL", "LOOKER_CORE_EMBED_ANNUAL"] When `null`, the `platform_edition` field will be omitted from the resulting object.
   - `private_ip_enabled` (`bool`): Whether private IP is enabled on the Looker instance. When `null`, the `private_ip_enabled` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `public_ip_enabled` (`bool`): Whether public IP is enabled on the Looker instance. When `null`, the `public_ip_enabled` field will be omitted from the resulting object.
diff --git a/docs/4.x/memcache_instance.md b/docs/4.x/memcache_instance.md
index 2f3ff8f8..0ff9d335 100644
--- a/docs/4.x/memcache_instance.md
+++ b/docs/4.x/memcache_instance.md
@@ -77,7 +77,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `authorized_network` (`string`): The full name of the GCE network to connect the instance to.  If not provided,
 'default' will be used. When `null`, the `authorized_network` field will be omitted from the resulting object.
   - `display_name` (`string`): A user-visible name for the instance. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user-provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `memcache_version` (`string`): The major version of Memcached software. If not provided, latest supported version will be used.
 Currently the latest supported major version is MEMCACHE_1_5. The minor version will be automatically
 determined by our system based on the latest supported minor version. Default value: "MEMCACHE_1_5" Possible values: ["MEMCACHE_1_5"] When `null`, the `memcache_version` field will be omitted from the resulting object.
@@ -117,7 +121,11 @@ injecting into a complete block.
   - `authorized_network` (`string`): The full name of the GCE network to connect the instance to.  If not provided,
 'default' will be used. When `null`, the `authorized_network` field will be omitted from the resulting object.
   - `display_name` (`string`): A user-visible name for the instance. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user-provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `memcache_version` (`string`): The major version of Memcached software. If not provided, latest supported version will be used.
 Currently the latest supported major version is MEMCACHE_1_5. The minor version will be automatically
 determined by our system based on the latest supported minor version. Default value: "MEMCACHE_1_5" Possible values: ["MEMCACHE_1_5"] When `null`, the `memcache_version` field will be omitted from the resulting object.
diff --git a/docs/4.x/ml_engine_model.md b/docs/4.x/ml_engine_model.md
index b4981e3a..e27120c7 100644
--- a/docs/4.x/ml_engine_model.md
+++ b/docs/4.x/ml_engine_model.md
@@ -61,7 +61,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): The description specified for the model when it was created. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): One or more labels that you can add, to organize your models. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): One or more labels that you can add, to organize your models.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The name specified for the model.
   - `online_prediction_console_logging` (`bool`): If true, online prediction nodes send stderr and stdout streams to Stackdriver Logging When `null`, the `online_prediction_console_logging` field will be omitted from the resulting object.
   - `online_prediction_logging` (`bool`): If true, online prediction access logs are sent to StackDriver Logging. When `null`, the `online_prediction_logging` field will be omitted from the resulting object.
@@ -95,7 +98,10 @@ injecting into a complete block.
 
 **Args**:
   - `description` (`string`): The description specified for the model when it was created. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): One or more labels that you can add, to organize your models. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): One or more labels that you can add, to organize your models.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The name specified for the model.
   - `online_prediction_console_logging` (`bool`): If true, online prediction nodes send stderr and stdout streams to Stackdriver Logging When `null`, the `online_prediction_console_logging` field will be omitted from the resulting object.
   - `online_prediction_logging` (`bool`): If true, online prediction access logs are sent to StackDriver Logging. When `null`, the `online_prediction_logging` field will be omitted from the resulting object.
diff --git a/docs/4.x/monitoring_alert_policy.md b/docs/4.x/monitoring_alert_policy.md
index cb2f366a..4e8f4cb0 100644
--- a/docs/4.x/monitoring_alert_policy.md
+++ b/docs/4.x/monitoring_alert_policy.md
@@ -532,9 +532,7 @@ continues to receive new data points. When `null`, the `condition_absent` sub bl
   - `condition_matched_log` (`list[obj]`): A condition that checks for log messages matching given constraints.
 If set, no other conditions can be present. When `null`, the `condition_matched_log` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.conditions.condition_matched_log.new](#fn-conditionscondition_matched_lognew) constructor.
   - `condition_monitoring_query_language` (`list[obj]`): A Monitoring Query Language query that outputs a boolean stream When `null`, the `condition_monitoring_query_language` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.monitoring_alert_policy.conditions.condition_monitoring_query_language.new](#fn-conditionscondition_monitoring_query_languagenew) constructor.
-  - `condition_prometheus_query_language` (`list[obj]`): A Monitoring Query Language query that outputs a boolean stream
-
-A condition type that allows alert policies to be defined using
+  - `condition_prometheus_query_language` (`list[obj]`): A condition type that allows alert policies to be defined using
 Prometheus Query Language (PromQL).
 
 The PrometheusQueryLanguageCondition message contains information
@@ -884,10 +882,7 @@ Some external tools may require this field to be populated correctly
 in order to refer to the original Prometheus configuration file.
 The rule group name and the alert name are necessary to update the
 relevant AlertPolicies in case the definition of the rule group changes
-in the future.
-
-This field is optional. If this field is not empty, then it must be a
-valid Prometheus label name. When `null`, the `rule_group` field will be omitted from the resulting object.
+in the future. This field is optional. When `null`, the `rule_group` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `condition_prometheus_query_language` sub block.
@@ -1282,6 +1277,10 @@ exceed more than 10,240 bytes when encoded in UTF-8 format,
 whichever is smaller. When `null`, the `content` field will be omitted from the resulting object.
   - `mime_type` (`string`): The format of the content field. Presently, only the value
 "text/markdown" is supported. When `null`, the `mime_type` field will be omitted from the resulting object.
+  - `subject` (`string`): The subject line of the notification. The subject line may not
+exceed 10,240 bytes. In notifications generated by this policy the contents
+of the subject line after variable expansion will be truncated to 255 bytes
+or shorter at the latest UTF-8 character boundary. When `null`, the `subject` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `documentation` sub block.
diff --git a/docs/4.x/network_connectivity_hub.md b/docs/4.x/network_connectivity_hub.md
index efb45595..fdb21768 100644
--- a/docs/4.x/network_connectivity_hub.md
+++ b/docs/4.x/network_connectivity_hub.md
@@ -54,7 +54,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): An optional description of the hub. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements). When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements).
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Immutable. The name of the hub. Hub names must be unique. They use the following form: `projects/{project_number}/locations/global/hubs/{hub_id}`
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_hub.timeouts.new](#fn-timeoutsnew) constructor.
@@ -82,7 +85,10 @@ injecting into a complete block.
 
 **Args**:
   - `description` (`string`): An optional description of the hub. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements). When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements).
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Immutable. The name of the hub. Hub names must be unique. They use the following form: `projects/{project_number}/locations/global/hubs/{hub_id}`
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_hub.timeouts.new](#fn-timeoutsnew) constructor.
diff --git a/docs/4.x/network_connectivity_policy_based_route.md b/docs/4.x/network_connectivity_policy_based_route.md
new file mode 100644
index 00000000..94d8e623
--- /dev/null
+++ b/docs/4.x/network_connectivity_policy_based_route.md
@@ -0,0 +1,500 @@
+---
+permalink: /network_connectivity_policy_based_route/
+---
+
+# network_connectivity_policy_based_route
+
+`network_connectivity_policy_based_route` represents the `google_network_connectivity_policy_based_route` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withDescription()`](#fn-withdescription)
+* [`fn withFilter()`](#fn-withfilter)
+* [`fn withFilterMixin()`](#fn-withfiltermixin)
+* [`fn withInterconnectAttachment()`](#fn-withinterconnectattachment)
+* [`fn withInterconnectAttachmentMixin()`](#fn-withinterconnectattachmentmixin)
+* [`fn withLabels()`](#fn-withlabels)
+* [`fn withName()`](#fn-withname)
+* [`fn withNetwork()`](#fn-withnetwork)
+* [`fn withNextHopIlbIp()`](#fn-withnexthopilbip)
+* [`fn withNextHopOtherRoutes()`](#fn-withnexthopotherroutes)
+* [`fn withPriority()`](#fn-withpriority)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withVirtualMachine()`](#fn-withvirtualmachine)
+* [`fn withVirtualMachineMixin()`](#fn-withvirtualmachinemixin)
+* [`obj filter`](#obj-filter)
+  * [`fn new()`](#fn-filternew)
+* [`obj interconnect_attachment`](#obj-interconnect_attachment)
+  * [`fn new()`](#fn-interconnect_attachmentnew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+* [`obj virtual_machine`](#obj-virtual_machine)
+  * [`fn new()`](#fn-virtual_machinenew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.network_connectivity_policy_based_route.new` injects a new `google_network_connectivity_policy_based_route` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.network_connectivity_policy_based_route.new('some_id')
+
+You can get the reference to the `id` field of the created `google.network_connectivity_policy_based_route` using the reference:
+
+    $._ref.google_network_connectivity_policy_based_route.some_id.get('id')
+
+This is the same as directly entering `"${ google_network_connectivity_policy_based_route.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `name` (`string`): The name of the policy based route.
+  - `network` (`string`): Fully-qualified URL of the network that this route applies to, for example: projects/my-project/global/networks/my-network.
+  - `next_hop_ilb_ip` (`string`): The IP address of a global-access-enabled L4 ILB that is the next hop for matching packets. When `null`, the `next_hop_ilb_ip` field will be omitted from the resulting object.
+  - `next_hop_other_routes` (`string`): Other routes that will be referenced to determine the next hop of the packet. Possible values: ["DEFAULT_ROUTING"] When `null`, the `next_hop_other_routes` field will be omitted from the resulting object.
+  - `priority` (`number`): The priority of this policy-based route. Priority is used to break ties in cases where there are more than one matching policy-based routes found. In cases where multiple policy-based routes are matched, the one with the lowest-numbered priority value wins. The default value is 1000. The priority value must be from 1 to 65535, inclusive. When `null`, the `priority` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `filter` (`list[obj]`): The filter to match L4 traffic. When `null`, the `filter` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_policy_based_route.filter.new](#fn-filternew) constructor.
+  - `interconnect_attachment` (`list[obj]`): The interconnect attachments that this policy-based route applies to. When `null`, the `interconnect_attachment` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_policy_based_route.interconnect_attachment.new](#fn-interconnect_attachmentnew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_policy_based_route.timeouts.new](#fn-timeoutsnew) constructor.
+  - `virtual_machine` (`list[obj]`): VM instances to which this policy-based route applies to. When `null`, the `virtual_machine` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_policy_based_route.virtual_machine.new](#fn-virtual_machinenew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.network_connectivity_policy_based_route.newAttrs` constructs a new object with attributes and blocks configured for the `network_connectivity_policy_based_route`
+Terraform resource.
+
+Unlike [google.network_connectivity_policy_based_route.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `description` (`string`): An optional description of this resource. When `null`, the `description` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `name` (`string`): The name of the policy based route.
+  - `network` (`string`): Fully-qualified URL of the network that this route applies to, for example: projects/my-project/global/networks/my-network.
+  - `next_hop_ilb_ip` (`string`): The IP address of a global-access-enabled L4 ILB that is the next hop for matching packets. When `null`, the `next_hop_ilb_ip` field will be omitted from the resulting object.
+  - `next_hop_other_routes` (`string`): Other routes that will be referenced to determine the next hop of the packet. Possible values: ["DEFAULT_ROUTING"] When `null`, the `next_hop_other_routes` field will be omitted from the resulting object.
+  - `priority` (`number`): The priority of this policy-based route. Priority is used to break ties in cases where there are more than one matching policy-based routes found. In cases where multiple policy-based routes are matched, the one with the lowest-numbered priority value wins. The default value is 1000. The priority value must be from 1 to 65535, inclusive. When `null`, the `priority` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `filter` (`list[obj]`): The filter to match L4 traffic. When `null`, the `filter` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_policy_based_route.filter.new](#fn-filternew) constructor.
+  - `interconnect_attachment` (`list[obj]`): The interconnect attachments that this policy-based route applies to. When `null`, the `interconnect_attachment` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_policy_based_route.interconnect_attachment.new](#fn-interconnect_attachmentnew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_policy_based_route.timeouts.new](#fn-timeoutsnew) constructor.
+  - `virtual_machine` (`list[obj]`): VM instances to which this policy-based route applies to. When `null`, the `virtual_machine` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.network_connectivity_policy_based_route.virtual_machine.new](#fn-virtual_machinenew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `network_connectivity_policy_based_route` resource into the root Terraform configuration.
+
+
+### fn withDescription
+
+```ts
+withDescription()
+```
+
+`google.string.withDescription` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the description field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `description` field.
+
+
+### fn withFilter
+
+```ts
+withFilter()
+```
+
+`google.list[obj].withFilter` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the filter field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withFilterMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `filter` field.
+
+
+### fn withFilterMixin
+
+```ts
+withFilterMixin()
+```
+
+`google.list[obj].withFilterMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the filter field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withFilter](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `filter` field.
+
+
+### fn withInterconnectAttachment
+
+```ts
+withInterconnectAttachment()
+```
+
+`google.list[obj].withInterconnectAttachment` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the interconnect_attachment field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withInterconnectAttachmentMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `interconnect_attachment` field.
+
+
+### fn withInterconnectAttachmentMixin
+
+```ts
+withInterconnectAttachmentMixin()
+```
+
+`google.list[obj].withInterconnectAttachmentMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the interconnect_attachment field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withInterconnectAttachment](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `interconnect_attachment` field.
+
+
+### fn withLabels
+
+```ts
+withLabels()
+```
+
+`google.obj.withLabels` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the labels field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `labels` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withNetwork
+
+```ts
+withNetwork()
+```
+
+`google.string.withNetwork` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the network field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `network` field.
+
+
+### fn withNextHopIlbIp
+
+```ts
+withNextHopIlbIp()
+```
+
+`google.string.withNextHopIlbIp` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the next_hop_ilb_ip field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `next_hop_ilb_ip` field.
+
+
+### fn withNextHopOtherRoutes
+
+```ts
+withNextHopOtherRoutes()
+```
+
+`google.string.withNextHopOtherRoutes` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the next_hop_other_routes field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `next_hop_other_routes` field.
+
+
+### fn withPriority
+
+```ts
+withPriority()
+```
+
+`google.number.withPriority` constructs a mixin object that can be merged into the `number`
+Terraform resource block to set or update the priority field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`number`): The value to set for the `priority` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withVirtualMachine
+
+```ts
+withVirtualMachine()
+```
+
+`google.list[obj].withVirtualMachine` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the virtual_machine field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withVirtualMachineMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `virtual_machine` field.
+
+
+### fn withVirtualMachineMixin
+
+```ts
+withVirtualMachineMixin()
+```
+
+`google.list[obj].withVirtualMachineMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the virtual_machine field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withVirtualMachine](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `virtual_machine` field.
+
+
+## obj filter
+
+
+
+### fn filter.new
+
+```ts
+new()
+```
+
+
+`google.network_connectivity_policy_based_route.filter.new` constructs a new object with attributes and blocks configured for the `filter`
+Terraform sub block.
+
+
+
+**Args**:
+  - `dest_range` (`string`): The destination IP range of outgoing packets that this policy-based route applies to. Default is "0.0.0.0/0" if protocol version is IPv4. When `null`, the `dest_range` field will be omitted from the resulting object.
+  - `ip_protocol` (`string`): The IP protocol that this policy-based route applies to. Valid values are 'TCP', 'UDP', and 'ALL'. Default is 'ALL'. When `null`, the `ip_protocol` field will be omitted from the resulting object.
+  - `protocol_version` (`string`): Internet protocol versions this policy-based route applies to. Possible values: ["IPV4"]
+  - `src_range` (`string`): The source IP range of outgoing packets that this policy-based route applies to. Default is "0.0.0.0/0" if protocol version is IPv4. When `null`, the `src_range` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `filter` sub block.
+
+
+## obj interconnect_attachment
+
+
+
+### fn interconnect_attachment.new
+
+```ts
+new()
+```
+
+
+`google.network_connectivity_policy_based_route.interconnect_attachment.new` constructs a new object with attributes and blocks configured for the `interconnect_attachment`
+Terraform sub block.
+
+
+
+**Args**:
+  - `region` (`string`): Cloud region to install this policy-based route on for Interconnect attachments. Use 'all' to install it on all Interconnect attachments.
+
+**Returns**:
+  - An attribute object that represents the `interconnect_attachment` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.network_connectivity_policy_based_route.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
+
+
+## obj virtual_machine
+
+
+
+### fn virtual_machine.new
+
+```ts
+new()
+```
+
+
+`google.network_connectivity_policy_based_route.virtual_machine.new` constructs a new object with attributes and blocks configured for the `virtual_machine`
+Terraform sub block.
+
+
+
+**Args**:
+  - `tags` (`list`): A list of VM instance tags that this policy-based route applies to. VM instances that have ANY of tags specified here will install this PBR.
+
+**Returns**:
+  - An attribute object that represents the `virtual_machine` sub block.
diff --git a/docs/4.x/network_connectivity_service_connection_policy.md b/docs/4.x/network_connectivity_service_connection_policy.md
index 71fe1a3d..540e019a 100644
--- a/docs/4.x/network_connectivity_service_connection_policy.md
+++ b/docs/4.x/network_connectivity_service_connection_policy.md
@@ -61,7 +61,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): Free-text description of the resource. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): User-defined labels. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location of the ServiceConnectionPolicy.
   - `name` (`string`): The name of a ServiceConnectionPolicy. Format: projects/{project}/locations/{location}/serviceConnectionPolicies/{service_connection_policy} See: https://google.aip.dev/122#fields-representing-resource-names
   - `network` (`string`): The resource path of the consumer network. Example: - projects/{projectNumOrId}/global/networks/{resourceId}.
@@ -94,7 +98,11 @@ injecting into a complete block.
 
