Make GKE the default in alpha and qa (#2624 )

Add user email prefix to the console user create (#2623 )
Save Cloud SQL connection names in Keyring (#2622 )
2026-05-22 15:51:49 +00:00 · 2024-12-17 17:40:03 +00:00 · 2024-12-13 19:47:21 +00:00 · 2024-12-13 16:18:15 +00:00 · 2024-12-12 18:39:18 +00:00
53 changed files with 614 additions and 299 deletions
--- a/console-webapp/src/app/users/userDetails.component.html
+++ b/console-webapp/src/app/users/userDetails.component.html
@@ -11,31 +11,10 @@
      <mat-icon>arrow_back</mat-icon>
    </button>
  </div>
-  <form (ngSubmit)="saveEdit()">
-    <p>
-      <mat-form-field appearance="outline">
-        <mat-label
-          >User Role:
-          <mat-icon
-            matTooltip="Viewer role doesn't allow making updates; Editor role allows updates, like Contacts delete or SSL certificate change"
-            >help_outline</mat-icon
-          ></mat-label
-        >
-        <mat-select [(ngModel)]="userRole" name="userRole">
-          <mat-option value="PRIMARY_CONTACT">Editor</mat-option>
-          <mat-option value="ACCOUNT_MANAGER">Viewer</mat-option>
-        </mat-select>
-      </mat-form-field>
-    </p>
-    <button
-      mat-flat-button
-      color="primary"
-      aria-label="Save user"
-      type="submit"
-    >
-      Save
-    </button>
-  </form>
+  <app-user-edit-form
+    [user]="userDetails()"
+    (onEditComplete)="saveEdit($event)"
+  />
  } @else { @if(isNewUser) {
  <h1 class="mat-headline-4">
    {{ userDetails().emailAddress + " successfully created" }}
@@ -53,7 +32,7 @@
      mat-flat-button
      color="primary"
      aria-label="Edit User"
-      (click)="userRole = userDetails().role; isEditing = true"
+      (click)="isEditing = true"
    >
      <mat-icon>edit</mat-icon>
      Edit
--- a/console-webapp/src/app/users/userDetails.component.scss
+++ b/console-webapp/src/app/users/userDetails.component.scss
--- a/console-webapp/src/app/users/userDetails.component.ts
+++ b/console-webapp/src/app/users/userDetails.component.ts
@@ -19,13 +19,14 @@ import { SelectedRegistrarModule } from '../app.module';
 import { MaterialModule } from '../material.module';
 import { RegistrarService } from '../registrar/registrar.service';
 import { SnackBarModule } from '../snackbar.module';
-import { UsersService, roleToDescription } from './users.service';
+import { UsersService, roleToDescription, User } from './users.service';
 import { FormsModule } from '@angular/forms';
+import { UserEditFormComponent } from './userEditForm.component';

@Component({
  selector: 'app-user-edit',
-  templateUrl: './userEdit.component.html',
-  styleUrls: ['./userEdit.component.scss'],
+  templateUrl: './userDetails.component.html',
+  styleUrls: ['./userDetails.component.scss'],
  standalone: true,
  imports: [
    FormsModule,
@@ -33,15 +34,15 @@ import { FormsModule } from '@angular/forms';
    SnackBarModule,
    CommonModule,
    SelectedRegistrarModule,
+    UserEditFormComponent,
  ],
  providers: [],
 })
-export class UserEditComponent {
+export class UserDetailsComponent {
  isEditing = false;
  isPasswordVisible = false;
  isNewUser = false;
  isLoading = false;
-  userRole = '';

  userDetails = computed(() => {
    return this.usersService
@@ -84,22 +85,17 @@ export class UserEditComponent {
    this.usersService.currentlyOpenUserEmail.set('');
  }

-  saveEdit() {
+  saveEdit(user: User) {
    this.isLoading = true;
-    this.usersService
-      .updateUser({
-        role: this.userRole,
-        emailAddress: this.userDetails().emailAddress,
-      })
-      .subscribe({
-        error: (err) => {
-          this._snackBar.open(err.error || err.message);
-          this.isLoading = false;
-        },
-        complete: () => {
-          this.isLoading = false;
-          this.isEditing = false;
-        },
-      });
+    this.usersService.updateUser(user).subscribe({
+      error: (err) => {
+        this._snackBar.open(err.error || err.message);
+        this.isLoading = false;
+      },
+      complete: () => {
+        this.isLoading = false;
+        this.isEditing = false;
+      },
+    });
  }
 }
--- a/console-webapp/src/app/users/userEditForm.component.html
+++ b/console-webapp/src/app/users/userEditForm.component.html
@@ -0,0 +1,39 @@
+<form (ngSubmit)="saveEdit($event)" #form>
+  <p *ngIf="isNew()">
+    <mat-form-field appearance="outline">
+      <mat-label
+        >User name prefix:
+        <mat-icon
+          matTooltip="Prefix will be combined with registrar ID to create a unique user name - {prefix}.{registrarId}@registry.google"
+          >help_outline</mat-icon
+        ></mat-label
+      >
+      <input
+        matInput
+        minlength="3"
+        maxlength="3"
+        [required]="true"
+        [(ngModel)]="user().emailAddress"
+        [ngModelOptions]="{ standalone: true }"
+      />
+    </mat-form-field>
+  </p>
+  <p>
+    <mat-form-field appearance="outline">
+      <mat-label
+        >User Role:
+        <mat-icon
+          matTooltip="Viewer role doesn't allow making updates; Editor role allows updates, like Contacts delete or SSL certificate change"
+          >help_outline</mat-icon
+        ></mat-label
+      >
+      <mat-select [(ngModel)]="user().role" name="userRole">
+        <mat-option value="PRIMARY_CONTACT">Editor</mat-option>
+        <mat-option value="ACCOUNT_MANAGER">Viewer</mat-option>
+      </mat-select>
+    </mat-form-field>
+  </p>
+  <button mat-flat-button color="primary" aria-label="Save user" type="submit">
+    Save
+  </button>
+</form>
--- a/console-webapp/src/app/users/userEditForm.component.scss
+++ b/console-webapp/src/app/users/userEditForm.component.scss
--- a/console-webapp/src/app/users/userEditForm.component.ts
+++ b/console-webapp/src/app/users/userEditForm.component.ts
@@ -0,0 +1,58 @@
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import { CommonModule } from '@angular/common';
+import {
+  Component,
+  ElementRef,
+  EventEmitter,
+  input,
+  Output,
+  ViewChild,
+} from '@angular/core';
+import { MaterialModule } from '../material.module';
+import { FormsModule } from '@angular/forms';
+import { User } from './users.service';
+
+@Component({
+  selector: 'app-user-edit-form',
+  templateUrl: './userEditForm.component.html',
+  styleUrls: ['./userEditForm.component.scss'],
+  standalone: true,
+  imports: [FormsModule, MaterialModule, CommonModule],
+  providers: [],
+})
+export class UserEditFormComponent {
+  @ViewChild('form') form!: ElementRef;
+  isNew = input<boolean>(false);
+  user = input<User>(
+    {
+      emailAddress: '',
+      role: 'ACCOUNT_MANAGER',
+    },
+    // @ts-ignore - legit option, typescript fails to match it to a proper type
+    { transform: (user: User) => structuredClone(user) }
+  );
+
+  @Output() onEditComplete = new EventEmitter<User>();
+
+  saveEdit(e: SubmitEvent) {
+    e.preventDefault();
+    if (this.form.nativeElement.checkValidity()) {
+      this.onEditComplete.emit(this.user());
+    } else {
+      this.form.nativeElement.reportValidity();
+    }
+  }
+}
--- a/console-webapp/src/app/users/users.component.html
+++ b/console-webapp/src/app/users/users.component.html
@@ -4,10 +4,8 @@
    <mat-spinner />
  </div>
  } @else if(selectingExistingUser) {
-
  <div class="console-app__users">
    <h1 class="mat-headline-4">Add existing user</h1>
-
    <p>
      <button
        mat-icon-button
@@ -61,6 +59,19 @@
  </div>
  } @else if(usersService.currentlyOpenUserEmail()) {
  <app-user-edit></app-user-edit>
+  } @else if(isNew) {
+  <h1 class="mat-headline-4">New User Form</h1>
+  <div class="spacer"></div>
+  <p>
+    <button
+      mat-icon-button
+      aria-label="Back to users list"
+      (click)="isNew = false"
+    >
+      <mat-icon>arrow_back</mat-icon>
+    </button>
+  </p>
+  <app-user-edit-form [isNew]="true" (onEditComplete)="createNewUser($event)" />
  } @else {
  <div class="console-app__users">
    <div class="console-app__users-header">
@@ -79,11 +90,11 @@
        </button>
        <button
          mat-flat-button
-          (click)="createNewUser()"
+          (click)="isNew = true"
          aria-label="Create new user"
          color="primary"
        >
-          Create a Viewer User
+          Create New User
        </button>
      </div>
    </div>
--- a/console-webapp/src/app/users/users.component.ts
+++ b/console-webapp/src/app/users/users.component.ts
@@ -20,12 +20,13 @@ import { SelectedRegistrarModule } from '../app.module';
 import { MaterialModule } from '../material.module';
 import { RegistrarService } from '../registrar/registrar.service';
 import { SnackBarModule } from '../snackbar.module';
-import { UserEditComponent } from './userEdit.component';
+import { UserDetailsComponent } from './userDetails.component';
 import { User, UsersService } from './users.service';
 import { UserDataService } from '../shared/services/userData.service';
 import { FormsModule } from '@angular/forms';
 import { UsersListComponent } from './usersList.component';
 import { MatSelectChange } from '@angular/material/select';
+import { UserEditFormComponent } from './userEditForm.component';

@Component({
  selector: 'app-users',
@@ -39,12 +40,14 @@ import { MatSelectChange } from '@angular/material/select';
    CommonModule,
    SelectedRegistrarModule,
    UsersListComponent,
-    UserEditComponent,
+    UserEditFormComponent,
+    UserDetailsComponent,
  ],
  providers: [UsersService],
 })
 export class UsersComponent {
  isLoading = false;
+  isNew = false;
  selectingExistingUser = false;
  selectedRegistrarId = '';
  usersSelection: User[] = [];
@@ -87,9 +90,9 @@ export class UsersComponent {
    });
  }

-  createNewUser() {
+  createNewUser(user: User) {
    this.isLoading = true;
-    this.usersService.createOrAddNewUser(null).subscribe({
+    this.usersService.createOrAddNewUser(user).subscribe({
      error: (err: HttpErrorResponse) => {
        this._snackBar.open(err.error || err.message);
        this.isLoading = false;
--- a/console-webapp/src/app/users/users.service.ts
+++ b/console-webapp/src/app/users/users.service.ts
@@ -60,9 +60,9 @@ export class UsersService {
      );
  }

