#515 Issue
Aug. 10, 2026
Welcome to issue #514 August 3rd, 2026
News
AI FinOps Generative AIDetect early and enforce firmly with Google Cloud's enhanced cost controls for AI spend - Today, we are announcing two native features in the Google Cloud Billing console: early anomalies on AI services and spend caps on Google Cloud Budgets.
BigQuery Data Analytics SAPAnnouncing general availability of SAP Business Data Cloud Connect for BigQuery - Unify your operational data in real time. SAP BDC Connect for BigQuery provides a zero-copy architecture to help you lower IT costs.
AI LLMAnnouncing support for the Inkling model family on Google Cloud - Google Cloud now supports Thinking Machine Lab's Inkling multimodal model family—including the highly efficient Inkling-Small variant—through Model Garden on Agent Platform.
Agents Apache Iceberg AWS Data Analytics Serverless SparkThe borderless Lakehouse: Bring AWS, Databricks and Snowflake data to your AI agents - The borderless Lakehouse provides secure, bi-directional access via BigQuery and Managed Service for Apache Spark to any Iceberg-compatible engine.
BigQuery Data AnalyticsBringing Conversational Analytics to your entire data ecosystem - Get up to speed on the latest for Conversational Analytics (CA) in Google Data Cloud, including BigQuery, Looker and Databases.
HPC Public SectorModernizing the skies: NOAA and Google Cloud collaborate to advance weather forecasting - Google Cloud is now the primary HPC provider for NOAA’s supercomputing system (WCOSS), driving a major shift to operational cloud-first weather modeling.
AlloyDB Databases IAMAlloyDB adds group authentication to secure enterprise scale and AI agents - We’re bringing identity-driven access control to your enterprise workloads through IAM group authentication for AlloyDB, now available in preview.
Articles, Tutorials
Infrastructure, Networking, Security, Kubernetes
GCP Experience Retail Workforce Identity FederationBest Buy scales AI workloads and secures access with Workforce Identity Federation - To support tens of thousands of users, Best Buy modernized its identity architecture, adopting Workforce Identity Federation to federate existing Entra ID identities.
NetworkingModernizing Enterprise Cloud Security: Building an Autoscale Multi-NIC Palo Alto Stack on Google Cloud NCC Mesh Topology - This article explores how enterprises can build a scalable and transparent Zero Trust security architecture in Google Cloud by combining Network Connectivity Center (NCC) Mesh Topologies, Network Security Intercept (NSI), and Palo Alto VM-Series firewalls. It explains how this integrated approach eliminates traditional routing bottlenecks and Source NAT limitations, allowing for seamless Layer 7 traffic inspection and full client IP visibility across complex multi-tenant environments.
CISOCloud CISO Perspectives: Why AI Threat Defense is the new boardroom baseline - It’s time to have The Talk: Here’s what boards and CISOs should be discussing on AI-era security governance and business agility.
Agents SecurityMastering Agent Runtime Security Controls on Google Cloud Platform (GCP) - This article explores a comprehensive architectural guide for securing enterprise AI Agent Runtimes on Google Cloud Platform, focusing on preventing unauthorized data exfiltration and shadow tool integrations. It details a multi-layered defense model that combines network egress boundaries, VPC Service Controls, and managed organization constraints to govern outbound traffic and third-party connectors.
SecurityCyber Snapshot Report: Go beyond the toolchain and build enterprise resilience - Check out curated frontline insights and blueprints to turn potential crises into manageable events in the newest Cyber Snapshot Report.
SecurityNew to Google SecOps: Additional Methods to Filter in Dashboards - This article explores advanced filtering techniques for dashboards within Google Security Operations (SecOps), focusing on how to constrain inputs using manual and dynamic lists. It guides users through configuring tokens and updating underlying chart queries to create interactive, user-friendly drop-down menus for specific fields like rule packs and rule names.
Google Kubernetes Engine Kubernetes NetworkingKubernetes networking 101 on GKE: Quick Reference Guide - If you’re using Kubernetes, understanding the networking component can sometimes become complex. In this guide, we will look at some.
Cloud Run GKE Autopilot Infrastructure KubernetesCloud Run vs. GKE Autopilot: A Comparison for ADK Agents - This article provides a practical comparison between Google Cloud Run and GKE Autopilot for hosting agent development kit workloads. By deploying the exact same container image to both platforms, the evaluation highlights key differences in identity configuration, cold-start behavior, and infrastructure complexity.
Agents Google Kubernetes EngineDo more with less: How GKE can reduce your cost per agent by 75% - Learn how GKE Agent Sandbox can increase agent density up to 3.5x and cut compute costs by 75% without sacrificing performance.
