feat(networkservices): update the API

#### networkservices:v1beta1

The following keys were added:
- schemas.WasmPlugin.properties.kmsKeyName.description
- schemas.WasmPlugin.properties.kmsKeyName.type
- schemas.WasmPlugin.properties.kmsKeyVersion.description
- schemas.WasmPlugin.properties.kmsKeyVersion.readOnly
- schemas.WasmPlugin.properties.kmsKeyVersion.type

The following keys were changed:
- resources.projects.resources.locations.resources.operations.methods.list.parameters.returnPartialSuccess.description
- schemas.AuthzExtension.properties.wireFormat.description
- schemas.AuthzExtension.properties.wireFormat.enumDescriptions
- schemas.Gateway.properties.envoyHeaders.enumDescriptions
- schemas.ListOperationsResponse.properties.unreachable.description
- schemas.Mesh.properties.envoyHeaders.enumDescriptions

Author: yoshi-automation

discovery/networkservices-v1beta1.json

@@ -2145,7 +2145,7 @@
                       "type": "string"
                     },
                     "returnPartialSuccess": {
-                      "description": "When set to `true`, operations that are reachable are returned as normal, and those that are unreachable are returned in the [ListOperationsResponse.unreachable] field. This can only be `true` when reading across collections e.g. when `parent` is set to `\"projects/example/locations/-\"`. This field is not by default supported and will result in an `UNIMPLEMENTED` error if set unless explicitly documented otherwise in service or product specific documentation.",
+                      "description": "When set to `true`, operations that are reachable are returned as normal, and those that are unreachable are returned in the ListOperationsResponse.unreachable field. This can only be `true` when reading across collections. For example, when `parent` is set to `\"projects/example/locations/-\"`. This field is not supported by default and will result in an `UNIMPLEMENTED` error if set unless explicitly documented otherwise in service or product specific documentation.",
                       "location": "query",
                       "type": "boolean"
                     }
@@ -3100,7 +3100,7 @@
       }
     }
   },
-  "revision": "20251105",
+  "revision": "20251203",
   "rootUrl": "https://networkservices.googleapis.com/",
   "schemas": {
     "AuthzExtension": {
@@ -3181,7 +3181,7 @@
           "type": "string"
         },
         "wireFormat": {
-          "description": "Optional. The format of communication supported by the callout extension. If not specified, the default value `EXT_PROC_GRPC` is used.",
+          "description": "Optional. The format of communication supported by the callout extension. This field is supported only for regional `AuthzExtension` resources. If not specified, the default value `EXT_PROC_GRPC` is used. Global `AuthzExtension` resources use the `EXT_PROC_GRPC` wire format.",
           "enum": [
             "WIRE_FORMAT_UNSPECIFIED",
             "EXT_PROC_GRPC",
@@ -3190,7 +3190,7 @@
           "enumDescriptions": [
             "Not specified.",
             "The extension service uses ext_proc gRPC API over a gRPC stream. This is the default value if the wire format is not specified. The backend service for the extension must use HTTP2 or H2C as the protocol. All `supported_events` for a client request are sent as part of the same gRPC stream.",
-            "The extension service uses Envoy's `ext_authz` gRPC API. The backend service for the extension must use HTTP2, or H2C as the protocol. `EXT_AUTHZ_GRPC` is only supported for regional `AuthzExtension` resources."
+            "The extension service uses Envoy's `ext_authz` gRPC API. The backend service for the extension must use HTTP2 or H2C as the protocol. `EXT_AUTHZ_GRPC` is only supported for regional `AuthzExtension` resources."