-  createOrAddNewUser(maybeExistingUser: User | null) {
+  createOrAddNewUser(user: User) {
    return this.backendService
-      .createUser(this.registrarService.registrarId(), maybeExistingUser)
+      .createUser(this.registrarService.registrarId(), user)
      .pipe(
        tap((newUser: User) => {
          if (newUser) {
--- a/core/build.gradle
+++ b/core/build.gradle
@@ -166,6 +166,7 @@ dependencies {
  // gradleLint.ignore('unused-dependency') {
  implementation deps['com.google.gwt:gwt-user']
  // }
+  implementation deps['com.google.cloud:google-cloud-compute']
  implementation deps['com.google.cloud:google-cloud-core']
  implementation deps['com.google.cloud:google-cloud-storage']
  implementation deps['com.google.cloud:google-cloud-tasks']
--- a/core/gradle.lockfile
+++ b/core/gradle.lockfile
@@ -32,8 +32,8 @@ com.google.api-client:google-api-client-jackson2:2.0.1=compileClasspath,deploy_j
 com.google.api-client:google-api-client-jackson2:2.2.0=testRuntimeClasspath
 com.google.api-client:google-api-client-java6:2.1.4=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client-servlet:2.2.0=testRuntimeClasspath
-com.google.api-client:google-api-client-servlet:2.7.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
-com.google.api-client:google-api-client:2.7.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api-client:google-api-client-servlet:2.7.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath
+com.google.api-client:google-api-client:2.7.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:gapic-google-cloud-storage-v2:2.32.1-alpha=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 com.google.api.grpc:gapic-google-cloud-storage-v2:2.45.0-beta=testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:3.9.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -54,6 +54,7 @@ com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.181.0=compileCl
 com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.181.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:2.43.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-bigtable-v2:2.43.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-compute-v1:1.64.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.112.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-firestore-v1:3.25.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-monitoring-v3:3.49.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -94,7 +95,7 @@ com.google.apis:google-api-services-iam:v2-rev20240530-2.0.0=compileClasspath,de
 com.google.apis:google-api-services-iamcredentials:v1-rev20211203-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-monitoring:v3-rev20241017-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-pubsub:v1-rev20220904-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-sheets:v4-rev20241008-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-sheets:v4-rev20241203-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20240925-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-storage:v1-rev20240706-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 com.google.apis:google-api-services-storage:v1-rev20241008-2.0.0=testRuntimeClasspath
@@ -120,6 +121,7 @@ com.google.cloud.sql:jdbc-socket-factory-core:1.21.0=compileClasspath,deploy_jar
 com.google.cloud.sql:postgres-socket-factory:1.21.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigquerystorage:3.9.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigtable:2.43.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-compute:1.64.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-core-grpc:2.42.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 com.google.cloud:google-cloud-core-grpc:2.48.0=testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-core-http:2.31.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
@@ -153,7 +155,7 @@ com.google.devtools.ksp:symbol-processing-api:1.9.20-1.0.14=annotationProcessor,
 com.google.errorprone:error_prone_annotation:2.23.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_annotations:2.20.0=soy
 com.google.errorprone:error_prone_annotations:2.23.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
-com.google.errorprone:error_prone_annotations:2.35.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.errorprone:error_prone_annotations:2.36.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.errorprone:error_prone_annotations:2.7.1=checkstyle
 com.google.errorprone:error_prone_check_api:2.23.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_core:2.23.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
@@ -179,14 +181,14 @@ com.google.guava:guava:33.0.0-jre=annotationProcessor,testAnnotationProcessor
 com.google.guava:guava:33.3.1-jre=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.gwt:gwt-user:2.10.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-apache-v2:1.45.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-apache-v2:1.45.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-appengine:1.43.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 com.google.http-client:google-http-client-appengine:1.45.0=testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-gson:1.45.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-gson:1.45.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-jackson2:1.43.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
 com.google.http-client:google-http-client-jackson2:1.45.0=testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-protobuf:1.44.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client:1.45.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client:1.45.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.inject:guice:5.1.0=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 com.google.inject:guice:7.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,soy,testCompileClasspath,testRuntimeClasspath
 com.google.j2objc:j2objc-annotations:1.3=checkstyle
@@ -262,10 +264,11 @@ io.github.eisop:dataflow-errorprone:3.34.0-eisop1=annotationProcessor,errorprone
 io.github.java-diff-utils:java-diff-utils:4.12=annotationProcessor,errorprone,nonprodAnnotationProcessor,testAnnotationProcessor
 io.github.java-diff-utils:java-diff-utils:4.15=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-alts:1.68.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-api:1.68.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-api:1.68.1=compileClasspath,nonprodCompileClasspath,testCompileClasspath
+io.grpc:grpc-api:1.68.2=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-auth:1.68.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-census:1.66.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-context:1.68.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-context:1.68.2=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-core:1.68.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-googleapis:1.68.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-grpclb:1.68.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -484,7 +487,7 @@ org.jetbrains.kotlinx:kotlinx-serialization-core-jvm:1.0.1=deploy_jar,nonprodRun
 org.jetbrains.kotlinx:kotlinx-serialization-core:1.0.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
 org.jetbrains:annotations:13.0=annotationProcessor,testAnnotationProcessor
 org.jetbrains:annotations:17.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.jline:jline:3.27.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.jline:jline:3.28.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.joda:joda-money:2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.json:json:20230618=soy
 org.json:json:20240303=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
--- a/core/src/main/java/google/registry/config/RegistryConfig.java
+++ b/core/src/main/java/google/registry/config/RegistryConfig.java
@@ -46,7 +46,6 @@ import java.lang.annotation.Documented;
 import java.lang.annotation.Retention;
 import java.net.URI;
 import java.net.URL;
-import java.util.Map;
 import java.util.Map.Entry;
 import java.util.Optional;
 import java.util.function.Supplier;
@@ -118,12 +117,6 @@ public final class RegistryConfig {
      return config.gcpProject.projectIdNumber;
    }

-    @Provides
-    @Config("backendServiceIds")
-    public static Map<String, Long> provideBackendServiceIds(RegistryConfigSettings config) {
-      return config.gcpProject.backendServiceIds;
-    }
-
    @Provides
    @Config("baseDomain")
    public static String provideBaseDomain(RegistryConfigSettings config) {
--- a/core/src/main/java/google/registry/config/RegistryConfigSettings.java
+++ b/core/src/main/java/google/registry/config/RegistryConfigSettings.java
@@ -56,7 +56,6 @@ public class RegistryConfigSettings {
    public String bsaServiceUrl;
    public String toolsServiceUrl;
    public String pubapiServiceUrl;
-    public Map<String, Long> backendServiceIds;
    public String baseDomain;
  }

--- a/core/src/main/java/google/registry/config/files/default-config.yaml
+++ b/core/src/main/java/google/registry/config/files/default-config.yaml
@@ -24,15 +24,6 @@ gcpProject:
  toolsServiceUrl: https://tools.example.com
  pubapiServiceUrl: https://pubapi.example.com

-  # The backend service IDs created when setting up GKE routes. They will be included in the
-  # audience field in the JWT that IAP creates.
-  # See: https://cloud.google.com/iap/docs/signed-headers-howto#verifying_the_jwt_payload
-  backendServiceIds:
-    frontend: 12345
-    backend: 12345
-    pubapi: 12345
-    console: 12345
-
  # The base domain name of the registry service. Services are reachable at [service].baseDomain.
  baseDomain: registry.test

--- a/core/src/main/java/google/registry/keyring/api/DummyKeyringModule.java
+++ b/core/src/main/java/google/registry/keyring/api/DummyKeyringModule.java
@@ -124,7 +124,9 @@ public abstract class DummyKeyringModule {
        "not a real login",
        "not a real credential",
        "not a real password",
-        "not a real password");
+        "not a real password",
+        "not the real primary connection",
+        "not the real replica connection");
  }

  private DummyKeyringModule() {}
--- a/core/src/main/java/google/registry/keyring/api/InMemoryKeyring.java
+++ b/core/src/main/java/google/registry/keyring/api/InMemoryKeyring.java
@@ -39,6 +39,8 @@ public final class InMemoryKeyring implements Keyring {
  private final String marksdbLordnPassword;
  private final String marksdbSmdrlLoginAndPassword;
  private final String bsaApiKey;
+  private final String sqlPrimaryConnectionName;
+  private final String sqlReplicaConnectionName;

  public InMemoryKeyring(
      PGPKeyPair rdeStagingKey,
@@ -55,7 +57,9 @@ public final class InMemoryKeyring implements Keyring {
      String marksdbSmdrlLoginAndPassword,
      String cloudSqlPassword,
      String toolsCloudSqlPassword,
-      String bsaApiKey) {
+      String bsaApiKey,
+      String sqlPrimaryConnectionName,
+      String sqlReplicaConnectionName) {
    checkArgument(PgpHelper.isSigningKey(rdeSigningKey.getPublicKey()),
        "RDE signing key must support signing: %s", rdeSigningKey.getKeyID());
    checkArgument(rdeStagingKey.getPublicKey().isEncryptionKey(),
@@ -81,6 +85,8 @@ public final class InMemoryKeyring implements Keyring {
    this.marksdbSmdrlLoginAndPassword =
        checkNotNull(marksdbSmdrlLoginAndPassword, "marksdbSmdrlLoginAndPassword");
    this.bsaApiKey = checkNotNull(bsaApiKey, "bsaApiKey");
+    this.sqlPrimaryConnectionName = sqlPrimaryConnectionName;
+    this.sqlReplicaConnectionName = sqlReplicaConnectionName;
  }

  @Override
@@ -153,6 +159,16 @@ public final class InMemoryKeyring implements Keyring {
    return bsaApiKey;
  }

+  @Override
+  public String getSqlPrimaryConnectionName() {
+    return sqlPrimaryConnectionName;
+  }
+
+  @Override
+  public String getSqlReplicaConnectionName() {
+    return sqlReplicaConnectionName;
+  }
+
  /** Does nothing. */
  @Override
  public void close() {}
--- a/core/src/main/java/google/registry/keyring/api/Keyring.java
+++ b/core/src/main/java/google/registry/keyring/api/Keyring.java
@@ -148,6 +148,12 @@ public interface Keyring extends AutoCloseable {
  /** Returns the API_KEY for authentication with the BSA portal. */
  String getBsaApiKey();

+  /** Returns the Cloud SQL connection name of the primary database instance. */
+  String getSqlPrimaryConnectionName();
+
+  /** Returns the Cloud SQL connection name of the replica database instance. */
+  String getSqlReplicaConnectionName();
+
  // Don't throw so try-with-resources works better.
  @Override
  void close();
--- a/core/src/main/java/google/registry/keyring/secretmanager/SecretManagerKeyring.java
+++ b/core/src/main/java/google/registry/keyring/secretmanager/SecretManagerKeyring.java
@@ -57,14 +57,16 @@ public class SecretManagerKeyring implements Keyring {

  /** Key labels for string secrets. */
  enum StringKeyLabel {
-    SAFE_BROWSING_API_KEY,
    BSA_API_KEY_STRING,
    ICANN_REPORTING_PASSWORD_STRING,
    MARKSDB_DNL_LOGIN_STRING,
    MARKSDB_LORDN_PASSWORD_STRING,
    MARKSDB_SMDRL_LOGIN_STRING,
    RDE_SSH_CLIENT_PRIVATE_STRING,
-    RDE_SSH_CLIENT_PUBLIC_STRING;
+    RDE_SSH_CLIENT_PUBLIC_STRING,
+    SAFE_BROWSING_API_KEY,
+    SQL_PRIMARY_CONN_NAME,
+    SQL_REPLICA_CONN_NAME;

    String getLabel() {
      return UPPER_UNDERSCORE.to(LOWER_HYPHEN, name());
@@ -148,6 +150,16 @@ public class SecretManagerKeyring implements Keyring {
    return getString(StringKeyLabel.BSA_API_KEY_STRING);
  }

+  @Override
+  public String getSqlPrimaryConnectionName() {
+    return getString(StringKeyLabel.SQL_PRIMARY_CONN_NAME);
+  }
+
+  @Override
+  public String getSqlReplicaConnectionName() {
+    return getString(StringKeyLabel.SQL_REPLICA_CONN_NAME);
+  }
+
  /** No persistent resources are maintained for this Keyring implementation. */
  @Override
  public void close() {}
--- a/core/src/main/java/google/registry/keyring/secretmanager/SecretManagerKeyringUpdater.java
+++ b/core/src/main/java/google/registry/keyring/secretmanager/SecretManagerKeyringUpdater.java
@@ -32,6 +32,8 @@ import static google.registry.keyring.secretmanager.SecretManagerKeyring.StringK
 import static google.registry.keyring.secretmanager.SecretManagerKeyring.StringKeyLabel.RDE_SSH_CLIENT_PRIVATE_STRING;
 import static google.registry.keyring.secretmanager.SecretManagerKeyring.StringKeyLabel.RDE_SSH_CLIENT_PUBLIC_STRING;
 import static google.registry.keyring.secretmanager.SecretManagerKeyring.StringKeyLabel.SAFE_BROWSING_API_KEY;
+import static google.registry.keyring.secretmanager.SecretManagerKeyring.StringKeyLabel.SQL_PRIMARY_CONN_NAME;
+import static google.registry.keyring.secretmanager.SecretManagerKeyring.StringKeyLabel.SQL_REPLICA_CONN_NAME;
 import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;

 import com.google.common.flogger.FluentLogger;
@@ -124,6 +126,14 @@ public final class SecretManagerKeyringUpdater {
    return setString(credential, BSA_API_KEY_STRING);
  }

+  public SecretManagerKeyringUpdater setSqlPrimaryConnectionName(String name) {
+    return setString(name, SQL_PRIMARY_CONN_NAME);
+  }
+
+  public SecretManagerKeyringUpdater setSqlReplicaConnectionName(String name) {
+    return setString(name, SQL_REPLICA_CONN_NAME);
+  }
+
  /**
   * Persists the secrets in the Secret Manager.
   *
--- a/core/src/main/java/google/registry/request/auth/AuthModule.java
+++ b/core/src/main/java/google/registry/request/auth/AuthModule.java
@@ -14,19 +14,35 @@

 package google.registry.request.auth;

+import static com.google.common.base.Preconditions.checkNotNull;
+import static com.google.common.base.Suppliers.memoizeWithExpiration;
 import static com.google.common.net.HttpHeaders.AUTHORIZATION;
+import static google.registry.util.RegistryEnvironment.UNITTEST;

