From 081821be676c9e691f9c52642883c49bc67b904e Mon Sep 17 00:00:00 2001
From: xiaoweim <xiaoweim@google.com>
Date: Thu, 30 Jan 2025 22:00:33 +0000
Subject: [PATCH] sync crd version

---
 ...esscontextmanageraccesslevelcondition.yaml |    4 +-
 ...esscontextmanagergcpuseraccessbinding.yaml |    4 +-
 ...beta1_accesscontextmanageraccesslevel.yaml |    4 +-
 ...eta1_accesscontextmanageraccesspolicy.yaml |    4 +-
 ..._accesscontextmanagerserviceperimeter.yaml |    4 +-
 ...ontextmanagerserviceperimeterresource.yaml |    4 +-
 crds/alloydb_v1beta1_alloydbbackup.yaml       |    4 +-
 crds/alloydb_v1beta1_alloydbcluster.yaml      |    4 +-
 crds/alloydb_v1beta1_alloydbinstance.yaml     |  207 +--
 crds/alloydb_v1beta1_alloydbuser.yaml         |    4 +-
 crds/apigateway_v1alpha1_apigatewayapi.yaml   |    4 +-
 ...igateway_v1alpha1_apigatewayapiconfig.yaml |    4 +-
 ...apigateway_v1alpha1_apigatewaygateway.yaml |    4 +-
 crds/apigee_v1alpha1_apigeeaddonsconfig.yaml  |    4 +-
 ...gee_v1alpha1_apigeeendpointattachment.yaml |    4 +-
 crds/apigee_v1alpha1_apigeeenvgroup.yaml      |  140 --
 ...gee_v1alpha1_apigeeenvgroupattachment.yaml |    4 +-
 crds/apigee_v1alpha1_apigeeinstance.yaml      |    4 +-
 ...gee_v1alpha1_apigeeinstanceattachment.yaml |    4 +-
 crds/apigee_v1alpha1_apigeenataddress.yaml    |    4 +-
 ...igee_v1alpha1_apigeesyncauthorization.yaml |    4 +-
 crds/apigee_v1beta1_apigeeenvgroup.yaml       |  340 +++++
 crds/apigee_v1beta1_apigeeenvironment.yaml    |    4 +-
 crds/apigee_v1beta1_apigeeorganization.yaml   |    4 +-
 crds/apikeys_v1alpha1_apikeyskey.yaml         |    4 +-
 ...ngine_v1alpha1_appenginedomainmapping.yaml |    4 +-
 ...engine_v1alpha1_appenginefirewallrule.yaml |    4 +-
 ..._v1alpha1_appengineflexibleappversion.yaml |    4 +-
 ...v1alpha1_appengineservicesplittraffic.yaml |    4 +-
 ..._v1alpha1_appenginestandardappversion.yaml |    4 +-
 ...ry_v1beta1_artifactregistryrepository.yaml |    8 +-
 ...corp_v1alpha1_beyondcorpappconnection.yaml |    4 +-
 ...dcorp_v1alpha1_beyondcorpappconnector.yaml |    4 +-
 ...ondcorp_v1alpha1_beyondcorpappgateway.yaml |    4 +-
 ...gquery_v1alpha1_bigquerydatasetaccess.yaml |    6 +-
 crds/bigquery_v1beta1_bigquerydataset.yaml    |    4 +-
 crds/bigquery_v1beta1_bigqueryjob.yaml        |    6 +-
 crds/bigquery_v1beta1_bigqueryroutine.yaml    |    4 +-
 crds/bigquery_v1beta1_bigquerytable.yaml      |    4 +-
 ..._v1alpha1_bigqueryanalyticshublisting.yaml |  350 -----
 ...eta1_bigqueryanalyticshubdataexchange.yaml |    7 +-
 ...b_v1beta1_bigqueryanalyticshublisting.yaml |  700 +++++++++
 ..._v1beta1_bigqueryconnectionconnection.yaml |    4 +-
 ...v1alpha1_bigquerydatapolicydatapolicy.yaml |    4 +-
 ...er_v1beta1_bigquerydatatransferconfig.yaml |  116 +-
 ...bigqueryreservationcapacitycommitment.yaml |    4 +-
 ...alpha1_bigqueryreservationreservation.yaml |    4 +-
 crds/bigtable_v1beta1_bigtableappprofile.yaml |    4 +-
 crds/bigtable_v1beta1_bigtablegcpolicy.yaml   |    4 +-
 crds/bigtable_v1beta1_bigtableinstance.yaml   |    4 +-
 crds/bigtable_v1beta1_bigtabletable.yaml      |    4 +-
 ...gbudgets_v1beta1_billingbudgetsbudget.yaml |    4 +-
 ...n_v1beta1_binaryauthorizationattestor.yaml |    4 +-
 ...ion_v1beta1_binaryauthorizationpolicy.yaml |    4 +-
 ...v1beta1_certificatemanagercertificate.yaml |    4 +-
 ...eta1_certificatemanagercertificatemap.yaml |    4 +-
 ...certificatemanagercertificatemapentry.yaml |    4 +-
 ...a1_certificatemanagerdnsauthorization.yaml |   22 +-
 ...udasset_v1alpha1_cloudassetfolderfeed.yaml |    4 +-
 ...t_v1alpha1_cloudassetorganizationfeed.yaml |    4 +-
 ...dasset_v1alpha1_cloudassetprojectfeed.yaml |    4 +-
 .../cloudbuild_v1beta1_cloudbuildtrigger.yaml |    9 +-
 ...oudbuild_v1beta1_cloudbuildworkerpool.yaml |   13 +-
 ...ons2_v1alpha1_cloudfunctions2function.yaml |    4 +-
 ...ctions_v1beta1_cloudfunctionsfunction.yaml |    4 +-
 ...udidentity_v1beta1_cloudidentitygroup.yaml |    4 +-
 ...ntity_v1beta1_cloudidentitymembership.yaml |    4 +-
 crds/cloudids_v1beta1_cloudidsendpoint.yaml   |    4 +-
 crds/cloudiot_v1alpha1_cloudiotdevice.yaml    |    4 +-
 ...udiot_v1alpha1_cloudiotdeviceregistry.yaml |    4 +-
 ...udscheduler_v1beta1_cloudschedulerjob.yaml |   11 +-
 crds/cloudtasks_v1alpha1_cloudtasksqueue.yaml |    4 +-
 crds/compute_v1alpha1_computeautoscaler.yaml  |    4 +-
 ...pha1_computebackendbucketsignedurlkey.yaml |    4 +-
 ...ha1_computebackendservicesignedurlkey.yaml |    4 +-
 ...1_computediskresourcepolicyattachment.yaml |    4 +-
 ...v1alpha1_computeglobalnetworkendpoint.yaml |    4 +-
 ...ha1_computeglobalnetworkendpointgroup.yaml |    4 +-
 ...1alpha1_computeinstancegroupnamedport.yaml |    4 +-
 .../compute_v1alpha1_computemachineimage.yaml |    4 +-
 ...mpute_v1alpha1_computenetworkendpoint.yaml |    4 +-
 ...pha1_computenetworkfirewallpolicyrule.yaml |    4 +-
 ...ha1_computenetworkpeeringroutesconfig.yaml |    4 +-
 ...ha1_computeorganizationsecuritypolicy.yaml |    4 +-
 ...organizationsecuritypolicyassociation.yaml |    4 +-
 ...computeorganizationsecuritypolicyrule.yaml |    4 +-
 ...ute_v1alpha1_computeperinstanceconfig.yaml |    4 +-
 ...pute_v1alpha1_computeregionautoscaler.yaml |    4 +-
 ...uteregiondiskresourcepolicyattachment.yaml |    4 +-
 ...alpha1_computeregionperinstanceconfig.yaml |    4 +-
 ...mpute_v1alpha1_computeregionsslpolicy.yaml |    4 +-
 crds/compute_v1beta1_computeaddress.yaml      |    4 +-
 .../compute_v1beta1_computebackendbucket.yaml |    4 +-
 ...compute_v1beta1_computebackendservice.yaml |    4 +-
 crds/compute_v1beta1_computedisk.yaml         |    4 +-
 ...ute_v1beta1_computeexternalvpngateway.yaml |    4 +-
 crds/compute_v1beta1_computefirewall.yaml     |    4 +-
 ...compute_v1beta1_computefirewallpolicy.yaml |    6 +-
 ...eta1_computefirewallpolicyassociation.yaml |    4 +-
 ...ute_v1beta1_computefirewallpolicyrule.yaml |   15 +-
 ...compute_v1beta1_computeforwardingrule.yaml |    6 +-
 crds/compute_v1beta1_computehealthcheck.yaml  |    4 +-
 ...ompute_v1beta1_computehttphealthcheck.yaml |    4 +-
 ...mpute_v1beta1_computehttpshealthcheck.yaml |    4 +-
 crds/compute_v1beta1_computeimage.yaml        |    4 +-
 crds/compute_v1beta1_computeinstance.yaml     |    4 +-
 .../compute_v1beta1_computeinstancegroup.yaml |    4 +-
 ...e_v1beta1_computeinstancegroupmanager.yaml |    4 +-
 ...mpute_v1beta1_computeinstancetemplate.yaml |    4 +-
 ...v1beta1_computeinterconnectattachment.yaml |    4 +-
 ..._v1beta1_computemanagedsslcertificate.yaml |    4 +-
 crds/compute_v1beta1_computenetwork.yaml      |    4 +-
 ...e_v1beta1_computenetworkendpointgroup.yaml |    4 +-
 ..._v1beta1_computenetworkfirewallpolicy.yaml |    6 +-
 ...mputenetworkfirewallpolicyassociation.yaml |    4 +-
 ...compute_v1beta1_computenetworkpeering.yaml |    4 +-
 crds/compute_v1beta1_computenodegroup.yaml    |    4 +-
 crds/compute_v1beta1_computenodetemplate.yaml |    4 +-
 ...ompute_v1beta1_computepacketmirroring.yaml |    4 +-
 ...ompute_v1beta1_computeprojectmetadata.yaml |    4 +-
 ...ta1_computeregionnetworkendpointgroup.yaml |    4 +-
 crds/compute_v1beta1_computereservation.yaml  |    4 +-
 ...compute_v1beta1_computeresourcepolicy.yaml |    4 +-
 crds/compute_v1beta1_computeroute.yaml        |    4 +-
 crds/compute_v1beta1_computerouter.yaml       |    4 +-
 ...ompute_v1beta1_computerouterinterface.yaml |    4 +-
 crds/compute_v1beta1_computerouternat.yaml    |    4 +-
 crds/compute_v1beta1_computerouterpeer.yaml   |    4 +-
 ...compute_v1beta1_computesecuritypolicy.yaml |    4 +-
 ...pute_v1beta1_computeserviceattachment.yaml |    4 +-
 ...e_v1beta1_computesharedvpchostproject.yaml |    4 +-
 ...1beta1_computesharedvpcserviceproject.yaml |    4 +-
 crds/compute_v1beta1_computesnapshot.yaml     |    4 +-
 ...compute_v1beta1_computesslcertificate.yaml |    4 +-
 crds/compute_v1beta1_computesslpolicy.yaml    |    4 +-
 crds/compute_v1beta1_computesubnetwork.yaml   |    4 +-
 ...ompute_v1beta1_computetargetgrpcproxy.yaml |    4 +-
 ...ompute_v1beta1_computetargethttpproxy.yaml |    4 +-
 ...mpute_v1beta1_computetargethttpsproxy.yaml |    4 +-
 ...compute_v1beta1_computetargetinstance.yaml |    4 +-
 crds/compute_v1beta1_computetargetpool.yaml   |    4 +-
 ...compute_v1beta1_computetargetsslproxy.yaml |    4 +-
 ...compute_v1beta1_computetargettcpproxy.yaml |   11 +-
 ...mpute_v1beta1_computetargetvpngateway.yaml |    4 +-
 crds/compute_v1beta1_computeurlmap.yaml       |    6 +-
 crds/compute_v1beta1_computevpngateway.yaml   |    4 +-
 crds/compute_v1beta1_computevpntunnel.yaml    |    4 +-
 ...ller_v1beta1_configcontrollerinstance.yaml |    4 +-
 crds/container_v1beta1_containercluster.yaml  |    8 +-
 crds/container_v1beta1_containernodepool.yaml |    4 +-
 ..._v1alpha1_containeranalysisoccurrence.yaml |    4 +-
 ...nalysis_v1beta1_containeranalysisnote.yaml |    4 +-
 ...ched_v1beta1_containerattachedcluster.yaml |   11 +-
 ...datacatalog_v1alpha1_datacatalogentry.yaml |    8 +-
 ...atalog_v1alpha1_datacatalogentrygroup.yaml |    4 +-
 crds/datacatalog_v1alpha1_datacatalogtag.yaml |    4 +-
 ...talog_v1alpha1_datacatalogtagtemplate.yaml |    4 +-
 ...acatalog_v1beta1_datacatalogpolicytag.yaml |    4 +-
 ...tacatalog_v1beta1_datacatalogtaxonomy.yaml |    4 +-
 ...aflow_v1beta1_dataflowflextemplatejob.yaml |    6 +-
 crds/dataflow_v1beta1_dataflowjob.yaml        |    4 +-
 crds/dataform_v1beta1_dataformrepository.yaml |    4 +-
 ...datafusion_v1beta1_datafusioninstance.yaml |    4 +-
 ...roc_v1beta1_dataprocautoscalingpolicy.yaml |    4 +-
 crds/dataproc_v1beta1_dataproccluster.yaml    |    4 +-
 ...proc_v1beta1_dataprocworkflowtemplate.yaml |    4 +-
 crds/datastore_v1alpha1_datastoreindex.yaml   |    4 +-
 ..._v1alpha1_datastreamconnectionprofile.yaml |    4 +-
 ..._v1alpha1_datastreamprivateconnection.yaml |    4 +-
 .../datastream_v1alpha1_datastreamstream.yaml |    4 +-
 ..._v1alpha1_deploymentmanagerdeployment.yaml |    4 +-
 crds/dialogflow_v1alpha1_dialogflowagent.yaml |    4 +-
 ...logflow_v1alpha1_dialogflowentitytype.yaml |    4 +-
 ...ogflow_v1alpha1_dialogflowfulfillment.yaml |    4 +-
 .../dialogflow_v1alpha1_dialogflowintent.yaml |    4 +-
 ...alogflowcx_v1alpha1_dialogflowcxagent.yaml |    4 +-
 ...lowcx_v1alpha1_dialogflowcxentitytype.yaml |    4 +-
 ...ialogflowcx_v1alpha1_dialogflowcxflow.yaml |    6 +-
 ...logflowcx_v1alpha1_dialogflowcxintent.yaml |    4 +-
 ...ialogflowcx_v1alpha1_dialogflowcxpage.yaml |    6 +-
 ...ogflowcx_v1alpha1_dialogflowcxwebhook.yaml |    4 +-
 ...ine_v1alpha1_discoveryenginedatastore.yaml |   13 +-
 ...1_discoveryenginedatastoretargetsite.yaml} |  116 +-
 ...engine_v1alpha1_discoveryengineengine.yaml |  327 +++++
 crds/dlp_v1beta1_dlpdeidentifytemplate.yaml   |    4 +-
 crds/dlp_v1beta1_dlpinspecttemplate.yaml      |    4 +-
 crds/dlp_v1beta1_dlpjobtrigger.yaml           |    4 +-
 crds/dlp_v1beta1_dlpstoredinfotype.yaml       |    4 +-
 crds/dns_v1alpha1_dnsresponsepolicy.yaml      |    4 +-
 crds/dns_v1alpha1_dnsresponsepolicyrule.yaml  |    4 +-
 crds/dns_v1beta1_dnsmanagedzone.yaml          |    4 +-
 crds/dns_v1beta1_dnspolicy.yaml               |    4 +-
 crds/dns_v1beta1_dnsrecordset.yaml            |    6 +-
 ...cumentai_v1alpha1_documentaiprocessor.yaml |    4 +-
 ...ha1_documentaiprocessordefaultversion.yaml |    4 +-
 ...ontainer_v1beta1_edgecontainercluster.yaml |    4 +-
 ...ntainer_v1beta1_edgecontainernodepool.yaml |    4 +-
 ...er_v1beta1_edgecontainervpnconnection.yaml |    4 +-
 ...dgenetwork_v1beta1_edgenetworknetwork.yaml |    4 +-
 ...edgenetwork_v1beta1_edgenetworksubnet.yaml |    4 +-
 ...cts_v1alpha1_essentialcontactscontact.yaml |    4 +-
 crds/eventarc_v1beta1_eventarctrigger.yaml    |    6 +-
 .../filestore_v1alpha1_filestoresnapshot.yaml |    4 +-
 crds/filestore_v1beta1_filestorebackup.yaml   |    4 +-
 crds/filestore_v1beta1_filestoreinstance.yaml |    4 +-
 .../firebase_v1alpha1_firebaseandroidapp.yaml |    4 +-
 crds/firebase_v1alpha1_firebaseproject.yaml   |    4 +-
 crds/firebase_v1alpha1_firebasewebapp.yaml    |    4 +-
 ...ase_v1alpha1_firebasedatabaseinstance.yaml |    4 +-
 ...sting_v1alpha1_firebasehostingchannel.yaml |    4 +-
 ...ehosting_v1alpha1_firebasehostingsite.yaml |    4 +-
 ...torage_v1alpha1_firebasestoragebucket.yaml |    4 +-
 ... firestore_v1beta1_firestoredatabase.yaml} |  202 ++-
 crds/firestore_v1beta1_firestoreindex.yaml    |    4 +-
 ...kebackup_v1alpha1_gkebackupbackupplan.yaml |    4 +-
 crds/gkehub_v1beta1_gkehubfeature.yaml        |    4 +-
 ...kehub_v1beta1_gkehubfeaturemembership.yaml |   18 +-
 crds/gkehub_v1beta1_gkehubmembership.yaml     |    4 +-
 ...hcare_v1alpha1_healthcareconsentstore.yaml |    4 +-
 ...healthcare_v1alpha1_healthcaredataset.yaml |    4 +-
 ...lthcare_v1alpha1_healthcaredicomstore.yaml |    4 +-
 ...althcare_v1alpha1_healthcarefhirstore.yaml |    6 +-
 ...lthcare_v1alpha1_healthcarehl7v2store.yaml |    4 +-
 crds/iam_v1beta1_iamaccessboundarypolicy.yaml |    4 +-
 crds/iam_v1beta1_iamauditconfig.yaml          |    4 +-
 crds/iam_v1beta1_iamcustomrole.yaml           |    4 +-
 crds/iam_v1beta1_iampartialpolicy.yaml        |   34 +-
 crds/iam_v1beta1_iampolicy.yaml               |    4 +-
 crds/iam_v1beta1_iampolicymember.yaml         |   31 +-
 crds/iam_v1beta1_iamserviceaccount.yaml       |    4 +-
 crds/iam_v1beta1_iamserviceaccountkey.yaml    |    4 +-
 crds/iam_v1beta1_iamworkforcepool.yaml        |    4 +-
 .../iam_v1beta1_iamworkforcepoolprovider.yaml |    4 +-
 crds/iam_v1beta1_iamworkloadidentitypool.yaml |    4 +-
 ...beta1_iamworkloadidentitypoolprovider.yaml |    4 +-
 crds/iap_v1alpha1_iapsettings.yaml            |  310 ++++
 crds/iap_v1beta1_iapbrand.yaml                |    4 +-
 ...p_v1beta1_iapidentityawareproxyclient.yaml |    4 +-
 ...tityplatformdefaultsupportedidpconfig.yaml |    4 +-
 ...ha1_identityplatforminboundsamlconfig.yaml |    4 +-
 ..._identityplatformprojectdefaultconfig.yaml |    4 +-
 ...atformtenantdefaultsupportedidpconfig.yaml |    4 +-
 ...entityplatformtenantinboundsamlconfig.yaml |    4 +-
 ...atform_v1beta1_identityplatformconfig.yaml |    4 +-
 ...1beta1_identityplatformoauthidpconfig.yaml |    4 +-
 ...atform_v1beta1_identityplatformtenant.yaml |    4 +-
 ..._identityplatformtenantoauthidpconfig.yaml |    4 +-
 crds/kms_v1alpha1_kmscryptokeyversion.yaml    |    4 +-
 crds/kms_v1alpha1_kmskeyringimportjob.yaml    |    4 +-
 crds/kms_v1alpha1_kmssecretciphertext.yaml    |    4 +-
 ...yaml => kms_v1beta1_kmsautokeyconfig.yaml} |  167 ++-
 crds/kms_v1beta1_kmscryptokey.yaml            |    4 +-
 crds/kms_v1beta1_kmskeyhandle.yaml            |  325 +++++
 crds/kms_v1beta1_kmskeyring.yaml              |    4 +-
 crds/logging_v1beta1_logginglogbucket.yaml    |    4 +-
 crds/logging_v1beta1_logginglogexclusion.yaml |    4 +-
 crds/logging_v1beta1_logginglogmetric.yaml    |    4 +-
 crds/logging_v1beta1_logginglogsink.yaml      |    4 +-
 crds/logging_v1beta1_logginglogview.yaml      |    4 +-
 crds/memcache_v1beta1_memcacheinstance.yaml   |    6 +-
 ...orystore_v1alpha1_memorystoreinstance.yaml |  477 ++++++
 crds/mlengine_v1alpha1_mlenginemodel.yaml     |    4 +-
 ...itoring_v1beta1_monitoringalertpolicy.yaml |    4 +-
 ...onitoring_v1beta1_monitoringdashboard.yaml |    4 +-
 crds/monitoring_v1beta1_monitoringgroup.yaml  |    4 +-
 ...ng_v1beta1_monitoringmetricdescriptor.yaml |    4 +-
 ...ng_v1beta1_monitoringmonitoredproject.yaml |    4 +-
 ...v1beta1_monitoringnotificationchannel.yaml |    6 +-
 .../monitoring_v1beta1_monitoringservice.yaml |    4 +-
 ...beta1_monitoringservicelevelobjective.yaml |    4 +-
 ...g_v1beta1_monitoringuptimecheckconfig.yaml |    4 +-
 ...rkconnectivityserviceconnectionpolicy.yaml |   11 +-
 ...tivity_v1beta1_networkconnectivityhub.yaml |    4 +-
 ...vity_v1beta1_networkconnectivityspoke.yaml |    4 +-
 ...ha1_networkmanagementconnectivitytest.yaml |    4 +-
 ...a1_networksecurityauthorizationpolicy.yaml |    4 +-
 ...1beta1_networksecurityclienttlspolicy.yaml |    4 +-
 ...1beta1_networksecurityservertlspolicy.yaml |    4 +-
 ...alpha1_networkservicesedgecachekeyset.yaml |    4 +-
 ...alpha1_networkservicesedgecacheorigin.yaml |    4 +-
 ...lpha1_networkservicesedgecacheservice.yaml |   14 +-
 ...v1beta1_networkservicesendpointpolicy.yaml |    6 +-
 ...rvices_v1beta1_networkservicesgateway.yaml |    6 +-
 ...ices_v1beta1_networkservicesgrpcroute.yaml |    6 +-
 ...ices_v1beta1_networkserviceshttproute.yaml |    8 +-
 ...kservices_v1beta1_networkservicesmesh.yaml |    4 +-
 ...vices_v1beta1_networkservicestcproute.yaml |    4 +-
 ...vices_v1beta1_networkservicestlsroute.yaml |    6 +-
 ...tebooks_v1alpha1_notebooksenvironment.yaml |    4 +-
 ...cy_v1alpha1_orgpolicycustomconstraint.yaml |    4 +-
 ...nfig_v1alpha1_osconfigpatchdeployment.yaml |    4 +-
 .../osconfig_v1beta1_osconfigguestpolicy.yaml |    8 +-
 ...ig_v1beta1_osconfigospolicyassignment.yaml |    4 +-
 .../oslogin_v1alpha1_osloginsshpublickey.yaml |    4 +-
 crds/privateca_v1beta1_privatecacapool.yaml   |    4 +-
 ...rivateca_v1beta1_privatecacertificate.yaml |    6 +-
 ...v1beta1_privatecacertificateauthority.yaml |    6 +-
 ..._v1beta1_privatecacertificatetemplate.yaml |    4 +-
 ...a1_privilegedaccessmanagerentitlement.yaml |   17 +-
 crds/pubsub_v1beta1_pubsubschema.yaml         |    4 +-
 crds/pubsub_v1beta1_pubsubsubscription.yaml   |    4 +-
 crds/pubsub_v1beta1_pubsubtopic.yaml          |    4 +-
 ...blite_v1alpha1_pubsublitesubscription.yaml |    4 +-
 crds/pubsublite_v1alpha1_pubsublitetopic.yaml |    4 +-
 ...sublite_v1beta1_pubsublitereservation.yaml |    4 +-
 ...rprise_v1beta1_recaptchaenterprisekey.yaml |    4 +-
 crds/redis_v1beta1_rediscluster.yaml          |   11 +-
 crds/redis_v1beta1_redisinstance.yaml         |    8 +-
 crds/resourcemanager_v1beta1_folder.yaml      |    4 +-
 crds/resourcemanager_v1beta1_project.yaml     |    4 +-
 ...cemanager_v1beta1_resourcemanagerlien.yaml |    4 +-
 ...manager_v1beta1_resourcemanagerpolicy.yaml |    4 +-
 crds/run_v1beta1_runjob.yaml                  |    4 +-
 crds/run_v1beta1_runservice.yaml              |    4 +-
 ...etmanager_v1beta1_secretmanagersecret.yaml |   19 +-
 ...er_v1beta1_secretmanagersecretversion.yaml |  217 ++-
 ..._v1alpha1_securesourcemanagerinstance.yaml |   49 +-
 ...1alpha1_securesourcemanagerrepository.yaml |   22 +-
 ...pha1_securitycenternotificationconfig.yaml |    4 +-
 ...ycenter_v1alpha1_securitycentersource.yaml |    4 +-
 ...tory_v1beta1_servicedirectoryendpoint.yaml |    4 +-
 ...ory_v1beta1_servicedirectorynamespace.yaml |    4 +-
 ...ctory_v1beta1_servicedirectoryservice.yaml |    4 +-
 ...g_v1beta1_servicenetworkingconnection.yaml |    4 +-
 ...ha1_serviceusageconsumerquotaoverride.yaml |    4 +-
 crds/serviceusage_v1beta1_service.yaml        |    4 +-
 .../serviceusage_v1beta1_serviceidentity.yaml |    4 +-
 ...urcerepo_v1beta1_sourcereporepository.yaml |    4 +-
 crds/spanner_v1beta1_spannerdatabase.yaml     |    4 +-
 crds/spanner_v1beta1_spannerinstance.yaml     |   84 +-
 crds/sql_v1beta1_sqldatabase.yaml             |    4 +-
 crds/sql_v1beta1_sqlinstance.yaml             |    6 +-
 crds/sql_v1beta1_sqlsslcert.yaml              |    4 +-
 crds/sql_v1beta1_sqluser.yaml                 |    4 +-
 crds/storage_v1alpha1_storagehmackey.yaml     |    4 +-
 crds/storage_v1beta1_storagebucket.yaml       |    4 +-
 ...ge_v1beta1_storagebucketaccesscontrol.yaml |    4 +-
 ...ta1_storagedefaultobjectaccesscontrol.yaml |    4 +-
 crds/storage_v1beta1_storagenotification.yaml |    4 +-
 ...fer_v1alpha1_storagetransferagentpool.yaml |    4 +-
 ...getransfer_v1beta1_storagetransferjob.yaml |    4 +-
 .../tags_v1alpha1_tagslocationtagbinding.yaml |    4 +-
 crds/tags_v1beta1_tagstagbinding.yaml         |    4 +-
 crds/tags_v1beta1_tagstagkey.yaml             |    4 +-
 crds/tags_v1beta1_tagstagvalue.yaml           |    4 +-
 crds/tpu_v1alpha1_tpunode.yaml                |    6 +-
 ...ertexai_v1alpha1_vertexaifeaturestore.yaml |    4 +-
 ...alpha1_vertexaifeaturestoreentitytype.yaml |    6 +-
 ...vertexaifeaturestoreentitytypefeature.yaml |    4 +-
 ...rtexai_v1alpha1_vertexaiindexendpoint.yaml |    4 +-
 ...rtexai_v1alpha1_vertexaimetadatastore.yaml |    4 +-
 ...vertexai_v1alpha1_vertexaitensorboard.yaml |    4 +-
 crds/vertexai_v1beta1_vertexaidataset.yaml    |    4 +-
 crds/vertexai_v1beta1_vertexaiendpoint.yaml   |    4 +-
 crds/vertexai_v1beta1_vertexaiindex.yaml      |    4 +-
 .../vpcaccess_v1beta1_vpcaccessconnector.yaml |    4 +-
 .../workflows_v1alpha1_workflowsworkflow.yaml |    4 +-
 crds/workstations_v1beta1_workstation.yaml    |  422 ++++++
 ...rkstations_v1beta1_workstationcluster.yaml |   33 +-
 ...orkstations_v1beta1_workstationconfig.yaml | 1298 +++++++++++++++++
 360 files changed, 6024 insertions(+), 1507 deletions(-)
 delete mode 100644 crds/apigee_v1alpha1_apigeeenvgroup.yaml
 create mode 100644 crds/apigee_v1beta1_apigeeenvgroup.yaml
 delete mode 100644 crds/bigqueryanalyticshub_v1alpha1_bigqueryanalyticshublisting.yaml
 create mode 100644 crds/bigqueryanalyticshub_v1beta1_bigqueryanalyticshublisting.yaml
 rename crds/{kms_v1alpha1_kmskeyhandle.yaml => discoveryengine_v1alpha1_discoveryenginedatastoretargetsite.yaml} (55%)
 create mode 100644 crds/discoveryengine_v1alpha1_discoveryengineengine.yaml
 rename crds/{firestore_v1alpha1_firestoredatabase.yaml => firestore_v1beta1_firestoredatabase.yaml} (52%)
 create mode 100644 crds/iap_v1alpha1_iapsettings.yaml
 rename crds/{kms_v1alpha1_kmsautokeyconfig.yaml => kms_v1beta1_kmsautokeyconfig.yaml} (53%)
 create mode 100644 crds/kms_v1beta1_kmskeyhandle.yaml
 create mode 100644 crds/memorystore_v1alpha1_memorystoreinstance.yaml
 create mode 100644 crds/workstations_v1beta1_workstation.yaml
 create mode 100644 crds/workstations_v1beta1_workstationconfig.yaml

diff --git a/crds/accesscontextmanager_v1alpha1_accesscontextmanageraccesslevelcondition.yaml b/crds/accesscontextmanager_v1alpha1_accesscontextmanageraccesslevelcondition.yaml
index 10399427f4..095a5b54f2 100644
--- a/crds/accesscontextmanager_v1alpha1_accesscontextmanageraccesslevelcondition.yaml
+++ b/crds/accesscontextmanager_v1alpha1_accesscontextmanageraccesslevelcondition.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/accesscontextmanager_v1alpha1_accesscontextmanagergcpuseraccessbinding.yaml b/crds/accesscontextmanager_v1alpha1_accesscontextmanagergcpuseraccessbinding.yaml
index e227249287..4f62641d47 100644
--- a/crds/accesscontextmanager_v1alpha1_accesscontextmanagergcpuseraccessbinding.yaml
+++ b/crds/accesscontextmanager_v1alpha1_accesscontextmanagergcpuseraccessbinding.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/accesscontextmanager_v1beta1_accesscontextmanageraccesslevel.yaml b/crds/accesscontextmanager_v1beta1_accesscontextmanageraccesslevel.yaml
index 951b2dac83..e35aecde10 100644
--- a/crds/accesscontextmanager_v1beta1_accesscontextmanageraccesslevel.yaml
+++ b/crds/accesscontextmanager_v1beta1_accesscontextmanageraccesslevel.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/accesscontextmanager_v1beta1_accesscontextmanageraccesspolicy.yaml b/crds/accesscontextmanager_v1beta1_accesscontextmanageraccesspolicy.yaml
index 8eccec7512..5ca48b9a12 100644
--- a/crds/accesscontextmanager_v1beta1_accesscontextmanageraccesspolicy.yaml
+++ b/crds/accesscontextmanager_v1beta1_accesscontextmanageraccesspolicy.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/accesscontextmanager_v1beta1_accesscontextmanagerserviceperimeter.yaml b/crds/accesscontextmanager_v1beta1_accesscontextmanagerserviceperimeter.yaml
index 46f42ba577..2dd371573c 100644
--- a/crds/accesscontextmanager_v1beta1_accesscontextmanagerserviceperimeter.yaml
+++ b/crds/accesscontextmanager_v1beta1_accesscontextmanagerserviceperimeter.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/accesscontextmanager_v1beta1_accesscontextmanagerserviceperimeterresource.yaml b/crds/accesscontextmanager_v1beta1_accesscontextmanagerserviceperimeterresource.yaml
index a19100acf2..3ed9765ba3 100644
--- a/crds/accesscontextmanager_v1beta1_accesscontextmanagerserviceperimeterresource.yaml
+++ b/crds/accesscontextmanager_v1beta1_accesscontextmanagerserviceperimeterresource.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/alloydb_v1beta1_alloydbbackup.yaml b/crds/alloydb_v1beta1_alloydbbackup.yaml
index bda14ab38b..f5266ef8ca 100644
--- a/crds/alloydb_v1beta1_alloydbbackup.yaml
+++ b/crds/alloydb_v1beta1_alloydbbackup.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/alloydb_v1beta1_alloydbcluster.yaml b/crds/alloydb_v1beta1_alloydbcluster.yaml
index 6fadcdd3ba..7e02c54445 100644
--- a/crds/alloydb_v1beta1_alloydbcluster.yaml
+++ b/crds/alloydb_v1beta1_alloydbcluster.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/alloydb_v1beta1_alloydbinstance.yaml b/crds/alloydb_v1beta1_alloydbinstance.yaml
index 29d961e85d..e34c0c5493 100644
--- a/crds/alloydb_v1beta1_alloydbinstance.yaml
+++ b/crds/alloydb_v1beta1_alloydbinstance.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -30,6 +30,7 @@ spec:
     categories:
     - gcp
     kind: AlloyDBInstance
+    listKind: AlloyDBInstanceList
     plural: alloydbinstances
     shortNames:
     - gcpalloydbinstance
@@ -53,28 +54,25 @@ spec:
       jsonPath: .status.conditions[?(@.type=='Ready')].lastTransitionTime
       name: Status Age
       type: date
-    name: v1beta1
+    name: v1alpha1
     schema:
       openAPIV3Schema:
+        description: AlloyDBInstance is the Schema for the AlloyDBInstance API
         properties:
           apiVersion:
-            description: 'apiVersion defines the versioned schema of this representation
+            description: 'APIVersion defines the versioned schema of this representation
               of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources'
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
             type: string
           kind:
-            description: 'kind is a string value representing the REST resource this
+            description: 'Kind is a string value representing the REST resource this
               object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds'
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
             type: string
           metadata:
             type: object
           spec:
-            oneOf:
-            - required:
-              - instanceType
-            - required:
-              - instanceTypeRef
+            description: AlloyDBInstanceSpec defines the desired state of AlloyDBInstance
             properties:
               annotations:
                 additionalProperties:
@@ -84,14 +82,16 @@ spec:
                 type: object
               availabilityType:
                 description: |-
-                  'Availability type of an Instance. Defaults to REGIONAL for both primary and read instances.
-                  Note that primary and read instances can have different availability types.
-                  Only READ_POOL instance supports ZONAL type. Users can't specify the zone for READ_POOL instance.
-                  Zone is automatically chosen from the list of zones in the region specified.
-                  Read pool of size 1 can only have zonal availability. Read pools with node count of 2 or more
-                  can have regional availability (nodes are present in 2 or more zones in a region).' Possible values: ["AVAILABILITY_TYPE_UNSPECIFIED", "ZONAL", "REGIONAL"].
+                  Availability type of an Instance. If empty, defaults to REGIONAL for primary instances.
+
+                  For read pools, availabilityType is always UNSPECIFIED. Instances in the
+                  read pools are evenly distributed across available zones within the region
+                  (i.e. read pools with more than one node will have a node in at least two zones).
+                  Possible values: ["AVAILABILITY_TYPE_UNSPECIFIED", "ZONAL", "REGIONAL"].
                 type: string
               clusterRef:
+                description: The AlloyDBInstance cluster that this resource belongs
+                  to.
                 oneOf:
                 - not:
                     required:
@@ -108,14 +108,14 @@ spec:
                   - external
                 properties:
                   external:
-                    description: 'Allowed value: The `name` field of an `AlloyDBCluster`
-                      resource.'
+                    description: If provided must be in the format `projects/[projectId]/locations/[location]/clusters/[clusterId]`.
                     type: string
                   name:
-                    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
+                    description: The `metadata.name` field of a `AlloyDBCluster` resource.
                     type: string
                   namespace:
-                    description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
+                    description: The `metadata.namespace` field of a `AlloyDBCluster`
+                      resource.
                     type: string
                 type: object
               databaseFlags:
@@ -139,14 +139,15 @@ spec:
                   instance, instance is created in a random zone with available capacity.
                 type: string
               instanceType:
-                description: |-
-                  We recommend that you use `instanceTypeRef` instead.
-                  The type of the instance. Possible values: [PRIMARY, READ_POOL, SECONDARY]
+                description: 'Not recommended. We recommend that you use `instanceTypeRef`
+                  instead. The type of the instance. Possible values: [PRIMARY, READ_POOL,
+                  SECONDARY]'
                 type: string
               instanceTypeRef:
                 description: |-
                   The type of instance.
                   Possible values: ["PRIMARY", "READ_POOL", "SECONDARY"]
+
                   For PRIMARY and SECONDARY instances, set the value to refer to the name of the associated cluster.
                   This is recommended because the instance type of primary and secondary instances is tied to the cluster type of the associated cluster.
                   If the secondary cluster is promoted to primary cluster, then the associated secondary instance also becomes primary instance.
@@ -175,14 +176,15 @@ spec:
                   - external
                 properties:
                   external:
-                    description: 'Allowed value: The `clusterType` field of an `AlloyDBCluster`
-                      resource.'
+                    description: 'The type of instance. Possible values: ["PRIMARY",
+                      "READ_POOL", "SECONDARY"]'
                     type: string
                   name:
-                    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
+                    description: The `metadata.name` field of a `AlloyDBCluster` resource.
                     type: string
                   namespace:
-                    description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
+                    description: The `metadata.namespace` field of a `AlloyDBCluster`
+                      resource.
                     type: string
                 type: object
               machineConfig:
@@ -191,30 +193,32 @@ spec:
                 properties:
                   cpuCount:
                     description: The number of CPU's in the VM instance.
+                    format: int32
                     type: integer
                 type: object
               networkConfig:
                 description: Instance level network configuration.
                 properties:
                   authorizedExternalNetworks:
-                    description: A list of external networks authorized to access
-                      this instance. This field is only allowed to be set when 'enable_public_ip'
-                      is set to true.
+                    description: Optional. A list of external network authorized to
+                      access this instance. This field is only allowed to be set when
+                      'enablePublicIp' is set to true.
                     items:
                       properties:
                         cidrRange:
-                          description: CIDR range for one authorized network of the
+                          description: CIDR range for one authorzied network of the
                             instance.
                           type: string
                       type: object
                     type: array
                   enableOutboundPublicIp:
-                    description: Enabling outbound public ip for the instance.
+                    description: Optional. Enabling an outbound public IP address
+                      to support a database server sending requests out into the internet.
                     type: boolean
                   enablePublicIp:
-                    description: Enabling public ip for the instance. If a user wishes
-                      to disable this, please also clear the list of the authorized
-                      external networks set on the same instance.
+                    description: Optional. Enabling public ip for the instance. If
+                      a user wishes to disable this, please also clear the list of
+                      the authorized external networks set on the same instance.
                     type: boolean
                 type: object
               readPoolConfig:
@@ -224,21 +228,23 @@ spec:
                   nodeCount:
                     description: Read capacity, i.e. number of nodes in a read pool
                       instance.
+                    format: int32
                     type: integer
                 type: object
               resourceID:
-                description: Immutable. Optional. The instanceId of the resource.
-                  Used for creation and acquisition. When unset, the value of `metadata.name`
-                  is used as the default.
+                description: Optional. The instanceId of the resource. If not given,
+                  the metadata.name will be used.
                 type: string
             required:
             - clusterRef
             type: object
           status:
+            description: AlloyDBInstanceStatus defines the config connector machine
+              state of AlloyDBInstance
             properties:
               conditions:
-                description: Conditions represent the latest available observation
-                  of the resource's current state.
+                description: Conditions represent the latest available observations
+                  of the object's current state.
                 items:
                   properties:
                     lastTransitionTime:
@@ -265,6 +271,10 @@ spec:
               createTime:
                 description: Time the Instance was created in UTC.
                 type: string
+              externalRef:
+                description: A unique specifier for the AlloyDBInstance resource in
+                  GCP.
+                type: string
               ipAddress:
                 description: The IP address for the Instance. This is the connection
                   endpoint for an end-user application.
@@ -278,12 +288,12 @@ spec:
                   If this is equal to metadata.generation, then that means that the
                   current reported status reflects the most recent desired state of
                   the resource.
+                format: int64
                 type: integer
               outboundPublicIpAddresses:
-                description: |-
-                  The outbound public IP addresses for the instance. This is available ONLY when
-                  networkConfig.enableOutboundPublicIp is set to true. These IP addresses are used
-                  for outbound connections.
+                description: The outbound public IP addresses for the instance. This
+                  is available ONLY when networkConfig.enableOutboundPublicIp is set
+                  to true. These IP addresses are used for outbound connections.
                 items:
                   type: string
                 type: array
@@ -312,7 +322,7 @@ spec:
         - spec
         type: object
     served: true
-    storage: false
+    storage: true
     subresources:
       status: {}
   - additionalPrinterColumns:
@@ -331,28 +341,25 @@ spec:
       jsonPath: .status.conditions[?(@.type=='Ready')].lastTransitionTime
       name: Status Age
       type: date
-    name: v1alpha1
+    name: v1beta1
     schema:
       openAPIV3Schema:
+        description: AlloyDBInstance is the Schema for the AlloyDBInstance API
         properties:
           apiVersion:
-            description: 'apiVersion defines the versioned schema of this representation
+            description: 'APIVersion defines the versioned schema of this representation
               of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources'
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
             type: string
           kind:
-            description: 'kind is a string value representing the REST resource this
+            description: 'Kind is a string value representing the REST resource this
               object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds'
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
             type: string
           metadata:
             type: object
           spec:
-            oneOf:
-            - required:
-              - instanceType
-            - required:
-              - instanceTypeRef
+            description: AlloyDBInstanceSpec defines the desired state of AlloyDBInstance
             properties:
               annotations:
                 additionalProperties:
@@ -362,14 +369,16 @@ spec:
                 type: object
               availabilityType:
                 description: |-
-                  'Availability type of an Instance. Defaults to REGIONAL for both primary and read instances.
-                  Note that primary and read instances can have different availability types.
-                  Only READ_POOL instance supports ZONAL type. Users can't specify the zone for READ_POOL instance.
-                  Zone is automatically chosen from the list of zones in the region specified.
-                  Read pool of size 1 can only have zonal availability. Read pools with node count of 2 or more
-                  can have regional availability (nodes are present in 2 or more zones in a region).' Possible values: ["AVAILABILITY_TYPE_UNSPECIFIED", "ZONAL", "REGIONAL"].
+                  Availability type of an Instance. If empty, defaults to REGIONAL for primary instances.
+
+                  For read pools, availabilityType is always UNSPECIFIED. Instances in the
+                  read pools are evenly distributed across available zones within the region
+                  (i.e. read pools with more than one node will have a node in at least two zones).
+                  Possible values: ["AVAILABILITY_TYPE_UNSPECIFIED", "ZONAL", "REGIONAL"].
                 type: string
               clusterRef:
+                description: The AlloyDBInstance cluster that this resource belongs
+                  to.
                 oneOf:
                 - not:
                     required:
@@ -386,14 +395,14 @@ spec:
                   - external
                 properties:
                   external:
-                    description: 'Allowed value: The `name` field of an `AlloyDBCluster`
-                      resource.'
+                    description: If provided must be in the format `projects/[projectId]/locations/[location]/clusters/[clusterId]`.
                     type: string
                   name:
-                    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
+                    description: The `metadata.name` field of a `AlloyDBCluster` resource.
                     type: string
                   namespace:
-                    description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
+                    description: The `metadata.namespace` field of a `AlloyDBCluster`
+                      resource.
                     type: string
                 type: object
               databaseFlags:
@@ -417,14 +426,15 @@ spec:
                   instance, instance is created in a random zone with available capacity.
                 type: string
               instanceType:
-                description: |-
-                  We recommend that you use `instanceTypeRef` instead.
-                  The type of the instance. Possible values: [PRIMARY, READ_POOL, SECONDARY]
+                description: 'Not recommended. We recommend that you use `instanceTypeRef`
+                  instead. The type of the instance. Possible values: [PRIMARY, READ_POOL,
+                  SECONDARY]'
                 type: string
               instanceTypeRef:
                 description: |-
                   The type of instance.
                   Possible values: ["PRIMARY", "READ_POOL", "SECONDARY"]
+
                   For PRIMARY and SECONDARY instances, set the value to refer to the name of the associated cluster.
                   This is recommended because the instance type of primary and secondary instances is tied to the cluster type of the associated cluster.
                   If the secondary cluster is promoted to primary cluster, then the associated secondary instance also becomes primary instance.
@@ -453,14 +463,15 @@ spec:
                   - external
                 properties:
                   external:
-                    description: 'Allowed value: The `clusterType` field of an `AlloyDBCluster`
-                      resource.'
+                    description: 'The type of instance. Possible values: ["PRIMARY",
+                      "READ_POOL", "SECONDARY"]'
                     type: string
                   name:
-                    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
+                    description: The `metadata.name` field of a `AlloyDBCluster` resource.
                     type: string
                   namespace:
-                    description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
+                    description: The `metadata.namespace` field of a `AlloyDBCluster`
+                      resource.
                     type: string
                 type: object
               machineConfig:
@@ -469,30 +480,32 @@ spec:
                 properties:
                   cpuCount:
                     description: The number of CPU's in the VM instance.