DevOps Google Kubernetes Engine KubernetesStop Over-Provisioning for Startup: GKE’s New CPU Startup Boost - This article explores GKE's new CPU startup boost feature, which solves the dilemma of having to over-provision Kubernetes resources just to handle heavy application initialization phases. It explains how developers can temporarily increase CPU requests during startup using factors or fixed quantities, and then automatically scale them back down to steady-state baselines without restarting the container.
Cloud KMSFuture-proofing data integrity: Quantum-safe digital signatures in Cloud KMS - We are extending the PQC digital signature algorithms suite available in Google Cloud Key Management System to include ML-DSA and SLH-DSA. Here’s why.
Threat IntelligenceBatten Down Your Packages: Mitigation Guidance for Supply Chain Compromise - Trends we have observed in threat actor use of software supply chain compromise, and provide mitigation and hardening recommendations.
App Development, Serverless, Databases, DevOps
Agents AI Genkit GoEnable on-demand expertise with Agent Skills in Genkit Go - To prevent context window bloat and reduce token consumption, Genkit Go introduces Agent Skills based on a progressive disclosure architecture. Developers can package specialized instructions, scripts, and references into modular SKILL.md bundles where only the frontmatter metadata is initially exposed to the agent's system prompt. When a task matches the skill's description, Genkit's middleware dynamically loads the full instruction body and associated assets, ensuring the model accesses precise workflows exactly when needed.
Cloud Run SREGCP Cloud Run’s New Automated Failover Is a Direct Answer to a Real Outage - This article explores Google Cloud’s rapid launch of automated cross-region failover for Cloud Run, which reached General Availability just days after a major data center outage in the Netherlands. It explains how the new service health feature utilizes standard readiness probes and application load balancers to effortlessly orchestrate multi-region resilience without complex architectural overhauls.
API Apigee Cloud RunBuilding an Earthquake Watch API Platform with Apigee X and Cloud Run - This article demonstrates how to build an end-to-end API platform called QuakeWatch using Apigee X and Google Cloud Run. It walks through using real-time U.S. Geological Survey earthquake data stored in Firestore to showcase advanced API management features, such as routing, rate-limiting, and response caching. Ultimately, the guide proves how a single backend can support multiple service tiers—such as Free and Pro plans—enforced entirely through gateway policies without requiring backend code changes.
DevOps Pythondrongo: the moto for Google Cloud - This article introduces "drongo," a new in-memory, in-process testing tool for Google Cloud Platform (GCP) that functions similarly to the popular AWS testing library, moto. It explains how drongo allows developers to test multiple GCP services quickly and reliably without needing Docker, external emulators, or complex mock objects.
ADK Agents Cloud RunEval Is Evil: How to Safely Execute Untrusted AI Code with Cloud Run sandboxes and ADK - This article explores how Google Cloud Run sandboxes provide a secure isolation boundary for safely executing untrusted user input and AI-generated code. It demonstrates how to implement this programmatically to prevent malicious data exfiltration and highlights its seamless integration as a code execution tool within the Agent Development Kit.
Agents Cloud Functions Cloud Run FinOpsFinally — Hard Caps to Limit Your Google Cloud Spend - No more $10k surprise cloud bills! Google Cloud introduces native Cloud Spend Caps to hard-stop spend before your wallet takes a hit.
Cloud Run ServerlessCloud Run sandboxes now in public preview - A new feature just shipped for Cloud Run! Introducing Cloud Run sandboxes, now in public preview.
Cloud Build DevOpsBuilding a Secure, Serverless CI/CD Pipeline on GCP - This article provides a step-by-step guide to building a secure, production-grade, and fully serverless CI/CD pipeline on Google Cloud Platform. It demonstrates how to separate continuous integration from continuous delivery by integrating GitHub with Cloud Build and Cloud Deploy, while enforcing robust security practices like least-privilege access and Binary Authorization.
FirebaseTriple-layer security for Firebase web apps - This article explores a comprehensive, three-layer security approach for Firebase web applications. It details how to protect your project by implementing strict Firebase Security Rules for client access, enforcing the principle of least privilege on backend operations using custom service accounts, and verifying client request integrity with Firebase App Check.
FirebaseBringing Google Maps to Friendly Meals with Firebase AI Logic - Discover how to enhance your Android applications with spatial intelligence by integrating Google Maps grounding through Firebase AI Logic. The article demonstrates how to connect Gemini models with real-time location data to build a location-aware cooking assistant that finds nearby stores for missing ingredients. You will also learn how to configure server-side prompt templates, handle device location permissions in Kotlin, and prepare your app for production.
Cloud Run Cloud StorageBuilding Serverless Rclone Data Transfers to Google Cloud Storage - In this post you will learn how to use the rclone open-source data transfer engine to build an automated, zero-maintenance transfer service that transfers data between external services and Google Cloud Storage.