+import com.google.cloud.compute.v1.BackendService;
+import com.google.cloud.compute.v1.BackendServicesClient;
+import com.google.cloud.compute.v1.BackendServicesSettings;
 import com.google.common.collect.ImmutableList;
+import com.google.common.collect.ImmutableMap;
+import com.google.re2j.Matcher;
+import com.google.re2j.Pattern;
+import dagger.Lazy;
 import dagger.Module;
 import dagger.Provides;
+import google.registry.config.CredentialModule.ApplicationDefaultCredential;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.request.auth.OidcTokenAuthenticationMechanism.IapOidcAuthenticationMechanism;
 import google.registry.request.auth.OidcTokenAuthenticationMechanism.RegularOidcAuthenticationMechanism;
 import google.registry.request.auth.OidcTokenAuthenticationMechanism.TokenExtractor;
 import google.registry.request.auth.OidcTokenAuthenticationMechanism.TokenVerifier;
+import google.registry.util.GoogleCredentialsBundle;
 import google.registry.util.RegistryEnvironment;
-import java.util.Map;
+import java.io.IOException;
+import java.time.Duration;
+import java.util.function.Supplier;
 import javax.annotation.Nullable;
+import javax.inject.Named;
+import javax.inject.Provider;
 import javax.inject.Qualifier;
 import javax.inject.Singleton;

@@ -44,6 +60,13 @@ public class AuthModule {
  private static final String IAP_GKE_AUDIENCE_FORMAT = "/projects/%d/global/backendServices/%d";
  private static final String IAP_ISSUER_URL = "https://cloud.google.com/iap";
  private static final String REGULAR_ISSUER_URL = "https://accounts.google.com";
+  // The backend service IDs created when setting up GKE routes. They will be included in the
+  // audience field in the JWT that IAP creates.
+  // See: https://cloud.google.com/iap/docs/signed-headers-howto#verifying_the_jwt_payload
+  // The automatically generated backend service ID has the following format:
+  // gkemcg1-default-console[-canary]-80-(some random string)
+  private static final Pattern BACKEND_END_PATTERN =
+      Pattern.compile(".*-default-((frontend|backend|console|pubapi)(-canary)?)-80-.*");

  /** Provides the custom authentication mechanisms. */
  @Provides
@@ -68,13 +91,18 @@ public class AuthModule {
  TokenVerifier provideIapTokenVerifier(
      @Config("projectId") String projectId,
      @Config("projectIdNumber") long projectIdNumber,
-      @Config("backendServiceIds") Map<String, Long> backendServiceIds) {
+      @Named("backendServiceIdMap") Supplier<ImmutableMap<String, Long>> backendServiceIdMap) {
    com.google.auth.oauth2.TokenVerifier.Builder tokenVerifierBuilder =
        com.google.auth.oauth2.TokenVerifier.newBuilder().setIssuer(IAP_ISSUER_URL);
    return (String service, String token) -> {
      String audience;
      if (RegistryEnvironment.isOnJetty()) {
-        long backendServiceId = backendServiceIds.get(service);
+        Long backendServiceId = backendServiceIdMap.get().get(service);
+        checkNotNull(
+            backendServiceId,
+            "Backend service ID not found for service: %s, available IDs are %s",
+            service,
+            backendServiceIdMap);
        audience = String.format(IAP_GKE_AUDIENCE_FORMAT, projectIdNumber, backendServiceId);
      } else {
        audience = String.format(IAP_GAE_AUDIENCE_FORMAT, projectIdNumber, projectId);
@@ -116,4 +144,48 @@ public class AuthModule {
      return null;
    };
  }
+
+  @Provides
+  @Singleton
+  static BackendServicesClient provideBackendServicesClients(
+      @ApplicationDefaultCredential GoogleCredentialsBundle credentialsBundle) {
+    try {
+      return BackendServicesClient.create(
+          BackendServicesSettings.newBuilder()
+              .setCredentialsProvider(credentialsBundle::getGoogleCredentials)
+              .build());
+    } catch (IOException e) {
+      throw new RuntimeException(e);
+    }
+  }
+
+  @Provides
+  @Named("backendServiceIdMap")
+  static ImmutableMap<String, Long> provideBackendServiceList(
+      Lazy<BackendServicesClient> client, @Config("projectId") String projectId) {
+    if (RegistryEnvironment.isInTestServer() || RegistryEnvironment.get() == UNITTEST) {
+      return ImmutableMap.of();
+    }
+    ImmutableMap.Builder<String, Long> builder = ImmutableMap.builder();
+    for (BackendService service : client.get().list(projectId).iterateAll()) {
+      String name = service.getName();
+      Matcher matcher = BACKEND_END_PATTERN.matcher(name);
+      if (!matcher.matches()) {
+        continue;
+      }
+      builder.put(matcher.group(1), service.getId());
+    }
+    return builder.build();
+  }
+
+  // Use an expiring cache so that the backend service ID map can be refreshed without restarting
+  // the server. The map is very unlikely to change, except for when services are just deployed
+  // for the first time, because some pods might receive traffic before all services are deployed.
+  @Provides
+  @Singleton
+  @Named("backendServiceIdMap")
+  static Supplier<ImmutableMap<String, Long>> provideBackendServiceIdMapSupplier(
+      @Named("backendServiceIdMap") Provider<ImmutableMap<String, Long>> backendServiceIdMap) {
+    return memoizeWithExpiration(backendServiceIdMap::get, Duration.ofMinutes(15));
+  }
 }
--- a/core/src/main/java/google/registry/request/auth/OidcTokenAuthenticationMechanism.java
+++ b/core/src/main/java/google/registry/request/auth/OidcTokenAuthenticationMechanism.java
@@ -87,6 +87,9 @@ public abstract class OidcTokenAuthenticationMechanism implements Authentication
      if (RegistryEnvironment.isOnJetty()) {
        String hostname = request.getServerName();
        service = Splitter.on('.').split(hostname).iterator().next();
+        if (request.getHeader("canary") != null) {
+          service += "-canary";
+        }
      }
      token = tokenVerifier.verify(service, rawIdToken);
    } catch (Exception e) {
--- a/core/src/main/java/google/registry/tools/CurlCommand.java
+++ b/core/src/main/java/google/registry/tools/CurlCommand.java
@@ -80,15 +80,14 @@ class CurlCommand implements CommandWithConnection {
      required = true)
  private String serviceName;

-  @Parameter(
-      names = {"--canary"},
-      description = "If set, use the canary end-point; otherwise use the regular end-point.")
-  private Boolean canary = Boolean.FALSE;
-
  @Inject
  @Config("useGke")
  boolean useGke;

+  @Inject
+  @Config("useCanary")
+  boolean useCanary;
+
  @Override
  public void setConnection(ServiceConnection connection) {
    this.connection = connection;
@@ -109,7 +108,7 @@ class CurlCommand implements CommandWithConnection {
            ? GkeService.valueOf(Ascii.toUpperCase(serviceName))
            : GaeService.valueOf(Ascii.toUpperCase(serviceName));

-    ServiceConnection connectionToService = connection.withService(service, canary);
+    ServiceConnection connectionToService = connection.withService(service, useCanary);
    String response =
        (method == Method.GET)
            ? connectionToService.sendGetRequest(path, ImmutableMap.<String, String>of())
--- a/core/src/main/java/google/registry/tools/GetKeyringSecretCommand.java
+++ b/core/src/main/java/google/registry/tools/GetKeyringSecretCommand.java
@@ -64,8 +64,6 @@ final class GetKeyringSecretCommand implements Command {
      case BSA_API_KEY -> out.write(KeySerializer.serializeString(keyring.getBsaApiKey()));
      case ICANN_REPORTING_PASSWORD ->
          out.write(KeySerializer.serializeString(keyring.getIcannReportingPassword()));
-      case SAFE_BROWSING_API_KEY ->
-          out.write(KeySerializer.serializeString(keyring.getSafeBrowsingAPIKey()));
      case MARKSDB_DNL_LOGIN_AND_PASSWORD ->
          out.write(KeySerializer.serializeString(keyring.getMarksdbDnlLoginAndPassword()));
      case MARKSDB_LORDN_PASSWORD ->
@@ -91,6 +89,12 @@ final class GetKeyringSecretCommand implements Command {
                      keyring.getRdeStagingEncryptionKey(), keyring.getRdeStagingDecryptionKey())));
      case RDE_STAGING_PUBLIC_KEY ->
          out.write(KeySerializer.serializePublicKey(keyring.getRdeStagingEncryptionKey()));
+      case SAFE_BROWSING_API_KEY ->
+          out.write(KeySerializer.serializeString(keyring.getSafeBrowsingAPIKey()));
+      case SQL_PRIMARY_CONN_NAME ->
+          out.write(KeySerializer.serializeString(keyring.getSqlPrimaryConnectionName()));
+      case SQL_REPLICA_CONN_NAME ->
+          out.write(KeySerializer.serializeString(keyring.getSqlReplicaConnectionName()));
    }
  }
 }
--- a/core/src/main/java/google/registry/tools/RegistryCli.java
+++ b/core/src/main/java/google/registry/tools/RegistryCli.java
@@ -25,6 +25,7 @@ import com.beust.jcommander.Parameters;
 import com.beust.jcommander.ParametersDelegate;
 import com.google.common.base.Throwables;
 import com.google.common.collect.ImmutableMap;
+import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.Iterables;
 import google.registry.persistence.transaction.JpaTransactionManager;
 import google.registry.persistence.transaction.TransactionManagerFactory;
@@ -41,6 +42,9 @@ import org.postgresql.util.PSQLException;
@Parameters(separators = " =", commandDescription = "Command-line interface to the registry")
 final class RegistryCli implements CommandRunner {

+  private static final ImmutableSet<RegistryToolEnvironment> DEFAULT_GKE_ENVIRONMENTS =
+      ImmutableSet.of(RegistryToolEnvironment.ALPHA, RegistryToolEnvironment.QA);
+
  // The environment parameter is parsed twice: once here, and once with {@link
  // RegistryToolEnvironment#parseFromArgs} in the {@link RegistryTool#main} function.
  //
@@ -73,6 +77,12 @@ final class RegistryCli implements CommandRunner {
  @Parameter(names = "--gke", description = "Whether to use GKE runtime, instead of GAE")
  private boolean useGke = false;

+  @Parameter(names = "--gae", description = "Whether to use GAE runtime, instead of GKE")
+  private boolean useGae = false;
+
+  @Parameter(names = "--canary", description = "Whether to connect to the canary instances")
+  private boolean useCanary = false;
+
  // Do not make this final - compile-time constant inlining may interfere with JCommander.
  @ParametersDelegate private LoggingParameters loggingParams = new LoggingParameters();

@@ -146,6 +156,13 @@ final class RegistryCli implements CommandRunner {
      }
      throw e;
    }
+
+    checkState(!useGke || !useGae, "Cannot specify both --gke and --gae");
+    // Special logic to set the default based on the environment if neither --gae nor --gke is set.
+    if (!useGke && !useGae) {
+      useGke = DEFAULT_GKE_ENVIRONMENTS.contains(environment);
+    }
+
    String parsedCommand = jcommander.getParsedCommand();
    // Show the list of all commands either if requested or if no subcommand name was specified
    // (which does not throw a ParameterException parse error above).
@@ -166,6 +183,7 @@ final class RegistryCli implements CommandRunner {
            .credentialFilePath(credentialJson)
            .sqlAccessInfoFile(sqlAccessInfoFile)
            .useGke(useGke)
+            .useCanary(useCanary)
            .build();

    // JCommander stores sub-commands as nested JCommander objects containing a list of user objects
@@ -196,9 +214,9 @@ final class RegistryCli implements CommandRunner {
          System.err.println("===================================================================");
          System.err.println(
              """
-                  This error is likely the result of having another instance of
-                  nomulus running at the same time.  Check your system, shut down
-                  the other instance, and try again.""");
+              This error is likely the result of having another instance of
+              nomulus running at the same time.  Check your system, shut down
+              the other instance, and try again.""");
          System.err.println("===================================================================");
        } else {
          throw e;
--- a/core/src/main/java/google/registry/tools/RegistryToolComponent.java
+++ b/core/src/main/java/google/registry/tools/RegistryToolComponent.java
@@ -195,6 +195,9 @@ interface RegistryToolComponent {
    @BindsInstance
    Builder useGke(@Config("useGke") boolean useGke);

+    @BindsInstance
+    Builder useCanary(@Config("useCanary") boolean useCanary);
+
    RegistryToolComponent build();
  }
 }
--- a/core/src/main/java/google/registry/tools/ServiceConnection.java
+++ b/core/src/main/java/google/registry/tools/ServiceConnection.java
@@ -65,8 +65,11 @@ public class ServiceConnection {
  private final HttpRequestFactory requestFactory;

