feat(workstations): update the api

#### workstations:v1beta

The following keys were deleted:
- schemas.Empty (Total Keys: 2)
- schemas.OperationMetadata.properties.cancelRequested (Total Keys: 2)
- schemas.OperationMetadata.properties.statusDetail (Total Keys: 2)

The following keys were added:
- schemas.CustomerEncryptionKey (Total Keys: 4)
- schemas.GoogleProtobufEmpty (Total Keys: 2)
- schemas.OperationMetadata.properties.requestedCancellation (Total Keys: 2)
- schemas.OperationMetadata.properties.statusMessage (Total Keys: 2)
- schemas.WorkstationConfig.properties.encryptionKey.$ref (Total Keys: 1)

The following keys were changed:
- resources.projects.resources.locations.resources.operations.methods.cancel.response.$ref (Total Keys: 1)
- resources.projects.resources.locations.resources.operations.methods.delete.response.$ref (Total Keys: 1)

docs/dyn/workstations_v1beta.projects.locations.workstationClusters.html

@@ -143,7 +143,7 @@ <h3>Method Details</h3>
   &quot;privateClusterConfig&quot;: { # Configuration options for private clusters. # Configuration for private cluster.
     &quot;clusterHostname&quot;: &quot;A String&quot;, # Output only. Hostname for the workstation cluster. This field will be populated only when private endpoint is enabled. To access workstations in the cluster, create a new DNS zone mapping this domain name to an internal IP address and a forwarding rule mapping that address to the service attachment.
     &quot;enablePrivateEndpoint&quot;: True or False, # Immutable. Whether Workstations endpoint is private.
-    &quot;serviceAttachmentUri&quot;: &quot;A String&quot;, # Output only. Service attachment URI for the workstation cluster. The service attachemnt is created when private endpoint is enabled. To access workstations in the cluster, configure access to the managed service using (Private Service Connect)[https://cloud.google.com/vpc/docs/configure-private-service-connect-services].
+    &quot;serviceAttachmentUri&quot;: &quot;A String&quot;, # Output only. Service attachment URI for the workstation cluster. The service attachemnt is created when private endpoint is enabled. To access workstations in the cluster, configure access to the managed service using [Private Service Connect](https://cloud.google.com/vpc/docs/configure-private-service-connect-services).
   },
   &quot;reconciling&quot;: True or False, # Output only. Indicates whether this resource is currently being updated to match its intended state.
   &quot;subnetwork&quot;: &quot;A String&quot;, # Immutable. Name of the Compute Engine subnetwork in which instances associated with this cluster will be created. Must be part of the subnetwork specified for this cluster.
@@ -262,7 +262,7 @@ <h3>Method Details</h3>
   &quot;privateClusterConfig&quot;: { # Configuration options for private clusters. # Configuration for private cluster.
     &quot;clusterHostname&quot;: &quot;A String&quot;, # Output only. Hostname for the workstation cluster. This field will be populated only when private endpoint is enabled. To access workstations in the cluster, create a new DNS zone mapping this domain name to an internal IP address and a forwarding rule mapping that address to the service attachment.
     &quot;enablePrivateEndpoint&quot;: True or False, # Immutable. Whether Workstations endpoint is private.
-    &quot;serviceAttachmentUri&quot;: &quot;A String&quot;, # Output only. Service attachment URI for the workstation cluster. The service attachemnt is created when private endpoint is enabled. To access workstations in the cluster, configure access to the managed service using (Private Service Connect)[https://cloud.google.com/vpc/docs/configure-private-service-connect-services].
+    &quot;serviceAttachmentUri&quot;: &quot;A String&quot;, # Output only. Service attachment URI for the workstation cluster. The service attachemnt is created when private endpoint is enabled. To access workstations in the cluster, configure access to the managed service using [Private Service Connect](https://cloud.google.com/vpc/docs/configure-private-service-connect-services).
