diff --git a/java-batch/proto-google-cloud-batch-v1alpha/src/main/java/com/google/cloud/batch/v1alpha/AllocationPolicy.java b/java-batch/proto-google-cloud-batch-v1alpha/src/main/java/com/google/cloud/batch/v1alpha/AllocationPolicy.java
index 53e426424e05..cf8249dcbc3d 100644
--- a/java-batch/proto-google-cloud-batch-v1alpha/src/main/java/com/google/cloud/batch/v1alpha/AllocationPolicy.java
+++ b/java-batch/proto-google-cloud-batch-v1alpha/src/main/java/com/google/cloud/batch/v1alpha/AllocationPolicy.java
@@ -43,6 +43,7 @@ private AllocationPolicy() {
     instanceTemplates_ = com.google.protobuf.LazyStringArrayList.emptyList();
     provisioningModels_ = java.util.Collections.emptyList();
     serviceAccountEmail_ = "";
+    tags_ = com.google.protobuf.LazyStringArrayList.emptyList();
   }
 
   @java.lang.Override
@@ -14331,6 +14332,86 @@ public com.google.cloud.batch.v1alpha.AllocationPolicy.PlacementPolicy getPlacem
         : placement_;
   }
 
+  public static final int TAGS_FIELD_NUMBER = 11;
+
+  @SuppressWarnings("serial")
+  private com.google.protobuf.LazyStringArrayList tags_ =
+      com.google.protobuf.LazyStringArrayList.emptyList();
+  /**
+   *
+   *
+   * <pre>
+   * Optional. Tags applied to the VM instances.
+   *
+   * The tags identify valid sources or targets for network firewalls.
+   * Each tag must be 1-63 characters long, and comply with
+   * [RFC1035](https://www.ietf.org/rfc/rfc1035.txt).
+   * </pre>
+   *
+   * <code>repeated string tags = 11 [(.google.api.field_behavior) = OPTIONAL];</code>
+   *
+   * @return A list containing the tags.
+   */
+  public com.google.protobuf.ProtocolStringList getTagsList() {
+    return tags_;
+  }
+  /**
+   *
+   *
+   * <pre>
+   * Optional. Tags applied to the VM instances.
+   *
+   * The tags identify valid sources or targets for network firewalls.
+   * Each tag must be 1-63 characters long, and comply with
+   * [RFC1035](https://www.ietf.org/rfc/rfc1035.txt).
+   * </pre>
+   *
+   * <code>repeated string tags = 11 [(.google.api.field_behavior) = OPTIONAL];</code>
+   *
+   * @return The count of tags.
+   */
+  public int getTagsCount() {
+    return tags_.size();
+  }
+  /**
+   *
+   *
+   * <pre>
+   * Optional. Tags applied to the VM instances.
+   *
+   * The tags identify valid sources or targets for network firewalls.
+   * Each tag must be 1-63 characters long, and comply with
+   * [RFC1035](https://www.ietf.org/rfc/rfc1035.txt).
+   * </pre>
+   *
+   * <code>repeated string tags = 11 [(.google.api.field_behavior) = OPTIONAL];</code>
+   *
+   * @param index The index of the element to return.
+   * @return The tags at the given index.
+   */
+  public java.lang.String getTags(int index) {
+    return tags_.get(index);
+  }
+  /**
+   *
+   *
+   * <pre>
+   * Optional. Tags applied to the VM instances.
+   *
+   * The tags identify valid sources or targets for network firewalls.
+   * Each tag must be 1-63 characters long, and comply with
+   * [RFC1035](https://www.ietf.org/rfc/rfc1035.txt).
+   * </pre>
+   *
+   * <code>repeated string tags = 11 [(.google.api.field_behavior) = OPTIONAL];</code>
+   *
+   * @param index The index of the value to return.
+   * @return The bytes of the tags at the given index.
+   */
+  public com.google.protobuf.ByteString getTagsBytes(int index) {
+    return tags_.getByteString(index);
+  }
+
   private byte memoizedIsInitialized = -1;
 
   @java.lang.Override
@@ -14379,6 +14460,9 @@ public void writeTo(com.google.protobuf.CodedOutputStream output) throws java.io
     if (placement_ != null) {
       output.writeMessage(10, getPlacement());
     }
+    for (int i = 0; i < tags_.size(); i++) {
+      com.google.protobuf.GeneratedMessageV3.writeString(output, 11, tags_.getRaw(i));
+    }
     getUnknownFields().writeTo(output);
   }
 
@@ -14440,6 +14524,14 @@ public int getSerializedSize() {
     if (placement_ != null) {
       size += com.google.protobuf.CodedOutputStream.computeMessageSize(10, getPlacement());
     }
+    {
+      int dataSize = 0;
+      for (int i = 0; i < tags_.size(); i++) {
+        dataSize += computeStringSizeNoTag(tags_.getRaw(i));
+      }
+      size += dataSize;
+      size += 1 * getTagsList().size();
+    }
     size += getUnknownFields().getSerializedSize();
     memoizedSize = size;
     return size;
@@ -14481,6 +14573,7 @@ public boolean equals(final java.lang.Object obj) {
     if (hasPlacement()) {
       if (!getPlacement().equals(other.getPlacement())) return false;
     }
+    if (!getTagsList().equals(other.getTagsList())) return false;
     if (!getUnknownFields().equals(other.getUnknownFields())) return false;
     return true;
   }
@@ -14530,6 +14623,10 @@ public int hashCode() {
       hash = (37 * hash) + PLACEMENT_FIELD_NUMBER;
       hash = (53 * hash) + getPlacement().hashCode();
     }
+    if (getTagsCount() > 0) {
+      hash = (37 * hash) + TAGS_FIELD_NUMBER;
+      hash = (53 * hash) + getTagsList().hashCode();
+    }
     hash = (29 * hash) + getUnknownFields().hashCode();
     memoizedHashCode = hash;
     return hash;
@@ -14727,6 +14824,7 @@ public Builder clear() {
         placementBuilder_.dispose();
         placementBuilder_ = null;
       }
+      tags_ = com.google.protobuf.LazyStringArrayList.emptyList();
       return this;
     }
 
@@ -14809,6 +14907,10 @@ private void buildPartial0(com.google.cloud.batch.v1alpha.AllocationPolicy resul
       if (((from_bitField0_ & 0x00000200) != 0)) {
         result.placement_ = placementBuilder_ == null ? placement_ : placementBuilder_.build();
       }
+      if (((from_bitField0_ & 0x00000400) != 0)) {
+        tags_.makeImmutable();
+        result.tags_ = tags_;
+      }
     }
 