  @Inject
-  ServiceConnection(@Config("useGke") boolean useGke, HttpRequestFactory requestFactory) {
-    this(useGke ? GkeService.BACKEND : GaeService.TOOLS, requestFactory, false);
+  ServiceConnection(
+      @Config("useGke") boolean useGke,
+      @Config("useCanary") boolean useCanary,
+      HttpRequestFactory requestFactory) {
+    this(useGke ? GkeService.BACKEND : GaeService.TOOLS, requestFactory, useCanary);
  }

  private ServiceConnection(Service service, HttpRequestFactory requestFactory, boolean useCanary) {
--- a/core/src/main/java/google/registry/tools/UpdateKeyringSecretCommand.java
+++ b/core/src/main/java/google/registry/tools/UpdateKeyringSecretCommand.java
@@ -90,12 +90,16 @@ final class UpdateKeyringSecretCommand implements Command {
          secretManagerKeyringUpdater.setRdeSshClientPublicKey(deserializeString(input));
      case RDE_STAGING_KEY_PAIR ->
          secretManagerKeyringUpdater.setRdeStagingKey(deserializeKeyPair(input));
-      case SAFE_BROWSING_API_KEY ->
-          secretManagerKeyringUpdater.setSafeBrowsingAPIKey(deserializeString(input));
      case RDE_STAGING_PUBLIC_KEY ->
          throw new IllegalArgumentException(
              "Can't update RDE_STAGING_PUBLIC_KEY directly."
                  + " Must update public and private keys together using RDE_STAGING_KEY_PAIR.");
+      case SAFE_BROWSING_API_KEY ->
+          secretManagerKeyringUpdater.setSafeBrowsingAPIKey(deserializeString(input));
+      case SQL_PRIMARY_CONN_NAME ->
+          secretManagerKeyringUpdater.setSqlPrimaryConnectionName(deserializeString(input));
+      case SQL_REPLICA_CONN_NAME ->
+          secretManagerKeyringUpdater.setSqlReplicaConnectionName(deserializeString(input));
    }

    secretManagerKeyringUpdater.update();
--- a/core/src/main/java/google/registry/tools/params/KeyringKeyName.java
+++ b/core/src/main/java/google/registry/tools/params/KeyringKeyName.java
@@ -36,5 +36,7 @@ public enum KeyringKeyName {
  RDE_SSH_CLIENT_PUBLIC_KEY,
  RDE_STAGING_KEY_PAIR,
  RDE_STAGING_PUBLIC_KEY,
-  SAFE_BROWSING_API_KEY
+  SAFE_BROWSING_API_KEY,
+  SQL_PRIMARY_CONN_NAME,
+  SQL_REPLICA_CONN_NAME
 }
--- a/core/src/main/java/google/registry/ui/server/console/ConsoleUsersAction.java
+++ b/core/src/main/java/google/registry/ui/server/console/ConsoleUsersAction.java
@@ -29,7 +29,6 @@ import static jakarta.servlet.http.HttpServletResponse.SC_OK;

 import com.google.api.services.directory.Directory;
 import com.google.api.services.directory.model.UserName;
-import com.google.common.base.Splitter;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
 import com.google.gson.annotations.Expose;
@@ -52,7 +51,6 @@ import java.util.Map;
 import java.util.Objects;
 import java.util.Optional;
 import java.util.stream.Collectors;
-import java.util.stream.IntStream;
 import javax.annotation.Nullable;
 import javax.inject.Inject;
 import javax.inject.Named;
@@ -67,7 +65,6 @@ public class ConsoleUsersAction extends ConsoleApiAction {
  static final String PATH = "/console-api/users";

  private static final int PASSWORD_LENGTH = 16;
-  private static final Splitter EMAIL_SPLITTER = Splitter.on('@').trimResults();

  private final String registrarId;
  private final Directory directory;
@@ -102,12 +99,7 @@ public class ConsoleUsersAction extends ConsoleApiAction {
    // Temporary flag while testing
    if (user.getUserRoles().isAdmin()) {
      checkPermission(user, registrarId, ConsolePermission.MANAGE_USERS);
-      if (userData.isPresent()) { // Adding existing user to registrar
-        tm().transact(this::runAppendUserInTransaction);
-      } else { // Adding new user to registrar
-        tm().transact(this::runCreateInTransaction);
-      }
-
+      tm().transact(this::runPostInTransaction);
    } else {
      consoleApiParams.response().setStatus(SC_FORBIDDEN);
    }
@@ -152,31 +144,35 @@ public class ConsoleUsersAction extends ConsoleApiAction {
    }
  }

-  private void runAppendUserInTransaction() {
-    if (!isModifyingRequestValid(false)) {
-      return;
+  private void runPostInTransaction() throws IOException {
+    validateRequestParams();
+    if (!tm().exists(VKey.create(User.class, this.userData.get().emailAddress))) {
+      this.runCreate();
+    } else {
+      this.runAppendUserToExistingRegistrar();
    }
+  }
+
+  private void runAppendUserToExistingRegistrar() {
    ImmutableList<User> allRegistrarUsers = getAllRegistrarUsers(registrarId);
-    if (allRegistrarUsers.size() >= 4)
+    if (allRegistrarUsers.size() >= 4) {
      throw new BadRequestException("Total users amount per registrar is limited to 4");
+    }

    updateUserRegistrarRoles(
        this.userData.get().emailAddress,
        registrarId,
-        RegistrarRole.valueOf(this.userData.get().role),
-        false);
+        RegistrarRole.valueOf(this.userData.get().role));
    consoleApiParams.response().setStatus(SC_OK);
  }

  private void runDeleteInTransaction() throws IOException {
-    if (!isModifyingRequestValid(true)) {
+    if (!isModifyingRequestValid()) {
      return;
    }

    String email = this.userData.get().emailAddress;
-    User updatedUser =
-        updateUserRegistrarRoles(
-            email, registrarId, RegistrarRole.valueOf(this.userData.get().role), true);
+    User updatedUser = updateUserRegistrarRoles(email, registrarId, null);

    // User has no registrars assigned
    if (updatedUser.getUserRoles().getRegistrarRoles().size() == 0) {
@@ -192,33 +188,33 @@ public class ConsoleUsersAction extends ConsoleApiAction {
      User.revokeIapPermission(email, maybeGroupEmailAddress, cloudTasksUtils, null, iamClient);
    }

-
    consoleApiParams.response().setStatus(SC_OK);
  }

-  private void runCreateInTransaction() throws IOException {
+  private void runCreate() throws IOException {
    ImmutableList<User> allRegistrarUsers = getAllRegistrarUsers(registrarId);
-    if (allRegistrarUsers.size() >= 4)
+    if (allRegistrarUsers.size() >= 4) {
      throw new BadRequestException("Total users amount per registrar is limited to 4");
+    }

-    String nextAvailableEmail =
-        IntStream.range(1, 5)
-            .mapToObj(i -> String.format("%s-user%s@%s", registrarId, i, gSuiteDomainName))
-            .filter(email -> tm().loadByKeyIfPresent(VKey.create(User.class, email)).isEmpty())
-            .findFirst()
-            // Can only happen if registrar cycled through 20 users, which is unlikely
-            .orElseThrow(
-                () -> new BadRequestException("Failed to find available increment for new user"));
+    String newEmailPrefix = userData.get().emailAddress.trim();
+
+    if (!newEmailPrefix.matches("^[a-zA-Z0-9]{3}$")) {
+      throw new BadRequestException("Email prefix is invalid");
+    }
+
+    String newEmail = String.format("%s.%s@%s", newEmailPrefix, registrarId, gSuiteDomainName);
+    if (tm().loadByKeyIfPresent(VKey.create(User.class, newEmail)).isPresent()) {
+      throw new BadRequestException("Email prefix is not available");
+    }

    com.google.api.services.directory.model.User newUser =
        new com.google.api.services.directory.model.User();

    newUser.setName(
-        new UserName()
-            .setFamilyName(registrarId)
-            .setGivenName(EMAIL_SPLITTER.splitToList(nextAvailableEmail).get(0)));
+        new UserName().setFamilyName(registrarId).setGivenName(newEmailPrefix + "." + registrarId));
    newUser.setPassword(passwordGenerator.createString(PASSWORD_LENGTH));
-    newUser.setPrimaryEmail(nextAvailableEmail);
+    newUser.setPrimaryEmail(newEmail);

    try {
      directory.users().insert(newUser).execute();
@@ -232,11 +228,9 @@ public class ConsoleUsersAction extends ConsoleApiAction {
            .setRegistrarRoles(ImmutableMap.of(registrarId, ACCOUNT_MANAGER))
            .build();

-    User.Builder builder =
-        new User.Builder().setUserRoles(userRoles).setEmailAddress(newUser.getPrimaryEmail());
+    User.Builder builder = new User.Builder().setUserRoles(userRoles).setEmailAddress(newEmail);
    tm().put(builder.build());
-    User.grantIapPermission(
-        nextAvailableEmail, maybeGroupEmailAddress, cloudTasksUtils, null, iamClient);
+    User.grantIapPermission(newEmail, maybeGroupEmailAddress, cloudTasksUtils, null, iamClient);

    consoleApiParams.response().setStatus(SC_CREATED);
    consoleApiParams
@@ -244,72 +238,69 @@ public class ConsoleUsersAction extends ConsoleApiAction {
        .setPayload(
            consoleApiParams
                .gson()
-                .toJson(
-                    new UserData(
-                        newUser.getPrimaryEmail(),
-                        ACCOUNT_MANAGER.toString(),
-                        newUser.getPassword())));
+                .toJson(new UserData(newEmail, ACCOUNT_MANAGER.toString(), newUser.getPassword())));
  }

  private void runUpdateInTransaction() {
-    if (!isModifyingRequestValid(true)) {
+    if (!isModifyingRequestValid()) {
      return;
    }

    updateUserRegistrarRoles(
        this.userData.get().emailAddress,
        registrarId,
-        RegistrarRole.valueOf(this.userData.get().role),
-        false);
+        RegistrarRole.valueOf(this.userData.get().role));
    consoleApiParams.response().setStatus(SC_OK);
  }

-  private boolean isModifyingRequestValid(boolean verifyAccess) {
+  private boolean isModifyingRequestValid() {
+    validateRequestParams();
+    User userToUpdate = verifyUserExists(userData.get().emailAddress);
+    return validateUserRegistrarAssociation(userToUpdate);
+  }
+
+  private void validateRequestParams() {
    if (userData.isEmpty()
        || isNullOrEmpty(userData.get().emailAddress)
        || isNullOrEmpty(userData.get().role)) {
      throw new BadRequestException("User data is missing or incomplete");
    }
-    String email = userData.get().emailAddress;
-    User userToUpdate =
-        tm().loadByKeyIfPresent(VKey.create(User.class, email))
-            .orElseThrow(
-                () -> new BadRequestException(String.format("User %s doesn't exist", email)));
-
-    if (verifyAccess && !userToUpdate.getUserRoles().getRegistrarRoles().containsKey(registrarId)) {
-      setFailedResponse(
-          String.format("Can't update user not associated with registrarId %s", registrarId),
-          SC_FORBIDDEN);
-      return false;
-    }
-    return true;
  }

-  private User updateUserRegistrarRoles(
-      String email, String registrarId, RegistrarRole newRole, boolean isDelete) {
-    User userToUpdate = tm().loadByKeyIfPresent(VKey.create(User.class, email)).get();
+  private User verifyUserExists(String email) {
+    return tm().loadByKeyIfPresent(VKey.create(User.class, email))
+        .orElseThrow(() -> new BadRequestException(String.format("User %s doesn't exist", email)));
+  }
+
+  private boolean validateUserRegistrarAssociation(User user) {
+    if (user.getUserRoles().getRegistrarRoles().containsKey(registrarId)) {
+      return true;
+    }
+    setFailedResponse(
+        String.format("Can't update user not associated with registrarId %s", registrarId),
+        SC_FORBIDDEN);
+    return false;
+  }
+
+  private User updateUserRegistrarRoles(String email, String registrarId, RegistrarRole newRole) {
    Map<String, RegistrarRole> updatedRegistrarRoles;
-    if (isDelete) {
+    User user = verifyUserExists(email);
+    if (newRole == null) {
      updatedRegistrarRoles =
-          userToUpdate.getUserRoles().getRegistrarRoles().entrySet().stream()
+          user.getUserRoles().getRegistrarRoles().entrySet().stream()
              .filter(entry -> !Objects.equals(entry.getKey(), registrarId))
              .collect(ImmutableMap.toImmutableMap(Map.Entry::getKey, Map.Entry::getValue));
    } else {
      updatedRegistrarRoles =
          ImmutableMap.<String, RegistrarRole>builder()
-              .putAll(userToUpdate.getUserRoles().getRegistrarRoles())
+              .putAll(user.getUserRoles().getRegistrarRoles())
              .put(registrarId, newRole)
              .buildKeepingLast();
    }
    var updatedUser =
-        userToUpdate
-            .asBuilder()
+        user.asBuilder()
            .setUserRoles(
-                userToUpdate
-                    .getUserRoles()
-                    .asBuilder()
-                    .setRegistrarRoles(updatedRegistrarRoles)
-                    .build())
+                user.getUserRoles().asBuilder().setRegistrarRoles(updatedRegistrarRoles).build())
            .build();
    tm().put(updatedUser);
    return updatedUser;
--- a/core/src/test/java/google/registry/keyring/secretmanager/SecretManagerKeyringUpdaterTest.java
+++ b/core/src/test/java/google/registry/keyring/secretmanager/SecretManagerKeyringUpdaterTest.java
@@ -102,6 +102,24 @@ public class SecretManagerKeyringUpdaterTest {
    verifyPersistedSecret("bsa-api-key-string", secret);
  }