+                    format: int32
                     type: integer
                 type: object
               networkConfig:
                 description: Instance level network configuration.
                 properties:
                   authorizedExternalNetworks:
-                    description: A list of external networks authorized to access
-                      this instance. This field is only allowed to be set when 'enable_public_ip'
-                      is set to true.
+                    description: Optional. A list of external network authorized to
+                      access this instance. This field is only allowed to be set when
+                      'enablePublicIp' is set to true.
                     items:
                       properties:
                         cidrRange:
-                          description: CIDR range for one authorized network of the
+                          description: CIDR range for one authorzied network of the
                             instance.
                           type: string
                       type: object
                     type: array
                   enableOutboundPublicIp:
-                    description: Enabling outbound public ip for the instance.
+                    description: Optional. Enabling an outbound public IP address
+                      to support a database server sending requests out into the internet.
                     type: boolean
                   enablePublicIp:
-                    description: Enabling public ip for the instance. If a user wishes
-                      to disable this, please also clear the list of the authorized
-                      external networks set on the same instance.
+                    description: Optional. Enabling public ip for the instance. If
+                      a user wishes to disable this, please also clear the list of
+                      the authorized external networks set on the same instance.
                     type: boolean
                 type: object
               readPoolConfig:
@@ -502,21 +515,23 @@ spec:
                   nodeCount:
                     description: Read capacity, i.e. number of nodes in a read pool
                       instance.
+                    format: int32
                     type: integer
                 type: object
               resourceID:
-                description: Immutable. Optional. The instanceId of the resource.
-                  Used for creation and acquisition. When unset, the value of `metadata.name`
-                  is used as the default.
+                description: Optional. The instanceId of the resource. If not given,
+                  the metadata.name will be used.
                 type: string
             required:
             - clusterRef
             type: object
           status:
+            description: AlloyDBInstanceStatus defines the config connector machine
+              state of AlloyDBInstance
             properties:
               conditions:
-                description: Conditions represent the latest available observation
-                  of the resource's current state.
+                description: Conditions represent the latest available observations
+                  of the object's current state.
                 items:
                   properties:
                     lastTransitionTime:
@@ -543,6 +558,10 @@ spec:
               createTime:
                 description: Time the Instance was created in UTC.
                 type: string
+              externalRef:
+                description: A unique specifier for the AlloyDBInstance resource in
+                  GCP.
+                type: string
               ipAddress:
                 description: The IP address for the Instance. This is the connection
                   endpoint for an end-user application.
@@ -556,12 +575,12 @@ spec:
                   If this is equal to metadata.generation, then that means that the
                   current reported status reflects the most recent desired state of
                   the resource.
+                format: int64
                 type: integer
               outboundPublicIpAddresses:
-                description: |-
-                  The outbound public IP addresses for the instance. This is available ONLY when
-                  networkConfig.enableOutboundPublicIp is set to true. These IP addresses are used
-                  for outbound connections.
+                description: The outbound public IP addresses for the instance. This
+                  is available ONLY when networkConfig.enableOutboundPublicIp is set
+                  to true. These IP addresses are used for outbound connections.
                 items:
                   type: string
                 type: array
@@ -590,12 +609,12 @@ spec:
         - spec
         type: object
     served: true
-    storage: true
+    storage: false
     subresources:
       status: {}
 status:
   acceptedNames:
     kind: ""
     plural: ""
-  conditions: []
-  storedVersions: []
+  conditions: null
+  storedVersions: null
diff --git a/crds/alloydb_v1beta1_alloydbuser.yaml b/crds/alloydb_v1beta1_alloydbuser.yaml
index 985bb06510..545b5e5602 100644
--- a/crds/alloydb_v1beta1_alloydbuser.yaml
+++ b/crds/alloydb_v1beta1_alloydbuser.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/apigateway_v1alpha1_apigatewayapi.yaml b/crds/apigateway_v1alpha1_apigatewayapi.yaml
index f0d620c975..38ac60d754 100644
--- a/crds/apigateway_v1alpha1_apigatewayapi.yaml
+++ b/crds/apigateway_v1alpha1_apigatewayapi.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/apigateway_v1alpha1_apigatewayapiconfig.yaml b/crds/apigateway_v1alpha1_apigatewayapiconfig.yaml
index 80dfe0e251..36bcf4e83c 100644
--- a/crds/apigateway_v1alpha1_apigatewayapiconfig.yaml
+++ b/crds/apigateway_v1alpha1_apigatewayapiconfig.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/apigateway_v1alpha1_apigatewaygateway.yaml b/crds/apigateway_v1alpha1_apigatewaygateway.yaml
index 4c87d31b94..83d13c399c 100644
--- a/crds/apigateway_v1alpha1_apigatewaygateway.yaml
+++ b/crds/apigateway_v1alpha1_apigatewaygateway.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/apigee_v1alpha1_apigeeaddonsconfig.yaml b/crds/apigee_v1alpha1_apigeeaddonsconfig.yaml
index c8dceb1bbb..1600c54e56 100644
--- a/crds/apigee_v1alpha1_apigeeaddonsconfig.yaml
+++ b/crds/apigee_v1alpha1_apigeeaddonsconfig.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/apigee_v1alpha1_apigeeendpointattachment.yaml b/crds/apigee_v1alpha1_apigeeendpointattachment.yaml
index eaea528b40..0c878c0ccc 100644
--- a/crds/apigee_v1alpha1_apigeeendpointattachment.yaml
+++ b/crds/apigee_v1alpha1_apigeeendpointattachment.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/apigee_v1alpha1_apigeeenvgroup.yaml b/crds/apigee_v1alpha1_apigeeenvgroup.yaml
deleted file mode 100644
index 0248ff96f0..0000000000
--- a/crds/apigee_v1alpha1_apigeeenvgroup.yaml
+++ /dev/null
@@ -1,140 +0,0 @@
-# Copyright 2020 Google LLC
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    cnrm.cloud.google.com/version: 1.125.0
-  creationTimestamp: null
-  labels:
-    cnrm.cloud.google.com/managed-by-kcc: "true"
-    cnrm.cloud.google.com/stability-level: alpha
-    cnrm.cloud.google.com/system: "true"
-    cnrm.cloud.google.com/tf2crd: "true"
-  name: apigeeenvgroups.apigee.cnrm.cloud.google.com
-spec:
-  group: apigee.cnrm.cloud.google.com
-  names:
-    categories:
-    - gcp
-    kind: ApigeeEnvgroup
-    plural: apigeeenvgroups
-    shortNames:
-    - gcpapigeeenvgroup
-    - gcpapigeeenvgroups
-    singular: apigeeenvgroup
-  scope: Namespaced
-  versions:
-  - additionalPrinterColumns:
-    - jsonPath: .metadata.creationTimestamp
-      name: Age
-      type: date
-    - description: When 'True', the most recent reconcile of the resource succeeded
-      jsonPath: .status.conditions[?(@.type=='Ready')].status
-      name: Ready
-      type: string
-    - description: The reason for the value in 'Ready'
-      jsonPath: .status.conditions[?(@.type=='Ready')].reason
-      name: Status
-      type: string
-    - description: The last transition time for the value in 'Status'
-      jsonPath: .status.conditions[?(@.type=='Ready')].lastTransitionTime
-      name: Status Age
-      type: date
-    name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        properties:
-          apiVersion:
-            description: 'apiVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            properties:
-              hostnames:
-                description: Hostnames of the environment group.
-                items:
-                  type: string
-                type: array
-              orgId:
-                description: |-
-                  Immutable. The Apigee Organization associated with the Apigee environment group,
-                  in the format 'organizations/{{org_name}}'.
-                type: string
-              resourceID:
-                description: Immutable. Optional. The name of the resource. Used for
-                  creation and acquisition. When unset, the value of `metadata.name`
-                  is used as the default.
-                type: string
-            required:
-            - orgId
-            type: object
-          status:
-            properties:
-              conditions:
-                description: Conditions represent the latest available observation
-                  of the resource's current state.
-                items:
-                  properties:
-                    lastTransitionTime:
-                      description: Last time the condition transitioned from one status
-                        to another.
-                      type: string
-                    message:
-                      description: Human-readable message indicating details about
-                        last transition.
-                      type: string
-                    reason:
-                      description: Unique, one-word, CamelCase reason for the condition's
-                        last transition.
-                      type: string
-                    status:
-                      description: Status is the status of the condition. Can be True,
-                        False, Unknown.
-                      type: string
-                    type:
-                      description: Type is the type of the condition.
-                      type: string
-                  type: object
-                type: array
-              observedGeneration:
-                description: ObservedGeneration is the generation of the resource
-                  that was most recently observed by the Config Connector controller.
-                  If this is equal to metadata.generation, then that means that the
-                  current reported status reflects the most recent desired state of
-                  the resource.
-                type: integer
-            type: object
-        required:
-        - spec
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []
diff --git a/crds/apigee_v1alpha1_apigeeenvgroupattachment.yaml b/crds/apigee_v1alpha1_apigeeenvgroupattachment.yaml
index dd62c1022b..9f501a85e1 100644
--- a/crds/apigee_v1alpha1_apigeeenvgroupattachment.yaml
+++ b/crds/apigee_v1alpha1_apigeeenvgroupattachment.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/apigee_v1alpha1_apigeeinstance.yaml b/crds/apigee_v1alpha1_apigeeinstance.yaml
index 90d38be6f4..c0fe488004 100644
--- a/crds/apigee_v1alpha1_apigeeinstance.yaml
+++ b/crds/apigee_v1alpha1_apigeeinstance.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/apigee_v1alpha1_apigeeinstanceattachment.yaml b/crds/apigee_v1alpha1_apigeeinstanceattachment.yaml
index 251a51f0c5..b25c4000ff 100644
--- a/crds/apigee_v1alpha1_apigeeinstanceattachment.yaml
+++ b/crds/apigee_v1alpha1_apigeeinstanceattachment.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/apigee_v1alpha1_apigeenataddress.yaml b/crds/apigee_v1alpha1_apigeenataddress.yaml
index 9949af8366..c9030cf368 100644
--- a/crds/apigee_v1alpha1_apigeenataddress.yaml
+++ b/crds/apigee_v1alpha1_apigeenataddress.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/apigee_v1alpha1_apigeesyncauthorization.yaml b/crds/apigee_v1alpha1_apigeesyncauthorization.yaml
index d360ccb326..fc34d078e4 100644
--- a/crds/apigee_v1alpha1_apigeesyncauthorization.yaml
+++ b/crds/apigee_v1alpha1_apigeesyncauthorization.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/apigee_v1beta1_apigeeenvgroup.yaml b/crds/apigee_v1beta1_apigeeenvgroup.yaml
new file mode 100644
index 0000000000..f16b5fffcf
--- /dev/null
+++ b/crds/apigee_v1beta1_apigeeenvgroup.yaml
@@ -0,0 +1,340 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    cnrm.cloud.google.com/version: 1.128.0
+  creationTimestamp: null
+  labels:
+    cnrm.cloud.google.com/managed-by-kcc: "true"
+    cnrm.cloud.google.com/system: "true"
+  name: apigeeenvgroups.apigee.cnrm.cloud.google.com
+spec:
+  group: apigee.cnrm.cloud.google.com
+  names:
+    categories:
+    - gcp
+    kind: ApigeeEnvgroup
+    listKind: ApigeeEnvgroupList
+    plural: apigeeenvgroups
+    shortNames:
+    - gcpapigeeenvgroup
+    - gcpapigeeenvgroups
+    singular: apigeeenvgroup
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    - description: When 'True', the most recent reconcile of the resource succeeded
+      jsonPath: .status.conditions[?(@.type=='Ready')].status
+      name: Ready
+      type: string
+    - description: The reason for the value in 'Ready'
+      jsonPath: .status.conditions[?(@.type=='Ready')].reason
+      name: Status
+      type: string
+    - description: The last transition time for the value in 'Status'
+      jsonPath: .status.conditions[?(@.type=='Ready')].lastTransitionTime
+      name: Status Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: ApigeeEnvgroup is the Schema for the ApigeeEnvgroup API
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: ApigeeEnvgroupSpec defines the desired state of ApigeeEnvgroup
+            properties:
+              hostnames:
+                description: Host names for this environment group.
+                items:
+                  type: string
+                type: array
+              organizationRef:
+                oneOf:
+                - not:
+                    required:
+                    - external
+                  required:
+                  - name
+                - not:
+                    anyOf:
+                    - required:
+                      - name
+                    - required:
+                      - namespace
+                  required:
+                  - external
+                properties:
+                  external:
+                    description: The ApigeeOrganization selfLink, when not managed
+                      by Config Connector.
+                    type: string
+                  name:
+                    description: The `name` field of an `ApigeeOrganization` resource.
+                    type: string
+                  namespace:
+                    description: The `namespace` field of an `ApigeeOrganization`
+                      resource.
+                    type: string
+                type: object
+              resourceID:
+                description: The ApigeeEnvgroup name. If not given, the metadata.name
+                  will be used.
+                type: string
+            required:
+            - organizationRef
+            type: object
+          status:
+            description: ApigeeEnvgroupStatus defines the config connector machine
+              state of ApigeeEnvgroup
+            properties:
+              conditions:
+                description: Conditions represent the latest available observations
+                  of the object's current state.
+                items:
+                  properties:
+                    lastTransitionTime:
+                      description: Last time the condition transitioned from one status
+                        to another.
+                      type: string
+                    message:
+                      description: Human-readable message indicating details about
+                        last transition.
+                      type: string
+                    reason:
+                      description: Unique, one-word, CamelCase reason for the condition's
+                        last transition.
+                      type: string
+                    status:
+                      description: Status is the status of the condition. Can be True,
+                        False, Unknown.
+                      type: string
+                    type:
+                      description: Type is the type of the condition.
+                      type: string
+                  type: object
+                type: array
+              externalRef:
+                description: A unique specifier for the ApigeeEnvgroup resource in
+                  GCP.
+                type: string
+              observedGeneration:
+                description: ObservedGeneration is the generation of the resource
+                  that was most recently observed by the Config Connector controller.
+                  If this is equal to metadata.generation, then that means that the
+                  current reported status reflects the most recent desired state of
+                  the resource.
+                format: int64
+                type: integer
+              observedState:
+                description: ObservedState is the state of the resource as most recently
+                  observed in GCP.
+                properties:
+                  createdAt:
+                    description: Output only. The time at which the environment group
+                      was created as milliseconds since epoch.
+                    format: int64
+                    type: integer
+                  lastModifiedAt:
+                    description: Output only. The time at which the environment group
+                      was last updated as milliseconds since epoch.
+                    format: int64
+                    type: integer
+                  name:
+                    description: ID of the environment group.
+                    type: string
+                  state:
+                    description: Output only. State of the environment group. Values
+                      other than ACTIVE means the resource is not ready to use.
+                    type: string
+                type: object
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: false
+    subresources:
+      status: {}
+  - additionalPrinterColumns:
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    - description: When 'True', the most recent reconcile of the resource succeeded
+      jsonPath: .status.conditions[?(@.type=='Ready')].status
+      name: Ready
+      type: string
+    - description: The reason for the value in 'Ready'
+      jsonPath: .status.conditions[?(@.type=='Ready')].reason
+      name: Status
+      type: string
+    - description: The last transition time for the value in 'Status'
+      jsonPath: .status.conditions[?(@.type=='Ready')].lastTransitionTime
+      name: Status Age
+      type: date
+    name: v1beta1
+    schema:
+      openAPIV3Schema:
+        description: ApigeeEnvgroup is the Schema for the ApigeeEnvgroup API
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: ApigeeEnvgroupSpec defines the desired state of ApigeeEnvgroup
+            properties:
+              hostnames:
+                description: Host names for this environment group.
+                items:
+                  type: string
+                type: array
+              organizationRef:
+                oneOf:
+                - not:
+                    required:
+                    - external
+                  required:
+                  - name
+                - not:
+                    anyOf:
+                    - required:
+                      - name
+                    - required:
+                      - namespace
+                  required:
+                  - external
+                properties:
+                  external:
+                    description: The ApigeeOrganization selfLink, when not managed
+                      by Config Connector.
+                    type: string
+                  name:
+                    description: The `name` field of an `ApigeeOrganization` resource.
+                    type: string
+                  namespace:
+                    description: The `namespace` field of an `ApigeeOrganization`
+                      resource.
+                    type: string
+                type: object
+              resourceID:
+                description: The ApigeeEnvgroup name. If not given, the metadata.name
+                  will be used.
+                type: string
+            required:
+            - organizationRef
+            type: object
+          status:
+            description: ApigeeEnvgroupStatus defines the config connector machine
+              state of ApigeeEnvgroup
+            properties:
+              conditions:
+                description: Conditions represent the latest available observations
+                  of the object's current state.
+                items:
+                  properties:
+                    lastTransitionTime:
+                      description: Last time the condition transitioned from one status
+                        to another.
+                      type: string
+                    message:
+                      description: Human-readable message indicating details about
+                        last transition.
+                      type: string
+                    reason:
+                      description: Unique, one-word, CamelCase reason for the condition's
+                        last transition.
+                      type: string
+                    status:
+                      description: Status is the status of the condition. Can be True,
+                        False, Unknown.
+                      type: string
+                    type:
+                      description: Type is the type of the condition.
+                      type: string
+                  type: object
+                type: array
+              externalRef:
+                description: A unique specifier for the ApigeeEnvgroup resource in
+                  GCP.
+                type: string
+              observedGeneration:
+                description: ObservedGeneration is the generation of the resource
+                  that was most recently observed by the Config Connector controller.
+                  If this is equal to metadata.generation, then that means that the
+                  current reported status reflects the most recent desired state of
+                  the resource.
+                format: int64
+                type: integer
+              observedState:
+                description: ObservedState is the state of the resource as most recently
+                  observed in GCP.
+                properties:
+                  createdAt:
+                    description: Output only. The time at which the environment group
+                      was created as milliseconds since epoch.
+                    format: int64
+                    type: integer
+                  lastModifiedAt:
+                    description: Output only. The time at which the environment group
+                      was last updated as milliseconds since epoch.
+                    format: int64
+                    type: integer
+                  name:
+                    description: ID of the environment group.
+                    type: string
+                  state:
+                    description: Output only. State of the environment group. Values
+                      other than ACTIVE means the resource is not ready to use.
+                    type: string
+                type: object
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: null
+  storedVersions: null
diff --git a/crds/apigee_v1beta1_apigeeenvironment.yaml b/crds/apigee_v1beta1_apigeeenvironment.yaml
index 9a1ad97126..eb168aef26 100644
--- a/crds/apigee_v1beta1_apigeeenvironment.yaml
+++ b/crds/apigee_v1beta1_apigeeenvironment.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/apigee_v1beta1_apigeeorganization.yaml b/crds/apigee_v1beta1_apigeeorganization.yaml
index aa40f157f4..672f6cd247 100644
--- a/crds/apigee_v1beta1_apigeeorganization.yaml
+++ b/crds/apigee_v1beta1_apigeeorganization.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/apikeys_v1alpha1_apikeyskey.yaml b/crds/apikeys_v1alpha1_apikeyskey.yaml
index 0adfd6b2e0..1ed6371eef 100644
--- a/crds/apikeys_v1alpha1_apikeyskey.yaml
+++ b/crds/apikeys_v1alpha1_apikeyskey.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/appengine_v1alpha1_appenginedomainmapping.yaml b/crds/appengine_v1alpha1_appenginedomainmapping.yaml
index 1e79ba0afe..4dcc458455 100644
--- a/crds/appengine_v1alpha1_appenginedomainmapping.yaml
+++ b/crds/appengine_v1alpha1_appenginedomainmapping.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/appengine_v1alpha1_appenginefirewallrule.yaml b/crds/appengine_v1alpha1_appenginefirewallrule.yaml
index 86d181fc48..9628cc534f 100644
--- a/crds/appengine_v1alpha1_appenginefirewallrule.yaml
+++ b/crds/appengine_v1alpha1_appenginefirewallrule.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/appengine_v1alpha1_appengineflexibleappversion.yaml b/crds/appengine_v1alpha1_appengineflexibleappversion.yaml
index 2be0946de4..f887219403 100644
--- a/crds/appengine_v1alpha1_appengineflexibleappversion.yaml
+++ b/crds/appengine_v1alpha1_appengineflexibleappversion.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/appengine_v1alpha1_appengineservicesplittraffic.yaml b/crds/appengine_v1alpha1_appengineservicesplittraffic.yaml
index fe1073e48f..d08a9522aa 100644
--- a/crds/appengine_v1alpha1_appengineservicesplittraffic.yaml
+++ b/crds/appengine_v1alpha1_appengineservicesplittraffic.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/appengine_v1alpha1_appenginestandardappversion.yaml b/crds/appengine_v1alpha1_appenginestandardappversion.yaml
index 71edc71943..646a6bc4fb 100644
--- a/crds/appengine_v1alpha1_appenginestandardappversion.yaml
+++ b/crds/appengine_v1alpha1_appenginestandardappversion.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/artifactregistry_v1beta1_artifactregistryrepository.yaml b/crds/artifactregistry_v1beta1_artifactregistryrepository.yaml
index b978551030..4d8e481ff6 100644
--- a/crds/artifactregistry_v1beta1_artifactregistryrepository.yaml
+++ b/crds/artifactregistry_v1beta1_artifactregistryrepository.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -155,8 +155,8 @@ spec:
                 type: object
               format:
                 description: |-
-                  Immutable. The format of packages that are stored in the repository. See
-                  [Supported formats](https://cloud.google.com/artifact-registry/docs/supported-formats).
+                  Immutable. The format of packages that are stored in the repository. Supported formats
+                  can be found [here](https://cloud.google.com/artifact-registry/docs/supported-formats).
                   You can only create alpha formats if you are a member of the
                   [alpha user group](https://cloud.google.com/artifact-registry/docs/supported-formats#alpha-access).
                 type: string
diff --git a/crds/beyondcorp_v1alpha1_beyondcorpappconnection.yaml b/crds/beyondcorp_v1alpha1_beyondcorpappconnection.yaml
index 625754e888..a9c452d68f 100644
--- a/crds/beyondcorp_v1alpha1_beyondcorpappconnection.yaml
+++ b/crds/beyondcorp_v1alpha1_beyondcorpappconnection.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/beyondcorp_v1alpha1_beyondcorpappconnector.yaml b/crds/beyondcorp_v1alpha1_beyondcorpappconnector.yaml
index 5dd0c14564..9b84a955e0 100644
--- a/crds/beyondcorp_v1alpha1_beyondcorpappconnector.yaml
+++ b/crds/beyondcorp_v1alpha1_beyondcorpappconnector.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/beyondcorp_v1alpha1_beyondcorpappgateway.yaml b/crds/beyondcorp_v1alpha1_beyondcorpappgateway.yaml
index c91fabf618..e3bd12937f 100644
--- a/crds/beyondcorp_v1alpha1_beyondcorpappgateway.yaml
+++ b/crds/beyondcorp_v1alpha1_beyondcorpappgateway.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/bigquery_v1alpha1_bigquerydatasetaccess.yaml b/crds/bigquery_v1alpha1_bigquerydatasetaccess.yaml
index c612c5a8eb..4f35d709f6 100644
--- a/crds/bigquery_v1alpha1_bigquerydatasetaccess.yaml
+++ b/crds/bigquery_v1alpha1_bigquerydatasetaccess.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -217,7 +217,7 @@ spec:
           status:
             properties:
               apiUpdatedMember:
-                description: If true, represents that the iam_member in the config
+                description: If true, represents that that the iam_member in the config
                   was translated to a different member type by the API, and is stored
                   in state as a different member type.
                 type: boolean
diff --git a/crds/bigquery_v1beta1_bigquerydataset.yaml b/crds/bigquery_v1beta1_bigquerydataset.yaml
index 4b1c36a5af..9768494a4d 100644
--- a/crds/bigquery_v1beta1_bigquerydataset.yaml
+++ b/crds/bigquery_v1beta1_bigquerydataset.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/bigquery_v1beta1_bigqueryjob.yaml b/crds/bigquery_v1beta1_bigqueryjob.yaml
index 506709af2b..ca6352fa6b 100644
--- a/crds/bigquery_v1beta1_bigqueryjob.yaml
+++ b/crds/bigquery_v1beta1_bigqueryjob.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -441,7 +441,7 @@ spec:
                   projectionFields:
                     description: |-
                       Immutable. If sourceFormat is set to "DATASTORE_BACKUP", indicates which entity properties to load into BigQuery from a Cloud Datastore backup.
-                      Property names are case-sensitive and must be top-level properties. If no properties are specified, BigQuery loads all properties.
+                      Property names are case sensitive and must be top-level properties. If no properties are specified, BigQuery loads all properties.
                       If any named property isn't found in the Cloud Datastore backup, an invalid error is returned in the job result.
                     items:
                       type: string
diff --git a/crds/bigquery_v1beta1_bigqueryroutine.yaml b/crds/bigquery_v1beta1_bigqueryroutine.yaml
index e0255be863..82676b2830 100644
--- a/crds/bigquery_v1beta1_bigqueryroutine.yaml
+++ b/crds/bigquery_v1beta1_bigqueryroutine.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/bigquery_v1beta1_bigquerytable.yaml b/crds/bigquery_v1beta1_bigquerytable.yaml
index f86412d57e..cedf6486ef 100644
--- a/crds/bigquery_v1beta1_bigquerytable.yaml
+++ b/crds/bigquery_v1beta1_bigquerytable.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/bigqueryanalyticshub_v1alpha1_bigqueryanalyticshublisting.yaml b/crds/bigqueryanalyticshub_v1alpha1_bigqueryanalyticshublisting.yaml
deleted file mode 100644
index e9db70631c..0000000000
--- a/crds/bigqueryanalyticshub_v1alpha1_bigqueryanalyticshublisting.yaml
+++ /dev/null
@@ -1,350 +0,0 @@
-# Copyright 2020 Google LLC
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    cnrm.cloud.google.com/version: 1.125.0
-  creationTimestamp: null
-  labels:
-    cnrm.cloud.google.com/managed-by-kcc: "true"
-    cnrm.cloud.google.com/system: "true"
-  name: bigqueryanalyticshublistings.bigqueryanalyticshub.cnrm.cloud.google.com
-spec:
-  group: bigqueryanalyticshub.cnrm.cloud.google.com
-  names:
-    categories:
-    - gcp
-    kind: BigQueryAnalyticsHubListing
-    listKind: BigQueryAnalyticsHubListingList
-    plural: bigqueryanalyticshublistings
-    singular: bigqueryanalyticshublisting
-  scope: Namespaced
-  versions:
-  - additionalPrinterColumns:
-    - jsonPath: .metadata.creationTimestamp
-      name: Age
-      type: date
-    - description: When 'True', the most recent reconcile of the resource succeeded
-      jsonPath: .status.conditions[?(@.type=='Ready')].status
-      name: Ready
-      type: string
-    - description: The reason for the value in 'Ready'
-      jsonPath: .status.conditions[?(@.type=='Ready')].reason
-      name: Status
-      type: string
-    - description: The last transition time for the value in 'Status'
-      jsonPath: .status.conditions[?(@.type=='Ready')].lastTransitionTime
-      name: Status Age
-      type: date
-    name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: BigQueryAnalyticsHubListing is the Schema for the BigQueryAnalyticsHubListing
-          API
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: BigQueryAnalyticsHubListingSpec defines the desired state
-              of BigQueryAnalyticsHubDataExchangeListing
-            properties:
-              categories:
-                description: Optional. Categories of the listing. Up to two categories
-                  are allowed.
-                items:
-                  type: string
-                type: array
-              dataExchangeRef:
-                oneOf:
-                - not:
-                    required:
-                    - external
-                  required:
-                  - name
-                - not:
-                    anyOf:
-                    - required:
-                      - name
-                    - required:
-                      - namespace
-                  required:
-                  - external
-                properties:
-                  external:
-                    description: The DataExchange selfLink, when not managed by Config
-                      Connector.
-                    type: string
-                  name:
-                    description: The `name` field of a `DataExchange` resource.
-                    type: string
-                  namespace:
-                    description: The `namespace` field of a `DataExchange` resource.
-                    type: string
-                type: object
-              dataProvider:
-                description: Optional. Details of the data provider who owns the source
-                  data.
-                properties:
-                  name:
-                    description: Optional. Name of the data provider.
-                    type: string
-                  primaryContact:
-                    description: 'Optional. Email or URL of the data provider. Max
-                      Length: 1000 bytes.'
-                    type: string
-                type: object
-              description:
-                description: 'Optional. Short description of the listing. The description
-                  must contain only Unicode characters or tabs  (HT), new lines (LF),
-                  carriage returns (CR), and page breaks (FF). Default value is an
-                  empty string. Max length: 2000 bytes.'
-                type: string
-              discoveryType:
-                description: Optional. Type of discovery of the listing on the discovery
-                  page.
-                type: string
-              displayName:
-                description: 'Required. Human-readable display name of the listing.
-                  The display name must contain only Unicode letters, numbers (0-9),
-                  underscores (_), dashes (-), spaces ( ), ampersands (&) and can''t
-                  start or end with spaces. Default value is an empty string. Max
-                  length: 63 bytes.'
-                type: string
-              documentation:
-                description: Optional. Documentation describing the listing.
-                type: string
-              location:
-                description: Immutable. The name of the location this data exchange.
-                type: string
-              primaryContact:
-                description: 'Optional. Email or URL of the primary point of contact
-                  of the listing. Max Length: 1000 bytes.'
-                type: string
-              projectRef:
-                description: The Project that this resource belongs to.
-                oneOf:
-                - not:
-                    required:
-                    - external
-                  required:
-                  - name
-                - not:
-                    anyOf:
-                    - required:
-                      - name
-                    - required:
-                      - namespace
-                  required:
-                  - external
-                properties:
-                  external:
-                    description: The `projectID` field of a project, when not managed
-                      by Config Connector.
-                    type: string
-                  kind:
-                    description: The kind of the Project resource; optional but must
-                      be `Project` if provided.
-                    type: string
-                  name:
-                    description: The `name` field of a `Project` resource.
-                    type: string
-                  namespace:
-                    description: The `namespace` field of a `Project` resource.
-                    type: string
-                type: object
-              publisher:
-                description: Optional. Details of the publisher who owns the listing
-                  and who can share the source data.
-                properties:
-                  name:
-                    description: Optional. Name of the listing publisher.
-                    type: string
-                  primaryContact:
-                    description: 'Optional. Email or URL of the listing publisher.
-                      Max Length: 1000 bytes.'
-                    type: string
-                type: object
-              requestAccess:
-                description: 'Optional. Email or URL of the request access of the
-                  listing. Subscribers can use this reference to request access. Max
-                  Length: 1000 bytes.'
-                type: string
-              resourceID:
-                description: Immutable. The BigQueryAnalyticsHubDataExchangeListing
-                  name. If not given, the metadata.name will be used.
-                type: string
-                x-kubernetes-validations:
-                - message: ResourceID field is immutable
-                  rule: self == oldSelf
-              source:
-                properties:
-                  bigQueryDatasetSource:
-                    description: One of the following fields must be set.
-                    properties:
-                      datasetRef:
-                        description: Resource name of the dataset source for this
-                          listing. e.g. `projects/myproject/datasets/123`
-                        oneOf:
-                        - not:
-                            required:
-                            - external
-                          required:
-                          - name
-                        - not:
-                            anyOf:
-                            - required:
-                              - name
-                            - required:
-                              - namespace
-                          required:
-                          - external
-                        properties:
-                          external:
-                            description: If provided must be in the format `projects/[project_id]/datasets/[dataset_id]`.
-                            type: string
-                          name:
-                            description: The `metadata.name` field of a `BigQueryDataset`
-                              resource.
-                            type: string
-                          namespace:
-                            description: The `metadata.namespace` field of a `BigQueryDataset`
-                              resource.
-                            type: string
-                        type: object
-                      restrictedExportPolicy:
-                        description: Optional. If set, restricted export policy will
-                          be propagated and enforced on the linked dataset.
-                        properties:
-                          enabled:
-                            description: Optional. If true, enable restricted export.
-                            properties:
-                              value:
-                                description: The bool value.
-                                type: boolean
-                            type: object
-                          restrictDirectTableAccess:
-                            description: Optional. If true, restrict direct table
-                              access (read api/tabledata.list) on linked table.
-                            properties:
-                              value:
-                                description: The bool value.
-                                type: boolean
-                            type: object
-                          restrictQueryResult:
-                            description: Optional. If true, restrict export of query
-                              result derived from restricted linked dataset table.
-                            properties:
-                              value:
-                                description: The bool value.
-                                type: boolean
-                            type: object
-                        type: object
-                      selectedResources:
-                        description: Optional. Resources in this dataset that are
-                          selectively shared. If this field is empty, then the entire
-                          dataset (all resources) are shared. This field is only valid
-                          for data clean room exchanges.
-                        items:
-                          properties:
-                            table:
-                              description: 'Optional. Format: For table: `projects/{projectId}/datasets/{datasetId}/tables/{tableId}`
-                                Example:"projects/test_project/datasets/test_dataset/tables/test_table"'
-                              type: string
-                          type: object
-                        type: array
-                    required:
-                    - datasetRef
-                    type: object
-                type: object
-            required:
-            - dataExchangeRef
-            - displayName
-            - location
-            - projectRef
-            - source
-            type: object
-          status:
-            description: BigQueryAnalyticsHubListingStatus defines the config connector
-              machine state of BigQueryAnalyticsHubDataExchangeListing
-            properties:
-              conditions:
-                description: Conditions represent the latest available observations
-                  of the object's current state.
-                items:
-                  properties:
-                    lastTransitionTime:
-                      description: Last time the condition transitioned from one status
-                        to another.
-                      type: string
-                    message:
-                      description: Human-readable message indicating details about
-                        last transition.
-                      type: string
-                    reason:
-                      description: Unique, one-word, CamelCase reason for the condition's
-                        last transition.
-                      type: string
-                    status:
-                      description: Status is the status of the condition. Can be True,
-                        False, Unknown.
-                      type: string
-                    type:
-                      description: Type is the type of the condition.
-                      type: string
-                  type: object
-                type: array
-              externalRef:
-                description: A unique specifier for the BigQueryAnalyticsHubDataExchangeListing
-                  resource in GCP.
-                type: string
-              observedGeneration:
-                description: ObservedGeneration is the generation of the resource
-                  that was most recently observed by the Config Connector controller.
-                  If this is equal to metadata.generation, then that means that the
-                  current reported status reflects the most recent desired state of
-                  the resource.
-                format: int64
-                type: integer
-              observedState:
-                description: ObservedState is the state of the resource as most recently
-                  observed in GCP.
-                properties:
-                  state:
-                    description: Output only. Current state of the listing.
-                    type: string
-                type: object
-            type: object
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: null
-  storedVersions: null
diff --git a/crds/bigqueryanalyticshub_v1beta1_bigqueryanalyticshubdataexchange.yaml b/crds/bigqueryanalyticshub_v1beta1_bigqueryanalyticshubdataexchange.yaml
index e2b2f4c135..ee70dabd21 100644
--- a/crds/bigqueryanalyticshub_v1beta1_bigqueryanalyticshubdataexchange.yaml
+++ b/crds/bigqueryanalyticshub_v1beta1_bigqueryanalyticshubdataexchange.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -31,6 +31,9 @@ spec:
     kind: BigQueryAnalyticsHubDataExchange
     listKind: BigQueryAnalyticsHubDataExchangeList
     plural: bigqueryanalyticshubdataexchanges
+    shortNames:
+    - gcpbigqueryanalyticshubdataexchange
+    - gcpbigqueryanalyticshubdataexchanges
     singular: bigqueryanalyticshubdataexchange
   scope: Namespaced
   versions:
diff --git a/crds/bigqueryanalyticshub_v1beta1_bigqueryanalyticshublisting.yaml b/crds/bigqueryanalyticshub_v1beta1_bigqueryanalyticshublisting.yaml
new file mode 100644
index 0000000000..5012faf957
--- /dev/null
+++ b/crds/bigqueryanalyticshub_v1beta1_bigqueryanalyticshublisting.yaml
@@ -0,0 +1,700 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    cnrm.cloud.google.com/version: 1.128.0
+  creationTimestamp: null
+  labels:
+    cnrm.cloud.google.com/managed-by-kcc: "true"
+    cnrm.cloud.google.com/system: "true"
+  name: bigqueryanalyticshublistings.bigqueryanalyticshub.cnrm.cloud.google.com
+spec:
+  group: bigqueryanalyticshub.cnrm.cloud.google.com
+  names:
+    categories:
+    - gcp
+    kind: BigQueryAnalyticsHubListing
+    listKind: BigQueryAnalyticsHubListingList
+    plural: bigqueryanalyticshublistings
+    shortNames:
+    - gcpbigqueryanalyticshublisting
+    - gcpbigqueryanalyticshublistings
+    singular: bigqueryanalyticshublisting
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    - description: When 'True', the most recent reconcile of the resource succeeded
+      jsonPath: .status.conditions[?(@.type=='Ready')].status
+      name: Ready
+      type: string
+    - description: The reason for the value in 'Ready'
+      jsonPath: .status.conditions[?(@.type=='Ready')].reason
+      name: Status
+      type: string
+    - description: The last transition time for the value in 'Status'
+      jsonPath: .status.conditions[?(@.type=='Ready')].lastTransitionTime
+      name: Status Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: BigQueryAnalyticsHubListing is the Schema for the BigQueryAnalyticsHubListing
+          API
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: BigQueryAnalyticsHubListingSpec defines the desired state
+              of BigQueryAnalyticsHubDataExchangeListing
+            properties:
+              categories:
+                description: Optional. Categories of the listing. Up to two categories
+                  are allowed.
+                items:
+                  type: string
+                type: array
+              dataExchangeRef:
+                description: BigQueryAnalyticsHubDataExchangeRef defines the resource
+                  reference to BigQueryAnalyticsHubDataExchange, which "External"
+                  field holds the GCP identifier for the KRM object.
+                oneOf:
+                - not:
+                    required:
+                    - external
+                  required:
+                  - name
+                - not:
+                    anyOf:
+                    - required:
+                      - name
+                    - required:
+                      - namespace
+                  required:
+                  - external
+                properties:
+                  external:
+                    description: A reference to an externally managed BigQueryAnalyticsHubDataExchange
+                      resource. Should be in the format "projects/{{projectID}}/locations/{{location}}/dataexchanges/{{dataexchangeID}}".
+                    type: string
+                  name:
+                    description: The name of a BigQueryAnalyticsHubDataExchange resource.
+                    type: string
+                  namespace:
+                    description: The namespace of a BigQueryAnalyticsHubDataExchange
+                      resource.
+                    type: string
+                type: object
+              dataProvider:
+                description: Optional. Details of the data provider who owns the source
+                  data.
+                properties:
+                  name:
+                    description: Optional. Name of the data provider.
+                    type: string
+                  primaryContact:
+                    description: 'Optional. Email or URL of the data provider. Max
+                      Length: 1000 bytes.'
+                    type: string
+                type: object
+              description:
+                description: 'Optional. Short description of the listing. The description
+                  must contain only Unicode characters or tabs  (HT), new lines (LF),
+                  carriage returns (CR), and page breaks (FF). Default value is an
+                  empty string. Max length: 2000 bytes.'
+                type: string
+              discoveryType:
+                description: Optional. Type of discovery of the listing on the discovery
+                  page.
+                type: string
+              displayName:
+                description: 'Required. Human-readable display name of the listing.
+                  The display name must contain only Unicode letters, numbers (0-9),
+                  underscores (_), dashes (-), spaces ( ), ampersands (&) and can''t
+                  start or end with spaces. Default value is an empty string. Max
+                  length: 63 bytes.'
+                type: string
+              documentation:
+                description: Optional. Documentation describing the listing.
+                type: string
+              location:
+                description: Immutable. The name of the location this data exchange.
+                type: string
+              primaryContact:
+                description: 'Optional. Email or URL of the primary point of contact
+                  of the listing. Max Length: 1000 bytes.'
+                type: string
+              projectRef:
+                description: The Project that this resource belongs to.
+                oneOf:
+                - not:
+                    required:
+                    - external
+                  required:
+                  - name
+                - not:
+                    anyOf:
+                    - required:
+                      - name
+                    - required:
+                      - namespace
+                  required:
+                  - external
+                properties:
+                  external:
+                    description: The `projectID` field of a project, when not managed
+                      by Config Connector.
+                    type: string
+                  kind:
+                    description: The kind of the Project resource; optional but must
+                      be `Project` if provided.
+                    type: string
+                  name:
+                    description: The `name` field of a `Project` resource.
+                    type: string
+                  namespace:
+                    description: The `namespace` field of a `Project` resource.
+                    type: string
+                type: object
+              publisher:
+                description: Optional. Details of the publisher who owns the listing
+                  and who can share the source data.
+                properties:
+                  name:
+                    description: Optional. Name of the listing publisher.
+                    type: string
+                  primaryContact:
+                    description: 'Optional. Email or URL of the listing publisher.
+                      Max Length: 1000 bytes.'
+                    type: string
+                type: object
+              requestAccess:
+                description: 'Optional. Email or URL of the request access of the
+                  listing. Subscribers can use this reference to request access. Max
+                  Length: 1000 bytes.'
+                type: string
+              resourceID:
+                description: Immutable. The BigQueryAnalyticsHubDataExchangeListing
+                  name. If not given, the metadata.name will be used.
+                type: string
+                x-kubernetes-validations:
+                - message: ResourceID field is immutable
+                  rule: self == oldSelf
+              source:
+                properties:
+                  bigQueryDatasetSource:
+                    description: One of the following fields must be set.
+                    properties:
+                      datasetRef:
+                        description: Resource name of the dataset source for this
+                          listing. e.g. `projects/myproject/datasets/123`
+                        oneOf:
+                        - not:
+                            required:
+                            - external
+                          required:
+                          - name
+                        - not:
+                            anyOf:
+                            - required:
+                              - name
+                            - required:
+                              - namespace
+                          required:
+                          - external
+                        properties:
+                          external:
+                            description: If provided must be in the format `projects/[project_id]/datasets/[dataset_id]`.
+                            type: string
+                          name:
+                            description: The `metadata.name` field of a `BigQueryDataset`
+                              resource.
+                            type: string
+                          namespace:
+                            description: The `metadata.namespace` field of a `BigQueryDataset`
+                              resource.
+                            type: string
+                        type: object
+                      restrictedExportPolicy:
+                        description: Optional. If set, restricted export policy will
+                          be propagated and enforced on the linked dataset.
+                        properties:
+                          enabled:
+                            description: Optional. If true, enable restricted export.
+                            type: boolean
+                          restrictDirectTableAccess:
+                            description: Optional. If true, restrict direct table
+                              access (read api/tabledata.list) on linked table.
+                            type: boolean
+                          restrictQueryResult:
+                            description: Optional. If true, restrict export of query
+                              result derived from restricted linked dataset table.
+                            type: boolean
+                        type: object
+                      selectedResources:
+                        description: Optional. Resources in this dataset that are
+                          selectively shared. If this field is empty, then the entire
+                          dataset (all resources) are shared. This field is only valid
+                          for data clean room exchanges.
+                        items:
+                          properties:
+                            tableRef:
+                              description: 'Optional. A reference to a BigQueryTable.
+                                Format: `projects/{projectId}/datasets/{datasetId}/tables/{tableId}`
+                                Example:"projects/test_project/datasets/test_dataset/tables/test_table"'
+                              oneOf:
+                              - not:
+                                  required:
+                                  - external
+                                required:
+                                - name
+                              - not:
+                                  anyOf:
+                                  - required:
+                                    - name
+                                  - required:
+                                    - namespace
+                                required:
+                                - external
+                              properties:
+                                external:
+                                  description: If provided must be in the format `projects/{projectId}/datasets/{datasetId}/tables/{tableId}`.
+                                  type: string
+                                name:
+                                  description: The `metadata.name` field of a `BigQueryTable`
+                                    resource.
+                                  type: string
+                                namespace:
+                                  description: The `metadata.namespace` field of a
+                                    `BigQueryTable` resource.
+                                  type: string
+                              type: object
+                          type: object
+                        type: array
+                    required:
+                    - datasetRef
+                    type: object
+                type: object
+            required:
+            - dataExchangeRef
+            - displayName
+            - location
+            - projectRef
+            - source
+            type: object
+          status:
+            description: BigQueryAnalyticsHubListingStatus defines the config connector
+              machine state of BigQueryAnalyticsHubDataExchangeListing
+            properties:
+              conditions:
+                description: Conditions represent the latest available observations
+                  of the object's current state.
+                items:
+                  properties:
+                    lastTransitionTime:
+                      description: Last time the condition transitioned from one status
+                        to another.
+                      type: string
+                    message:
+                      description: Human-readable message indicating details about
+                        last transition.
+                      type: string
+                    reason:
+                      description: Unique, one-word, CamelCase reason for the condition's
+                        last transition.
+                      type: string
+                    status:
+                      description: Status is the status of the condition. Can be True,
+                        False, Unknown.
+                      type: string
+                    type:
+                      description: Type is the type of the condition.
+                      type: string
+                  type: object
+                type: array
+              externalRef:
+                description: A unique specifier for the BigQueryAnalyticsHubDataExchangeListing
+                  resource in GCP.
+                type: string
+              observedGeneration:
+                description: ObservedGeneration is the generation of the resource
+                  that was most recently observed by the Config Connector controller.
+                  If this is equal to metadata.generation, then that means that the
+                  current reported status reflects the most recent desired state of
+                  the resource.
+                format: int64
+                type: integer
+              observedState:
+                description: ObservedState is the state of the resource as most recently
+                  observed in GCP.
+                properties:
+                  state:
+                    description: Output only. Current state of the listing.
+                    type: string
+                type: object
+            type: object
+        type: object
+    served: true
+    storage: false
+    subresources:
+      status: {}
+  - additionalPrinterColumns:
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    - description: When 'True', the most recent reconcile of the resource succeeded
+      jsonPath: .status.conditions[?(@.type=='Ready')].status
+      name: Ready
+      type: string
+    - description: The reason for the value in 'Ready'
+      jsonPath: .status.conditions[?(@.type=='Ready')].reason
+      name: Status
+      type: string
+    - description: The last transition time for the value in 'Status'
+      jsonPath: .status.conditions[?(@.type=='Ready')].lastTransitionTime
+      name: Status Age
+      type: date
+    name: v1beta1
+    schema:
+      openAPIV3Schema:
+        description: BigQueryAnalyticsHubListing is the Schema for the BigQueryAnalyticsHubListing
+          API
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: BigQueryAnalyticsHubListingSpec defines the desired state
+              of BigQueryAnalyticsHubDataExchangeListing
+            properties:
+              categories:
+                description: Optional. Categories of the listing. Up to two categories
+                  are allowed.