     @java.lang.Override
@@ -14926,6 +15028,16 @@ public Builder mergeFrom(com.google.cloud.batch.v1alpha.AllocationPolicy other)
       if (other.hasPlacement()) {
         mergePlacement(other.getPlacement());
       }
+      if (!other.tags_.isEmpty()) {
+        if (tags_.isEmpty()) {
+          tags_ = other.tags_;
+          bitField0_ |= 0x00000400;
+        } else {
+          ensureTagsIsMutable();
+          tags_.addAll(other.tags_);
+        }
+        onChanged();
+      }
       this.mergeUnknownFields(other.getUnknownFields());
       onChanged();
       return this;
@@ -15041,6 +15153,13 @@ public Builder mergeFrom(
                 bitField0_ |= 0x00000200;
                 break;
               } // case 82
+            case 90:
+              {
+                java.lang.String s = input.readStringRequireUtf8();
+                ensureTagsIsMutable();
+                tags_.add(s);
+                break;
+              } // case 90
             default:
               {
                 if (!super.parseUnknownField(input, extensionRegistry, tag)) {
@@ -17316,6 +17435,216 @@ public Builder clearPlacement() {
       return placementBuilder_;
     }
 
+    private com.google.protobuf.LazyStringArrayList tags_ =
+        com.google.protobuf.LazyStringArrayList.emptyList();
+
+    private void ensureTagsIsMutable() {
+      if (!tags_.isModifiable()) {
+        tags_ = new com.google.protobuf.LazyStringArrayList(tags_);
+      }
+      bitField0_ |= 0x00000400;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Optional. Tags applied to the VM instances.
+     *
+     * The tags identify valid sources or targets for network firewalls.
+     * Each tag must be 1-63 characters long, and comply with
+     * [RFC1035](https://www.ietf.org/rfc/rfc1035.txt).
+     * </pre>
+     *
+     * <code>repeated string tags = 11 [(.google.api.field_behavior) = OPTIONAL];</code>
+     *
+     * @return A list containing the tags.
+     */
+    public com.google.protobuf.ProtocolStringList getTagsList() {
+      tags_.makeImmutable();
+      return tags_;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Optional. Tags applied to the VM instances.
+     *
+     * The tags identify valid sources or targets for network firewalls.
+     * Each tag must be 1-63 characters long, and comply with
+     * [RFC1035](https://www.ietf.org/rfc/rfc1035.txt).
+     * </pre>
+     *
+     * <code>repeated string tags = 11 [(.google.api.field_behavior) = OPTIONAL];</code>
+     *
+     * @return The count of tags.
+     */
+    public int getTagsCount() {
+      return tags_.size();
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Optional. Tags applied to the VM instances.
+     *
+     * The tags identify valid sources or targets for network firewalls.
+     * Each tag must be 1-63 characters long, and comply with
+     * [RFC1035](https://www.ietf.org/rfc/rfc1035.txt).
+     * </pre>
+     *
+     * <code>repeated string tags = 11 [(.google.api.field_behavior) = OPTIONAL];</code>
+     *
+     * @param index The index of the element to return.
+     * @return The tags at the given index.
+     */
+    public java.lang.String getTags(int index) {
+      return tags_.get(index);
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Optional. Tags applied to the VM instances.
+     *
+     * The tags identify valid sources or targets for network firewalls.
+     * Each tag must be 1-63 characters long, and comply with
+     * [RFC1035](https://www.ietf.org/rfc/rfc1035.txt).
+     * </pre>
+     *
+     * <code>repeated string tags = 11 [(.google.api.field_behavior) = OPTIONAL];</code>
+     *
+     * @param index The index of the value to return.
+     * @return The bytes of the tags at the given index.
+     */
+    public com.google.protobuf.ByteString getTagsBytes(int index) {
+      return tags_.getByteString(index);
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Optional. Tags applied to the VM instances.
+     *
+     * The tags identify valid sources or targets for network firewalls.
+     * Each tag must be 1-63 characters long, and comply with
+     * [RFC1035](https://www.ietf.org/rfc/rfc1035.txt).
+     * </pre>
+     *
+     * <code>repeated string tags = 11 [(.google.api.field_behavior) = OPTIONAL];</code>
+     *
+     * @param index The index to set the value at.
+     * @param value The tags to set.
+     * @return This builder for chaining.
+     */
+    public Builder setTags(int index, java.lang.String value) {
+      if (value == null) {
+        throw new NullPointerException();
+      }
+      ensureTagsIsMutable();
+      tags_.set(index, value);
+      bitField0_ |= 0x00000400;
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Optional. Tags applied to the VM instances.
+     *
+     * The tags identify valid sources or targets for network firewalls.
+     * Each tag must be 1-63 characters long, and comply with
+     * [RFC1035](https://www.ietf.org/rfc/rfc1035.txt).
+     * </pre>
+     *
+     * <code>repeated string tags = 11 [(.google.api.field_behavior) = OPTIONAL];</code>
+     *
+     * @param value The tags to add.
+     * @return This builder for chaining.
+     */
+    public Builder addTags(java.lang.String value) {
+      if (value == null) {
+        throw new NullPointerException();
+      }
+      ensureTagsIsMutable();
+      tags_.add(value);
+      bitField0_ |= 0x00000400;
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Optional. Tags applied to the VM instances.
+     *
+     * The tags identify valid sources or targets for network firewalls.
+     * Each tag must be 1-63 characters long, and comply with
+     * [RFC1035](https://www.ietf.org/rfc/rfc1035.txt).
+     * </pre>
+     *
+     * <code>repeated string tags = 11 [(.google.api.field_behavior) = OPTIONAL];</code>
+     *
+     * @param values The tags to add.
+     * @return This builder for chaining.
+     */
+    public Builder addAllTags(java.lang.Iterable<java.lang.String> values) {
+      ensureTagsIsMutable();
+      com.google.protobuf.AbstractMessageLite.Builder.addAll(values, tags_);
+      bitField0_ |= 0x00000400;
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Optional. Tags applied to the VM instances.
+     *
+     * The tags identify valid sources or targets for network firewalls.
+     * Each tag must be 1-63 characters long, and comply with
+     * [RFC1035](https://www.ietf.org/rfc/rfc1035.txt).
+     * </pre>
+     *
+     * <code>repeated string tags = 11 [(.google.api.field_behavior) = OPTIONAL];</code>
+     *
+     * @return This builder for chaining.
+     */
+    public Builder clearTags() {
+      tags_ = com.google.protobuf.LazyStringArrayList.emptyList();
+      bitField0_ = (bitField0_ & ~0x00000400);
+      ;
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Optional. Tags applied to the VM instances.
+     *
+     * The tags identify valid sources or targets for network firewalls.
+     * Each tag must be 1-63 characters long, and comply with
+     * [RFC1035](https://www.ietf.org/rfc/rfc1035.txt).
+     * </pre>
+     *
+     * <code>repeated string tags = 11 [(.google.api.field_behavior) = OPTIONAL];</code>
+     *
+     * @param value The bytes of the tags to add.
+     * @return This builder for chaining.