 **Args**:
   - `description` (`string`): Free-text description of the resource. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): User-defined labels. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): User-defined labels.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location of the ServiceConnectionPolicy.
   - `name` (`string`): The name of a ServiceConnectionPolicy. Format: projects/{project}/locations/{location}/serviceConnectionPolicies/{service_connection_policy} See: https://google.aip.dev/122#fields-representing-resource-names
   - `network` (`string`): The resource path of the consumer network. Example: - projects/{projectNumOrId}/global/networks/{resourceId}.
diff --git a/docs/4.x/network_connectivity_spoke.md b/docs/4.x/network_connectivity_spoke.md
index d8cc8fdb..df6318fa 100644
--- a/docs/4.x/network_connectivity_spoke.md
+++ b/docs/4.x/network_connectivity_spoke.md
@@ -75,7 +75,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): An optional description of the spoke. When `null`, the `description` field will be omitted from the resulting object.
   - `hub` (`string`): Immutable. The URI of the hub that this spoke is attached to.
-  - `labels` (`obj`): Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements). When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements).
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): Immutable. The name of the spoke. Spoke names must be unique.
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
@@ -109,7 +112,10 @@ injecting into a complete block.
 **Args**:
   - `description` (`string`): An optional description of the spoke. When `null`, the `description` field will be omitted from the resulting object.
   - `hub` (`string`): Immutable. The URI of the hub that this spoke is attached to.
-  - `labels` (`obj`): Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements). When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional labels in key:value format. For more information about labels, see [Requirements for labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements).
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): Immutable. The name of the spoke. Spoke names must be unique.
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
diff --git a/docs/4.x/network_management_connectivity_test.md b/docs/4.x/network_management_connectivity_test.md
index 931ee644..6b381b15 100644
--- a/docs/4.x/network_management_connectivity_test.md
+++ b/docs/4.x/network_management_connectivity_test.md
@@ -65,7 +65,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): The user-supplied description of the Connectivity Test.
 Maximum of 512 characters. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user-provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Unique name for the connectivity test.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `protocol` (`string`): IP Protocol of the test. When not provided, "TCP" is assumed. When `null`, the `protocol` field will be omitted from the resulting object.
@@ -139,7 +143,11 @@ injecting into a complete block.
 **Args**:
   - `description` (`string`): The user-supplied description of the Connectivity Test.
 Maximum of 512 characters. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user-provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user-provided metadata.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Unique name for the connectivity test.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `protocol` (`string`): IP Protocol of the test. When not provided, "TCP" is assumed. When `null`, the `protocol` field will be omitted from the resulting object.
diff --git a/docs/4.x/network_security_address_group.md b/docs/4.x/network_security_address_group.md
index fec29458..f9a81b14 100644
--- a/docs/4.x/network_security_address_group.md
+++ b/docs/4.x/network_security_address_group.md
@@ -61,7 +61,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `description` (`string`): Free-text description of the resource. When `null`, the `description` field will be omitted from the resulting object.
   - `items` (`list`): List of items. When `null`, the `items` field will be omitted from the resulting object.
   - `labels` (`obj`): Set of label tags associated with the AddressGroup resource.
-An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location of the gateway security policy.
 The default value is 'global'.
   - `name` (`string`): Name of the AddressGroup resource.
@@ -95,7 +99,11 @@ injecting into a complete block.
   - `description` (`string`): Free-text description of the resource. When `null`, the `description` field will be omitted from the resulting object.
   - `items` (`list`): List of items. When `null`, the `items` field will be omitted from the resulting object.
   - `labels` (`obj`): Set of label tags associated with the AddressGroup resource.
-An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location of the gateway security policy.
 The default value is 'global'.
   - `name` (`string`): Name of the AddressGroup resource.
diff --git a/docs/4.x/network_services_edge_cache_keyset.md b/docs/4.x/network_services_edge_cache_keyset.md
index f85ac479..7e08feed 100644
--- a/docs/4.x/network_services_edge_cache_keyset.md
+++ b/docs/4.x/network_services_edge_cache_keyset.md
@@ -62,7 +62,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource; provided by the client when the resource is created.
 The name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,
 and all following characters must be a dash, underscore, letter or digit.
@@ -103,7 +106,10 @@ injecting into a complete block.
 
 **Args**:
   - `description` (`string`): A human-readable description of the resource. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource; provided by the client when the resource is created.
 The name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,
 and all following characters must be a dash, underscore, letter or digit.
diff --git a/docs/4.x/network_services_edge_cache_origin.md b/docs/4.x/network_services_edge_cache_origin.md
index cf305366..99dc7e00 100644
--- a/docs/4.x/network_services_edge_cache_origin.md
+++ b/docs/4.x/network_services_edge_cache_origin.md
@@ -87,7 +87,10 @@ After maxAttempts is reached, the configured failoverOrigin will be used to fulf
 
 The value of timeout.maxAttemptsTimeout dictates the timeout across all origins.
 A reference to a Topic resource. When `null`, the `failover_origin` field will be omitted from the resulting object.
-  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `max_attempts` (`number`): The maximum number of attempts to cache fill from this origin. Another attempt is made when a cache fill fails with one of the retryConditions.
 
 Once maxAttempts to this origin have failed the failoverOrigin will be used, if one is specified. That failoverOrigin may specify its own maxAttempts,
@@ -168,7 +171,10 @@ After maxAttempts is reached, the configured failoverOrigin will be used to fulf
 
 The value of timeout.maxAttemptsTimeout dictates the timeout across all origins.
 A reference to a Topic resource. When `null`, the `failover_origin` field will be omitted from the resulting object.
-  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `max_attempts` (`number`): The maximum number of attempts to cache fill from this origin. Another attempt is made when a cache fill fails with one of the retryConditions.
 
 Once maxAttempts to this origin have failed the failoverOrigin will be used, if one is specified. That failoverOrigin may specify its own maxAttempts,
diff --git a/docs/4.x/network_services_edge_cache_service.md b/docs/4.x/network_services_edge_cache_service.md
index af275ef8..ae9bcdbd 100644
--- a/docs/4.x/network_services_edge_cache_service.md
+++ b/docs/4.x/network_services_edge_cache_service.md
@@ -116,7 +116,10 @@ Some legacy HTTP clients may have issues with HTTP/2 connections due to broken H
   - `edge_ssl_certificates` (`list`): URLs to sslCertificate resources that are used to authenticate connections between users and the EdgeCacheService.
 
 Note that only "global" certificates with a "scope" of "EDGE_CACHE" can be attached to an EdgeCacheService. When `null`, the `edge_ssl_certificates` field will be omitted from the resulting object.
-  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource; provided by the client when the resource is created.
 The name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,
 and all following characters must be a dash, underscore, letter or digit.
@@ -165,7 +168,10 @@ Some legacy HTTP clients may have issues with HTTP/2 connections due to broken H
   - `edge_ssl_certificates` (`list`): URLs to sslCertificate resources that are used to authenticate connections between users and the EdgeCacheService.
 
 Note that only "global" certificates with a "scope" of "EDGE_CACHE" can be attached to an EdgeCacheService. When `null`, the `edge_ssl_certificates` field will be omitted from the resulting object.
-  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Set of label tags associated with the EdgeCache resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Name of the resource; provided by the client when the resource is created.
 The name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,
 and all following characters must be a dash, underscore, letter or digit.
diff --git a/docs/4.x/network_services_gateway.md b/docs/4.x/network_services_gateway.md
index e0a076cb..3160c459 100644
--- a/docs/4.x/network_services_gateway.md
+++ b/docs/4.x/network_services_gateway.md
@@ -75,7 +75,10 @@ If there is no other gateway of type 'SECURE_WEB_GATEWAY' remaining for
   - `gateway_security_policy` (`string`): A fully-qualified GatewaySecurityPolicy URL reference. Defines how a server should apply security policy to inbound (VM to Proxy) initiated connections.
 For example: 'projects/*/locations/*/gatewaySecurityPolicies/swg-policy'.
 This policy is specific to gateways of type 'SECURE_WEB_GATEWAY'. When `null`, the `gateway_security_policy` field will be omitted from the resulting object.
-  - `labels` (`obj`): Set of label tags associated with the Gateway resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Set of label tags associated with the Gateway resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location of the gateway.
 The default value is 'global'. When `null`, the `location` field will be omitted from the resulting object.
   - `name` (`string`): Short name of the Gateway resource to be created.
@@ -131,7 +134,10 @@ If there is no other gateway of type 'SECURE_WEB_GATEWAY' remaining for
   - `gateway_security_policy` (`string`): A fully-qualified GatewaySecurityPolicy URL reference. Defines how a server should apply security policy to inbound (VM to Proxy) initiated connections.
 For example: 'projects/*/locations/*/gatewaySecurityPolicies/swg-policy'.
 This policy is specific to gateways of type 'SECURE_WEB_GATEWAY'. When `null`, the `gateway_security_policy` field will be omitted from the resulting object.
-  - `labels` (`obj`): Set of label tags associated with the Gateway resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Set of label tags associated with the Gateway resource.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location of the gateway.
 The default value is 'global'. When `null`, the `location` field will be omitted from the resulting object.
   - `name` (`string`): Short name of the Gateway resource to be created.
diff --git a/docs/4.x/notebooks_instance.md b/docs/4.x/notebooks_instance.md
index 86d1d4a4..22e11e49 100644
--- a/docs/4.x/notebooks_instance.md
+++ b/docs/4.x/notebooks_instance.md
@@ -120,7 +120,11 @@ your VM instance's service account can use the instance. When `null`, the `i
   - `kms_key` (`string`): The KMS key used to encrypt the disks, only applicable if diskEncryption is CMEK.
 Format: projects/{project_id}/locations/{location}/keyRings/{key_ring_id}/cryptoKeys/{key_id} When `null`, the `kms_key` field will be omitted from the resulting object.
   - `labels` (`obj`): Labels to apply to this instance. These can be later modified by the setLabels method.
-An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): A reference to the zone where the machine resides.
   - `machine_type` (`string`): A reference to a machine type which defines VM kind.
   - `metadata` (`obj`): Custom metadata to apply to this instance.
@@ -205,7 +209,11 @@ your VM instance's service account can use the instance. When `null`, the `i
   - `kms_key` (`string`): The KMS key used to encrypt the disks, only applicable if diskEncryption is CMEK.
 Format: projects/{project_id}/locations/{location}/keyRings/{key_ring_id}/cryptoKeys/{key_id} When `null`, the `kms_key` field will be omitted from the resulting object.
   - `labels` (`obj`): Labels to apply to this instance. These can be later modified by the setLabels method.
-An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): A reference to the zone where the machine resides.
   - `machine_type` (`string`): A reference to a machine type which defines VM kind.
   - `metadata` (`obj`): Custom metadata to apply to this instance.
diff --git a/docs/4.x/org_policy_custom_constraint.md b/docs/4.x/org_policy_custom_constraint.md
new file mode 100644
index 00000000..05aad3de
--- /dev/null
+++ b/docs/4.x/org_policy_custom_constraint.md
@@ -0,0 +1,292 @@
+---
+permalink: /org_policy_custom_constraint/
+---
+
+# org_policy_custom_constraint
+
+`org_policy_custom_constraint` represents the `google_org_policy_custom_constraint` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withActionType()`](#fn-withactiontype)
+* [`fn withCondition()`](#fn-withcondition)
+* [`fn withDescription()`](#fn-withdescription)
+* [`fn withDisplayName()`](#fn-withdisplayname)
+* [`fn withMethodTypes()`](#fn-withmethodtypes)
+* [`fn withName()`](#fn-withname)
+* [`fn withParent()`](#fn-withparent)
+* [`fn withResourceTypes()`](#fn-withresourcetypes)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.org_policy_custom_constraint.new` injects a new `google_org_policy_custom_constraint` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.org_policy_custom_constraint.new('some_id')
+
+You can get the reference to the `id` field of the created `google.org_policy_custom_constraint` using the reference:
+
+    $._ref.google_org_policy_custom_constraint.some_id.get('id')
+
+This is the same as directly entering `"${ google_org_policy_custom_constraint.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `action_type` (`string`): The action to take if the condition is met. Possible values: ["ALLOW", "DENY"]
+  - `condition` (`string`): A CEL condition that refers to a supported service resource, for example 'resource.management.autoUpgrade == false'. For details about CEL usage, see [Common Expression Language](https://cloud.google.com/resource-manager/docs/organization-policy/creating-managing-custom-constraints#common_expression_language).
+  - `description` (`string`): A human-friendly description of the constraint to display as an error message when the policy is violated. When `null`, the `description` field will be omitted from the resulting object.
+  - `display_name` (`string`): A human-friendly name for the constraint. When `null`, the `display_name` field will be omitted from the resulting object.
+  - `method_types` (`list`): A list of RESTful methods for which to enforce the constraint. Can be 'CREATE', 'UPDATE', or both. Not all Google Cloud services support both methods. To see supported methods for each service, find the service in [Supported services](https://cloud.google.com/resource-manager/docs/organization-policy/custom-constraint-supported-services).
+  - `name` (`string`): Immutable. The name of the custom constraint. This is unique within the organization.
+  - `parent` (`string`): The parent of the resource, an organization. Format should be 'organizations/{organization_id}'.
+  - `resource_types` (`list`): Immutable. The fully qualified name of the Google Cloud REST resource containing the object and field you want to restrict. For example, 'container.googleapis.com/NodePool'.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_custom_constraint.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.org_policy_custom_constraint.newAttrs` constructs a new object with attributes and blocks configured for the `org_policy_custom_constraint`
+Terraform resource.
+
+Unlike [google.org_policy_custom_constraint.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `action_type` (`string`): The action to take if the condition is met. Possible values: ["ALLOW", "DENY"]
+  - `condition` (`string`): A CEL condition that refers to a supported service resource, for example 'resource.management.autoUpgrade == false'. For details about CEL usage, see [Common Expression Language](https://cloud.google.com/resource-manager/docs/organization-policy/creating-managing-custom-constraints#common_expression_language).
+  - `description` (`string`): A human-friendly description of the constraint to display as an error message when the policy is violated. When `null`, the `description` field will be omitted from the resulting object.
+  - `display_name` (`string`): A human-friendly name for the constraint. When `null`, the `display_name` field will be omitted from the resulting object.
+  - `method_types` (`list`): A list of RESTful methods for which to enforce the constraint. Can be 'CREATE', 'UPDATE', or both. Not all Google Cloud services support both methods. To see supported methods for each service, find the service in [Supported services](https://cloud.google.com/resource-manager/docs/organization-policy/custom-constraint-supported-services).
+  - `name` (`string`): Immutable. The name of the custom constraint. This is unique within the organization.
+  - `parent` (`string`): The parent of the resource, an organization. Format should be 'organizations/{organization_id}'.
+  - `resource_types` (`list`): Immutable. The fully qualified name of the Google Cloud REST resource containing the object and field you want to restrict. For example, 'container.googleapis.com/NodePool'.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.org_policy_custom_constraint.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `org_policy_custom_constraint` resource into the root Terraform configuration.
+
+
+### fn withActionType
+
+```ts
+withActionType()
+```
+
+`google.string.withActionType` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the action_type field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `action_type` field.
+
+
+### fn withCondition
+
+```ts
+withCondition()
+```
+
+`google.string.withCondition` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the condition field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `condition` field.
+
+
+### fn withDescription
+
+```ts
+withDescription()
+```
+
+`google.string.withDescription` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the description field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `description` field.
+
+
+### fn withDisplayName
+
+```ts
+withDisplayName()
+```
+
+`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the display_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `display_name` field.
+
+
+### fn withMethodTypes
+
+```ts
+withMethodTypes()
+```
+
+`google.list.withMethodTypes` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the method_types field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `method_types` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withParent
+
+```ts
+withParent()
+```
+
+`google.string.withParent` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the parent field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `parent` field.
+
+
+### fn withResourceTypes
+
+```ts
+withResourceTypes()
+```
+
+`google.list.withResourceTypes` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the resource_types field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `resource_types` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.org_policy_custom_constraint.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/os_config_patch_deployment.md b/docs/4.x/os_config_patch_deployment.md
index 4342899b..b20ff778 100644
--- a/docs/4.x/os_config_patch_deployment.md
+++ b/docs/4.x/os_config_patch_deployment.md
@@ -1034,6 +1034,7 @@ Terraform sub block.
 
 **Args**:
   - `day_of_week` (`string`): A day of the week. Possible values: ["MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY", "SUNDAY"]
+  - `day_offset` (`number`): Represents the number of days before or after the given week day of month that the patch deployment is scheduled for. When `null`, the `day_offset` field will be omitted from the resulting object.
   - `week_ordinal` (`number`): Week number in a month. 1-4 indicates the 1st to 4th week of the month. -1 indicates the last week of the month.
 
 **Returns**:
diff --git a/docs/4.x/privateca_ca_pool.md b/docs/4.x/privateca_ca_pool.md
index ce3c1f88..24a41fa0 100644
--- a/docs/4.x/privateca_ca_pool.md
+++ b/docs/4.x/privateca_ca_pool.md
@@ -97,7 +97,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `labels` (`obj`): Labels with user-defined metadata.
 
 An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass":
-"1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+"1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): Location of the CaPool. A full list of valid locations can be found by
 running 'gcloud privateca locations list'.
   - `name` (`string`): The name for this CaPool.
@@ -132,7 +136,11 @@ injecting into a complete block.
   - `labels` (`obj`): Labels with user-defined metadata.
 
 An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass":
-"1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+"1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): Location of the CaPool. A full list of valid locations can be found by
 running 'gcloud privateca locations list'.
   - `name` (`string`): The name for this CaPool.
diff --git a/docs/4.x/privateca_certificate.md b/docs/4.x/privateca_certificate.md
index 6a4f447d..3cff320d 100644
--- a/docs/4.x/privateca_certificate.md
+++ b/docs/4.x/privateca_certificate.md
@@ -99,7 +99,11 @@ in the format 'projects/*/locations/*/certificateTemplates/*'. If this i
 the caller must have the necessary permission to use this template. If this is
 omitted, no template will be used. This template must be in the same location
 as the Certificate. When `null`, the `certificate_template` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `lifetime` (`string`): The desired lifetime of the CA certificate. Used to create the "notBeforeTime" and
 "notAfterTime" fields inside an X.509 certificate. A duration in seconds with up to nine
 fractional digits, terminated by 's'. Example: "3.5s". When `null`, the `lifetime` field will be omitted from the resulting object.
@@ -143,7 +147,11 @@ in the format 'projects/*/locations/*/certificateTemplates/*'. If this i
 the caller must have the necessary permission to use this template. If this is
 omitted, no template will be used. This template must be in the same location
 as the Certificate. When `null`, the `certificate_template` field will be omitted from the resulting object.
-  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Labels with user-defined metadata to apply to this resource.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `lifetime` (`string`): The desired lifetime of the CA certificate. Used to create the "notBeforeTime" and
 "notAfterTime" fields inside an X.509 certificate. A duration in seconds with up to nine
 fractional digits, terminated by 's'. Example: "3.5s". When `null`, the `lifetime` field will be omitted from the resulting object.
diff --git a/docs/4.x/privateca_certificate_authority.md b/docs/4.x/privateca_certificate_authority.md
index 56d21ef1..17054d48 100644
--- a/docs/4.x/privateca_certificate_authority.md
+++ b/docs/4.x/privateca_certificate_authority.md
@@ -116,7 +116,11 @@ Use with care. Defaults to 'false'. When `null`, the `ignore_active_cert
   - `labels` (`obj`): Labels with user-defined metadata.
 
 An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass":
-"1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+"1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `lifetime` (`string`): The desired lifetime of the CA certificate. Used to create the "notBeforeTime" and
 "notAfterTime" fields inside an X.509 certificate. A duration in seconds with up to nine
 fractional digits, terminated by 's'. Example: "3.5s". When `null`, the `lifetime` field will be omitted from the resulting object.
@@ -177,7 +181,11 @@ Use with care. Defaults to 'false'. When `null`, the `ignore_active_cert
   - `labels` (`obj`): Labels with user-defined metadata.
 
 An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass":
-"1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+"1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `lifetime` (`string`): The desired lifetime of the CA certificate. Used to create the "notBeforeTime" and
 "notAfterTime" fields inside an X.509 certificate. A duration in seconds with up to nine
 fractional digits, terminated by 's'. Example: "3.5s". When `null`, the `lifetime` field will be omitted from the resulting object.
diff --git a/docs/4.x/privateca_certificate_template.md b/docs/4.x/privateca_certificate_template.md
index 40d84b1f..ef30657f 100644
--- a/docs/4.x/privateca_certificate_template.md
+++ b/docs/4.x/privateca_certificate_template.md
@@ -87,7 +87,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): Optional. A human-readable description of scenarios this template is intended for. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional. Labels with user-defined metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. Labels with user-defined metadata.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): The resource name for this CertificateTemplate in the format `projects/*/locations/*/certificateTemplates/*`.
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
@@ -119,7 +122,10 @@ injecting into a complete block.
 