+  @Test
+  void sqlPrimaryConnectionName() {
+    String name = "name";
+    updater.setSqlPrimaryConnectionName(name).update();
+
+    assertThat(keyring.getSqlPrimaryConnectionName()).isEqualTo(name);
+    verifyPersistedSecret("sql-primary-conn-name", name);
+  }
+
+  @Test
+  void sqlReplicaConnectionName() {
+    String name = "name";
+    updater.setSqlReplicaConnectionName(name).update();
+
+    assertThat(keyring.getSqlReplicaConnectionName()).isEqualTo(name);
+    verifyPersistedSecret("sql-replica-conn-name", name);
+  }
+
  @Test
  void marksdbDnlLoginAndPassword() {
    String secret = "marksdbDnlLoginAndPassword";
--- a/core/src/test/java/google/registry/request/auth/OidcTokenAuthenticationMechanismTest.java
+++ b/core/src/test/java/google/registry/request/auth/OidcTokenAuthenticationMechanismTest.java
@@ -26,12 +26,13 @@ import static org.mockito.Mockito.when;
 import com.google.api.client.googleapis.auth.oauth2.GoogleIdToken.Payload;
 import com.google.api.client.json.webtoken.JsonWebSignature;
 import com.google.api.client.json.webtoken.JsonWebSignature.Header;
+import com.google.auth.oauth2.GoogleCredentials;
 import com.google.auth.oauth2.TokenVerifier.VerificationException;
-import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSet;
 import dagger.Component;
 import dagger.Module;
 import dagger.Provides;
+import google.registry.config.CredentialModule.ApplicationDefaultCredential;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.model.console.GlobalRole;
 import google.registry.model.console.User;
@@ -40,8 +41,8 @@ import google.registry.persistence.transaction.JpaTestExtensions;
 import google.registry.request.auth.AuthSettings.AuthLevel;
 import google.registry.request.auth.OidcTokenAuthenticationMechanism.IapOidcAuthenticationMechanism;
 import google.registry.request.auth.OidcTokenAuthenticationMechanism.RegularOidcAuthenticationMechanism;
+import google.registry.util.GoogleCredentialsBundle;
 import jakarta.servlet.http.HttpServletRequest;
-import java.util.Map;
 import javax.inject.Singleton;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
@@ -228,9 +229,9 @@ public class OidcTokenAuthenticationMechanismTest {

    @Provides
    @Singleton
-    @Config("backendServiceIds")
-    Map<String, Long> provideBackendServiceIds() {
-      return ImmutableMap.of();
+    @ApplicationDefaultCredential
+    GoogleCredentialsBundle provideGoogleCredentialBundle() {
+      return GoogleCredentialsBundle.create(GoogleCredentials.newBuilder().build());
    }
  }
 }
--- a/core/src/test/java/google/registry/testing/FakeKeyringModule.java
+++ b/core/src/test/java/google/registry/testing/FakeKeyringModule.java
@@ -56,6 +56,8 @@ public final class FakeKeyringModule {
  private static final String MARKSDB_LORDN_PASSWORD = "yolo";
  private static final String MARKSDB_SMDRL_LOGIN_AND_PASSWORD = "smdrl:yolo";
  private static final String BSA_API_KEY = "bsaapikey";
+  private static final String SQL_PRIMARY_CONNECTION = "project:primary-region:primary-name";
+  private static final String SQL_REPLICA_CONNECTION = "project:replica-region:replica-name";

  @Provides
  public Keyring get() {
@@ -151,6 +153,16 @@ public final class FakeKeyringModule {
        return rdeReceiverKey;
      }

+      @Override
+      public String getSqlPrimaryConnectionName() {
+        return SQL_PRIMARY_CONNECTION;
+      }
+
+      @Override
+      public String getSqlReplicaConnectionName() {
+        return SQL_REPLICA_CONNECTION;
+      }
+
      @Override
      public void close() {}
    };
--- a/core/src/test/java/google/registry/tools/CurlCommandTest.java
+++ b/core/src/test/java/google/registry/tools/CurlCommandTest.java
@@ -157,19 +157,6 @@ class CurlCommandTest extends CommandTestCase<CurlCommand> {
            eq("".getBytes(UTF_8)));
  }

-  @Test
-  void testCanaryInvocation() throws Exception {
-    runCommand("--path=/foo/bar?a=1&b=2", "--request=POST", "--service=TOOLS", "--canary");
-    verify(connection).withService(eq(TOOLS), eq(true));
-    verifyNoMoreInteractions(connection);
-    verify(connectionForService)
-        .sendPostRequest(
-            eq("/foo/bar?a=1&b=2"),
-            eq(ImmutableMap.<String, String>of()),
-            eq(MediaType.PLAIN_TEXT_UTF_8),
-            eq("".getBytes(UTF_8)));
-  }
-
  @Test
  @MockitoSettings(strictness = Strictness.LENIENT)
  void testGetWithBody() {
--- a/core/src/test/java/google/registry/tools/GcpProjectConnectionTest.java
+++ b/core/src/test/java/google/registry/tools/GcpProjectConnectionTest.java
@@ -85,7 +85,7 @@ final class GcpProjectConnectionTest {
    when(lowLevelHttpResponse.getStatusCode()).thenReturn(200);

    httpTransport = new TestHttpTransport();
-    connection = new ServiceConnection(false, httpTransport.createRequestFactory());
+    connection = new ServiceConnection(false, false, httpTransport.createRequestFactory());
  }

  @Test
--- a/core/src/test/java/google/registry/tools/ServiceConnectionTest.java
+++ b/core/src/test/java/google/registry/tools/ServiceConnectionTest.java
@@ -37,7 +37,8 @@ public class ServiceConnectionTest {

  @Test
  void testSuccess_serverUrl_notCanary() {
-    ServiceConnection connection = new ServiceConnection(false, null).withService(DEFAULT, false);
+    ServiceConnection connection =
+        new ServiceConnection(false, false, null).withService(DEFAULT, false);
    String serverUrl = connection.getServer().toString();
    assertThat(serverUrl).isEqualTo("https://default.example.com"); // See default-config.yaml
  }
@@ -48,14 +49,15 @@ public class ServiceConnectionTest {
        assertThrows(
            IllegalArgumentException.class,
            () -> {
-              new ServiceConnection(true, null).withService(DEFAULT, true);
+              new ServiceConnection(true, false, null).withService(DEFAULT, true);
            });
    assertThat(thrown).hasMessageThat().contains("Cannot switch from GkeService to GaeService");
  }

  @Test
  void testSuccess_serverUrl_gae_canary() {
-    ServiceConnection connection = new ServiceConnection(false, null).withService(DEFAULT, true);
+    ServiceConnection connection =
+        new ServiceConnection(false, false, null).withService(DEFAULT, true);
    String serverUrl = connection.getServer().toString();
    assertThat(serverUrl).isEqualTo("https://nomulus-dot-default.example.com");
  }
@@ -71,7 +73,7 @@ public class ServiceConnectionTest {
    when(request.execute()).thenReturn(response);
    when(response.getContent()).thenReturn(ByteArrayInputStream.nullInputStream());
    ServiceConnection connection =
-        new ServiceConnection(true, factory).withService(GkeService.PUBAPI, true);
+        new ServiceConnection(true, false, factory).withService(GkeService.PUBAPI, true);
    String serverUrl = connection.getServer().toString();
    assertThat(serverUrl).isEqualTo("https://pubapi.registry.test");
    connection.sendGetRequest("/path", ImmutableMap.of());
--- a/core/src/test/java/google/registry/ui/server/console/ConsoleUsersActionTest.java
+++ b/core/src/test/java/google/registry/ui/server/console/ConsoleUsersActionTest.java
@@ -159,6 +159,24 @@ class ConsoleUsersActionTest {
    assertThat(response.getStatus()).isEqualTo(HttpServletResponse.SC_FORBIDDEN);
  }

+  @Test
+  void testFailure_invalidPrefix() throws IOException {
+    User user = DatabaseHelper.createAdminUser("email@email.com");
+    AuthResult authResult = AuthResult.createUser(user);
+    ConsoleUsersAction action =
+        createAction(
+            Optional.of(ConsoleApiParamsUtils.createFake(authResult)),
+            Optional.of("POST"),
+            Optional.of(new UserData("a@d", RegistrarRole.ACCOUNT_MANAGER.toString(), null)));
+    action.cloudTasksUtils = cloudTasksHelper.getTestCloudTasksUtils();
+    when(directory.users()).thenReturn(users);
+    when(users.insert(any(com.google.api.services.directory.model.User.class))).thenReturn(insert);
+    action.run();
+    var response = ((FakeResponse) consoleApiParams.response());
+    assertThat(response.getStatus()).isEqualTo(SC_BAD_REQUEST);
+    assertThat(response.getPayload()).contains("Email prefix is invalid");
+  }
+
  @Test
  void testSuccess_createsUser() throws IOException {
    User user = DatabaseHelper.createAdminUser("email@email.com");
@@ -167,7 +185,7 @@ class ConsoleUsersActionTest {
        createAction(
            Optional.of(ConsoleApiParamsUtils.createFake(authResult)),
            Optional.of("POST"),
-            Optional.empty());
+            Optional.of(new UserData("lol", RegistrarRole.ACCOUNT_MANAGER.toString(), null)));
    action.cloudTasksUtils = cloudTasksHelper.getTestCloudTasksUtils();
    when(directory.users()).thenReturn(users);
    when(users.insert(any(com.google.api.services.directory.model.User.class))).thenReturn(insert);
@@ -176,7 +194,7 @@ class ConsoleUsersActionTest {
    assertThat(response.getStatus()).isEqualTo(SC_CREATED);
    assertThat(response.getPayload())
        .contains(
-            "{\"emailAddress\":\"TheRegistrar-user1@email.com\",\"role\":\"ACCOUNT_MANAGER\",\"password\":\"abcdefghijklmnop\"}");
+            "{\"emailAddress\":\"lol.TheRegistrar@email.com\",\"role\":\"ACCOUNT_MANAGER\",\"password\":\"abcdefghijklmnop\"}");
  }

  @Test
@@ -319,7 +337,8 @@ class ConsoleUsersActionTest {
        createAction(
            Optional.of(ConsoleApiParamsUtils.createFake(authResult)),
            Optional.of("POST"),
-            Optional.empty());
+            Optional.of(
+                new UserData("test3@test.com", RegistrarRole.ACCOUNT_MANAGER.toString(), null)));
    action.cloudTasksUtils = cloudTasksHelper.getTestCloudTasksUtils();
    when(directory.users()).thenReturn(users);
    when(users.insert(any(com.google.api.services.directory.model.User.class))).thenReturn(insert);
--- a/dependencies.gradle
+++ b/dependencies.gradle
@@ -104,6 +104,7 @@ ext {
      'com.google.cloud.bigdataoss:util:[2.2.6,)',
      'com.google.cloud.sql:jdbc-socket-factory-core:[1.2.1,)',
      'com.google.cloud.sql:postgres-socket-factory:[1.2.1,)',
+      'com.google.cloud:google-cloud-compute:[1.64.0,)',
      'com.google.cloud:google-cloud-core-http:[1.94.3,)',
      'com.google.cloud:google-cloud-core:[1.94.3,)',
      'com.google.cloud:google-cloud-nio:[0.123.4,)',
--- a/jetty/build.gradle
+++ b/jetty/build.gradle
@@ -82,8 +82,36 @@ tasks.register('run', JavaExec) {
    dependsOn(tasks.named('stage'))
 }