+     */
+    public Builder addTagsBytes(com.google.protobuf.ByteString value) {
+      if (value == null) {
+        throw new NullPointerException();
+      }
+      checkByteStringIsUtf8(value);
+      ensureTagsIsMutable();
+      tags_.add(value);
+      bitField0_ |= 0x00000400;
+      onChanged();
+      return this;
+    }
+
     @java.lang.Override
     public final Builder setUnknownFields(final com.google.protobuf.UnknownFieldSet unknownFields) {
       return super.setUnknownFields(unknownFields);
diff --git a/java-batch/proto-google-cloud-batch-v1alpha/src/main/java/com/google/cloud/batch/v1alpha/AllocationPolicyOrBuilder.java b/java-batch/proto-google-cloud-batch-v1alpha/src/main/java/com/google/cloud/batch/v1alpha/AllocationPolicyOrBuilder.java
index 332d809a6610..3430b1bfd939 100644
--- a/java-batch/proto-google-cloud-batch-v1alpha/src/main/java/com/google/cloud/batch/v1alpha/AllocationPolicyOrBuilder.java
+++ b/java-batch/proto-google-cloud-batch-v1alpha/src/main/java/com/google/cloud/batch/v1alpha/AllocationPolicyOrBuilder.java
@@ -565,4 +565,71 @@ java.lang.String getLabelsOrDefault(
    * <code>.google.cloud.batch.v1alpha.AllocationPolicy.PlacementPolicy placement = 10;</code>
    */
   com.google.cloud.batch.v1alpha.AllocationPolicy.PlacementPolicyOrBuilder getPlacementOrBuilder();
+
+  /**
+   *
+   *
+   * <pre>
+   * Optional. Tags applied to the VM instances.
+   *
+   * The tags identify valid sources or targets for network firewalls.
+   * Each tag must be 1-63 characters long, and comply with
+   * [RFC1035](https://www.ietf.org/rfc/rfc1035.txt).
+   * </pre>
+   *
+   * <code>repeated string tags = 11 [(.google.api.field_behavior) = OPTIONAL];</code>
+   *
+   * @return A list containing the tags.
+   */
+  java.util.List<java.lang.String> getTagsList();
+  /**
+   *
+   *
+   * <pre>
+   * Optional. Tags applied to the VM instances.
+   *
+   * The tags identify valid sources or targets for network firewalls.
+   * Each tag must be 1-63 characters long, and comply with
+   * [RFC1035](https://www.ietf.org/rfc/rfc1035.txt).
+   * </pre>
+   *
+   * <code>repeated string tags = 11 [(.google.api.field_behavior) = OPTIONAL];</code>
+   *
+   * @return The count of tags.
+   */
+  int getTagsCount();
+  /**
+   *
+   *
+   * <pre>
+   * Optional. Tags applied to the VM instances.
+   *
+   * The tags identify valid sources or targets for network firewalls.
+   * Each tag must be 1-63 characters long, and comply with
+   * [RFC1035](https://www.ietf.org/rfc/rfc1035.txt).
+   * </pre>
+   *
+   * <code>repeated string tags = 11 [(.google.api.field_behavior) = OPTIONAL];</code>
+   *
+   * @param index The index of the element to return.
+   * @return The tags at the given index.
+   */
+  java.lang.String getTags(int index);
+  /**
+   *
+   *
+   * <pre>
+   * Optional. Tags applied to the VM instances.
+   *
+   * The tags identify valid sources or targets for network firewalls.
+   * Each tag must be 1-63 characters long, and comply with
+   * [RFC1035](https://www.ietf.org/rfc/rfc1035.txt).
+   * </pre>
+   *
+   * <code>repeated string tags = 11 [(.google.api.field_behavior) = OPTIONAL];</code>
+   *
+   * @param index The index of the value to return.
+   * @return The bytes of the tags at the given index.
+   */
+  com.google.protobuf.ByteString getTagsBytes(int index);
 }
diff --git a/java-batch/proto-google-cloud-batch-v1alpha/src/main/java/com/google/cloud/batch/v1alpha/JobProto.java b/java-batch/proto-google-cloud-batch-v1alpha/src/main/java/com/google/cloud/batch/v1alpha/JobProto.java
index 1d716f482129..a75e6ce12b0a 100644
--- a/java-batch/proto-google-cloud-batch-v1alpha/src/main/java/com/google/cloud/batch/v1alpha/JobProto.java
+++ b/java-batch/proto-google-cloud-batch-v1alpha/src/main/java/com/google/cloud/batch/v1alpha/JobProto.java
@@ -229,7 +229,7 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
           + "\016new_task_state\030\003 \001(\0162,.google.cloud.bat"
           + "ch.v1alpha.TaskStatus.State\"K\n\004Type\022\024\n\020T"
           + "YPE_UNSPECIFIED\020\000\022\025\n\021JOB_STATE_CHANGED\020\001"
-          + "\022\026\n\022TASK_STATE_CHANGED\020\002\"\240\021\n\020AllocationP"
+          + "\022\026\n\022TASK_STATE_CHANGED\020\002\"\264\021\n\020AllocationP"
           + "olicy\022M\n\010location\030\001 \001(\0132;.google.cloud.b"
           + "atch.v1alpha.AllocationPolicy.LocationPo"
           + "licy\022Q\n\010instance\030\002 \001(\0132;.google.cloud.ba"
@@ -248,70 +248,71 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
           + "ch.v1alpha.AllocationPolicy.NetworkPolic"
           + "y\022O\n\tplacement\030\n \001(\0132<.google.cloud.batc"
           + "h.v1alpha.AllocationPolicy.PlacementPoli"
-          + "cy\032E\n\016LocationPolicy\022\031\n\021allowed_location"
-          + "s\030\001 \003(\t\022\030\n\020denied_locations\030\002 \003(\t\032q\n\004Dis"
-          + "k\022\017\n\005image\030\004 \001(\tH\000\022\022\n\010snapshot\030\005 \001(\tH\000\022\014"
-          + "\n\004type\030\001 \001(\t\022\017\n\007size_gb\030\002 \001(\003\022\026\n\016disk_in"
-          + "terface\030\006 \001(\tB\r\n\013data_source\032\217\001\n\014Attache"
-          + "dDisk\022E\n\010new_disk\030\001 \001(\01321.google.cloud.b"
-          + "atch.v1alpha.AllocationPolicy.DiskH\000\022\027\n\r"
-          + "existing_disk\030\002 \001(\tH\000\022\023\n\013device_name\030\003 \001"
-          + "(\tB\n\n\010attached\032i\n\013Accelerator\022\014\n\004type\030\001 "
-          + "\001(\t\022\r\n\005count\030\002 \001(\003\022\037\n\023install_gpu_driver"
-          + "s\030\003 \001(\010B\002\030\001\022\034\n\016driver_version\030\004 \001(\tB\004\342A\001"
-          + "\001\032\272\003\n\016InstancePolicy\022!\n\025allowed_machine_"
-          + "types\030\001 \003(\tB\002\030\001\022\024\n\014machine_type\030\002 \001(\t\022\030\n"
-          + "\020min_cpu_platform\030\003 \001(\t\022Z\n\022provisioning_"
-          + "model\030\004 \001(\0162>.google.cloud.batch.v1alpha"
-          + ".AllocationPolicy.ProvisioningModel\022N\n\014a"
-          + "ccelerators\030\005 \003(\01328.google.cloud.batch.v"
-          + "1alpha.AllocationPolicy.Accelerator\022D\n\tb"
-          + "oot_disk\030\010 \001(\01321.google.cloud.batch.v1al"
-          + "pha.AllocationPolicy.Disk\022H\n\005disks\030\006 \003(\013"
-          + "29.google.cloud.batch.v1alpha.Allocation"
-          + "Policy.AttachedDisk\022\031\n\013reservation\030\007 \001(\t"
-          + "B\004\342A\001\001\032\266\001\n\030InstancePolicyOrTemplate\022M\n\006p"
-          + "olicy\030\001 \001(\0132;.google.cloud.batch.v1alpha"
-          + ".AllocationPolicy.InstancePolicyH\000\022\033\n\021in"
-          + "stance_template\030\002 \001(\tH\000\022\033\n\023install_gpu_d"
-          + "rivers\030\003 \001(\010B\021\n\017policy_template\032W\n\020Netwo"
-          + "rkInterface\022\017\n\007network\030\001 \001(\t\022\022\n\nsubnetwo"
-          + "rk\030\002 \001(\t\022\036\n\026no_external_ip_address\030\003 \001(\010"
-          + "\032j\n\rNetworkPolicy\022Y\n\022network_interfaces\030"
-          + "\001 \003(\0132=.google.cloud.batch.v1alpha.Alloc"
-          + "ationPolicy.NetworkInterface\032<\n\017Placemen"