 **Args**:
   - `description` (`string`): Optional. A human-readable description of scenarios this template is intended for. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Optional. Labels with user-defined metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Optional. Labels with user-defined metadata.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): The resource name for this CertificateTemplate in the format `projects/*/locations/*/certificateTemplates/*`.
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
diff --git a/docs/4.x/project.md b/docs/4.x/project.md
index 5133a7b3..62aa0258 100644
--- a/docs/4.x/project.md
+++ b/docs/4.x/project.md
@@ -60,7 +60,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `auto_create_network` (`bool`): Create the 'default' network automatically.  Default true. If set to false, the default network will be deleted.  Note that, for quota purposes, you will still need to have 1 network slot available to create the project successfully, even if you set auto_create_network to false, since the network will exist momentarily. When `null`, the `auto_create_network` field will be omitted from the resulting object.
   - `billing_account` (`string`): The alphanumeric ID of the billing account this project belongs to. The user or service account performing this operation with Terraform must have Billing Account Administrator privileges (roles/billing.admin) in the organization. See Google Cloud Billing API Access Control for more details. When `null`, the `billing_account` field will be omitted from the resulting object.
   - `folder_id` (`string`): The numeric ID of the folder this project should be created under. Only one of org_id or folder_id may be specified. If the folder_id is specified, then the project is created under the specified folder. Changing this forces the project to be migrated to the newly specified folder. When `null`, the `folder_id` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to the project. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to the project.
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The display name of the project.
   - `org_id` (`string`): The numeric ID of the organization this project belongs to. Changing this forces a new project to be created.  Only one of org_id or folder_id may be specified. If the org_id is specified then the project is created at the top level. Changing this forces the project to be migrated to the newly specified organization. When `null`, the `org_id` field will be omitted from the resulting object.
   - `project_id` (`string`): The project ID. Changing this forces a new project to be created.
@@ -92,7 +95,10 @@ injecting into a complete block.
   - `auto_create_network` (`bool`): Create the 'default' network automatically.  Default true. If set to false, the default network will be deleted.  Note that, for quota purposes, you will still need to have 1 network slot available to create the project successfully, even if you set auto_create_network to false, since the network will exist momentarily. When `null`, the `auto_create_network` field will be omitted from the resulting object.
   - `billing_account` (`string`): The alphanumeric ID of the billing account this project belongs to. The user or service account performing this operation with Terraform must have Billing Account Administrator privileges (roles/billing.admin) in the organization. See Google Cloud Billing API Access Control for more details. When `null`, the `billing_account` field will be omitted from the resulting object.
   - `folder_id` (`string`): The numeric ID of the folder this project should be created under. Only one of org_id or folder_id may be specified. If the folder_id is specified, then the project is created under the specified folder. Changing this forces the project to be migrated to the newly specified folder. When `null`, the `folder_id` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to the project. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to the project.
+				
+				**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+				Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The display name of the project.
   - `org_id` (`string`): The numeric ID of the organization this project belongs to. Changing this forces a new project to be created.  Only one of org_id or folder_id may be specified. If the org_id is specified then the project is created at the top level. Changing this forces the project to be migrated to the newly specified organization. When `null`, the `org_id` field will be omitted from the resulting object.
   - `project_id` (`string`): The project ID. Changing this forces a new project to be created.
diff --git a/docs/4.x/provider.md b/docs/4.x/provider.md
index 0b9c0649..0c22171a 100644
--- a/docs/4.x/provider.md
+++ b/docs/4.x/provider.md
@@ -65,7 +65,6 @@ the `src` and/or `version` parameters are set.
   - `cloud_functions_custom_endpoint` (`string`): Set the `cloud_functions_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_functions_custom_endpoint` field will be omitted from the resulting object.
   - `cloud_identity_custom_endpoint` (`string`): Set the `cloud_identity_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_identity_custom_endpoint` field will be omitted from the resulting object.
   - `cloud_ids_custom_endpoint` (`string`): Set the `cloud_ids_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_ids_custom_endpoint` field will be omitted from the resulting object.
-  - `cloud_iot_custom_endpoint` (`string`): Set the `cloud_iot_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_iot_custom_endpoint` field will be omitted from the resulting object.
   - `cloud_resource_manager_custom_endpoint` (`string`): Set the `cloud_resource_manager_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_resource_manager_custom_endpoint` field will be omitted from the resulting object.
   - `cloud_run_custom_endpoint` (`string`): Set the `cloud_run_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_run_custom_endpoint` field will be omitted from the resulting object.
   - `cloud_run_v2_custom_endpoint` (`string`): Set the `cloud_run_v2_custom_endpoint` field on the resulting provider block. When `null`, the `cloud_run_v2_custom_endpoint` field will be omitted from the resulting object.
@@ -94,23 +93,25 @@ the `src` and/or `version` parameters are set.
   - `dataproc_metastore_custom_endpoint` (`string`): Set the `dataproc_metastore_custom_endpoint` field on the resulting provider block. When `null`, the `dataproc_metastore_custom_endpoint` field will be omitted from the resulting object.
   - `datastore_custom_endpoint` (`string`): Set the `datastore_custom_endpoint` field on the resulting provider block. When `null`, the `datastore_custom_endpoint` field will be omitted from the resulting object.
   - `datastream_custom_endpoint` (`string`): Set the `datastream_custom_endpoint` field on the resulting provider block. When `null`, the `datastream_custom_endpoint` field will be omitted from the resulting object.
+  - `default_labels` (`obj`): Set the `default_labels` field on the resulting provider block. When `null`, the `default_labels` field will be omitted from the resulting object.
   - `deployment_manager_custom_endpoint` (`string`): Set the `deployment_manager_custom_endpoint` field on the resulting provider block. When `null`, the `deployment_manager_custom_endpoint` field will be omitted from the resulting object.
   - `dialogflow_custom_endpoint` (`string`): Set the `dialogflow_custom_endpoint` field on the resulting provider block. When `null`, the `dialogflow_custom_endpoint` field will be omitted from the resulting object.
   - `dialogflow_cx_custom_endpoint` (`string`): Set the `dialogflow_cx_custom_endpoint` field on the resulting provider block. When `null`, the `dialogflow_cx_custom_endpoint` field will be omitted from the resulting object.
   - `dns_custom_endpoint` (`string`): Set the `dns_custom_endpoint` field on the resulting provider block. When `null`, the `dns_custom_endpoint` field will be omitted from the resulting object.
   - `document_ai_custom_endpoint` (`string`): Set the `document_ai_custom_endpoint` field on the resulting provider block. When `null`, the `document_ai_custom_endpoint` field will be omitted from the resulting object.
   - `document_ai_warehouse_custom_endpoint` (`string`): Set the `document_ai_warehouse_custom_endpoint` field on the resulting provider block. When `null`, the `document_ai_warehouse_custom_endpoint` field will be omitted from the resulting object.
+  - `edgecontainer_custom_endpoint` (`string`): Set the `edgecontainer_custom_endpoint` field on the resulting provider block. When `null`, the `edgecontainer_custom_endpoint` field will be omitted from the resulting object.
   - `edgenetwork_custom_endpoint` (`string`): Set the `edgenetwork_custom_endpoint` field on the resulting provider block. When `null`, the `edgenetwork_custom_endpoint` field will be omitted from the resulting object.
   - `essential_contacts_custom_endpoint` (`string`): Set the `essential_contacts_custom_endpoint` field on the resulting provider block. When `null`, the `essential_contacts_custom_endpoint` field will be omitted from the resulting object.
   - `eventarc_custom_endpoint` (`string`): Set the `eventarc_custom_endpoint` field on the resulting provider block. When `null`, the `eventarc_custom_endpoint` field will be omitted from the resulting object.
   - `filestore_custom_endpoint` (`string`): Set the `filestore_custom_endpoint` field on the resulting provider block. When `null`, the `filestore_custom_endpoint` field will be omitted from the resulting object.
   - `firebaserules_custom_endpoint` (`string`): Set the `firebaserules_custom_endpoint` field on the resulting provider block. When `null`, the `firebaserules_custom_endpoint` field will be omitted from the resulting object.
   - `firestore_custom_endpoint` (`string`): Set the `firestore_custom_endpoint` field on the resulting provider block. When `null`, the `firestore_custom_endpoint` field will be omitted from the resulting object.
-  - `game_services_custom_endpoint` (`string`): Set the `game_services_custom_endpoint` field on the resulting provider block. When `null`, the `game_services_custom_endpoint` field will be omitted from the resulting object.
   - `gke_backup_custom_endpoint` (`string`): Set the `gke_backup_custom_endpoint` field on the resulting provider block. When `null`, the `gke_backup_custom_endpoint` field will be omitted from the resulting object.
   - `gke_hub2_custom_endpoint` (`string`): Set the `gke_hub2_custom_endpoint` field on the resulting provider block. When `null`, the `gke_hub2_custom_endpoint` field will be omitted from the resulting object.
   - `gke_hub_custom_endpoint` (`string`): Set the `gke_hub_custom_endpoint` field on the resulting provider block. When `null`, the `gke_hub_custom_endpoint` field will be omitted from the resulting object.
   - `gkehub_feature_custom_endpoint` (`string`): Set the `gkehub_feature_custom_endpoint` field on the resulting provider block. When `null`, the `gkehub_feature_custom_endpoint` field will be omitted from the resulting object.
+  - `gkeonprem_custom_endpoint` (`string`): Set the `gkeonprem_custom_endpoint` field on the resulting provider block. When `null`, the `gkeonprem_custom_endpoint` field will be omitted from the resulting object.
   - `healthcare_custom_endpoint` (`string`): Set the `healthcare_custom_endpoint` field on the resulting provider block. When `null`, the `healthcare_custom_endpoint` field will be omitted from the resulting object.
   - `iam2_custom_endpoint` (`string`): Set the `iam2_custom_endpoint` field on the resulting provider block. When `null`, the `iam2_custom_endpoint` field will be omitted from the resulting object.
   - `iam_beta_custom_endpoint` (`string`): Set the `iam_beta_custom_endpoint` field on the resulting provider block. When `null`, the `iam_beta_custom_endpoint` field will be omitted from the resulting object.
@@ -162,6 +163,7 @@ the `src` and/or `version` parameters are set.
   - `tags_custom_endpoint` (`string`): Set the `tags_custom_endpoint` field on the resulting provider block. When `null`, the `tags_custom_endpoint` field will be omitted from the resulting object.
   - `tags_location_custom_endpoint` (`string`): Set the `tags_location_custom_endpoint` field on the resulting provider block. When `null`, the `tags_location_custom_endpoint` field will be omitted from the resulting object.
   - `tpu_custom_endpoint` (`string`): Set the `tpu_custom_endpoint` field on the resulting provider block. When `null`, the `tpu_custom_endpoint` field will be omitted from the resulting object.
+  - `universe_domain` (`string`): Set the `universe_domain` field on the resulting provider block. When `null`, the `universe_domain` field will be omitted from the resulting object.
   - `user_project_override` (`bool`): Set the `user_project_override` field on the resulting provider block. When `null`, the `user_project_override` field will be omitted from the resulting object.
   - `vertex_ai_custom_endpoint` (`string`): Set the `vertex_ai_custom_endpoint` field on the resulting provider block. When `null`, the `vertex_ai_custom_endpoint` field will be omitted from the resulting object.
   - `vpc_access_custom_endpoint` (`string`): Set the `vpc_access_custom_endpoint` field on the resulting provider block. When `null`, the `vpc_access_custom_endpoint` field will be omitted from the resulting object.
@@ -229,7 +231,6 @@ injecting into a complete block.
   - `cloud_functions_custom_endpoint` (`string`): Set the `cloud_functions_custom_endpoint` field on the resulting object. When `null`, the `cloud_functions_custom_endpoint` field will be omitted from the resulting object.
   - `cloud_identity_custom_endpoint` (`string`): Set the `cloud_identity_custom_endpoint` field on the resulting object. When `null`, the `cloud_identity_custom_endpoint` field will be omitted from the resulting object.
   - `cloud_ids_custom_endpoint` (`string`): Set the `cloud_ids_custom_endpoint` field on the resulting object. When `null`, the `cloud_ids_custom_endpoint` field will be omitted from the resulting object.
-  - `cloud_iot_custom_endpoint` (`string`): Set the `cloud_iot_custom_endpoint` field on the resulting object. When `null`, the `cloud_iot_custom_endpoint` field will be omitted from the resulting object.
   - `cloud_resource_manager_custom_endpoint` (`string`): Set the `cloud_resource_manager_custom_endpoint` field on the resulting object. When `null`, the `cloud_resource_manager_custom_endpoint` field will be omitted from the resulting object.
   - `cloud_run_custom_endpoint` (`string`): Set the `cloud_run_custom_endpoint` field on the resulting object. When `null`, the `cloud_run_custom_endpoint` field will be omitted from the resulting object.
   - `cloud_run_v2_custom_endpoint` (`string`): Set the `cloud_run_v2_custom_endpoint` field on the resulting object. When `null`, the `cloud_run_v2_custom_endpoint` field will be omitted from the resulting object.
@@ -258,23 +259,25 @@ injecting into a complete block.
   - `dataproc_metastore_custom_endpoint` (`string`): Set the `dataproc_metastore_custom_endpoint` field on the resulting object. When `null`, the `dataproc_metastore_custom_endpoint` field will be omitted from the resulting object.
   - `datastore_custom_endpoint` (`string`): Set the `datastore_custom_endpoint` field on the resulting object. When `null`, the `datastore_custom_endpoint` field will be omitted from the resulting object.
   - `datastream_custom_endpoint` (`string`): Set the `datastream_custom_endpoint` field on the resulting object. When `null`, the `datastream_custom_endpoint` field will be omitted from the resulting object.
+  - `default_labels` (`obj`): Set the `default_labels` field on the resulting object. When `null`, the `default_labels` field will be omitted from the resulting object.
   - `deployment_manager_custom_endpoint` (`string`): Set the `deployment_manager_custom_endpoint` field on the resulting object. When `null`, the `deployment_manager_custom_endpoint` field will be omitted from the resulting object.
   - `dialogflow_custom_endpoint` (`string`): Set the `dialogflow_custom_endpoint` field on the resulting object. When `null`, the `dialogflow_custom_endpoint` field will be omitted from the resulting object.
   - `dialogflow_cx_custom_endpoint` (`string`): Set the `dialogflow_cx_custom_endpoint` field on the resulting object. When `null`, the `dialogflow_cx_custom_endpoint` field will be omitted from the resulting object.
   - `dns_custom_endpoint` (`string`): Set the `dns_custom_endpoint` field on the resulting object. When `null`, the `dns_custom_endpoint` field will be omitted from the resulting object.
   - `document_ai_custom_endpoint` (`string`): Set the `document_ai_custom_endpoint` field on the resulting object. When `null`, the `document_ai_custom_endpoint` field will be omitted from the resulting object.
   - `document_ai_warehouse_custom_endpoint` (`string`): Set the `document_ai_warehouse_custom_endpoint` field on the resulting object. When `null`, the `document_ai_warehouse_custom_endpoint` field will be omitted from the resulting object.
+  - `edgecontainer_custom_endpoint` (`string`): Set the `edgecontainer_custom_endpoint` field on the resulting object. When `null`, the `edgecontainer_custom_endpoint` field will be omitted from the resulting object.
   - `edgenetwork_custom_endpoint` (`string`): Set the `edgenetwork_custom_endpoint` field on the resulting object. When `null`, the `edgenetwork_custom_endpoint` field will be omitted from the resulting object.
   - `essential_contacts_custom_endpoint` (`string`): Set the `essential_contacts_custom_endpoint` field on the resulting object. When `null`, the `essential_contacts_custom_endpoint` field will be omitted from the resulting object.
   - `eventarc_custom_endpoint` (`string`): Set the `eventarc_custom_endpoint` field on the resulting object. When `null`, the `eventarc_custom_endpoint` field will be omitted from the resulting object.
   - `filestore_custom_endpoint` (`string`): Set the `filestore_custom_endpoint` field on the resulting object. When `null`, the `filestore_custom_endpoint` field will be omitted from the resulting object.
   - `firebaserules_custom_endpoint` (`string`): Set the `firebaserules_custom_endpoint` field on the resulting object. When `null`, the `firebaserules_custom_endpoint` field will be omitted from the resulting object.
   - `firestore_custom_endpoint` (`string`): Set the `firestore_custom_endpoint` field on the resulting object. When `null`, the `firestore_custom_endpoint` field will be omitted from the resulting object.
-  - `game_services_custom_endpoint` (`string`): Set the `game_services_custom_endpoint` field on the resulting object. When `null`, the `game_services_custom_endpoint` field will be omitted from the resulting object.
   - `gke_backup_custom_endpoint` (`string`): Set the `gke_backup_custom_endpoint` field on the resulting object. When `null`, the `gke_backup_custom_endpoint` field will be omitted from the resulting object.
   - `gke_hub2_custom_endpoint` (`string`): Set the `gke_hub2_custom_endpoint` field on the resulting object. When `null`, the `gke_hub2_custom_endpoint` field will be omitted from the resulting object.
   - `gke_hub_custom_endpoint` (`string`): Set the `gke_hub_custom_endpoint` field on the resulting object. When `null`, the `gke_hub_custom_endpoint` field will be omitted from the resulting object.
   - `gkehub_feature_custom_endpoint` (`string`): Set the `gkehub_feature_custom_endpoint` field on the resulting object. When `null`, the `gkehub_feature_custom_endpoint` field will be omitted from the resulting object.
+  - `gkeonprem_custom_endpoint` (`string`): Set the `gkeonprem_custom_endpoint` field on the resulting object. When `null`, the `gkeonprem_custom_endpoint` field will be omitted from the resulting object.
   - `healthcare_custom_endpoint` (`string`): Set the `healthcare_custom_endpoint` field on the resulting object. When `null`, the `healthcare_custom_endpoint` field will be omitted from the resulting object.
   - `iam2_custom_endpoint` (`string`): Set the `iam2_custom_endpoint` field on the resulting object. When `null`, the `iam2_custom_endpoint` field will be omitted from the resulting object.
   - `iam_beta_custom_endpoint` (`string`): Set the `iam_beta_custom_endpoint` field on the resulting object. When `null`, the `iam_beta_custom_endpoint` field will be omitted from the resulting object.
@@ -326,6 +329,7 @@ injecting into a complete block.
   - `tags_custom_endpoint` (`string`): Set the `tags_custom_endpoint` field on the resulting object. When `null`, the `tags_custom_endpoint` field will be omitted from the resulting object.
   - `tags_location_custom_endpoint` (`string`): Set the `tags_location_custom_endpoint` field on the resulting object. When `null`, the `tags_location_custom_endpoint` field will be omitted from the resulting object.
   - `tpu_custom_endpoint` (`string`): Set the `tpu_custom_endpoint` field on the resulting object. When `null`, the `tpu_custom_endpoint` field will be omitted from the resulting object.
+  - `universe_domain` (`string`): Set the `universe_domain` field on the resulting object. When `null`, the `universe_domain` field will be omitted from the resulting object.
   - `user_project_override` (`bool`): Set the `user_project_override` field on the resulting object. When `null`, the `user_project_override` field will be omitted from the resulting object.
   - `vertex_ai_custom_endpoint` (`string`): Set the `vertex_ai_custom_endpoint` field on the resulting object. When `null`, the `vertex_ai_custom_endpoint` field will be omitted from the resulting object.
   - `vpc_access_custom_endpoint` (`string`): Set the `vpc_access_custom_endpoint` field on the resulting object. When `null`, the `vpc_access_custom_endpoint` field will be omitted from the resulting object.
diff --git a/docs/4.x/pubsub_schema.md b/docs/4.x/pubsub_schema.md
index 0b3c07c5..55170130 100644
--- a/docs/4.x/pubsub_schema.md
+++ b/docs/4.x/pubsub_schema.md
@@ -55,7 +55,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `definition` (`string`): The definition of the schema.
 This should contain a string representing the full definition of the schema
-that is a valid schema definition of the type specified in type. When `null`, the `definition` field will be omitted from the resulting object.
+that is a valid schema definition of the type specified in type. Changes
+to the definition commit new [schema revisions](https://cloud.google.com/pubsub/docs/commit-schema-revision).
+A schema can only have up to 20 revisions, so updates that fail with an
+error indicating that the limit has been reached require manually
+[deleting old revisions](https://cloud.google.com/pubsub/docs/delete-schema-revision). When `null`, the `definition` field will be omitted from the resulting object.
   - `name` (`string`): The ID to use for the schema, which will become the final component of the schema's resource name.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `type` (`string`): The type of the schema definition Default value: "TYPE_UNSPECIFIED" Possible values: ["TYPE_UNSPECIFIED", "PROTOCOL_BUFFER", "AVRO"] When `null`, the `type` field will be omitted from the resulting object.
@@ -85,7 +89,11 @@ injecting into a complete block.
 **Args**:
   - `definition` (`string`): The definition of the schema.
 This should contain a string representing the full definition of the schema
-that is a valid schema definition of the type specified in type. When `null`, the `definition` field will be omitted from the resulting object.
+that is a valid schema definition of the type specified in type. Changes
+to the definition commit new [schema revisions](https://cloud.google.com/pubsub/docs/commit-schema-revision).
+A schema can only have up to 20 revisions, so updates that fail with an
+error indicating that the limit has been reached require manually
+[deleting old revisions](https://cloud.google.com/pubsub/docs/delete-schema-revision). When `null`, the `definition` field will be omitted from the resulting object.
   - `name` (`string`): The ID to use for the schema, which will become the final component of the schema's resource name.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `type` (`string`): The type of the schema definition Default value: "TYPE_UNSPECIFIED" Possible values: ["TYPE_UNSPECIFIED", "PROTOCOL_BUFFER", "AVRO"] When `null`, the `type` field will be omitted from the resulting object.
diff --git a/docs/4.x/cloudiot_registry_iam_binding.md b/docs/4.x/pubsub_schema_iam_binding.md
similarity index 70%
rename from docs/4.x/cloudiot_registry_iam_binding.md
rename to docs/4.x/pubsub_schema_iam_binding.md
index ce3fdbb5..c2d3c85e 100644
--- a/docs/4.x/cloudiot_registry_iam_binding.md
+++ b/docs/4.x/pubsub_schema_iam_binding.md
@@ -1,10 +1,10 @@
 ---
-permalink: /cloudiot_registry_iam_binding/
+permalink: /pubsub_schema_iam_binding/
 ---
 