+                items:
+                  type: string
+                type: array
+              dataExchangeRef:
+                description: BigQueryAnalyticsHubDataExchangeRef defines the resource
+                  reference to BigQueryAnalyticsHubDataExchange, which "External"
+                  field holds the GCP identifier for the KRM object.
+                oneOf:
+                - not:
+                    required:
+                    - external
+                  required:
+                  - name
+                - not:
+                    anyOf:
+                    - required:
+                      - name
+                    - required:
+                      - namespace
+                  required:
+                  - external
+                properties:
+                  external:
+                    description: A reference to an externally managed BigQueryAnalyticsHubDataExchange
+                      resource. Should be in the format "projects/{{projectID}}/locations/{{location}}/dataexchanges/{{dataexchangeID}}".
+                    type: string
+                  name:
+                    description: The name of a BigQueryAnalyticsHubDataExchange resource.
+                    type: string
+                  namespace:
+                    description: The namespace of a BigQueryAnalyticsHubDataExchange
+                      resource.
+                    type: string
+                type: object
+              dataProvider:
+                description: Optional. Details of the data provider who owns the source
+                  data.
+                properties:
+                  name:
+                    description: Optional. Name of the data provider.
+                    type: string
+                  primaryContact:
+                    description: 'Optional. Email or URL of the data provider. Max
+                      Length: 1000 bytes.'
+                    type: string
+                type: object
+              description:
+                description: 'Optional. Short description of the listing. The description
+                  must contain only Unicode characters or tabs  (HT), new lines (LF),
+                  carriage returns (CR), and page breaks (FF). Default value is an
+                  empty string. Max length: 2000 bytes.'
+                type: string
+              discoveryType:
+                description: Optional. Type of discovery of the listing on the discovery
+                  page.
+                type: string
+              displayName:
+                description: 'Required. Human-readable display name of the listing.
+                  The display name must contain only Unicode letters, numbers (0-9),
+                  underscores (_), dashes (-), spaces ( ), ampersands (&) and can''t
+                  start or end with spaces. Default value is an empty string. Max
+                  length: 63 bytes.'
+                type: string
+              documentation:
+                description: Optional. Documentation describing the listing.
+                type: string
+              location:
+                description: Immutable. The name of the location this data exchange.
+                type: string
+              primaryContact:
+                description: 'Optional. Email or URL of the primary point of contact
+                  of the listing. Max Length: 1000 bytes.'
+                type: string
+              projectRef:
+                description: The Project that this resource belongs to.
+                oneOf:
+                - not:
+                    required:
+                    - external
+                  required:
+                  - name
+                - not:
+                    anyOf:
+                    - required:
+                      - name
+                    - required:
+                      - namespace
+                  required:
+                  - external
+                properties:
+                  external:
+                    description: The `projectID` field of a project, when not managed
+                      by Config Connector.
+                    type: string
+                  kind:
+                    description: The kind of the Project resource; optional but must
+                      be `Project` if provided.
+                    type: string
+                  name:
+                    description: The `name` field of a `Project` resource.
+                    type: string
+                  namespace:
+                    description: The `namespace` field of a `Project` resource.
+                    type: string
+                type: object
+              publisher:
+                description: Optional. Details of the publisher who owns the listing
+                  and who can share the source data.
+                properties:
+                  name:
+                    description: Optional. Name of the listing publisher.
+                    type: string
+                  primaryContact:
+                    description: 'Optional. Email or URL of the listing publisher.
+                      Max Length: 1000 bytes.'
+                    type: string
+                type: object
+              requestAccess:
+                description: 'Optional. Email or URL of the request access of the
+                  listing. Subscribers can use this reference to request access. Max
+                  Length: 1000 bytes.'
+                type: string
+              resourceID:
+                description: Immutable. The BigQueryAnalyticsHubDataExchangeListing
+                  name. If not given, the metadata.name will be used.
+                type: string
+                x-kubernetes-validations:
+                - message: ResourceID field is immutable
+                  rule: self == oldSelf
+              source:
+                properties:
+                  bigQueryDatasetSource:
+                    description: One of the following fields must be set.
+                    properties:
+                      datasetRef:
+                        description: Resource name of the dataset source for this
+                          listing. e.g. `projects/myproject/datasets/123`
+                        oneOf:
+                        - not:
+                            required:
+                            - external
+                          required:
+                          - name
+                        - not:
+                            anyOf:
+                            - required:
+                              - name
+                            - required:
+                              - namespace
+                          required:
+                          - external
+                        properties:
+                          external:
+                            description: If provided must be in the format `projects/[project_id]/datasets/[dataset_id]`.
+                            type: string
+                          name:
+                            description: The `metadata.name` field of a `BigQueryDataset`
+                              resource.
+                            type: string
+                          namespace:
+                            description: The `metadata.namespace` field of a `BigQueryDataset`
+                              resource.
+                            type: string
+                        type: object
+                      restrictedExportPolicy:
+                        description: Optional. If set, restricted export policy will
+                          be propagated and enforced on the linked dataset.
+                        properties:
+                          enabled:
+                            description: Optional. If true, enable restricted export.
+                            type: boolean
+                          restrictDirectTableAccess:
+                            description: Optional. If true, restrict direct table
+                              access (read api/tabledata.list) on linked table.
+                            type: boolean
+                          restrictQueryResult:
+                            description: Optional. If true, restrict export of query
+                              result derived from restricted linked dataset table.
+                            type: boolean
+                        type: object
+                      selectedResources:
+                        description: Optional. Resources in this dataset that are
+                          selectively shared. If this field is empty, then the entire
+                          dataset (all resources) are shared. This field is only valid
+                          for data clean room exchanges.
+                        items:
+                          properties:
+                            tableRef:
+                              description: 'Optional. A reference to a BigQueryTable.
+                                Format: `projects/{projectId}/datasets/{datasetId}/tables/{tableId}`
+                                Example:"projects/test_project/datasets/test_dataset/tables/test_table"'
+                              oneOf:
+                              - not:
+                                  required:
+                                  - external
+                                required:
+                                - name
+                              - not:
+                                  anyOf:
+                                  - required:
+                                    - name
+                                  - required:
+                                    - namespace
+                                required:
+                                - external
+                              properties:
+                                external:
+                                  description: If provided must be in the format `projects/{projectId}/datasets/{datasetId}/tables/{tableId}`.
+                                  type: string
+                                name:
+                                  description: The `metadata.name` field of a `BigQueryTable`
+                                    resource.
+                                  type: string
+                                namespace:
+                                  description: The `metadata.namespace` field of a
+                                    `BigQueryTable` resource.
+                                  type: string
+                              type: object
+                          type: object
+                        type: array
+                    required:
+                    - datasetRef
+                    type: object
+                type: object
+            required:
+            - dataExchangeRef
+            - displayName
+            - location
+            - projectRef
+            - source
+            type: object
+          status:
+            description: BigQueryAnalyticsHubListingStatus defines the config connector
+              machine state of BigQueryAnalyticsHubDataExchangeListing
+            properties:
+              conditions:
+                description: Conditions represent the latest available observations
+                  of the object's current state.
+                items:
+                  properties:
+                    lastTransitionTime:
+                      description: Last time the condition transitioned from one status
+                        to another.
+                      type: string
+                    message:
+                      description: Human-readable message indicating details about
+                        last transition.
+                      type: string
+                    reason:
+                      description: Unique, one-word, CamelCase reason for the condition's
+                        last transition.
+                      type: string
+                    status:
+                      description: Status is the status of the condition. Can be True,
+                        False, Unknown.
+                      type: string
+                    type:
+                      description: Type is the type of the condition.
+                      type: string
+                  type: object
+                type: array
+              externalRef:
+                description: A unique specifier for the BigQueryAnalyticsHubDataExchangeListing
+                  resource in GCP.
+                type: string
+              observedGeneration:
+                description: ObservedGeneration is the generation of the resource
+                  that was most recently observed by the Config Connector controller.
+                  If this is equal to metadata.generation, then that means that the
+                  current reported status reflects the most recent desired state of
+                  the resource.
+                format: int64
+                type: integer
+              observedState:
+                description: ObservedState is the state of the resource as most recently
+                  observed in GCP.
+                properties:
+                  state:
+                    description: Output only. Current state of the listing.
+                    type: string
+                type: object
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: null
+  storedVersions: null
diff --git a/crds/bigqueryconnection_v1beta1_bigqueryconnectionconnection.yaml b/crds/bigqueryconnection_v1beta1_bigqueryconnectionconnection.yaml
index eb42e3056a..25b7a89a86 100644
--- a/crds/bigqueryconnection_v1beta1_bigqueryconnectionconnection.yaml
+++ b/crds/bigqueryconnection_v1beta1_bigqueryconnectionconnection.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/bigquerydatapolicy_v1alpha1_bigquerydatapolicydatapolicy.yaml b/crds/bigquerydatapolicy_v1alpha1_bigquerydatapolicydatapolicy.yaml
index e08abfd2a1..c221cbf5f0 100644
--- a/crds/bigquerydatapolicy_v1alpha1_bigquerydatapolicydatapolicy.yaml
+++ b/crds/bigquerydatapolicy_v1alpha1_bigquerydatapolicydatapolicy.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/bigquerydatatransfer_v1beta1_bigquerydatatransferconfig.yaml b/crds/bigquerydatatransfer_v1beta1_bigquerydatatransferconfig.yaml
index 557a459b05..5933605129 100644
--- a/crds/bigquerydatatransfer_v1beta1_bigquerydatatransferconfig.yaml
+++ b/crds/bigquerydatatransfer_v1beta1_bigquerydatatransferconfig.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -30,6 +30,9 @@ spec:
     kind: BigQueryDataTransferConfig
     listKind: BigQueryDataTransferConfigList
     plural: bigquerydatatransferconfigs
+    shortNames:
+    - gcpbigquerydatatransferconfig
+    - gcpbigquerydatatransferconfigs
     singular: bigquerydatatransferconfig
   scope: Namespaced
   versions:
@@ -245,12 +248,9 @@ spec:
                     type: string
                 type: object
               resourceID:
-                description: Immutable. The BigQueryDataTransferConfig name. If not
-                  given, the metadata.name will be used.
+                description: The BigQueryDataTransferConfig name. If not given, the
+                  metadata.name will be used.
                 type: string
-                x-kubernetes-validations:
-                - message: ResourceID field is immutable
-                  rule: self == oldSelf
               schedule:
                 description: |-
                   Data transfer schedule.
@@ -634,12 +634,9 @@ spec:
                     type: string
                 type: object
               resourceID:
-                description: Immutable. The BigQueryDataTransferConfig name. If not
-                  given, the metadata.name will be used.
+                description: The BigQueryDataTransferConfig name. If not given, the
+                  metadata.name will be used.
                 type: string
-                x-kubernetes-validations:
-                - message: ResourceID field is immutable
-                  rule: self == oldSelf
               schedule:
                 description: |-
                   Data transfer schedule.
@@ -680,6 +677,85 @@ spec:
                       transfer can be triggered manually is not limited by this option.
                     type: string
                 type: object
+              scheduleOptionsV2:
+                description: Options customizing different types of data transfer
+                  schedule. This field replaces "schedule" and "schedule_options"
+                  fields. ScheduleOptionsV2 cannot be used together with ScheduleOptions/Schedule.
+                properties:
+                  eventDrivenSchedule:
+                    description: Event driven transfer schedule options. If set, the
+                      transfer will be scheduled upon events arrial.
+                    properties:
+                      pubSubSubscriptionRef:
+                        description: Pub/Sub subscription used to receive events.
+                          Only Google Cloud Storage data source support this option.
+                        oneOf:
+                        - not:
+                            required:
+                            - external
+                          required:
+                          - name
+                        - not:
+                            anyOf:
+                            - required:
+                              - name
+                            - required:
+                              - namespace
+                          required:
+                          - external
+                        properties:
+                          external:
+                            description: If provided must be in the format `projects/[project_id]/subscriptions/[subscription_id]`.
+                            type: string
+                          name:
+                            description: The `metadata.name` field of a `PubSubSubscription`
+                              resource.
+                            type: string
+                          namespace:
+                            description: The `metadata.namespace` field of a `PubSubSubscription`
+                              resource.
+                            type: string
+                        type: object
+                    type: object
+                  manualSchedule:
+                    description: Manual transfer schedule. If set, the transfer run
+                      will not be auto-scheduled by the system, unless the client
+                      invokes StartManualTransferRuns.  This is equivalent to disable_auto_scheduling
+                      = true.
+                    type: object
+                  timeBasedSchedule:
+                    description: Time based transfer schedule options. This is the
+                      default schedule option.
+                    properties:
+                      endTime:
+                        description: Defines time to stop scheduling transfer runs.
+                          A transfer run cannot be scheduled at or after the end time.
+                          The end time can be changed at any moment.
+                        type: string
+                      schedule:
+                        description: |-
+                          Data transfer schedule.
+                           If the data source does not support a custom schedule, this should be
+                           empty. If it is empty, the default value for the data source will be used.
+                           The specified times are in UTC.
+                           Examples of valid format:
+                           `1st,3rd monday of month 15:30`,
+                           `every wed,fri of jan,jun 13:15`, and
+                           `first sunday of quarter 00:00`.
+                           See more explanation about the format here:
+                           https://cloud.google.com/appengine/docs/flexible/python/scheduling-jobs-with-cron-yaml#the_schedule_format
+
+                           NOTE: The minimum interval time between recurring transfers depends on the
+                           data source; refer to the documentation for your data source.
+                        type: string
+                      startTime:
+                        description: Specifies time to start scheduling transfer runs.
+                          The first run will be scheduled at or after the start time
+                          according to a recurrence pattern defined in the schedule
+                          string. The start time can be changed at any moment.
+                        type: string
+                    type: object
+                type: object
               serviceAccountRef:
                 description: Service account email. If this field is set, the transfer
                   config will be created with this service account's credentials.
@@ -769,6 +845,22 @@ spec:
                     description: Output only. Region in which BigQuery dataset is
                       located.
                     type: string
+                  error:
+                    description: Output only. Error code with detailed information
+                      about reason of the latest config failure.
+                    properties:
+                      code:
+                        description: The status code, which should be an enum value
+                          of [google.rpc.Code][google.rpc.Code].
+                        format: int32
+                        type: integer
+                      message:
+                        description: A developer-facing error message, which should
+                          be in English. Any user-facing error message should be localized
+                          and sent in the [google.rpc.Status.details][google.rpc.Status.details]
+                          field, or localized by the client.
+                        type: string
+                    type: object
                   name:
                     description: Identifier. The resource name of the transfer config.
                       Transfer config names have the form either `projects/{project_id}/locations/{region}/transferConfigs/{config_id}`
diff --git a/crds/bigqueryreservation_v1alpha1_bigqueryreservationcapacitycommitment.yaml b/crds/bigqueryreservation_v1alpha1_bigqueryreservationcapacitycommitment.yaml
index 957a94ed63..cdc1ef87cc 100644
--- a/crds/bigqueryreservation_v1alpha1_bigqueryreservationcapacitycommitment.yaml
+++ b/crds/bigqueryreservation_v1alpha1_bigqueryreservationcapacitycommitment.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/bigqueryreservation_v1alpha1_bigqueryreservationreservation.yaml b/crds/bigqueryreservation_v1alpha1_bigqueryreservationreservation.yaml
index 8a204bc2d6..cb281be3c0 100644
--- a/crds/bigqueryreservation_v1alpha1_bigqueryreservationreservation.yaml
+++ b/crds/bigqueryreservation_v1alpha1_bigqueryreservationreservation.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/bigtable_v1beta1_bigtableappprofile.yaml b/crds/bigtable_v1beta1_bigtableappprofile.yaml
index 6d4f1a4814..86643b5758 100644
--- a/crds/bigtable_v1beta1_bigtableappprofile.yaml
+++ b/crds/bigtable_v1beta1_bigtableappprofile.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/bigtable_v1beta1_bigtablegcpolicy.yaml b/crds/bigtable_v1beta1_bigtablegcpolicy.yaml
index 1c3715b879..e676311122 100644
--- a/crds/bigtable_v1beta1_bigtablegcpolicy.yaml
+++ b/crds/bigtable_v1beta1_bigtablegcpolicy.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/bigtable_v1beta1_bigtableinstance.yaml b/crds/bigtable_v1beta1_bigtableinstance.yaml
index 1d85b9cf84..a4c1bd0200 100644
--- a/crds/bigtable_v1beta1_bigtableinstance.yaml
+++ b/crds/bigtable_v1beta1_bigtableinstance.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/bigtable_v1beta1_bigtabletable.yaml b/crds/bigtable_v1beta1_bigtabletable.yaml
index a988fb334e..f5bd77f454 100644
--- a/crds/bigtable_v1beta1_bigtabletable.yaml
+++ b/crds/bigtable_v1beta1_bigtabletable.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/billingbudgets_v1beta1_billingbudgetsbudget.yaml b/crds/billingbudgets_v1beta1_billingbudgetsbudget.yaml
index ea2c212971..0a4f8d682d 100644
--- a/crds/billingbudgets_v1beta1_billingbudgetsbudget.yaml
+++ b/crds/billingbudgets_v1beta1_billingbudgetsbudget.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/binaryauthorization_v1beta1_binaryauthorizationattestor.yaml b/crds/binaryauthorization_v1beta1_binaryauthorizationattestor.yaml
index 241b12d0fc..fdc12eb693 100644
--- a/crds/binaryauthorization_v1beta1_binaryauthorizationattestor.yaml
+++ b/crds/binaryauthorization_v1beta1_binaryauthorizationattestor.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/binaryauthorization_v1beta1_binaryauthorizationpolicy.yaml b/crds/binaryauthorization_v1beta1_binaryauthorizationpolicy.yaml
index 12851d2d38..82a0d031f4 100644
--- a/crds/binaryauthorization_v1beta1_binaryauthorizationpolicy.yaml
+++ b/crds/binaryauthorization_v1beta1_binaryauthorizationpolicy.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/certificatemanager_v1beta1_certificatemanagercertificate.yaml b/crds/certificatemanager_v1beta1_certificatemanagercertificate.yaml
index 1288222ec9..1a798d7d84 100644
--- a/crds/certificatemanager_v1beta1_certificatemanagercertificate.yaml
+++ b/crds/certificatemanager_v1beta1_certificatemanagercertificate.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/certificatemanager_v1beta1_certificatemanagercertificatemap.yaml b/crds/certificatemanager_v1beta1_certificatemanagercertificatemap.yaml
index c2689e30a5..aa55443ec6 100644
--- a/crds/certificatemanager_v1beta1_certificatemanagercertificatemap.yaml
+++ b/crds/certificatemanager_v1beta1_certificatemanagercertificatemap.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/certificatemanager_v1beta1_certificatemanagercertificatemapentry.yaml b/crds/certificatemanager_v1beta1_certificatemanagercertificatemapentry.yaml
index f6043faa57..0e64e78376 100644
--- a/crds/certificatemanager_v1beta1_certificatemanagercertificatemapentry.yaml
+++ b/crds/certificatemanager_v1beta1_certificatemanagercertificatemapentry.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/certificatemanager_v1beta1_certificatemanagerdnsauthorization.yaml b/crds/certificatemanager_v1beta1_certificatemanagerdnsauthorization.yaml
index 3b625389ff..66e3e150a9 100644
--- a/crds/certificatemanager_v1beta1_certificatemanagerdnsauthorization.yaml
+++ b/crds/certificatemanager_v1beta1_certificatemanagerdnsauthorization.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -120,13 +120,10 @@ spec:
                     type: string
                 type: object
               resourceID:
-                description: Immutable. Optional. The name of the resource. Used for
-                  creation and acquisition. When unset, the value of `metadata.name`
-                  is used as the default.
+                description: Optional. The name of the resource. Used for creation
+                  and acquisition. When unset, the value of `metadata.name` is used
+                  as the default.
                 type: string
-                x-kubernetes-validations:
-                - message: ResourceID field is immutable
-                  rule: self == oldSelf
             required:
             - domain
             - projectRef
@@ -283,13 +280,10 @@ spec:
                     type: string
                 type: object
               resourceID:
-                description: Immutable. Optional. The name of the resource. Used for
-                  creation and acquisition. When unset, the value of `metadata.name`
-                  is used as the default.
+                description: Optional. The name of the resource. Used for creation
+                  and acquisition. When unset, the value of `metadata.name` is used
+                  as the default.
                 type: string
-                x-kubernetes-validations:
-                - message: ResourceID field is immutable
-                  rule: self == oldSelf
             required:
             - domain
             - projectRef
diff --git a/crds/cloudasset_v1alpha1_cloudassetfolderfeed.yaml b/crds/cloudasset_v1alpha1_cloudassetfolderfeed.yaml
index 4ddae49359..6646b275e8 100644
--- a/crds/cloudasset_v1alpha1_cloudassetfolderfeed.yaml
+++ b/crds/cloudasset_v1alpha1_cloudassetfolderfeed.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/cloudasset_v1alpha1_cloudassetorganizationfeed.yaml b/crds/cloudasset_v1alpha1_cloudassetorganizationfeed.yaml
index 4b5ce2419a..7c18c63219 100644
--- a/crds/cloudasset_v1alpha1_cloudassetorganizationfeed.yaml
+++ b/crds/cloudasset_v1alpha1_cloudassetorganizationfeed.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/cloudasset_v1alpha1_cloudassetprojectfeed.yaml b/crds/cloudasset_v1alpha1_cloudassetprojectfeed.yaml
index 1450a7efe9..2bbecb5e22 100644
--- a/crds/cloudasset_v1alpha1_cloudassetprojectfeed.yaml
+++ b/crds/cloudasset_v1alpha1_cloudassetprojectfeed.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/cloudbuild_v1beta1_cloudbuildtrigger.yaml b/crds/cloudbuild_v1beta1_cloudbuildtrigger.yaml
index f12cdcab3d..2d8dc6737b 100644
--- a/crds/cloudbuild_v1beta1_cloudbuildtrigger.yaml
+++ b/crds/cloudbuild_v1beta1_cloudbuildtrigger.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -1056,9 +1056,8 @@ spec:
                   type: string
                 type: array
               location:
-                description: |-
-                  Immutable. The [Cloud Build location](https://cloud.google.com/build/docs/locations) for the trigger.
-                  If not specified, "global" is used.
+                description: 'Immutable. The location of the Cloud Build trigger.
+                  If not specified, "global" is used. More info: cloud.google.com/build/docs/locations.'
                 type: string
               pubsubConfig:
                 description: |-
diff --git a/crds/cloudbuild_v1beta1_cloudbuildworkerpool.yaml b/crds/cloudbuild_v1beta1_cloudbuildworkerpool.yaml
index c456c97cbc..9248fd192c 100644
--- a/crds/cloudbuild_v1beta1_cloudbuildworkerpool.yaml
+++ b/crds/cloudbuild_v1beta1_cloudbuildworkerpool.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -25,9 +25,14 @@ metadata:
 spec:
   group: cloudbuild.cnrm.cloud.google.com
   names:
+    categories:
+    - gcp
     kind: CloudBuildWorkerPool
     listKind: CloudBuildWorkerPoolList
     plural: cloudbuildworkerpools
+    shortNames:
+    - gcpcloudbuildworkerpool
+    - gcpcloudbuildworkerpools
     singular: cloudbuildworkerpool
   scope: Namespaced
   versions:
@@ -84,7 +89,7 @@ spec:
                         properties:
                           external:
                             description: A reference to an externally managed Compute
-                              Network resource. Should be in the format `projects/<projectID>/global/networks/<network>`.
+                              Network resource. Should be in the format `projects/{{projectID}}/global/networks/{{network}}`.
                             type: string
                           name:
                             description: The `name` field of a `ComputeNetwork` resource.
@@ -292,7 +297,7 @@ spec:
                         properties:
                           external:
                             description: A reference to an externally managed Compute
-                              Network resource. Should be in the format `projects/<projectID>/global/networks/<network>`.
+                              Network resource. Should be in the format `projects/{{projectID}}/global/networks/{{network}}`.
                             type: string
                           name:
                             description: The `name` field of a `ComputeNetwork` resource.
diff --git a/crds/cloudfunctions2_v1alpha1_cloudfunctions2function.yaml b/crds/cloudfunctions2_v1alpha1_cloudfunctions2function.yaml
index b885572160..c0b49acb2e 100644
--- a/crds/cloudfunctions2_v1alpha1_cloudfunctions2function.yaml
+++ b/crds/cloudfunctions2_v1alpha1_cloudfunctions2function.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/cloudfunctions_v1beta1_cloudfunctionsfunction.yaml b/crds/cloudfunctions_v1beta1_cloudfunctionsfunction.yaml
index 49aad51603..b8297c2aea 100644
--- a/crds/cloudfunctions_v1beta1_cloudfunctionsfunction.yaml
+++ b/crds/cloudfunctions_v1beta1_cloudfunctionsfunction.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/cloudidentity_v1beta1_cloudidentitygroup.yaml b/crds/cloudidentity_v1beta1_cloudidentitygroup.yaml
index fd67310592..de4d09e1d8 100644
--- a/crds/cloudidentity_v1beta1_cloudidentitygroup.yaml
+++ b/crds/cloudidentity_v1beta1_cloudidentitygroup.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/cloudidentity_v1beta1_cloudidentitymembership.yaml b/crds/cloudidentity_v1beta1_cloudidentitymembership.yaml
index 23fd35b6b7..460dd010ff 100644
--- a/crds/cloudidentity_v1beta1_cloudidentitymembership.yaml
+++ b/crds/cloudidentity_v1beta1_cloudidentitymembership.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/cloudids_v1beta1_cloudidsendpoint.yaml b/crds/cloudids_v1beta1_cloudidsendpoint.yaml
index 2b378b9821..ce69d662ce 100644
--- a/crds/cloudids_v1beta1_cloudidsendpoint.yaml
+++ b/crds/cloudids_v1beta1_cloudidsendpoint.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/cloudiot_v1alpha1_cloudiotdevice.yaml b/crds/cloudiot_v1alpha1_cloudiotdevice.yaml
index 594a744377..78b22ea6b4 100644
--- a/crds/cloudiot_v1alpha1_cloudiotdevice.yaml
+++ b/crds/cloudiot_v1alpha1_cloudiotdevice.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/cloudiot_v1alpha1_cloudiotdeviceregistry.yaml b/crds/cloudiot_v1alpha1_cloudiotdeviceregistry.yaml
index 75e951e7ce..09b47d7ae6 100644
--- a/crds/cloudiot_v1alpha1_cloudiotdeviceregistry.yaml
+++ b/crds/cloudiot_v1alpha1_cloudiotdeviceregistry.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/cloudscheduler_v1beta1_cloudschedulerjob.yaml b/crds/cloudscheduler_v1beta1_cloudschedulerjob.yaml
index ecb1d9ed4c..d666e5d93b 100644
--- a/crds/cloudscheduler_v1beta1_cloudschedulerjob.yaml
+++ b/crds/cloudscheduler_v1beta1_cloudschedulerjob.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
@@ -334,7 +334,7 @@ spec:
                       and finally retries at intervals of max_backoff_duration up
                       to retry_count times. For example, if min_backoff_duration is
                       10s, max_backoff_duration is 300s, and `max_doublings` is 3,
-                      then the job will first be retried in 10s. The retry interval
+                      then the a job will first be retried in 10s. The retry interval
                       will double three times, and then increase linearly by 2^3 *
                       10s. Finally, the job will retry at intervals of max_backoff_duration
                       until the job has been attempted retry_count times. Thus, the
@@ -402,8 +402,9 @@ spec:
                     properties:
                       host:
                         description: 'Output only. The host that the job is sent to.
-                          Read information about [how App Engine requests are
-                          routed](https://cloud.google.com/appengine/docs/standard/python/how-requests-are-routed).                          The host is constructed as: * `host = [application_domain_name]`
+                          For more information about how App Engine requests are routed,
+                          see [here](https://cloud.google.com/appengine/docs/standard/python/how-requests-are-routed).
+                          The host is constructed as: * `host = [application_domain_name]`
                           `| [service] + ''.'' + [application_domain_name]` `| [version]
                           + ''.'' + [application_domain_name]` `| [version_dot_service]+
                           ''.'' + [application_domain_name]` `| [instance] + ''.''
diff --git a/crds/cloudtasks_v1alpha1_cloudtasksqueue.yaml b/crds/cloudtasks_v1alpha1_cloudtasksqueue.yaml
index e84dc6ba64..7d198e9c09 100644
--- a/crds/cloudtasks_v1alpha1_cloudtasksqueue.yaml
+++ b/crds/cloudtasks_v1alpha1_cloudtasksqueue.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1alpha1_computeautoscaler.yaml b/crds/compute_v1alpha1_computeautoscaler.yaml
index d407ceaabc..029a603dfd 100644
--- a/crds/compute_v1alpha1_computeautoscaler.yaml
+++ b/crds/compute_v1alpha1_computeautoscaler.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1alpha1_computebackendbucketsignedurlkey.yaml b/crds/compute_v1alpha1_computebackendbucketsignedurlkey.yaml
index f80abd78c0..0e2812a934 100644
--- a/crds/compute_v1alpha1_computebackendbucketsignedurlkey.yaml
+++ b/crds/compute_v1alpha1_computebackendbucketsignedurlkey.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1alpha1_computebackendservicesignedurlkey.yaml b/crds/compute_v1alpha1_computebackendservicesignedurlkey.yaml
index d7cb392e06..37540f1776 100644
--- a/crds/compute_v1alpha1_computebackendservicesignedurlkey.yaml
+++ b/crds/compute_v1alpha1_computebackendservicesignedurlkey.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1alpha1_computediskresourcepolicyattachment.yaml b/crds/compute_v1alpha1_computediskresourcepolicyattachment.yaml
index 235a89a630..9916889db4 100644
--- a/crds/compute_v1alpha1_computediskresourcepolicyattachment.yaml
+++ b/crds/compute_v1alpha1_computediskresourcepolicyattachment.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1alpha1_computeglobalnetworkendpoint.yaml b/crds/compute_v1alpha1_computeglobalnetworkendpoint.yaml
index d11361be8c..f420116c74 100644
--- a/crds/compute_v1alpha1_computeglobalnetworkendpoint.yaml
+++ b/crds/compute_v1alpha1_computeglobalnetworkendpoint.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1alpha1_computeglobalnetworkendpointgroup.yaml b/crds/compute_v1alpha1_computeglobalnetworkendpointgroup.yaml
index 08377d3c67..4069aee912 100644
--- a/crds/compute_v1alpha1_computeglobalnetworkendpointgroup.yaml
+++ b/crds/compute_v1alpha1_computeglobalnetworkendpointgroup.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1alpha1_computeinstancegroupnamedport.yaml b/crds/compute_v1alpha1_computeinstancegroupnamedport.yaml
index 4e9e413f13..cc261ed434 100644
--- a/crds/compute_v1alpha1_computeinstancegroupnamedport.yaml
+++ b/crds/compute_v1alpha1_computeinstancegroupnamedport.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1alpha1_computemachineimage.yaml b/crds/compute_v1alpha1_computemachineimage.yaml
index 82c2b47dec..a2830f6508 100644
--- a/crds/compute_v1alpha1_computemachineimage.yaml
+++ b/crds/compute_v1alpha1_computemachineimage.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1alpha1_computenetworkendpoint.yaml b/crds/compute_v1alpha1_computenetworkendpoint.yaml
index 80cb46e987..3b23927b6e 100644
--- a/crds/compute_v1alpha1_computenetworkendpoint.yaml
+++ b/crds/compute_v1alpha1_computenetworkendpoint.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1alpha1_computenetworkfirewallpolicyrule.yaml b/crds/compute_v1alpha1_computenetworkfirewallpolicyrule.yaml
index ae4a05d2f6..c311d54d20 100644
--- a/crds/compute_v1alpha1_computenetworkfirewallpolicyrule.yaml
+++ b/crds/compute_v1alpha1_computenetworkfirewallpolicyrule.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1alpha1_computenetworkpeeringroutesconfig.yaml b/crds/compute_v1alpha1_computenetworkpeeringroutesconfig.yaml
index 8531bccc1c..9eafdbd9b3 100644
--- a/crds/compute_v1alpha1_computenetworkpeeringroutesconfig.yaml
+++ b/crds/compute_v1alpha1_computenetworkpeeringroutesconfig.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1alpha1_computeorganizationsecuritypolicy.yaml b/crds/compute_v1alpha1_computeorganizationsecuritypolicy.yaml
index 6fb7037eec..6c1cf5e79f 100644
--- a/crds/compute_v1alpha1_computeorganizationsecuritypolicy.yaml
+++ b/crds/compute_v1alpha1_computeorganizationsecuritypolicy.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1alpha1_computeorganizationsecuritypolicyassociation.yaml b/crds/compute_v1alpha1_computeorganizationsecuritypolicyassociation.yaml
index aaaaa1eda8..028d4606e7 100644
--- a/crds/compute_v1alpha1_computeorganizationsecuritypolicyassociation.yaml
+++ b/crds/compute_v1alpha1_computeorganizationsecuritypolicyassociation.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1alpha1_computeorganizationsecuritypolicyrule.yaml b/crds/compute_v1alpha1_computeorganizationsecuritypolicyrule.yaml
index fb7d6520f2..36d4628bc0 100644
--- a/crds/compute_v1alpha1_computeorganizationsecuritypolicyrule.yaml
+++ b/crds/compute_v1alpha1_computeorganizationsecuritypolicyrule.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1alpha1_computeperinstanceconfig.yaml b/crds/compute_v1alpha1_computeperinstanceconfig.yaml
index cab4d90ad0..ab6abe608a 100644
--- a/crds/compute_v1alpha1_computeperinstanceconfig.yaml
+++ b/crds/compute_v1alpha1_computeperinstanceconfig.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1alpha1_computeregionautoscaler.yaml b/crds/compute_v1alpha1_computeregionautoscaler.yaml
index 29c6de69cf..765889638a 100644
--- a/crds/compute_v1alpha1_computeregionautoscaler.yaml
+++ b/crds/compute_v1alpha1_computeregionautoscaler.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1alpha1_computeregiondiskresourcepolicyattachment.yaml b/crds/compute_v1alpha1_computeregiondiskresourcepolicyattachment.yaml
index 4a06670d36..0d23a2c052 100644
--- a/crds/compute_v1alpha1_computeregiondiskresourcepolicyattachment.yaml
+++ b/crds/compute_v1alpha1_computeregiondiskresourcepolicyattachment.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1alpha1_computeregionperinstanceconfig.yaml b/crds/compute_v1alpha1_computeregionperinstanceconfig.yaml
index 2b94bb7619..4cf3e804b0 100644
--- a/crds/compute_v1alpha1_computeregionperinstanceconfig.yaml
+++ b/crds/compute_v1alpha1_computeregionperinstanceconfig.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1alpha1_computeregionsslpolicy.yaml b/crds/compute_v1alpha1_computeregionsslpolicy.yaml
index d4b4574a4a..4dc5e6f7df 100644
--- a/crds/compute_v1alpha1_computeregionsslpolicy.yaml
+++ b/crds/compute_v1alpha1_computeregionsslpolicy.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computeaddress.yaml b/crds/compute_v1beta1_computeaddress.yaml
index 7e286716fd..943cfeff48 100644
--- a/crds/compute_v1beta1_computeaddress.yaml
+++ b/crds/compute_v1beta1_computeaddress.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computebackendbucket.yaml b/crds/compute_v1beta1_computebackendbucket.yaml
index 7d3f849f11..e6a9c26cbe 100644
--- a/crds/compute_v1beta1_computebackendbucket.yaml
+++ b/crds/compute_v1beta1_computebackendbucket.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computebackendservice.yaml b/crds/compute_v1beta1_computebackendservice.yaml
index 3240b2d371..752ad80e4c 100644
--- a/crds/compute_v1beta1_computebackendservice.yaml
+++ b/crds/compute_v1beta1_computebackendservice.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computedisk.yaml b/crds/compute_v1beta1_computedisk.yaml
index 13dd11adbb..5ddd988c43 100644
--- a/crds/compute_v1beta1_computedisk.yaml
+++ b/crds/compute_v1beta1_computedisk.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computeexternalvpngateway.yaml b/crds/compute_v1beta1_computeexternalvpngateway.yaml
index a2192ea020..da98241329 100644
--- a/crds/compute_v1beta1_computeexternalvpngateway.yaml
+++ b/crds/compute_v1beta1_computeexternalvpngateway.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computefirewall.yaml b/crds/compute_v1beta1_computefirewall.yaml
index e5bd566c50..c6a954a650 100644
--- a/crds/compute_v1beta1_computefirewall.yaml
+++ b/crds/compute_v1beta1_computefirewall.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computefirewallpolicy.yaml b/crds/compute_v1beta1_computefirewallpolicy.yaml
index a3c9d3411f..9e9e1a6c17 100644
--- a/crds/compute_v1beta1_computefirewallpolicy.yaml
+++ b/crds/compute_v1beta1_computefirewallpolicy.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
@@ -206,7 +206,7 @@ spec:
                 type: integer
               ruleTupleCount:
                 description: Total count of all firewall policy rule tuples. A firewall
-                  policy cannot exceed a set number of tuples.
+                  policy can not exceed a set number of tuples.
                 format: int64
                 type: integer
               selfLink:
diff --git a/crds/compute_v1beta1_computefirewallpolicyassociation.yaml b/crds/compute_v1beta1_computefirewallpolicyassociation.yaml
index ff69d238a0..ba31e9efe7 100644
--- a/crds/compute_v1beta1_computefirewallpolicyassociation.yaml
+++ b/crds/compute_v1beta1_computefirewallpolicyassociation.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/compute_v1beta1_computefirewallpolicyrule.yaml b/crds/compute_v1beta1_computefirewallpolicyrule.yaml
index 6cbd659780..98715d5813 100644
--- a/crds/compute_v1beta1_computefirewallpolicyrule.yaml
+++ b/crds/compute_v1beta1_computefirewallpolicyrule.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,10 +16,9 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
-    cnrm.cloud.google.com/dcl2crd: "true"
     cnrm.cloud.google.com/managed-by-kcc: "true"
     cnrm.cloud.google.com/stability-level: stable
     cnrm.cloud.google.com/system: "true"
@@ -115,14 +114,14 @@ spec:
                 properties:
                   external:
                     description: A reference to an externally managed ComputeFirewallPolicy
-                      resource. Should be in the format `locations/global/firewallPolicies/<firewallPolicy>`.
+                      resource. Should be in the format `locations/global/firewallPolicies/{{firewallPolicyID}}`.
                     type: string
                   name:
-                    description: The `name` field of a `ComputeFirewall olicy ` resource.
+                    description: The `name` field of a `ComputeFirewallPolicy` resource.
                     type: string
                   namespace:
-                    description: The `namespace` field of a `ComputeFirewallPolicy
-                      ` resource.
+                    description: The `namespace` field of a `ComputeFirewallPolicy`
+                      resource.
                     type: string
                 type: object
               match:
@@ -249,7 +248,7 @@ spec:
                   properties:
                     external:
                       description: A reference to an externally managed Compute Network
-                        resource. Should be in the format `projects/<projectID>/global/networks/<network>`.
+                        resource. Should be in the format `projects/{{projectID}}/global/networks/{{network}}`.
                       type: string
                     name:
                       description: The `name` field of a `ComputeNetwork` resource.
diff --git a/crds/compute_v1beta1_computeforwardingrule.yaml b/crds/compute_v1beta1_computeforwardingrule.yaml
index d0dee404b8..ae2be380e9 100644
--- a/crds/compute_v1beta1_computeforwardingrule.yaml
+++ b/crds/compute_v1beta1_computeforwardingrule.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -319,7 +319,7 @@ spec:
                 properties:
                   external:
                     description: A reference to an externally managed Compute Network
-                      resource. Should be in the format `projects/<projectID>/global/networks/<network>`.
+                      resource. Should be in the format `projects/{{projectID}}/global/networks/{{network}}`.
                     type: string
                   name:
                     description: The `name` field of a `ComputeNetwork` resource.
diff --git a/crds/compute_v1beta1_computehealthcheck.yaml b/crds/compute_v1beta1_computehealthcheck.yaml
index 1ab4b44e12..4fde656c63 100644
--- a/crds/compute_v1beta1_computehealthcheck.yaml
+++ b/crds/compute_v1beta1_computehealthcheck.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computehttphealthcheck.yaml b/crds/compute_v1beta1_computehttphealthcheck.yaml
index 434181690f..9d260fb8ba 100644
--- a/crds/compute_v1beta1_computehttphealthcheck.yaml
+++ b/crds/compute_v1beta1_computehttphealthcheck.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computehttpshealthcheck.yaml b/crds/compute_v1beta1_computehttpshealthcheck.yaml
index 5dc82e1abb..1e254c0c38 100644
--- a/crds/compute_v1beta1_computehttpshealthcheck.yaml
+++ b/crds/compute_v1beta1_computehttpshealthcheck.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computeimage.yaml b/crds/compute_v1beta1_computeimage.yaml
index c57f144c09..28cdd59733 100644
--- a/crds/compute_v1beta1_computeimage.yaml
+++ b/crds/compute_v1beta1_computeimage.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computeinstance.yaml b/crds/compute_v1beta1_computeinstance.yaml
index 923c6b8e8a..46b017c6a6 100644
--- a/crds/compute_v1beta1_computeinstance.yaml
+++ b/crds/compute_v1beta1_computeinstance.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computeinstancegroup.yaml b/crds/compute_v1beta1_computeinstancegroup.yaml
index 2a5f90b3da..c7754fb409 100644
--- a/crds/compute_v1beta1_computeinstancegroup.yaml
+++ b/crds/compute_v1beta1_computeinstancegroup.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computeinstancegroupmanager.yaml b/crds/compute_v1beta1_computeinstancegroupmanager.yaml
index 995d6e4842..0f404610e5 100644
--- a/crds/compute_v1beta1_computeinstancegroupmanager.yaml
+++ b/crds/compute_v1beta1_computeinstancegroupmanager.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/compute_v1beta1_computeinstancetemplate.yaml b/crds/compute_v1beta1_computeinstancetemplate.yaml
index 5dbdc71dd3..63d02fcb35 100644
--- a/crds/compute_v1beta1_computeinstancetemplate.yaml
+++ b/crds/compute_v1beta1_computeinstancetemplate.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computeinterconnectattachment.yaml b/crds/compute_v1beta1_computeinterconnectattachment.yaml
index f1d5d7b485..7f38576a98 100644
--- a/crds/compute_v1beta1_computeinterconnectattachment.yaml
+++ b/crds/compute_v1beta1_computeinterconnectattachment.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computemanagedsslcertificate.yaml b/crds/compute_v1beta1_computemanagedsslcertificate.yaml
index 4d5319d49d..4f537b4e22 100644
--- a/crds/compute_v1beta1_computemanagedsslcertificate.yaml
+++ b/crds/compute_v1beta1_computemanagedsslcertificate.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computenetwork.yaml b/crds/compute_v1beta1_computenetwork.yaml
index e765e97689..71244f6327 100644
--- a/crds/compute_v1beta1_computenetwork.yaml
+++ b/crds/compute_v1beta1_computenetwork.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computenetworkendpointgroup.yaml b/crds/compute_v1beta1_computenetworkendpointgroup.yaml
index 05c0c29b1e..e63e0b70ec 100644
--- a/crds/compute_v1beta1_computenetworkendpointgroup.yaml
+++ b/crds/compute_v1beta1_computenetworkendpointgroup.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computenetworkfirewallpolicy.yaml b/crds/compute_v1beta1_computenetworkfirewallpolicy.yaml
index 9742d39f7e..9a8612ced7 100644
--- a/crds/compute_v1beta1_computenetworkfirewallpolicy.yaml
+++ b/crds/compute_v1beta1_computenetworkfirewallpolicy.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -158,7 +158,7 @@ spec:
                 type: integer
               ruleTupleCount:
                 description: Total count of all firewall policy rule tuples. A firewall
-                  policy cannot exceed a set number of tuples.