Big Data, Analytics, ML&AI
BigQuery dbt FinOps MonitoringBeyond Monitoring: Extending dbt-bigquery-monitoring into an Data Observability and FinOps Platform - How to transform dbt-bigquery-monitoring from a metadata package into the foundation of an enterprise observability platform for BigQuery.
ADK AI BigQuery BigQueryMLHow to Build a Serverless Agent Observability Pipeline in BigQuery - This article demonstrates how to build a real-time, serverless observability pipeline for multi-agent AI systems using the Agent Development Kit, BigQuery Continuous Queries, and BigQuery ML.
Knowledge Catalog10 Things I Wish My Data Catalog Could Do - This article explores the limitations of traditional data catalogs and envisions ten advanced capabilities needed to bridge the gap between stored metadata and practical data usage. By building an experimental system that unifies metadata from tools like BigQuery, dbt, and Knowledge Catalog, the author demonstrates how AI agents can assemble rich context packages to generate accurate SQL queries, link business terms to actual columns, and adapt answers for different departments.
AgentsGoogle Cloud Skills Tutorial — Part 5 : Build Your Own Custom Skill - This article provides a comprehensive, step-by-step tutorial on how to build and test a custom Google Cloud Agent Skill for automating workflows like storage cleanup. It walks developers through creating a structured Markdown configuration, setting up test environments, and implementing strict safety gates for AI-driven cloud management. Ultimately, it demonstrates how teams can easily teach cloud agents their specific internal conventions and operational procedures using simple text files.
AI Gemini Enterprise Agent PlatformAgent and Model Evaluations in Gemini Enterprise Agent Platform are now GA - Agent Platform's evaluation service is now generally available, providing developers with a unified engine to measure agent quality consistently across local development experiments and live production traffic. You can evaluate agents using over 20 pre-built metrics, DeepMind-backed adaptive rubrics, or custom code-based and LLM-as-a-judge metrics stored in a centralized, versioned registry. The service integrates directly into existing workflows via the Agent Platform SDK, agents-cli, and ADK, offering built-in user and environment simulators to automate complex multi-turn testing and streamline CI pipelines.
AI TPUHow to use Google microbenchmarks for evaluating TPU performance - Google's open-source TPU microbenchmark suite provides developers with granular performance metrics across Network, Compute, HBM, Host Transfer, and Attention components to validate real-world hardware capabilities. By leveraging these benchmarks to establish a Roofline model, engineers can accurately diagnose whether their machine learning workloads are compute-, memory-, or network-bound. This empirical baseline directly guides targeted software optimizations—such as kernel tuning, mesh sharding, and rematerialization—to maximize hardware utilization for large-scale model deployments.
LLM TPUInside the optimization of Mistral 3 large inference on Ironwood - This technical article details how engineers optimized the inference performance of the Mistral 3 Mixture-of-Experts (MoE) model on Google’s Ironwood TPUs. By implementing advanced strategies like hybrid sharding, SparseCore tree reductions, and asynchronous scheduling, the team achieved up to a 48% boost in throughput and a 30% reduction in latency without sacrificing benchmark accuracy.
Generative AI LLMAnnouncing Day 0 support for Kimi K3 on Google Cloud - This article explains how to efficiently deploy and serve Moonshot AI’s massive 2.8-trillion-parameter Kimi K3 model using Google Cloud's advanced AI infrastructure. It outlines flexible deployment pathways—ranging from quick setups via Model Garden to distributed serving on Google Kubernetes Engine (GKE) utilizing SGLang and high-performance hardware accelerators.
ADK LLM PaywallEvaluating Google ADK Agents: From Execution Traces to Regression Tests (Part 4) - A Practical Guide to Eval Sets, Eval Configs, Trajectory Metrics, and Rubric-Based Scoring.
MCPMCP Toolbox adds support for the new 2026–07–28 MCP spec - MCP Toolbox v1.8.0 and SDKs now natively support the 20260728 stateless MCP spec for better scaling.
ADK AIComparing Orchestration Patterns in Google ADK: Multi-Agent vs. Workflow-Based Loops - As agentic AI matures, developers face a critical design decision: How should agents orchestrate tasks?
Cloud Run GeminiThe anatomy of an AI agent on Google Cloud: a complete guide - This article serves as a comprehensive guide to building and deploying production-ready AI agents on Google Cloud. It breaks down the agent architecture layer by layer—covering models, frameworks, runtimes, tools, and memory—while mapping them to specific Google Cloud products like Vertex AI, Cloud Run, and the Agent Development Kit.
Agents CLI Gemini Enterprise Agent PlatformAutomate your agent development lifecycle using any coding agent - With Agents CLI skills, you can go through the different phases of the entire agent lifecycle without ever leaving your coding agent.
Agents DevOps LookerAutomate data monitoring and root-cause analysis with Looker Agentic Workflows - Learn how Looker users can extend one-time questions to ongoing inquiries for monitoring, using background agents that can surface results in chat.