-# cloudiot_registry_iam_binding
+# pubsub_schema_iam_binding
 
-`cloudiot_registry_iam_binding` represents the `google_cloudiot_registry_iam_binding` Terraform resource.
+`pubsub_schema_iam_binding` represents the `google_pubsub_schema_iam_binding` Terraform resource.
 
 
 
@@ -18,10 +18,9 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withCondition()`](#fn-withcondition)
 * [`fn withConditionMixin()`](#fn-withconditionmixin)
 * [`fn withMembers()`](#fn-withmembers)
-* [`fn withName()`](#fn-withname)
 * [`fn withProject()`](#fn-withproject)
-* [`fn withRegion()`](#fn-withregion)
 * [`fn withRole()`](#fn-withrole)
+* [`fn withSchema()`](#fn-withschema)
 * [`obj condition`](#obj-condition)
   * [`fn new()`](#fn-conditionnew)
 
@@ -34,20 +33,20 @@ new()
 ```
 
 
-`google.cloudiot_registry_iam_binding.new` injects a new `google_cloudiot_registry_iam_binding` Terraform `resource`
+`google.pubsub_schema_iam_binding.new` injects a new `google_pubsub_schema_iam_binding` Terraform `resource`
 block into the root module document.
 
 Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
 resource. For example, if you added a new instance to the root using:
 
     # arguments omitted for brevity
-    google.cloudiot_registry_iam_binding.new('some_id')
+    google.pubsub_schema_iam_binding.new('some_id')
 
-You can get the reference to the `id` field of the created `google.cloudiot_registry_iam_binding` using the reference:
+You can get the reference to the `id` field of the created `google.pubsub_schema_iam_binding` using the reference:
 
-    $._ref.google_cloudiot_registry_iam_binding.some_id.get('id')
+    $._ref.google_pubsub_schema_iam_binding.some_id.get('id')
 
-This is the same as directly entering `"${ google_cloudiot_registry_iam_binding.some_id.id }"` as the value.
+This is the same as directly entering `"${ google_pubsub_schema_iam_binding.some_id.id }"` as the value.
 
 NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
 or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
@@ -55,11 +54,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `members` (`list`): Set the `members` field on the resulting resource block.
-  - `name` (`string`): Set the `name` field on the resulting resource block.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
-  - `region` (`string`): Set the `region` field on the resulting resource block. When `null`, the `region` field will be omitted from the resulting object.
   - `role` (`string`): Set the `role` field on the resulting resource block.
-  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry_iam_binding.condition.new](#fn-conditionnew) constructor.
+  - `schema` (`string`): Set the `schema` field on the resulting resource block.
+  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_schema_iam_binding.condition.new](#fn-conditionnew) constructor.
 
 **Returns**:
 - A mixin object that injects the new resource into the root Terraform configuration.
@@ -72,10 +70,10 @@ newAttrs()
 ```
 
 
-`google.cloudiot_registry_iam_binding.newAttrs` constructs a new object with attributes and blocks configured for the `cloudiot_registry_iam_binding`
+`google.pubsub_schema_iam_binding.newAttrs` constructs a new object with attributes and blocks configured for the `pubsub_schema_iam_binding`
 Terraform resource.
 
-Unlike [google.cloudiot_registry_iam_binding.new](#fn-new), this function will not inject the `resource`
+Unlike [google.pubsub_schema_iam_binding.new](#fn-new), this function will not inject the `resource`
 block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
 [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
 
@@ -84,14 +82,13 @@ injecting into a complete block.
 
 **Args**:
   - `members` (`list`): Set the `members` field on the resulting object.
-  - `name` (`string`): Set the `name` field on the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
-  - `region` (`string`): Set the `region` field on the resulting object. When `null`, the `region` field will be omitted from the resulting object.
   - `role` (`string`): Set the `role` field on the resulting object.
-  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry_iam_binding.condition.new](#fn-conditionnew) constructor.
+  - `schema` (`string`): Set the `schema` field on the resulting object.
+  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_schema_iam_binding.condition.new](#fn-conditionnew) constructor.
 
 **Returns**:
-  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudiot_registry_iam_binding` resource into the root Terraform configuration.
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pubsub_schema_iam_binding` resource into the root Terraform configuration.
 
 
 ### fn withCondition
@@ -147,22 +144,6 @@ Terraform resource block to set or update the members field.
   - `value` (`list`): The value to set for the `members` field.
 
 
-### fn withName
-
-```ts
-withName()
-```
-
-`google.string.withName` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the name field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `name` field.
-
-
 ### fn withProject
 
 ```ts
@@ -179,36 +160,36 @@ Terraform resource block to set or update the project field.
   - `value` (`string`): The value to set for the `project` field.
 
 
-### fn withRegion
+### fn withRole
 
 ```ts
-withRegion()
+withRole()
 ```
 
-`google.string.withRegion` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the region field.
+`google.string.withRole` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the role field.
 
 
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `region` field.
+  - `value` (`string`): The value to set for the `role` field.
 
 
-### fn withRole
+### fn withSchema
 
 ```ts
-withRole()
+withSchema()
 ```
 
-`google.string.withRole` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the role field.
+`google.string.withSchema` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the schema field.
 
 
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `role` field.
+  - `value` (`string`): The value to set for the `schema` field.
 
 
 ## obj condition
@@ -222,7 +203,7 @@ new()
 ```
 
 
-`google.cloudiot_registry_iam_binding.condition.new` constructs a new object with attributes and blocks configured for the `condition`
+`google.pubsub_schema_iam_binding.condition.new` constructs a new object with attributes and blocks configured for the `condition`
 Terraform sub block.
 
 
diff --git a/docs/4.x/cloudiot_registry_iam_member.md b/docs/4.x/pubsub_schema_iam_member.md
similarity index 70%
rename from docs/4.x/cloudiot_registry_iam_member.md
rename to docs/4.x/pubsub_schema_iam_member.md
index d7fbf273..181b6a73 100644
--- a/docs/4.x/cloudiot_registry_iam_member.md
+++ b/docs/4.x/pubsub_schema_iam_member.md
@@ -1,10 +1,10 @@
 ---
-permalink: /cloudiot_registry_iam_member/
+permalink: /pubsub_schema_iam_member/
 ---
 
-# cloudiot_registry_iam_member
+# pubsub_schema_iam_member
 
-`cloudiot_registry_iam_member` represents the `google_cloudiot_registry_iam_member` Terraform resource.
+`pubsub_schema_iam_member` represents the `google_pubsub_schema_iam_member` Terraform resource.
 
 
 
@@ -18,10 +18,9 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withCondition()`](#fn-withcondition)
 * [`fn withConditionMixin()`](#fn-withconditionmixin)
 * [`fn withMember()`](#fn-withmember)
-* [`fn withName()`](#fn-withname)
 * [`fn withProject()`](#fn-withproject)
-* [`fn withRegion()`](#fn-withregion)
 * [`fn withRole()`](#fn-withrole)
+* [`fn withSchema()`](#fn-withschema)
 * [`obj condition`](#obj-condition)
   * [`fn new()`](#fn-conditionnew)
 
@@ -34,20 +33,20 @@ new()
 ```
 
 
-`google.cloudiot_registry_iam_member.new` injects a new `google_cloudiot_registry_iam_member` Terraform `resource`
+`google.pubsub_schema_iam_member.new` injects a new `google_pubsub_schema_iam_member` Terraform `resource`
 block into the root module document.
 
 Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
 resource. For example, if you added a new instance to the root using:
 
     # arguments omitted for brevity
-    google.cloudiot_registry_iam_member.new('some_id')
+    google.pubsub_schema_iam_member.new('some_id')
 
-You can get the reference to the `id` field of the created `google.cloudiot_registry_iam_member` using the reference:
+You can get the reference to the `id` field of the created `google.pubsub_schema_iam_member` using the reference:
 
-    $._ref.google_cloudiot_registry_iam_member.some_id.get('id')
+    $._ref.google_pubsub_schema_iam_member.some_id.get('id')
 
-This is the same as directly entering `"${ google_cloudiot_registry_iam_member.some_id.id }"` as the value.
+This is the same as directly entering `"${ google_pubsub_schema_iam_member.some_id.id }"` as the value.
 
 NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
 or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
@@ -55,11 +54,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `member` (`string`): Set the `member` field on the resulting resource block.
-  - `name` (`string`): Set the `name` field on the resulting resource block.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
-  - `region` (`string`): Set the `region` field on the resulting resource block. When `null`, the `region` field will be omitted from the resulting object.
   - `role` (`string`): Set the `role` field on the resulting resource block.
-  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry_iam_member.condition.new](#fn-conditionnew) constructor.
+  - `schema` (`string`): Set the `schema` field on the resulting resource block.
+  - `condition` (`list[obj]`): Set the `condition` field on the resulting resource block. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_schema_iam_member.condition.new](#fn-conditionnew) constructor.
 
 **Returns**:
 - A mixin object that injects the new resource into the root Terraform configuration.
@@ -72,10 +70,10 @@ newAttrs()
 ```
 
 
-`google.cloudiot_registry_iam_member.newAttrs` constructs a new object with attributes and blocks configured for the `cloudiot_registry_iam_member`
+`google.pubsub_schema_iam_member.newAttrs` constructs a new object with attributes and blocks configured for the `pubsub_schema_iam_member`
 Terraform resource.
 
-Unlike [google.cloudiot_registry_iam_member.new](#fn-new), this function will not inject the `resource`
+Unlike [google.pubsub_schema_iam_member.new](#fn-new), this function will not inject the `resource`
 block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
 [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
 
@@ -84,14 +82,13 @@ injecting into a complete block.
 
 **Args**:
   - `member` (`string`): Set the `member` field on the resulting object.
-  - `name` (`string`): Set the `name` field on the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
-  - `region` (`string`): Set the `region` field on the resulting object. When `null`, the `region` field will be omitted from the resulting object.
   - `role` (`string`): Set the `role` field on the resulting object.
-  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.cloudiot_registry_iam_member.condition.new](#fn-conditionnew) constructor.
+  - `schema` (`string`): Set the `schema` field on the resulting object.
+  - `condition` (`list[obj]`): Set the `condition` field on the resulting object. When `null`, the `condition` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.pubsub_schema_iam_member.condition.new](#fn-conditionnew) constructor.
 
 **Returns**:
-  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudiot_registry_iam_member` resource into the root Terraform configuration.
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pubsub_schema_iam_member` resource into the root Terraform configuration.
 
 
 ### fn withCondition
@@ -147,22 +144,6 @@ Terraform resource block to set or update the member field.
   - `value` (`string`): The value to set for the `member` field.
 
 
-### fn withName
-
-```ts
-withName()
-```
-
-`google.string.withName` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the name field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `name` field.
-
-
 ### fn withProject
 
 ```ts
@@ -179,36 +160,36 @@ Terraform resource block to set or update the project field.
   - `value` (`string`): The value to set for the `project` field.
 
 
-### fn withRegion
+### fn withRole
 
 ```ts
-withRegion()
+withRole()
 ```
 
-`google.string.withRegion` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the region field.
+`google.string.withRole` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the role field.
 
 
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `region` field.
+  - `value` (`string`): The value to set for the `role` field.
 
 
-### fn withRole
+### fn withSchema
 
 ```ts
-withRole()
+withSchema()
 ```
 
-`google.string.withRole` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the role field.
+`google.string.withSchema` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the schema field.
 
 
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `role` field.
+  - `value` (`string`): The value to set for the `schema` field.
 
 
 ## obj condition
@@ -222,7 +203,7 @@ new()
 ```
 
 
-`google.cloudiot_registry_iam_member.condition.new` constructs a new object with attributes and blocks configured for the `condition`
+`google.pubsub_schema_iam_member.condition.new` constructs a new object with attributes and blocks configured for the `condition`
 Terraform sub block.
 
 
diff --git a/docs/4.x/cloudiot_registry_iam_policy.md b/docs/4.x/pubsub_schema_iam_policy.md
similarity index 59%
rename from docs/4.x/cloudiot_registry_iam_policy.md
rename to docs/4.x/pubsub_schema_iam_policy.md
index 8c33fada..419f01f4 100644
--- a/docs/4.x/cloudiot_registry_iam_policy.md
+++ b/docs/4.x/pubsub_schema_iam_policy.md
@@ -1,10 +1,10 @@
 ---
-permalink: /cloudiot_registry_iam_policy/
+permalink: /pubsub_schema_iam_policy/
 ---
 
-# cloudiot_registry_iam_policy
+# pubsub_schema_iam_policy
 
-`cloudiot_registry_iam_policy` represents the `google_cloudiot_registry_iam_policy` Terraform resource.
+`pubsub_schema_iam_policy` represents the `google_pubsub_schema_iam_policy` Terraform resource.
 
 
 
@@ -15,10 +15,9 @@ This package contains functions and utilities for setting up the resource using
 
 * [`fn new()`](#fn-new)
 * [`fn newAttrs()`](#fn-newattrs)
-* [`fn withName()`](#fn-withname)
 * [`fn withPolicyData()`](#fn-withpolicydata)
 * [`fn withProject()`](#fn-withproject)
-* [`fn withRegion()`](#fn-withregion)
+* [`fn withSchema()`](#fn-withschema)
 
 ## Fields
 
@@ -29,30 +28,29 @@ new()
 ```
 
 
-`google.cloudiot_registry_iam_policy.new` injects a new `google_cloudiot_registry_iam_policy` Terraform `resource`
+`google.pubsub_schema_iam_policy.new` injects a new `google_pubsub_schema_iam_policy` Terraform `resource`
 block into the root module document.
 
 Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
 resource. For example, if you added a new instance to the root using:
 
     # arguments omitted for brevity
-    google.cloudiot_registry_iam_policy.new('some_id')
+    google.pubsub_schema_iam_policy.new('some_id')
 
-You can get the reference to the `id` field of the created `google.cloudiot_registry_iam_policy` using the reference:
+You can get the reference to the `id` field of the created `google.pubsub_schema_iam_policy` using the reference:
 
-    $._ref.google_cloudiot_registry_iam_policy.some_id.get('id')
+    $._ref.google_pubsub_schema_iam_policy.some_id.get('id')
 
-This is the same as directly entering `"${ google_cloudiot_registry_iam_policy.some_id.id }"` as the value.
+This is the same as directly entering `"${ google_pubsub_schema_iam_policy.some_id.id }"` as the value.
 
 NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
 or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
-  - `name` (`string`): Set the `name` field on the resulting resource block.
   - `policy_data` (`string`): Set the `policy_data` field on the resulting resource block.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
-  - `region` (`string`): Set the `region` field on the resulting resource block. When `null`, the `region` field will be omitted from the resulting object.
+  - `schema` (`string`): Set the `schema` field on the resulting resource block.
 
 **Returns**:
 - A mixin object that injects the new resource into the root Terraform configuration.
@@ -65,10 +63,10 @@ newAttrs()
 ```
 
 
-`google.cloudiot_registry_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `cloudiot_registry_iam_policy`
+`google.pubsub_schema_iam_policy.newAttrs` constructs a new object with attributes and blocks configured for the `pubsub_schema_iam_policy`
 Terraform resource.
 
-Unlike [google.cloudiot_registry_iam_policy.new](#fn-new), this function will not inject the `resource`
+Unlike [google.pubsub_schema_iam_policy.new](#fn-new), this function will not inject the `resource`
 block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
 [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
 
@@ -76,29 +74,12 @@ This is most useful when you need to preprocess the attributes with functions, c
 injecting into a complete block.
 
 **Args**:
-  - `name` (`string`): Set the `name` field on the resulting object.
   - `policy_data` (`string`): Set the `policy_data` field on the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
-  - `region` (`string`): Set the `region` field on the resulting object. When `null`, the `region` field will be omitted from the resulting object.
+  - `schema` (`string`): Set the `schema` field on the resulting object.
 