+tasks.register('buildDeployer', Exec) {
+    workingDir("${rootDir}/release/builder/")
+    commandLine 'go', 'build', '-o', "${buildDir}/deployer", 'deployCloudSchedulerAndQueue.go'
+}
+
+// Once GKE is the only option, we can use the same task in the root project instaead.
+tasks.register('deployCloudSchedulerAndQueue') {
+    dependsOn(tasks.named('deployCloudScheduler'), tasks.named('deployQueue'))
+}
+
+tasks.register('deployCloudScheduler', Exec) {
+    dependsOn(tasks.named('buildDeployer'))
+    workingDir("$buildDir")
+    commandLine './deployer',
+        "${rootDir}/core/src/main/java/google/registry/config/files/nomulus-config-${rootProject.environment}.yaml",
+        "${rootDir}/core/src/main/java/google/registry/env/${rootProject.environment}/default/WEB-INF/cloud-scheduler-tasks.xml",
+        rootProject.gcpProject, '--gke'
+}
+
+tasks.register('deployQueue', Exec) {
+    dependsOn(tasks.named('buildDeployer'))
+    workingDir("$buildDir")
+    commandLine './deployer',
+        "${rootDir}/core/src/main/java/google/registry/config/files/nomulus-config-${rootProject.environment}.yaml",
+        "${rootDir}/core/src/main/java/google/registry/env/common/default/WEB-INF/cloud-tasks-queue.xml",
+        rootProject.gcpProject, '--gke'
+}
+
 tasks.register('deployNomulus', Exec) {
-    dependsOn('pushNomulusImage', ':proxy:pushProxyImage')
+    dependsOn('pushNomulusImage', 'deployCloudSchedulerAndQueue')
    configure verifyDeploymentConfig
    commandLine './deploy-nomulus-for-env.sh', "${rootProject.environment}", "${rootProject.baseDomain}"
 }
--- a/jetty/deploy-nomulus-for-env.sh
+++ b/jetty/deploy-nomulus-for-env.sh
@@ -49,12 +49,19 @@ do
  if [[ "${parts[1]}" == us-* ]]
  then
    kubectl apply -f "./kubernetes/gateway/nomulus-gateway.yaml"
-    for service in frontend backend pubapi console
+    for service in frontend backend console pubapi
    do
      sed s/BASE_DOMAIN/"${base_domain}"/g "./kubernetes/gateway/nomulus-route-${service}.yaml" | \
      kubectl apply -f -
+      # Don't enable IAP on pubapi.
+      if [[ "${service}" == pubapi ]]
+      then
+        continue
+      fi
      sed s/SERVICE/"${service}"/g "./kubernetes/gateway/nomulus-iap-${environment}.yaml" | \
      kubectl apply -f -
+      sed s/SERVICE/"${service}-canary"/g "./kubernetes/gateway/nomulus-iap-${environment}.yaml" | \
+      kubectl apply -f -
    done
  fi
 done < <(gcloud container clusters list --project "${project}" | grep nomulus)
--- a/jetty/gradle.lockfile
+++ b/jetty/gradle.lockfile
@@ -30,8 +30,8 @@ com.github.kevinstern:software-and-algorithms:1.0=annotationProcessor,errorprone
 com.google.android:annotations:4.1.1.4=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client-jackson2:2.0.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client-java6:2.1.4=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.api-client:google-api-client-servlet:2.7.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.api-client:google-api-client:2.7.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.api-client:google-api-client-servlet:2.7.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.api-client:google-api-client:2.7.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.api.grpc:gapic-google-cloud-storage-v2:2.32.1-alpha=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:3.9.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.181.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
@@ -50,6 +50,7 @@ com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.181.0=deploy_ja
 com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.181.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:2.43.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-bigtable-v2:2.43.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-compute-v1:1.64.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.112.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-firestore-v1:3.25.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-monitoring-v3:3.49.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
@@ -84,7 +85,7 @@ com.google.apis:google-api-services-iam:v2-rev20240530-2.0.0=deploy_jar,runtimeC
 com.google.apis:google-api-services-iamcredentials:v1-rev20211203-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-monitoring:v3-rev20241017-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-pubsub:v1-rev20220904-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-sheets:v4-rev20241008-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-sheets:v4-rev20241203-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20240925-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-storage:v1-rev20240706-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.auth:google-auth-library-credentials:1.30.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
@@ -104,6 +105,7 @@ com.google.cloud.sql:jdbc-socket-factory-core:1.21.0=deploy_jar,runtimeClasspath
 com.google.cloud.sql:postgres-socket-factory:1.21.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigquerystorage:3.9.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigtable:2.43.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-compute:1.64.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-core-grpc:2.42.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-core-http:2.31.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-core:2.42.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
@@ -123,7 +125,7 @@ com.google.common.html.types:types:1.0.8=deploy_jar,runtimeClasspath,testRuntime
 com.google.dagger:dagger:2.51.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.errorprone:error_prone_annotation:2.23.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.errorprone:error_prone_annotations:2.23.0=annotationProcessor,errorprone,testAnnotationProcessor
-com.google.errorprone:error_prone_annotations:2.35.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.errorprone:error_prone_annotations:2.36.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.errorprone:error_prone_annotations:2.7.1=checkstyle
 com.google.errorprone:error_prone_check_api:2.23.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.errorprone:error_prone_core:2.23.0=annotationProcessor,errorprone,testAnnotationProcessor
@@ -142,12 +144,12 @@ com.google.guava:guava:32.1.1-jre=annotationProcessor,errorprone,testAnnotationP
 com.google.guava:guava:33.3.1-jre=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=checkstyle,deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.gwt:gwt-user:2.10.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-apache-v2:1.45.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-apache-v2:1.45.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-appengine:1.43.3=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-gson:1.45.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-gson:1.45.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-jackson2:1.43.3=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-protobuf:1.44.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client:1.45.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client:1.45.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.inject:guice:5.1.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.inject:guice:7.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.j2objc:j2objc-annotations:1.3=checkstyle
@@ -205,10 +207,10 @@ io.github.eisop:dataflow-errorprone:3.34.0-eisop1=annotationProcessor,errorprone
 io.github.java-diff-utils:java-diff-utils:4.12=annotationProcessor,errorprone,testAnnotationProcessor
 io.github.java-diff-utils:java-diff-utils:4.15=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-alts:1.68.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-api:1.68.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-api:1.68.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-auth:1.68.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-census:1.66.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-context:1.68.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-context:1.68.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-core:1.68.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-googleapis:1.68.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-grpclb:1.68.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
@@ -359,7 +361,7 @@ org.jetbrains.kotlinx:kotlinx-datetime:0.4.0=deploy_jar,runtimeClasspath,testRun
 org.jetbrains.kotlinx:kotlinx-serialization-core-jvm:1.0.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.jetbrains.kotlinx:kotlinx-serialization-core:1.0.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.jetbrains:annotations:17.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
-org.jline:jline:3.27.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+org.jline:jline:3.28.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.joda:joda-money:2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.json:json:20240303=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.jsoup:jsoup:1.18.3=deploy_jar,runtimeClasspath,testRuntimeClasspath
--- a/jetty/kubernetes/nomulus-frontend.yaml
+++ b/jetty/kubernetes/nomulus-frontend.yaml
@@ -45,6 +45,14 @@ spec:
        - name: CONTAINER_NAME
          value: proxy
 ---
+# Only need to define the service account once per cluster.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: nomulus
+  annotations:
+    iam.gke.io/gcp-service-account: "nomulus-service-account@GCP_PROJECT.iam.gserviceaccount.com"
+---
 apiVersion: autoscaling/v2
 kind: HorizontalPodAutoscaler
 metadata:
--- a/networking/gradle.lockfile
+++ b/networking/gradle.lockfile
@@ -10,7 +10,7 @@ com.github.docker-java:docker-java-transport-zerodep:3.4.0=testCompileClasspath,
 com.github.docker-java:docker-java-transport:3.4.0=testCompileClasspath,testRuntimeClasspath
 com.github.kevinstern:software-and-algorithms:1.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.android:annotations:4.1.1.4=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.api-client:google-api-client:2.7.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.api-client:google-api-client:2.7.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2:2.54.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2beta2:0.144.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2beta3:0.144.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
@@ -37,7 +37,7 @@ com.google.devtools.ksp:symbol-processing-api:1.9.20-1.0.14=annotationProcessor,
 com.google.errorprone:error_prone_annotation:2.23.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.errorprone:error_prone_annotations:2.23.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.errorprone:error_prone_annotations:2.28.0=compileClasspath,testCompileClasspath
-com.google.errorprone:error_prone_annotations:2.35.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.errorprone:error_prone_annotations:2.36.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.errorprone:error_prone_annotations:2.7.1=checkstyle
 com.google.errorprone:error_prone_check_api:2.23.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.errorprone:error_prone_core:2.23.0=annotationProcessor,errorprone,testAnnotationProcessor
@@ -56,9 +56,9 @@ com.google.guava:guava:33.0.0-jre=annotationProcessor,testAnnotationProcessor
 com.google.guava:guava:33.2.1-android=testCompileClasspath
 com.google.guava:guava:33.3.1-jre=compileClasspath,deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,compileClasspath,deploy_jar,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-apache-v2:1.45.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-gson:1.45.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client:1.45.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-apache-v2:1.45.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-gson:1.45.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client:1.45.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.inject:guice:5.1.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.j2objc:j2objc-annotations:1.3=checkstyle
 com.google.j2objc:j2objc-annotations:3.0.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -81,9 +81,9 @@ io.github.eisop:dataflow-errorprone:3.34.0-eisop1=annotationProcessor,errorprone
 io.github.java-diff-utils:java-diff-utils:4.12=annotationProcessor,errorprone,testAnnotationProcessor
 io.github.java-diff-utils:java-diff-utils:4.15=deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-alts:1.68.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-api:1.68.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-api:1.68.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-auth:1.68.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-context:1.68.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-context:1.68.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-core:1.68.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-googleapis:1.68.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-grpclb:1.68.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
--- a/prober/gradle.lockfile
+++ b/prober/gradle.lockfile
@@ -10,7 +10,7 @@ com.github.docker-java:docker-java-transport-zerodep:3.4.0=testCompileClasspath,
 com.github.docker-java:docker-java-transport:3.4.0=testCompileClasspath,testRuntimeClasspath
 com.github.kevinstern:software-and-algorithms:1.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.android:annotations:4.1.1.4=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.api-client:google-api-client:2.7.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.api-client:google-api-client:2.7.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2:2.54.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2beta2:0.144.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2beta3:0.144.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
@@ -37,7 +37,7 @@ com.google.devtools.ksp:symbol-processing-api:1.9.20-1.0.14=annotationProcessor,
 com.google.errorprone:error_prone_annotation:2.23.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.errorprone:error_prone_annotations:2.23.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.errorprone:error_prone_annotations:2.28.0=compileClasspath,testCompileClasspath
-com.google.errorprone:error_prone_annotations:2.35.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.errorprone:error_prone_annotations:2.36.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.errorprone:error_prone_annotations:2.7.1=checkstyle
 com.google.errorprone:error_prone_check_api:2.23.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.errorprone:error_prone_core:2.23.0=annotationProcessor,errorprone,testAnnotationProcessor
@@ -56,9 +56,9 @@ com.google.guava:guava:33.0.0-jre=annotationProcessor,testAnnotationProcessor
 com.google.guava:guava:33.2.1-android=testCompileClasspath
 com.google.guava:guava:33.3.1-jre=compileClasspath,deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,compileClasspath,deploy_jar,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-apache-v2:1.45.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-gson:1.45.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client:1.45.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-apache-v2:1.45.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-gson:1.45.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client:1.45.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.inject:guice:5.1.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.j2objc:j2objc-annotations:1.3=checkstyle
 com.google.j2objc:j2objc-annotations:3.0.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -84,9 +84,9 @@ io.github.eisop:dataflow-errorprone:3.34.0-eisop1=annotationProcessor,errorprone
 io.github.java-diff-utils:java-diff-utils:4.12=annotationProcessor,errorprone,testAnnotationProcessor
 io.github.java-diff-utils:java-diff-utils:4.15=deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-alts:1.68.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-api:1.68.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-api:1.68.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-auth:1.68.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
-io.grpc:grpc-context:1.68.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+io.grpc:grpc-context:1.68.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-core:1.68.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-googleapis:1.68.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-grpclb:1.68.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
--- a/proxy/deploy-proxy-for-env.sh
+++ b/proxy/deploy-proxy-for-env.sh
@@ -32,13 +32,13 @@ do
  gcloud container clusters get-credentials "${parts[0]}" \
    --project "${project}" --zone "${parts[1]}"
  sed s/GCP_PROJECT/${project}/g "./kubernetes/proxy-deployment-${environment}.yaml" | \
-  kubectl replace -f -
-  kubectl replace -f "./kubernetes/proxy-service.yaml" --force
+  kubectl apply -f -
+  kubectl apply -f "./kubernetes/proxy-service.yaml" --force
  # Alpha does not have canary
  if [[ ${environment} != "alpha" ]]; then
    sed s/GCP_PROJECT/${project}/g "./kubernetes/proxy-deployment-${environment}-canary.yaml" | \
-    kubectl replace -f -
-    kubectl replace -f "./kubernetes/proxy-service-canary.yaml" --force
+    kubectl apply -f -
+    kubectl apply -f "./kubernetes/proxy-service-canary.yaml" --force
  fi
  # Kills all running pods, new pods created will be pulling the new image.
  kubectl delete pods --all
--- a/proxy/src/main/java/google/registry/proxy/ProxyConfig.java
+++ b/proxy/src/main/java/google/registry/proxy/ProxyConfig.java
@@ -41,7 +41,6 @@ public class ProxyConfig {

  public String projectId;
  public String oauthClientId;
-  public boolean canary;
  public List<String> gcpScopes;
  public int serverCertificateCacheSeconds;
  public Gcs gcs;
--- a/proxy/src/main/java/google/registry/proxy/ProxyModule.java
+++ b/proxy/src/main/java/google/registry/proxy/ProxyModule.java
@@ -281,8 +281,8 @@ public class ProxyModule {
  @Singleton
  @Provides
  @Named("canary")
-  static boolean provideIsCanary(ProxyConfig config) {
-    return config.canary;
+  boolean provideIsCanary(Environment env) {
+    return env.name().endsWith("_CANARY");
  }