-          + "tPolicy\022\023\n\013collocation\030\001 \001(\t\022\024\n\014max_dist"
-          + "ance\030\002 \001(\003\032-\n\013LabelsEntry\022\013\n\003key\030\001 \001(\t\022\r"
-          + "\n\005value\030\002 \001(\t:\0028\001\"`\n\021ProvisioningModel\022\""
-          + "\n\036PROVISIONING_MODEL_UNSPECIFIED\020\000\022\014\n\010ST"
-          + "ANDARD\020\001\022\010\n\004SPOT\020\002\022\017\n\013PREEMPTIBLE\020\003\"\227\006\n\t"
-          + "TaskGroup\022\022\n\004name\030\001 \001(\tB\004\342A\001\003\022=\n\ttask_sp"
-          + "ec\030\003 \001(\0132$.google.cloud.batch.v1alpha.Ta"
-          + "skSpecB\004\342A\001\002\022\022\n\ntask_count\030\004 \001(\003\022\023\n\013para"
-          + "llelism\030\005 \001(\003\022Q\n\021scheduling_policy\030\006 \001(\016"
-          + "26.google.cloud.batch.v1alpha.TaskGroup."
-          + "SchedulingPolicy\022G\n\021allocation_policy\030\007 "
-          + "\001(\0132,.google.cloud.batch.v1alpha.Allocat"
-          + "ionPolicy\022A\n\006labels\030\010 \003(\01321.google.cloud"
-          + ".batch.v1alpha.TaskGroup.LabelsEntry\022B\n\021"
-          + "task_environments\030\t \003(\0132\'.google.cloud.b"
-          + "atch.v1alpha.Environment\022\033\n\023task_count_p"
-          + "er_node\030\n \001(\003\022\032\n\022require_hosts_file\030\013 \001("
-          + "\010\022\026\n\016permissive_ssh\030\014 \001(\010\022\034\n\016enable_oslo"
-          + "gin\030\r \001(\010B\004\342A\001\001\032-\n\013LabelsEntry\022\013\n\003key\030\001 "
-          + "\001(\t\022\r\n\005value\030\002 \001(\t:\0028\001\"\\\n\020SchedulingPoli"
-          + "cy\022!\n\035SCHEDULING_POLICY_UNSPECIFIED\020\000\022\027\n"
-          + "\023AS_SOON_AS_POSSIBLE\020\001\022\014\n\010IN_ORDER\020\002:o\352A"
-          + "l\n\036batch.googleapis.com/TaskGroup\022Jproje"
-          + "cts/{project}/locations/{location}/jobs/"
-          + "{job}/taskGroups/{task_group}\"/\n\016Service"
-          + "Account\022\r\n\005email\030\001 \001(\t\022\016\n\006scopes\030\002 \003(\tB\302"
-          + "\001\n\036com.google.cloud.batch.v1alphaB\010JobPr"
-          + "otoP\001Z4cloud.google.com/go/batch/apiv1al"
-          + "pha/batchpb;batchpb\242\002\003GCB\252\002\032Google.Cloud"
-          + ".Batch.V1Alpha\312\002\032Google\\Cloud\\Batch\\V1al"
-          + "pha\352\002\035Google::Cloud::Batch::V1alphab\006pro"
-          + "to3"
+          + "cy\022\022\n\004tags\030\013 \003(\tB\004\342A\001\001\032E\n\016LocationPolicy"
+          + "\022\031\n\021allowed_locations\030\001 \003(\t\022\030\n\020denied_lo"
+          + "cations\030\002 \003(\t\032q\n\004Disk\022\017\n\005image\030\004 \001(\tH\000\022\022"
+          + "\n\010snapshot\030\005 \001(\tH\000\022\014\n\004type\030\001 \001(\t\022\017\n\007size"
+          + "_gb\030\002 \001(\003\022\026\n\016disk_interface\030\006 \001(\tB\r\n\013dat"
+          + "a_source\032\217\001\n\014AttachedDisk\022E\n\010new_disk\030\001 "
+          + "\001(\01321.google.cloud.batch.v1alpha.Allocat"
+          + "ionPolicy.DiskH\000\022\027\n\rexisting_disk\030\002 \001(\tH"
+          + "\000\022\023\n\013device_name\030\003 \001(\tB\n\n\010attached\032i\n\013Ac"
+          + "celerator\022\014\n\004type\030\001 \001(\t\022\r\n\005count\030\002 \001(\003\022\037"
+          + "\n\023install_gpu_drivers\030\003 \001(\010B\002\030\001\022\034\n\016drive"
+          + "r_version\030\004 \001(\tB\004\342A\001\001\032\272\003\n\016InstancePolicy"
+          + "\022!\n\025allowed_machine_types\030\001 \003(\tB\002\030\001\022\024\n\014m"
+          + "achine_type\030\002 \001(\t\022\030\n\020min_cpu_platform\030\003 "
+          + "\001(\t\022Z\n\022provisioning_model\030\004 \001(\0162>.google"
+          + ".cloud.batch.v1alpha.AllocationPolicy.Pr"
+          + "ovisioningModel\022N\n\014accelerators\030\005 \003(\01328."
+          + "google.cloud.batch.v1alpha.AllocationPol"
+          + "icy.Accelerator\022D\n\tboot_disk\030\010 \001(\01321.goo"
+          + "gle.cloud.batch.v1alpha.AllocationPolicy"
+          + ".Disk\022H\n\005disks\030\006 \003(\01329.google.cloud.batc"
+          + "h.v1alpha.AllocationPolicy.AttachedDisk\022"
+          + "\031\n\013reservation\030\007 \001(\tB\004\342A\001\001\032\266\001\n\030InstanceP"
+          + "olicyOrTemplate\022M\n\006policy\030\001 \001(\0132;.google"
+          + ".cloud.batch.v1alpha.AllocationPolicy.In"
+          + "stancePolicyH\000\022\033\n\021instance_template\030\002 \001("
+          + "\tH\000\022\033\n\023install_gpu_drivers\030\003 \001(\010B\021\n\017poli"
+          + "cy_template\032W\n\020NetworkInterface\022\017\n\007netwo"
+          + "rk\030\001 \001(\t\022\022\n\nsubnetwork\030\002 \001(\t\022\036\n\026no_exter"
+          + "nal_ip_address\030\003 \001(\010\032j\n\rNetworkPolicy\022Y\n"
+          + "\022network_interfaces\030\001 \003(\0132=.google.cloud"
+          + ".batch.v1alpha.AllocationPolicy.NetworkI"
+          + "nterface\032<\n\017PlacementPolicy\022\023\n\013collocati"
+          + "on\030\001 \001(\t\022\024\n\014max_distance\030\002 \001(\003\032-\n\013Labels"
+          + "Entry\022\013\n\003key\030\001 \001(\t\022\r\n\005value\030\002 \001(\t:\0028\001\"`\n"
+          + "\021ProvisioningModel\022\"\n\036PROVISIONING_MODEL"
+          + "_UNSPECIFIED\020\000\022\014\n\010STANDARD\020\001\022\010\n\004SPOT\020\002\022\017"
+          + "\n\013PREEMPTIBLE\020\003\"\270\006\n\tTaskGroup\022\022\n\004name\030\001 "
+          + "\001(\tB\004\342A\001\003\022=\n\ttask_spec\030\003 \001(\0132$.google.cl"
+          + "oud.batch.v1alpha.TaskSpecB\004\342A\001\002\022\022\n\ntask"
+          + "_count\030\004 \001(\003\022\023\n\013parallelism\030\005 \001(\003\022Q\n\021sch"
+          + "eduling_policy\030\006 \001(\01626.google.cloud.batc"
+          + "h.v1alpha.TaskGroup.SchedulingPolicy\022G\n\021"
+          + "allocation_policy\030\007 \001(\0132,.google.cloud.b"
+          + "atch.v1alpha.AllocationPolicy\022A\n\006labels\030"
+          + "\010 \003(\01321.google.cloud.batch.v1alpha.TaskG"
+          + "roup.LabelsEntry\022B\n\021task_environments\030\t "
+          + "\003(\0132\'.google.cloud.batch.v1alpha.Environ"
+          + "ment\022\033\n\023task_count_per_node\030\n \001(\003\022\032\n\022req"
+          + "uire_hosts_file\030\013 \001(\010\022\026\n\016permissive_ssh\030"
+          + "\014 \001(\010\022\036\n\016enable_oslogin\030\r \001(\010B\006\030\001\342A\001\001\022\035\n"
+          + "\017run_as_non_root\030\016 \001(\010B\004\342A\001\001\032-\n\013LabelsEn"
+          + "try\022\013\n\003key\030\001 \001(\t\022\r\n\005value\030\002 \001(\t:\0028\001\"\\\n\020S"
+          + "chedulingPolicy\022!\n\035SCHEDULING_POLICY_UNS"
+          + "PECIFIED\020\000\022\027\n\023AS_SOON_AS_POSSIBLE\020\001\022\014\n\010I"
+          + "N_ORDER\020\002:o\352Al\n\036batch.googleapis.com/Tas"
+          + "kGroup\022Jprojects/{project}/locations/{lo"
+          + "cation}/jobs/{job}/taskGroups/{task_grou"
+          + "p}\"/\n\016ServiceAccount\022\r\n\005email\030\001 \001(\t\022\016\n\006s"
+          + "copes\030\002 \003(\tB\302\001\n\036com.google.cloud.batch.v"
+          + "1alphaB\010JobProtoP\001Z4cloud.google.com/go/"
+          + "batch/apiv1alpha/batchpb;batchpb\242\002\003GCB\252\002"