 **Returns**:
-  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `cloudiot_registry_iam_policy` resource into the root Terraform configuration.
-
-
-### fn withName
-
-```ts
-withName()
-```
-
-`google.string.withName` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the name field.
-
-
-
-**Args**:
-  - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `name` field.
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pubsub_schema_iam_policy` resource into the root Terraform configuration.
 
 
 ### fn withPolicyData
@@ -133,17 +114,17 @@ Terraform resource block to set or update the project field.
   - `value` (`string`): The value to set for the `project` field.
 
 
-### fn withRegion
+### fn withSchema
 
 ```ts
-withRegion()
+withSchema()
 ```
 
-`google.string.withRegion` constructs a mixin object that can be merged into the `string`
-Terraform resource block to set or update the region field.
+`google.string.withSchema` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the schema field.
 
 
 
 **Args**:
   - `resourceLabel` (`string`): The name label of the block to update.
-  - `value` (`string`): The value to set for the `region` field.
+  - `value` (`string`): The value to set for the `schema` field.
diff --git a/docs/4.x/pubsub_subscription.md b/docs/4.x/pubsub_subscription.md
index d5bd21c7..baad6c52 100644
--- a/docs/4.x/pubsub_subscription.md
+++ b/docs/4.x/pubsub_subscription.md
@@ -123,7 +123,11 @@ may be delivered in any order. When `null`, the `enable_message_ordering` field
 Pub/Sub automatically acknowledges the messages that don't match the filter. You can filter messages
 by their attributes. The maximum length of a filter is 256 bytes. After creating the subscription,
 you can't modify the filter. When `null`, the `filter` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to this Subscription. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to this Subscription.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `message_retention_duration` (`string`): How long to retain unacknowledged messages in the subscription's
 backlog, from the moment a message is published. If
 retain_acked_messages is true, then this also configures the retention
@@ -226,7 +230,11 @@ may be delivered in any order. When `null`, the `enable_message_ordering` field
 Pub/Sub automatically acknowledges the messages that don't match the filter. You can filter messages
 by their attributes. The maximum length of a filter is 256 bytes. After creating the subscription,
 you can't modify the filter. When `null`, the `filter` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to this Subscription. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to this Subscription.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `message_retention_duration` (`string`): How long to retain unacknowledged messages in the subscription's
 backlog, from the moment a message is published. If
 retain_acked_messages is true, then this also configures the retention
diff --git a/docs/4.x/pubsub_topic.md b/docs/4.x/pubsub_topic.md
index c780b8f8..a2fdebe4 100644
--- a/docs/4.x/pubsub_topic.md
+++ b/docs/4.x/pubsub_topic.md
@@ -67,7 +67,11 @@ to messages published on this topic. Your project's PubSub service account
 ('service-{{PROJECT_NUMBER}}@gcp-sa-pubsub.iam.gserviceaccount.com') must have
 'roles/cloudkms.cryptoKeyEncrypterDecrypter' to use this feature.
 The expected format is 'projects/*/locations/*/keyRings/*/cryptoKeys/*' When `null`, the `kms_key_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to this Topic. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to this Topic.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `message_retention_duration` (`string`): Indicates the minimum duration to retain a message after it is published
 to the topic. If this field is set, messages published to the topic in
 the last messageRetentionDuration are always available to subscribers.
@@ -110,7 +114,11 @@ to messages published on this topic. Your project's PubSub service account
 ('service-{{PROJECT_NUMBER}}@gcp-sa-pubsub.iam.gserviceaccount.com') must have
 'roles/cloudkms.cryptoKeyEncrypterDecrypter' to use this feature.
 The expected format is 'projects/*/locations/*/keyRings/*/cryptoKeys/*' When `null`, the `kms_key_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to this Topic. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to this Topic.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `message_retention_duration` (`string`): Indicates the minimum duration to retain a message after it is published
 to the topic. If this field is set, messages published to the topic in
 the last messageRetentionDuration are always available to subscribers.
diff --git a/docs/4.x/recaptcha_enterprise_key.md b/docs/4.x/recaptcha_enterprise_key.md
index 37517d3a..5a63c440 100644
--- a/docs/4.x/recaptcha_enterprise_key.md
+++ b/docs/4.x/recaptcha_enterprise_key.md
@@ -69,7 +69,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `display_name` (`string`): Human-readable display name of this key. Modifiable by user.
-  - `labels` (`obj`): See [Creating and managing labels](https://cloud.google.com/recaptcha-enterprise/docs/labels). When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): See [Creating and managing labels](https://cloud.google.com/recaptcha-enterprise/docs/labels).
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
   - `android_settings` (`list[obj]`): Settings for keys that can be used by Android apps. When `null`, the `android_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.android_settings.new](#fn-android_settingsnew) constructor.
   - `ios_settings` (`list[obj]`): Settings for keys that can be used by iOS apps. When `null`, the `ios_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.ios_settings.new](#fn-ios_settingsnew) constructor.
@@ -100,7 +103,10 @@ injecting into a complete block.
 