   },
   &quot;reconciling&quot;: True or False, # Output only. Indicates whether this resource is currently being updated to match its intended state.
   &quot;subnetwork&quot;: &quot;A String&quot;, # Immutable. Name of the Compute Engine subnetwork in which instances associated with this cluster will be created. Must be part of the subnetwork specified for this cluster.
@@ -321,7 +321,7 @@ <h3>Method Details</h3>
       &quot;privateClusterConfig&quot;: { # Configuration options for private clusters. # Configuration for private cluster.
         &quot;clusterHostname&quot;: &quot;A String&quot;, # Output only. Hostname for the workstation cluster. This field will be populated only when private endpoint is enabled. To access workstations in the cluster, create a new DNS zone mapping this domain name to an internal IP address and a forwarding rule mapping that address to the service attachment.
         &quot;enablePrivateEndpoint&quot;: True or False, # Immutable. Whether Workstations endpoint is private.
-        &quot;serviceAttachmentUri&quot;: &quot;A String&quot;, # Output only. Service attachment URI for the workstation cluster. The service attachemnt is created when private endpoint is enabled. To access workstations in the cluster, configure access to the managed service using (Private Service Connect)[https://cloud.google.com/vpc/docs/configure-private-service-connect-services].
+        &quot;serviceAttachmentUri&quot;: &quot;A String&quot;, # Output only. Service attachment URI for the workstation cluster. The service attachemnt is created when private endpoint is enabled. To access workstations in the cluster, configure access to the managed service using [Private Service Connect](https://cloud.google.com/vpc/docs/configure-private-service-connect-services).
       },
       &quot;reconciling&quot;: True or False, # Output only. Indicates whether this resource is currently being updated to match its intended state.
       &quot;subnetwork&quot;: &quot;A String&quot;, # Immutable. Name of the Compute Engine subnetwork in which instances associated with this cluster will be created. Must be part of the subnetwork specified for this cluster.
@@ -383,7 +383,7 @@ <h3>Method Details</h3>
   &quot;privateClusterConfig&quot;: { # Configuration options for private clusters. # Configuration for private cluster.
     &quot;clusterHostname&quot;: &quot;A String&quot;, # Output only. Hostname for the workstation cluster. This field will be populated only when private endpoint is enabled. To access workstations in the cluster, create a new DNS zone mapping this domain name to an internal IP address and a forwarding rule mapping that address to the service attachment.
     &quot;enablePrivateEndpoint&quot;: True or False, # Immutable. Whether Workstations endpoint is private.
-    &quot;serviceAttachmentUri&quot;: &quot;A String&quot;, # Output only. Service attachment URI for the workstation cluster. The service attachemnt is created when private endpoint is enabled. To access workstations in the cluster, configure access to the managed service using (Private Service Connect)[https://cloud.google.com/vpc/docs/configure-private-service-connect-services].
+    &quot;serviceAttachmentUri&quot;: &quot;A String&quot;, # Output only. Service attachment URI for the workstation cluster. The service attachemnt is created when private endpoint is enabled. To access workstations in the cluster, configure access to the managed service using [Private Service Connect](https://cloud.google.com/vpc/docs/configure-private-service-connect-services).
   },
   &quot;reconciling&quot;: True or False, # Output only. Indicates whether this resource is currently being updated to match its intended state.
   &quot;subnetwork&quot;: &quot;A String&quot;, # Immutable. Name of the Compute Engine subnetwork in which instances associated with this cluster will be created. Must be part of the subnetwork specified for this cluster.