+          + "\032Google.Cloud.Batch.V1Alpha\312\002\032Google\\Clo"
+          + "ud\\Batch\\V1alpha\352\002\035Google::Cloud::Batch:"
+          + ":V1alphab\006proto3"
     };
     descriptor =
         com.google.protobuf.Descriptors.FileDescriptor.internalBuildGeneratedFileFrom(
@@ -468,6 +469,7 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
               "Labels",
               "Network",
               "Placement",
+              "Tags",
             });
     internal_static_google_cloud_batch_v1alpha_AllocationPolicy_LocationPolicy_descriptor =
         internal_static_google_cloud_batch_v1alpha_AllocationPolicy_descriptor
@@ -594,6 +596,7 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
               "RequireHostsFile",
               "PermissiveSsh",
               "EnableOslogin",
+              "RunAsNonRoot",
             });
     internal_static_google_cloud_batch_v1alpha_TaskGroup_LabelsEntry_descriptor =
         internal_static_google_cloud_batch_v1alpha_TaskGroup_descriptor.getNestedTypes().get(0);
diff --git a/java-batch/proto-google-cloud-batch-v1alpha/src/main/java/com/google/cloud/batch/v1alpha/Runnable.java b/java-batch/proto-google-cloud-batch-v1alpha/src/main/java/com/google/cloud/batch/v1alpha/Runnable.java
index 0e7173e27eb8..fe509c6731f0 100644
--- a/java-batch/proto-google-cloud-batch-v1alpha/src/main/java/com/google/cloud/batch/v1alpha/Runnable.java
+++ b/java-batch/proto-google-cloud-batch-v1alpha/src/main/java/com/google/cloud/batch/v1alpha/Runnable.java
@@ -384,11 +384,13 @@ public interface ContainerOrBuilder
      *
      *
      * <pre>
-     * Optional. Not yet implemented.
-     * If set to true, container will run with Image streaming.
+     * Optional. If set to true, container will run with Image streaming.
      * The container runtime will be changed to containerd
      * instead of docker. Currently, only imageUri, commands, entrypoint
      * and volumes are supported and any other fields will be ignored.
+     * Please refer
+     * [here](https://github.com/GoogleCloudPlatform/batch-samples/tree/main/api-samples/image-streaming)
+     * for the feature requirements and limitations.
      * </pre>
      *
      * <code>bool enable_image_streaming = 12 [(.google.api.field_behavior) = OPTIONAL];</code>
@@ -915,11 +917,13 @@ public com.google.protobuf.ByteString getPasswordBytes() {
      *
      *
      * <pre>
-     * Optional. Not yet implemented.
-     * If set to true, container will run with Image streaming.
+     * Optional. If set to true, container will run with Image streaming.
      * The container runtime will be changed to containerd
      * instead of docker. Currently, only imageUri, commands, entrypoint
      * and volumes are supported and any other fields will be ignored.
+     * Please refer
+     * [here](https://github.com/GoogleCloudPlatform/batch-samples/tree/main/api-samples/image-streaming)
+     * for the feature requirements and limitations.
      * </pre>
      *
      * <code>bool enable_image_streaming = 12 [(.google.api.field_behavior) = OPTIONAL];</code>
@@ -2571,11 +2575,13 @@ public Builder setPasswordBytes(com.google.protobuf.ByteString value) {
        *
        *
        * <pre>
-       * Optional. Not yet implemented.
-       * If set to true, container will run with Image streaming.
+       * Optional. If set to true, container will run with Image streaming.
        * The container runtime will be changed to containerd
        * instead of docker. Currently, only imageUri, commands, entrypoint
        * and volumes are supported and any other fields will be ignored.
+       * Please refer
+       * [here](https://github.com/GoogleCloudPlatform/batch-samples/tree/main/api-samples/image-streaming)
+       * for the feature requirements and limitations.
        * </pre>
        *
        * <code>bool enable_image_streaming = 12 [(.google.api.field_behavior) = OPTIONAL];</code>
@@ -2590,11 +2596,13 @@ public boolean getEnableImageStreaming() {
        *
        *
        * <pre>
-       * Optional. Not yet implemented.
-       * If set to true, container will run with Image streaming.
+       * Optional. If set to true, container will run with Image streaming.
        * The container runtime will be changed to containerd
        * instead of docker. Currently, only imageUri, commands, entrypoint
        * and volumes are supported and any other fields will be ignored.
+       * Please refer
+       * [here](https://github.com/GoogleCloudPlatform/batch-samples/tree/main/api-samples/image-streaming)
+       * for the feature requirements and limitations.
        * </pre>
        *
        * <code>bool enable_image_streaming = 12 [(.google.api.field_behavior) = OPTIONAL];</code>
@@ -2613,11 +2621,13 @@ public Builder setEnableImageStreaming(boolean value) {
        *
        *
        * <pre>
-       * Optional. Not yet implemented.
-       * If set to true, container will run with Image streaming.
+       * Optional. If set to true, container will run with Image streaming.
        * The container runtime will be changed to containerd
        * instead of docker. Currently, only imageUri, commands, entrypoint
        * and volumes are supported and any other fields will be ignored.
+       * Please refer
+       * [here](https://github.com/GoogleCloudPlatform/batch-samples/tree/main/api-samples/image-streaming)
+       * for the feature requirements and limitations.
        * </pre>
        *
        * <code>bool enable_image_streaming = 12 [(.google.api.field_behavior) = OPTIONAL];</code>
diff --git a/java-batch/proto-google-cloud-batch-v1alpha/src/main/java/com/google/cloud/batch/v1alpha/TaskGroup.java b/java-batch/proto-google-cloud-batch-v1alpha/src/main/java/com/google/cloud/batch/v1alpha/TaskGroup.java
index 94d10a6ced06..03fcf88a445e 100644
--- a/java-batch/proto-google-cloud-batch-v1alpha/src/main/java/com/google/cloud/batch/v1alpha/TaskGroup.java
+++ b/java-batch/proto-google-cloud-batch-v1alpha/src/main/java/com/google/cloud/batch/v1alpha/TaskGroup.java
@@ -784,8 +784,8 @@ public boolean getPermissiveSsh() {
    *
    *
    * <pre>
-   * Optional. When true, Batch will use the OS Login generated POSIX account to
-   * exeucute the runnables instead of the default root user.
+   * Optional. Deprecated: When true, Batch will use the OS Login generated
+   * POSIX account to exeucute the runnables instead of the default root user.
    *
    * To control root or non-root privilege for runnable execution, the project &#92;
    * Admin user needs to configure IAM roles according to
@@ -795,15 +795,40 @@ public boolean getPermissiveSsh() {
    * roles/compute.osLogin should be granted to the Batch job submitter.
    * </pre>
    *
-   * <code>bool enable_oslogin = 13 [(.google.api.field_behavior) = OPTIONAL];</code>
+   * <code>bool enable_oslogin = 13 [deprecated = true, (.google.api.field_behavior) = OPTIONAL];
+   * </code>
    *
+   * @deprecated google.cloud.batch.v1alpha.TaskGroup.enable_oslogin is deprecated. See
+   *     google/cloud/batch/v1alpha/job.proto;l=710
    * @return The enableOslogin.
    */
   @java.lang.Override
+  @java.lang.Deprecated
   public boolean getEnableOslogin() {
     return enableOslogin_;
   }
 