 **Args**:
   - `display_name` (`string`): Human-readable display name of this key. Modifiable by user.
-  - `labels` (`obj`): See [Creating and managing labels](https://cloud.google.com/recaptcha-enterprise/docs/labels). When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): See [Creating and managing labels](https://cloud.google.com/recaptcha-enterprise/docs/labels).
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field `effective_labels` for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `project` (`string`): The project for the resource When `null`, the `project` field will be omitted from the resulting object.
   - `android_settings` (`list[obj]`): Settings for keys that can be used by Android apps. When `null`, the `android_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.android_settings.new](#fn-android_settingsnew) constructor.
   - `ios_settings` (`list[obj]`): Settings for keys that can be used by iOS apps. When `null`, the `ios_settings` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.recaptcha_enterprise_key.ios_settings.new](#fn-ios_settingsnew) constructor.
diff --git a/docs/4.x/redis_cluster.md b/docs/4.x/redis_cluster.md
new file mode 100644
index 00000000..1ae9531e
--- /dev/null
+++ b/docs/4.x/redis_cluster.md
@@ -0,0 +1,349 @@
+---
+permalink: /redis_cluster/
+---
+
+# redis_cluster
+
+`redis_cluster` represents the `google_redis_cluster` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withAuthorizationMode()`](#fn-withauthorizationmode)
+* [`fn withName()`](#fn-withname)
+* [`fn withProject()`](#fn-withproject)
+* [`fn withPscConfigs()`](#fn-withpscconfigs)
+* [`fn withPscConfigsMixin()`](#fn-withpscconfigsmixin)
+* [`fn withRegion()`](#fn-withregion)
+* [`fn withReplicaCount()`](#fn-withreplicacount)
+* [`fn withShardCount()`](#fn-withshardcount)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`fn withTransitEncryptionMode()`](#fn-withtransitencryptionmode)
+* [`obj psc_configs`](#obj-psc_configs)
+  * [`fn new()`](#fn-psc_configsnew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.redis_cluster.new` injects a new `google_redis_cluster` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.redis_cluster.new('some_id')
+
+You can get the reference to the `id` field of the created `google.redis_cluster` using the reference:
+
+    $._ref.google_redis_cluster.some_id.get('id')
+
+This is the same as directly entering `"${ google_redis_cluster.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `authorization_mode` (`string`): Optional. The authorization mode of the Redis cluster. If not provided, auth feature is disabled for the cluster. Default value: "AUTH_MODE_DISABLED" Possible values: ["AUTH_MODE_UNSPECIFIED", "AUTH_MODE_IAM_AUTH", "AUTH_MODE_DISABLED"] When `null`, the `authorization_mode` field will be omitted from the resulting object.
+  - `name` (`string`): Unique name of the resource in this scope including project and location using the form:
+projects/{projectId}/locations/{locationId}/clusters/{clusterId} When `null`, the `name` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
+  - `region` (`string`): The name of the region of the Redis cluster. When `null`, the `region` field will be omitted from the resulting object.
+  - `replica_count` (`number`): Optional. The number of replica nodes per shard. When `null`, the `replica_count` field will be omitted from the resulting object.
+  - `shard_count` (`number`): Required. Number of shards for the Redis cluster.
+  - `transit_encryption_mode` (`string`): Optional. The in-transit encryption for the Redis cluster.
+If not provided, encryption is disabled for the cluster. Default value: "TRANSIT_ENCRYPTION_MODE_DISABLED" Possible values: ["TRANSIT_ENCRYPTION_MODE_UNSPECIFIED", "TRANSIT_ENCRYPTION_MODE_DISABLED", "TRANSIT_ENCRYPTION_MODE_SERVER_AUTHENTICATION"] When `null`, the `transit_encryption_mode` field will be omitted from the resulting object.
+  - `psc_configs` (`list[obj]`): Required. Each PscConfig configures the consumer network where two
+network addresses will be designated to the cluster for client access.
+Currently, only one PscConfig is supported. When `null`, the `psc_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_cluster.psc_configs.new](#fn-psc_configsnew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_cluster.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.redis_cluster.newAttrs` constructs a new object with attributes and blocks configured for the `redis_cluster`
+Terraform resource.
+
+Unlike [google.redis_cluster.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `authorization_mode` (`string`): Optional. The authorization mode of the Redis cluster. If not provided, auth feature is disabled for the cluster. Default value: "AUTH_MODE_DISABLED" Possible values: ["AUTH_MODE_UNSPECIFIED", "AUTH_MODE_IAM_AUTH", "AUTH_MODE_DISABLED"] When `null`, the `authorization_mode` field will be omitted from the resulting object.
+  - `name` (`string`): Unique name of the resource in this scope including project and location using the form:
+projects/{projectId}/locations/{locationId}/clusters/{clusterId} When `null`, the `name` field will be omitted from the resulting object.
+  - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
+  - `region` (`string`): The name of the region of the Redis cluster. When `null`, the `region` field will be omitted from the resulting object.
+  - `replica_count` (`number`): Optional. The number of replica nodes per shard. When `null`, the `replica_count` field will be omitted from the resulting object.
+  - `shard_count` (`number`): Required. Number of shards for the Redis cluster.
+  - `transit_encryption_mode` (`string`): Optional. The in-transit encryption for the Redis cluster.
+If not provided, encryption is disabled for the cluster. Default value: "TRANSIT_ENCRYPTION_MODE_DISABLED" Possible values: ["TRANSIT_ENCRYPTION_MODE_UNSPECIFIED", "TRANSIT_ENCRYPTION_MODE_DISABLED", "TRANSIT_ENCRYPTION_MODE_SERVER_AUTHENTICATION"] When `null`, the `transit_encryption_mode` field will be omitted from the resulting object.
+  - `psc_configs` (`list[obj]`): Required. Each PscConfig configures the consumer network where two
+network addresses will be designated to the cluster for client access.
+Currently, only one PscConfig is supported. When `null`, the `psc_configs` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_cluster.psc_configs.new](#fn-psc_configsnew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.redis_cluster.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `redis_cluster` resource into the root Terraform configuration.
+
+
+### fn withAuthorizationMode
+
+```ts
+withAuthorizationMode()
+```
+
+`google.string.withAuthorizationMode` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the authorization_mode field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `authorization_mode` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`google.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withProject
+
+```ts
+withProject()
+```
+
+`google.string.withProject` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the project field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `project` field.
+
+
+### fn withPscConfigs
+
+```ts
+withPscConfigs()
+```
+
+`google.list[obj].withPscConfigs` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the psc_configs field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withPscConfigsMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `psc_configs` field.
+
+
+### fn withPscConfigsMixin
+
+```ts
+withPscConfigsMixin()
+```
+
+`google.list[obj].withPscConfigsMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the psc_configs field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withPscConfigs](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `psc_configs` field.
+
+
+### fn withRegion
+
+```ts
+withRegion()
+```
+
+`google.string.withRegion` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the region field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `region` field.
+
+
+### fn withReplicaCount
+
+```ts
+withReplicaCount()
+```
+
+`google.number.withReplicaCount` constructs a mixin object that can be merged into the `number`
+Terraform resource block to set or update the replica_count field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`number`): The value to set for the `replica_count` field.
+
+
+### fn withShardCount
+
+```ts
+withShardCount()
+```
+
+`google.number.withShardCount` constructs a mixin object that can be merged into the `number`
+Terraform resource block to set or update the shard_count field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`number`): The value to set for the `shard_count` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTransitEncryptionMode
+
+```ts
+withTransitEncryptionMode()
+```
+
+`google.string.withTransitEncryptionMode` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the transit_encryption_mode field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `transit_encryption_mode` field.
+
+
+## obj psc_configs
+
+
+
+### fn psc_configs.new
+
+```ts
+new()
+```
+
+
+`google.redis_cluster.psc_configs.new` constructs a new object with attributes and blocks configured for the `psc_configs`
+Terraform sub block.
+
+
+
+**Args**:
+  - `network` (`string`): Required. The consumer network where the network address of
+the discovery endpoint will be reserved, in the form of
+projects/{network_project_id_or_number}/global/networks/{network_id}.
+
+**Returns**:
+  - An attribute object that represents the `psc_configs` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.redis_cluster.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/redis_instance.md b/docs/4.x/redis_instance.md
index f2714902..98157200 100644
--- a/docs/4.x/redis_instance.md
+++ b/docs/4.x/redis_instance.md
@@ -95,7 +95,10 @@ will be used. When `null`, the `authorized_network` field will be omitted from t
   - `customer_managed_key` (`string`): Optional. The KMS key reference that you want to use to encrypt the data at rest for this Redis
 instance. If this is provided, CMEK is enabled. When `null`, the `customer_managed_key` field will be omitted from the resulting object.
   - `display_name` (`string`): An arbitrary and optional user-provided name for the instance. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user provided metadata.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location_id` (`string`): The zone where the instance will be provisioned. If not provided,
 the service will choose a zone for the instance. For STANDARD_HA tier,
 instances will be created across two zones for protection against
@@ -177,7 +180,10 @@ will be used. When `null`, the `authorized_network` field will be omitted from t
   - `customer_managed_key` (`string`): Optional. The KMS key reference that you want to use to encrypt the data at rest for this Redis
 instance. If this is provided, CMEK is enabled. When `null`, the `customer_managed_key` field will be omitted from the resulting object.
   - `display_name` (`string`): An arbitrary and optional user-provided name for the instance. When `null`, the `display_name` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user provided metadata.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location_id` (`string`): The zone where the instance will be provisioned. If not provided,
 the service will choose a zone for the instance. For STANDARD_HA tier,
 instances will be created across two zones for protection against
diff --git a/docs/4.x/scc_folder_custom_module.md b/docs/4.x/scc_folder_custom_module.md
new file mode 100644
index 00000000..c3cfe777
--- /dev/null
+++ b/docs/4.x/scc_folder_custom_module.md
@@ -0,0 +1,421 @@
+---
+permalink: /scc_folder_custom_module/
+---
+
+# scc_folder_custom_module
+
+`scc_folder_custom_module` represents the `google_scc_folder_custom_module` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withCustomConfig()`](#fn-withcustomconfig)
+* [`fn withCustomConfigMixin()`](#fn-withcustomconfigmixin)
+* [`fn withDisplayName()`](#fn-withdisplayname)
+* [`fn withEnablementState()`](#fn-withenablementstate)
+* [`fn withFolder()`](#fn-withfolder)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj custom_config`](#obj-custom_config)
+  * [`fn new()`](#fn-custom_confignew)
+  * [`obj custom_config.custom_output`](#obj-custom_configcustom_output)
+    * [`fn new()`](#fn-custom_configcustom_outputnew)
+    * [`obj custom_config.custom_output.properties`](#obj-custom_configcustom_outputproperties)
+      * [`fn new()`](#fn-custom_configcustom_outputpropertiesnew)
+      * [`obj custom_config.custom_output.properties.value_expression`](#obj-custom_configcustom_outputpropertiesvalue_expression)
+        * [`fn new()`](#fn-custom_configcustom_outputpropertiesvalue_expressionnew)
+  * [`obj custom_config.predicate`](#obj-custom_configpredicate)
+    * [`fn new()`](#fn-custom_configpredicatenew)
+  * [`obj custom_config.resource_selector`](#obj-custom_configresource_selector)
+    * [`fn new()`](#fn-custom_configresource_selectornew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.scc_folder_custom_module.new` injects a new `google_scc_folder_custom_module` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.scc_folder_custom_module.new('some_id')
+
+You can get the reference to the `id` field of the created `google.scc_folder_custom_module` using the reference:
+
+    $._ref.google_scc_folder_custom_module.some_id.get('id')
+
+This is the same as directly entering `"${ google_scc_folder_custom_module.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `display_name` (`string`): The display name of the Security Health Analytics custom module. This
+display name becomes the finding category for all findings that are
+returned by this custom module. The display name must be between 1 and
+128 characters, start with a lowercase letter, and contain alphanumeric
+characters or underscores only.
+  - `enablement_state` (`string`): The enablement state of the custom module. Possible values: ["ENABLED", "DISABLED"]
+  - `folder` (`string`): Numerical ID of the parent folder.
+  - `custom_config` (`list[obj]`): The user specified custom configuration for the module. When `null`, the `custom_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.custom_config.new](#fn-custom_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.scc_folder_custom_module.newAttrs` constructs a new object with attributes and blocks configured for the `scc_folder_custom_module`
+Terraform resource.
+
+Unlike [google.scc_folder_custom_module.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `display_name` (`string`): The display name of the Security Health Analytics custom module. This
+display name becomes the finding category for all findings that are
+returned by this custom module. The display name must be between 1 and
+128 characters, start with a lowercase letter, and contain alphanumeric
+characters or underscores only.
+  - `enablement_state` (`string`): The enablement state of the custom module. Possible values: ["ENABLED", "DISABLED"]
+  - `folder` (`string`): Numerical ID of the parent folder.
+  - `custom_config` (`list[obj]`): The user specified custom configuration for the module. When `null`, the `custom_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.custom_config.new](#fn-custom_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `scc_folder_custom_module` resource into the root Terraform configuration.
+
+
+### fn withCustomConfig
+
+```ts
+withCustomConfig()
+```
+
+`google.list[obj].withCustomConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the custom_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withCustomConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `custom_config` field.
+
+
+### fn withCustomConfigMixin
+
+```ts
+withCustomConfigMixin()
+```
+
+`google.list[obj].withCustomConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the custom_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withCustomConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `custom_config` field.
+
+
+### fn withDisplayName
+
+```ts
+withDisplayName()
+```
+
+`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the display_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `display_name` field.
+
+
+### fn withEnablementState
+
+```ts
+withEnablementState()
+```
+
+`google.string.withEnablementState` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the enablement_state field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `enablement_state` field.
+
+
+### fn withFolder
+
+```ts
+withFolder()
+```
+
+`google.string.withFolder` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the folder field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `folder` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj custom_config
+
+
+
+### fn custom_config.new
+
+```ts
+new()
+```
+
+
+`google.scc_folder_custom_module.custom_config.new` constructs a new object with attributes and blocks configured for the `custom_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `description` (`string`): Text that describes the vulnerability or misconfiguration that the custom
+module detects. This explanation is returned with each finding instance to
+help investigators understand the detected issue. The text must be enclosed in quotation marks. When `null`, the `description` field will be omitted from the resulting object.
+  - `recommendation` (`string`): An explanation of the recommended steps that security teams can take to resolve
+the detected issue. This explanation is returned with each finding generated by
+this module in the nextSteps property of the finding JSON.
+  - `severity` (`string`): The severity to assign to findings generated by the module. Possible values: ["CRITICAL", "HIGH", "MEDIUM", "LOW"]
+  - `custom_output` (`list[obj]`): Custom output properties. When `null`, the `custom_output` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.custom_config.custom_output.new](#fn-custom_configcustom_outputnew) constructor.
+  - `predicate` (`list[obj]`): The CEL expression to evaluate to produce findings. When the expression evaluates
+to true against a resource, a finding is generated. When `null`, the `predicate` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.custom_config.predicate.new](#fn-custom_configpredicatenew) constructor.
+  - `resource_selector` (`list[obj]`): The resource types that the custom module operates on. Each custom module
+can specify up to 5 resource types. When `null`, the `resource_selector` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.custom_config.resource_selector.new](#fn-custom_configresource_selectornew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `custom_config` sub block.
+
+
+## obj custom_config.custom_output
+
+
+
+### fn custom_config.custom_output.new
+
+```ts
+new()
+```
+
+
+`google.scc_folder_custom_module.custom_config.custom_output.new` constructs a new object with attributes and blocks configured for the `custom_output`
+Terraform sub block.
+
+
+
+**Args**:
+  - `properties` (`list[obj]`): A list of custom output properties to add to the finding. When `null`, the `properties` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.custom_config.custom_output.properties.new](#fn-custom_configcustom_configpropertiesnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `custom_output` sub block.
+
+
+## obj custom_config.custom_output.properties
+
+
+
+### fn custom_config.custom_output.properties.new
+
+```ts
+new()
+```
+
+
+`google.scc_folder_custom_module.custom_config.custom_output.properties.new` constructs a new object with attributes and blocks configured for the `properties`
+Terraform sub block.
+
+
+
+**Args**:
+  - `name` (`string`): Name of the property for the custom output. When `null`, the `name` field will be omitted from the resulting object.
+  - `value_expression` (`list[obj]`): The CEL expression for the custom output. A resource property can be specified
+to return the value of the property or a text string enclosed in quotation marks. When `null`, the `value_expression` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_folder_custom_module.custom_config.custom_output.properties.value_expression.new](#fn-custom_configcustom_configcustom_outputvalue_expressionnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `properties` sub block.
+
+
+## obj custom_config.custom_output.properties.value_expression
+
+
+
+### fn custom_config.custom_output.properties.value_expression.new
+
+```ts
+new()
+```
+
+
+`google.scc_folder_custom_module.custom_config.custom_output.properties.value_expression.new` constructs a new object with attributes and blocks configured for the `value_expression`
+Terraform sub block.
+
+
+
+**Args**:
+  - `description` (`string`): Description of the expression. This is a longer text which describes the
+expression, e.g. when hovered over it in a UI. When `null`, the `description` field will be omitted from the resulting object.
+  - `expression` (`string`): Textual representation of an expression in Common Expression Language syntax.
+  - `location` (`string`): String indicating the location of the expression for error reporting, e.g. a
+file name and a position in the file. When `null`, the `location` field will be omitted from the resulting object.
+  - `title` (`string`): Title for the expression, i.e. a short string describing its purpose. This can
+be used e.g. in UIs which allow to enter the expression. When `null`, the `title` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `value_expression` sub block.
+
+
+## obj custom_config.predicate
+
+
+
+### fn custom_config.predicate.new
+
+```ts
+new()
+```
+
+
+`google.scc_folder_custom_module.custom_config.predicate.new` constructs a new object with attributes and blocks configured for the `predicate`
+Terraform sub block.
+
+
+
+**Args**:
+  - `description` (`string`): Description of the expression. This is a longer text which describes the
+expression, e.g. when hovered over it in a UI. When `null`, the `description` field will be omitted from the resulting object.
+  - `expression` (`string`): Textual representation of an expression in Common Expression Language syntax.
+  - `location` (`string`): String indicating the location of the expression for error reporting, e.g. a
+file name and a position in the file. When `null`, the `location` field will be omitted from the resulting object.
+  - `title` (`string`): Title for the expression, i.e. a short string describing its purpose. This can
+be used e.g. in UIs which allow to enter the expression. When `null`, the `title` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `predicate` sub block.
+
+
+## obj custom_config.resource_selector
+
+
+
+### fn custom_config.resource_selector.new
+
+```ts
+new()
+```
+
+
+`google.scc_folder_custom_module.custom_config.resource_selector.new` constructs a new object with attributes and blocks configured for the `resource_selector`
+Terraform sub block.
+
+
+
+**Args**:
+  - `resource_types` (`list`): The resource types to run the detector on.
+
+**Returns**:
+  - An attribute object that represents the `resource_selector` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.scc_folder_custom_module.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/scc_organization_custom_module.md b/docs/4.x/scc_organization_custom_module.md
new file mode 100644
index 00000000..ffa9d21f
--- /dev/null
+++ b/docs/4.x/scc_organization_custom_module.md
@@ -0,0 +1,421 @@
+---
+permalink: /scc_organization_custom_module/
+---
+
+# scc_organization_custom_module
+
+`scc_organization_custom_module` represents the `google_scc_organization_custom_module` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withCustomConfig()`](#fn-withcustomconfig)
+* [`fn withCustomConfigMixin()`](#fn-withcustomconfigmixin)
+* [`fn withDisplayName()`](#fn-withdisplayname)
+* [`fn withEnablementState()`](#fn-withenablementstate)
+* [`fn withOrganization()`](#fn-withorganization)
+* [`fn withTimeouts()`](#fn-withtimeouts)
+* [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
+* [`obj custom_config`](#obj-custom_config)
+  * [`fn new()`](#fn-custom_confignew)
+  * [`obj custom_config.custom_output`](#obj-custom_configcustom_output)
+    * [`fn new()`](#fn-custom_configcustom_outputnew)
+    * [`obj custom_config.custom_output.properties`](#obj-custom_configcustom_outputproperties)
+      * [`fn new()`](#fn-custom_configcustom_outputpropertiesnew)
+      * [`obj custom_config.custom_output.properties.value_expression`](#obj-custom_configcustom_outputpropertiesvalue_expression)
+        * [`fn new()`](#fn-custom_configcustom_outputpropertiesvalue_expressionnew)
+  * [`obj custom_config.predicate`](#obj-custom_configpredicate)
+    * [`fn new()`](#fn-custom_configpredicatenew)
+  * [`obj custom_config.resource_selector`](#obj-custom_configresource_selector)
+    * [`fn new()`](#fn-custom_configresource_selectornew)
+* [`obj timeouts`](#obj-timeouts)
+  * [`fn new()`](#fn-timeoutsnew)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`google.scc_organization_custom_module.new` injects a new `google_scc_organization_custom_module` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    google.scc_organization_custom_module.new('some_id')
+
+You can get the reference to the `id` field of the created `google.scc_organization_custom_module` using the reference:
+
+    $._ref.google_scc_organization_custom_module.some_id.get('id')
+
+This is the same as directly entering `"${ google_scc_organization_custom_module.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `display_name` (`string`): The display name of the Security Health Analytics custom module. This
+display name becomes the finding category for all findings that are
+returned by this custom module. The display name must be between 1 and
+128 characters, start with a lowercase letter, and contain alphanumeric
+characters or underscores only.
+  - `enablement_state` (`string`): The enablement state of the custom module. Possible values: ["ENABLED", "DISABLED"]
+  - `organization` (`string`): Numerical ID of the parent organization.
+  - `custom_config` (`list[obj]`): The user specified custom configuration for the module. When `null`, the `custom_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.custom_config.new](#fn-custom_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`google.scc_organization_custom_module.newAttrs` constructs a new object with attributes and blocks configured for the `scc_organization_custom_module`
+Terraform resource.
+
+Unlike [google.scc_organization_custom_module.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `display_name` (`string`): The display name of the Security Health Analytics custom module. This
+display name becomes the finding category for all findings that are
+returned by this custom module. The display name must be between 1 and
+128 characters, start with a lowercase letter, and contain alphanumeric
+characters or underscores only.
+  - `enablement_state` (`string`): The enablement state of the custom module. Possible values: ["ENABLED", "DISABLED"]
+  - `organization` (`string`): Numerical ID of the parent organization.
+  - `custom_config` (`list[obj]`): The user specified custom configuration for the module. When `null`, the `custom_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.custom_config.new](#fn-custom_confignew) constructor.
+  - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.timeouts.new](#fn-timeoutsnew) constructor.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `scc_organization_custom_module` resource into the root Terraform configuration.
+
+
+### fn withCustomConfig
+
+```ts
+withCustomConfig()
+```
+
+`google.list[obj].withCustomConfig` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the custom_config field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withCustomConfigMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `custom_config` field.
+
+
+### fn withCustomConfigMixin
+
+```ts
+withCustomConfigMixin()
+```
+
+`google.list[obj].withCustomConfigMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the custom_config field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withCustomConfig](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `custom_config` field.
+
+
+### fn withDisplayName
+
+```ts
+withDisplayName()
+```
+
+`google.string.withDisplayName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the display_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `display_name` field.
+
+
+### fn withEnablementState
+
+```ts
+withEnablementState()
+```
+
+`google.string.withEnablementState` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the enablement_state field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `enablement_state` field.
+
+
+### fn withOrganization
+
+```ts
+withOrganization()
+```
+
+`google.string.withOrganization` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the organization field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `organization` field.
+
+
+### fn withTimeouts
+
+```ts
+withTimeouts()
+```
+
+`google.obj.withTimeouts` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will replace the map with the passed in `value`. If you wish to instead merge the
+passed in value to the existing map, use the [google.obj.withTimeoutsMixin](TODO) function.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+### fn withTimeoutsMixin
+
+```ts
+withTimeoutsMixin()
+```
+
+`google.obj.withTimeoutsMixin` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the timeouts field.
+
+This function will merge the passed in value to the existing map. If you wish
+to instead replace the entire map with the passed in `value`, use the [google.obj.withTimeouts](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `timeouts` field.
+
+
+## obj custom_config
+
+
+
+### fn custom_config.new
+
+```ts
+new()
+```
+
+
+`google.scc_organization_custom_module.custom_config.new` constructs a new object with attributes and blocks configured for the `custom_config`
+Terraform sub block.
+
+
+
+**Args**:
+  - `description` (`string`): Text that describes the vulnerability or misconfiguration that the custom
+module detects. This explanation is returned with each finding instance to
+help investigators understand the detected issue. The text must be enclosed in quotation marks. When `null`, the `description` field will be omitted from the resulting object.
+  - `recommendation` (`string`): An explanation of the recommended steps that security teams can take to resolve
+the detected issue. This explanation is returned with each finding generated by
+this module in the nextSteps property of the finding JSON.
+  - `severity` (`string`): The severity to assign to findings generated by the module. Possible values: ["CRITICAL", "HIGH", "MEDIUM", "LOW"]
+  - `custom_output` (`list[obj]`): Custom output properties. When `null`, the `custom_output` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.custom_config.custom_output.new](#fn-custom_configcustom_outputnew) constructor.
+  - `predicate` (`list[obj]`): The CEL expression to evaluate to produce findings. When the expression evaluates
+to true against a resource, a finding is generated. When `null`, the `predicate` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.custom_config.predicate.new](#fn-custom_configpredicatenew) constructor.
+  - `resource_selector` (`list[obj]`): The resource types that the custom module operates on. Each custom module
+can specify up to 5 resource types. When `null`, the `resource_selector` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.custom_config.resource_selector.new](#fn-custom_configresource_selectornew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `custom_config` sub block.
+
+
+## obj custom_config.custom_output
+
+
+
+### fn custom_config.custom_output.new
+
+```ts
+new()
+```
+
+
+`google.scc_organization_custom_module.custom_config.custom_output.new` constructs a new object with attributes and blocks configured for the `custom_output`
+Terraform sub block.
+
+
+
+**Args**:
+  - `properties` (`list[obj]`): A list of custom output properties to add to the finding. When `null`, the `properties` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.custom_config.custom_output.properties.new](#fn-custom_configcustom_configpropertiesnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `custom_output` sub block.
+
+
+## obj custom_config.custom_output.properties
+
+
+
+### fn custom_config.custom_output.properties.new
+
+```ts
+new()
+```
+
+
+`google.scc_organization_custom_module.custom_config.custom_output.properties.new` constructs a new object with attributes and blocks configured for the `properties`
+Terraform sub block.
+
+
+
+**Args**:
+  - `name` (`string`): Name of the property for the custom output. When `null`, the `name` field will be omitted from the resulting object.
+  - `value_expression` (`list[obj]`): The CEL expression for the custom output. A resource property can be specified
+to return the value of the property or a text string enclosed in quotation marks. When `null`, the `value_expression` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.scc_organization_custom_module.custom_config.custom_output.properties.value_expression.new](#fn-custom_configcustom_configcustom_outputvalue_expressionnew) constructor.
+
+**Returns**:
+  - An attribute object that represents the `properties` sub block.
+
+
+## obj custom_config.custom_output.properties.value_expression
+
+
+
+### fn custom_config.custom_output.properties.value_expression.new
+
+```ts
+new()
+```
+
+
+`google.scc_organization_custom_module.custom_config.custom_output.properties.value_expression.new` constructs a new object with attributes and blocks configured for the `value_expression`
+Terraform sub block.
+
+
+
+**Args**:
+  - `description` (`string`): Description of the expression. This is a longer text which describes the
+expression, e.g. when hovered over it in a UI. When `null`, the `description` field will be omitted from the resulting object.
+  - `expression` (`string`): Textual representation of an expression in Common Expression Language syntax.
+  - `location` (`string`): String indicating the location of the expression for error reporting, e.g. a
+file name and a position in the file. When `null`, the `location` field will be omitted from the resulting object.
+  - `title` (`string`): Title for the expression, i.e. a short string describing its purpose. This can
+be used e.g. in UIs which allow to enter the expression. When `null`, the `title` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `value_expression` sub block.
+
+
+## obj custom_config.predicate
+
+
+
+### fn custom_config.predicate.new
+
+```ts
+new()
+```
+
+
+`google.scc_organization_custom_module.custom_config.predicate.new` constructs a new object with attributes and blocks configured for the `predicate`
+Terraform sub block.
+
+
+
+**Args**:
+  - `description` (`string`): Description of the expression. This is a longer text which describes the
+expression, e.g. when hovered over it in a UI. When `null`, the `description` field will be omitted from the resulting object.
+  - `expression` (`string`): Textual representation of an expression in Common Expression Language syntax.
+  - `location` (`string`): String indicating the location of the expression for error reporting, e.g. a
+file name and a position in the file. When `null`, the `location` field will be omitted from the resulting object.
+  - `title` (`string`): Title for the expression, i.e. a short string describing its purpose. This can
+be used e.g. in UIs which allow to enter the expression. When `null`, the `title` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `predicate` sub block.
+
+
+## obj custom_config.resource_selector
+
+
+
+### fn custom_config.resource_selector.new
+
+```ts
+new()
+```
+
+
+`google.scc_organization_custom_module.custom_config.resource_selector.new` constructs a new object with attributes and blocks configured for the `resource_selector`
+Terraform sub block.
+
+
+
+**Args**:
+  - `resource_types` (`list`): The resource types to run the detector on.
+
+**Returns**:
+  - An attribute object that represents the `resource_selector` sub block.
+
+
+## obj timeouts
+
+
+
+### fn timeouts.new
+
+```ts
+new()
+```
+
+
+`google.scc_organization_custom_module.timeouts.new` constructs a new object with attributes and blocks configured for the `timeouts`
+Terraform sub block.
+
+
+
+**Args**:
+  - `create` (`string`): Set the `create` field on the resulting object. When `null`, the `create` field will be omitted from the resulting object.
+  - `delete` (`string`): Set the `delete` field on the resulting object. When `null`, the `delete` field will be omitted from the resulting object.
+  - `update` (`string`): Set the `update` field on the resulting object. When `null`, the `update` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that represents the `timeouts` sub block.
diff --git a/docs/4.x/secret_manager_secret.md b/docs/4.x/secret_manager_secret.md
index 951cc940..7a666af8 100644
--- a/docs/4.x/secret_manager_secret.md
+++ b/docs/4.x/secret_manager_secret.md
@@ -91,9 +91,14 @@ symbols.
 The total size of annotation keys and values must be less than 16KiB.
 
 An object containing a list of "key": value pairs. Example:
-{ "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `annotations` field will be omitted from the resulting object.
+{ "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `expire_time` (`string`): Timestamp in UTC when the Secret is scheduled to expire. This is always provided on output, regardless of what was sent on input.
-A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z". When `null`, the `expire_time` field will be omitted from the resulting object.
+A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
+Only one of 'expire_time' or 'ttl' can be provided. When `null`, the `expire_time` field will be omitted from the resulting object.
   - `labels` (`obj`): The labels assigned to this Secret.
 
 Label keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes,
@@ -105,11 +110,16 @@ and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}\p{N}_-]
 No more than 64 labels can be assigned to a given resource.
 
 An object containing a list of "key": value pairs. Example:
-{ "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+{ "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `secret_id` (`string`): This must be unique within the project.
   - `ttl` (`string`): The TTL for the Secret.
-A duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s". When `null`, the `ttl` field will be omitted from the resulting object.
+A duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s".
+Only one of 'ttl' or 'expire_time' can be provided. When `null`, the `ttl` field will be omitted from the resulting object.
   - `version_aliases` (`obj`): Mapping from version alias to version name.
 
 A version alias is a string with a maximum length of 63 characters and can contain
@@ -160,9 +170,14 @@ symbols.
 The total size of annotation keys and values must be less than 16KiB.
 
 An object containing a list of "key": value pairs. Example:
-{ "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `annotations` field will be omitted from the resulting object.
+{ "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
+Please refer to the field 'effective_annotations' for all of the annotations present on the resource. When `null`, the `annotations` field will be omitted from the resulting object.
   - `expire_time` (`string`): Timestamp in UTC when the Secret is scheduled to expire. This is always provided on output, regardless of what was sent on input.
-A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z". When `null`, the `expire_time` field will be omitted from the resulting object.
+A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
+Only one of 'expire_time' or 'ttl' can be provided. When `null`, the `expire_time` field will be omitted from the resulting object.
   - `labels` (`obj`): The labels assigned to this Secret.
 
 Label keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes,
@@ -174,11 +189,16 @@ and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}\p{N}_-]
 No more than 64 labels can be assigned to a given resource.
 
 An object containing a list of "key": value pairs. Example:
-{ "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+{ "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `secret_id` (`string`): This must be unique within the project.
   - `ttl` (`string`): The TTL for the Secret.
-A duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s". When `null`, the `ttl` field will be omitted from the resulting object.
+A duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s".
+Only one of 'ttl' or 'expire_time' can be provided. When `null`, the `ttl` field will be omitted from the resulting object.
   - `version_aliases` (`obj`): Mapping from version alias to version name.
 
 A version alias is a string with a maximum length of 63 characters and can contain
@@ -474,7 +494,6 @@ Terraform sub block.
 