docs/dyn/workstations_v1beta.projects.locations.workstationClusters.workstationConfigs.html

@@ -163,6 +163,10 @@ <h3>Method Details</h3>
   &quot;degraded&quot;: True or False, # Output only. Whether this resource is in degraded mode, in which case it may require user action to restore full functionality. Details can be found in the `conditions` field.
   &quot;deleteTime&quot;: &quot;A String&quot;, # Output only. Time when this resource was soft-deleted.
   &quot;displayName&quot;: &quot;A String&quot;, # Human-readable name for this resource.
+  &quot;encryptionKey&quot;: { # A customer-specified encryption key for the Compute Engine resources of this workstation configuration. # Encrypts resources of this workstation configuration using a customer-specified encryption key. If specified, the boot disk of the Compute Engine instance and the persistent disk will be encrypted using this encryption key. If this field is not set, the disks will be encrypted using a generated key. Customer-specified encryption keys do not protect disk metadata. If the customer-specified encryption key is rotated, when the workstation instance is stopped, the system will attempt to recreate the persistent disk with the new version of the key. Be sure to keep older versions of the key until the persistent disk is recreated. Otherwise, data on the persistent disk will be lost. If the encryption key is revoked, the workstation session will automatically be stopped within 7 hours.
+    &quot;kmsKey&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS, for example, `projects/PROJECT_ID/locations/REGION/keyRings/KEY_RING/cryptoKeys/KEY_NAME`.
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. However, it is recommended to use a separate service account and to follow KMS best practices mentioned at https://cloud.google.com/kms/docs/separation-of-duties
+  },
   &quot;etag&quot;: &quot;A String&quot;, # Checksum computed by the server. May be sent on update and delete requests to ensure that the client has an up-to-date value before proceeding.
   &quot;host&quot;: { # Runtime host for a workstation. # Runtime host for the workstation.
     &quot;gceInstance&quot;: { # A runtime using a Compute Engine instance. # Specifies a Compute Engine instance as the host.
@@ -322,6 +326,10 @@ <h3>Method Details</h3>
   &quot;degraded&quot;: True or False, # Output only. Whether this resource is in degraded mode, in which case it may require user action to restore full functionality. Details can be found in the `conditions` field.
   &quot;deleteTime&quot;: &quot;A String&quot;, # Output only. Time when this resource was soft-deleted.
   &quot;displayName&quot;: &quot;A String&quot;, # Human-readable name for this resource.
+  &quot;encryptionKey&quot;: { # A customer-specified encryption key for the Compute Engine resources of this workstation configuration. # Encrypts resources of this workstation configuration using a customer-specified encryption key. If specified, the boot disk of the Compute Engine instance and the persistent disk will be encrypted using this encryption key. If this field is not set, the disks will be encrypted using a generated key. Customer-specified encryption keys do not protect disk metadata. If the customer-specified encryption key is rotated, when the workstation instance is stopped, the system will attempt to recreate the persistent disk with the new version of the key. Be sure to keep older versions of the key until the persistent disk is recreated. Otherwise, data on the persistent disk will be lost. If the encryption key is revoked, the workstation session will automatically be stopped within 7 hours.
+    &quot;kmsKey&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS, for example, `projects/PROJECT_ID/locations/REGION/keyRings/KEY_RING/cryptoKeys/KEY_NAME`.
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. However, it is recommended to use a separate service account and to follow KMS best practices mentioned at https://cloud.google.com/kms/docs/separation-of-duties
+  },
   &quot;etag&quot;: &quot;A String&quot;, # Checksum computed by the server. May be sent on update and delete requests to ensure that the client has an up-to-date value before proceeding.
   &quot;host&quot;: { # Runtime host for a workstation. # Runtime host for the workstation.
     &quot;gceInstance&quot;: { # A runtime using a Compute Engine instance. # Specifies a Compute Engine instance as the host.
@@ -469,6 +477,10 @@ <h3>Method Details</h3>
       &quot;degraded&quot;: True or False, # Output only. Whether this resource is in degraded mode, in which case it may require user action to restore full functionality. Details can be found in the `conditions` field.
       &quot;deleteTime&quot;: &quot;A String&quot;, # Output only. Time when this resource was soft-deleted.
       &quot;displayName&quot;: &quot;A String&quot;, # Human-readable name for this resource.
+      &quot;encryptionKey&quot;: { # A customer-specified encryption key for the Compute Engine resources of this workstation configuration. # Encrypts resources of this workstation configuration using a customer-specified encryption key. If specified, the boot disk of the Compute Engine instance and the persistent disk will be encrypted using this encryption key. If this field is not set, the disks will be encrypted using a generated key. Customer-specified encryption keys do not protect disk metadata. If the customer-specified encryption key is rotated, when the workstation instance is stopped, the system will attempt to recreate the persistent disk with the new version of the key. Be sure to keep older versions of the key until the persistent disk is recreated. Otherwise, data on the persistent disk will be lost. If the encryption key is revoked, the workstation session will automatically be stopped within 7 hours.