+                  policy can not exceed a set number of tuples.
                 type: integer
               selfLink:
                 description: Server-defined URL for the resource.
diff --git a/crds/compute_v1beta1_computenetworkfirewallpolicyassociation.yaml b/crds/compute_v1beta1_computenetworkfirewallpolicyassociation.yaml
index 934798ae97..0010f16bde 100644
--- a/crds/compute_v1beta1_computenetworkfirewallpolicyassociation.yaml
+++ b/crds/compute_v1beta1_computenetworkfirewallpolicyassociation.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computenetworkpeering.yaml b/crds/compute_v1beta1_computenetworkpeering.yaml
index fad188386c..d6c1e577b0 100644
--- a/crds/compute_v1beta1_computenetworkpeering.yaml
+++ b/crds/compute_v1beta1_computenetworkpeering.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computenodegroup.yaml b/crds/compute_v1beta1_computenodegroup.yaml
index 379924d09a..3d9528f196 100644
--- a/crds/compute_v1beta1_computenodegroup.yaml
+++ b/crds/compute_v1beta1_computenodegroup.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computenodetemplate.yaml b/crds/compute_v1beta1_computenodetemplate.yaml
index 193c5687a0..d787493b13 100644
--- a/crds/compute_v1beta1_computenodetemplate.yaml
+++ b/crds/compute_v1beta1_computenodetemplate.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computepacketmirroring.yaml b/crds/compute_v1beta1_computepacketmirroring.yaml
index 6ea8d7a98a..a91beb7504 100644
--- a/crds/compute_v1beta1_computepacketmirroring.yaml
+++ b/crds/compute_v1beta1_computepacketmirroring.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/compute_v1beta1_computeprojectmetadata.yaml b/crds/compute_v1beta1_computeprojectmetadata.yaml
index 1de3aa69d8..e4d6137500 100644
--- a/crds/compute_v1beta1_computeprojectmetadata.yaml
+++ b/crds/compute_v1beta1_computeprojectmetadata.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computeregionnetworkendpointgroup.yaml b/crds/compute_v1beta1_computeregionnetworkendpointgroup.yaml
index 44a2708f38..408d386957 100644
--- a/crds/compute_v1beta1_computeregionnetworkendpointgroup.yaml
+++ b/crds/compute_v1beta1_computeregionnetworkendpointgroup.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computereservation.yaml b/crds/compute_v1beta1_computereservation.yaml
index 35709a7b18..b1baab1f1c 100644
--- a/crds/compute_v1beta1_computereservation.yaml
+++ b/crds/compute_v1beta1_computereservation.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computeresourcepolicy.yaml b/crds/compute_v1beta1_computeresourcepolicy.yaml
index df3443b437..5db9117471 100644
--- a/crds/compute_v1beta1_computeresourcepolicy.yaml
+++ b/crds/compute_v1beta1_computeresourcepolicy.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computeroute.yaml b/crds/compute_v1beta1_computeroute.yaml
index 48ea0b91be..37d936fbcd 100644
--- a/crds/compute_v1beta1_computeroute.yaml
+++ b/crds/compute_v1beta1_computeroute.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computerouter.yaml b/crds/compute_v1beta1_computerouter.yaml
index 7930b9cc42..0fccebccff 100644
--- a/crds/compute_v1beta1_computerouter.yaml
+++ b/crds/compute_v1beta1_computerouter.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computerouterinterface.yaml b/crds/compute_v1beta1_computerouterinterface.yaml
index fe1d7ba54a..a1d5f21ecd 100644
--- a/crds/compute_v1beta1_computerouterinterface.yaml
+++ b/crds/compute_v1beta1_computerouterinterface.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computerouternat.yaml b/crds/compute_v1beta1_computerouternat.yaml
index fab10fbf12..65c1489f70 100644
--- a/crds/compute_v1beta1_computerouternat.yaml
+++ b/crds/compute_v1beta1_computerouternat.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computerouterpeer.yaml b/crds/compute_v1beta1_computerouterpeer.yaml
index 9fac6f158d..8070ca4a31 100644
--- a/crds/compute_v1beta1_computerouterpeer.yaml
+++ b/crds/compute_v1beta1_computerouterpeer.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computesecuritypolicy.yaml b/crds/compute_v1beta1_computesecuritypolicy.yaml
index de1a2c3611..93f682f551 100644
--- a/crds/compute_v1beta1_computesecuritypolicy.yaml
+++ b/crds/compute_v1beta1_computesecuritypolicy.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computeserviceattachment.yaml b/crds/compute_v1beta1_computeserviceattachment.yaml
index cff31970b1..6a54565a2d 100644
--- a/crds/compute_v1beta1_computeserviceattachment.yaml
+++ b/crds/compute_v1beta1_computeserviceattachment.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/compute_v1beta1_computesharedvpchostproject.yaml b/crds/compute_v1beta1_computesharedvpchostproject.yaml
index e59af35d2c..7e09daf495 100644
--- a/crds/compute_v1beta1_computesharedvpchostproject.yaml
+++ b/crds/compute_v1beta1_computesharedvpchostproject.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computesharedvpcserviceproject.yaml b/crds/compute_v1beta1_computesharedvpcserviceproject.yaml
index 35efcc5c1e..b7da413997 100644
--- a/crds/compute_v1beta1_computesharedvpcserviceproject.yaml
+++ b/crds/compute_v1beta1_computesharedvpcserviceproject.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computesnapshot.yaml b/crds/compute_v1beta1_computesnapshot.yaml
index 8f93f5f7ca..f75b1075b3 100644
--- a/crds/compute_v1beta1_computesnapshot.yaml
+++ b/crds/compute_v1beta1_computesnapshot.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computesslcertificate.yaml b/crds/compute_v1beta1_computesslcertificate.yaml
index 621be78862..dcf3d55c9c 100644
--- a/crds/compute_v1beta1_computesslcertificate.yaml
+++ b/crds/compute_v1beta1_computesslcertificate.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computesslpolicy.yaml b/crds/compute_v1beta1_computesslpolicy.yaml
index e6bf958797..280c014bef 100644
--- a/crds/compute_v1beta1_computesslpolicy.yaml
+++ b/crds/compute_v1beta1_computesslpolicy.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computesubnetwork.yaml b/crds/compute_v1beta1_computesubnetwork.yaml
index ea38ad043a..10e7e60dcb 100644
--- a/crds/compute_v1beta1_computesubnetwork.yaml
+++ b/crds/compute_v1beta1_computesubnetwork.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computetargetgrpcproxy.yaml b/crds/compute_v1beta1_computetargetgrpcproxy.yaml
index de4cde0516..26f5ce4bd1 100644
--- a/crds/compute_v1beta1_computetargetgrpcproxy.yaml
+++ b/crds/compute_v1beta1_computetargetgrpcproxy.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computetargethttpproxy.yaml b/crds/compute_v1beta1_computetargethttpproxy.yaml
index a89573c927..cd311c95bd 100644
--- a/crds/compute_v1beta1_computetargethttpproxy.yaml
+++ b/crds/compute_v1beta1_computetargethttpproxy.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computetargethttpsproxy.yaml b/crds/compute_v1beta1_computetargethttpsproxy.yaml
index 5027e5ecef..a6deadab44 100644
--- a/crds/compute_v1beta1_computetargethttpsproxy.yaml
+++ b/crds/compute_v1beta1_computetargethttpsproxy.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computetargetinstance.yaml b/crds/compute_v1beta1_computetargetinstance.yaml
index fc85504305..3e2c7725cb 100644
--- a/crds/compute_v1beta1_computetargetinstance.yaml
+++ b/crds/compute_v1beta1_computetargetinstance.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computetargetpool.yaml b/crds/compute_v1beta1_computetargetpool.yaml
index 784a2e7cb3..8462d7ce88 100644
--- a/crds/compute_v1beta1_computetargetpool.yaml
+++ b/crds/compute_v1beta1_computetargetpool.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computetargetsslproxy.yaml b/crds/compute_v1beta1_computetargetsslproxy.yaml
index 85f3580f19..cc37324e23 100644
--- a/crds/compute_v1beta1_computetargetsslproxy.yaml
+++ b/crds/compute_v1beta1_computetargetsslproxy.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computetargettcpproxy.yaml b/crds/compute_v1beta1_computetargettcpproxy.yaml
index ec268c8222..28d5e3e2c3 100644
--- a/crds/compute_v1beta1_computetargettcpproxy.yaml
+++ b/crds/compute_v1beta1_computetargettcpproxy.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -129,12 +129,9 @@ spec:
                   ["NONE", "PROXY_V1"].'
                 type: string
               resourceID:
-                description: Immutable. The ComputeTargetTCPProxy name. If not given,
-                  the metadata.name will be used.
+                description: The ComputeTargetTCPProxy name. If not given, the metadata.name
+                  will be used.
                 type: string
-                x-kubernetes-validations:
-                - message: ResourceID is immutable
-                  rule: self == oldSelf
             required:
             - backendServiceRef
             type: object
diff --git a/crds/compute_v1beta1_computetargetvpngateway.yaml b/crds/compute_v1beta1_computetargetvpngateway.yaml
index 37b06519f8..ba7cb260c3 100644
--- a/crds/compute_v1beta1_computetargetvpngateway.yaml
+++ b/crds/compute_v1beta1_computetargetvpngateway.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computeurlmap.yaml b/crds/compute_v1beta1_computeurlmap.yaml
index f08c16618b..63400465ff 100644
--- a/crds/compute_v1beta1_computeurlmap.yaml
+++ b/crds/compute_v1beta1_computeurlmap.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -1952,7 +1952,7 @@ spec:
                                   type: array
                                 ignoreCase:
                                   description: |-
-                                    Specifies that prefixMatch and fullPathMatch matches are case-sensitive.
+                                    Specifies that prefixMatch and fullPathMatch matches are case sensitive.
                                     Defaults to false.
                                   type: boolean
                                 metadataFilters:
diff --git a/crds/compute_v1beta1_computevpngateway.yaml b/crds/compute_v1beta1_computevpngateway.yaml
index 05b1bf8636..39b1294462 100644
--- a/crds/compute_v1beta1_computevpngateway.yaml
+++ b/crds/compute_v1beta1_computevpngateway.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/compute_v1beta1_computevpntunnel.yaml b/crds/compute_v1beta1_computevpntunnel.yaml
index de282bb1c6..453a2c2dcb 100644
--- a/crds/compute_v1beta1_computevpntunnel.yaml
+++ b/crds/compute_v1beta1_computevpntunnel.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/configcontroller_v1beta1_configcontrollerinstance.yaml b/crds/configcontroller_v1beta1_configcontrollerinstance.yaml
index 29379ec6e8..8faf23ebe0 100644
--- a/crds/configcontroller_v1beta1_configcontrollerinstance.yaml
+++ b/crds/configcontroller_v1beta1_configcontrollerinstance.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/container_v1beta1_containercluster.yaml b/crds/container_v1beta1_containercluster.yaml
index 786e8a2984..d283ebf04b 100644
--- a/crds/container_v1beta1_containercluster.yaml
+++ b/crds/container_v1beta1_containercluster.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -1491,7 +1491,7 @@ spec:
                         properties:
                           eventType:
                             description: Can be used to filter what notifications
-                              are sent. Valid values include UPGRADE_AVAILABLE_EVENT,
+                              are sent. Valid values include include UPGRADE_AVAILABLE_EVENT,
                               UPGRADE_EVENT and SECURITY_BULLETIN_EVENT.
                             items:
                               type: string
@@ -1716,7 +1716,7 @@ spec:
                   field will not be blocked.
                 properties:
                   enabled:
-                    description: When enabled, services with external ips specified
+                    description: When enabled, services with exterenal ips specified
                       will be allowed.
                     type: boolean
                 required:
diff --git a/crds/container_v1beta1_containernodepool.yaml b/crds/container_v1beta1_containernodepool.yaml
index 44ce265e59..f204f21a06 100644
--- a/crds/container_v1beta1_containernodepool.yaml
+++ b/crds/container_v1beta1_containernodepool.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/containeranalysis_v1alpha1_containeranalysisoccurrence.yaml b/crds/containeranalysis_v1alpha1_containeranalysisoccurrence.yaml
index a06271bc55..200e9a8434 100644
--- a/crds/containeranalysis_v1alpha1_containeranalysisoccurrence.yaml
+++ b/crds/containeranalysis_v1alpha1_containeranalysisoccurrence.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/containeranalysis_v1beta1_containeranalysisnote.yaml b/crds/containeranalysis_v1beta1_containeranalysisnote.yaml
index 7a7471d904..8014df56f9 100644
--- a/crds/containeranalysis_v1beta1_containeranalysisnote.yaml
+++ b/crds/containeranalysis_v1beta1_containeranalysisnote.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/containerattached_v1beta1_containerattachedcluster.yaml b/crds/containerattached_v1beta1_containerattachedcluster.yaml
index ac23ad0072..919573e9d9 100644
--- a/crds/containerattached_v1beta1_containerattachedcluster.yaml
+++ b/crds/containerattached_v1beta1_containerattachedcluster.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -283,12 +283,9 @@ spec:
                     type: string
                 type: object
               resourceID:
-                description: Immutable, Optional. The ContainerAttachedCluster name.
-                  If not given, the metadata.name will be used.
+                description: Optional. The ContainerAttachedCluster name. If not given,
+                  the metadata.name will be used.
                 type: string
-                x-kubernetes-validations:
-                - message: ResourceID field is immutable
-                  rule: self == oldSelf
             required:
             - distribution
             - fleet
diff --git a/crds/datacatalog_v1alpha1_datacatalogentry.yaml b/crds/datacatalog_v1alpha1_datacatalogentry.yaml
index fe609df924..0a06e68724 100644
--- a/crds/datacatalog_v1alpha1_datacatalogentry.yaml
+++ b/crds/datacatalog_v1alpha1_datacatalogentry.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -154,7 +154,7 @@ spec:
                 description: |-
                   This field indicates the entry's source system that Data Catalog does not integrate with.
                   userSpecifiedSystem strings must begin with a letter or underscore and can only contain letters, numbers,
-                  and underscores; are case-insensitive; must be at least 1 character and at most 64 characters long.
+                  and underscores; are case insensitive; must be at least 1 character and at most 64 characters long.
                 type: string
               userSpecifiedType:
                 description: |-
@@ -162,7 +162,7 @@ spec:
                   When creating an entry, users should check the enum values first, if nothing matches the entry
                   to be created, then provide a custom value, for example "my_special_type".
                   userSpecifiedType strings must begin with a letter or underscore and can only contain letters,
-                  numbers, and underscores; are case-insensitive; must be at least 1 character and at most 64 characters long.
+                  numbers, and underscores; are case insensitive; must be at least 1 character and at most 64 characters long.
                 type: string
             required:
             - entryGroup
diff --git a/crds/datacatalog_v1alpha1_datacatalogentrygroup.yaml b/crds/datacatalog_v1alpha1_datacatalogentrygroup.yaml
index 4aa32923c6..935e73af53 100644
--- a/crds/datacatalog_v1alpha1_datacatalogentrygroup.yaml
+++ b/crds/datacatalog_v1alpha1_datacatalogentrygroup.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/datacatalog_v1alpha1_datacatalogtag.yaml b/crds/datacatalog_v1alpha1_datacatalogtag.yaml
index 08ff3387e7..cec78ad568 100644
--- a/crds/datacatalog_v1alpha1_datacatalogtag.yaml
+++ b/crds/datacatalog_v1alpha1_datacatalogtag.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/datacatalog_v1alpha1_datacatalogtagtemplate.yaml b/crds/datacatalog_v1alpha1_datacatalogtagtemplate.yaml
index ecd0b057c8..fa042595f9 100644
--- a/crds/datacatalog_v1alpha1_datacatalogtagtemplate.yaml
+++ b/crds/datacatalog_v1alpha1_datacatalogtagtemplate.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/datacatalog_v1beta1_datacatalogpolicytag.yaml b/crds/datacatalog_v1beta1_datacatalogpolicytag.yaml
index cb7a59177d..536a14f867 100644
--- a/crds/datacatalog_v1beta1_datacatalogpolicytag.yaml
+++ b/crds/datacatalog_v1beta1_datacatalogpolicytag.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/datacatalog_v1beta1_datacatalogtaxonomy.yaml b/crds/datacatalog_v1beta1_datacatalogtaxonomy.yaml
index 3ebe555a96..fe554f8b3a 100644
--- a/crds/datacatalog_v1beta1_datacatalogtaxonomy.yaml
+++ b/crds/datacatalog_v1beta1_datacatalogtaxonomy.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/dataflow_v1beta1_dataflowflextemplatejob.yaml b/crds/dataflow_v1beta1_dataflowflextemplatejob.yaml
index c2480c35c3..f4452b806f 100644
--- a/crds/dataflow_v1beta1_dataflowflextemplatejob.yaml
+++ b/crds/dataflow_v1beta1_dataflowflextemplatejob.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -156,7 +156,7 @@ spec:
                 properties:
                   external:
                     description: A reference to an externally managed Compute Network
-                      resource. Should be in the format `projects/<projectID>/global/networks/<network>`.
+                      resource. Should be in the format `projects/{{projectID}}/global/networks/{{network}}`.
                     type: string
                   name:
                     description: The `name` field of a `ComputeNetwork` resource.
diff --git a/crds/dataflow_v1beta1_dataflowjob.yaml b/crds/dataflow_v1beta1_dataflowjob.yaml
index 9341bc08c1..bd28409023 100644
--- a/crds/dataflow_v1beta1_dataflowjob.yaml
+++ b/crds/dataflow_v1beta1_dataflowjob.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/dataform_v1beta1_dataformrepository.yaml b/crds/dataform_v1beta1_dataformrepository.yaml
index 54f604119f..140b13fdcb 100644
--- a/crds/dataform_v1beta1_dataformrepository.yaml
+++ b/crds/dataform_v1beta1_dataformrepository.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/datafusion_v1beta1_datafusioninstance.yaml b/crds/datafusion_v1beta1_datafusioninstance.yaml
index 012091758f..f896133daf 100644
--- a/crds/datafusion_v1beta1_datafusioninstance.yaml
+++ b/crds/datafusion_v1beta1_datafusioninstance.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/dataproc_v1beta1_dataprocautoscalingpolicy.yaml b/crds/dataproc_v1beta1_dataprocautoscalingpolicy.yaml
index 9550a28da6..d995100f65 100644
--- a/crds/dataproc_v1beta1_dataprocautoscalingpolicy.yaml
+++ b/crds/dataproc_v1beta1_dataprocautoscalingpolicy.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/dataproc_v1beta1_dataproccluster.yaml b/crds/dataproc_v1beta1_dataproccluster.yaml
index da41c54a2f..d7336afa2e 100644
--- a/crds/dataproc_v1beta1_dataproccluster.yaml
+++ b/crds/dataproc_v1beta1_dataproccluster.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/dataproc_v1beta1_dataprocworkflowtemplate.yaml b/crds/dataproc_v1beta1_dataprocworkflowtemplate.yaml
index 3271fef71e..4ee05be83c 100644
--- a/crds/dataproc_v1beta1_dataprocworkflowtemplate.yaml
+++ b/crds/dataproc_v1beta1_dataprocworkflowtemplate.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/datastore_v1alpha1_datastoreindex.yaml b/crds/datastore_v1alpha1_datastoreindex.yaml
index 5709a3f18a..83bd2c7c5d 100644
--- a/crds/datastore_v1alpha1_datastoreindex.yaml
+++ b/crds/datastore_v1alpha1_datastoreindex.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/datastream_v1alpha1_datastreamconnectionprofile.yaml b/crds/datastream_v1alpha1_datastreamconnectionprofile.yaml
index d78061c22d..14aa99f414 100644
--- a/crds/datastream_v1alpha1_datastreamconnectionprofile.yaml
+++ b/crds/datastream_v1alpha1_datastreamconnectionprofile.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/datastream_v1alpha1_datastreamprivateconnection.yaml b/crds/datastream_v1alpha1_datastreamprivateconnection.yaml
index 66f88bab18..538f25396e 100644
--- a/crds/datastream_v1alpha1_datastreamprivateconnection.yaml
+++ b/crds/datastream_v1alpha1_datastreamprivateconnection.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/datastream_v1alpha1_datastreamstream.yaml b/crds/datastream_v1alpha1_datastreamstream.yaml
index 555f038340..73b2e2eb95 100644
--- a/crds/datastream_v1alpha1_datastreamstream.yaml
+++ b/crds/datastream_v1alpha1_datastreamstream.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/deploymentmanager_v1alpha1_deploymentmanagerdeployment.yaml b/crds/deploymentmanager_v1alpha1_deploymentmanagerdeployment.yaml
index 8fa85fbedf..e980caedd6 100644
--- a/crds/deploymentmanager_v1alpha1_deploymentmanagerdeployment.yaml
+++ b/crds/deploymentmanager_v1alpha1_deploymentmanagerdeployment.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/dialogflow_v1alpha1_dialogflowagent.yaml b/crds/dialogflow_v1alpha1_dialogflowagent.yaml
index 856301f01b..8fd0a3768b 100644
--- a/crds/dialogflow_v1alpha1_dialogflowagent.yaml
+++ b/crds/dialogflow_v1alpha1_dialogflowagent.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/dialogflow_v1alpha1_dialogflowentitytype.yaml b/crds/dialogflow_v1alpha1_dialogflowentitytype.yaml
index 496be763bb..77b6579e4e 100644
--- a/crds/dialogflow_v1alpha1_dialogflowentitytype.yaml
+++ b/crds/dialogflow_v1alpha1_dialogflowentitytype.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/dialogflow_v1alpha1_dialogflowfulfillment.yaml b/crds/dialogflow_v1alpha1_dialogflowfulfillment.yaml
index ba735b3222..ea30614fdf 100644
--- a/crds/dialogflow_v1alpha1_dialogflowfulfillment.yaml
+++ b/crds/dialogflow_v1alpha1_dialogflowfulfillment.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/dialogflow_v1alpha1_dialogflowintent.yaml b/crds/dialogflow_v1alpha1_dialogflowintent.yaml
index 9913042ce3..0cd45b36c8 100644
--- a/crds/dialogflow_v1alpha1_dialogflowintent.yaml
+++ b/crds/dialogflow_v1alpha1_dialogflowintent.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/dialogflowcx_v1alpha1_dialogflowcxagent.yaml b/crds/dialogflowcx_v1alpha1_dialogflowcxagent.yaml
index e50d4df028..390323bb44 100644
--- a/crds/dialogflowcx_v1alpha1_dialogflowcxagent.yaml
+++ b/crds/dialogflowcx_v1alpha1_dialogflowcxagent.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/dialogflowcx_v1alpha1_dialogflowcxentitytype.yaml b/crds/dialogflowcx_v1alpha1_dialogflowcxentitytype.yaml
index 02a7fc824f..eac6ee47e9 100644
--- a/crds/dialogflowcx_v1alpha1_dialogflowcxentitytype.yaml
+++ b/crds/dialogflowcx_v1alpha1_dialogflowcxentitytype.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/dialogflowcx_v1alpha1_dialogflowcxflow.yaml b/crds/dialogflowcx_v1alpha1_dialogflowcxflow.yaml
index 44b36c307b..d04742187a 100644
--- a/crds/dialogflowcx_v1alpha1_dialogflowcxflow.yaml
+++ b/crds/dialogflowcx_v1alpha1_dialogflowcxflow.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -316,7 +316,7 @@ spec:
                   They are responsible for matching the user's first utterances in the flow.
                   They are inherited by every page's [transition routes][Page.transition_routes] and can support use cases such as the user saying "help" or "can I talk to a human?", which can be handled in a common way regardless of the current page. Transition routes defined in the page have higher priority than those defined in the flow.
 
-                  TransitionRoutes are evaluated in the following order:
+                  TransitionRoutes are evalauted in the following order:
                     TransitionRoutes with intent specified.
                     TransitionRoutes with only condition specified.
                     TransitionRoutes with intent specified are inherited by pages in the flow.
diff --git a/crds/dialogflowcx_v1alpha1_dialogflowcxintent.yaml b/crds/dialogflowcx_v1alpha1_dialogflowcxintent.yaml
index a753c7db4e..1c6b5537f5 100644
--- a/crds/dialogflowcx_v1alpha1_dialogflowcxintent.yaml
+++ b/crds/dialogflowcx_v1alpha1_dialogflowcxintent.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/dialogflowcx_v1alpha1_dialogflowcxpage.yaml b/crds/dialogflowcx_v1alpha1_dialogflowcxpage.yaml
index 0ad67fcc28..43008e9221 100644
--- a/crds/dialogflowcx_v1alpha1_dialogflowcxpage.yaml
+++ b/crds/dialogflowcx_v1alpha1_dialogflowcxpage.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -861,7 +861,7 @@ spec:
               transitionRoutes:
                 description: |-
                   A list of transitions for the transition rules of this page. They route the conversation to another page in the same flow, or another flow.
-                  When we are in a certain page, the TransitionRoutes are evaluated in the following order:
+                  When we are in a certain page, the TransitionRoutes are evalauted in the following order:
                   TransitionRoutes defined in the page with intent specified.
                   TransitionRoutes defined in the transition route groups with intent specified.
                   TransitionRoutes defined in flow with intent specified.
diff --git a/crds/dialogflowcx_v1alpha1_dialogflowcxwebhook.yaml b/crds/dialogflowcx_v1alpha1_dialogflowcxwebhook.yaml
index 74e20230bb..859a322d1f 100644
--- a/crds/dialogflowcx_v1alpha1_dialogflowcxwebhook.yaml
+++ b/crds/dialogflowcx_v1alpha1_dialogflowcxwebhook.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/discoveryengine_v1alpha1_discoveryenginedatastore.yaml b/crds/discoveryengine_v1alpha1_discoveryenginedatastore.yaml
index 23d0961571..ebf8129a01 100644
--- a/crds/discoveryengine_v1alpha1_discoveryenginedatastore.yaml
+++ b/crds/discoveryengine_v1alpha1_discoveryenginedatastore.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -134,12 +134,9 @@ spec:
                     type: string
                 type: object
               resourceID:
-                description: Immutable. The DiscoveryEngineDataStore name. If not
-                  given, the metadata.name will be used.
+                description: The DiscoveryEngineDataStore name. If not given, the
+                  metadata.name will be used.
                 type: string
-                x-kubernetes-validations:
-                - message: ResourceID field is immutable
-                  rule: self == oldSelf
               solutionTypes:
                 description: |-
                   The solutions that the data store enrolls. Available solutions for each
@@ -255,7 +252,7 @@ spec:
                     type: string
                   defaultSchemaID:
                     description: Output only. The id of the default [Schema][google.cloud.discoveryengine.v1.Schema]
-                      asscociated to this data store.
+                      associated to this data store.
                     type: string
                 type: object
             type: object
diff --git a/crds/kms_v1alpha1_kmskeyhandle.yaml b/crds/discoveryengine_v1alpha1_discoveryenginedatastoretargetsite.yaml
similarity index 55%
rename from crds/kms_v1alpha1_kmskeyhandle.yaml
rename to crds/discoveryengine_v1alpha1_discoveryenginedatastoretargetsite.yaml
index 645568b3f9..afec59378f 100644
--- a/crds/kms_v1alpha1_kmskeyhandle.yaml
+++ b/crds/discoveryengine_v1alpha1_discoveryenginedatastoretargetsite.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,24 +16,24 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
     cnrm.cloud.google.com/system: "true"
-  name: kmskeyhandles.kms.cnrm.cloud.google.com
+  name: discoveryenginedatastoretargetsites.discoveryengine.cnrm.cloud.google.com
 spec:
-  group: kms.cnrm.cloud.google.com
+  group: discoveryengine.cnrm.cloud.google.com
   names:
     categories:
     - gcp
-    kind: KMSKeyHandle
-    listKind: KMSKeyHandleList
-    plural: kmskeyhandles
+    kind: DiscoveryEngineDataStoreTargetSite
+    listKind: DiscoveryEngineDataStoreTargetSiteList
+    plural: discoveryenginedatastoretargetsites
     shortNames:
-    - gcpkmskeyhandle
-    - gcpkmskeyhandles
-    singular: kmskeyhandle
+    - gcpdiscoveryenginedatastoretargetsite
+    - gcpdiscoveryenginedatastoretargetsites
+    singular: discoveryenginedatastoretargetsite
   scope: Namespaced
   versions:
   - additionalPrinterColumns:
@@ -55,7 +55,8 @@ spec:
     name: v1alpha1
     schema:
       openAPIV3Schema:
-        description: KMSKeyHandle is the Schema for the KMSKeyHandle API
+        description: DiscoveryEngineDataStoreTargetSite is the Schema for the DiscoveryEngineDataStoreTargetSite
+          API
         properties:
           apiVersion:
             description: 'APIVersion defines the versioned schema of this representation
@@ -70,13 +71,11 @@ spec:
           metadata:
             type: object
           spec:
-            description: KMSKeyHandleSpec defines the desired state of KMSKeyHandle
+            description: DiscoveryEngineDataStoreTargetSiteSpec defines the desired
+              state of DiscoveryEngineDataStoreTargetSite
             properties:
-              location:
-                description: Location name to create KeyHandle
-                type: string
-              projectRef:
-                description: Project hosting KMSKeyHandle
+              dataStoreRef:
+                description: The DataStore this target site should be part of.
                 oneOf:
                 - not:
                     required:
@@ -93,36 +92,37 @@ spec:
                   - external
                 properties:
                   external:
-                    description: The `projectID` field of a project, when not managed
-                      by Config Connector.
-                    type: string
-                  kind:
-                    description: The kind of the Project resource; optional but must
-                      be `Project` if provided.
+                    description: A reference to an externally managed DiscoveryEngineDataStore
+                      resource. Should be in the format "projects/{{projectID}}/locations/{{location}}/datastores/{{datastoreID}}".
                     type: string
                   name:
-                    description: The `name` field of a `Project` resource.
+                    description: The name of a DiscoveryEngineDataStore resource.
                     type: string
                   namespace:
-                    description: The `namespace` field of a `Project` resource.
+                    description: The namespace of a DiscoveryEngineDataStore resource.
                     type: string
                 type: object
-              resourceID:
-                description: Immutable. The KMSKeyHandle name. If not given, the metadata.name
-                  will be used.
+              exactMatch:
+                description: Input only. If set to false, a uri_pattern is generated
+                  to include all pages whose address contains the provided_uri_pattern.
+                  If set to true, an uri_pattern is generated to try to be an exact
+                  match of the provided_uri_pattern or just the specific page if the
+                  provided_uri_pattern is a specific one. provided_uri_pattern is
+                  always normalized to generate the URI pattern to be used by the
+                  search engine.
+                type: boolean
+              providedURIPattern:
+                description: Required. Input only. The user provided URI pattern from
+                  which the `generated_uri_pattern` is generated.
                 type: string
-                x-kubernetes-validations:
-                - message: ResourceID field is immutable
-                  rule: self == oldSelf
-              resourceTypeSelector:
-                description: Indicates the resource type that the resulting [CryptoKey][]
-                  is meant to protect, e.g. `{SERVICE}.googleapis.com/{TYPE}`. See
-                  documentation for supported resource types https://cloud.google.com/kms/docs/autokey-overview#compatible-services.
+              type:
+                description: The type of the target site, e.g., whether the site is
+                  to be included or excluded.
                 type: string
             type: object
           status:
-            description: KMSKeyHandleStatus defines the config connector machine state
-              of KMSKeyHandle
+            description: DiscoveryEngineDataStoreTargetSiteStatus defines the config
+              connector machine state of DiscoveryEngineDataStoreTargetSite
             properties:
               conditions:
                 description: Conditions represent the latest available observations
@@ -151,7 +151,8 @@ spec:
                   type: object
                 type: array
               externalRef:
-                description: A unique specifier for the KMSKeyHandle resource in GCP.
+                description: A unique specifier for the DiscoveryEngineDataStoreTargetSite
+                  resource in GCP.
                 type: string
               observedGeneration:
                 description: ObservedGeneration is the generation of the resource
@@ -165,7 +166,44 @@ spec:
                 description: ObservedState is the state of the resource as most recently
                   observed in GCP.
                 properties:
-                  kmsKey:
+                  failureReason:
+                    description: Output only. Failure reason.
+                    properties:
+                      quotaFailure:
+                        description: Failed due to insufficient quota.
+                        properties:
+                          totalRequiredQuota:
+                            description: This number is an estimation on how much
+                              total quota this project needs to successfully complete
+                              indexing.
+                            format: int64
+                            type: integer
+                        type: object
+                    type: object
+                  generatedURIPattern:
+                    description: Output only. This is system-generated based on the
+                      provided_uri.
+                    type: string
+                  indexingStatus:
+                    description: Output only. Indexing status.
+                    type: string
+                  rootDomainURI:
+                    description: Output only. Root domain of the provided_uri.
+                    type: string
+                  siteVerificationInfo:
+                    description: Output only. Site ownership and validity verification
+                      status.
+                    properties:
+                      siteVerificationState:
+                        description: Site verification state indicating the ownership
+                          and validity.
+                        type: string
+                      verifyTime:
+                        description: Latest site verification time.
+                        type: string
+                    type: object
+                  updateTime:
+                    description: Output only. The target site's last updated time.
                     type: string
                 type: object
             type: object
diff --git a/crds/discoveryengine_v1alpha1_discoveryengineengine.yaml b/crds/discoveryengine_v1alpha1_discoveryengineengine.yaml
new file mode 100644
index 0000000000..05cfddf159
--- /dev/null
+++ b/crds/discoveryengine_v1alpha1_discoveryengineengine.yaml
@@ -0,0 +1,327 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    cnrm.cloud.google.com/version: 1.128.0
+  creationTimestamp: null
+  labels:
+    cnrm.cloud.google.com/managed-by-kcc: "true"
+    cnrm.cloud.google.com/system: "true"
+  name: discoveryengineengines.discoveryengine.cnrm.cloud.google.com
+spec:
+  group: discoveryengine.cnrm.cloud.google.com
+  names:
+    categories:
+    - gcp
+    kind: DiscoveryEngineEngine
+    listKind: DiscoveryEngineEngineList
+    plural: discoveryengineengines
+    shortNames:
+    - gcpdiscoveryengineengine
+    - gcpdiscoveryengineengines
+    singular: discoveryengineengine
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    - description: When 'True', the most recent reconcile of the resource succeeded
+      jsonPath: .status.conditions[?(@.type=='Ready')].status
+      name: Ready
+      type: string
+    - description: The reason for the value in 'Ready'
+      jsonPath: .status.conditions[?(@.type=='Ready')].reason
+      name: Status
+      type: string
+    - description: The last transition time for the value in 'Status'
+      jsonPath: .status.conditions[?(@.type=='Ready')].lastTransitionTime
+      name: Status Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: DiscoveryEngineEngine is the Schema for the DiscoveryEngineEngine
+          API
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: DiscoveryEngineEngineSpec defines the desired state of DiscoveryEngineEngine
+            properties:
+              chatEngineConfig:
+                description: Configurations for the Chat Engine. Only applicable if
+                  solution_type is SOLUTION_TYPE_CHAT.
+                properties:
+                  agentCreationConfig:
+                    description: |-
+                      The configurationt generate the Dialogflow agent that is associated to
+                       this Engine.
+
+                       Note that these configurations are one-time consumed by
+                       and passed to Dialogflow service. It means they cannot be retrieved using
+                       [EngineService.GetEngine][google.cloud.discoveryengine.v1.EngineService.GetEngine]
+                       or
+                       [EngineService.ListEngines][google.cloud.discoveryengine.v1.EngineService.ListEngines]
+                       API after engine creation.
+                    properties:
+                      business:
+                        description: Name of the company, organization or other entity
+                          that the agent represents. Used for knowledge connector
+                          LLM prompt and for knowledge search.
+                        type: string
+                      defaultLanguageCode:
+                        description: Required. The default language of the agent as
+                          a language tag. See [Language Support](https://cloud.google.com/dialogflow/docs/reference/language)
+                          for a list of the currently supported language codes.
+                        type: string
+                      location:
+                        description: 'Agent location for Agent creation, supported
+                          values: global/us/eu. If not provided, us Engine will create
+                          Agent using us-central-1 by default; eu Engine will create
+                          Agent using eu-west-1 by default.'
+                        type: string
+                      timeZone:
+                        description: Required. The time zone of the agent from the
+                          [time zone database](https://www.iana.org/time-zones), e.g.,
+                          America/New_York, Europe/Paris.
+                        type: string
+                    type: object
+                  dialogflowAgentToLink:
+                    description: |-
+                      The resource name of an exist Dialogflow agent to link to this Chat
+                       Engine. Customers can either provide `agent_creation_config` to create
+                       agent or provide an agent name that links the agent with the Chat engine.
+
+                       Format: `projects/<Project ID>/locations/<Location ID>/agents/<Agent
+                       ID>`.
+
+                       Note that the `dialogflow_agent_to_link` are one-time consumed by and
+                       passed to Dialogflow service. It means they cannot be retrieved using
+                       [EngineService.GetEngine][google.cloud.discoveryengine.v1.EngineService.GetEngine]
+                       or
+                       [EngineService.ListEngines][google.cloud.discoveryengine.v1.EngineService.ListEngines]
+                       API after engine creation. Use
+                       [ChatEngineMetadata.dialogflow_agent][google.cloud.discoveryengine.v1.Engine.ChatEngineMetadata.dialogflow_agent]
+                       for actual agent association after Engine is created.
+                    type: string
+                type: object
+              collection:
+                description: Immutable. The collection for the Engine.
+                type: string
+              commonConfig:
+                description: Common config spec that specifies the metadata of the
+                  engine.
+                properties:
+                  companyName:
+                    description: The name of the company, business or entity that
+                      is associated with the engine. Setting this may help improve
+                      LLM related features.
+                    type: string
+                type: object
+              dataStoreRefs:
+                description: The data stores associated with this engine. For SOLUTION_TYPE_SEARCH
+                  and SOLUTION_TYPE_RECOMMENDATION type of engines, they can only
+                  associate with at most one data store. If solution_type is SOLUTION_TYPE_CHAT,
+                  multiple DataStores in the same Collection can be associated here.
+                  Note that when used in CreateEngineRequest, one DataStore must be
+                  provided as the system will use it for necessary initializations.
+                items:
+                  description: DiscoveryEngineDataStoreRef defines the resource reference
+                    to DiscoveryEngineDataStore, which "External" field holds the
+                    GCP identifier for the KRM object.
+                  oneOf:
+                  - not:
+                      required:
+                      - external
+                    required:
+                    - name
+                  - not:
+                      anyOf:
+                      - required:
+                        - name
+                      - required:
+                        - namespace
+                    required:
+                    - external
+                  properties:
+                    external:
+                      description: A reference to an externally managed DiscoveryEngineDataStore
+                        resource. Should be in the format "projects/{{projectID}}/locations/{{location}}/datastores/{{datastoreID}}".
+                      type: string
+                    name:
+                      description: The name of a DiscoveryEngineDataStore resource.
+                      type: string
+                    namespace:
+                      description: The namespace of a DiscoveryEngineDataStore resource.
+                      type: string
+                  type: object
+                type: array
+              disableAnalytics:
+                description: Optional. Whether to disable analytics for searches performed
+                  on this engine.
+                type: boolean
+              displayName:
+                description: Required. The display name of the engine. Should be human
+                  readable. UTF-8 encoded string with limit of 1024 characters.
+                type: string
+              industryVertical:
+                description: 'The industry vertical that the engine registers. The
+                  restriction of the Engine industry vertical is based on DataStore:
+                  If unspecified, default to `GENERIC`. Vertical on Engine has to
+                  match vertical of the DataStore linked to the engine.'
+                type: string
+              location:
+                description: Immutable. Location of the resource.
+                type: string
+              projectRef:
+                description: Immutable. The Project that this resource belongs to.
+                oneOf:
+                - not:
+                    required:
+                    - external
+                  required:
+                  - name
+                - not:
+                    anyOf:
+                    - required:
+                      - name
+                    - required:
+                      - namespace
+                  required:
+                  - external
+                properties:
+                  external:
+                    description: The `projectID` field of a project, when not managed
+                      by Config Connector.
+                    type: string
+                  kind:
+                    description: The kind of the Project resource; optional but must
+                      be `Project` if provided.
+                    type: string
+                  name:
+                    description: The `name` field of a `Project` resource.
+                    type: string
+                  namespace:
+                    description: The `namespace` field of a `Project` resource.
+                    type: string
+                type: object
+              resourceID:
+                description: Immutable. The DiscoveryEngineChatEngine name. If not
+                  given, the metadata.name will be used.
+                type: string
+              searchEngineConfig:
+                description: Configurations for the Search Engine. Only applicable
+                  if solution_type is SOLUTION_TYPE_SEARCH.
+                properties:
+                  searchAddOns:
+                    description: The add-on that this search engine enables.
+                    items:
+                      type: string
+                    type: array
+                  searchTier:
+                    description: |-
+                      The search feature tier of this engine.
+
+                       Different tiers might have different
+                       pricing. To learn more, check the pricing documentation.
+
+                       Defaults to
+                       [SearchTier.SEARCH_TIER_STANDARD][google.cloud.discoveryengine.v1.SearchTier.SEARCH_TIER_STANDARD]
+                       if not specified.
+                    type: string
+                type: object
+              solutionType:
+                description: Required. The solutions of the engine.
+                type: string
+            required:
+            - collection
+            - displayName
+            - location
+            - projectRef
+            - solutionType
+            type: object
+          status:
+            description: DiscoveryEngineEngineStatus defines the config connector
+              machine state of DiscoveryEngineEngine
+            properties:
+              conditions:
+                description: Conditions represent the latest available observations
+                  of the object's current state.
+                items:
+                  properties:
+                    lastTransitionTime:
+                      description: Last time the condition transitioned from one status
+                        to another.
+                      type: string
+                    message:
+                      description: Human-readable message indicating details about
+                        last transition.
+                      type: string
+                    reason:
+                      description: Unique, one-word, CamelCase reason for the condition's
+                        last transition.
+                      type: string
+                    status:
+                      description: Status is the status of the condition. Can be True,
+                        False, Unknown.
+                      type: string
+                    type:
+                      description: Type is the type of the condition.
+                      type: string
+                  type: object
+                type: array
+              externalRef:
+                description: A unique specifier for the DiscoveryEngineEngine resource
+                  in GCP.
+                type: string
+              observedGeneration:
+                description: ObservedGeneration is the generation of the resource
+                  that was most recently observed by the Config Connector controller.
+                  If this is equal to metadata.generation, then that means that the
+                  current reported status reflects the most recent desired state of
+                  the resource.
+                format: int64
+                type: integer
+              observedState:
+                description: ObservedState is the state of the resource as most recently
+                  observed in GCP.
+                type: object
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: null
+  storedVersions: null
diff --git a/crds/dlp_v1beta1_dlpdeidentifytemplate.yaml b/crds/dlp_v1beta1_dlpdeidentifytemplate.yaml
index 8d69ffa322..3796e485d9 100644
--- a/crds/dlp_v1beta1_dlpdeidentifytemplate.yaml
+++ b/crds/dlp_v1beta1_dlpdeidentifytemplate.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/dlp_v1beta1_dlpinspecttemplate.yaml b/crds/dlp_v1beta1_dlpinspecttemplate.yaml
index 81fdf82752..4e3c03ed01 100644
--- a/crds/dlp_v1beta1_dlpinspecttemplate.yaml
+++ b/crds/dlp_v1beta1_dlpinspecttemplate.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/dlp_v1beta1_dlpjobtrigger.yaml b/crds/dlp_v1beta1_dlpjobtrigger.yaml
index 9aa1c8d7b2..2590333128 100644
--- a/crds/dlp_v1beta1_dlpjobtrigger.yaml
+++ b/crds/dlp_v1beta1_dlpjobtrigger.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/dlp_v1beta1_dlpstoredinfotype.yaml b/crds/dlp_v1beta1_dlpstoredinfotype.yaml
index e2dce2f2d4..37282c7f59 100644
--- a/crds/dlp_v1beta1_dlpstoredinfotype.yaml
+++ b/crds/dlp_v1beta1_dlpstoredinfotype.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/dns_v1alpha1_dnsresponsepolicy.yaml b/crds/dns_v1alpha1_dnsresponsepolicy.yaml
index 6507f46ce0..78cab11652 100644
--- a/crds/dns_v1alpha1_dnsresponsepolicy.yaml
+++ b/crds/dns_v1alpha1_dnsresponsepolicy.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/dns_v1alpha1_dnsresponsepolicyrule.yaml b/crds/dns_v1alpha1_dnsresponsepolicyrule.yaml
index 097474505f..42caddfb62 100644
--- a/crds/dns_v1alpha1_dnsresponsepolicyrule.yaml
+++ b/crds/dns_v1alpha1_dnsresponsepolicyrule.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/dns_v1beta1_dnsmanagedzone.yaml b/crds/dns_v1beta1_dnsmanagedzone.yaml
index 71b032ba80..d0e84d58ac 100644
--- a/crds/dns_v1beta1_dnsmanagedzone.yaml
+++ b/crds/dns_v1beta1_dnsmanagedzone.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/dns_v1beta1_dnspolicy.yaml b/crds/dns_v1beta1_dnspolicy.yaml
index 0de7445a69..aa1fed9ed7 100644
--- a/crds/dns_v1beta1_dnspolicy.yaml
+++ b/crds/dns_v1beta1_dnspolicy.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/dns_v1beta1_dnsrecordset.yaml b/crds/dns_v1beta1_dnsrecordset.yaml
index 9187343e53..47ae20b827 100644
--- a/crds/dns_v1beta1_dnsrecordset.yaml
+++ b/crds/dns_v1beta1_dnsrecordset.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -110,7 +110,7 @@ spec:
                 type: string
               routingPolicy:
                 description: The configuration for steering traffic based on query.