           ],
           "type": "string"
         }
@@ -3467,7 +3467,7 @@
           "enumDescriptions": [
             "Defaults to NONE.",
             "Suppress envoy debug headers.",
-            "Envoy will insert default internal debug headers into upstream requests: x-envoy-attempt-count x-envoy-is-timeout-retry x-envoy-expected-rq-timeout-ms x-envoy-original-path x-envoy-upstream-stream-duration-ms"
+            "Envoy will insert default internal debug headers into upstream requests: x-envoy-attempt-count, x-envoy-is-timeout-retry, x-envoy-expected-rq-timeout-ms, x-envoy-original-path, x-envoy-upstream-stream-duration-ms"
           ],
           "type": "string"
         },
@@ -5052,7 +5052,7 @@
           "type": "array"
         },
         "unreachable": {
-          "description": "Unordered list. Unreachable resources. Populated when the request sets `ListOperationsRequest.return_partial_success` and reads across collections e.g. when attempting to list all resources across all supported locations.",
+          "description": "Unordered list. Unreachable resources. Populated when the request sets `ListOperationsRequest.return_partial_success` and reads across collections. For example, when attempting to list all resources across all supported locations.",
           "items": {
             "type": "string"
           },
@@ -5304,7 +5304,7 @@
           "enumDescriptions": [
             "Defaults to NONE.",
             "Suppress envoy debug headers.",
-            "Envoy will insert default internal debug headers into upstream requests: x-envoy-attempt-count x-envoy-is-timeout-retry x-envoy-expected-rq-timeout-ms x-envoy-original-path x-envoy-upstream-stream-duration-ms"
+            "Envoy will insert default internal debug headers into upstream requests: x-envoy-attempt-count, x-envoy-is-timeout-retry, x-envoy-expected-rq-timeout-ms, x-envoy-original-path, x-envoy-upstream-stream-duration-ms"
           ],
           "type": "string"
         },
@@ -5989,6 +5989,15 @@
           "description": "Optional. A human-readable description of the resource.",
           "type": "string"
         },
+        "kmsKeyName": {
+          "description": "Optional. The name of the customer managed Cloud KMS key to be used to encrypt the `WasmPlugin` image (provided by image_uri) and configuration (provided by plugin_config_data or plugin_config_uri) that are stored by the `Service Extensions` product at rest. Format: \"projects/{project}/locations/{location}/keyRings/{keyring}/cryptoKeys/{key}\" By default, Google Cloud automatically encrypts all data at rest using Google-owned and Google-managed encryption keys. If you need ownership and control of the keys that protect your data at rest, you can specify a customer-managed encryption key (CMEK) to encrypt your `WasmPlugin` data. For more information, see [Using customer-managed encryption keys](https://cloud.google.com/kms/docs/cmek). ",
+          "type": "string"
+        },
+        "kmsKeyVersion": {
+          "description": "Output only. The name of the specific CryptoKeyVersion used to encrypt the `WasmPlugin` data, if the kms_key_name field is set. Format: \"projects/{project}/locations/{location}/keyRings/{keyring}/cryptoKeys/{key}/cryptoKeyVersions/{version}\" This is a read-only field. `WasmPlugin` data is automatically encrypted using the most recent `CryptoKeyVersion` of the `CryptoKey` provided in the `kms_key_name` field. See [Cloud KMS resources](https://cloud.google.com/kms/docs/resource-hierarchy) for more information.",
+          "readOnly": true,
+          "type": "string"
+        },
         "labels": {
           "additionalProperties": {
             "type": "string"