+  public static final int RUN_AS_NON_ROOT_FIELD_NUMBER = 14;
+  private boolean runAsNonRoot_ = false;
+  /**
+   *
+   *
+   * <pre>
+   * Optional. If not set or set to false, Batch will use root user to execute
+   * runnables. If set to true, Batch will make sure to run the runnables using
+   * non-root user. Currently, the non-root user Batch used is generated by OS
+   * login. Reference: https://cloud.google.com/compute/docs/oslogin
+   * </pre>
+   *
+   * <code>bool run_as_non_root = 14 [(.google.api.field_behavior) = OPTIONAL];</code>
+   *
+   * @return The runAsNonRoot.
+   */
+  @java.lang.Override
+  public boolean getRunAsNonRoot() {
+    return runAsNonRoot_;
+  }
+
   private byte memoizedIsInitialized = -1;
 
   @java.lang.Override
@@ -855,6 +880,9 @@ public void writeTo(com.google.protobuf.CodedOutputStream output) throws java.io
     if (enableOslogin_ != false) {
       output.writeBool(13, enableOslogin_);
     }
+    if (runAsNonRoot_ != false) {
+      output.writeBool(14, runAsNonRoot_);
+    }
     getUnknownFields().writeTo(output);
   }
 
@@ -909,6 +937,9 @@ public int getSerializedSize() {
     if (enableOslogin_ != false) {
       size += com.google.protobuf.CodedOutputStream.computeBoolSize(13, enableOslogin_);
     }
+    if (runAsNonRoot_ != false) {
+      size += com.google.protobuf.CodedOutputStream.computeBoolSize(14, runAsNonRoot_);
+    }
     size += getUnknownFields().getSerializedSize();
     memoizedSize = size;
     return size;
@@ -942,6 +973,7 @@ public boolean equals(final java.lang.Object obj) {
     if (getRequireHostsFile() != other.getRequireHostsFile()) return false;
     if (getPermissiveSsh() != other.getPermissiveSsh()) return false;
     if (getEnableOslogin() != other.getEnableOslogin()) return false;
+    if (getRunAsNonRoot() != other.getRunAsNonRoot()) return false;
     if (!getUnknownFields().equals(other.getUnknownFields())) return false;
     return true;
   }
@@ -985,6 +1017,8 @@ public int hashCode() {
     hash = (53 * hash) + com.google.protobuf.Internal.hashBoolean(getPermissiveSsh());
     hash = (37 * hash) + ENABLE_OSLOGIN_FIELD_NUMBER;
     hash = (53 * hash) + com.google.protobuf.Internal.hashBoolean(getEnableOslogin());
+    hash = (37 * hash) + RUN_AS_NON_ROOT_FIELD_NUMBER;
+    hash = (53 * hash) + com.google.protobuf.Internal.hashBoolean(getRunAsNonRoot());
     hash = (29 * hash) + getUnknownFields().hashCode();
     memoizedHashCode = hash;
     return hash;
@@ -1170,6 +1204,7 @@ public Builder clear() {
       requireHostsFile_ = false;
       permissiveSsh_ = false;
       enableOslogin_ = false;
+      runAsNonRoot_ = false;
       return this;
     }
 