-                  You can specify either Weighted Round Robin(WRR) type or Geolocation (GEO)
+                  You can specify either Weighted Round Robin(WRR) type or Geolocation(GEO)
                   type.
                 properties:
                   enableGeoFencing:
diff --git a/crds/documentai_v1alpha1_documentaiprocessor.yaml b/crds/documentai_v1alpha1_documentaiprocessor.yaml
index 36a2c26b1e..2ac00f563b 100644
--- a/crds/documentai_v1alpha1_documentaiprocessor.yaml
+++ b/crds/documentai_v1alpha1_documentaiprocessor.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/documentai_v1alpha1_documentaiprocessordefaultversion.yaml b/crds/documentai_v1alpha1_documentaiprocessordefaultversion.yaml
index 627dfcdd7c..79262b0cb2 100644
--- a/crds/documentai_v1alpha1_documentaiprocessordefaultversion.yaml
+++ b/crds/documentai_v1alpha1_documentaiprocessordefaultversion.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/edgecontainer_v1beta1_edgecontainercluster.yaml b/crds/edgecontainer_v1beta1_edgecontainercluster.yaml
index 4ed46b056a..5b41118158 100644
--- a/crds/edgecontainer_v1beta1_edgecontainercluster.yaml
+++ b/crds/edgecontainer_v1beta1_edgecontainercluster.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/edgecontainer_v1beta1_edgecontainernodepool.yaml b/crds/edgecontainer_v1beta1_edgecontainernodepool.yaml
index 370fdeff1a..a70f2872ca 100644
--- a/crds/edgecontainer_v1beta1_edgecontainernodepool.yaml
+++ b/crds/edgecontainer_v1beta1_edgecontainernodepool.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/edgecontainer_v1beta1_edgecontainervpnconnection.yaml b/crds/edgecontainer_v1beta1_edgecontainervpnconnection.yaml
index 4838cc33d8..9fee28d190 100644
--- a/crds/edgecontainer_v1beta1_edgecontainervpnconnection.yaml
+++ b/crds/edgecontainer_v1beta1_edgecontainervpnconnection.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/edgenetwork_v1beta1_edgenetworknetwork.yaml b/crds/edgenetwork_v1beta1_edgenetworknetwork.yaml
index e2cc8771a3..aee9970570 100644
--- a/crds/edgenetwork_v1beta1_edgenetworknetwork.yaml
+++ b/crds/edgenetwork_v1beta1_edgenetworknetwork.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/edgenetwork_v1beta1_edgenetworksubnet.yaml b/crds/edgenetwork_v1beta1_edgenetworksubnet.yaml
index ab36cab257..d04aa097a7 100644
--- a/crds/edgenetwork_v1beta1_edgenetworksubnet.yaml
+++ b/crds/edgenetwork_v1beta1_edgenetworksubnet.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/essentialcontacts_v1alpha1_essentialcontactscontact.yaml b/crds/essentialcontacts_v1alpha1_essentialcontactscontact.yaml
index 13802bf339..87bfcc5e66 100644
--- a/crds/essentialcontacts_v1alpha1_essentialcontactscontact.yaml
+++ b/crds/essentialcontacts_v1alpha1_essentialcontactscontact.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/eventarc_v1beta1_eventarctrigger.yaml b/crds/eventarc_v1beta1_eventarctrigger.yaml
index 92609f9378..4881f61283 100644
--- a/crds/eventarc_v1beta1_eventarctrigger.yaml
+++ b/crds/eventarc_v1beta1_eventarctrigger.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
@@ -246,7 +246,7 @@ spec:
                     description: An HTTP endpoint destination described by an URI.
                     properties:
                       uri:
-                        description: 'Required. The URI of the HTTP endpoint. The
+                        description: 'Required. The URI of the HTTP enpdoint. The
                           value must be a RFC2396 URI string. Examples: `http://10.10.10.8:80/route`,
                           `http://svc.us-central1.p.local:8080/`. Only HTTP and HTTPS
                           protocols are supported. The host can be either a static
diff --git a/crds/filestore_v1alpha1_filestoresnapshot.yaml b/crds/filestore_v1alpha1_filestoresnapshot.yaml
index 14f8d94c3b..b42e8dc662 100644
--- a/crds/filestore_v1alpha1_filestoresnapshot.yaml
+++ b/crds/filestore_v1alpha1_filestoresnapshot.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/filestore_v1beta1_filestorebackup.yaml b/crds/filestore_v1beta1_filestorebackup.yaml
index 7cb333b049..46e368585e 100644
--- a/crds/filestore_v1beta1_filestorebackup.yaml
+++ b/crds/filestore_v1beta1_filestorebackup.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/filestore_v1beta1_filestoreinstance.yaml b/crds/filestore_v1beta1_filestoreinstance.yaml
index 5d62eafbd4..c3d653c125 100644
--- a/crds/filestore_v1beta1_filestoreinstance.yaml
+++ b/crds/filestore_v1beta1_filestoreinstance.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/firebase_v1alpha1_firebaseandroidapp.yaml b/crds/firebase_v1alpha1_firebaseandroidapp.yaml
index 014801a186..91959b5259 100644
--- a/crds/firebase_v1alpha1_firebaseandroidapp.yaml
+++ b/crds/firebase_v1alpha1_firebaseandroidapp.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/firebase_v1alpha1_firebaseproject.yaml b/crds/firebase_v1alpha1_firebaseproject.yaml
index e18c95e739..fe95ba33f8 100644
--- a/crds/firebase_v1alpha1_firebaseproject.yaml
+++ b/crds/firebase_v1alpha1_firebaseproject.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/firebase_v1alpha1_firebasewebapp.yaml b/crds/firebase_v1alpha1_firebasewebapp.yaml
index 81182a2df5..d15a472a93 100644
--- a/crds/firebase_v1alpha1_firebasewebapp.yaml
+++ b/crds/firebase_v1alpha1_firebasewebapp.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/firebasedatabase_v1alpha1_firebasedatabaseinstance.yaml b/crds/firebasedatabase_v1alpha1_firebasedatabaseinstance.yaml
index 856c70ec4c..e371623a19 100644
--- a/crds/firebasedatabase_v1alpha1_firebasedatabaseinstance.yaml
+++ b/crds/firebasedatabase_v1alpha1_firebasedatabaseinstance.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/firebasehosting_v1alpha1_firebasehostingchannel.yaml b/crds/firebasehosting_v1alpha1_firebasehostingchannel.yaml
index 56d1082d22..77688ff292 100644
--- a/crds/firebasehosting_v1alpha1_firebasehostingchannel.yaml
+++ b/crds/firebasehosting_v1alpha1_firebasehostingchannel.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/firebasehosting_v1alpha1_firebasehostingsite.yaml b/crds/firebasehosting_v1alpha1_firebasehostingsite.yaml
index 389c1f8788..5e4e390c14 100644
--- a/crds/firebasehosting_v1alpha1_firebasehostingsite.yaml
+++ b/crds/firebasehosting_v1alpha1_firebasehostingsite.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/firebasestorage_v1alpha1_firebasestoragebucket.yaml b/crds/firebasestorage_v1alpha1_firebasestoragebucket.yaml
index 314d5f60e4..93fc891b9a 100644
--- a/crds/firebasestorage_v1alpha1_firebasestoragebucket.yaml
+++ b/crds/firebasestorage_v1alpha1_firebasestoragebucket.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/firestore_v1alpha1_firestoredatabase.yaml b/crds/firestore_v1beta1_firestoredatabase.yaml
similarity index 52%
rename from crds/firestore_v1alpha1_firestoredatabase.yaml
rename to crds/firestore_v1beta1_firestoredatabase.yaml
index b5711c4444..528b740867 100644
--- a/crds/firestore_v1alpha1_firestoredatabase.yaml
+++ b/crds/firestore_v1beta1_firestoredatabase.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -30,6 +30,9 @@ spec:
     kind: FirestoreDatabase
     listKind: FirestoreDatabaseList
     plural: firestoredatabases
+    shortNames:
+    - gcpfirestoredatabase
+    - gcpfirestoredatabases
     singular: firestoredatabase
   scope: Namespaced
   versions:
@@ -225,6 +228,201 @@ spec:
             type: object
         type: object
     served: true
+    storage: false
+    subresources:
+      status: {}
+  - additionalPrinterColumns:
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    - description: When 'True', the most recent reconcile of the resource succeeded
+      jsonPath: .status.conditions[?(@.type=='Ready')].status
+      name: Ready
+      type: string
+    - description: The reason for the value in 'Ready'
+      jsonPath: .status.conditions[?(@.type=='Ready')].reason
+      name: Status
+      type: string
+    - description: The last transition time for the value in 'Status'
+      jsonPath: .status.conditions[?(@.type=='Ready')].lastTransitionTime
+      name: Status Age
+      type: date
+    name: v1beta1
+    schema:
+      openAPIV3Schema:
+        description: FirestoreDatabase is the Schema for the FirestoreDatabase API
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: FirestoreDatabaseSpec defines the desired state of FirestoreDatabase
+            properties:
+              concurrencyMode:
+                description: The concurrency control mode to use for this database.
+                  See https://cloud.google.com/firestore/docs/reference/rest/v1/projects.databases#concurrencymode
+                  for more info.
+                type: string
+              locationID:
+                description: The location of the database. Available locations are
+                  listed at https://cloud.google.com/firestore/docs/locations.
+                type: string
+              pointInTimeRecoveryEnablement:
+                description: Whether to enable the PITR feature on this database.
+                  See https://cloud.google.com/firestore/docs/reference/rest/v1/projects.databases#pointintimerecoveryenablement
+                  for more info.
+                type: string
+              projectRef:
+                description: Immutable. The Project that this resource belongs to.
+                oneOf:
+                - not:
+                    required:
+                    - external
+                  required:
+                  - name
+                - not:
+                    anyOf:
+                    - required:
+                      - name
+                    - required:
+                      - namespace
+                  required:
+                  - external
+                properties:
+                  external:
+                    description: The `projectID` field of a project, when not managed
+                      by Config Connector.
+                    type: string
+                  kind:
+                    description: The kind of the Project resource; optional but must
+                      be `Project` if provided.
+                    type: string
+                  name:
+                    description: The `name` field of a `Project` resource.
+                    type: string
+                  namespace:
+                    description: The `namespace` field of a `Project` resource.
+                    type: string
+                type: object
+              resourceID:
+                description: The FirestoreDatabase name. If not given, the metadata.name
+                  will be used.
+                type: string
+            required:
+            - projectRef
+            type: object
+          status:
+            description: FirestoreDatabaseStatus defines the config connector machine
+              state of FirestoreDatabase
+            properties:
+              conditions:
+                description: Conditions represent the latest available observations
+                  of the object's current state.
+                items:
+                  properties:
+                    lastTransitionTime:
+                      description: Last time the condition transitioned from one status
+                        to another.
+                      type: string
+                    message:
+                      description: Human-readable message indicating details about
+                        last transition.
+                      type: string
+                    reason:
+                      description: Unique, one-word, CamelCase reason for the condition's
+                        last transition.
+                      type: string
+                    status:
+                      description: Status is the status of the condition. Can be True,
+                        False, Unknown.
+                      type: string
+                    type:
+                      description: Type is the type of the condition.
+                      type: string
+                  type: object
+                type: array
+              externalRef:
+                description: A unique specifier for the FirestoreDatabase resource
+                  in GCP.
+                type: string
+              observedGeneration:
+                description: ObservedGeneration is the generation of the resource
+                  that was most recently observed by the Config Connector controller.
+                  If this is equal to metadata.generation, then that means that the
+                  current reported status reflects the most recent desired state of
+                  the resource.
+                format: int64
+                type: integer
+              observedState:
+                description: ObservedState is the state of the resource as most recently
+                  observed in GCP.
+                properties:
+                  createTime:
+                    description: Output only. The timestamp at which this database
+                      was created. Databases created before 2016 do not populate create_time.
+                    type: string
+                  earliestVersionTime:
+                    description: |-
+                      Output only. The earliest timestamp at which older versions of the data can
+                       be read from the database. See [version_retention_period] above; this field
+                       is populated with `now - version_retention_period`.
+
+                       This value is continuously updated, and becomes stale the moment it is
+                       queried. If you are using this value to recover data, make sure to account
+                       for the time from the moment when the value is queried to the moment when
+                       you initiate the recovery.
+                    type: string
+                  etag:
+                    description: This checksum is computed by the server based on
+                      the value of other fields, and may be sent on update and delete
+                      requests to ensure the client has an up-to-date value before
+                      proceeding.
+                    type: string
+                  keyPrefix:
+                    description: |-
+                      Output only. The key_prefix for this database. This key_prefix is used, in
+                       combination with the project id ("<key prefix>~<project id>") to construct
+                       the application id that is returned from the Cloud Datastore APIs in Google
+                       App Engine first generation runtimes.
+
+                       This value may be empty in which case the appid to use for URL-encoded keys
+                       is the project_id (eg: foo instead of v~foo).
+                    type: string
+                  uid:
+                    description: Output only. The system-generated UUID4 for this
+                      Database.
+                    type: string
+                  updateTime:
+                    description: Output only. The timestamp at which this database
+                      was most recently updated. Note this only includes updates to
+                      the database resource and not data contained by the database.
+                    type: string
+                  versionRetentionPeriod:
+                    description: |-
+                      Output only. The period during which past versions of data are retained in
+                       the database.
+
+                       Any [read][google.firestore.v1.GetDocumentRequest.read_time]
+                       or [query][google.firestore.v1.ListDocumentsRequest.read_time] can specify
+                       a `read_time` within this window, and will read the state of the database
+                       at that time.
+
+                       If the PITR feature is enabled, the retention period is 7 days. Otherwise,
+                       the retention period is 1 hour.
+                    type: string
+                type: object
+            type: object
+        type: object
+    served: true
     storage: true
     subresources:
       status: {}
diff --git a/crds/firestore_v1beta1_firestoreindex.yaml b/crds/firestore_v1beta1_firestoreindex.yaml
index 5202a17d96..b81bfb951f 100644
--- a/crds/firestore_v1beta1_firestoreindex.yaml
+++ b/crds/firestore_v1beta1_firestoreindex.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/gkebackup_v1alpha1_gkebackupbackupplan.yaml b/crds/gkebackup_v1alpha1_gkebackupbackupplan.yaml
index 7c8738d7a3..ed1e879568 100644
--- a/crds/gkebackup_v1alpha1_gkebackupbackupplan.yaml
+++ b/crds/gkebackup_v1alpha1_gkebackupbackupplan.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/gkehub_v1beta1_gkehubfeature.yaml b/crds/gkehub_v1beta1_gkehubfeature.yaml
index 8858208527..dae6136809 100644
--- a/crds/gkehub_v1beta1_gkehubfeature.yaml
+++ b/crds/gkehub_v1beta1_gkehubfeature.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/gkehub_v1beta1_gkehubfeaturemembership.yaml b/crds/gkehub_v1beta1_gkehubfeaturemembership.yaml
index c6a5fb3df9..37a3ace101 100644
--- a/crds/gkehub_v1beta1_gkehubfeaturemembership.yaml
+++ b/crds/gkehub_v1beta1_gkehubfeaturemembership.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,10 +16,9 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
-    cnrm.cloud.google.com/dcl2crd: "true"
     cnrm.cloud.google.com/managed-by-kcc: "true"
     cnrm.cloud.google.com/stability-level: stable
     cnrm.cloud.google.com/system: "true"
@@ -240,6 +239,12 @@ spec:
                         description: Specifies whether the Config Sync Repo is in
                           "hierarchical" or "unstructured" mode.
                         type: string
+                      stopSyncing:
+                        description: 'Set to true to stop syncing configurations for
+                          a single cluster. This field is only available on clusters
+                          using Config Sync auto-upgrades or on Config Sync version
+                          1.20.0 or later. Defaults: false.'
+                        type: boolean
                     type: object
                   hierarchyController:
                     description: Hierarchy Controller is no longer available. Use
@@ -257,6 +262,13 @@ spec:
                           cluster.
                         type: boolean
                     type: object
+                  management:
+                    description: Optional. Whether to automatically manage the configmanagement
+                      Feature. There are 3 accepted values. MANAGEMENT_UNSPECIFIED
+                      means that the mamangement mode is unspecified. MANAGEMENT_AUTOMATIC
+                      means that Google manages the Feature for the cluster. MANAGEMENT_MANUAL
+                      means that users should manage the Feature for the cluster.
+                    type: string
                   policyController:
                     description: '**DEPRECATED** Configuring Policy Controller through
                       the configmanagement feature is no longer recommended. Use the
diff --git a/crds/gkehub_v1beta1_gkehubmembership.yaml b/crds/gkehub_v1beta1_gkehubmembership.yaml
index 2cbe9a0553..0900913eda 100644
--- a/crds/gkehub_v1beta1_gkehubmembership.yaml
+++ b/crds/gkehub_v1beta1_gkehubmembership.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/healthcare_v1alpha1_healthcareconsentstore.yaml b/crds/healthcare_v1alpha1_healthcareconsentstore.yaml
index bcf882a43b..c86ca885a7 100644
--- a/crds/healthcare_v1alpha1_healthcareconsentstore.yaml
+++ b/crds/healthcare_v1alpha1_healthcareconsentstore.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/healthcare_v1alpha1_healthcaredataset.yaml b/crds/healthcare_v1alpha1_healthcaredataset.yaml
index 32a7d61d26..2d24e50bb4 100644
--- a/crds/healthcare_v1alpha1_healthcaredataset.yaml
+++ b/crds/healthcare_v1alpha1_healthcaredataset.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/healthcare_v1alpha1_healthcaredicomstore.yaml b/crds/healthcare_v1alpha1_healthcaredicomstore.yaml
index fdc2ed265b..d20e918826 100644
--- a/crds/healthcare_v1alpha1_healthcaredicomstore.yaml
+++ b/crds/healthcare_v1alpha1_healthcaredicomstore.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/healthcare_v1alpha1_healthcarefhirstore.yaml b/crds/healthcare_v1alpha1_healthcarefhirstore.yaml
index 9efdf3e6c4..e127befc6d 100644
--- a/crds/healthcare_v1alpha1_healthcarefhirstore.yaml
+++ b/crds/healthcare_v1alpha1_healthcarefhirstore.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -106,7 +106,7 @@ spec:
                 type: boolean
               disableResourceVersioning:
                 description: |-
-                  Immutable. Whether to disable resource versioning for this FHIR store. This field cannot be changed after the creation
+                  Immutable. Whether to disable resource versioning for this FHIR store. This field can not be changed after the creation
                   of FHIR store. If set to false, which is the default behavior, all write operations will cause historical
                   versions to be recorded automatically. The historical versions can be fetched through the history APIs, but
                   cannot be updated. If set to true, no historical versions will be kept. The server will send back errors for
diff --git a/crds/healthcare_v1alpha1_healthcarehl7v2store.yaml b/crds/healthcare_v1alpha1_healthcarehl7v2store.yaml
index 08dfb5870c..437a2ca70a 100644
--- a/crds/healthcare_v1alpha1_healthcarehl7v2store.yaml
+++ b/crds/healthcare_v1alpha1_healthcarehl7v2store.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/iam_v1beta1_iamaccessboundarypolicy.yaml b/crds/iam_v1beta1_iamaccessboundarypolicy.yaml
index 4e5f5e6444..71a9f244d3 100644
--- a/crds/iam_v1beta1_iamaccessboundarypolicy.yaml
+++ b/crds/iam_v1beta1_iamaccessboundarypolicy.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/iam_v1beta1_iamauditconfig.yaml b/crds/iam_v1beta1_iamauditconfig.yaml
index 1ab3a59ee5..da8a3168b2 100644
--- a/crds/iam_v1beta1_iamauditconfig.yaml
+++ b/crds/iam_v1beta1_iamauditconfig.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/iam_v1beta1_iamcustomrole.yaml b/crds/iam_v1beta1_iamcustomrole.yaml
index fb137c394a..b94a39392b 100644
--- a/crds/iam_v1beta1_iamcustomrole.yaml
+++ b/crds/iam_v1beta1_iamcustomrole.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/iam_v1beta1_iampartialpolicy.yaml b/crds/iam_v1beta1_iampartialpolicy.yaml
index c37bf5f0d2..8212cd7999 100644
--- a/crds/iam_v1beta1_iampartialpolicy.yaml
+++ b/crds/iam_v1beta1_iampartialpolicy.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -109,6 +109,8 @@ spec:
                               Exactly one of 'member' or 'memberFrom' must be used,
                               and only one subfield within 'memberFrom' can be used.
                             oneOf:
+                            - required:
+                              - bigQueryConnectionConnectionRef
                             - required:
                               - logSinkRef
                             - required:
@@ -118,6 +120,34 @@ spec:
                             - required:
                               - sqlInstanceRef
                             properties:
+                              bigQueryConnectionConnectionRef:
+                                description: BigQueryConnectionConnection whose service
+                                  account is to be bound to the role. Use the Type
+                                  field to specifie the connection type. For "spark"
+                                  connetion, the service account is in `status.observedState.spark.serviceAccountID`.
+                                  For "cloudSQL" connection, the service account is
+                                  in `status.observedState.cloudSQL.serviceAccountID`.
+                                  For "cloudResource" connection, the service account
+                                  is in `status.observedState.cloudResource.serviceAccountID`.
+                                properties:
+                                  name:
+                                    type: string
+                                  namespace:
+                                    type: string
+                                  type:
+                                    description: Type field specifies the connection
+                                      type of the BigQueryConnectionConnection resource,
+                                      whose service account is to be bound to the
+                                      role.
+                                    enum:
+                                    - spark
+                                    - cloudSQL
+                                    - cloudResource
+                                    type: string
+                                required:
+                                - name
+                                - type
+                                type: object
                               logSinkRef:
                                 description: The LoggingLogSink whose writer identity
                                   (i.e. its 'status.writerIdentity') is to be bound
diff --git a/crds/iam_v1beta1_iampolicy.yaml b/crds/iam_v1beta1_iampolicy.yaml
index 1bb97131bc..d890384f39 100644
--- a/crds/iam_v1beta1_iampolicy.yaml
+++ b/crds/iam_v1beta1_iampolicy.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/iam_v1beta1_iampolicymember.yaml b/crds/iam_v1beta1_iampolicymember.yaml
index c28a50da4c..00a5cb7114 100644
--- a/crds/iam_v1beta1_iampolicymember.yaml
+++ b/crds/iam_v1beta1_iampolicymember.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -98,6 +98,8 @@ spec:
                   Exactly one of 'member' or 'memberFrom' must be used, and only one
                   subfield within 'memberFrom' can be used.
                 oneOf:
+                - required:
+                  - bigQueryConnectionConnectionRef
                 - required:
                   - logSinkRef
                 - required:
@@ -107,6 +109,31 @@ spec:
                 - required:
                   - sqlInstanceRef
                 properties:
+                  bigQueryConnectionConnectionRef:
+                    description: BigQueryConnectionConnection whose service account
+                      is to be bound to the role. Use the Type field to specifie the
+                      connection type. For "spark" connetion, the service account
+                      is in `status.observedState.spark.serviceAccountID`. For "cloudSQL"
+                      connection, the service account is in `status.observedState.cloudSQL.serviceAccountID`.
+                      For "cloudResource" connection, the service account is in `status.observedState.cloudResource.serviceAccountID`.
+                    properties:
+                      name:
+                        type: string
+                      namespace:
+                        type: string
+                      type:
+                        description: Type field specifies the connection type of the
+                          BigQueryConnectionConnection resource, whose service account
+                          is to be bound to the role.
+                        enum:
+                        - spark
+                        - cloudSQL
+                        - cloudResource
+                        type: string
+                    required:
+                    - name
+                    - type
+                    type: object
                   logSinkRef:
                     description: The LoggingLogSink whose writer identity (i.e. its
                       'status.writerIdentity') is to be bound to the role.
diff --git a/crds/iam_v1beta1_iamserviceaccount.yaml b/crds/iam_v1beta1_iamserviceaccount.yaml
index ed32f603a4..13830e8c58 100644
--- a/crds/iam_v1beta1_iamserviceaccount.yaml
+++ b/crds/iam_v1beta1_iamserviceaccount.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/iam_v1beta1_iamserviceaccountkey.yaml b/crds/iam_v1beta1_iamserviceaccountkey.yaml
index 2fe4ac913c..fe3d71859a 100644
--- a/crds/iam_v1beta1_iamserviceaccountkey.yaml
+++ b/crds/iam_v1beta1_iamserviceaccountkey.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/iam_v1beta1_iamworkforcepool.yaml b/crds/iam_v1beta1_iamworkforcepool.yaml
index 0ba0a4d481..3c68bb12d0 100644
--- a/crds/iam_v1beta1_iamworkforcepool.yaml
+++ b/crds/iam_v1beta1_iamworkforcepool.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/iam_v1beta1_iamworkforcepoolprovider.yaml b/crds/iam_v1beta1_iamworkforcepoolprovider.yaml
index 21f5853af5..bcbd9d2a5f 100644
--- a/crds/iam_v1beta1_iamworkforcepoolprovider.yaml
+++ b/crds/iam_v1beta1_iamworkforcepoolprovider.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/iam_v1beta1_iamworkloadidentitypool.yaml b/crds/iam_v1beta1_iamworkloadidentitypool.yaml
index d32580c616..8faeaa55b2 100644
--- a/crds/iam_v1beta1_iamworkloadidentitypool.yaml
+++ b/crds/iam_v1beta1_iamworkloadidentitypool.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/iam_v1beta1_iamworkloadidentitypoolprovider.yaml b/crds/iam_v1beta1_iamworkloadidentitypoolprovider.yaml
index 2c04e902a1..088f8e2b77 100644
--- a/crds/iam_v1beta1_iamworkloadidentitypoolprovider.yaml
+++ b/crds/iam_v1beta1_iamworkloadidentitypoolprovider.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/iap_v1alpha1_iapsettings.yaml b/crds/iap_v1alpha1_iapsettings.yaml
new file mode 100644
index 0000000000..8b17437a78
--- /dev/null
+++ b/crds/iap_v1alpha1_iapsettings.yaml
@@ -0,0 +1,310 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    cnrm.cloud.google.com/version: 1.128.0
+  creationTimestamp: null
+  labels:
+    cnrm.cloud.google.com/managed-by-kcc: "true"
+    cnrm.cloud.google.com/system: "true"
+  name: iapsettings.iap.cnrm.cloud.google.com
+spec:
+  group: iap.cnrm.cloud.google.com
+  names:
+    categories:
+    - gcp
+    kind: IAPSettings
+    listKind: IAPSettingsList
+    plural: iapsettings
+    shortNames:
+    - gcpiapsettings
+    - gcpiapsettingss
+    singular: iapsettings
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    - description: When 'True', the most recent reconcile of the resource succeeded
+      jsonPath: .status.conditions[?(@.type=='Ready')].status
+      name: Ready
+      type: string
+    - description: The reason for the value in 'Ready'
+      jsonPath: .status.conditions[?(@.type=='Ready')].reason
+      name: Status
+      type: string
+    - description: The last transition time for the value in 'Status'
+      jsonPath: .status.conditions[?(@.type=='Ready')].lastTransitionTime
+      name: Status Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: IAPSettings is the Schema for the IAPSettings API
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: IAPSettingsSpec defines the desired state of IAPSettings
+            properties:
+              accessSettings:
+                description: Top level wrapper for all access related setting in IAP
+                properties:
+                  allowedDomainsSettings:
+                    description: Settings to configure and enable allowed domains.
+                    properties:
+                      domains:
+                        description: List of trusted domains.
+                        items:
+                          type: string
+                        type: array
+                      enable:
+                        description: Configuration for customers to opt in for the
+                          feature.
+                        type: boolean
+                    type: object
+                  corsSettings:
+                    description: Configuration to allow cross-origin requests via
+                      IAP.
+                    properties:
+                      allowHTTPOptions:
+                        description: Configuration to allow HTTP OPTIONS calls to
+                          skip authorization. If undefined, IAP will not apply any
+                          special logic to OPTIONS requests.
+                        type: boolean
+                    type: object
+                  gcipSettings:
+                    description: GCIP claims and endpoint configurations for 3p identity
+                      providers.
+                    properties:
+                      loginPageURI:
+                        description: Login page URI associated with the GCIP tenants.
+                          Typically, all resources within the same project share the
+                          same login page, though it could be overridden at the sub
+                          resource level.
+                        type: string
+                      tenantIds:
+                        description: GCIP tenant ids that are linked to the IAP resource.
+                          tenant_ids could be a string beginning with a number character
+                          to indicate authenticating with GCIP tenant flow, or in
+                          the format of _<ProjectNumber> to indicate authenticating
+                          with GCIP agent flow. If agent flow is used, tenant_ids
+                          should only contain one single element, while for tenant
+                          flow, tenant_ids can contain multiple elements.
+                        items:
+                          type: string
+                        type: array
+                    type: object
+                  oauthSettings:
+                    description: Settings to configure IAP's OAuth behavior.
+                    properties:
+                      loginHint:
+                        description: 'Domain hint to send as hd=? parameter in OAuth
+                          request flow. Enables redirect to primary IDP by skipping
+                          Google''s login screen. https://developers.google.com/identity/protocols/OpenIDConnect#hd-param
+                          Note: IAP does not verify that the id token''s hd claim
+                          matches this value since access behavior is managed by IAM
+                          policies.'
+                        type: string
+                      programmaticClients:
+                        description: List of OAuth client IDs allowed to programmatically
+                          authenticate with IAP.
+                        items:
+                          type: string
+                        type: array
+                    type: object
+                  reauthSettings:
+                    description: Settings to configure reauthentication policies in
+                      IAP.
+                    properties:
+                      maxAge:
+                        description: Reauth session lifetime, how long before a user
+                          has to reauthenticate again.
+                        type: string
+                      method:
+                        description: Reauth method requested.
+                        type: string
+                      policyType:
+                        description: How IAP determines the effective policy in cases
+                          of hierarchial policies. Policies are merged from higher
+                          in the hierarchy to lower in the hierarchy.
+                        type: string
+                    type: object
+                type: object
+              applicationSettings:
+                description: Top level wrapper for all application related settings
+                  in IAP
+                properties:
+                  accessDeniedPageSettings:
+                    description: Customization for Access Denied page.
+                    properties:
+                      accessDeniedPageURI:
+                        description: The URI to be redirected to when access is denied.
+                        type: string
+                      generateTroubleshootingURI:
+                        description: Whether to generate a troubleshooting URL on
+                          access denied events to this application.
+                        type: boolean
+                      remediationTokenGenerationEnabled:
+                        description: Whether to generate remediation token on access
+                          denied events to this application.
+                        type: boolean
+                    type: object
+                  attributePropagationSettings:
+                    description: Settings to configure attribute propagation.
+                    properties:
+                      enable:
+                        description: Whether the provided attribute propagation settings
+                          should be evaluated on user requests. If set to true, attributes
+                          returned from the expression will be propagated in the set
+                          output credentials.
+                        type: boolean
+                      expression:
+                        description: |-
+                          Raw string CEL expression. Must return a list of attributes. A maximum of
+                           45 attributes can be selected. Expressions can select different attribute
+                           types from `attributes`: `attributes.saml_attributes`,
+                           `attributes.iap_attributes`. The following functions are supported:
+
+                            - filter `<list>.filter(<iter_var>, <predicate>)`: Returns a subset of
+                            `<list>` where `<predicate>` is true for every item.
+
+                            - in `<var> in <list>`: Returns true if `<list>` contains `<var>`.
+
+                            - selectByName `<list>.selectByName(<string>)`: Returns the attribute
+                            in
+                            `<list>` with the given `<string>` name, otherwise returns empty.
+
+                            - emitAs `<attribute>.emitAs(<string>)`: Sets the `<attribute>` name
+                            field to the given `<string>` for propagation in selected output
+                            credentials.
+
+                            - strict `<attribute>.strict()`: Ignores the `x-goog-iap-attr-` prefix
+                            for the provided `<attribute>` when propagating with the `HEADER` output
+                            credential, such as request headers.
+
+                            - append `<target_list>.append(<attribute>)` OR
+                            `<target_list>.append(<list>)`: Appends the provided `<attribute>` or
+                            `<list>` to the end of `<target_list>`.
+
+                           Example expression: `attributes.saml_attributes.filter(x, x.name in
+                           ['test']).append(attributes.iap_attributes.selectByName('exact').emitAs('custom').strict())`
+                        type: string
+                      outputCredentials:
+                        description: Which output credentials attributes selected
+                          by the CEL expression should be propagated in. All attributes
+                          will be fully duplicated in each selected output credential.
+                        items:
+                          type: string
+                        type: array
+                    type: object
+                  cookieDomain:
+                    description: The Domain value to set for cookies generated by
+                      IAP. This value is not validated by the API, but will be ignored
+                      at runtime if invalid.
+                    type: string
+                  csmSettings:
+                    description: Settings to configure IAP's behavior for a service
+                      mesh.
+                    properties:
+                      rctokenAud:
+                        description: Audience claim set in the generated RCToken.
+                          This value is not validated by IAP.
+                        type: string
+                    type: object
+                type: object
+              name:
+                description: 'Required. The resource name of the IAP protected resource.
+                  The name could have the following format: organizations/{organization_id}
+                  folders/{folder_id} projects/{projects_id} projects/{projects_id}/iap_web
+                  projects/{projects_id}/iap_web/compute projects/{projects_id}/iap_web/compute-{region}
+                  projects/{projects_id}/iap_web/compute/service/{service_id} projects/{projects_id}/iap_web/compute-{region}/service/{service_id}
+                  projects/{projects_id}/iap_web/appengine-{app_id} projects/{projects_id}/iap_web/appengine-{app_id}/service/{service_id}
+                  projects/{projects_id}/iap_web/appengine-{app_id}/service/{service_id}/version/{version_id}'
+                type: string
+              resourceID:
+                description: The IAPSettings name.
+                type: string
+            required:
+            - name
+            type: object
+          status:
+            description: IAPSettingsStatus defines the config connector machine state
+              of IAPSettings
+            properties:
+              conditions:
+                description: Conditions represent the latest available observations
+                  of the object's current state.
+                items:
+                  properties:
+                    lastTransitionTime:
+                      description: Last time the condition transitioned from one status
+                        to another.
+                      type: string
+                    message:
+                      description: Human-readable message indicating details about
+                        last transition.
+                      type: string
+                    reason:
+                      description: Unique, one-word, CamelCase reason for the condition's
+                        last transition.
+                      type: string
+                    status:
+                      description: Status is the status of the condition. Can be True,
+                        False, Unknown.
+                      type: string
+                    type:
+                      description: Type is the type of the condition.
+                      type: string
+                  type: object
+                type: array
+              externalRef:
+                description: A unique specifier for the IAPSettings resource in GCP.
+                type: string
+              observedGeneration:
+                description: ObservedGeneration is the generation of the resource
+                  that was most recently observed by the Config Connector controller.
+                  If this is equal to metadata.generation, then that means that the
+                  current reported status reflects the most recent desired state of
+                  the resource.
+                format: int64
+                type: integer
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: null
+  storedVersions: null
diff --git a/crds/iap_v1beta1_iapbrand.yaml b/crds/iap_v1beta1_iapbrand.yaml
index 909b6c5dcf..aabf400fd7 100644
--- a/crds/iap_v1beta1_iapbrand.yaml
+++ b/crds/iap_v1beta1_iapbrand.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/iap_v1beta1_iapidentityawareproxyclient.yaml b/crds/iap_v1beta1_iapidentityawareproxyclient.yaml
index 383e1299bc..6d010ddceb 100644
--- a/crds/iap_v1beta1_iapidentityawareproxyclient.yaml
+++ b/crds/iap_v1beta1_iapidentityawareproxyclient.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/identityplatform_v1alpha1_identityplatformdefaultsupportedidpconfig.yaml b/crds/identityplatform_v1alpha1_identityplatformdefaultsupportedidpconfig.yaml
index 95bc6e427c..f9944c11b1 100644
--- a/crds/identityplatform_v1alpha1_identityplatformdefaultsupportedidpconfig.yaml
+++ b/crds/identityplatform_v1alpha1_identityplatformdefaultsupportedidpconfig.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/identityplatform_v1alpha1_identityplatforminboundsamlconfig.yaml b/crds/identityplatform_v1alpha1_identityplatforminboundsamlconfig.yaml
index 7f5e7a60f8..48e6eb76f1 100644
--- a/crds/identityplatform_v1alpha1_identityplatforminboundsamlconfig.yaml
+++ b/crds/identityplatform_v1alpha1_identityplatforminboundsamlconfig.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/identityplatform_v1alpha1_identityplatformprojectdefaultconfig.yaml b/crds/identityplatform_v1alpha1_identityplatformprojectdefaultconfig.yaml
index d516c41e4e..824323c321 100644
--- a/crds/identityplatform_v1alpha1_identityplatformprojectdefaultconfig.yaml
+++ b/crds/identityplatform_v1alpha1_identityplatformprojectdefaultconfig.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/identityplatform_v1alpha1_identityplatformtenantdefaultsupportedidpconfig.yaml b/crds/identityplatform_v1alpha1_identityplatformtenantdefaultsupportedidpconfig.yaml
index 24d2715773..ba5e47069e 100644
--- a/crds/identityplatform_v1alpha1_identityplatformtenantdefaultsupportedidpconfig.yaml
+++ b/crds/identityplatform_v1alpha1_identityplatformtenantdefaultsupportedidpconfig.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/identityplatform_v1alpha1_identityplatformtenantinboundsamlconfig.yaml b/crds/identityplatform_v1alpha1_identityplatformtenantinboundsamlconfig.yaml
index b815846f84..4d47b4bdbb 100644
--- a/crds/identityplatform_v1alpha1_identityplatformtenantinboundsamlconfig.yaml
+++ b/crds/identityplatform_v1alpha1_identityplatformtenantinboundsamlconfig.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/identityplatform_v1beta1_identityplatformconfig.yaml b/crds/identityplatform_v1beta1_identityplatformconfig.yaml
index ec41d7b804..c6e0724c0a 100644
--- a/crds/identityplatform_v1beta1_identityplatformconfig.yaml
+++ b/crds/identityplatform_v1beta1_identityplatformconfig.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/identityplatform_v1beta1_identityplatformoauthidpconfig.yaml b/crds/identityplatform_v1beta1_identityplatformoauthidpconfig.yaml
index 7123faaeca..f5a62ad5fe 100644
--- a/crds/identityplatform_v1beta1_identityplatformoauthidpconfig.yaml
+++ b/crds/identityplatform_v1beta1_identityplatformoauthidpconfig.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/identityplatform_v1beta1_identityplatformtenant.yaml b/crds/identityplatform_v1beta1_identityplatformtenant.yaml
index abd5388097..7387bba681 100644
--- a/crds/identityplatform_v1beta1_identityplatformtenant.yaml
+++ b/crds/identityplatform_v1beta1_identityplatformtenant.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/identityplatform_v1beta1_identityplatformtenantoauthidpconfig.yaml b/crds/identityplatform_v1beta1_identityplatformtenantoauthidpconfig.yaml
index 0396de5562..59ddba919d 100644
--- a/crds/identityplatform_v1beta1_identityplatformtenantoauthidpconfig.yaml
+++ b/crds/identityplatform_v1beta1_identityplatformtenantoauthidpconfig.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/kms_v1alpha1_kmscryptokeyversion.yaml b/crds/kms_v1alpha1_kmscryptokeyversion.yaml
index 7e2248cc5d..e916a2cc6d 100644
--- a/crds/kms_v1alpha1_kmscryptokeyversion.yaml
+++ b/crds/kms_v1alpha1_kmscryptokeyversion.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/kms_v1alpha1_kmskeyringimportjob.yaml b/crds/kms_v1alpha1_kmskeyringimportjob.yaml
index f554c62f86..1dcd1fa86e 100644
--- a/crds/kms_v1alpha1_kmskeyringimportjob.yaml
+++ b/crds/kms_v1alpha1_kmskeyringimportjob.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/kms_v1alpha1_kmssecretciphertext.yaml b/crds/kms_v1alpha1_kmssecretciphertext.yaml
index c58b132a67..99a36257ca 100644
--- a/crds/kms_v1alpha1_kmssecretciphertext.yaml
+++ b/crds/kms_v1alpha1_kmssecretciphertext.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/kms_v1alpha1_kmsautokeyconfig.yaml b/crds/kms_v1beta1_kmsautokeyconfig.yaml
similarity index 53%
rename from crds/kms_v1alpha1_kmsautokeyconfig.yaml
rename to crds/kms_v1beta1_kmsautokeyconfig.yaml
index 1a8d6795a9..6dd00793aa 100644
--- a/crds/kms_v1alpha1_kmsautokeyconfig.yaml
+++ b/crds/kms_v1beta1_kmsautokeyconfig.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,10 +16,11 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
+    cnrm.cloud.google.com/stability-level: beta
     cnrm.cloud.google.com/system: "true"
   name: kmsautokeyconfigs.kms.cnrm.cloud.google.com
 spec:
@@ -195,6 +196,168 @@ spec:
             type: object
         type: object
     served: true
+    storage: false
+    subresources:
+      status: {}
+  - additionalPrinterColumns:
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    - description: When 'True', the most recent reconcile of the resource succeeded
+      jsonPath: .status.conditions[?(@.type=='Ready')].status
+      name: Ready
+      type: string
+    - description: The reason for the value in 'Ready'
+      jsonPath: .status.conditions[?(@.type=='Ready')].reason
+      name: Status
+      type: string
+    - description: The last transition time for the value in 'Status'
+      jsonPath: .status.conditions[?(@.type=='Ready')].lastTransitionTime
+      name: Status Age
+      type: date
+    name: v1beta1
+    schema:
+      openAPIV3Schema:
+        description: KMSAutokeyConfig is the Schema for the KMSAutokeyConfig API
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: KMSAutokeyConfigSpec defines the desired state of KMSAutokeyConfig
+            properties:
+              folderRef:
+                description: Immutable. The folder that this resource belongs to.
+                oneOf:
+                - not:
+                    required:
+                    - external
+                  required:
+                  - name
+                - not:
+                    anyOf:
+                    - required:
+                      - name
+                    - required:
+                      - namespace
+                  required:
+                  - external
+                properties:
+                  external:
+                    description: The 'name' field of a folder, when not managed by
+                      Config Connector. This field must be set when 'name' field is
+                      not set.
+                    type: string
+                  name:
+                    description: The 'name' field of a 'Folder' resource. This field
+                      must be set when 'external' field is not set.
+                    type: string
+                  namespace:
+                    description: The 'namespace' field of a 'Folder' resource. If
+                      unset, the namespace is defaulted to the namespace of the referencer
+                      resource.
+                    type: string
+                type: object
+              keyProject:
+                description: The Project that this resource belongs to.
+                oneOf:
+                - not:
+                    required:
+                    - external
+                  required:
+                  - name
+                  - kind
+                - not:
+                    anyOf:
+                    - required:
+                      - name
+                    - required:
+                      - namespace
+                    - required:
+                      - kind
+                  required:
+                  - external
+                properties:
+                  external:
+                    description: The `projectID` field of a project, when not managed
+                      by Config Connector.
+                    type: string
+                  kind:
+                    description: The kind of the Project resource; optional but must
+                      be `Project` if provided.
+                    type: string
+                  name:
+                    description: The `name` field of a `Project` resource.
+                    type: string
+                  namespace:
+                    description: The `namespace` field of a `Project` resource.
+                    type: string
+                type: object
+            required:
+            - folderRef
+            type: object
+          status:
+            description: KMSAutokeyConfigStatus defines the config connector machine
+              state of KMSAutokeyConfig
+            properties:
+              conditions:
+                description: Conditions represent the latest available observations
+                  of the object's current state.
+                items:
+                  properties:
+                    lastTransitionTime:
+                      description: Last time the condition transitioned from one status
+                        to another.
+                      type: string
+                    message:
+                      description: Human-readable message indicating details about
+                        last transition.
+                      type: string
+                    reason:
+                      description: Unique, one-word, CamelCase reason for the condition's
+                        last transition.
+                      type: string
+                    status:
+                      description: Status is the status of the condition. Can be True,
+                        False, Unknown.
+                      type: string
+                    type:
+                      description: Type is the type of the condition.
+                      type: string
+                  type: object
+                type: array
+              externalRef:
+                description: A unique specifier for the KMSAutokeyConfig resource
+                  in GCP.
+                type: string
+              observedGeneration:
+                description: ObservedGeneration is the generation of the resource
+                  that was most recently observed by the Config Connector controller.
+                  If this is equal to metadata.generation, then that means that the
+                  current reported status reflects the most recent desired state of
+                  the resource.
+                format: int64
+                type: integer
+              observedState:
+                description: ObservedState is the state of the resource as most recently
+                  observed in GCP.
+                properties:
+                  state:
+                    description: Output only. Current state of this AutokeyConfig.
+                    type: string
+                type: object
+            type: object
+        type: object
+    served: true
     storage: true
     subresources:
       status: {}
diff --git a/crds/kms_v1beta1_kmscryptokey.yaml b/crds/kms_v1beta1_kmscryptokey.yaml
index a84471a09b..fe7eec4cc1 100644
--- a/crds/kms_v1beta1_kmscryptokey.yaml
+++ b/crds/kms_v1beta1_kmscryptokey.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/kms_v1beta1_kmskeyhandle.yaml b/crds/kms_v1beta1_kmskeyhandle.yaml
new file mode 100644
index 0000000000..f0c30bffd1
--- /dev/null
+++ b/crds/kms_v1beta1_kmskeyhandle.yaml
@@ -0,0 +1,325 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    cnrm.cloud.google.com/version: 1.128.0
+  creationTimestamp: null
+  labels:
+    cnrm.cloud.google.com/managed-by-kcc: "true"
+    cnrm.cloud.google.com/stability-level: beta
+    cnrm.cloud.google.com/system: "true"
+  name: kmskeyhandles.kms.cnrm.cloud.google.com
+spec:
+  group: kms.cnrm.cloud.google.com
+  names:
+    categories:
+    - gcp
+    kind: KMSKeyHandle
+    listKind: KMSKeyHandleList
+    plural: kmskeyhandles
+    shortNames:
+    - gcpkmskeyhandle
+    - gcpkmskeyhandles
+    singular: kmskeyhandle
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    - description: When 'True', the most recent reconcile of the resource succeeded
+      jsonPath: .status.conditions[?(@.type=='Ready')].status
+      name: Ready
+      type: string
+    - description: The reason for the value in 'Ready'
+      jsonPath: .status.conditions[?(@.type=='Ready')].reason
+      name: Status
+      type: string
+    - description: The last transition time for the value in 'Status'
+      jsonPath: .status.conditions[?(@.type=='Ready')].lastTransitionTime
+      name: Status Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: KMSKeyHandle is the Schema for the KMSKeyHandle API
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: KMSKeyHandleSpec defines the desired state of KMSKeyHandle
+            properties:
+              location:
+                description: Location name to create KeyHandle
+                type: string
+              projectRef:
+                description: Project hosting KMSKeyHandle
+                oneOf:
+                - not:
+                    required:
+                    - external
+                  required:
+                  - name
+                - not:
+                    anyOf:
+                    - required:
+                      - name
+                    - required:
+                      - namespace
+                  required:
+                  - external
+                properties:
+                  external:
+                    description: The `projectID` field of a project, when not managed
+                      by Config Connector.
+                    type: string
+                  kind:
+                    description: The kind of the Project resource; optional but must
+                      be `Project` if provided.
+                    type: string
+                  name:
+                    description: The `name` field of a `Project` resource.
+                    type: string
+                  namespace:
+                    description: The `namespace` field of a `Project` resource.
+                    type: string
+                type: object
+              resourceID:
+                description: 'The KMS Key Handle ID used for resource creation or
+                  acquisition. For creation: If specified, this value is used as the
+                  key handle ID. If not provided, a UUID will be generated and assigned
+                  as the key handle ID. For acquisition: This field must be provided
+                  to identify the key handle resource to acquire.'
+                type: string
+              resourceTypeSelector:
+                description: Indicates the resource type that the resulting [CryptoKey][]
+                  is meant to protect, e.g. `{SERVICE}.googleapis.com/{TYPE}`. See
+                  documentation for supported resource types https://cloud.google.com/kms/docs/autokey-overview#compatible-services.
+                type: string
+            type: object
+          status:
+            description: KMSKeyHandleStatus defines the config connector machine state
+              of KMSKeyHandle
+            properties:
+              conditions:
+                description: Conditions represent the latest available observations
+                  of the object's current state.
+                items:
+                  properties:
+                    lastTransitionTime:
+                      description: Last time the condition transitioned from one status
+                        to another.
+                      type: string
+                    message:
+                      description: Human-readable message indicating details about
+                        last transition.
+                      type: string
+                    reason:
+                      description: Unique, one-word, CamelCase reason for the condition's
+                        last transition.