src/apis/networkservices/v1beta1.ts

@@ -177,7 +177,7 @@ export namespace networkservices_v1beta1 {
      */
     updateTime?: string | null;
     /**
-     * Optional. The format of communication supported by the callout extension. If not specified, the default value `EXT_PROC_GRPC` is used.
+     * Optional. The format of communication supported by the callout extension. This field is supported only for regional `AuthzExtension` resources. If not specified, the default value `EXT_PROC_GRPC` is used. Global `AuthzExtension` resources use the `EXT_PROC_GRPC` wire format.
      */
     wireFormat?: string | null;
   }
@@ -1461,7 +1461,7 @@ export namespace networkservices_v1beta1 {
      */
     operations?: Schema$Operation[];
     /**
-     * Unordered list. Unreachable resources. Populated when the request sets `ListOperationsRequest.return_partial_success` and reads across collections e.g. when attempting to list all resources across all supported locations.
+     * Unordered list. Unreachable resources. Populated when the request sets `ListOperationsRequest.return_partial_success` and reads across collections. For example, when attempting to list all resources across all supported locations.
      */
     unreachable?: string[] | null;
   }
@@ -2086,6 +2086,14 @@ export namespace networkservices_v1beta1 {
      * Optional. A human-readable description of the resource.
      */
     description?: string | null;
+    /**
+     * Optional. The name of the customer managed Cloud KMS key to be used to encrypt the `WasmPlugin` image (provided by image_uri) and configuration (provided by plugin_config_data or plugin_config_uri) that are stored by the `Service Extensions` product at rest. Format: "projects/{project\}/locations/{location\}/keyRings/{keyring\}/cryptoKeys/{key\}" By default, Google Cloud automatically encrypts all data at rest using Google-owned and Google-managed encryption keys. If you need ownership and control of the keys that protect your data at rest, you can specify a customer-managed encryption key (CMEK) to encrypt your `WasmPlugin` data. For more information, see [Using customer-managed encryption keys](https://cloud.google.com/kms/docs/cmek).
+     */
+    kmsKeyName?: string | null;
+    /**
+     * Output only. The name of the specific CryptoKeyVersion used to encrypt the `WasmPlugin` data, if the kms_key_name field is set. Format: "projects/{project\}/locations/{location\}/keyRings/{keyring\}/cryptoKeys/{key\}/cryptoKeyVersions/{version\}" This is a read-only field. `WasmPlugin` data is automatically encrypted using the most recent `CryptoKeyVersion` of the `CryptoKey` provided in the `kms_key_name` field. See [Cloud KMS resources](https://cloud.google.com/kms/docs/resource-hierarchy) for more information.
+     */
+    kmsKeyVersion?: string | null;
     /**
      * Optional. Set of labels associated with the `WasmPlugin` resource. The format must comply with [the following requirements](/compute/docs/labeling-resources#requirements).
      */
@@ -12073,7 +12081,7 @@ export namespace networkservices_v1beta1 {
      *     pageSize: 'placeholder-value',
      *     // The standard list page token.
      *     pageToken: 'placeholder-value',
-     *     // When set to `true`, operations that are reachable are returned as normal, and those that are unreachable are returned in the [ListOperationsResponse.unreachable] field. This can only be `true` when reading across collections e.g. when `parent` is set to `"projects/example/locations/-"`. This field is not by default supported and will result in an `UNIMPLEMENTED` error if set unless explicitly documented otherwise in service or product specific documentation.
+     *     // When set to `true`, operations that are reachable are returned as normal, and those that are unreachable are returned in the ListOperationsResponse.unreachable field. This can only be `true` when reading across collections. For example, when `parent` is set to `"projects/example/locations/-"`. This field is not supported by default and will result in an `UNIMPLEMENTED` error if set unless explicitly documented otherwise in service or product specific documentation.
      *     returnPartialSuccess: 'placeholder-value',
      *   });
      *   console.log(res.data);
@@ -12226,7 +12234,7 @@ export namespace networkservices_v1beta1 {
      */
     pageToken?: string;
     /**
-     * When set to `true`, operations that are reachable are returned as normal, and those that are unreachable are returned in the [ListOperationsResponse.unreachable] field. This can only be `true` when reading across collections e.g. when `parent` is set to `"projects/example/locations/-"`. This field is not by default supported and will result in an `UNIMPLEMENTED` error if set unless explicitly documented otherwise in service or product specific documentation.
+     * When set to `true`, operations that are reachable are returned as normal, and those that are unreachable are returned in the ListOperationsResponse.unreachable field. This can only be `true` when reading across collections. For example, when `parent` is set to `"projects/example/locations/-"`. This field is not supported by default and will result in an `UNIMPLEMENTED` error if set unless explicitly documented otherwise in service or product specific documentation.
      */
     returnPartialSuccess?: boolean;
   }
@@ -15541,6 +15549,8 @@ export namespace networkservices_v1beta1 {
      *       // {
      *       //   "createTime": "my_createTime",
      *       //   "description": "my_description",
+     *       //   "kmsKeyName": "my_kmsKeyName",
+     *       //   "kmsKeyVersion": "my_kmsKeyVersion",
      *       //   "labels": {},
      *       //   "logConfig": {},
      *       //   "mainVersionId": "my_mainVersionId",
@@ -15840,6 +15850,8 @@ export namespace networkservices_v1beta1 {
      *   // {
      *   //   "createTime": "my_createTime",
      *   //   "description": "my_description",
+     *   //   "kmsKeyName": "my_kmsKeyName",
+     *   //   "kmsKeyVersion": "my_kmsKeyVersion",
      *   //   "labels": {},
      *   //   "logConfig": {},
      *   //   "mainVersionId": "my_mainVersionId",
@@ -16131,6 +16143,8 @@ export namespace networkservices_v1beta1 {
      *       // {
      *       //   "createTime": "my_createTime",
      *       //   "description": "my_description",
+     *       //   "kmsKeyName": "my_kmsKeyName",
+     *       //   "kmsKeyVersion": "my_kmsKeyVersion",
      *       //   "labels": {},
      *       //   "logConfig": {},
      *       //   "mainVersionId": "my_mainVersionId",