@@ -1254,6 +1289,9 @@ private void buildPartial0(com.google.cloud.batch.v1alpha.TaskGroup result) {
       if (((from_bitField0_ & 0x00000800) != 0)) {
         result.enableOslogin_ = enableOslogin_;
       }
+      if (((from_bitField0_ & 0x00001000) != 0)) {
+        result.runAsNonRoot_ = runAsNonRoot_;
+      }
     }
 
     @java.lang.Override
@@ -1362,6 +1400,9 @@ public Builder mergeFrom(com.google.cloud.batch.v1alpha.TaskGroup other) {
       if (other.getEnableOslogin() != false) {
         setEnableOslogin(other.getEnableOslogin());
       }
+      if (other.getRunAsNonRoot() != false) {
+        setRunAsNonRoot(other.getRunAsNonRoot());
+      }
       this.mergeUnknownFields(other.getUnknownFields());
       onChanged();
       return this;
@@ -1474,6 +1515,12 @@ public Builder mergeFrom(
                 bitField0_ |= 0x00000800;
                 break;
               } // case 104
+            case 112:
+              {
+                runAsNonRoot_ = input.readBool();
+                bitField0_ |= 0x00001000;
+                break;
+              } // case 112
             default:
               {
                 if (!super.parseUnknownField(input, extensionRegistry, tag)) {
@@ -3105,8 +3152,8 @@ public Builder clearPermissiveSsh() {
      *
      *
      * <pre>
-     * Optional. When true, Batch will use the OS Login generated POSIX account to
-     * exeucute the runnables instead of the default root user.
+     * Optional. Deprecated: When true, Batch will use the OS Login generated
+     * POSIX account to exeucute the runnables instead of the default root user.
      *
      * To control root or non-root privilege for runnable execution, the project &#92;
      * Admin user needs to configure IAM roles according to
@@ -3116,11 +3163,15 @@ public Builder clearPermissiveSsh() {
      * roles/compute.osLogin should be granted to the Batch job submitter.
      * </pre>
      *
-     * <code>bool enable_oslogin = 13 [(.google.api.field_behavior) = OPTIONAL];</code>
+     * <code>bool enable_oslogin = 13 [deprecated = true, (.google.api.field_behavior) = OPTIONAL];
+     * </code>
      *
+     * @deprecated google.cloud.batch.v1alpha.TaskGroup.enable_oslogin is deprecated. See
+     *     google/cloud/batch/v1alpha/job.proto;l=710
      * @return The enableOslogin.
      */
     @java.lang.Override
+    @java.lang.Deprecated
     public boolean getEnableOslogin() {
       return enableOslogin_;
     }
@@ -3128,8 +3179,8 @@ public boolean getEnableOslogin() {
      *
      *
      * <pre>
-     * Optional. When true, Batch will use the OS Login generated POSIX account to
-     * exeucute the runnables instead of the default root user.
+     * Optional. Deprecated: When true, Batch will use the OS Login generated
+     * POSIX account to exeucute the runnables instead of the default root user.
      *
      * To control root or non-root privilege for runnable execution, the project &#92;
      * Admin user needs to configure IAM roles according to
@@ -3139,11 +3190,15 @@ public boolean getEnableOslogin() {
      * roles/compute.osLogin should be granted to the Batch job submitter.
      * </pre>
      *
-     * <code>bool enable_oslogin = 13 [(.google.api.field_behavior) = OPTIONAL];</code>
+     * <code>bool enable_oslogin = 13 [deprecated = true, (.google.api.field_behavior) = OPTIONAL];
+     * </code>
      *
+     * @deprecated google.cloud.batch.v1alpha.TaskGroup.enable_oslogin is deprecated. See
+     *     google/cloud/batch/v1alpha/job.proto;l=710
      * @param value The enableOslogin to set.
      * @return This builder for chaining.
      */
+    @java.lang.Deprecated
     public Builder setEnableOslogin(boolean value) {
 
       enableOslogin_ = value;
@@ -3155,8 +3210,8 @@ public Builder setEnableOslogin(boolean value) {
      *
      *
      * <pre>
-     * Optional. When true, Batch will use the OS Login generated POSIX account to
-     * exeucute the runnables instead of the default root user.
+     * Optional. Deprecated: When true, Batch will use the OS Login generated
+     * POSIX account to exeucute the runnables instead of the default root user.
      *
      * To control root or non-root privilege for runnable execution, the project &#92;
      * Admin user needs to configure IAM roles according to
@@ -3166,10 +3221,14 @@ public Builder setEnableOslogin(boolean value) {
      * roles/compute.osLogin should be granted to the Batch job submitter.
      * </pre>
      *
-     * <code>bool enable_oslogin = 13 [(.google.api.field_behavior) = OPTIONAL];</code>
+     * <code>bool enable_oslogin = 13 [deprecated = true, (.google.api.field_behavior) = OPTIONAL];
+     * </code>
      *
+     * @deprecated google.cloud.batch.v1alpha.TaskGroup.enable_oslogin is deprecated. See
+     *     google/cloud/batch/v1alpha/job.proto;l=710
      * @return This builder for chaining.
      */
+    @java.lang.Deprecated
     public Builder clearEnableOslogin() {
       bitField0_ = (bitField0_ & ~0x00000800);
       enableOslogin_ = false;
@@ -3177,6 +3236,68 @@ public Builder clearEnableOslogin() {
       return this;
     }
 