+                      type: string
+                    status:
+                      description: Status is the status of the condition. Can be True,
+                        False, Unknown.
+                      type: string
+                    type:
+                      description: Type is the type of the condition.
+                      type: string
+                  type: object
+                type: array
+              externalRef:
+                description: A unique specifier for the KMSKeyHandle resource in GCP.
+                type: string
+              observedGeneration:
+                description: ObservedGeneration is the generation of the resource
+                  that was most recently observed by the Config Connector controller.
+                  If this is equal to metadata.generation, then that means that the
+                  current reported status reflects the most recent desired state of
+                  the resource.
+                format: int64
+                type: integer
+              observedState:
+                description: ObservedState is the state of the resource as most recently
+                  observed in GCP.
+                properties:
+                  kmsKey:
+                    type: string
+                type: object
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: false
+    subresources:
+      status: {}
+  - additionalPrinterColumns:
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    - description: When 'True', the most recent reconcile of the resource succeeded
+      jsonPath: .status.conditions[?(@.type=='Ready')].status
+      name: Ready
+      type: string
+    - description: The reason for the value in 'Ready'
+      jsonPath: .status.conditions[?(@.type=='Ready')].reason
+      name: Status
+      type: string
+    - description: The last transition time for the value in 'Status'
+      jsonPath: .status.conditions[?(@.type=='Ready')].lastTransitionTime
+      name: Status Age
+      type: date
+    name: v1beta1
+    schema:
+      openAPIV3Schema:
+        description: KMSKeyHandle is the Schema for the KMSKeyHandle API
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: KMSKeyHandleSpec defines the desired state of KMSKeyHandle
+            properties:
+              location:
+                description: Location name to create KeyHandle
+                type: string
+              projectRef:
+                description: Project hosting KMSKeyHandle
+                oneOf:
+                - not:
+                    required:
+                    - external
+                  required:
+                  - name
+                - not:
+                    anyOf:
+                    - required:
+                      - name
+                    - required:
+                      - namespace
+                  required:
+                  - external
+                properties:
+                  external:
+                    description: The `projectID` field of a project, when not managed
+                      by Config Connector.
+                    type: string
+                  kind:
+                    description: The kind of the Project resource; optional but must
+                      be `Project` if provided.
+                    type: string
+                  name:
+                    description: The `name` field of a `Project` resource.
+                    type: string
+                  namespace:
+                    description: The `namespace` field of a `Project` resource.
+                    type: string
+                type: object
+              resourceID:
+                description: 'The KMS Key Handle ID used for resource creation or
+                  acquisition. For creation: If specified, this value is used as the
+                  key handle ID. If not provided, a UUID will be generated and assigned
+                  as the key handle ID. For acquisition: This field must be provided
+                  to identify the key handle resource to acquire.'
+                type: string
+              resourceTypeSelector:
+                description: Indicates the resource type that the resulting [CryptoKey][]
+                  is meant to protect, e.g. `{SERVICE}.googleapis.com/{TYPE}`. See
+                  documentation for supported resource types https://cloud.google.com/kms/docs/autokey-overview#compatible-services.
+                type: string
+            type: object
+          status:
+            description: KMSKeyHandleStatus defines the config connector machine state
+              of KMSKeyHandle
+            properties:
+              conditions:
+                description: Conditions represent the latest available observations
+                  of the object's current state.
+                items:
+                  properties:
+                    lastTransitionTime:
+                      description: Last time the condition transitioned from one status
+                        to another.
+                      type: string
+                    message:
+                      description: Human-readable message indicating details about
+                        last transition.
+                      type: string
+                    reason:
+                      description: Unique, one-word, CamelCase reason for the condition's
+                        last transition.
+                      type: string
+                    status:
+                      description: Status is the status of the condition. Can be True,
+                        False, Unknown.
+                      type: string
+                    type:
+                      description: Type is the type of the condition.
+                      type: string
+                  type: object
+                type: array
+              externalRef:
+                description: A unique specifier for the KMSKeyHandle resource in GCP.
+                type: string
+              observedGeneration:
+                description: ObservedGeneration is the generation of the resource
+                  that was most recently observed by the Config Connector controller.
+                  If this is equal to metadata.generation, then that means that the
+                  current reported status reflects the most recent desired state of
+                  the resource.
+                format: int64
+                type: integer
+              observedState:
+                description: ObservedState is the state of the resource as most recently
+                  observed in GCP.
+                properties:
+                  kmsKey:
+                    type: string
+                type: object
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: null
+  storedVersions: null
diff --git a/crds/kms_v1beta1_kmskeyring.yaml b/crds/kms_v1beta1_kmskeyring.yaml
index 2f1af53e7d..b1fb3d4b08 100644
--- a/crds/kms_v1beta1_kmskeyring.yaml
+++ b/crds/kms_v1beta1_kmskeyring.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/logging_v1beta1_logginglogbucket.yaml b/crds/logging_v1beta1_logginglogbucket.yaml
index e6ee17497f..8c5761c1f1 100644
--- a/crds/logging_v1beta1_logginglogbucket.yaml
+++ b/crds/logging_v1beta1_logginglogbucket.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/logging_v1beta1_logginglogexclusion.yaml b/crds/logging_v1beta1_logginglogexclusion.yaml
index 48f8b3f17a..4c6d195ad5 100644
--- a/crds/logging_v1beta1_logginglogexclusion.yaml
+++ b/crds/logging_v1beta1_logginglogexclusion.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/logging_v1beta1_logginglogmetric.yaml b/crds/logging_v1beta1_logginglogmetric.yaml
index 863122dfba..5321d5388c 100644
--- a/crds/logging_v1beta1_logginglogmetric.yaml
+++ b/crds/logging_v1beta1_logginglogmetric.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/logging_v1beta1_logginglogsink.yaml b/crds/logging_v1beta1_logginglogsink.yaml
index 4feadd48dc..ff8a8a0c65 100644
--- a/crds/logging_v1beta1_logginglogsink.yaml
+++ b/crds/logging_v1beta1_logginglogsink.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/logging_v1beta1_logginglogview.yaml b/crds/logging_v1beta1_logginglogview.yaml
index e6f6197a0f..8e05d0f1f2 100644
--- a/crds/logging_v1beta1_logginglogview.yaml
+++ b/crds/logging_v1beta1_logginglogview.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/memcache_v1beta1_memcacheinstance.yaml b/crds/memcache_v1beta1_memcacheinstance.yaml
index f237bacd9d..ea48cee6fc 100644
--- a/crds/memcache_v1beta1_memcacheinstance.yaml
+++ b/crds/memcache_v1beta1_memcacheinstance.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -284,7 +284,7 @@ spec:
                     scheduleDeadlineTime:
                       description: |-
                         Output only. The deadline that the maintenance schedule start time
-                        cannot go beyond, including reschedule.
+                        can not go beyond, including reschedule.
                         A timestamp in RFC3339 UTC "Zulu" format, with nanosecond
                         resolution and up to nine fractional digits.
                       type: string
diff --git a/crds/memorystore_v1alpha1_memorystoreinstance.yaml b/crds/memorystore_v1alpha1_memorystoreinstance.yaml
new file mode 100644
index 0000000000..e435decdbe
--- /dev/null
+++ b/crds/memorystore_v1alpha1_memorystoreinstance.yaml
@@ -0,0 +1,477 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    cnrm.cloud.google.com/version: 1.128.0
+  creationTimestamp: null
+  labels:
+    cnrm.cloud.google.com/managed-by-kcc: "true"
+    cnrm.cloud.google.com/system: "true"
+  name: memorystoreinstances.memorystore.cnrm.cloud.google.com
+spec:
+  group: memorystore.cnrm.cloud.google.com
+  names:
+    categories:
+    - gcp
+    kind: MemorystoreInstance
+    listKind: MemorystoreInstanceList
+    plural: memorystoreinstances
+    shortNames:
+    - gcpmemorystoreinstance
+    - gcpmemorystoreinstances
+    singular: memorystoreinstance
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    - description: When 'True', the most recent reconcile of the resource succeeded
+      jsonPath: .status.conditions[?(@.type=='Ready')].status
+      name: Ready
+      type: string
+    - description: The reason for the value in 'Ready'
+      jsonPath: .status.conditions[?(@.type=='Ready')].reason
+      name: Status
+      type: string
+    - description: The last transition time for the value in 'Status'
+      jsonPath: .status.conditions[?(@.type=='Ready')].lastTransitionTime
+      name: Status Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: MemorystoreInstance is the Schema for the MemorystoreInstance
+          API
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: MemorystoreInstanceSpec defines the desired state of MemorystoreInstance
+            properties:
+              authorizationMode:
+                description: Optional. Immutable. Authorization mode of the instance.
+                type: string
+              deletionProtectionEnabled:
+                description: Optional. If set to true deletion of the instance will
+                  fail.
+                type: boolean
+              engineConfigs:
+                additionalProperties:
+                  type: string
+                description: Optional. User-provided engine configurations for the
+                  instance.
+                type: object
+              engineVersion:
+                description: Optional. Immutable. Engine version of the instance.
+                type: string
+              location:
+                description: Immutable.
+                type: string
+                x-kubernetes-validations:
+                - message: Location field is immutable
+                  rule: self == oldSelf
+              nodeType:
+                description: Optional. Immutable. Machine type for individual nodes
+                  of the instance.
+                type: string
+              persistenceConfig:
+                description: Optional. Persistence configuration of the instance.
+                properties:
+                  aofConfig:
+                    description: Optional. AOF configuration. This field will be ignored
+                      if mode is not AOF.
+                    properties:
+                      appendFsync:
+                        description: Optional. The fsync mode.
+                        type: string
+                    type: object
+                  mode:
+                    description: Optional. Current persistence mode.
+                    type: string
+                  rdbConfig:
+                    description: Optional. RDB configuration. This field will be ignored
+                      if mode is not RDB.
+                    properties:
+                      rdbSnapshotPeriod:
+                        description: Optional. Period between RDB snapshots.
+                        type: string
+                      rdbSnapshotStartTime:
+                        description: Optional. Time that the first snapshot was/will
+                          be attempted, and to which future snapshots will be aligned.
+                          If not provided, the current time will be used.
+                        type: string
+                    type: object
+                type: object
+              projectRef:
+                description: The Project that this resource belongs to.
+                oneOf:
+                - not:
+                    required:
+                    - external
+                  required:
+                  - name
+                - not:
+                    anyOf:
+                    - required:
+                      - name
+                    - required:
+                      - namespace
+                  required:
+                  - external
+                properties:
+                  external:
+                    description: The `projectID` field of a project, when not managed
+                      by Config Connector.
+                    type: string
+                  kind:
+                    description: The kind of the Project resource; optional but must
+                      be `Project` if provided.
+                    type: string
+                  name:
+                    description: The `name` field of a `Project` resource.
+                    type: string
+                  namespace:
+                    description: The `namespace` field of a `Project` resource.
+                    type: string
+                type: object
+              pscAutoConnections:
+                description: Required. Immutable. User inputs for the auto-created
+                  PSC connections.
+                items:
+                  description: kcc specific struct to separate input and output fields
+                    in google.cloud.memorystore.v1beta.PscAutoConnection
+                  properties:
+                    networkRef:
+                      description: Required. The network where the PSC endpoints are
+                        created, in the form of projects/{project_id}/global/networks/{network_id}.
+                      oneOf:
+                      - not:
+                          required:
+                          - external
+                        required:
+                        - name
+                      - not:
+                          anyOf:
+                          - required:
+                            - name
+                          - required:
+                            - namespace
+                        required:
+                        - external
+                      properties:
+                        external:
+                          description: A reference to an externally managed Compute
+                            Network resource. Should be in the format `projects/{{projectID}}/global/networks/{{network}}`.
+                          type: string
+                        name:
+                          description: The `name` field of a `ComputeNetwork` resource.
+                          type: string
+                        namespace:
+                          description: The `namespace` field of a `ComputeNetwork`
+                            resource.
+                          type: string
+                      type: object
+                    projectRef:
+                      description: Required. The consumer project_id where PSC connections
+                        are established. This should be the same project_id that the
+                        cluster is being created in.
+                      oneOf:
+                      - not:
+                          required:
+                          - external
+                        required:
+                        - name
+                        - kind
+                      - not:
+                          anyOf:
+                          - required:
+                            - name
+                          - required:
+                            - namespace
+                          - required:
+                            - kind
+                        required:
+                        - external
+                      properties:
+                        external:
+                          description: The `projectID` field of a project, when not
+                            managed by Config Connector.
+                          type: string
+                        kind:
+                          description: The kind of the Project resource; optional
+                            but must be `Project` if provided.
+                          type: string
+                        name:
+                          description: The `name` field of a `Project` resource.
+                          type: string
+                        namespace:
+                          description: The `namespace` field of a `Project` resource.
+                          type: string
+                      type: object
+                  required:
+                  - networkRef
+                  - projectRef
+                  type: object
+                type: array
+              replicaCount:
+                description: Optional. Number of replica nodes per shard. If omitted
+                  the default is 0 replicas.
+                format: int32
+                type: integer
+              resourceID:
+                description: Optional. Immutable. The MemorystoreInstance name. If
+                  not given, the metadata.name will be used.
+                type: string
+              shardCount:
+                description: Optional. Number of shards for the instance.
+                format: int32
+                type: integer
+              transitEncryptionMode:
+                description: Optional. Immutable. In-transit encryption mode of the
+                  instance.
+                type: string
+              zoneDistributionConfig:
+                description: Optional. Immutable. Zone distribution configuration
+                  of the instance for node allocatiteon.
+                properties:
+                  mode:
+                    description: Optional. Current zone distribution mode. Defaults
+                      to MULTI_ZONE.
+                    type: string
+                  zone:
+                    description: Optional. Defines zone where all resources will be
+                      allocated with SINGLE_ZONE mode. Ignored for MULTI_ZONE mode.
+                    type: string
+                type: object
+            required:
+            - location
+            - projectRef
+            type: object
+          status:
+            description: MemorystoreInstanceStatus defines the config connector machine
+              state of MemorystoreInstance
+            properties:
+              conditions:
+                description: Conditions represent the latest available observations
+                  of the object's current state.
+                items:
+                  properties:
+                    lastTransitionTime:
+                      description: Last time the condition transitioned from one status
+                        to another.
+                      type: string
+                    message:
+                      description: Human-readable message indicating details about
+                        last transition.
+                      type: string
+                    reason:
+                      description: Unique, one-word, CamelCase reason for the condition's
+                        last transition.
+                      type: string
+                    status:
+                      description: Status is the status of the condition. Can be True,
+                        False, Unknown.
+                      type: string
+                    type:
+                      description: Type is the type of the condition.
+                      type: string
+                  type: object
+                type: array
+              externalRef:
+                description: A unique specifier for the MemorystoreInstance resource
+                  in GCP.
+                type: string
+              observedGeneration:
+                description: ObservedGeneration is the generation of the resource
+                  that was most recently observed by the Config Connector controller.
+                  If this is equal to metadata.generation, then that means that the
+                  current reported status reflects the most recent desired state of
+                  the resource.
+                format: int64
+                type: integer
+              observedState:
+                description: ObservedState is the state of the resource as most recently
+                  observed in GCP.
+                properties:
+                  authorizationMode:
+                    description: Optional. Immutable. Authorization mode of the instance.
+                    type: string
+                  createTime:
+                    description: Output only. Creation timestamp of the instance.
+                    type: string
+                  discoveryEndpoints:
+                    description: Output only. Endpoints clients can connect to the
+                      instance through. Currently only one discovery endpoint is supported.
+                    items:
+                      properties:
+                        address:
+                          description: Output only. IP address of the exposed endpoint
+                            clients connect to.
+                          type: string
+                        network:
+                          description: Output only. The network where the IP address
+                            of the discovery endpoint will be reserved, in the form
+                            of projects/{network_project}/global/networks/{network_id}.
+                          type: string
+                        port:
+                          description: Output only. The port number of the exposed
+                            endpoint.
+                          format: int32
+                          type: integer
+                      type: object
+                    type: array
+                  engineVersion:
+                    description: Optional. Immutable. Engine version of the instance.
+                      https://cloud.google.com/memorystore/docs/valkey/supported-versions
+                    type: string
+                  name:
+                    description: 'Identifier. Unique name of the instance. Format:
+                      projects/{project}/locations/{location}/instances/{instance}'
+                    type: string
+                  nodeConfig:
+                    description: Output only. Configuration of individual nodes of
+                      the instance.
+                    properties:
+                      sizeGb:
+                        description: Output only. Memory size in GB of the node.
+                        type: number
+                    type: object
+                  nodeType:
+                    description: Optional. Immutable. Machine type for individual
+                      nodes of the instance.
+                    type: string
+                  pscAutoConnections:
+                    description: Output only. Resource details of the auto-created
+                      PSC connections.
+                    items:
+                      properties:
+                        connectionType:
+                          description: Output only. Type of the PSC connection.
+                          type: string
+                        forwardingRule:
+                          description: 'Output only. The URI of the consumer side
+                            forwarding rule. Format: projects/{project}/regions/{region}/forwardingRules/{forwarding_rule}'
+                          type: string
+                        ipAddress:
+                          description: Output only. The IP allocated on the consumer
+                            network for the PSC forwarding rule.
+                          type: string
+                        network:
+                          description: Required. The network where the PSC endpoints
+                            are created, in the form of projects/{project_id}/global/networks/{network_id}.
+                          type: string
+                        port:
+                          description: Optional. Output only. port will only be set
+                            for Primary/Reader or Discovery endpoint.
+                          format: int32
+                          type: integer
+                        projectID:
+                          description: Required. The consumer project_id where PSC
+                            connections are established. This should be the same project_id
+                            that the cluster is being created in.
+                          type: string
+                        pscConnectionID:
+                          description: Output only. The PSC connection id of the forwarding
+                            rule connected to the service attachment.
+                          type: string
+                        pscConnectionStatus:
+                          description: 'Output only. The status of the PSC connection:
+                            whether a connection exists and ACTIVE or it no longer
+                            exists. Please note that this value is updated periodically.
+                            Please use Private Service Connect APIs for the latest
+                            status.'
+                          type: string
+                        serviceAttachment:
+                          description: Output only. The service attachment which is
+                            the target of the PSC connection, in the form of projects/{project-id}/regions/{region}/serviceAttachments/{service-attachment-id}.
+                          type: string
+                      type: object
+                    type: array
+                  state:
+                    description: Output only. Current state of the instance.
+                    type: string
+                  stateInfo:
+                    description: Output only. Additional information about the state
+                      of the instance.
+                    properties:
+                      updateInfo:
+                        description: Output only. Describes ongoing update when instance
+                          state is UPDATING.
+                        properties:
+                          targetReplicaCount:
+                            description: Output only. Target number of replica nodes
+                              per shard for the instance.
+                            format: int32
+                            type: integer
+                          targetShardCount:
+                            description: Output only. Target number of shards for
+                              the instance.
+                            format: int32
+                            type: integer
+                        type: object
+                    type: object
+                  transitEncryptionMode:
+                    description: Optional. Immutable. In-transit encryption mode of
+                      the instance.
+                    type: string
+                  uid:
+                    description: Output only. System assigned, unique identifier for
+                      the instance.
+                    type: string
+                  updateTime:
+                    description: Output only. Latest update timestamp of the instance.
+                    type: string
+                  zoneDistributionConfig:
+                    description: Optional. Immutable. Zone distribution configuration
+                      of the instance for node allocation.
+                    properties:
+                      mode:
+                        description: Optional. Current zone distribution mode. Defaults
+                          to MULTI_ZONE.
+                        type: string
+                      zone:
+                        description: Optional. Defines zone where all resources will
+                          be allocated with SINGLE_ZONE mode. Ignored for MULTI_ZONE
+                          mode.
+                        type: string
+                    type: object
+                type: object
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: null
+  storedVersions: null
diff --git a/crds/mlengine_v1alpha1_mlenginemodel.yaml b/crds/mlengine_v1alpha1_mlenginemodel.yaml
index 1441b8e55b..9304870438 100644
--- a/crds/mlengine_v1alpha1_mlenginemodel.yaml
+++ b/crds/mlengine_v1alpha1_mlenginemodel.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/monitoring_v1beta1_monitoringalertpolicy.yaml b/crds/monitoring_v1beta1_monitoringalertpolicy.yaml
index 7459a639bd..293ae1eac6 100644
--- a/crds/monitoring_v1beta1_monitoringalertpolicy.yaml
+++ b/crds/monitoring_v1beta1_monitoringalertpolicy.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/monitoring_v1beta1_monitoringdashboard.yaml b/crds/monitoring_v1beta1_monitoringdashboard.yaml
index f62f9eb5e1..db511c8be7 100644
--- a/crds/monitoring_v1beta1_monitoringdashboard.yaml
+++ b/crds/monitoring_v1beta1_monitoringdashboard.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/monitoring_v1beta1_monitoringgroup.yaml b/crds/monitoring_v1beta1_monitoringgroup.yaml
index 5a3a850b13..80ac38a11e 100644
--- a/crds/monitoring_v1beta1_monitoringgroup.yaml
+++ b/crds/monitoring_v1beta1_monitoringgroup.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/monitoring_v1beta1_monitoringmetricdescriptor.yaml b/crds/monitoring_v1beta1_monitoringmetricdescriptor.yaml
index 0f4125391e..4edd136d6e 100644
--- a/crds/monitoring_v1beta1_monitoringmetricdescriptor.yaml
+++ b/crds/monitoring_v1beta1_monitoringmetricdescriptor.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/monitoring_v1beta1_monitoringmonitoredproject.yaml b/crds/monitoring_v1beta1_monitoringmonitoredproject.yaml
index aa697dbb0e..6960b8a67e 100644
--- a/crds/monitoring_v1beta1_monitoringmonitoredproject.yaml
+++ b/crds/monitoring_v1beta1_monitoringmonitoredproject.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/monitoring_v1beta1_monitoringnotificationchannel.yaml b/crds/monitoring_v1beta1_monitoringnotificationchannel.yaml
index 1d274a5db4..3669972e3b 100644
--- a/crds/monitoring_v1beta1_monitoringnotificationchannel.yaml
+++ b/crds/monitoring_v1beta1_monitoringnotificationchannel.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -105,7 +105,7 @@ spec:
                 type: string
               sensitiveLabels:
                 description: |-
-                  Different notification type behaviors are configured primarily using the 'labels' field on this
+                  Different notification type behaviors are configured primarily using the the 'labels' field on this
                   resource. This block contains the labels which contain secrets or passwords so that they can be marked
                   sensitive and hidden from plan output. The name of the field, eg: password, will be the key
                   in the 'labels' map in the api request.
diff --git a/crds/monitoring_v1beta1_monitoringservice.yaml b/crds/monitoring_v1beta1_monitoringservice.yaml
index 06c9b11bcd..3578800169 100644
--- a/crds/monitoring_v1beta1_monitoringservice.yaml
+++ b/crds/monitoring_v1beta1_monitoringservice.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/monitoring_v1beta1_monitoringservicelevelobjective.yaml b/crds/monitoring_v1beta1_monitoringservicelevelobjective.yaml
index 2a8e06bb18..7ca23eedd7 100644
--- a/crds/monitoring_v1beta1_monitoringservicelevelobjective.yaml
+++ b/crds/monitoring_v1beta1_monitoringservicelevelobjective.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/monitoring_v1beta1_monitoringuptimecheckconfig.yaml b/crds/monitoring_v1beta1_monitoringuptimecheckconfig.yaml
index 19e9e9d5fb..2902c440a6 100644
--- a/crds/monitoring_v1beta1_monitoringuptimecheckconfig.yaml
+++ b/crds/monitoring_v1beta1_monitoringuptimecheckconfig.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/networkconnectivity_v1alpha1_networkconnectivityserviceconnectionpolicy.yaml b/crds/networkconnectivity_v1alpha1_networkconnectivityserviceconnectionpolicy.yaml
index a1da379b0d..e9514e6d8f 100644
--- a/crds/networkconnectivity_v1alpha1_networkconnectivityserviceconnectionpolicy.yaml
+++ b/crds/networkconnectivity_v1alpha1_networkconnectivityserviceconnectionpolicy.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -25,9 +25,14 @@ metadata:
 spec:
   group: networkconnectivity.cnrm.cloud.google.com
   names:
+    categories:
+    - gcp
     kind: NetworkConnectivityServiceConnectionPolicy
     listKind: NetworkConnectivityServiceConnectionPolicyList
     plural: networkconnectivityserviceconnectionpolicies
+    shortNames:
+    - gcpnetworkconnectivityserviceconnectionpolicy
+    - gcpnetworkconnectivityserviceconnectionpolicies
     singular: networkconnectivityserviceconnectionpolicy
   scope: Namespaced
   versions:
@@ -92,7 +97,7 @@ spec:
                 properties:
                   external:
                     description: A reference to an externally managed Compute Network
-                      resource. Should be in the format `projects/<projectID>/global/networks/<network>`.
+                      resource. Should be in the format `projects/{{projectID}}/global/networks/{{network}}`.
                     type: string
                   name:
                     description: The `name` field of a `ComputeNetwork` resource.
diff --git a/crds/networkconnectivity_v1beta1_networkconnectivityhub.yaml b/crds/networkconnectivity_v1beta1_networkconnectivityhub.yaml
index 65a3fa2b1e..284cd3f707 100644
--- a/crds/networkconnectivity_v1beta1_networkconnectivityhub.yaml
+++ b/crds/networkconnectivity_v1beta1_networkconnectivityhub.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/networkconnectivity_v1beta1_networkconnectivityspoke.yaml b/crds/networkconnectivity_v1beta1_networkconnectivityspoke.yaml
index 190303b8c3..5cf35a69a2 100644
--- a/crds/networkconnectivity_v1beta1_networkconnectivityspoke.yaml
+++ b/crds/networkconnectivity_v1beta1_networkconnectivityspoke.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/networkmanagement_v1alpha1_networkmanagementconnectivitytest.yaml b/crds/networkmanagement_v1alpha1_networkmanagementconnectivitytest.yaml
index d8380e04e0..df6f724dcc 100644
--- a/crds/networkmanagement_v1alpha1_networkmanagementconnectivitytest.yaml
+++ b/crds/networkmanagement_v1alpha1_networkmanagementconnectivitytest.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/networksecurity_v1beta1_networksecurityauthorizationpolicy.yaml b/crds/networksecurity_v1beta1_networksecurityauthorizationpolicy.yaml
index f478be4a2e..79ea422f01 100644
--- a/crds/networksecurity_v1beta1_networksecurityauthorizationpolicy.yaml
+++ b/crds/networksecurity_v1beta1_networksecurityauthorizationpolicy.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/networksecurity_v1beta1_networksecurityclienttlspolicy.yaml b/crds/networksecurity_v1beta1_networksecurityclienttlspolicy.yaml
index 6443a51022..9ef057b989 100644
--- a/crds/networksecurity_v1beta1_networksecurityclienttlspolicy.yaml
+++ b/crds/networksecurity_v1beta1_networksecurityclienttlspolicy.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/networksecurity_v1beta1_networksecurityservertlspolicy.yaml b/crds/networksecurity_v1beta1_networksecurityservertlspolicy.yaml
index 60bf600e9d..684b6a9d36 100644
--- a/crds/networksecurity_v1beta1_networksecurityservertlspolicy.yaml
+++ b/crds/networksecurity_v1beta1_networksecurityservertlspolicy.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/networkservices_v1alpha1_networkservicesedgecachekeyset.yaml b/crds/networkservices_v1alpha1_networkservicesedgecachekeyset.yaml
index d0661f114d..46067857a4 100644
--- a/crds/networkservices_v1alpha1_networkservicesedgecachekeyset.yaml
+++ b/crds/networkservices_v1alpha1_networkservicesedgecachekeyset.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/networkservices_v1alpha1_networkservicesedgecacheorigin.yaml b/crds/networkservices_v1alpha1_networkservicesedgecacheorigin.yaml
index 13c656dcdd..5793258822 100644
--- a/crds/networkservices_v1alpha1_networkservicesedgecacheorigin.yaml
+++ b/crds/networkservices_v1alpha1_networkservicesedgecacheorigin.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/networkservices_v1alpha1_networkservicesedgecacheservice.yaml b/crds/networkservices_v1alpha1_networkservicesedgecacheservice.yaml
index 9d55149f41..28de53eb68 100644
--- a/crds/networkservices_v1alpha1_networkservicesedgecacheservice.yaml
+++ b/crds/networkservices_v1alpha1_networkservicesedgecacheservice.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -350,7 +350,7 @@ spec:
                                       type: array
                                     ignoreCase:
                                       description: Specifies that prefixMatch and
-                                        fullPathMatch matches are case-sensitive.
+                                        fullPathMatch matches are case sensitive.
                                       type: boolean
                                     pathTemplateMatch:
                                       description: |-
@@ -537,8 +537,8 @@ spec:
 
                                               Cookie names:
                                                 - must be valid RFC 6265 "cookie-name" tokens
-                                                - are case-sensitive
-                                                - cannot start with "Edge-Cache-" (case-insensitive)
+                                                - are case sensitive
+                                                - cannot start with "Edge-Cache-" (case insensitive)
 
                                                 Note that specifying several cookies, and/or cookies that have a large range of values (e.g., per-user) will dramatically impact the cache hit rate, and may result in a higher eviction rate and reduced performance.
 
@@ -551,7 +551,7 @@ spec:
                                               Names of HTTP request headers to include in cache keys. The value of the header field will be used as part of the cache key.
 
                                               - Header names must be valid HTTP RFC 7230 header field values.
-                                              - Header field names are case-insensitive
+                                              - Header field names are case insensitive
                                               - To include the HTTP method, use ":method"
 
                                               Note that specifying several headers, and/or headers that have a large range of values (e.g. per-user) will dramatically impact the cache hit rate, and may result in a higher eviction rate and reduced performance.
@@ -610,7 +610,7 @@ spec:
 
                                           Defaults to 86400s (1 day).
 
-                                          Cache directives that attempt to set a max-age or s-maxage greater than this, or an Expires header more than maxTtl seconds in the future will be capped at the value of maxTTL, as if it were the value of an s-maxage Cache-Control directive.
+                                          Cache directives that attempt to set a max-age or s-maxage higher than this, or an Expires header more than maxTtl seconds in the future will be capped at the value of maxTTL, as if it were the value of an s-maxage Cache-Control directive.
 
                                           - The TTL must be >= 0 and <= 31,536,000 seconds (1 year)
                                           - Setting a TTL of "0" means "always revalidate"
diff --git a/crds/networkservices_v1beta1_networkservicesendpointpolicy.yaml b/crds/networkservices_v1beta1_networkservicesendpointpolicy.yaml
index a93d9ebdc6..83ba534b66 100644
--- a/crds/networkservices_v1beta1_networkservicesendpointpolicy.yaml
+++ b/crds/networkservices_v1beta1_networkservicesendpointpolicy.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
@@ -149,7 +149,7 @@ spec:
                           should contain all of the labels specified here. The selection
                           is determined based on the best match. For example, suppose
                           there are three EndpointPolicy resources P1, P2 and P3 and
-                          if P1 has the matcher as MATCH_ANY , P2 has MATCH_ALL
+                          if P1 has a the matcher as MATCH_ANY , P2 has MATCH_ALL
                           , and P3 has MATCH_ALL . If a client with label connects,
                           the config from P1 will be selected. If a client with label
                           connects, the config from P2 will be selected. If a client
diff --git a/crds/networkservices_v1beta1_networkservicesgateway.yaml b/crds/networkservices_v1beta1_networkservicesgateway.yaml
index 017f634931..362d07aee5 100644
--- a/crds/networkservices_v1beta1_networkservicesgateway.yaml
+++ b/crds/networkservices_v1beta1_networkservicesgateway.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
@@ -133,7 +133,7 @@ spec:
                 description: Immutable. Required. Immutable. Scope determines how
                   configuration across multiple Gateway instances are merged. The
                   configuration for multiple Gateway instances with the same scope
-                  will be merged as presented as a single configuration to the proxy/load
+                  will be merged as presented as a single coniguration to the proxy/load
                   balancer. Max length 64 characters. Scope should start with a letter
                   and can only have letters, numbers, hyphens.
                 type: string
diff --git a/crds/networkservices_v1beta1_networkservicesgrpcroute.yaml b/crds/networkservices_v1beta1_networkservicesgrpcroute.yaml
index 4a50ac0e3f..3aeafe0c7c 100644
--- a/crds/networkservices_v1beta1_networkservicesgrpcroute.yaml
+++ b/crds/networkservices_v1beta1_networkservicesgrpcroute.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
@@ -384,7 +384,7 @@ spec:
                             properties:
                               caseSensitive:
                                 description: Optional. Specifies that matches are
-                                  case-sensitive. The default value is true. case_sensitive
+                                  case sensitive. The default value is true. case_sensitive
                                   must not be used with a type of REGULAR_EXPRESSION.
                                 type: boolean
                               grpcMethod:
diff --git a/crds/networkservices_v1beta1_networkserviceshttproute.yaml b/crds/networkservices_v1beta1_networkserviceshttproute.yaml
index a2a3931cb5..4c12a73a4d 100644
--- a/crds/networkservices_v1beta1_networkserviceshttproute.yaml
+++ b/crds/networkservices_v1beta1_networkserviceshttproute.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
@@ -359,7 +359,7 @@ spec:
                             pathRedirect:
                               description: The path that will be used in the redirect
                                 response instead of the one that was supplied in the
-                                request. path_redirect cannot be supplied together
+                                request. path_redirect can not be supplied together
                                 with prefix_redirect. Supply one alone or neither.
                                 If neither is supplied, the path of the original request
                                 will be used for the redirect.
@@ -626,7 +626,7 @@ spec:
                             type: array
                           ignoreCase:
                             description: Specifies if prefix_match and full_path_match
-                              matches are case-sensitive. The default value is false.
+                              matches are case sensitive. The default value is false.
                             type: boolean
                           prefixMatch:
                             description: The HTTP request path value must begin with
diff --git a/crds/networkservices_v1beta1_networkservicesmesh.yaml b/crds/networkservices_v1beta1_networkservicesmesh.yaml
index 3e3b35937d..0892e74922 100644
--- a/crds/networkservices_v1beta1_networkservicesmesh.yaml
+++ b/crds/networkservices_v1beta1_networkservicesmesh.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/networkservices_v1beta1_networkservicestcproute.yaml b/crds/networkservices_v1beta1_networkservicestcproute.yaml
index 8e64fe19ef..1815624df3 100644
--- a/crds/networkservices_v1beta1_networkservicestcproute.yaml
+++ b/crds/networkservices_v1beta1_networkservicestcproute.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/networkservices_v1beta1_networkservicestlsroute.yaml b/crds/networkservices_v1beta1_networkservicestlsroute.yaml
index 3e1b24c3f2..df212ee933 100644
--- a/crds/networkservices_v1beta1_networkservicestlsroute.yaml
+++ b/crds/networkservices_v1beta1_networkservicestlsroute.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
@@ -220,7 +220,7 @@ spec:
                                 type: object
                               weight:
                                 description: 'Optional. Specifies the proportion of
-                                  requests forwarded to the backend referenced by
+                                  requests forwareded to the backend referenced by
                                   the service_name field. This is computed as: weight/Sum(weights
                                   in destinations) Weights in all destinations does
                                   not need to sum up to 100.'
diff --git a/crds/notebooks_v1alpha1_notebooksenvironment.yaml b/crds/notebooks_v1alpha1_notebooksenvironment.yaml
index e937e9eb8b..0fee131bc4 100644
--- a/crds/notebooks_v1alpha1_notebooksenvironment.yaml
+++ b/crds/notebooks_v1alpha1_notebooksenvironment.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/orgpolicy_v1alpha1_orgpolicycustomconstraint.yaml b/crds/orgpolicy_v1alpha1_orgpolicycustomconstraint.yaml
index 5529116f42..795bc818fe 100644
--- a/crds/orgpolicy_v1alpha1_orgpolicycustomconstraint.yaml
+++ b/crds/orgpolicy_v1alpha1_orgpolicycustomconstraint.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/osconfig_v1alpha1_osconfigpatchdeployment.yaml b/crds/osconfig_v1alpha1_osconfigpatchdeployment.yaml
index f6fb0e2ff1..a1f9dbe31e 100644
--- a/crds/osconfig_v1alpha1_osconfigpatchdeployment.yaml
+++ b/crds/osconfig_v1alpha1_osconfigpatchdeployment.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/osconfig_v1beta1_osconfigguestpolicy.yaml b/crds/osconfig_v1beta1_osconfigguestpolicy.yaml
index f7f2a3fbf9..fe0da8c265 100644
--- a/crds/osconfig_v1beta1_osconfigguestpolicy.yaml
+++ b/crds/osconfig_v1beta1_osconfigguestpolicy.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
@@ -165,7 +165,7 @@ spec:
                           type: string
                         osVersion:
                           description: Targets VM instances with OS Inventory enabled
-                            and having the following OS version.
+                            and having the following following OS version.
                           type: string
                       type: object
                     type: array
@@ -373,7 +373,7 @@ spec:
                                 type: string
                             type: object
                           id:
-                            description: Required. ID of the artifact, which the installation
+                            description: Required. Id of the artifact, which the installation
                               and update steps of this recipe can reference. Artifacts
                               in a recipe cannot have the same id.
                             type: string
diff --git a/crds/osconfig_v1beta1_osconfigospolicyassignment.yaml b/crds/osconfig_v1beta1_osconfigospolicyassignment.yaml
index 636d308681..2575424f69 100644
--- a/crds/osconfig_v1beta1_osconfigospolicyassignment.yaml
+++ b/crds/osconfig_v1beta1_osconfigospolicyassignment.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/oslogin_v1alpha1_osloginsshpublickey.yaml b/crds/oslogin_v1alpha1_osloginsshpublickey.yaml
index d6c0add402..7f6dfdabcd 100644
--- a/crds/oslogin_v1alpha1_osloginsshpublickey.yaml
+++ b/crds/oslogin_v1alpha1_osloginsshpublickey.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/privateca_v1beta1_privatecacapool.yaml b/crds/privateca_v1beta1_privatecacapool.yaml
index abab578f00..0434f55b68 100644
--- a/crds/privateca_v1beta1_privatecacapool.yaml
+++ b/crds/privateca_v1beta1_privatecacapool.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/privateca_v1beta1_privatecacertificate.yaml b/crds/privateca_v1beta1_privatecacertificate.yaml
index 8bbcd485f2..fed7985c76 100644
--- a/crds/privateca_v1beta1_privatecacertificate.yaml
+++ b/crds/privateca_v1beta1_privatecacertificate.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
@@ -665,7 +665,7 @@ spec:
                         type: object
                     type: object
                   subjectKeyId:
-                    description: Provides a means of identifying certificates that
+                    description: Provides a means of identifiying certificates that
                       contain a particular public key, per https://tools.ietf.org/html/rfc5280#section-4.2.1.2.
                     properties:
                       keyId:
diff --git a/crds/privateca_v1beta1_privatecacertificateauthority.yaml b/crds/privateca_v1beta1_privatecacertificateauthority.yaml
index c9b9c6d56a..b1eee17482 100644
--- a/crds/privateca_v1beta1_privatecacertificateauthority.yaml
+++ b/crds/privateca_v1beta1_privatecacertificateauthority.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
@@ -702,7 +702,7 @@ spec:
                           type: object
                       type: object
                     subjectKeyId:
-                      description: Provides a means of identifying certificates that
+                      description: Provides a means of identifiying certificates that
                         contain a particular public key, per https://tools.ietf.org/html/rfc5280#section-4.2.1.2.
                       properties:
                         keyId:
diff --git a/crds/privateca_v1beta1_privatecacertificatetemplate.yaml b/crds/privateca_v1beta1_privatecacertificatetemplate.yaml
index 406d07463b..cbd9146216 100644
--- a/crds/privateca_v1beta1_privatecacertificatetemplate.yaml
+++ b/crds/privateca_v1beta1_privatecacertificatetemplate.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/privilegedaccessmanager_v1beta1_privilegedaccessmanagerentitlement.yaml b/crds/privilegedaccessmanager_v1beta1_privilegedaccessmanagerentitlement.yaml
index c6ecdf86be..1bb0624a45 100644
--- a/crds/privilegedaccessmanager_v1beta1_privilegedaccessmanagerentitlement.yaml
+++ b/crds/privilegedaccessmanager_v1beta1_privilegedaccessmanagerentitlement.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -30,6 +30,9 @@ spec:
     kind: PrivilegedAccessManagerEntitlement
     listKind: PrivilegedAccessManagerEntitlementList
     plural: privilegedaccessmanagerentitlements
+    shortNames:
+    - gcpprivilegedaccessmanagerentitlement
+    - gcpprivilegedaccessmanagerentitlements
     singular: privilegedaccessmanagerentitlement
   scope: Namespaced
   versions:
@@ -316,12 +319,9 @@ spec:
                     x-kubernetes-preserve-unknown-fields: true
                 type: object
               resourceID:
-                description: Immutable. The PrivilegedAccessManagerEntitlement name.
-                  If not given, the 'metadata.name' will be used.
+                description: The PrivilegedAccessManagerEntitlement name. If not given,
+                  the 'metadata.name' will be used.
                 type: string
-                x-kubernetes-validations:
-                - message: ResourceID field is immutable
-                  rule: self == oldSelf
             required:
             - eligibleUsers
             - location
@@ -686,9 +686,6 @@ spec:
                 description: Immutable. The PrivilegedAccessManagerEntitlement name.
                   If not given, the 'metadata.name' will be used.
                 type: string
-                x-kubernetes-validations:
-                - message: ResourceID field is immutable
-                  rule: self == oldSelf
             required:
             - eligibleUsers
             - location
diff --git a/crds/pubsub_v1beta1_pubsubschema.yaml b/crds/pubsub_v1beta1_pubsubschema.yaml
index d9d433ddc9..89a75c1cde 100644
--- a/crds/pubsub_v1beta1_pubsubschema.yaml
+++ b/crds/pubsub_v1beta1_pubsubschema.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/pubsub_v1beta1_pubsubsubscription.yaml b/crds/pubsub_v1beta1_pubsubsubscription.yaml
index 09bc3a199d..7d795251b0 100644
--- a/crds/pubsub_v1beta1_pubsubsubscription.yaml
+++ b/crds/pubsub_v1beta1_pubsubsubscription.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/pubsub_v1beta1_pubsubtopic.yaml b/crds/pubsub_v1beta1_pubsubtopic.yaml
index f3b68d0f02..bb307877bb 100644
--- a/crds/pubsub_v1beta1_pubsubtopic.yaml
+++ b/crds/pubsub_v1beta1_pubsubtopic.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/pubsublite_v1alpha1_pubsublitesubscription.yaml b/crds/pubsublite_v1alpha1_pubsublitesubscription.yaml
index c5369875f8..5aa9eb8861 100644
--- a/crds/pubsublite_v1alpha1_pubsublitesubscription.yaml
+++ b/crds/pubsublite_v1alpha1_pubsublitesubscription.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/pubsublite_v1alpha1_pubsublitetopic.yaml b/crds/pubsublite_v1alpha1_pubsublitetopic.yaml
index f5ab8f58d6..5cd428a8a0 100644
--- a/crds/pubsublite_v1alpha1_pubsublitetopic.yaml
+++ b/crds/pubsublite_v1alpha1_pubsublitetopic.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/pubsublite_v1beta1_pubsublitereservation.yaml b/crds/pubsublite_v1beta1_pubsublitereservation.yaml
index cee3e68842..bcacb503a7 100644
--- a/crds/pubsublite_v1beta1_pubsublitereservation.yaml
+++ b/crds/pubsublite_v1beta1_pubsublitereservation.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/recaptchaenterprise_v1beta1_recaptchaenterprisekey.yaml b/crds/recaptchaenterprise_v1beta1_recaptchaenterprisekey.yaml
index 49b5804075..bc1685bc68 100644
--- a/crds/recaptchaenterprise_v1beta1_recaptchaenterprisekey.yaml
+++ b/crds/recaptchaenterprise_v1beta1_recaptchaenterprisekey.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/dcl2crd: "true"
diff --git a/crds/redis_v1beta1_rediscluster.yaml b/crds/redis_v1beta1_rediscluster.yaml
index ba56a14e92..56bff83e39 100644
--- a/crds/redis_v1beta1_rediscluster.yaml
+++ b/crds/redis_v1beta1_rediscluster.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -31,6 +31,9 @@ spec:
     kind: RedisCluster
     listKind: RedisClusterList
     plural: redisclusters
+    shortNames:
+    - gcprediscluster
+    - gcpredisclusters
     singular: rediscluster
   scope: Namespaced
   versions:
@@ -172,7 +175,7 @@ spec:
                       properties:
                         external:
                           description: A reference to an externally managed Compute
-                            Network resource. Should be in the format `projects/<projectID>/global/networks/<network>`.
+                            Network resource. Should be in the format `projects/{{projectID}}/global/networks/{{network}}`.
                           type: string
                         name:
                           description: The `name` field of a `ComputeNetwork` resource.
@@ -511,7 +514,7 @@ spec:
                       properties:
                         external:
                           description: A reference to an externally managed Compute
-                            Network resource. Should be in the format `projects/<projectID>/global/networks/<network>`.
+                            Network resource. Should be in the format `projects/{{projectID}}/global/networks/{{network}}`.
                           type: string
                         name:
                           description: The `name` field of a `ComputeNetwork` resource.
diff --git a/crds/redis_v1beta1_redisinstance.yaml b/crds/redis_v1beta1_redisinstance.yaml
index a10d9f5b2c..a2e472ea31 100644
--- a/crds/redis_v1beta1_redisinstance.yaml
+++ b/crds/redis_v1beta1_redisinstance.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -255,7 +255,7 @@ spec:
                     scheduleDeadlineTime:
                       description: |-
                         Output only. The deadline that the maintenance schedule start time
-                        cannot go beyond, including reschedule.
+                        can not go beyond, including reschedule.
                         A timestamp in RFC3339 UTC "Zulu" format, with nanosecond
                         resolution and up to nine fractional digits.
                       type: string
@@ -433,7 +433,7 @@ spec:
                     scheduleDeadlineTime:
                       description: |-
                         Output only. The deadline that the maintenance schedule start time
-                        cannot go beyond, including reschedule.
+                        can not go beyond, including reschedule.