  @Singleton
--- a/proxy/src/main/java/google/registry/proxy/config/default-config.yaml
+++ b/proxy/src/main/java/google/registry/proxy/config/default-config.yaml
@@ -8,9 +8,6 @@
 # GCP project ID
 projectId: your-gcp-project-id

-# Whether to connect to the canary (instead of regular) service.
-canary: false
-
 # OAuth client ID set as the audience of the OIDC token. This value must be the
 # same as the auth.oauthClientId value in Nomulus config file, which usually is
 # the IAP client ID, to allow the request to access IAP protected endpoints.
--- a/services/backend/gradle.lockfile
+++ b/services/backend/gradle.lockfile
@@ -28,8 +28,8 @@ com.github.jnr:jnr-x86asm:1.0.2=compileClasspath,runtimeClasspath,testCompileCla
 com.google.android:annotations:4.1.1.4=runtimeClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client-jackson2:2.0.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client-java6:2.1.4=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api-client:google-api-client-servlet:2.7.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api-client:google-api-client:2.7.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api-client:google-api-client-servlet:2.7.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api-client:google-api-client:2.7.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:gapic-google-cloud-storage-v2:2.32.1-alpha=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:3.9.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.181.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -48,6 +48,7 @@ com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.181.0=compileCl
 com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.181.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:2.43.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-bigtable-v2:2.43.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-compute-v1:1.64.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.112.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-firestore-v1:3.25.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-monitoring-v3:3.49.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -82,7 +83,7 @@ com.google.apis:google-api-services-iam:v2-rev20240530-2.0.0=compileClasspath,ru
 com.google.apis:google-api-services-iamcredentials:v1-rev20211203-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-monitoring:v3-rev20241017-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-pubsub:v1-rev20220904-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-sheets:v4-rev20241008-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-sheets:v4-rev20241203-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20240925-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-storage:v1-rev20240706-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.auth:google-auth-library-credentials:1.30.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -99,6 +100,7 @@ com.google.cloud.sql:jdbc-socket-factory-core:1.21.0=compileClasspath,runtimeCla
 com.google.cloud.sql:postgres-socket-factory:1.21.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigquerystorage:3.9.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigtable:2.43.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-compute:1.64.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-core-grpc:2.42.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-core-http:2.31.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-core:2.42.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -116,7 +118,7 @@ com.google.code.findbugs:jsr305:3.0.2=compileClasspath,runtimeClasspath,testComp
 com.google.code.gson:gson:2.11.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.common.html.types:types:1.0.8=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.dagger:dagger:2.51.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.errorprone:error_prone_annotations:2.35.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.errorprone:error_prone_annotations:2.36.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.escapevelocity:escapevelocity:1.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.flatbuffers:flatbuffers-java:23.5.26=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.flogger:flogger-system-backend:0.8=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -126,12 +128,12 @@ com.google.guava:failureaccess:1.0.2=compileClasspath,runtimeClasspath,testCompi
 com.google.guava:guava:33.3.1-jre=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.gwt:gwt-user:2.10.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-apache-v2:1.45.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-apache-v2:1.45.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-appengine:1.43.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-gson:1.45.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-gson:1.45.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-jackson2:1.43.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-protobuf:1.44.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client:1.45.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client:1.45.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.inject:guice:7.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.j2objc:j2objc-annotations:3.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.jsinterop:jsinterop-annotations:2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -180,10 +182,11 @@ io.apicurio:apicurio-registry-protobuf-schema-utilities:3.0.0.M2=compileClasspat
 io.github.classgraph:classgraph:4.8.162=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.github.java-diff-utils:java-diff-utils:4.15=runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-alts:1.68.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-api:1.68.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-api:1.68.1=compileClasspath,testCompileClasspath
+io.grpc:grpc-api:1.68.2=runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-auth:1.68.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-census:1.66.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-context:1.68.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-context:1.68.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-core:1.68.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-googleapis:1.68.1=runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-grpclb:1.68.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -329,7 +332,7 @@ org.jetbrains.kotlinx:kotlinx-datetime:0.4.0=compileClasspath,runtimeClasspath,t
 org.jetbrains.kotlinx:kotlinx-serialization-core-jvm:1.0.1=runtimeClasspath,testRuntimeClasspath
 org.jetbrains.kotlinx:kotlinx-serialization-core:1.0.1=runtimeClasspath,testRuntimeClasspath
 org.jetbrains:annotations:17.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.jline:jline:3.27.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.jline:jline:3.28.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.joda:joda-money:2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.json:json:20240303=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.jsoup:jsoup:1.18.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
--- a/services/bsa/gradle.lockfile
+++ b/services/bsa/gradle.lockfile
@@ -28,8 +28,8 @@ com.github.jnr:jnr-x86asm:1.0.2=compileClasspath,runtimeClasspath,testCompileCla
 com.google.android:annotations:4.1.1.4=runtimeClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client-jackson2:2.0.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client-java6:2.1.4=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api-client:google-api-client-servlet:2.7.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api-client:google-api-client:2.7.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api-client:google-api-client-servlet:2.7.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api-client:google-api-client:2.7.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:gapic-google-cloud-storage-v2:2.32.1-alpha=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:3.9.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.181.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -48,6 +48,7 @@ com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.181.0=compileCl
 com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.181.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:2.43.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-bigtable-v2:2.43.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-compute-v1:1.64.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.112.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-firestore-v1:3.25.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-monitoring-v3:3.49.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -82,7 +83,7 @@ com.google.apis:google-api-services-iam:v2-rev20240530-2.0.0=compileClasspath,ru
 com.google.apis:google-api-services-iamcredentials:v1-rev20211203-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-monitoring:v3-rev20241017-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-pubsub:v1-rev20220904-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-sheets:v4-rev20241008-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-sheets:v4-rev20241203-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20240925-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-storage:v1-rev20240706-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.auth:google-auth-library-credentials:1.30.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -99,6 +100,7 @@ com.google.cloud.sql:jdbc-socket-factory-core:1.21.0=compileClasspath,runtimeCla
 com.google.cloud.sql:postgres-socket-factory:1.21.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigquerystorage:3.9.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigtable:2.43.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-compute:1.64.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-core-grpc:2.42.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-core-http:2.31.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-core:2.42.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -116,7 +118,7 @@ com.google.code.findbugs:jsr305:3.0.2=compileClasspath,runtimeClasspath,testComp
 com.google.code.gson:gson:2.11.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.common.html.types:types:1.0.8=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.dagger:dagger:2.51.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.errorprone:error_prone_annotations:2.35.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.errorprone:error_prone_annotations:2.36.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.escapevelocity:escapevelocity:1.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.flatbuffers:flatbuffers-java:23.5.26=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.flogger:flogger-system-backend:0.8=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -126,12 +128,12 @@ com.google.guava:failureaccess:1.0.2=compileClasspath,runtimeClasspath,testCompi
 com.google.guava:guava:33.3.1-jre=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.gwt:gwt-user:2.10.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-apache-v2:1.45.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-apache-v2:1.45.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-appengine:1.43.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-gson:1.45.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-gson:1.45.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-jackson2:1.43.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-protobuf:1.44.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client:1.45.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client:1.45.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.inject:guice:7.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.j2objc:j2objc-annotations:3.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.jsinterop:jsinterop-annotations:2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -180,10 +182,11 @@ io.apicurio:apicurio-registry-protobuf-schema-utilities:3.0.0.M2=compileClasspat
 io.github.classgraph:classgraph:4.8.162=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.github.java-diff-utils:java-diff-utils:4.15=runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-alts:1.68.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-api:1.68.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-api:1.68.1=compileClasspath,testCompileClasspath
+io.grpc:grpc-api:1.68.2=runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-auth:1.68.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-census:1.66.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-context:1.68.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-context:1.68.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-core:1.68.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-googleapis:1.68.1=runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-grpclb:1.68.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -329,7 +332,7 @@ org.jetbrains.kotlinx:kotlinx-datetime:0.4.0=compileClasspath,runtimeClasspath,t
 org.jetbrains.kotlinx:kotlinx-serialization-core-jvm:1.0.1=runtimeClasspath,testRuntimeClasspath
 org.jetbrains.kotlinx:kotlinx-serialization-core:1.0.1=runtimeClasspath,testRuntimeClasspath
 org.jetbrains:annotations:17.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.jline:jline:3.27.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.jline:jline:3.28.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.joda:joda-money:2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.json:json:20240303=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.jsoup:jsoup:1.18.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
--- a/services/default/gradle.lockfile
+++ b/services/default/gradle.lockfile
@@ -28,8 +28,8 @@ com.github.jnr:jnr-x86asm:1.0.2=compileClasspath,runtimeClasspath,testCompileCla
 com.google.android:annotations:4.1.1.4=runtimeClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client-jackson2:2.0.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client-java6:2.1.4=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api-client:google-api-client-servlet:2.7.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api-client:google-api-client:2.7.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api-client:google-api-client-servlet:2.7.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api-client:google-api-client:2.7.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:gapic-google-cloud-storage-v2:2.32.1-alpha=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:3.9.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.181.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -48,6 +48,7 @@ com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.181.0=compileCl
 com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.181.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:2.43.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-bigtable-v2:2.43.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-compute-v1:1.64.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.112.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-firestore-v1:3.25.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-monitoring-v3:3.49.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -82,7 +83,7 @@ com.google.apis:google-api-services-iam:v2-rev20240530-2.0.0=compileClasspath,ru
 com.google.apis:google-api-services-iamcredentials:v1-rev20211203-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-monitoring:v3-rev20241017-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-pubsub:v1-rev20220904-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-sheets:v4-rev20241008-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-sheets:v4-rev20241203-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20240925-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-storage:v1-rev20240706-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.auth:google-auth-library-credentials:1.30.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -99,6 +100,7 @@ com.google.cloud.sql:jdbc-socket-factory-core:1.21.0=compileClasspath,runtimeCla
 com.google.cloud.sql:postgres-socket-factory:1.21.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigquerystorage:3.9.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigtable:2.43.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-compute:1.64.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-core-grpc:2.42.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-core-http:2.31.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-core:2.42.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -116,7 +118,7 @@ com.google.code.findbugs:jsr305:3.0.2=compileClasspath,runtimeClasspath,testComp
 com.google.code.gson:gson:2.11.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.common.html.types:types:1.0.8=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.dagger:dagger:2.51.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.errorprone:error_prone_annotations:2.35.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.errorprone:error_prone_annotations:2.36.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.escapevelocity:escapevelocity:1.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.flatbuffers:flatbuffers-java:23.5.26=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.flogger:flogger-system-backend:0.8=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -126,12 +128,12 @@ com.google.guava:failureaccess:1.0.2=compileClasspath,runtimeClasspath,testCompi
 com.google.guava:guava:33.3.1-jre=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.gwt:gwt-user:2.10.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-apache-v2:1.45.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-apache-v2:1.45.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-appengine:1.43.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-gson:1.45.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-gson:1.45.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-jackson2:1.43.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-protobuf:1.44.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client:1.45.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client:1.45.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.inject:guice:7.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.j2objc:j2objc-annotations:3.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.jsinterop:jsinterop-annotations:2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -180,10 +182,11 @@ io.apicurio:apicurio-registry-protobuf-schema-utilities:3.0.0.M2=compileClasspat
 io.github.classgraph:classgraph:4.8.162=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.github.java-diff-utils:java-diff-utils:4.15=runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-alts:1.68.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-api:1.68.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-api:1.68.1=compileClasspath,testCompileClasspath