+    private boolean runAsNonRoot_;
+    /**
+     *
+     *
+     * <pre>
+     * Optional. If not set or set to false, Batch will use root user to execute
+     * runnables. If set to true, Batch will make sure to run the runnables using
+     * non-root user. Currently, the non-root user Batch used is generated by OS
+     * login. Reference: https://cloud.google.com/compute/docs/oslogin
+     * </pre>
+     *
+     * <code>bool run_as_non_root = 14 [(.google.api.field_behavior) = OPTIONAL];</code>
+     *
+     * @return The runAsNonRoot.
+     */
+    @java.lang.Override
+    public boolean getRunAsNonRoot() {
+      return runAsNonRoot_;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Optional. If not set or set to false, Batch will use root user to execute
+     * runnables. If set to true, Batch will make sure to run the runnables using
+     * non-root user. Currently, the non-root user Batch used is generated by OS
+     * login. Reference: https://cloud.google.com/compute/docs/oslogin
+     * </pre>
+     *
+     * <code>bool run_as_non_root = 14 [(.google.api.field_behavior) = OPTIONAL];</code>
+     *
+     * @param value The runAsNonRoot to set.
+     * @return This builder for chaining.
+     */
+    public Builder setRunAsNonRoot(boolean value) {
+
+      runAsNonRoot_ = value;
+      bitField0_ |= 0x00001000;
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Optional. If not set or set to false, Batch will use root user to execute
+     * runnables. If set to true, Batch will make sure to run the runnables using
+     * non-root user. Currently, the non-root user Batch used is generated by OS
+     * login. Reference: https://cloud.google.com/compute/docs/oslogin
+     * </pre>
+     *
+     * <code>bool run_as_non_root = 14 [(.google.api.field_behavior) = OPTIONAL];</code>
+     *
+     * @return This builder for chaining.
+     */
+    public Builder clearRunAsNonRoot() {
+      bitField0_ = (bitField0_ & ~0x00001000);
+      runAsNonRoot_ = false;
+      onChanged();
+      return this;
+    }
+
     @java.lang.Override
     public final Builder setUnknownFields(final com.google.protobuf.UnknownFieldSet unknownFields) {
       return super.setUnknownFields(unknownFields);
diff --git a/java-batch/proto-google-cloud-batch-v1alpha/src/main/java/com/google/cloud/batch/v1alpha/TaskGroupOrBuilder.java b/java-batch/proto-google-cloud-batch-v1alpha/src/main/java/com/google/cloud/batch/v1alpha/TaskGroupOrBuilder.java
index 579a0bc34de1..a7c5cfee177f 100644
--- a/java-batch/proto-google-cloud-batch-v1alpha/src/main/java/com/google/cloud/batch/v1alpha/TaskGroupOrBuilder.java
+++ b/java-batch/proto-google-cloud-batch-v1alpha/src/main/java/com/google/cloud/batch/v1alpha/TaskGroupOrBuilder.java
@@ -413,8 +413,8 @@ java.lang.String getLabelsOrDefault(
    *
    *
    * <pre>
-   * Optional. When true, Batch will use the OS Login generated POSIX account to
-   * exeucute the runnables instead of the default root user.
+   * Optional. Deprecated: When true, Batch will use the OS Login generated
+   * POSIX account to exeucute the runnables instead of the default root user.
    *
    * To control root or non-root privilege for runnable execution, the project &#92;
    * Admin user needs to configure IAM roles according to
@@ -424,9 +424,29 @@ java.lang.String getLabelsOrDefault(
    * roles/compute.osLogin should be granted to the Batch job submitter.
    * </pre>
    *
-   * <code>bool enable_oslogin = 13 [(.google.api.field_behavior) = OPTIONAL];</code>
+   * <code>bool enable_oslogin = 13 [deprecated = true, (.google.api.field_behavior) = OPTIONAL];
+   * </code>
    *
+   * @deprecated google.cloud.batch.v1alpha.TaskGroup.enable_oslogin is deprecated. See
+   *     google/cloud/batch/v1alpha/job.proto;l=710
    * @return The enableOslogin.
    */
+  @java.lang.Deprecated
   boolean getEnableOslogin();
+
+  /**
+   *
+   *
+   * <pre>
+   * Optional. If not set or set to false, Batch will use root user to execute
+   * runnables. If set to true, Batch will make sure to run the runnables using
+   * non-root user. Currently, the non-root user Batch used is generated by OS
+   * login. Reference: https://cloud.google.com/compute/docs/oslogin
+   * </pre>
+   *
+   * <code>bool run_as_non_root = 14 [(.google.api.field_behavior) = OPTIONAL];</code>
+   *
+   * @return The runAsNonRoot.
+   */
+  boolean getRunAsNonRoot();
 }
diff --git a/java-batch/proto-google-cloud-batch-v1alpha/src/main/proto/google/cloud/batch/v1alpha/job.proto b/java-batch/proto-google-cloud-batch-v1alpha/src/main/proto/google/cloud/batch/v1alpha/job.proto
index bad02721e8f0..427dfa59d600 100644
--- a/java-batch/proto-google-cloud-batch-v1alpha/src/main/proto/google/cloud/batch/v1alpha/job.proto
+++ b/java-batch/proto-google-cloud-batch-v1alpha/src/main/proto/google/cloud/batch/v1alpha/job.proto
@@ -608,6 +608,13 @@ message AllocationPolicy {
 
   // The placement policy.
   PlacementPolicy placement = 10;
+
+  // Optional. Tags applied to the VM instances.
+  //
+  // The tags identify valid sources or targets for network firewalls.
+  // Each tag must be 1-63 characters long, and comply with
+  // [RFC1035](https://www.ietf.org/rfc/rfc1035.txt).
+  repeated string tags = 11 [(google.api.field_behavior) = OPTIONAL];
 }
 
 // A TaskGroup defines one or more Tasks that all share the same TaskSpec.
@@ -692,8 +699,8 @@ message TaskGroup {
   // VMs running the Batch tasks in the same TaskGroup.
   bool permissive_ssh = 12;
 
-  // Optional. When true, Batch will use the OS Login generated POSIX account to
-  // exeucute the runnables instead of the default root user.
+  // Optional. Deprecated: When true, Batch will use the OS Login generated
+  // POSIX account to exeucute the runnables instead of the default root user.
   //
   // To control root or non-root privilege for runnable execution, the project \
   // Admin user needs to configure IAM roles according to
@@ -701,7 +708,14 @@ message TaskGroup {
   // Specifically, if a root execution is needed, the roles/compute.osAdminLogin
   // should be granted to the Batch job submitter. Otherwise,
   // roles/compute.osLogin should be granted to the Batch job submitter.
-  bool enable_oslogin = 13 [(google.api.field_behavior) = OPTIONAL];
+  bool enable_oslogin = 13
+      [deprecated = true, (google.api.field_behavior) = OPTIONAL];
+
+  // Optional. If not set or set to false, Batch will use root user to execute
+  // runnables. If set to true, Batch will make sure to run the runnables using
+  // non-root user. Currently, the non-root user Batch used is generated by OS
+  // login. Reference: https://cloud.google.com/compute/docs/oslogin
+  bool run_as_non_root = 14 [(google.api.field_behavior) = OPTIONAL];
 }
 
 // Carries information about a Google Cloud service account.
diff --git a/java-batch/proto-google-cloud-batch-v1alpha/src/main/proto/google/cloud/batch/v1alpha/task.proto b/java-batch/proto-google-cloud-batch-v1alpha/src/main/proto/google/cloud/batch/v1alpha/task.proto
index 4c61e4f333bc..cc9bbf61f1e6 100644
--- a/java-batch/proto-google-cloud-batch-v1alpha/src/main/proto/google/cloud/batch/v1alpha/task.proto
+++ b/java-batch/proto-google-cloud-batch-v1alpha/src/main/proto/google/cloud/batch/v1alpha/task.proto
@@ -208,11 +208,13 @@ message Runnable {
     // password from the Secret Manager;
     string password = 11;
 
-    // Optional. Not yet implemented.
-    // If set to true, container will run with Image streaming.
+    // Optional. If set to true, container will run with Image streaming.
     // The container runtime will be changed to containerd
     // instead of docker. Currently, only imageUri, commands, entrypoint
     // and volumes are supported and any other fields will be ignored.
+    // Please refer
+    // [here](https://github.com/GoogleCloudPlatform/batch-samples/tree/main/api-samples/image-streaming)
+    // for the feature requirements and limitations.
     bool enable_image_streaming = 12 [(google.api.field_behavior) = OPTIONAL];
   }