 
 **Args**:
-  - `automatic` (`bool`): The Secret will automatically be replicated without any restrictions. When `null`, the `automatic` field will be omitted from the resulting object.
   - `auto` (`list[obj]`): The Secret will automatically be replicated without any restrictions. When `null`, the `auto` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.replication.auto.new](#fn-replicationautonew) constructor.
   - `user_managed` (`list[obj]`): The Secret will be replicated to the regions specified by the user. When `null`, the `user_managed` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.secret_manager_secret.replication.user_managed.new](#fn-replicationuser_managednew) constructor.
 
diff --git a/docs/4.x/spanner_instance.md b/docs/4.x/spanner_instance.md
index ba05140b..a9a9dcc0 100644
--- a/docs/4.x/spanner_instance.md
+++ b/docs/4.x/spanner_instance.md
@@ -68,7 +68,11 @@ unique per project and between 4 and 30 characters in length.
   - `force_destroy` (`bool`): When deleting a spanner instance, this boolean option will delete all backups of this instance.
 This must be set to true if you created a backup manually in the console. When `null`, the `force_destroy` field will be omitted from the resulting object.
   - `labels` (`obj`): An object containing a list of "key": value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): A unique identifier for the instance, which cannot be changed after
 the instance is created. The name must be between 6 and 30 characters
 in length.
@@ -115,7 +119,11 @@ unique per project and between 4 and 30 characters in length.
   - `force_destroy` (`bool`): When deleting a spanner instance, this boolean option will delete all backups of this instance.
 This must be set to true if you created a backup manually in the console. When `null`, the `force_destroy` field will be omitted from the resulting object.
   - `labels` (`obj`): An object containing a list of "key": value pairs.
-Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }. When `null`, the `labels` field will be omitted from the resulting object.
+Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): A unique identifier for the instance, which cannot be changed after
 the instance is created. The name must be between 6 and 30 characters
 in length.
diff --git a/docs/4.x/sql_database_instance.md b/docs/4.x/sql_database_instance.md
index 489d6ea3..0ffd813a 100644
--- a/docs/4.x/sql_database_instance.md
+++ b/docs/4.x/sql_database_instance.md
@@ -527,6 +527,7 @@ Terraform sub block.
   - `allocated_ip_range` (`string`): The name of the allocated ip range for the private ip CloudSQL instance. For example: "google-managed-services-default". If set, the cloned instance ip will be created in the allocated range. The range name must comply with [RFC 1035](https://tools.ietf.org/html/rfc1035). Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?. When `null`, the `allocated_ip_range` field will be omitted from the resulting object.
   - `database_names` (`list`): (SQL Server only, use with point_in_time) clone only the specified databases from the source instance. Clone all databases if empty. When `null`, the `database_names` field will be omitted from the resulting object.
   - `point_in_time` (`string`): The timestamp of the point in time that should be restored. When `null`, the `point_in_time` field will be omitted from the resulting object.
+  - `preferred_zone` (`string`): (Point-in-time recovery for PostgreSQL only) Clone to an instance in the specified zone. If no zone is specified, clone to the same zone as the source instance. When `null`, the `preferred_zone` field will be omitted from the resulting object.
   - `source_instance_name` (`string`): The name of the instance from which the point in time should be restored.
 
 **Returns**:
diff --git a/docs/4.x/sql_source_representation_instance.md b/docs/4.x/sql_source_representation_instance.md
index 75ff174f..1e3c9b7a 100644
--- a/docs/4.x/sql_source_representation_instance.md
+++ b/docs/4.x/sql_source_representation_instance.md
@@ -66,7 +66,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `client_key` (`string`): The private key file for the client certificate on the external server. Required only for server-client authentication. Include only if SSL/TLS is used on the external server. When `null`, the `client_key` field will be omitted from the resulting object.
   - `database_version` (`string`): The MySQL version running on your source database server. Possible values: ["MYSQL_5_6", "MYSQL_5_7", "MYSQL_8_0", "POSTGRES_9_6", "POSTGRES_10", "POSTGRES_11", "POSTGRES_12", "POSTGRES_13", "POSTGRES_14"]
   - `dump_file_path` (`string`): A file in the bucket that contains the data from the external server. When `null`, the `dump_file_path` field will be omitted from the resulting object.
-  - `host` (`string`): The externally accessible IPv4 address for the source database server.
+  - `host` (`string`): The IPv4 address and port for the external server, or the the DNS address for the external server. If the external server is hosted on Cloud SQL, the port is 5432.
   - `name` (`string`): The name of the source representation instance. Use any valid Cloud SQL instance name.
   - `password` (`string`): The password for the replication user account. When `null`, the `password` field will be omitted from the resulting object.
   - `port` (`number`): The externally accessible port for the source database server.
@@ -104,7 +104,7 @@ injecting into a complete block.
   - `client_key` (`string`): The private key file for the client certificate on the external server. Required only for server-client authentication. Include only if SSL/TLS is used on the external server. When `null`, the `client_key` field will be omitted from the resulting object.
   - `database_version` (`string`): The MySQL version running on your source database server. Possible values: ["MYSQL_5_6", "MYSQL_5_7", "MYSQL_8_0", "POSTGRES_9_6", "POSTGRES_10", "POSTGRES_11", "POSTGRES_12", "POSTGRES_13", "POSTGRES_14"]
   - `dump_file_path` (`string`): A file in the bucket that contains the data from the external server. When `null`, the `dump_file_path` field will be omitted from the resulting object.
-  - `host` (`string`): The externally accessible IPv4 address for the source database server.
+  - `host` (`string`): The IPv4 address and port for the external server, or the the DNS address for the external server. If the external server is hosted on Cloud SQL, the port is 5432.
   - `name` (`string`): The name of the source representation instance. Use any valid Cloud SQL instance name.
   - `password` (`string`): The password for the replication user account. When `null`, the `password` field will be omitted from the resulting object.
   - `port` (`number`): The externally accessible port for the source database server.
diff --git a/docs/4.x/storage_bucket.md b/docs/4.x/storage_bucket.md
index 299c0592..d41a8586 100644
--- a/docs/4.x/storage_bucket.md
+++ b/docs/4.x/storage_bucket.md
@@ -22,6 +22,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withCustomPlacementConfig()`](#fn-withcustomplacementconfig)
 * [`fn withCustomPlacementConfigMixin()`](#fn-withcustomplacementconfigmixin)
 * [`fn withDefaultEventBasedHold()`](#fn-withdefaulteventbasedhold)
+* [`fn withEnableObjectRetention()`](#fn-withenableobjectretention)
 * [`fn withEncryption()`](#fn-withencryption)
 * [`fn withEncryptionMixin()`](#fn-withencryptionmixin)
 * [`fn withForceDestroy()`](#fn-withforcedestroy)
@@ -100,6 +101,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `default_event_based_hold` (`bool`): Whether or not to automatically apply an eventBasedHold to new objects added to the bucket. When `null`, the `default_event_based_hold` field will be omitted from the resulting object.
+  - `enable_object_retention` (`bool`): Enables each object in the bucket to have its own retention policy, which prevents deletion until stored for a specific length of time. When `null`, the `enable_object_retention` field will be omitted from the resulting object.
   - `force_destroy` (`bool`): When deleting a bucket, this boolean option will delete all contained objects. If you try to delete a bucket that contains objects, Terraform will fail that run. When `null`, the `force_destroy` field will be omitted from the resulting object.
   - `labels` (`obj`): A set of key/value label pairs to assign to the bucket. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The Google Cloud Storage location
@@ -143,6 +145,7 @@ injecting into a complete block.
 
 **Args**:
   - `default_event_based_hold` (`bool`): Whether or not to automatically apply an eventBasedHold to new objects added to the bucket. When `null`, the `default_event_based_hold` field will be omitted from the resulting object.
+  - `enable_object_retention` (`bool`): Enables each object in the bucket to have its own retention policy, which prevents deletion until stored for a specific length of time. When `null`, the `enable_object_retention` field will be omitted from the resulting object.
   - `force_destroy` (`bool`): When deleting a bucket, this boolean option will delete all contained objects. If you try to delete a bucket that contains objects, Terraform will fail that run. When `null`, the `force_destroy` field will be omitted from the resulting object.
   - `labels` (`obj`): A set of key/value label pairs to assign to the bucket. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The Google Cloud Storage location
@@ -294,6 +297,22 @@ Terraform resource block to set or update the default_event_based_hold field.
   - `value` (`bool`): The value to set for the `default_event_based_hold` field.
 
 
+### fn withEnableObjectRetention
+
+```ts
+withEnableObjectRetention()
+```
+
+`google.bool.withEnableObjectRetention` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the enable_object_retention field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `enable_object_retention` field.
+
+
 ### fn withEncryption
 
 ```ts
@@ -714,6 +733,7 @@ Terraform sub block.
 
 **Args**:
   - `enabled` (`bool`): While set to true, autoclass automatically transitions objects in your bucket to appropriate storage classes based on each object's access pattern.
+  - `terminal_storage_class` (`string`): The storage class that objects in the bucket eventually transition to if they are not read for a certain length of time. Supported values include: NEARLINE, ARCHIVE. When `null`, the `terminal_storage_class` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that represents the `autoclass` sub block.
diff --git a/docs/4.x/storage_bucket_object.md b/docs/4.x/storage_bucket_object.md
index de3761aa..447a616d 100644
--- a/docs/4.x/storage_bucket_object.md
+++ b/docs/4.x/storage_bucket_object.md
@@ -29,6 +29,8 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withKmsKeyName()`](#fn-withkmskeyname)
 * [`fn withMetadata()`](#fn-withmetadata)
 * [`fn withName()`](#fn-withname)
+* [`fn withRetention()`](#fn-withretention)
+* [`fn withRetentionMixin()`](#fn-withretentionmixin)
 * [`fn withSource()`](#fn-withsource)
 * [`fn withStorageClass()`](#fn-withstorageclass)
 * [`fn withTemporaryHold()`](#fn-withtemporaryhold)
@@ -36,6 +38,8 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withTimeoutsMixin()`](#fn-withtimeoutsmixin)
 * [`obj customer_encryption`](#obj-customer_encryption)
   * [`fn new()`](#fn-customer_encryptionnew)
+* [`obj retention`](#obj-retention)
+  * [`fn new()`](#fn-retentionnew)
 * [`obj timeouts`](#obj-timeouts)
   * [`fn new()`](#fn-timeoutsnew)
 
@@ -84,6 +88,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `storage_class` (`string`): The StorageClass of the new bucket object. Supported values include: MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE. If not provided, this defaults to the bucket's default storage class or to a standard class. When `null`, the `storage_class` field will be omitted from the resulting object.
   - `temporary_hold` (`bool`): Whether an object is under temporary hold. While this flag is set to true, the object is protected against deletion and overwrites. When `null`, the `temporary_hold` field will be omitted from the resulting object.
   - `customer_encryption` (`list[obj]`): Encryption key; encoded using base64. When `null`, the `customer_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket_object.customer_encryption.new](#fn-customer_encryptionnew) constructor.
+  - `retention` (`list[obj]`): Object level retention configuration. When `null`, the `retention` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket_object.retention.new](#fn-retentionnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket_object.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -124,6 +129,7 @@ injecting into a complete block.
   - `storage_class` (`string`): The StorageClass of the new bucket object. Supported values include: MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE. If not provided, this defaults to the bucket's default storage class or to a standard class. When `null`, the `storage_class` field will be omitted from the resulting object.
   - `temporary_hold` (`bool`): Whether an object is under temporary hold. While this flag is set to true, the object is protected against deletion and overwrites. When `null`, the `temporary_hold` field will be omitted from the resulting object.
   - `customer_encryption` (`list[obj]`): Encryption key; encoded using base64. When `null`, the `customer_encryption` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket_object.customer_encryption.new](#fn-customer_encryptionnew) constructor.
+  - `retention` (`list[obj]`): Object level retention configuration. When `null`, the `retention` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket_object.retention.new](#fn-retentionnew) constructor.
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_bucket_object.timeouts.new](#fn-timeoutsnew) constructor.
 
 **Returns**:
@@ -359,6 +365,43 @@ Terraform resource block to set or update the name field.
   - `value` (`string`): The value to set for the `name` field.
 
 
+### fn withRetention
+
+```ts
+withRetention()
+```
+
+`google.list[obj].withRetention` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the retention field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withRetentionMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `retention` field.
+
+
+### fn withRetentionMixin
+
+```ts
+withRetentionMixin()
+```
+
+`google.list[obj].withRetentionMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the retention field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withRetention](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `retention` field.
+
+
 ### fn withSource
 
 ```ts
@@ -467,6 +510,30 @@ Terraform sub block.
   - An attribute object that represents the `customer_encryption` sub block.
 
 
+## obj retention
+
+
+
+### fn retention.new
+
+```ts
+new()
+```
+
+
+`google.storage_bucket_object.retention.new` constructs a new object with attributes and blocks configured for the `retention`
+Terraform sub block.
+
+
+
+**Args**:
+  - `mode` (`string`): The object retention mode. Supported values include: "Unlocked", "Locked".
+  - `retain_until_time` (`string`): Time in RFC 3339 (e.g. 2030-01-01T02:03:04Z) until which object retention protects this object.
+
+**Returns**:
+  - An attribute object that represents the `retention` sub block.
+
+
 ## obj timeouts
 
 
diff --git a/docs/4.x/storage_transfer_job.md b/docs/4.x/storage_transfer_job.md
index 26346e9e..8e29bc5d 100644
--- a/docs/4.x/storage_transfer_job.md
+++ b/docs/4.x/storage_transfer_job.md
@@ -16,6 +16,8 @@ This package contains functions and utilities for setting up the resource using
 * [`fn new()`](#fn-new)
 * [`fn newAttrs()`](#fn-newattrs)
 * [`fn withDescription()`](#fn-withdescription)
+* [`fn withEventStream()`](#fn-witheventstream)
+* [`fn withEventStreamMixin()`](#fn-witheventstreammixin)
 * [`fn withNotificationConfig()`](#fn-withnotificationconfig)
 * [`fn withNotificationConfigMixin()`](#fn-withnotificationconfigmixin)
 * [`fn withProject()`](#fn-withproject)
@@ -24,6 +26,8 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withStatus()`](#fn-withstatus)
 * [`fn withTransferSpec()`](#fn-withtransferspec)
 * [`fn withTransferSpecMixin()`](#fn-withtransferspecmixin)
+* [`obj event_stream`](#obj-event_stream)
+  * [`fn new()`](#fn-event_streamnew)
 * [`obj notification_config`](#obj-notification_config)
   * [`fn new()`](#fn-notification_confignew)
 * [`obj schedule`](#obj-schedule)
@@ -91,6 +95,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `description` (`string`): Unique description to identify the Transfer Job.
   - `project` (`string`): The project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.
   - `status` (`string`): Status of the job. Default: ENABLED. NOTE: The effect of the new job status takes place during a subsequent job run. For example, if you change the job status from ENABLED to DISABLED, and an operation spawned by the transfer is running, the status change would not affect the current operation. When `null`, the `status` field will be omitted from the resulting object.
+  - `event_stream` (`list[obj]`): Set the `event_stream` field on the resulting resource block. When `null`, the `event_stream` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.event_stream.new](#fn-event_streamnew) constructor.
   - `notification_config` (`list[obj]`): Notification configuration. When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.notification_config.new](#fn-notification_confignew) constructor.
   - `schedule` (`list[obj]`): Schedule specification defining when the Transfer Job should be scheduled to start, end and what time to run. When `null`, the `schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.schedule.new](#fn-schedulenew) constructor.
   - `transfer_spec` (`list[obj]`): Transfer specification. When `null`, the `transfer_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.transfer_spec.new](#fn-transfer_specnew) constructor.
@@ -120,6 +125,7 @@ injecting into a complete block.
   - `description` (`string`): Unique description to identify the Transfer Job.
   - `project` (`string`): The project in which the resource belongs. If it is not provided, the provider project is used. When `null`, the `project` field will be omitted from the resulting object.
   - `status` (`string`): Status of the job. Default: ENABLED. NOTE: The effect of the new job status takes place during a subsequent job run. For example, if you change the job status from ENABLED to DISABLED, and an operation spawned by the transfer is running, the status change would not affect the current operation. When `null`, the `status` field will be omitted from the resulting object.
+  - `event_stream` (`list[obj]`): Set the `event_stream` field on the resulting object. When `null`, the `event_stream` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.event_stream.new](#fn-event_streamnew) constructor.
   - `notification_config` (`list[obj]`): Notification configuration. When `null`, the `notification_config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.notification_config.new](#fn-notification_confignew) constructor.
   - `schedule` (`list[obj]`): Schedule specification defining when the Transfer Job should be scheduled to start, end and what time to run. When `null`, the `schedule` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.schedule.new](#fn-schedulenew) constructor.
   - `transfer_spec` (`list[obj]`): Transfer specification. When `null`, the `transfer_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.storage_transfer_job.transfer_spec.new](#fn-transfer_specnew) constructor.
@@ -144,6 +150,43 @@ Terraform resource block to set or update the description field.
   - `value` (`string`): The value to set for the `description` field.
 