                         A timestamp in RFC3339 UTC "Zulu" format, with nanosecond
                         resolution and up to nine fractional digits.
                       type: string
diff --git a/crds/resourcemanager_v1beta1_folder.yaml b/crds/resourcemanager_v1beta1_folder.yaml
index adb70cb7ab..194eb2fb09 100644
--- a/crds/resourcemanager_v1beta1_folder.yaml
+++ b/crds/resourcemanager_v1beta1_folder.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/resourcemanager_v1beta1_project.yaml b/crds/resourcemanager_v1beta1_project.yaml
index e361ab440a..edabee0176 100644
--- a/crds/resourcemanager_v1beta1_project.yaml
+++ b/crds/resourcemanager_v1beta1_project.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/resourcemanager_v1beta1_resourcemanagerlien.yaml b/crds/resourcemanager_v1beta1_resourcemanagerlien.yaml
index be006c9418..c9064b01a8 100644
--- a/crds/resourcemanager_v1beta1_resourcemanagerlien.yaml
+++ b/crds/resourcemanager_v1beta1_resourcemanagerlien.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/resourcemanager_v1beta1_resourcemanagerpolicy.yaml b/crds/resourcemanager_v1beta1_resourcemanagerpolicy.yaml
index 817118a166..3d2a440a4c 100644
--- a/crds/resourcemanager_v1beta1_resourcemanagerpolicy.yaml
+++ b/crds/resourcemanager_v1beta1_resourcemanagerpolicy.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/run_v1beta1_runjob.yaml b/crds/run_v1beta1_runjob.yaml
index c16e61bd58..b6ea3d02e0 100644
--- a/crds/run_v1beta1_runjob.yaml
+++ b/crds/run_v1beta1_runjob.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/run_v1beta1_runservice.yaml b/crds/run_v1beta1_runservice.yaml
index 7d1a659a24..a172aaf995 100644
--- a/crds/run_v1beta1_runservice.yaml
+++ b/crds/run_v1beta1_runservice.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/secretmanager_v1beta1_secretmanagersecret.yaml b/crds/secretmanager_v1beta1_secretmanagersecret.yaml
index 5537a70afb..41dbd64142 100644
--- a/crds/secretmanager_v1beta1_secretmanagersecret.yaml
+++ b/crds/secretmanager_v1beta1_secretmanagersecret.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -252,12 +252,9 @@ spec:
                     type: object
                 type: object
               resourceID:
-                description: Immutable. The SecretManagerSecret name. If not given,
-                  the metadata.name will be used.
+                description: The SecretManagerSecret name. If not given, the metadata.name
+                  will be used.
                 type: string
-                x-kubernetes-validations:
-                - message: ResourceID field is immutable
-                  rule: self == oldSelf
               rotation:
                 description: Optional. Rotation policy attached to the [Secret][google.cloud.secretmanager.v1.Secret].
                   May be excluded if there is no rotation policy.
@@ -328,7 +325,8 @@ spec:
                   type: object
                 type: array
               ttl:
-                description: Input only. The TTL for the [Secret][google.cloud.secretmanager.v1.Secret].
+                description: 'Input only. A duration in seconds with up to nine fractional
+                  digits, ending with ''s''. Example: "3.5s".'
                 type: string
               versionAliases:
                 additionalProperties:
@@ -396,6 +394,11 @@ spec:
               observedState:
                 description: ObservedState is the state of the resource as most recently
                   observed in GCP.
+                properties:
+                  versionAliases:
+                    additionalProperties:
+                      type: string
+                    type: object
                 type: object
             type: object
         type: object
diff --git a/crds/secretmanager_v1beta1_secretmanagersecretversion.yaml b/crds/secretmanager_v1beta1_secretmanagersecretversion.yaml
index 3c8d2c0fd9..4c053de46b 100644
--- a/crds/secretmanager_v1beta1_secretmanagersecretversion.yaml
+++ b/crds/secretmanager_v1beta1_secretmanagersecretversion.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -30,6 +30,7 @@ spec:
     categories:
     - gcp
     kind: SecretManagerSecretVersion
+    listKind: SecretManagerSecretVersionList
     plural: secretmanagersecretversions
     shortNames:
     - gcpsecretmanagersecretversion
@@ -56,55 +57,52 @@ spec:
     name: v1beta1
     schema:
       openAPIV3Schema:
+        description: SecretManagerSecretVersion is the Schema for the SecretManagerSecretVersion
+          API
         properties:
           apiVersion:
-            description: 'apiVersion defines the versioned schema of this representation
+            description: 'APIVersion defines the versioned schema of this representation
               of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources'
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
             type: string
           kind:
-            description: 'kind is a string value representing the REST resource this
+            description: 'Kind is a string value representing the REST resource this
               object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds'
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
             type: string
           metadata:
             type: object
           spec:
+            description: SecretManagerSecretVersionSpec defines the desired state
+              of SecretManagerSecretVersion
             properties:
               deletionPolicy:
-                description: |-
-                  The deletion policy for the secret version. Setting 'ABANDON' allows the resource
-                  to be abandoned rather than deleted. Setting 'DISABLE' allows the resource to be
-                  disabled rather than deleted. Default is 'DELETE'. Possible values are:
-                    * DELETE
-                    * DISABLE
-                    * ABANDON.
+                description: 'DEPRECATED. You do not need to set this field in direct
+                  reconciler mode. Use delete-policy annotation instead. https://cloud.google.com/config-connector/docs/how-to/managing-deleting-resources#keeping_resources_after_deletion
+                  The deletion policy for the secret version. Setting ''ABANDON''
+                  allows the resource to be abandoned rather than deleted. Setting
+                  ''DISABLE'' allows the resource to be disabled rather than deleted.
+                  Default is ''DELETE''. Possible values are: * DELETE * DISABLE *
+                  ABANDON.'
                 type: string
               enabled:
-                description: The current state of the SecretVersion.
+                description: Should enable or disable the current SecretVersion. -
+                  Enabled version can be accessed and described. - Disabled version
+                  cannot be accessed, but the secret's contents still exist
                 type: boolean
               isSecretDataBase64:
-                description: Immutable. If set to 'true', the secret data is expected
-                  to be base64-encoded string and would be sent as is.
+                description: DEPRECATED. You do not need to set this field in direct
+                  reconciler mode.
                 type: boolean
               resourceID:
-                description: Immutable. Optional. The service-generated name of the
-                  resource. Used for acquisition only. Leave unset to create a new
-                  resource.
+                description: The SecretVersion number. If given, Config Connector
+                  acquires the resource from the Secret Manager service. If not given,
+                  Config Connector adds a new secret version to the GCP service, and
+                  you can find out the version number from `status.observedState.version`
                 type: string
               secretData:
-                description: Immutable. The secret data. Must be no larger than 64KiB.
-                oneOf:
-                - not:
-                    required:
-                    - valueFrom
-                  required:
-                  - value
-                - not:
-                    required:
-                    - value
-                  required:
-                  - valueFrom
+                description: The actual secret data. Config Connector supports secret
+                  data stored in Kubernetes secret or plain data (base64)
                 properties:
                   value:
                     description: Value of the field. Cannot be used if 'valueFrom'
@@ -125,13 +123,15 @@ spec:
                             description: Name of the Secret to extract a value from.
                             type: string
                         required:
-                        - name
                         - key
+                        - name
                         type: object
                     type: object
                 type: object
               secretRef:
-                description: Secret Manager secret resource
+                description: The resource name of the [Secret][google.cloud.secretmanager.v1.Secret]
+                  to create a [SecretVersion][google.cloud.secretmanager.v1.SecretVersion]
+                  for.
                 oneOf:
                 - not:
                     required:
@@ -148,25 +148,24 @@ spec:
                   - external
                 properties:
                   external:
-                    description: 'Allowed value: The `name` field of a `SecretManagerSecret`
-                      resource.'
+                    description: A reference to an externally managed SecretManagerSecret
+                      resource. Should be in the format "projects/{{projectID}}/locations/{{location}}/secrets/{{secretID}}".
                     type: string
                   name:
-                    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
+                    description: The name of a SecretManagerSecret resource.
                     type: string
                   namespace:
-                    description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
+                    description: The namespace of a SecretManagerSecret resource.
                     type: string
                 type: object
-            required:
-            - secretData
-            - secretRef
             type: object
           status:
+            description: SecretManagerSecretVersionStatus defines the config connector
+              machine state of SecretManagerSecretVersion
             properties:
               conditions:
-                description: Conditions represent the latest available observation
-                  of the resource's current state.
+                description: Conditions represent the latest available observations
+                  of the object's current state.
                 items:
                   properties:
                     lastTransitionTime:
@@ -191,16 +190,20 @@ spec:
                   type: object
                 type: array
               createTime:
-                description: The time at which the Secret was created.
+                description: 'DEPRECATING NOTE: Please use status.observedState.createTime
+                  instead.'
                 type: string
               destroyTime:
-                description: The time at which the Secret was destroyed. Only present
-                  if state is DESTROYED.
+                description: 'DEPRECATING NOTE: Please use status.observedState.destroyTime
+                  instead.'
+                type: string
+              externalRef:
+                description: A unique specifier for the SecretManagerSecretVersion
+                  resource in GCP.
                 type: string
               name:
-                description: |-
-                  The resource name of the SecretVersion. Format:
-                  'projects/{{project}}/secrets/{{secret_id}}/versions/{{version}}'.
+                description: 'DEPRECATING NOTE: Please use status.observedState.name
+                  instead.'
                 type: string
               observedGeneration:
                 description: ObservedGeneration is the generation of the resource
@@ -208,9 +211,121 @@ spec:
                   If this is equal to metadata.generation, then that means that the
                   current reported status reflects the most recent desired state of
                   the resource.
+                format: int64
                 type: integer
+              observedState:
+                description: ObservedState is the state of the resource as most recently
+                  observed in GCP.
+                properties:
+                  clientSpecifiedPayloadChecksum:
+                    description: Output only. True if payload checksum specified in
+                      [SecretPayload][google.cloud.secretmanager.v1.SecretPayload]
+                      object has been received by [SecretManagerService][google.cloud.secretmanager.v1.SecretManagerService]
+                      on [SecretManagerService.AddSecretVersion][google.cloud.secretmanager.v1.SecretManagerService.AddSecretVersion].
+                    type: boolean
+                  createTime:
+                    description: Output only. The time at which the [SecretVersion][google.cloud.secretmanager.v1.SecretVersion]
+                      was created.
+                    type: string
+                  customerManagedEncryption:
+                    description: Output only. The customer-managed encryption status
+                      of the [SecretVersion][google.cloud.secretmanager.v1.SecretVersion].
+                      Only populated if customer-managed encryption is used and [Secret][google.cloud.secretmanager.v1.Secret]
+                      is a Regionalised Secret.
+                    properties:
+                      kmsKeyVersionName:
+                        description: 'Required. The resource name of the Cloud KMS
+                          CryptoKeyVersion used to encrypt the secret payload, in
+                          the following format: `projects/*/locations/*/keyRings/*/cryptoKeys/*/versions/*`.'
+                        type: string
+                    type: object
+                  destroyTime:
+                    description: Output only. The time this [SecretVersion][google.cloud.secretmanager.v1.SecretVersion]
+                      was destroyed. Only present if [state][google.cloud.secretmanager.v1.SecretVersion.state]
+                      is [DESTROYED][google.cloud.secretmanager.v1.SecretVersion.State.DESTROYED].
+                    type: string
+                  name:
+                    description: |-
+                      Output only. The resource name of the
+                      [SecretVersion][google.cloud.secretmanager.v1.SecretVersion] in the
+                      format `projects/*/secrets/*/versions/*`.
+
+                      [SecretVersion][google.cloud.secretmanager.v1.SecretVersion] IDs in a
+                      [Secret][google.cloud.secretmanager.v1.Secret] start at 1 and are
+                      incremented for each subsequent version of the secret.
+                    type: string
+                  replicationStatus:
+                    description: The replication status of the [SecretVersion][google.cloud.secretmanager.v1.SecretVersion].
+                    properties:
+                      automatic:
+                        description: |-
+                          Describes the replication status of a
+                           [SecretVersion][google.cloud.secretmanager.v1.SecretVersion] with
+                           automatic replication.
+
+                           Only populated if the parent
+                           [Secret][google.cloud.secretmanager.v1.Secret] has an automatic
+                           replication policy.
+                        properties:
+                          customerManagedEncryption:
+                            description: Output only. The customer-managed encryption
+                              status of the [SecretVersion][google.cloud.secretmanager.v1.SecretVersion].
+                              Only populated if customer-managed encryption is used.
+                            properties:
+                              kmsKeyVersionName:
+                                description: 'Required. The resource name of the Cloud
+                                  KMS CryptoKeyVersion used to encrypt the secret
+                                  payload, in the following format: `projects/*/locations/*/keyRings/*/cryptoKeys/*/versions/*`.'
+                                type: string
+                            type: object
+                        type: object
+                      userManaged:
+                        description: |-
+                          Describes the replication status of a
+                           [SecretVersion][google.cloud.secretmanager.v1.SecretVersion] with
+                           user-managed replication.
+
+                           Only populated if the parent
+                           [Secret][google.cloud.secretmanager.v1.Secret] has a user-managed
+                           replication policy.
+                        properties:
+                          replicas:
+                            description: Output only. The list of replica statuses
+                              for the [SecretVersion][google.cloud.secretmanager.v1.SecretVersion].
+                            items:
+                              properties:
+                                customerManagedEncryption:
+                                  description: Output only. The customer-managed encryption
+                                    status of the [SecretVersion][google.cloud.secretmanager.v1.SecretVersion].
+                                    Only populated if customer-managed encryption
+                                    is used.
+                                  properties:
+                                    kmsKeyVersionName:
+                                      description: 'Required. The resource name of
+                                        the Cloud KMS CryptoKeyVersion used to encrypt
+                                        the secret payload, in the following format:
+                                        `projects/*/locations/*/keyRings/*/cryptoKeys/*/versions/*`.'
+                                      type: string
+                                  type: object
+                                location:
+                                  description: 'Output only. The canonical ID of the
+                                    replica location. For example: `"us-east1"`.'
+                                  type: string
+                              type: object
+                            type: array
+                        type: object
+                    type: object
+                  scheduledDestroyTime:
+                    description: Optional. Output only. Scheduled destroy time for
+                      secret version. This is a part of the Delayed secret version
+                      destroy feature. For a Secret with a valid version destroy TTL,
+                      when a secert version is destroyed, the version is moved to
+                      disabled state and it is scheduled for destruction. The version
+                      is destroyed only after the `scheduled_destroy_time`.
+                    type: string
+                type: object
               version:
-                description: The version of the Secret.
+                description: DEPRECATED.
                 type: string
             type: object
         required:
@@ -224,5 +339,5 @@ status:
   acceptedNames:
     kind: ""
     plural: ""
-  conditions: []
-  storedVersions: []
+  conditions: null
+  storedVersions: null
diff --git a/crds/securesourcemanager_v1alpha1_securesourcemanagerinstance.yaml b/crds/securesourcemanager_v1alpha1_securesourcemanagerinstance.yaml
index f32eb06635..f94199b1d3 100644
--- a/crds/securesourcemanager_v1alpha1_securesourcemanagerinstance.yaml
+++ b/crds/securesourcemanager_v1alpha1_securesourcemanagerinstance.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -107,6 +107,51 @@ spec:
               location:
                 description: Immutable. Location of the instance.
                 type: string
+              privateConfig:
+                description: Optional. PrivateConfig includes settings for private
+                  instance.
+                properties:
+                  caPoolRef:
+                    description: Required. Immutable. CA pool resource, resource must
+                      in the format of `projects/{project}/locations/{location}/caPools/{ca_pool}`.
+                    oneOf:
+                    - not:
+                        required:
+                        - external
+                      required:
+                      - name
+                    - not:
+                        anyOf:
+                        - required:
+                          - name
+                        - required:
+                          - namespace
+                      required:
+                      - external
+                    properties:
+                      external:
+                        description: A reference to an externally managed PrivateCACAPool.
+                          Should be in the format `projects/{project_id}/locations/{region}/caPools/{caPool}`.
+                        type: string
+                      name:
+                        description: The `name` of a `PrivateCACAPool` resource.
+                        type: string
+                      namespace:
+                        description: The `namespace` of a `PrivateCACAPool` resource.
+                        type: string
+                    type: object
+                  httpServiceAttachment:
+                    description: Output only. Service Attachment for HTTP, resource
+                      is in the format of `projects/{project}/regions/{region}/serviceAttachments/{service_attachment}`.
+                    type: string
+                  isPrivate:
+                    description: Required. Immutable. Indicate if it's private instance.
+                    type: boolean
+                  sshServiceAttachment:
+                    description: Output only. Service Attachment for SSH, resource
+                      is in the format of `projects/{project}/regions/{region}/serviceAttachments/{service_attachment}`.
+                    type: string
+                type: object
               projectRef:
                 description: Immutable. The Project that this resource belongs to.
                 oneOf:
diff --git a/crds/securesourcemanager_v1alpha1_securesourcemanagerrepository.yaml b/crds/securesourcemanager_v1alpha1_securesourcemanagerrepository.yaml
index 9c2d2627fc..0905ea1ee9 100644
--- a/crds/securesourcemanager_v1alpha1_securesourcemanagerrepository.yaml
+++ b/crds/securesourcemanager_v1alpha1_securesourcemanagerrepository.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -236,7 +236,7 @@ spec:
                 properties:
                   external:
                     description: A reference to an externally managed SecureSourceManagerInstance
-                      resource. Should be in the format "projects/<projectID>/locations/<location>/instances/<instanceID>".
+                      resource. Should be in the format "projects/{{projectID}}/locations/{{location}}/instances/{{instanceID}}".
                     type: string
                   name:
                     description: The name of a SecureSourceManagerInstance resource.
@@ -281,12 +281,9 @@ spec:
                     type: string
                 type: object
               resourceID:
-                description: Immutable. The SecureSourceManagerRepository name. If
-                  not given, the metadata.name will be used.
+                description: The SecureSourceManagerRepository name. If not given,
+                  the metadata.name will be used.
                 type: string
-                x-kubernetes-validations:
-                - message: ResourceID field is immutable
-                  rule: self == oldSelf
             required:
             - instanceRef
             - location
@@ -338,6 +335,15 @@ spec:
                 description: ObservedState is the state of the resource as most recently
                   observed in GCP.
                 properties:
+                  etag:
+                    description: Output only. This checksum is computed by the server
+                      based on the value of other fields, and may be sent on update
+                      and delete requests to ensure the client has an up-to-date value
+                      before proceeding.
+                    type: string
+                  uid:
+                    description: Output only. Unique identifier of the repository.
+                    type: string
                   uris:
                     description: Output only. URIs for the repository.
                     properties:
diff --git a/crds/securitycenter_v1alpha1_securitycenternotificationconfig.yaml b/crds/securitycenter_v1alpha1_securitycenternotificationconfig.yaml
index 49e27df413..0e6b320b8a 100644
--- a/crds/securitycenter_v1alpha1_securitycenternotificationconfig.yaml
+++ b/crds/securitycenter_v1alpha1_securitycenternotificationconfig.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/securitycenter_v1alpha1_securitycentersource.yaml b/crds/securitycenter_v1alpha1_securitycentersource.yaml
index 62ebaa4903..5b7721f485 100644
--- a/crds/securitycenter_v1alpha1_securitycentersource.yaml
+++ b/crds/securitycenter_v1alpha1_securitycentersource.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/servicedirectory_v1beta1_servicedirectoryendpoint.yaml b/crds/servicedirectory_v1beta1_servicedirectoryendpoint.yaml
index 052a3e81f4..d445952567 100644
--- a/crds/servicedirectory_v1beta1_servicedirectoryendpoint.yaml
+++ b/crds/servicedirectory_v1beta1_servicedirectoryendpoint.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/servicedirectory_v1beta1_servicedirectorynamespace.yaml b/crds/servicedirectory_v1beta1_servicedirectorynamespace.yaml
index 729afd5f87..7771f07d6d 100644
--- a/crds/servicedirectory_v1beta1_servicedirectorynamespace.yaml
+++ b/crds/servicedirectory_v1beta1_servicedirectorynamespace.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/servicedirectory_v1beta1_servicedirectoryservice.yaml b/crds/servicedirectory_v1beta1_servicedirectoryservice.yaml
index 9c97710a5c..08410ba1d5 100644
--- a/crds/servicedirectory_v1beta1_servicedirectoryservice.yaml
+++ b/crds/servicedirectory_v1beta1_servicedirectoryservice.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/servicenetworking_v1beta1_servicenetworkingconnection.yaml b/crds/servicenetworking_v1beta1_servicenetworkingconnection.yaml
index 6e4cb61f65..e2d17ff260 100644
--- a/crds/servicenetworking_v1beta1_servicenetworkingconnection.yaml
+++ b/crds/servicenetworking_v1beta1_servicenetworkingconnection.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/serviceusage_v1alpha1_serviceusageconsumerquotaoverride.yaml b/crds/serviceusage_v1alpha1_serviceusageconsumerquotaoverride.yaml
index 40c65f40ba..78c3395a58 100644
--- a/crds/serviceusage_v1alpha1_serviceusageconsumerquotaoverride.yaml
+++ b/crds/serviceusage_v1alpha1_serviceusageconsumerquotaoverride.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/serviceusage_v1beta1_service.yaml b/crds/serviceusage_v1beta1_service.yaml
index e804c692fd..5d3ae77b50 100644
--- a/crds/serviceusage_v1beta1_service.yaml
+++ b/crds/serviceusage_v1beta1_service.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/serviceusage_v1beta1_serviceidentity.yaml b/crds/serviceusage_v1beta1_serviceidentity.yaml
index 8f2357f5e1..196b99e394 100644
--- a/crds/serviceusage_v1beta1_serviceidentity.yaml
+++ b/crds/serviceusage_v1beta1_serviceidentity.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/sourcerepo_v1beta1_sourcereporepository.yaml b/crds/sourcerepo_v1beta1_sourcereporepository.yaml
index 45d4c1c3fb..0afd2af153 100644
--- a/crds/sourcerepo_v1beta1_sourcereporepository.yaml
+++ b/crds/sourcerepo_v1beta1_sourcereporepository.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/spanner_v1beta1_spannerdatabase.yaml b/crds/spanner_v1beta1_spannerdatabase.yaml
index e153160b46..805dbaf236 100644
--- a/crds/spanner_v1beta1_spannerdatabase.yaml
+++ b/crds/spanner_v1beta1_spannerdatabase.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/spanner_v1beta1_spannerinstance.yaml b/crds/spanner_v1beta1_spannerinstance.yaml
index 013c46b7ab..ab17bf8397 100644
--- a/crds/spanner_v1beta1_spannerinstance.yaml
+++ b/crds/spanner_v1beta1_spannerinstance.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -73,6 +73,58 @@ spec:
           spec:
             description: SpannerInstanceSpec defines the desired state of SpannerInstance
             properties:
+              autoscalingConfig:
+                description: Optional. The autoscaling configuration. Autoscaling
+                  is enabled if this field is set. When autoscaling is enabled, node_count
+                  and processing_units are treated as OUTPUT_ONLY fields and reflect
+                  the current compute capacity allocated to the instance.
+                properties:
+                  autoscalingLimits:
+                    description: Required. Autoscaling limits for an instance.
+                    properties:
+                      maxNodes:
+                        description: Maximum number of nodes allocated to the instance.
+                          If set, this number should be greater than or equal to min_nodes.
+                        format: int32
+                        type: integer
+                      maxProcessingUnits:
+                        description: Maximum number of processing units allocated
+                          to the instance. If set, this number should be multiples
+                          of 1000 and be greater than or equal to min_processing_units.
+                        format: int32
+                        type: integer
+                      minNodes:
+                        description: Minimum number of nodes allocated to the instance.
+                          If set, this number should be greater than or equal to 1.
+                        format: int32
+                        type: integer
+                      minProcessingUnits:
+                        description: Minimum number of processing units allocated
+                          to the instance. If set, this number should be multiples
+                          of 1000.
+                        format: int32
+                        type: integer
+                    type: object
+                  autoscalingTargets:
+                    description: Required. The autoscaling targets for an instance.
+                    properties:
+                      highPriorityCpuUtilizationPercent:
+                        description: Required. The target high priority cpu utilization
+                          percentage that the autoscaler should be trying to achieve
+                          for the instance. This number is on a scale from 0 (no utilization)
+                          to 100 (full utilization). The valid range is [10, 90] inclusive.
+                        format: int32
+                        type: integer
+                      storageUtilizationPercent:
+                        description: Required. The target storage utilization percentage
+                          that the autoscaler should be trying to achieve for the
+                          instance. This number is on a scale from 0 (no utilization)
+                          to 100 (full utilization). The valid range is [10, 100]
+                          inclusive.
+                        format: int32
+                        type: integer
+                    type: object
+                type: object
               config:
                 description: Immutable. The name of the instance's configuration (similar
                   but not quite the same as a region) which defines the geographic
@@ -89,19 +141,20 @@ spec:
                   in UIs. Must be unique per project and between 4 and 30 characters
                   in length.
                 type: string
+              edition:
+                description: Optional. The `Edition` of the current instance. Currently
+                  accepted values are EDITION_UNSPECIFIED, STANDARD, ENTERPRISE, ENTERPRISE_PLUS
+                type: string
               numNodes:
-                format: int64
+                format: int32
                 type: integer
               processingUnits:
-                format: int64
+                format: int32
                 type: integer
               resourceID:
-                description: Immutable. The SpannerInstance name. If not given, the
-                  metadata.name will be used.
+                description: The SpannerInstance name. If not given, the metadata.name
+                  will be used.
                 type: string
-                x-kubernetes-validations:
-                - message: ResourceID field is immutable
-                  rule: self == oldSelf
             required:
             - config
             - displayName
@@ -148,6 +201,19 @@ spec:
                   the resource.
                 format: int64
                 type: integer
+              observedState:
+                description: ObservedState is the state of the resource as most recently
+                  observed in GCP.
+                properties:
+                  numNodes:
+                    description: NumNodes and ProcessUnits is output fields with AutoScaler
+                      is set.
+                    format: int32
+                    type: integer
+                  processingUnits:
+                    format: int32
+                    type: integer
+                type: object
               state:
                 description: 'Instance status: ''CREATING'' or ''READY''.'
                 type: string
diff --git a/crds/sql_v1beta1_sqldatabase.yaml b/crds/sql_v1beta1_sqldatabase.yaml
index e408d0a24e..8a032074e8 100644
--- a/crds/sql_v1beta1_sqldatabase.yaml
+++ b/crds/sql_v1beta1_sqldatabase.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/sql_v1beta1_sqlinstance.yaml b/crds/sql_v1beta1_sqlinstance.yaml
index f235ca550c..fcfbc58b5b 100644
--- a/crds/sql_v1beta1_sqlinstance.yaml
+++ b/crds/sql_v1beta1_sqlinstance.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -559,7 +559,7 @@ spec:
                         properties:
                           external:
                             description: A reference to an externally managed Compute
-                              Network resource. Should be in the format `projects/<projectID>/global/networks/<network>`.
+                              Network resource. Should be in the format `projects/{{projectID}}/global/networks/{{network}}`.
                             type: string
                           name:
                             description: The `name` field of a `ComputeNetwork` resource.
diff --git a/crds/sql_v1beta1_sqlsslcert.yaml b/crds/sql_v1beta1_sqlsslcert.yaml
index f97e1c86dd..3278c67981 100644
--- a/crds/sql_v1beta1_sqlsslcert.yaml
+++ b/crds/sql_v1beta1_sqlsslcert.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/sql_v1beta1_sqluser.yaml b/crds/sql_v1beta1_sqluser.yaml
index d94bdf0bfd..04301ee1b7 100644
--- a/crds/sql_v1beta1_sqluser.yaml
+++ b/crds/sql_v1beta1_sqluser.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/storage_v1alpha1_storagehmackey.yaml b/crds/storage_v1alpha1_storagehmackey.yaml
index 20e789e747..816f7c651b 100644
--- a/crds/storage_v1alpha1_storagehmackey.yaml
+++ b/crds/storage_v1alpha1_storagehmackey.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/storage_v1beta1_storagebucket.yaml b/crds/storage_v1beta1_storagebucket.yaml
index d7b6bbacf1..fee826eafe 100644
--- a/crds/storage_v1beta1_storagebucket.yaml
+++ b/crds/storage_v1beta1_storagebucket.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/storage_v1beta1_storagebucketaccesscontrol.yaml b/crds/storage_v1beta1_storagebucketaccesscontrol.yaml
index b9aabcb887..08b15c8bca 100644
--- a/crds/storage_v1beta1_storagebucketaccesscontrol.yaml
+++ b/crds/storage_v1beta1_storagebucketaccesscontrol.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/storage_v1beta1_storagedefaultobjectaccesscontrol.yaml b/crds/storage_v1beta1_storagedefaultobjectaccesscontrol.yaml
index 61d32f66af..d768651e4c 100644
--- a/crds/storage_v1beta1_storagedefaultobjectaccesscontrol.yaml
+++ b/crds/storage_v1beta1_storagedefaultobjectaccesscontrol.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/storage_v1beta1_storagenotification.yaml b/crds/storage_v1beta1_storagenotification.yaml
index f107fa3b7d..97052c4003 100644
--- a/crds/storage_v1beta1_storagenotification.yaml
+++ b/crds/storage_v1beta1_storagenotification.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/storagetransfer_v1alpha1_storagetransferagentpool.yaml b/crds/storagetransfer_v1alpha1_storagetransferagentpool.yaml
index b3d89b3425..35febc76d5 100644
--- a/crds/storagetransfer_v1alpha1_storagetransferagentpool.yaml
+++ b/crds/storagetransfer_v1alpha1_storagetransferagentpool.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/storagetransfer_v1beta1_storagetransferjob.yaml b/crds/storagetransfer_v1beta1_storagetransferjob.yaml
index cedf57ef0e..42523940db 100644
--- a/crds/storagetransfer_v1beta1_storagetransferjob.yaml
+++ b/crds/storagetransfer_v1beta1_storagetransferjob.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/tags_v1alpha1_tagslocationtagbinding.yaml b/crds/tags_v1alpha1_tagslocationtagbinding.yaml
index 0e40baf37d..de75f0a745 100644
--- a/crds/tags_v1alpha1_tagslocationtagbinding.yaml
+++ b/crds/tags_v1alpha1_tagslocationtagbinding.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/tags_v1beta1_tagstagbinding.yaml b/crds/tags_v1beta1_tagstagbinding.yaml
index 48161dcd42..78938a3d5e 100644
--- a/crds/tags_v1beta1_tagstagbinding.yaml
+++ b/crds/tags_v1beta1_tagstagbinding.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/tags_v1beta1_tagstagkey.yaml b/crds/tags_v1beta1_tagstagkey.yaml
index af0ea8b1d6..4d92ba19a6 100644
--- a/crds/tags_v1beta1_tagstagkey.yaml
+++ b/crds/tags_v1beta1_tagstagkey.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/tags_v1beta1_tagstagvalue.yaml b/crds/tags_v1beta1_tagstagvalue.yaml
index 4ec988d2f7..3ad3a6627c 100644
--- a/crds/tags_v1beta1_tagstagvalue.yaml
+++ b/crds/tags_v1beta1_tagstagvalue.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/tpu_v1alpha1_tpunode.yaml b/crds/tpu_v1alpha1_tpunode.yaml
index 3ad74dc45a..9342fc8637 100644
--- a/crds/tpu_v1alpha1_tpunode.yaml
+++ b/crds/tpu_v1alpha1_tpunode.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -147,7 +147,7 @@ spec:
                   Immutable. Whether the VPC peering for the node is set up through Service Networking API.
                   The VPC Peering should be set up before provisioning the node. If this field is set,
                   cidr_block field should not be specified. If the network that you want to peer the
-                  TPU Node to is a Shared VPC network, the node must be created with this field enabled.
+                  TPU Node to is a Shared VPC network, the node must be created with this this field enabled.
                 type: boolean
               zone:
                 description: Immutable. The GCP location for the TPU. If it is not
diff --git a/crds/vertexai_v1alpha1_vertexaifeaturestore.yaml b/crds/vertexai_v1alpha1_vertexaifeaturestore.yaml
index c9a32fde6a..58b199c0d9 100644
--- a/crds/vertexai_v1alpha1_vertexaifeaturestore.yaml
+++ b/crds/vertexai_v1alpha1_vertexaifeaturestore.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/vertexai_v1alpha1_vertexaifeaturestoreentitytype.yaml b/crds/vertexai_v1alpha1_vertexaifeaturestoreentitytype.yaml
index c8fe8bc84d..f081ccf16b 100644
--- a/crds/vertexai_v1alpha1_vertexaifeaturestoreentitytype.yaml
+++ b/crds/vertexai_v1alpha1_vertexaifeaturestoreentitytype.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -93,7 +93,7 @@ spec:
                       value:
                         description: Specify a threshold value that can trigger the
                           alert. For categorical feature, the distribution distance
-                          is calculated by L-infinity norm. Each feature must have
+                          is calculated by L-inifinity norm. Each feature must have
                           a non-zero threshold if they need to be monitored. Otherwise
                           no alert will be triggered for that feature. The default
                           value is 0.3.
diff --git a/crds/vertexai_v1alpha1_vertexaifeaturestoreentitytypefeature.yaml b/crds/vertexai_v1alpha1_vertexaifeaturestoreentitytypefeature.yaml
index 3aa5ee2eb7..009faa3613 100644
--- a/crds/vertexai_v1alpha1_vertexaifeaturestoreentitytypefeature.yaml
+++ b/crds/vertexai_v1alpha1_vertexaifeaturestoreentitytypefeature.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/vertexai_v1alpha1_vertexaiindexendpoint.yaml b/crds/vertexai_v1alpha1_vertexaiindexendpoint.yaml
index 4aaee0d5e2..ba2c3cead1 100644
--- a/crds/vertexai_v1alpha1_vertexaiindexendpoint.yaml
+++ b/crds/vertexai_v1alpha1_vertexaiindexendpoint.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/vertexai_v1alpha1_vertexaimetadatastore.yaml b/crds/vertexai_v1alpha1_vertexaimetadatastore.yaml
index cbaa3a52c4..6bc461398d 100644
--- a/crds/vertexai_v1alpha1_vertexaimetadatastore.yaml
+++ b/crds/vertexai_v1alpha1_vertexaimetadatastore.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/vertexai_v1alpha1_vertexaitensorboard.yaml b/crds/vertexai_v1alpha1_vertexaitensorboard.yaml
index eae1e9b957..e4c8b5925b 100644
--- a/crds/vertexai_v1alpha1_vertexaitensorboard.yaml
+++ b/crds/vertexai_v1alpha1_vertexaitensorboard.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/vertexai_v1beta1_vertexaidataset.yaml b/crds/vertexai_v1beta1_vertexaidataset.yaml
index cdea64cc88..e14322a784 100644
--- a/crds/vertexai_v1beta1_vertexaidataset.yaml
+++ b/crds/vertexai_v1beta1_vertexaidataset.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/vertexai_v1beta1_vertexaiendpoint.yaml b/crds/vertexai_v1beta1_vertexaiendpoint.yaml
index 873c86f3f6..bf38f7d155 100644
--- a/crds/vertexai_v1beta1_vertexaiendpoint.yaml
+++ b/crds/vertexai_v1beta1_vertexaiendpoint.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/vertexai_v1beta1_vertexaiindex.yaml b/crds/vertexai_v1beta1_vertexaiindex.yaml
index e0333e7d12..fb049cb880 100644
--- a/crds/vertexai_v1beta1_vertexaiindex.yaml
+++ b/crds/vertexai_v1beta1_vertexaiindex.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/vpcaccess_v1beta1_vpcaccessconnector.yaml b/crds/vpcaccess_v1beta1_vpcaccessconnector.yaml
index 2f90b87c9a..8f1c0008ad 100644
--- a/crds/vpcaccess_v1beta1_vpcaccessconnector.yaml
+++ b/crds/vpcaccess_v1beta1_vpcaccessconnector.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/workflows_v1alpha1_workflowsworkflow.yaml b/crds/workflows_v1alpha1_workflowsworkflow.yaml
index f479ac7677..9cca6e6aac 100644
--- a/crds/workflows_v1alpha1_workflowsworkflow.yaml
+++ b/crds/workflows_v1alpha1_workflowsworkflow.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
diff --git a/crds/workstations_v1beta1_workstation.yaml b/crds/workstations_v1beta1_workstation.yaml
new file mode 100644
index 0000000000..29b86037aa
--- /dev/null
+++ b/crds/workstations_v1beta1_workstation.yaml
@@ -0,0 +1,422 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    cnrm.cloud.google.com/version: 1.128.0
+  creationTimestamp: null
+  labels:
+    cnrm.cloud.google.com/managed-by-kcc: "true"
+    cnrm.cloud.google.com/system: "true"
+  name: workstations.workstations.cnrm.cloud.google.com
+spec:
+  group: workstations.cnrm.cloud.google.com
+  names:
+    categories:
+    - gcp
+    kind: Workstation
+    listKind: WorkstationList
+    plural: workstations
+    shortNames:
+    - gcpworkstation
+    - gcpworkstations
+    singular: workstation
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    - description: When 'True', the most recent reconcile of the resource succeeded
+      jsonPath: .status.conditions[?(@.type=='Ready')].status
+      name: Ready
+      type: string
+    - description: The reason for the value in 'Ready'
+      jsonPath: .status.conditions[?(@.type=='Ready')].reason
+      name: Status
+      type: string
+    - description: The last transition time for the value in 'Status'
+      jsonPath: .status.conditions[?(@.type=='Ready')].lastTransitionTime
+      name: Status Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: Workstation is the Schema for the Workstation API
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: WorkstationSpec defines the desired state of Workstation
+            properties:
+              annotations:
+                description: Optional. Client-specified annotations.
+                items:
+                  properties:
+                    key:
+                      description: Key for the annotation.
+                      type: string
+                    value:
+                      description: Value for the annotation.
+                      type: string
+                  type: object
+                type: array
+              displayName:
+                description: Optional. Human-readable name for this workstation.
+                type: string
+              labels:
+                description: Optional. [Labels](https://cloud.google.com/workstations/docs/label-resources)
+                  that are applied to the workstation and that are also propagated
+                  to the underlying Compute Engine resources.
+                items:
+                  properties:
+                    key:
+                      description: Key for the label.
+                      type: string
+                    value:
+                      description: Value for the label.
+                      type: string
+                  type: object
+                type: array
+              parentRef:
+                description: Parent is a reference to the parent WorkstationConfig
+                  for this Workstation.
+                oneOf:
+                - not:
+                    required:
+                    - external
+                  required:
+                  - name
+                - not:
+                    anyOf:
+                    - required:
+                      - name
+                    - required:
+                      - namespace
+                  required:
+                  - external
+                properties:
+                  external:
+                    description: A reference to an externally managed WorkstationConfig
+                      resource. Should be in the format "projects/{{projectID}}/locations/{{location}}/workstationClusters/{{workstationclusterID}}/workstationConfigs/{{workstationconfigID}}".
+                    type: string
+                  name:
+                    description: The name of a WorkstationConfig resource.
+                    type: string
+                  namespace:
+                    description: The namespace of a WorkstationConfig resource.
+                    type: string
+                type: object
+              resourceID:
+                description: The Workstation name. If not given, the metadata.name
+                  will be used.
+                type: string
+            required:
+            - parentRef
+            type: object
+          status:
+            description: WorkstationStatus defines the config connector machine state
+              of Workstation
+            properties:
+              conditions:
+                description: Conditions represent the latest available observations
+                  of the object's current state.
+                items:
+                  properties:
+                    lastTransitionTime:
+                      description: Last time the condition transitioned from one status
+                        to another.
+                      type: string
+                    message:
+                      description: Human-readable message indicating details about
+                        last transition.
+                      type: string
+                    reason:
+                      description: Unique, one-word, CamelCase reason for the condition's
+                        last transition.
+                      type: string
+                    status:
+                      description: Status is the status of the condition. Can be True,
+                        False, Unknown.
+                      type: string
+                    type:
+                      description: Type is the type of the condition.
+                      type: string
+                  type: object
+                type: array
+              externalRef:
+                description: A unique specifier for the Workstation resource in GCP.
+                type: string
+              observedGeneration:
+                description: ObservedGeneration is the generation of the resource
+                  that was most recently observed by the Config Connector controller.
+                  If this is equal to metadata.generation, then that means that the
+                  current reported status reflects the most recent desired state of
+                  the resource.
+                format: int64
+                type: integer
+              observedState:
+                description: ObservedState is the state of the resource as most recently
+                  observed in GCP.
+                properties:
+                  createTime:
+                    description: Output only. Time when this workstation was created.
+                    type: string
+                  deleteTime:
+                    description: Output only. Time when this workstation was soft-deleted.
+                    type: string
+                  etag:
+                    description: Output only. Checksum computed by the server. May
+                      be sent on update and delete requests to make sure that the
+                      client has an up-to-date value before proceeding.
+                    type: string
+                  host:
+                    description: Output only. Host to which clients can send HTTPS
+                      traffic that will be received by the workstation. Authorized
+                      traffic will be received to the workstation as HTTP on port
+                      80. To send traffic to a different port, clients may prefix
+                      the host with the destination port in the format `{port}-{host}`.
+                    type: string
+                  startTime:
+                    description: Output only. Time when this workstation was most
+                      recently successfully started, regardless of the workstation's
+                      initial state.
+                    type: string
+                  state:
+                    description: Output only. Current state of the workstation.
+                    type: string
+                  uid:
+                    description: Output only. A system-assigned unique identifier
+                      for this workstation.
+                    type: string
+                  updateTime:
+                    description: Output only. Time when this workstation was most
+                      recently updated.
+                    type: string
+                type: object
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: false
+    subresources:
+      status: {}
+  - additionalPrinterColumns:
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    - description: When 'True', the most recent reconcile of the resource succeeded
+      jsonPath: .status.conditions[?(@.type=='Ready')].status
+      name: Ready
+      type: string
+    - description: The reason for the value in 'Ready'
+      jsonPath: .status.conditions[?(@.type=='Ready')].reason
+      name: Status
+      type: string
+    - description: The last transition time for the value in 'Status'
+      jsonPath: .status.conditions[?(@.type=='Ready')].lastTransitionTime
+      name: Status Age
+      type: date
+    name: v1beta1
+    schema:
+      openAPIV3Schema:
+        description: Workstation is the Schema for the Workstation API
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: WorkstationSpec defines the desired state of Workstation
+            properties:
+              annotations:
+                description: Optional. Client-specified annotations.
+                items:
+                  properties:
+                    key:
+                      description: Key for the annotation.
+                      type: string
+                    value:
+                      description: Value for the annotation.
+                      type: string
+                  type: object
+                type: array
+              displayName:
+                description: Optional. Human-readable name for this workstation.
+                type: string
+              labels:
+                description: Optional. [Labels](https://cloud.google.com/workstations/docs/label-resources)
+                  that are applied to the workstation and that are also propagated
+                  to the underlying Compute Engine resources.
+                items:
+                  properties:
+                    key:
+                      description: Key for the label.
+                      type: string
+                    value:
+                      description: Value for the label.
+                      type: string
+                  type: object
+                type: array
+              parentRef:
+                description: Parent is a reference to the parent WorkstationConfig
+                  for this Workstation.
+                oneOf:
+                - not:
+                    required:
+                    - external
+                  required:
+                  - name
+                - not:
+                    anyOf:
+                    - required:
+                      - name
+                    - required:
+                      - namespace
+                  required:
+                  - external
+                properties:
+                  external:
+                    description: A reference to an externally managed WorkstationConfig
+                      resource. Should be in the format "projects/{{projectID}}/locations/{{location}}/workstationClusters/{{workstationclusterID}}/workstationConfigs/{{workstationconfigID}}".
+                    type: string
+                  name:
+                    description: The name of a WorkstationConfig resource.
+                    type: string
+                  namespace:
+                    description: The namespace of a WorkstationConfig resource.
+                    type: string
+                type: object
+              resourceID:
+                description: The Workstation name. If not given, the metadata.name
+                  will be used.
+                type: string
+            required:
+            - parentRef
+            type: object
+          status:
+            description: WorkstationStatus defines the config connector machine state
+              of Workstation
+            properties:
+              conditions:
+                description: Conditions represent the latest available observations
+                  of the object's current state.
+                items:
+                  properties:
+                    lastTransitionTime:
+                      description: Last time the condition transitioned from one status
+                        to another.
+                      type: string
+                    message:
+                      description: Human-readable message indicating details about
+                        last transition.
+                      type: string
+                    reason:
+                      description: Unique, one-word, CamelCase reason for the condition's
+                        last transition.
+                      type: string
+                    status:
+                      description: Status is the status of the condition. Can be True,
+                        False, Unknown.
+                      type: string
+                    type:
+                      description: Type is the type of the condition.
+                      type: string
+                  type: object
+                type: array
+              externalRef:
+                description: A unique specifier for the Workstation resource in GCP.
+                type: string
+              observedGeneration:
+                description: ObservedGeneration is the generation of the resource
+                  that was most recently observed by the Config Connector controller.
+                  If this is equal to metadata.generation, then that means that the
+                  current reported status reflects the most recent desired state of
+                  the resource.
+                format: int64
+                type: integer
+              observedState:
+                description: ObservedState is the state of the resource as most recently
+                  observed in GCP.
+                properties:
+                  createTime:
+                    description: Output only. Time when this workstation was created.
+                    type: string
+                  deleteTime:
+                    description: Output only. Time when this workstation was soft-deleted.
+                    type: string
+                  etag:
+                    description: Output only. Checksum computed by the server. May
+                      be sent on update and delete requests to make sure that the
+                      client has an up-to-date value before proceeding.
+                    type: string
+                  host:
+                    description: Output only. Host to which clients can send HTTPS
+                      traffic that will be received by the workstation. Authorized
+                      traffic will be received to the workstation as HTTP on port
+                      80. To send traffic to a different port, clients may prefix
+                      the host with the destination port in the format `{port}-{host}`.
+                    type: string
+                  startTime:
+                    description: Output only. Time when this workstation was most
+                      recently successfully started, regardless of the workstation's
+                      initial state.
+                    type: string
+                  state:
+                    description: Output only. Current state of the workstation.
+                    type: string
+                  uid:
+                    description: Output only. A system-assigned unique identifier
+                      for this workstation.