+io.grpc:grpc-api:1.68.2=runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-auth:1.68.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-census:1.66.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-context:1.68.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-context:1.68.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-core:1.68.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-googleapis:1.68.1=runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-grpclb:1.68.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -329,7 +332,7 @@ org.jetbrains.kotlinx:kotlinx-datetime:0.4.0=compileClasspath,runtimeClasspath,t
 org.jetbrains.kotlinx:kotlinx-serialization-core-jvm:1.0.1=runtimeClasspath,testRuntimeClasspath
 org.jetbrains.kotlinx:kotlinx-serialization-core:1.0.1=runtimeClasspath,testRuntimeClasspath
 org.jetbrains:annotations:17.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.jline:jline:3.27.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.jline:jline:3.28.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.joda:joda-money:2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.json:json:20240303=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.jsoup:jsoup:1.18.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
--- a/services/pubapi/gradle.lockfile
+++ b/services/pubapi/gradle.lockfile
@@ -28,8 +28,8 @@ com.github.jnr:jnr-x86asm:1.0.2=compileClasspath,runtimeClasspath,testCompileCla
 com.google.android:annotations:4.1.1.4=runtimeClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client-jackson2:2.0.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client-java6:2.1.4=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api-client:google-api-client-servlet:2.7.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api-client:google-api-client:2.7.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api-client:google-api-client-servlet:2.7.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api-client:google-api-client:2.7.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:gapic-google-cloud-storage-v2:2.32.1-alpha=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:3.9.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.181.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -48,6 +48,7 @@ com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.181.0=compileCl
 com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.181.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:2.43.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-bigtable-v2:2.43.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-compute-v1:1.64.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.112.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-firestore-v1:3.25.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-monitoring-v3:3.49.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -82,7 +83,7 @@ com.google.apis:google-api-services-iam:v2-rev20240530-2.0.0=compileClasspath,ru
 com.google.apis:google-api-services-iamcredentials:v1-rev20211203-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-monitoring:v3-rev20241017-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-pubsub:v1-rev20220904-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-sheets:v4-rev20241008-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-sheets:v4-rev20241203-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20240925-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-storage:v1-rev20240706-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.auth:google-auth-library-credentials:1.30.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -99,6 +100,7 @@ com.google.cloud.sql:jdbc-socket-factory-core:1.21.0=compileClasspath,runtimeCla
 com.google.cloud.sql:postgres-socket-factory:1.21.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigquerystorage:3.9.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigtable:2.43.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-compute:1.64.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-core-grpc:2.42.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-core-http:2.31.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-core:2.42.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -116,7 +118,7 @@ com.google.code.findbugs:jsr305:3.0.2=compileClasspath,runtimeClasspath,testComp
 com.google.code.gson:gson:2.11.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.common.html.types:types:1.0.8=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.dagger:dagger:2.51.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.errorprone:error_prone_annotations:2.35.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.errorprone:error_prone_annotations:2.36.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.escapevelocity:escapevelocity:1.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.flatbuffers:flatbuffers-java:23.5.26=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.flogger:flogger-system-backend:0.8=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -126,12 +128,12 @@ com.google.guava:failureaccess:1.0.2=compileClasspath,runtimeClasspath,testCompi
 com.google.guava:guava:33.3.1-jre=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.gwt:gwt-user:2.10.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-apache-v2:1.45.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-apache-v2:1.45.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-appengine:1.43.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-gson:1.45.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-gson:1.45.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-jackson2:1.43.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-protobuf:1.44.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client:1.45.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client:1.45.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.inject:guice:7.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.j2objc:j2objc-annotations:3.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.jsinterop:jsinterop-annotations:2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -180,10 +182,11 @@ io.apicurio:apicurio-registry-protobuf-schema-utilities:3.0.0.M2=compileClasspat
 io.github.classgraph:classgraph:4.8.162=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.github.java-diff-utils:java-diff-utils:4.15=runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-alts:1.68.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-api:1.68.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-api:1.68.1=compileClasspath,testCompileClasspath
+io.grpc:grpc-api:1.68.2=runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-auth:1.68.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-census:1.66.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-context:1.68.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-context:1.68.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-core:1.68.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-googleapis:1.68.1=runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-grpclb:1.68.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -329,7 +332,7 @@ org.jetbrains.kotlinx:kotlinx-datetime:0.4.0=compileClasspath,runtimeClasspath,t
 org.jetbrains.kotlinx:kotlinx-serialization-core-jvm:1.0.1=runtimeClasspath,testRuntimeClasspath
 org.jetbrains.kotlinx:kotlinx-serialization-core:1.0.1=runtimeClasspath,testRuntimeClasspath
 org.jetbrains:annotations:17.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.jline:jline:3.27.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.jline:jline:3.28.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.joda:joda-money:2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.json:json:20240303=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.jsoup:jsoup:1.18.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
--- a/services/tools/gradle.lockfile
+++ b/services/tools/gradle.lockfile
@@ -28,8 +28,8 @@ com.github.jnr:jnr-x86asm:1.0.2=compileClasspath,runtimeClasspath,testCompileCla
 com.google.android:annotations:4.1.1.4=runtimeClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client-jackson2:2.0.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api-client:google-api-client-java6:2.1.4=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api-client:google-api-client-servlet:2.7.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.api-client:google-api-client:2.7.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api-client:google-api-client-servlet:2.7.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api-client:google-api-client:2.7.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:gapic-google-cloud-storage-v2:2.32.1-alpha=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1:3.9.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.181.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -48,6 +48,7 @@ com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.181.0=compileCl
 com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta2:0.181.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:2.43.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-bigtable-v2:2.43.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api.grpc:proto-google-cloud-compute-v1:1.64.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-datastore-v1:0.112.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-firestore-v1:3.25.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-monitoring-v3:3.49.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -82,7 +83,7 @@ com.google.apis:google-api-services-iam:v2-rev20240530-2.0.0=compileClasspath,ru
 com.google.apis:google-api-services-iamcredentials:v1-rev20211203-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-monitoring:v3-rev20241017-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-pubsub:v1-rev20220904-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-sheets:v4-rev20241008-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-sheets:v4-rev20241203-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-sqladmin:v1beta4-rev20240925-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-storage:v1-rev20240706-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.auth:google-auth-library-credentials:1.30.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -99,6 +100,7 @@ com.google.cloud.sql:jdbc-socket-factory-core:1.21.0=compileClasspath,runtimeCla
 com.google.cloud.sql:postgres-socket-factory:1.21.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigquerystorage:3.9.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigtable:2.43.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud:google-cloud-compute:1.64.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-core-grpc:2.42.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-core-http:2.31.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-core:2.42.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -116,7 +118,7 @@ com.google.code.findbugs:jsr305:3.0.2=compileClasspath,runtimeClasspath,testComp
 com.google.code.gson:gson:2.11.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.common.html.types:types:1.0.8=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.dagger:dagger:2.51.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.errorprone:error_prone_annotations:2.35.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.errorprone:error_prone_annotations:2.36.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.escapevelocity:escapevelocity:1.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.flatbuffers:flatbuffers-java:23.5.26=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.flogger:flogger-system-backend:0.8=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -126,12 +128,12 @@ com.google.guava:failureaccess:1.0.2=compileClasspath,runtimeClasspath,testCompi
 com.google.guava:guava:33.3.1-jre=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.gwt:gwt-user:2.10.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-apache-v2:1.45.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-apache-v2:1.45.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-appengine:1.43.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-gson:1.45.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-gson:1.45.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-jackson2:1.43.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.http-client:google-http-client-protobuf:1.44.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client:1.45.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client:1.45.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.inject:guice:7.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.j2objc:j2objc-annotations:3.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.jsinterop:jsinterop-annotations:2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -180,10 +182,11 @@ io.apicurio:apicurio-registry-protobuf-schema-utilities:3.0.0.M2=compileClasspat
 io.github.classgraph:classgraph:4.8.162=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.github.java-diff-utils:java-diff-utils:4.15=runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-alts:1.68.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-api:1.68.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-api:1.68.1=compileClasspath,testCompileClasspath
+io.grpc:grpc-api:1.68.2=runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-auth:1.68.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-census:1.66.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-context:1.68.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-context:1.68.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-core:1.68.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-googleapis:1.68.1=runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-grpclb:1.68.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -329,7 +332,7 @@ org.jetbrains.kotlinx:kotlinx-datetime:0.4.0=compileClasspath,runtimeClasspath,t
 org.jetbrains.kotlinx:kotlinx-serialization-core-jvm:1.0.1=runtimeClasspath,testRuntimeClasspath
 org.jetbrains.kotlinx:kotlinx-serialization-core:1.0.1=runtimeClasspath,testRuntimeClasspath
 org.jetbrains:annotations:17.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.jline:jline:3.27.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.jline:jline:3.28.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.joda:joda-money:2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.json:json:20240303=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.jsoup:jsoup:1.18.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
--- a/util/gradle.lockfile
+++ b/util/gradle.lockfile
@@ -10,7 +10,7 @@ com.github.docker-java:docker-java-transport-zerodep:3.4.0=testCompileClasspath,
 com.github.docker-java:docker-java-transport:3.4.0=testCompileClasspath,testRuntimeClasspath
 com.github.kevinstern:software-and-algorithms:1.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.android:annotations:4.1.1.4=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.api-client:google-api-client:2.7.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.api-client:google-api-client:2.7.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2:2.54.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2beta2:0.144.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api.grpc:proto-google-cloud-tasks-v2beta3:0.144.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -36,7 +36,7 @@ com.google.dagger:dagger:2.51.1=annotationProcessor,compileClasspath,deploy_jar,
 com.google.devtools.ksp:symbol-processing-api:1.9.20-1.0.14=annotationProcessor,testAnnotationProcessor
 com.google.errorprone:error_prone_annotation:2.23.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.errorprone:error_prone_annotations:2.23.0=annotationProcessor,errorprone,testAnnotationProcessor
-com.google.errorprone:error_prone_annotations:2.35.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.errorprone:error_prone_annotations:2.36.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.errorprone:error_prone_annotations:2.7.1=checkstyle
 com.google.errorprone:error_prone_check_api:2.23.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.errorprone:error_prone_core:2.23.0=annotationProcessor,errorprone,testAnnotationProcessor
@@ -55,9 +55,9 @@ com.google.guava:guava:32.1.1-jre=errorprone
 com.google.guava:guava:33.0.0-jre=annotationProcessor,testAnnotationProcessor
 com.google.guava:guava:33.3.1-jre=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=annotationProcessor,checkstyle,compileClasspath,deploy_jar,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-apache-v2:1.45.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client-gson:1.45.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.http-client:google-http-client:1.45.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-apache-v2:1.45.2=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client-gson:1.45.2=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.http-client:google-http-client:1.45.2=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.inject:guice:5.1.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.j2objc:j2objc-annotations:1.3=checkstyle
 com.google.j2objc:j2objc-annotations:3.0.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -80,9 +80,10 @@ io.github.eisop:dataflow-errorprone:3.34.0-eisop1=annotationProcessor,errorprone
 io.github.java-diff-utils:java-diff-utils:4.12=annotationProcessor,errorprone,testAnnotationProcessor
 io.github.java-diff-utils:java-diff-utils:4.15=deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-alts:1.68.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-api:1.68.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-api:1.68.1=compileClasspath,testCompileClasspath
+io.grpc:grpc-api:1.68.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-auth:1.68.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.grpc:grpc-context:1.68.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.grpc:grpc-context:1.68.2=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-core:1.68.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-googleapis:1.68.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-grpclb:1.68.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
Author	SHA1	Message	Date
Lai Jiang	da8df1f4d9	Make GKE the default in alpha and qa (#2624 )	2024-12-17 17:40:03 +00:00
Pavlo Tkach	f649d960c1	Add user email prefix to the console user create (#2623 )	2024-12-13 19:47:21 +00:00
Weimin Yu	e5ebc5a2bb	Save Cloud SQL connection names in Keyring (#2622 ) This eliminates the need to make a new release after database disaster recovery.	2024-12-13 16:18:15 +00:00
Lai Jiang	f9d2839590	Add necessary changes to provision QA with Terraform (#2618 ) Also programmatically determine backend service IDs.	2024-12-12 18:39:18 +00:00