 
+### fn withEventStream
+
+```ts
+withEventStream()
+```
+
+`google.list[obj].withEventStream` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the event_stream field.
+
+This function will replace the array with the passed in `value`. If you wish to instead append the
+passed in value to the existing array, use the [google.list[obj].withEventStreamMixin](TODO) function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `event_stream` field.
+
+
+### fn withEventStreamMixin
+
+```ts
+withEventStreamMixin()
+```
+
+`google.list[obj].withEventStreamMixin` constructs a mixin object that can be merged into the `list[obj]`
+Terraform resource block to set or update the event_stream field.
+
+This function will append the passed in array or object to the existing array. If you wish
+to instead replace the array with the passed in `value`, use the [google.list[obj].withEventStream](TODO)
+function.
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list[obj]`): The value to set for the `event_stream` field.
+
+
 ### fn withNotificationConfig
 
 ```ts
@@ -287,6 +330,31 @@ function.
   - `value` (`list[obj]`): The value to set for the `transfer_spec` field.
 
 
+## obj event_stream
+
+
+
+### fn event_stream.new
+
+```ts
+new()
+```
+
+
+`google.storage_transfer_job.event_stream.new` constructs a new object with attributes and blocks configured for the `event_stream`
+Terraform sub block.
+
+
+
+**Args**:
+  - `event_stream_expiration_time` (`string`): Specifies the data and time at which Storage Transfer Service stops listening for events from this stream. After this time, any transfers in progress will complete, but no new transfers are initiated When `null`, the `event_stream_expiration_time` field will be omitted from the resulting object.
+  - `event_stream_start_time` (`string`): Specifies the date and time that Storage Transfer Service starts listening for events from this stream. If no start time is specified or start time is in the past, Storage Transfer Service starts listening immediately When `null`, the `event_stream_start_time` field will be omitted from the resulting object.
+  - `name` (`string`): Specifies a unique name of the resource such as AWS SQS ARN in the form 'arn:aws:sqs:region:account_id:queue_name', or Pub/Sub subscription resource name in the form 'projects/{project}/subscriptions/{sub}'
+
+**Returns**:
+  - An attribute object that represents the `event_stream` sub block.
+
+
 ## obj notification_config
 
 
diff --git a/docs/4.x/tpu_node.md b/docs/4.x/tpu_node.md
index cb28e678..08afd0aa 100644
--- a/docs/4.x/tpu_node.md
+++ b/docs/4.x/tpu_node.md
@@ -74,7 +74,10 @@ currently existing TPU node, the CIDR block conflicts with any
 subnetworks in the user's provided network, or the provided network
 is peered with another network that is using that CIDR block. When `null`, the `cidr_block` field will be omitted from the resulting object.
   - `description` (`string`): The user-supplied description of the TPU. Maximum of 512 characters. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user provided metadata.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The immutable name of the TPU.
   - `network` (`string`): The name of a network to peer the TPU node to. It must be a
 preexisting Compute Engine network inside of the project on which
@@ -123,7 +126,10 @@ currently existing TPU node, the CIDR block conflicts with any
 subnetworks in the user's provided network, or the provided network
 is peered with another network that is using that CIDR block. When `null`, the `cidr_block` field will be omitted from the resulting object.
   - `description` (`string`): The user-supplied description of the TPU. Maximum of 512 characters. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): Resource labels to represent user provided metadata. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): Resource labels to represent user provided metadata.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The immutable name of the TPU.
   - `network` (`string`): The name of a network to peer the TPU node to. It must be a
 preexisting Compute Engine network inside of the project on which
diff --git a/docs/4.x/vertex_ai_dataset.md b/docs/4.x/vertex_ai_dataset.md
index 4491a4c2..f476aeba 100644
--- a/docs/4.x/vertex_ai_dataset.md
+++ b/docs/4.x/vertex_ai_dataset.md
@@ -59,7 +59,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `display_name` (`string`): The user-defined name of the Dataset. The name can be up to 128 characters long and can be consist of any UTF-8 characters.
-  - `labels` (`obj`): A set of key/value label pairs to assign to this Workflow. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to this Workflow.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `metadata_schema_uri` (`string`): Points to a YAML file stored on Google Cloud Storage describing additional information about the Dataset. The schema is defined as an OpenAPI 3.0.2 Schema Object. The schema files that can be used here are found in gs://google-cloud-aiplatform/schema/dataset/metadata/.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region of the dataset. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.
@@ -89,7 +93,11 @@ injecting into a complete block.
 
 **Args**:
   - `display_name` (`string`): The user-defined name of the Dataset. The name can be up to 128 characters long and can be consist of any UTF-8 characters.
-  - `labels` (`obj`): A set of key/value label pairs to assign to this Workflow. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to this Workflow.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `metadata_schema_uri` (`string`): Points to a YAML file stored on Google Cloud Storage describing additional information about the Dataset. The schema is defined as an OpenAPI 3.0.2 Schema Object. The schema files that can be used here are found in gs://google-cloud-aiplatform/schema/dataset/metadata/.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region of the dataset. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.
diff --git a/docs/4.x/vertex_ai_endpoint.md b/docs/4.x/vertex_ai_endpoint.md
index 94187d32..bb12631f 100644
--- a/docs/4.x/vertex_ai_endpoint.md
+++ b/docs/4.x/vertex_ai_endpoint.md
@@ -63,7 +63,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): The description of the Endpoint. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): Required. The display name of the Endpoint. The name can be up to 128 characters long and can consist of any UTF-8 characters.
-  - `labels` (`obj`): The labels with user-defined metadata to organize your Endpoints. Label keys and values can be no longer than 64 characters (Unicode codepoints), can only contain lowercase letters, numeric characters, underscores and dashes. International characters are allowed. See https://goo.gl/xmQnxf for more information and examples of labels. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): The labels with user-defined metadata to organize your Endpoints. Label keys and values can be no longer than 64 characters (Unicode codepoints), can only contain lowercase letters, numeric characters, underscores and dashes. International characters are allowed. See https://goo.gl/xmQnxf for more information and examples of labels.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): The resource name of the Endpoint. The name must be numeric with no leading zeros and can be at most 10 digits.
   - `network` (`string`): The full name of the Google Compute Engine [network](https://cloud.google.com//compute/docs/networks-and-firewalls#networks) to which the Endpoint should be peered. Private services access must already be configured for the network. If left unspecified, the Endpoint is not peered with any network. Only one of the fields, network or enable_private_service_connect, can be set. [Format](https://cloud.google.com/compute/docs/reference/rest/v1/networks/insert): 'projects/{project}/global/networks/{network}'. Where '{project}' is a project number, as in '12345', and '{network}' is network name. When `null`, the `network` field will be omitted from the resulting object.
@@ -96,7 +99,10 @@ injecting into a complete block.
 **Args**:
   - `description` (`string`): The description of the Endpoint. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): Required. The display name of the Endpoint. The name can be up to 128 characters long and can consist of any UTF-8 characters.
-  - `labels` (`obj`): The labels with user-defined metadata to organize your Endpoints. Label keys and values can be no longer than 64 characters (Unicode codepoints), can only contain lowercase letters, numeric characters, underscores and dashes. International characters are allowed. See https://goo.gl/xmQnxf for more information and examples of labels. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): The labels with user-defined metadata to organize your Endpoints. Label keys and values can be no longer than 64 characters (Unicode codepoints), can only contain lowercase letters, numeric characters, underscores and dashes. International characters are allowed. See https://goo.gl/xmQnxf for more information and examples of labels.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `location` (`string`): The location for the resource
   - `name` (`string`): The resource name of the Endpoint. The name must be numeric with no leading zeros and can be at most 10 digits.
   - `network` (`string`): The full name of the Google Compute Engine [network](https://cloud.google.com//compute/docs/networks-and-firewalls#networks) to which the Endpoint should be peered. Private services access must already be configured for the network. If left unspecified, the Endpoint is not peered with any network. Only one of the fields, network or enable_private_service_connect, can be set. [Format](https://cloud.google.com/compute/docs/reference/rest/v1/networks/insert): 'projects/{project}/global/networks/{network}'. Where '{project}' is a project number, as in '12345', and '{network}' is network name. When `null`, the `network` field will be omitted from the resulting object.
diff --git a/docs/4.x/vertex_ai_featurestore.md b/docs/4.x/vertex_ai_featurestore.md
index 1cde68e7..d3915f5d 100644
--- a/docs/4.x/vertex_ai_featurestore.md
+++ b/docs/4.x/vertex_ai_featurestore.md
@@ -65,7 +65,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 **Args**:
   - `resourceLabel` (`string`): The name label of the block.
   - `force_destroy` (`bool`): If set to true, any EntityTypes and Features for this Featurestore will also be deleted When `null`, the `force_destroy` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to this Featurestore. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to this Featurestore.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The name of the Featurestore. This value may be up to 60 characters, and valid characters are [a-z0-9_]. The first character cannot be a number. When `null`, the `name` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region of the dataset. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.
@@ -96,7 +100,11 @@ injecting into a complete block.
 
 **Args**:
   - `force_destroy` (`bool`): If set to true, any EntityTypes and Features for this Featurestore will also be deleted When `null`, the `force_destroy` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to this Featurestore. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to this Featurestore.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The name of the Featurestore. This value may be up to 60 characters, and valid characters are [a-z0-9_]. The first character cannot be a number. When `null`, the `name` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region of the dataset. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.
diff --git a/docs/4.x/vertex_ai_featurestore_entitytype.md b/docs/4.x/vertex_ai_featurestore_entitytype.md
index 252337e2..0abd11c5 100644
--- a/docs/4.x/vertex_ai_featurestore_entitytype.md
+++ b/docs/4.x/vertex_ai_featurestore_entitytype.md
@@ -67,7 +67,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): Optional. Description of the EntityType. When `null`, the `description` field will be omitted from the resulting object.
   - `featurestore` (`string`): The name of the Featurestore to use, in the format projects/{project}/locations/{location}/featurestores/{featurestore}.
-  - `labels` (`obj`): A set of key/value label pairs to assign to this EntityType. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to this EntityType.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The name of the EntityType. This value may be up to 60 characters, and valid characters are [a-z0-9_]. The first character cannot be a number. When `null`, the `name` field will be omitted from the resulting object.
   - `monitoring_config` (`list[obj]`): The default monitoring configuration for all Features under this EntityType.
 
@@ -98,7 +102,11 @@ injecting into a complete block.
 **Args**:
   - `description` (`string`): Optional. Description of the EntityType. When `null`, the `description` field will be omitted from the resulting object.
   - `featurestore` (`string`): The name of the Featurestore to use, in the format projects/{project}/locations/{location}/featurestores/{featurestore}.
-  - `labels` (`obj`): A set of key/value label pairs to assign to this EntityType. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to this EntityType.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The name of the EntityType. This value may be up to 60 characters, and valid characters are [a-z0-9_]. The first character cannot be a number. When `null`, the `name` field will be omitted from the resulting object.
   - `monitoring_config` (`list[obj]`): The default monitoring configuration for all Features under this EntityType.
 
diff --git a/docs/4.x/vertex_ai_featurestore_entitytype_feature.md b/docs/4.x/vertex_ai_featurestore_entitytype_feature.md
index 0fb8699f..3aa9bcbd 100644
--- a/docs/4.x/vertex_ai_featurestore_entitytype_feature.md
+++ b/docs/4.x/vertex_ai_featurestore_entitytype_feature.md
@@ -56,7 +56,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): Description of the feature. When `null`, the `description` field will be omitted from the resulting object.
   - `entitytype` (`string`): The name of the Featurestore to use, in the format projects/{project}/locations/{location}/featurestores/{featurestore}/entityTypes/{entitytype}.
-  - `labels` (`obj`): A set of key/value label pairs to assign to the feature. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to the feature.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The name of the feature. The feature can be up to 64 characters long and can consist only of ASCII Latin letters A-Z and a-z, underscore(_), and ASCII digits 0-9 starting with a letter. The value will be unique given an entity type. When `null`, the `name` field will be omitted from the resulting object.
   - `value_type` (`string`): Type of Feature value. Immutable. https://cloud.google.com/vertex-ai/docs/reference/rest/v1/projects.locations.featurestores.entityTypes.features#ValueType
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting resource block. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore_entitytype_feature.timeouts.new](#fn-timeoutsnew) constructor.
@@ -85,7 +89,11 @@ injecting into a complete block.
 **Args**:
   - `description` (`string`): Description of the feature. When `null`, the `description` field will be omitted from the resulting object.
   - `entitytype` (`string`): The name of the Featurestore to use, in the format projects/{project}/locations/{location}/featurestores/{featurestore}/entityTypes/{entitytype}.
-  - `labels` (`obj`): A set of key/value label pairs to assign to the feature. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to the feature.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): The name of the feature. The feature can be up to 64 characters long and can consist only of ASCII Latin letters A-Z and a-z, underscore(_), and ASCII digits 0-9 starting with a letter. The value will be unique given an entity type. When `null`, the `name` field will be omitted from the resulting object.
   - `value_type` (`string`): Type of Feature value. Immutable. https://cloud.google.com/vertex-ai/docs/reference/rest/v1/projects.locations.featurestores.entityTypes.features#ValueType
   - `timeouts` (`obj`): Set the `timeouts` field on the resulting object. When `null`, the `timeouts` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_featurestore_entitytype_feature.timeouts.new](#fn-timeoutsnew) constructor.
diff --git a/docs/4.x/vertex_ai_index.md b/docs/4.x/vertex_ai_index.md
index 166793c2..253605dd 100644
--- a/docs/4.x/vertex_ai_index.md
+++ b/docs/4.x/vertex_ai_index.md
@@ -72,7 +72,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `index_update_method` (`string`): The update method to use with this Index. The value must be the followings. If not set, BATCH_UPDATE will be used by default.
 * BATCH_UPDATE: user can call indexes.patch with files on Cloud Storage of datapoints to update.
 * STREAM_UPDATE: user can call indexes.upsertDatapoints/DeleteDatapoints to update the Index and the updates will be applied in corresponding DeployedIndexes in nearly real-time. When `null`, the `index_update_method` field will be omitted from the resulting object.
-  - `labels` (`obj`): The labels with user-defined metadata to organize your Indexes. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): The labels with user-defined metadata to organize your Indexes.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region of the index. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.
   - `metadata` (`list[obj]`): An additional information about the Index When `null`, the `metadata` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index.metadata.new](#fn-metadatanew) constructor.
@@ -105,7 +108,10 @@ injecting into a complete block.
   - `index_update_method` (`string`): The update method to use with this Index. The value must be the followings. If not set, BATCH_UPDATE will be used by default.
 * BATCH_UPDATE: user can call indexes.patch with files on Cloud Storage of datapoints to update.
 * STREAM_UPDATE: user can call indexes.upsertDatapoints/DeleteDatapoints to update the Index and the updates will be applied in corresponding DeployedIndexes in nearly real-time. When `null`, the `index_update_method` field will be omitted from the resulting object.
-  - `labels` (`obj`): The labels with user-defined metadata to organize your Indexes. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): The labels with user-defined metadata to organize your Indexes.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region of the index. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.
   - `metadata` (`list[obj]`): An additional information about the Index When `null`, the `metadata` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index.metadata.new](#fn-metadatanew) constructor.
@@ -306,7 +312,7 @@ The string must be a valid Cloud Storage directory path. If this
 field is set when calling IndexService.UpdateIndex, then no other
 Index field can be also updated as part of the same call.
 The expected structure and format of the files this URI points to is
-described at https://cloud.google.com/vertex-ai/docs/matching-engine/using-matching-engine#input-data-format When `null`, the `contents_delta_uri` field will be omitted from the resulting object.
+described at https://cloud.google.com/vertex-ai/docs/matching-engine/using-matching-engine#input-data-format
   - `is_complete_overwrite` (`bool`): If this field is set together with contentsDeltaUri when calling IndexService.UpdateIndex,
 then existing content of the Index will be replaced by the data from the contentsDeltaUri. When `null`, the `is_complete_overwrite` field will be omitted from the resulting object.
   - `config` (`list[obj]`): The configuration of the Matching Engine Index. When `null`, the `config` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_index.metadata.config.new](#fn-metadataconfignew) constructor.
diff --git a/docs/4.x/vertex_ai_index_endpoint.md b/docs/4.x/vertex_ai_index_endpoint.md
index 481d46d2..3fce8ade 100644
--- a/docs/4.x/vertex_ai_index_endpoint.md
+++ b/docs/4.x/vertex_ai_index_endpoint.md
@@ -58,7 +58,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): The description of the Index. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): The display name of the Index. The name can be up to 128 characters long and can consist of any UTF-8 characters.
-  - `labels` (`obj`): The labels with user-defined metadata to organize your Indexes. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): The labels with user-defined metadata to organize your Indexes.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `network` (`string`): The full name of the Google Compute Engine [network](https://cloud.google.com//compute/docs/networks-and-firewalls#networks) to which the index endpoint should be peered.
 Private services access must already be configured for the network. If left unspecified, the index endpoint is not peered with any network.
 [Format](https://cloud.google.com/compute/docs/reference/rest/v1/networks/insert): 'projects/{project}/global/networks/{network}'.
@@ -92,7 +95,10 @@ injecting into a complete block.
 **Args**:
   - `description` (`string`): The description of the Index. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): The display name of the Index. The name can be up to 128 characters long and can consist of any UTF-8 characters.
-  - `labels` (`obj`): The labels with user-defined metadata to organize your Indexes. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): The labels with user-defined metadata to organize your Indexes.
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `network` (`string`): The full name of the Google Compute Engine [network](https://cloud.google.com//compute/docs/networks-and-firewalls#networks) to which the index endpoint should be peered.
 Private services access must already be configured for the network. If left unspecified, the index endpoint is not peered with any network.
 [Format](https://cloud.google.com/compute/docs/reference/rest/v1/networks/insert): 'projects/{project}/global/networks/{network}'.
diff --git a/docs/4.x/vertex_ai_tensorboard.md b/docs/4.x/vertex_ai_tensorboard.md
index 5a1fc20c..ba435e7a 100644
--- a/docs/4.x/vertex_ai_tensorboard.md
+++ b/docs/4.x/vertex_ai_tensorboard.md
@@ -60,7 +60,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `description` (`string`): Description of this Tensorboard. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): User provided name of this Tensorboard.
-  - `labels` (`obj`): The labels with user-defined metadata to organize your Tensorboards. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): The labels with user-defined metadata to organize your Tensorboards.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region of the tensorboard. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.
   - `encryption_spec` (`list[obj]`): Customer-managed encryption key spec for a Tensorboard. If set, this Tensorboard and all sub-resources of this Tensorboard will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_tensorboard.encryption_spec.new](#fn-encryption_specnew) constructor.
@@ -90,7 +94,11 @@ injecting into a complete block.
 **Args**:
   - `description` (`string`): Description of this Tensorboard. When `null`, the `description` field will be omitted from the resulting object.
   - `display_name` (`string`): User provided name of this Tensorboard.
-  - `labels` (`obj`): The labels with user-defined metadata to organize your Tensorboards. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): The labels with user-defined metadata to organize your Tensorboards.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.
   - `region` (`string`): The region of the tensorboard. eg us-central1 When `null`, the `region` field will be omitted from the resulting object.
   - `encryption_spec` (`list[obj]`): Customer-managed encryption key spec for a Tensorboard. If set, this Tensorboard and all sub-resources of this Tensorboard will be secured by this key. When `null`, the `encryption_spec` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [google.vertex_ai_tensorboard.encryption_spec.new](#fn-encryption_specnew) constructor.
diff --git a/docs/4.x/workflows_workflow.md b/docs/4.x/workflows_workflow.md
index 52c20c9a..68fa8fe3 100644
--- a/docs/4.x/workflows_workflow.md
+++ b/docs/4.x/workflows_workflow.md
@@ -62,7 +62,11 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
 
 Format: projects/{project}/locations/{location}/keyRings/{keyRing}/cryptoKeys/{cryptoKey} When `null`, the `crypto_key_name` field will be omitted from the resulting object.
   - `description` (`string`): Description of the workflow provided by the user. Must be at most 1000 unicode characters long. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to this Workflow. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to this Workflow.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Name of the Workflow. When `null`, the `name` field will be omitted from the resulting object.
   - `name_prefix` (`string`): Set the `name_prefix` field on the resulting resource block. When `null`, the `name_prefix` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting resource block. When `null`, the `project` field will be omitted from the resulting object.
@@ -103,7 +107,11 @@ injecting into a complete block.
 
 Format: projects/{project}/locations/{location}/keyRings/{keyRing}/cryptoKeys/{cryptoKey} When `null`, the `crypto_key_name` field will be omitted from the resulting object.
   - `description` (`string`): Description of the workflow provided by the user. Must be at most 1000 unicode characters long. When `null`, the `description` field will be omitted from the resulting object.
-  - `labels` (`obj`): A set of key/value label pairs to assign to this Workflow. When `null`, the `labels` field will be omitted from the resulting object.
+  - `labels` (`obj`): A set of key/value label pairs to assign to this Workflow.
+
+
+**Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
+Please refer to the field 'effective_labels' for all of the labels present on the resource. When `null`, the `labels` field will be omitted from the resulting object.
   - `name` (`string`): Name of the Workflow. When `null`, the `name` field will be omitted from the resulting object.
   - `name_prefix` (`string`): Set the `name_prefix` field on the resulting object. When `null`, the `name_prefix` field will be omitted from the resulting object.
   - `project` (`string`): Set the `project` field on the resulting object. When `null`, the `project` field will be omitted from the resulting object.