+                    type: string
+                  updateTime:
+                    description: Output only. Time when this workstation was most
+                      recently updated.
+                    type: string
+                type: object
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: null
+  storedVersions: null
diff --git a/crds/workstations_v1beta1_workstationcluster.yaml b/crds/workstations_v1beta1_workstationcluster.yaml
index 51a4bb97f6..b57e43fa88 100644
--- a/crds/workstations_v1beta1_workstationcluster.yaml
+++ b/crds/workstations_v1beta1_workstationcluster.yaml
@@ -1,4 +1,4 @@
-# Copyright 2020 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cnrm.cloud.google.com/version: 1.125.0
+    cnrm.cloud.google.com/version: 1.128.0
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
@@ -30,6 +30,9 @@ spec:
     kind: WorkstationCluster
     listKind: WorkstationClusterList
     plural: workstationclusters
+    shortNames:
+    - gcpworkstationcluster
+    - gcpworkstationclusters
     singular: workstationcluster
   scope: Namespaced
   versions:
@@ -91,10 +94,10 @@ spec:
                 items:
                   properties:
                     key:
-                      description: Key for the annotation.
+                      description: Key for the label.
                       type: string
                     value:
-                      description: Value for the annotation.
+                      description: Value for the label.
                       type: string
                   type: object
                 type: array
@@ -122,7 +125,7 @@ spec:
                 properties:
                   external:
                     description: A reference to an externally managed Compute Network
-                      resource. Should be in the format `projects/<projectID>/global/networks/<network>`.
+                      resource. Should be in the format `projects/{{projectID}}/global/networks/{{network}}`.
                     type: string
                   name:
                     description: The `name` field of a `ComputeNetwork` resource.
@@ -215,12 +218,9 @@ spec:
                 - message: ResourceID field is immutable
                   rule: self == oldSelf
               resourceID:
-                description: Immutable. The WorkstationCluster name. If not given,
-                  the metadata.name will be used.
+                description: The WorkstationCluster name. If not given, the metadata.name
+                  will be used.
                 type: string
-                x-kubernetes-validations:
-                - message: ResourceID field is immutable
-                  rule: self == oldSelf
               subnetworkRef:
                 description: Immutable. Reference to the Compute Engine subnetwork
                   in which instances associated with this workstation cluster will
@@ -437,10 +437,10 @@ spec:
                 items:
                   properties:
                     key:
-                      description: Key for the annotation.
+                      description: Key for the label.
                       type: string
                     value:
-                      description: Value for the annotation.
+                      description: Value for the label.
                       type: string
                   type: object
                 type: array
@@ -468,7 +468,7 @@ spec:
                 properties:
                   external:
                     description: A reference to an externally managed Compute Network
-                      resource. Should be in the format `projects/<projectID>/global/networks/<network>`.
+                      resource. Should be in the format `projects/{{projectID}}/global/networks/{{network}}`.
                     type: string
                   name:
                     description: The `name` field of a `ComputeNetwork` resource.
@@ -561,12 +561,9 @@ spec:
                 - message: ResourceID field is immutable
                   rule: self == oldSelf
               resourceID:
-                description: Immutable. The WorkstationCluster name. If not given,
-                  the metadata.name will be used.
+                description: The WorkstationCluster name. If not given, the metadata.name
+                  will be used.
                 type: string
-                x-kubernetes-validations:
-                - message: ResourceID field is immutable
-                  rule: self == oldSelf
               subnetworkRef:
                 description: Immutable. Reference to the Compute Engine subnetwork
                   in which instances associated with this workstation cluster will
diff --git a/crds/workstations_v1beta1_workstationconfig.yaml b/crds/workstations_v1beta1_workstationconfig.yaml
new file mode 100644
index 0000000000..7eb70b038e
--- /dev/null
+++ b/crds/workstations_v1beta1_workstationconfig.yaml
@@ -0,0 +1,1298 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    cnrm.cloud.google.com/version: 1.128.0
+  creationTimestamp: null
+  labels:
+    cnrm.cloud.google.com/managed-by-kcc: "true"
+    cnrm.cloud.google.com/system: "true"
+  name: workstationconfigs.workstations.cnrm.cloud.google.com
+spec:
+  group: workstations.cnrm.cloud.google.com
+  names:
+    categories:
+    - gcp
+    kind: WorkstationConfig
+    listKind: WorkstationConfigList
+    plural: workstationconfigs
+    shortNames:
+    - gcpworkstationconfig
+    - gcpworkstationconfigs
+    singular: workstationconfig
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    - description: When 'True', the most recent reconcile of the resource succeeded
+      jsonPath: .status.conditions[?(@.type=='Ready')].status
+      name: Ready
+      type: string
+    - description: The reason for the value in 'Ready'
+      jsonPath: .status.conditions[?(@.type=='Ready')].reason
+      name: Status
+      type: string
+    - description: The last transition time for the value in 'Status'
+      jsonPath: .status.conditions[?(@.type=='Ready')].lastTransitionTime
+      name: Status Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: WorkstationConfig is the Schema for the WorkstationConfig API
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: WorkstationConfigSpec defines the desired state of WorkstationConfig
+            properties:
+              annotations:
+                description: Optional. Client-specified annotations.
+                items:
+                  properties:
+                    key:
+                      description: Key for the annotation.
+                      type: string
+                    value:
+                      description: Value for the annotation.
+                      type: string
+                  type: object
+                type: array
+              container:
+                description: Optional. Container that runs upon startup for each workstation
+                  using this workstation configuration.
+                properties:
+                  args:
+                    description: Optional. Arguments passed to the entrypoint.
+                    items:
+                      type: string
+                    type: array
+                  command:
+                    description: Optional. If set, overrides the default ENTRYPOINT
+                      specified by the image.
+                    items:
+                      type: string
+                    type: array
+                  env:
+                    description: Optional. Environment variables passed to the container's
+                      entrypoint.
+                    items:
+                      properties:
+                        name:
+                          description: Name is the name of the environment variable.
+                          type: string
+                        value:
+                          description: Value is the value of the environment variable.
+                          type: string
+                      type: object
+                    type: array
+                  image:
+                    description: |-
+                      Optional. A Docker container image that defines a custom environment.
+
+                       Cloud Workstations provides a number of
+                       [preconfigured
+                       images](https://cloud.google.com/workstations/docs/preconfigured-base-images),
+                       but you can create your own
+                       [custom container
+                       images](https://cloud.google.com/workstations/docs/custom-container-images).
+                       If using a private image, the `host.gceInstance.serviceAccount` field
+                       must be specified in the workstation configuration and must have
+                       permission to pull the specified image. Otherwise, the image must be
+                       publicly accessible.
+                    type: string
+                  runAsUser:
+                    description: Optional. If set, overrides the USER specified in
+                      the image with the given uid.
+                    format: int32
+                    type: integer
+                  workingDir:
+                    description: Optional. If set, overrides the default DIR specified
+                      by the image.
+                    type: string
+                type: object
+              displayName:
+                description: Optional. Human-readable name for this workstation configuration.
+                type: string
+              encryptionKey:
+                description: |-
+                  Immutable. Encrypts resources of this workstation configuration using a
+                   customer-managed encryption key (CMEK).
+
+                   If specified, the boot disk of the Compute Engine instance and the
+                   persistent disk are encrypted using this encryption key. If
+                   this field is not set, the disks are encrypted using a generated
+                   key. Customer-managed encryption keys do not protect disk metadata.
+
+                   If the customer-managed encryption key is rotated, when the workstation
+                   instance is stopped, the system attempts to recreate the
+                   persistent disk with the new version of the key. Be sure to keep
+                   older versions of the key until the persistent disk is recreated.
+                   Otherwise, data on the persistent disk might be lost.
+
+                   If the encryption key is revoked, the workstation session automatically
+                   stops within 7 hours.
+
+                   Immutable after the workstation configuration is created.
+                properties:
+                  kmsCryptoKeyRef:
+                    description: Immutable. A reference to the Google Cloud KMS encryption
+                      key. For example, `"projects/PROJECT_ID/locations/REGION/keyRings/KEY_RING/cryptoKeys/KEY_NAME"`.
+                      The key must be in the same region as the workstation configuration.
+                    oneOf:
+                    - not:
+                        required:
+                        - external
+                      required:
+                      - name
+                    - not:
+                        anyOf:
+                        - required:
+                          - name
+                        - required:
+                          - namespace
+                      required:
+                      - external
+                    properties:
+                      external:
+                        description: A reference to an externally managed KMSCryptoKey.
+                          Should be in the format `projects/[kms_project_id]/locations/[region]/keyRings/[key_ring_id]/cryptoKeys/[key]`.
+                        type: string
+                      name:
+                        description: The `name` of a `KMSCryptoKey` resource.
+                        type: string
+                      namespace:
+                        description: The `namespace` of a `KMSCryptoKey` resource.
+                        type: string
+                    type: object
+                  serviceAccountRef:
+                    description: Immutable. A reference to a service account to use
+                      with the specified KMS key. We recommend that you use a separate
+                      service account and follow KMS best practices. For more information,
+                      see [Separation of duties](https://cloud.google.com/kms/docs/separation-of-duties)
+                      and `gcloud kms keys add-iam-policy-binding` [`--member`](https://cloud.google.com/sdk/gcloud/reference/kms/keys/add-iam-policy-binding#--member).
+                    oneOf:
+                    - not:
+                        required:
+                        - external
+                      required:
+                      - name
+                    - not:
+                        anyOf:
+                        - required:
+                          - name
+                        - required:
+                          - namespace
+                      required:
+                      - external
+                    properties:
+                      external:
+                        description: The `email` field of an `IAMServiceAccount` resource.
+                        type: string
+                      name:
+                        description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
+                        type: string
+                      namespace:
+                        description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
+                        type: string
+                    type: object
+                type: object
+              host:
+                description: Optional. Runtime host for the workstation.
+                properties:
+                  gceInstance:
+                    description: Specifies a Compute Engine instance as the host.
+                    properties:
+                      bootDiskSizeGB:
+                        description: Optional. The size of the boot disk for the VM
+                          in gigabytes (GB). The minimum boot disk size is `30` GB.
+                          Defaults to `50` GB.
+                        format: int32
+                        type: integer
+                      confidentialInstanceConfig:
+                        description: Optional. A set of Compute Engine Confidential
+                          VM instance options.
+                        properties:
+                          enableConfidentialCompute:
+                            description: Optional. Whether the instance has confidential
+                              compute enabled.
+                            type: boolean
+                        type: object
+                      disablePublicIPAddresses:
+                        description: Optional. When set to true, disables public IP
+                          addresses for VMs. If you disable public IP addresses, you
+                          must set up Private Google Access or Cloud NAT on your network.
+                          If you use Private Google Access and you use `private.googleapis.com`
+                          or `restricted.googleapis.com` for Container Registry and
+                          Artifact Registry, make sure that you set up DNS records
+                          for domains `*.gcr.io` and `*.pkg.dev`. Defaults to false
+                          (VMs have public IP addresses).
+                        type: boolean
+                      enableNestedVirtualization:
+                        description: |-
+                          Optional. Whether to enable nested virtualization on Cloud Workstations
+                           VMs created under this workstation configuration.
+
+                           Nested virtualization lets you run virtual machine (VM) instances
+                           inside your workstation. Before enabling nested virtualization,
+                           consider the following important considerations. Cloud Workstations
+                           instances are subject to the [same restrictions as Compute Engine
+                           instances](https://cloud.google.com/compute/docs/instances/nested-virtualization/overview#restrictions):
+
+                           * **Organization policy**: projects, folders, or
+                           organizations may be restricted from creating nested VMs if the
+                           **Disable VM nested virtualization** constraint is enforced in
+                           the organization policy. For more information, see the
+                           Compute Engine section,
+                           [Checking whether nested virtualization is
+                           allowed](https://cloud.google.com/compute/docs/instances/nested-virtualization/managing-constraint#checking_whether_nested_virtualization_is_allowed).
+                           * **Performance**: nested VMs might experience a 10% or greater
+                           decrease in performance for workloads that are CPU-bound and
+                           possibly greater than a 10% decrease for workloads that are
+                           input/output bound.
+                           * **Machine Type**: nested virtualization can only be enabled on
+                           workstation configurations that specify a
+                           [machine_type][google.cloud.workstations.v1.WorkstationConfig.Host.GceInstance.machine_type]
+                           in the N1 or N2 machine series.
+                           * **GPUs**: nested virtualization may not be enabled on workstation
+                           configurations with accelerators.
+                           * **Operating System**: Because
+                           [Container-Optimized
+                           OS](https://cloud.google.com/compute/docs/images/os-details#container-optimized_os_cos)
+                           does not support nested virtualization, when nested virtualization is
+                           enabled, the underlying Compute Engine VM instances boot from an
+                           [Ubuntu
+                           LTS](https://cloud.google.com/compute/docs/images/os-details#ubuntu_lts)
+                           image.
+                        type: boolean
+                      machineType:
+                        description: Optional. The type of machine to use for VM instances—for
+                          example, `"e2-standard-4"`. For more information about machine
+                          types that Cloud Workstations supports, see the list of
+                          [available machine types](https://cloud.google.com/workstations/docs/available-machine-types).
+                        type: string
+                      poolSize:
+                        description: Optional. The number of VMs that the system should
+                          keep idle so that new workstations can be started quickly
+                          for new users. Defaults to `0` in the API.
+                        format: int32
+                        type: integer
+                      serviceAccountRef:
+                        description: |-
+                          Optional. A reference to the service account for Cloud
+                           Workstations VMs created with this configuration. When specified, be
+                           sure that the service account has `logginglogEntries.create` permission
+                           on the project so it can write logs out to Cloud Logging. If using a
+                           custom container image, the service account must have permissions to
+                           pull the specified image.
+
+                           If you as the administrator want to be able to `ssh` into the
+                           underlying VM, you need to set this value to a service account
+                           for which you have the `iam.serviceAccounts.actAs` permission.
+                           Conversely, if you don't want anyone to be able to `ssh` into the
+                           underlying VM, use a service account where no one has that
+                           permission.
+
+                           If not set, VMs run with a service account provided by the
+                           Cloud Workstations service, and the image must be publicly
+                           accessible.
+                        oneOf:
+                        - not:
+                            required:
+                            - external
+                          required:
+                          - name
+                        - not:
+                            anyOf:
+                            - required:
+                              - name
+                            - required:
+                              - namespace
+                          required:
+                          - external
+                        properties:
+                          external:
+                            description: The `email` field of an `IAMServiceAccount`
+                              resource.
+                            type: string
+                          name:
+                            description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
+                            type: string
+                          namespace:
+                            description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
+                            type: string
+                        type: object
+                      serviceAccountScopes:
+                        description: Optional. Scopes to grant to the [service_account][google.cloud.workstations.v1.WorkstationConfig.Host.GceInstance.service_account].
+                          Various scopes are automatically added based on feature
+                          usage. When specified, users of workstations under this
+                          configuration must have `iam.serviceAccounts.actAs` on the
+                          service account.
+                        items:
+                          type: string
+                        type: array
+                      shieldedInstanceConfig:
+                        description: Optional. A set of Compute Engine Shielded instance
+                          options.
+                        properties:
+                          enableIntegrityMonitoring:
+                            description: Optional. Whether the instance has integrity
+                              monitoring enabled.
+                            type: boolean
+                          enableSecureBoot:
+                            description: Optional. Whether the instance has Secure
+                              Boot enabled.
+                            type: boolean
+                          enableVTPM:
+                            description: Optional. Whether the instance has the vTPM
+                              enabled.
+                            type: boolean
+                        type: object
+                      tags:
+                        description: Optional. Network tags to add to the Compute
+                          Engine VMs backing the workstations. This option applies
+                          [network tags](https://cloud.google.com/vpc/docs/add-remove-network-tags)
+                          to VMs created with this configuration. These network tags
+                          enable the creation of [firewall rules](https://cloud.google.com/workstations/docs/configure-firewall-rules).
+                        items:
+                          type: string
+                        type: array
+                    type: object
+                type: object
+              idleTimeout:
+                description: |-
+                  Optional. Number of seconds to wait before automatically stopping a
+                   workstation after it last received user traffic.
+
+                   A value of `"0s"` indicates that Cloud Workstations VMs created with this
+                   configuration should never time out due to idleness.
+                   Provide
+                   [duration](https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#duration)
+                   terminated by `s` for seconds—for example, `"7200s"` (2 hours).
+                   The default is `"1200s"` (20 minutes).
+                type: string
+              labels:
+                description: Optional. [Labels](https://cloud.google.com/workstations/docs/label-resources)
+                  that are applied to the workstation configuration and that are also
+                  propagated to the underlying Compute Engine resources.
+                items:
+                  properties:
+                    key:
+                      description: Key for the label.
+                      type: string
+                    value:
+                      description: Value for the label.
+                      type: string
+                  type: object
+                type: array
+              parentRef:
+                description: Parent is a reference to the parent WorkstationCluster
+                  for this WorkstationConfig.
+                oneOf:
+                - not:
+                    required:
+                    - external
+                  required:
+                  - name
+                - not:
+                    anyOf:
+                    - required:
+                      - name
+                    - required:
+                      - namespace
+                  required:
+                  - external
+                properties:
+                  external:
+                    description: A reference to an externally managed WorkstationCluster
+                      resource. Should be in the format "projects/{{projectID}}/locations/{{location}}/workstationClusters/{{workstationclusterID}}".
+                    type: string
+                  name:
+                    description: The name of a WorkstationCluster resource.
+                    type: string
+                  namespace:
+                    description: The namespace of a WorkstationCluster resource.
+                    type: string
+                type: object
+              persistentDirectories:
+                description: Optional. Directories to persist across workstation sessions.
+                items:
+                  properties:
+                    gcePD:
+                      description: A PersistentDirectory backed by a Compute Engine
+                        persistent disk.
+                      properties:
+                        diskType:
+                          description: Optional. The [type of the persistent disk](https://cloud.google.com/compute/docs/disks#disk-types)
+                            for the home directory. Defaults to `"pd-standard"`.
+                          type: string
+                        fsType:
+                          description: Optional. Type of file system that the disk
+                            should be formatted with. The workstation image must support
+                            this file system type. Must be empty if [source_snapshot][google.cloud.workstations.v1.WorkstationConfig.PersistentDirectory.GceRegionalPersistentDisk.source_snapshot]
+                            is set. Defaults to `"ext4"`.
+                          type: string
+                        reclaimPolicy:
+                          description: Optional. Whether the persistent disk should
+                            be deleted when the workstation is deleted. Valid values
+                            are `DELETE` and `RETAIN`. Defaults to `DELETE`.
+                          type: string
+                        sizeGB:
+                          description: |-
+                            Optional. The GB capacity of a persistent home directory for each
+                             workstation created with this configuration. Must be empty if
+                             [source_snapshot][google.cloud.workstations.v1.WorkstationConfig.PersistentDirectory.GceRegionalPersistentDisk.source_snapshot]
+                             is set.
+
+                             Valid values are `10`, `50`, `100`, `200`, `500`, or `1000`.
+                             Defaults to `200`. If less than `200` GB, the
+                             [disk_type][google.cloud.workstations.v1.WorkstationConfig.PersistentDirectory.GceRegionalPersistentDisk.disk_type]
+                             must be
+                             `"pd-balanced"` or `"pd-ssd"`.
+                          format: int32
+                          type: integer
+                        sourceSnapshot:
+                          description: Optional. Name of the snapshot to use as the
+                            source for the disk. If set, [size_gb][google.cloud.workstations.v1.WorkstationConfig.PersistentDirectory.GceRegionalPersistentDisk.size_gb]
+                            and [fs_type][google.cloud.workstations.v1.WorkstationConfig.PersistentDirectory.GceRegionalPersistentDisk.fs_type]
+                            must be empty.
+                          type: string
+                      type: object
+                    mountPath:
+                      description: Optional. Location of this directory in the running
+                        workstation.
+                      type: string
+                  type: object
+                type: array
+              readinessChecks:
+                description: Optional. Readiness checks to perform when starting a
+                  workstation using this workstation configuration. Mark a workstation
+                  as running only after all specified readiness checks return 200
+                  status codes.
+                items:
+                  properties:
+                    path:
+                      description: Optional. Path to which the request should be sent.
+                      type: string
+                    port:
+                      description: Optional. Port to which the request should be sent.
+                      format: int32
+                      type: integer
+                  type: object
+                type: array
+              replicaZones:
+                description: |-
+                  Optional. Immutable. Specifies the zones used to replicate the VM and disk
+                   resources within the region. If set, exactly two zones within the
+                   workstation cluster's region must be specified—for example,
+                   `['us-central1-a', 'us-central1-f']`. If this field is empty, two default
+                   zones within the region are used.
+
+                   Immutable after the workstation configuration is created.
+                items:
+                  type: string
+                type: array
+              resourceID:
+                description: The WorkstationConfig name. If not given, the metadata.name
+                  will be used.
+                type: string
+              runningTimeout:
+                description: |-
+                  Optional. Number of seconds that a workstation can run until it is
+                   automatically shut down. We recommend that workstations be shut down daily
+                   to reduce costs and so that security updates can be applied upon restart.
+                   The
+                   [idle_timeout][google.cloud.workstations.v1.WorkstationConfig.idle_timeout]
+                   and
+                   [running_timeout][google.cloud.workstations.v1.WorkstationConfig.running_timeout]
+                   fields are independent of each other. Note that the
+                   [running_timeout][google.cloud.workstations.v1.WorkstationConfig.running_timeout]
+                   field shuts down VMs after the specified time, regardless of whether or not
+                   the VMs are idle.
+
+                   Provide duration terminated by `s` for seconds—for example, `"54000s"`
+                   (15 hours). Defaults to `"43200s"` (12 hours). A value of `"0s"` indicates
+                   that workstations using this configuration should never time out. If
+                   [encryption_key][google.cloud.workstations.v1.WorkstationConfig.encryption_key]
+                   is set, it must be greater than `"0s"` and less than
+                   `"86400s"` (24 hours).
+
+                   Warning: A value of `"0s"` indicates that Cloud Workstations VMs created
+                   with this configuration have no maximum running time. This is strongly
+                   discouraged because you incur costs and will not pick up security updates.
+                type: string
+            required:
+            - parentRef
+            type: object
+          status:
+            description: WorkstationConfigStatus defines the config connector machine
+              state of WorkstationConfig
+            properties:
+              conditions:
+                description: Conditions represent the latest available observations
+                  of the object's current state.
+                items:
+                  properties:
+                    lastTransitionTime:
+                      description: Last time the condition transitioned from one status
+                        to another.
+                      type: string
+                    message:
+                      description: Human-readable message indicating details about
+                        last transition.
+                      type: string
+                    reason:
+                      description: Unique, one-word, CamelCase reason for the condition's
+                        last transition.
+                      type: string
+                    status:
+                      description: Status is the status of the condition. Can be True,
+                        False, Unknown.
+                      type: string
+                    type:
+                      description: Type is the type of the condition.
+                      type: string
+                  type: object
+                type: array
+              externalRef:
+                description: A unique specifier for the WorkstationConfig resource
+                  in GCP.
+                type: string
+              observedGeneration:
+                description: ObservedGeneration is the generation of the resource
+                  that was most recently observed by the Config Connector controller.
+                  If this is equal to metadata.generation, then that means that the
+                  current reported status reflects the most recent desired state of
+                  the resource.
+                format: int64
+                type: integer
+              observedState:
+                description: ObservedState is the state of the resource as most recently
+                  observed in GCP.
+                properties:
+                  createTime:
+                    description: Output only. Time when this workstation configuration
+                      was created.
+                    type: string
+                  degraded:
+                    description: Output only. Whether this resource is degraded, in
+                      which case it may require user action to restore full functionality.
+                      See also the [conditions][google.cloud.workstations.v1.WorkstationConfig.conditions]
+                      field.
+                    type: boolean
+                  deleteTime:
+                    description: Output only. Time when this workstation configuration
+                      was soft-deleted.
+                    type: string
+                  etag:
+                    description: Output only. Checksum computed by the server. May
+                      be sent on update and delete requests to make sure that the
+                      client has an up-to-date value before proceeding.
+                    type: string
+                  gcpConditions:
+                    description: Output only. Status conditions describing the current
+                      resource state.
+                    items:
+                      properties:
+                        code:
+                          description: The status code, which should be an enum value
+                            of [google.rpc.Code][google.rpc.Code].
+                          format: int32
+                          type: integer
+                        message:
+                          description: A developer-facing error message, which should
+                            be in English. Any user-facing error message should be
+                            localized and sent in the [google.rpc.Status.details][google.rpc.Status.details]
+                            field, or localized by the client.
+                          type: string
+                      type: object
+                    type: array
+                  host:
+                    description: Output only. Observed state of the runtime host for
+                      the workstation configuration.
+                    properties:
+                      gceInstance:
+                        description: Output only. Observed state of the Compute Engine
+                          runtime host for the workstation configuration.
+                        properties:
+                          pooledInstances:
+                            description: Output only. Number of instances currently
+                              available in the pool for faster workstation startup.
+                            format: int32
+                            type: integer
+                        type: object
+                    type: object
+                  uid:
+                    description: Output only. A system-assigned unique identifier
+                      for this workstation configuration.
+                    type: string
+                  updateTime:
+                    description: Output only. Time when this workstation configuration
+                      was most recently updated.
+                    type: string
+                type: object
+            type: object
+        type: object
+    served: true
+    storage: false
+    subresources:
+      status: {}
+  - additionalPrinterColumns:
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    - description: When 'True', the most recent reconcile of the resource succeeded
+      jsonPath: .status.conditions[?(@.type=='Ready')].status
+      name: Ready
+      type: string
+    - description: The reason for the value in 'Ready'
+      jsonPath: .status.conditions[?(@.type=='Ready')].reason
+      name: Status
+      type: string
+    - description: The last transition time for the value in 'Status'
+      jsonPath: .status.conditions[?(@.type=='Ready')].lastTransitionTime
+      name: Status Age
+      type: date
+    name: v1beta1
+    schema:
+      openAPIV3Schema:
+        description: WorkstationConfig is the Schema for the WorkstationConfig API
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: WorkstationConfigSpec defines the desired state of WorkstationConfig
+            properties:
+              annotations:
+                description: Optional. Client-specified annotations.
+                items:
+                  properties:
+                    key:
+                      description: Key for the annotation.
+                      type: string
+                    value:
+                      description: Value for the annotation.
+                      type: string
+                  type: object
+                type: array
+              container:
+                description: Optional. Container that runs upon startup for each workstation
+                  using this workstation configuration.
+                properties:
+                  args:
+                    description: Optional. Arguments passed to the entrypoint.
+                    items:
+                      type: string
+                    type: array
+                  command:
+                    description: Optional. If set, overrides the default ENTRYPOINT
+                      specified by the image.
+                    items:
+                      type: string
+                    type: array
+                  env:
+                    description: Optional. Environment variables passed to the container's
+                      entrypoint.
+                    items:
+                      properties:
+                        name:
+                          description: Name is the name of the environment variable.
+                          type: string
+                        value:
+                          description: Value is the value of the environment variable.
+                          type: string
+                      type: object
+                    type: array
+                  image:
+                    description: |-
+                      Optional. A Docker container image that defines a custom environment.
+
+                       Cloud Workstations provides a number of
+                       [preconfigured
+                       images](https://cloud.google.com/workstations/docs/preconfigured-base-images),
+                       but you can create your own
+                       [custom container
+                       images](https://cloud.google.com/workstations/docs/custom-container-images).
+                       If using a private image, the `host.gceInstance.serviceAccount` field
+                       must be specified in the workstation configuration and must have
+                       permission to pull the specified image. Otherwise, the image must be
+                       publicly accessible.
+                    type: string
+                  runAsUser:
+                    description: Optional. If set, overrides the USER specified in
+                      the image with the given uid.
+                    format: int32
+                    type: integer
+                  workingDir:
+                    description: Optional. If set, overrides the default DIR specified
+                      by the image.
+                    type: string
+                type: object
+              displayName:
+                description: Optional. Human-readable name for this workstation configuration.
+                type: string
+              encryptionKey:
+                description: |-
+                  Immutable. Encrypts resources of this workstation configuration using a
+                   customer-managed encryption key (CMEK).
+
+                   If specified, the boot disk of the Compute Engine instance and the
+                   persistent disk are encrypted using this encryption key. If
+                   this field is not set, the disks are encrypted using a generated
+                   key. Customer-managed encryption keys do not protect disk metadata.
+
+                   If the customer-managed encryption key is rotated, when the workstation
+                   instance is stopped, the system attempts to recreate the
+                   persistent disk with the new version of the key. Be sure to keep
+                   older versions of the key until the persistent disk is recreated.
+                   Otherwise, data on the persistent disk might be lost.
+
+                   If the encryption key is revoked, the workstation session automatically
+                   stops within 7 hours.
+
+                   Immutable after the workstation configuration is created.
+                properties:
+                  kmsCryptoKeyRef:
+                    description: Immutable. A reference to the Google Cloud KMS encryption
+                      key. For example, `"projects/PROJECT_ID/locations/REGION/keyRings/KEY_RING/cryptoKeys/KEY_NAME"`.
+                      The key must be in the same region as the workstation configuration.
+                    oneOf:
+                    - not:
+                        required:
+                        - external
+                      required:
+                      - name
+                    - not:
+                        anyOf:
+                        - required:
+                          - name
+                        - required:
+                          - namespace
+                      required:
+                      - external
+                    properties:
+                      external:
+                        description: A reference to an externally managed KMSCryptoKey.
+                          Should be in the format `projects/[kms_project_id]/locations/[region]/keyRings/[key_ring_id]/cryptoKeys/[key]`.
+                        type: string
+                      name:
+                        description: The `name` of a `KMSCryptoKey` resource.
+                        type: string
+                      namespace:
+                        description: The `namespace` of a `KMSCryptoKey` resource.
+                        type: string
+                    type: object
+                  serviceAccountRef:
+                    description: Immutable. A reference to a service account to use
+                      with the specified KMS key. We recommend that you use a separate
+                      service account and follow KMS best practices. For more information,
+                      see [Separation of duties](https://cloud.google.com/kms/docs/separation-of-duties)
+                      and `gcloud kms keys add-iam-policy-binding` [`--member`](https://cloud.google.com/sdk/gcloud/reference/kms/keys/add-iam-policy-binding#--member).
+                    oneOf:
+                    - not:
+                        required:
+                        - external
+                      required:
+                      - name
+                    - not:
+                        anyOf:
+                        - required:
+                          - name
+                        - required:
+                          - namespace
+                      required:
+                      - external
+                    properties:
+                      external:
+                        description: The `email` field of an `IAMServiceAccount` resource.
+                        type: string
+                      name:
+                        description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
+                        type: string
+                      namespace:
+                        description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
+                        type: string
+                    type: object
+                type: object
+              host:
+                description: Optional. Runtime host for the workstation.
+                properties:
+                  gceInstance:
+                    description: Specifies a Compute Engine instance as the host.
+                    properties:
+                      bootDiskSizeGB:
+                        description: Optional. The size of the boot disk for the VM
+                          in gigabytes (GB). The minimum boot disk size is `30` GB.
+                          Defaults to `50` GB.
+                        format: int32
+                        type: integer
+                      confidentialInstanceConfig:
+                        description: Optional. A set of Compute Engine Confidential
+                          VM instance options.
+                        properties:
+                          enableConfidentialCompute:
+                            description: Optional. Whether the instance has confidential
+                              compute enabled.
+                            type: boolean
+                        type: object
+                      disablePublicIPAddresses:
+                        description: Optional. When set to true, disables public IP
+                          addresses for VMs. If you disable public IP addresses, you
+                          must set up Private Google Access or Cloud NAT on your network.
+                          If you use Private Google Access and you use `private.googleapis.com`
+                          or `restricted.googleapis.com` for Container Registry and
+                          Artifact Registry, make sure that you set up DNS records
+                          for domains `*.gcr.io` and `*.pkg.dev`. Defaults to false
+                          (VMs have public IP addresses).
+                        type: boolean
+                      enableNestedVirtualization:
+                        description: |-
+                          Optional. Whether to enable nested virtualization on Cloud Workstations
+                           VMs created under this workstation configuration.
+
+                           Nested virtualization lets you run virtual machine (VM) instances
+                           inside your workstation. Before enabling nested virtualization,
+                           consider the following important considerations. Cloud Workstations
+                           instances are subject to the [same restrictions as Compute Engine
+                           instances](https://cloud.google.com/compute/docs/instances/nested-virtualization/overview#restrictions):
+
+                           * **Organization policy**: projects, folders, or
+                           organizations may be restricted from creating nested VMs if the
+                           **Disable VM nested virtualization** constraint is enforced in
+                           the organization policy. For more information, see the
+                           Compute Engine section,
+                           [Checking whether nested virtualization is
+                           allowed](https://cloud.google.com/compute/docs/instances/nested-virtualization/managing-constraint#checking_whether_nested_virtualization_is_allowed).
+                           * **Performance**: nested VMs might experience a 10% or greater
+                           decrease in performance for workloads that are CPU-bound and
+                           possibly greater than a 10% decrease for workloads that are
+                           input/output bound.
+                           * **Machine Type**: nested virtualization can only be enabled on
+                           workstation configurations that specify a
+                           [machine_type][google.cloud.workstations.v1.WorkstationConfig.Host.GceInstance.machine_type]
+                           in the N1 or N2 machine series.
+                           * **GPUs**: nested virtualization may not be enabled on workstation
+                           configurations with accelerators.
+                           * **Operating System**: Because
+                           [Container-Optimized
+                           OS](https://cloud.google.com/compute/docs/images/os-details#container-optimized_os_cos)
+                           does not support nested virtualization, when nested virtualization is
+                           enabled, the underlying Compute Engine VM instances boot from an
+                           [Ubuntu
+                           LTS](https://cloud.google.com/compute/docs/images/os-details#ubuntu_lts)
+                           image.
+                        type: boolean
+                      machineType:
+                        description: Optional. The type of machine to use for VM instances—for
+                          example, `"e2-standard-4"`. For more information about machine
+                          types that Cloud Workstations supports, see the list of
+                          [available machine types](https://cloud.google.com/workstations/docs/available-machine-types).
+                        type: string
+                      poolSize:
+                        description: Optional. The number of VMs that the system should
+                          keep idle so that new workstations can be started quickly
+                          for new users. Defaults to `0` in the API.
+                        format: int32
+                        type: integer
+                      serviceAccountRef:
+                        description: |-
+                          Optional. A reference to the service account for Cloud
+                           Workstations VMs created with this configuration. When specified, be
+                           sure that the service account has `logginglogEntries.create` permission
+                           on the project so it can write logs out to Cloud Logging. If using a
+                           custom container image, the service account must have permissions to
+                           pull the specified image.
+
+                           If you as the administrator want to be able to `ssh` into the
+                           underlying VM, you need to set this value to a service account
+                           for which you have the `iam.serviceAccounts.actAs` permission.
+                           Conversely, if you don't want anyone to be able to `ssh` into the
+                           underlying VM, use a service account where no one has that
+                           permission.
+
+                           If not set, VMs run with a service account provided by the
+                           Cloud Workstations service, and the image must be publicly
+                           accessible.
+                        oneOf:
+                        - not:
+                            required:
+                            - external
+                          required:
+                          - name
+                        - not:
+                            anyOf:
+                            - required:
+                              - name
+                            - required:
+                              - namespace
+                          required:
+                          - external
+                        properties:
+                          external:
+                            description: The `email` field of an `IAMServiceAccount`
+                              resource.
+                            type: string
+                          name:
+                            description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
+                            type: string
+                          namespace:
+                            description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
+                            type: string
+                        type: object
+                      serviceAccountScopes:
+                        description: Optional. Scopes to grant to the [service_account][google.cloud.workstations.v1.WorkstationConfig.Host.GceInstance.service_account].
+                          Various scopes are automatically added based on feature
+                          usage. When specified, users of workstations under this
+                          configuration must have `iam.serviceAccounts.actAs` on the
+                          service account.
+                        items:
+                          type: string
+                        type: array
+                      shieldedInstanceConfig:
+                        description: Optional. A set of Compute Engine Shielded instance
+                          options.
+                        properties:
+                          enableIntegrityMonitoring:
+                            description: Optional. Whether the instance has integrity
+                              monitoring enabled.
+                            type: boolean
+                          enableSecureBoot:
+                            description: Optional. Whether the instance has Secure
+                              Boot enabled.
+                            type: boolean
+                          enableVTPM:
+                            description: Optional. Whether the instance has the vTPM
+                              enabled.
+                            type: boolean
+                        type: object
+                      tags:
+                        description: Optional. Network tags to add to the Compute
+                          Engine VMs backing the workstations. This option applies
+                          [network tags](https://cloud.google.com/vpc/docs/add-remove-network-tags)
+                          to VMs created with this configuration. These network tags
+                          enable the creation of [firewall rules](https://cloud.google.com/workstations/docs/configure-firewall-rules).
+                        items:
+                          type: string
+                        type: array
+                    type: object
+                type: object
+              idleTimeout:
+                description: |-
+                  Optional. Number of seconds to wait before automatically stopping a
+                   workstation after it last received user traffic.
+
+                   A value of `"0s"` indicates that Cloud Workstations VMs created with this
+                   configuration should never time out due to idleness.
+                   Provide
+                   [duration](https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#duration)
+                   terminated by `s` for seconds—for example, `"7200s"` (2 hours).
+                   The default is `"1200s"` (20 minutes).
+                type: string
+              labels:
+                description: Optional. [Labels](https://cloud.google.com/workstations/docs/label-resources)
+                  that are applied to the workstation configuration and that are also
+                  propagated to the underlying Compute Engine resources.
+                items:
+                  properties:
+                    key:
+                      description: Key for the label.
+                      type: string
+                    value:
+                      description: Value for the label.
+                      type: string
+                  type: object
+                type: array
+              parentRef:
+                description: Parent is a reference to the parent WorkstationCluster
+                  for this WorkstationConfig.
+                oneOf:
+                - not:
+                    required:
+                    - external
+                  required:
+                  - name
+                - not:
+                    anyOf:
+                    - required:
+                      - name
+                    - required:
+                      - namespace
+                  required:
+                  - external
+                properties:
+                  external:
+                    description: A reference to an externally managed WorkstationCluster
+                      resource. Should be in the format "projects/{{projectID}}/locations/{{location}}/workstationClusters/{{workstationclusterID}}".
+                    type: string
+                  name:
+                    description: The name of a WorkstationCluster resource.
+                    type: string
+                  namespace:
+                    description: The namespace of a WorkstationCluster resource.
+                    type: string
+                type: object
+              persistentDirectories:
+                description: Optional. Directories to persist across workstation sessions.
+                items:
+                  properties:
+                    gcePD:
+                      description: A PersistentDirectory backed by a Compute Engine
+                        persistent disk.
+                      properties:
+                        diskType:
+                          description: Optional. The [type of the persistent disk](https://cloud.google.com/compute/docs/disks#disk-types)
+                            for the home directory. Defaults to `"pd-standard"`.
+                          type: string
+                        fsType:
+                          description: Optional. Type of file system that the disk
+                            should be formatted with. The workstation image must support
+                            this file system type. Must be empty if [source_snapshot][google.cloud.workstations.v1.WorkstationConfig.PersistentDirectory.GceRegionalPersistentDisk.source_snapshot]
+                            is set. Defaults to `"ext4"`.
+                          type: string
+                        reclaimPolicy:
+                          description: Optional. Whether the persistent disk should
+                            be deleted when the workstation is deleted. Valid values
+                            are `DELETE` and `RETAIN`. Defaults to `DELETE`.
+                          type: string
+                        sizeGB:
+                          description: |-
+                            Optional. The GB capacity of a persistent home directory for each
+                             workstation created with this configuration. Must be empty if
+                             [source_snapshot][google.cloud.workstations.v1.WorkstationConfig.PersistentDirectory.GceRegionalPersistentDisk.source_snapshot]
+                             is set.
+
+                             Valid values are `10`, `50`, `100`, `200`, `500`, or `1000`.
+                             Defaults to `200`. If less than `200` GB, the
+                             [disk_type][google.cloud.workstations.v1.WorkstationConfig.PersistentDirectory.GceRegionalPersistentDisk.disk_type]
+                             must be
+                             `"pd-balanced"` or `"pd-ssd"`.
+                          format: int32
+                          type: integer
+                        sourceSnapshot:
+                          description: Optional. Name of the snapshot to use as the
+                            source for the disk. If set, [size_gb][google.cloud.workstations.v1.WorkstationConfig.PersistentDirectory.GceRegionalPersistentDisk.size_gb]
+                            and [fs_type][google.cloud.workstations.v1.WorkstationConfig.PersistentDirectory.GceRegionalPersistentDisk.fs_type]
+                            must be empty.
+                          type: string
+                      type: object
+                    mountPath:
+                      description: Optional. Location of this directory in the running
+                        workstation.
+                      type: string
+                  type: object
+                type: array
+              readinessChecks:
+                description: Optional. Readiness checks to perform when starting a
+                  workstation using this workstation configuration. Mark a workstation
+                  as running only after all specified readiness checks return 200
+                  status codes.
+                items:
+                  properties:
+                    path:
+                      description: Optional. Path to which the request should be sent.
+                      type: string
+                    port:
+                      description: Optional. Port to which the request should be sent.
+                      format: int32
+                      type: integer
+                  type: object
+                type: array
+              replicaZones:
+                description: |-
+                  Optional. Immutable. Specifies the zones used to replicate the VM and disk
+                   resources within the region. If set, exactly two zones within the
+                   workstation cluster's region must be specified—for example,
+                   `['us-central1-a', 'us-central1-f']`. If this field is empty, two default
+                   zones within the region are used.
+
+                   Immutable after the workstation configuration is created.
+                items:
+                  type: string
+                type: array
+              resourceID:
+                description: The WorkstationConfig name. If not given, the metadata.name
+                  will be used.
+                type: string
+              runningTimeout:
+                description: |-
+                  Optional. Number of seconds that a workstation can run until it is
+                   automatically shut down. We recommend that workstations be shut down daily
+                   to reduce costs and so that security updates can be applied upon restart.
+                   The
+                   [idle_timeout][google.cloud.workstations.v1.WorkstationConfig.idle_timeout]
+                   and
+                   [running_timeout][google.cloud.workstations.v1.WorkstationConfig.running_timeout]
+                   fields are independent of each other. Note that the
+                   [running_timeout][google.cloud.workstations.v1.WorkstationConfig.running_timeout]
+                   field shuts down VMs after the specified time, regardless of whether or not
+                   the VMs are idle.
+
+                   Provide duration terminated by `s` for seconds—for example, `"54000s"`
+                   (15 hours). Defaults to `"43200s"` (12 hours). A value of `"0s"` indicates
+                   that workstations using this configuration should never time out. If
+                   [encryption_key][google.cloud.workstations.v1.WorkstationConfig.encryption_key]
+                   is set, it must be greater than `"0s"` and less than
+                   `"86400s"` (24 hours).
+
+                   Warning: A value of `"0s"` indicates that Cloud Workstations VMs created
+                   with this configuration have no maximum running time. This is strongly
+                   discouraged because you incur costs and will not pick up security updates.
+                type: string
+            required:
+            - parentRef
+            type: object
+          status:
+            description: WorkstationConfigStatus defines the config connector machine
+              state of WorkstationConfig
+            properties:
+              conditions:
+                description: Conditions represent the latest available observations
+                  of the object's current state.
+                items:
+                  properties:
+                    lastTransitionTime:
+                      description: Last time the condition transitioned from one status
+                        to another.
+                      type: string
+                    message:
+                      description: Human-readable message indicating details about
+                        last transition.
+                      type: string
+                    reason:
+                      description: Unique, one-word, CamelCase reason for the condition's
+                        last transition.
+                      type: string
+                    status:
+                      description: Status is the status of the condition. Can be True,
+                        False, Unknown.
+                      type: string
+                    type:
+                      description: Type is the type of the condition.
+                      type: string
+                  type: object
+                type: array
+              externalRef:
+                description: A unique specifier for the WorkstationConfig resource
+                  in GCP.
+                type: string
+              observedGeneration:
+                description: ObservedGeneration is the generation of the resource
+                  that was most recently observed by the Config Connector controller.
+                  If this is equal to metadata.generation, then that means that the
+                  current reported status reflects the most recent desired state of
+                  the resource.
+                format: int64
+                type: integer
+              observedState:
+                description: ObservedState is the state of the resource as most recently
+                  observed in GCP.
+                properties:
+                  createTime:
+                    description: Output only. Time when this workstation configuration
+                      was created.
+                    type: string
+                  degraded:
+                    description: Output only. Whether this resource is degraded, in
+                      which case it may require user action to restore full functionality.
+                      See also the [conditions][google.cloud.workstations.v1.WorkstationConfig.conditions]
+                      field.
+                    type: boolean
+                  deleteTime:
+                    description: Output only. Time when this workstation configuration
+                      was soft-deleted.
+                    type: string
+                  etag:
+                    description: Output only. Checksum computed by the server. May
+                      be sent on update and delete requests to make sure that the
+                      client has an up-to-date value before proceeding.
+                    type: string
+                  gcpConditions:
+                    description: Output only. Status conditions describing the current
+                      resource state.
+                    items:
+                      properties:
+                        code:
+                          description: The status code, which should be an enum value
+                            of [google.rpc.Code][google.rpc.Code].
+                          format: int32
+                          type: integer
+                        message:
+                          description: A developer-facing error message, which should
+                            be in English. Any user-facing error message should be
+                            localized and sent in the [google.rpc.Status.details][google.rpc.Status.details]
+                            field, or localized by the client.
+                          type: string
+                      type: object
+                    type: array
+                  host:
+                    description: Output only. Observed state of the runtime host for
+                      the workstation configuration.
+                    properties:
+                      gceInstance:
+                        description: Output only. Observed state of the Compute Engine
+                          runtime host for the workstation configuration.
+                        properties:
+                          pooledInstances:
+                            description: Output only. Number of instances currently
+                              available in the pool for faster workstation startup.
+                            format: int32
+                            type: integer
+                        type: object
+                    type: object
+                  uid:
+                    description: Output only. A system-assigned unique identifier
+                      for this workstation configuration.
+                    type: string
+                  updateTime:
+                    description: Output only. Time when this workstation configuration
+                      was most recently updated.
+                    type: string
+                type: object
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: null
+  storedVersions: null