+        &quot;kmsKey&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS, for example, `projects/PROJECT_ID/locations/REGION/keyRings/KEY_RING/cryptoKeys/KEY_NAME`.
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. However, it is recommended to use a separate service account and to follow KMS best practices mentioned at https://cloud.google.com/kms/docs/separation-of-duties
+      },
       &quot;etag&quot;: &quot;A String&quot;, # Checksum computed by the server. May be sent on update and delete requests to ensure that the client has an up-to-date value before proceeding.
       &quot;host&quot;: { # Runtime host for a workstation. # Runtime host for the workstation.
         &quot;gceInstance&quot;: { # A runtime using a Compute Engine instance. # Specifies a Compute Engine instance as the host.
@@ -570,6 +582,10 @@ <h3>Method Details</h3>
       &quot;degraded&quot;: True or False, # Output only. Whether this resource is in degraded mode, in which case it may require user action to restore full functionality. Details can be found in the `conditions` field.
       &quot;deleteTime&quot;: &quot;A String&quot;, # Output only. Time when this resource was soft-deleted.
       &quot;displayName&quot;: &quot;A String&quot;, # Human-readable name for this resource.
+      &quot;encryptionKey&quot;: { # A customer-specified encryption key for the Compute Engine resources of this workstation configuration. # Encrypts resources of this workstation configuration using a customer-specified encryption key. If specified, the boot disk of the Compute Engine instance and the persistent disk will be encrypted using this encryption key. If this field is not set, the disks will be encrypted using a generated key. Customer-specified encryption keys do not protect disk metadata. If the customer-specified encryption key is rotated, when the workstation instance is stopped, the system will attempt to recreate the persistent disk with the new version of the key. Be sure to keep older versions of the key until the persistent disk is recreated. Otherwise, data on the persistent disk will be lost. If the encryption key is revoked, the workstation session will automatically be stopped within 7 hours.
+        &quot;kmsKey&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS, for example, `projects/PROJECT_ID/locations/REGION/keyRings/KEY_RING/cryptoKeys/KEY_NAME`.
+        &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. However, it is recommended to use a separate service account and to follow KMS best practices mentioned at https://cloud.google.com/kms/docs/separation-of-duties
+      },
       &quot;etag&quot;: &quot;A String&quot;, # Checksum computed by the server. May be sent on update and delete requests to ensure that the client has an up-to-date value before proceeding.
       &quot;host&quot;: { # Runtime host for a workstation. # Runtime host for the workstation.
         &quot;gceInstance&quot;: { # A runtime using a Compute Engine instance. # Specifies a Compute Engine instance as the host.
@@ -686,6 +702,10 @@ <h3>Method Details</h3>
   &quot;degraded&quot;: True or False, # Output only. Whether this resource is in degraded mode, in which case it may require user action to restore full functionality. Details can be found in the `conditions` field.
   &quot;deleteTime&quot;: &quot;A String&quot;, # Output only. Time when this resource was soft-deleted.
   &quot;displayName&quot;: &quot;A String&quot;, # Human-readable name for this resource.
+  &quot;encryptionKey&quot;: { # A customer-specified encryption key for the Compute Engine resources of this workstation configuration. # Encrypts resources of this workstation configuration using a customer-specified encryption key. If specified, the boot disk of the Compute Engine instance and the persistent disk will be encrypted using this encryption key. If this field is not set, the disks will be encrypted using a generated key. Customer-specified encryption keys do not protect disk metadata. If the customer-specified encryption key is rotated, when the workstation instance is stopped, the system will attempt to recreate the persistent disk with the new version of the key. Be sure to keep older versions of the key until the persistent disk is recreated. Otherwise, data on the persistent disk will be lost. If the encryption key is revoked, the workstation session will automatically be stopped within 7 hours.
+    &quot;kmsKey&quot;: &quot;A String&quot;, # The name of the encryption key that is stored in Google Cloud KMS, for example, `projects/PROJECT_ID/locations/REGION/keyRings/KEY_RING/cryptoKeys/KEY_NAME`.
+    &quot;kmsKeyServiceAccount&quot;: &quot;A String&quot;, # The service account being used for the encryption request for the given KMS key. If absent, the Compute Engine default service account is used. However, it is recommended to use a separate service account and to follow KMS best practices mentioned at https://cloud.google.com/kms/docs/separation-of-duties
+  },
   &quot;etag&quot;: &quot;A String&quot;, # Checksum computed by the server. May be sent on update and delete requests to ensure that the client has an up-to-date value before proceeding.
   &quot;host&quot;: { # Runtime host for a workstation. # Runtime host for the workstation.
     &quot;gceInstance&quot;: { # A runtime using a Compute Engine instance. # Specifies a Compute Engine instance as the host.