Slides, Videos, Audio
GCP Bytes Podcast - #46 In this episode we discuss; Ausalert, Omnirouter, Hermes, Amazon Leo, Cloudflare DNS, Korean Market, Arcfra, GDG Events, AMD & Microsoft, Microsoft Results, Google Cloud Killing It, Oracle in Trouble, Apple Sues OpenAI, GCVE Outage, Token Efficient Software Engineering, OKF v0.2, Video Sign In Feature, New Gemini Models, Kimi K3, Fable Removed, Opus 5, Qwen 3.8 Claude Escapes, Sol Hacked Huggingface.
Releases
AlloyDB - Transparent query forwarding is now available in Preview for clusters compatible with PostgreSQL 17 and 18. With this feature, the primary node in a cluster intercepts read-only queries and selectively forwards them to read pool instances while maintaining read-your-writes consistency. For more information, see Optimize resources and isolate read queries with transparent query forwarding. AlloyDB write endpoints are now available in Preview. Write endpoints simplify database connection management by providing a stable domain name service (DNS) name for your applications, decoupling them from instance IP addresses. During disaster recovery switchovers or failovers, AlloyDB automatically updates the endpoint to point to the new primary instance. For more information, see Manage database connections with write endpoints. AlloyDB now supports cross-region failover in Preview. You can optionally enable cross-region failover to automate the recreation of the original primary when a secondary cluster is promoted while maintaining your replication topology without requiring manual cluster deletion or re-creation. Cross-region failover is supported only for topologies with a single primary cluster and a single secondary cluster. For more information, see About cross-region replication and Work with cross-region replication. External search with AlloyDB now supports OpenSearch in Preview. You can use the external_search_fdw extension to connect to an OpenSearch cluster and query its data directly from your database. Note: IAM group authentication is available in Preview for new AlloyDB clusters. To enable this feature on an existing cluster, contact your Google Cloud account team. IAM group authentication for AlloyDB is available in Preview for new clusters running PostgreSQL 15 and later. This feature simplifies database user management by allowing access management at the group level, where group members inherit database roles and permissions. To use this feature, enable the alloydb.iam_authentication and alloydb.iam_group_authentication database flags. For more information, see IAM group authentication and Manage IAM authentication.
AppEngine Standard - Support for enabling only needed legacy bundled services using the app_engine_bundled_services field is in General Availability.
BigQuery - You can use the APPENDS and CHANGES change history functions to view the rows that were appended to or changed in a table during a given time range. This feature is generally available (GA). The feature formerly known as the legacy tabledata.insertAll method is now called the Storage Write API (REST). The feature formerly known as the Storage Write API is now called the Storage Write API (gRPC). You can use the Google-developed Open Database Connectivity (ODBC) driver for BigQuery to connect your applications to BigQuery. This feature is generally available (GA). BigQuery dataset insights is generally available (GA). BigQuery dataset insights helps you discover and visualize relationships between tables and automatically generate cross-table queries. You can run and publish these insights to Knowledge Catalog for agentic grounding use cases, or generate them on demand without publishing for quick, ad hoc dataset exploration. You can discover commercial BigQuery sharing listings on Google Cloud Marketplace with the Marketplace filter. For more information, see Subscribe to a Cloud Marketplace-integrated listing. This feature is generally available (GA). The BigQuery Data Transfer Service now supports incremental data transfers when transferring data from Klaviyo to BigQuery. This feature is supported in Preview. You can add tables, views, data sources, and data quality tests as tasks to BigQuery pipelines. For more information, see Add a pipeline task. This feature is generally available. You can audit when users download query results by using the BigQuery console. Data Access audit logs for the tabledata.list method now include a uiDownloadRequest field to indicate whether the request was triggered by a UI download. This feature is generally available (GA).
Bigtable - The Bigtable remote MCP server supports the Bigtable Data API, which provides the execute_sql tool that you can use to query Bigtable data using natural language prompts. This feature is generally available (GA). For more information, see Use the Bigtable remote MCP server. You can use the Google Cloud console to manage row key schemas for your Bigtable tables. This feature is in Preview. You can use Bigtable as a remote storage backend for LMCache. By storing the large language model (LLM) key-value (KV) cache externally in Bigtable, multiple AI serving instances can share and reuse precomputed attention tensors. This reduces compute overhead and significantly improves time-to-first-token (TTFT) for repeated prompts and shared documents. This feature is in Preview.
Billing - Spend cap budgets are now available for a limited set of services (Preview) Available in Preview for eligible services, you can now configure a spend cap budget to automatically pause usage when your spend exceeds the budget amount you set. Spend caps are a cost control mechanism. A spend cap is enforced when usage costs exceed your budget target amount. When enforced, any new request to the eligible services, within the specified project, are paused and no further usage costs are accrued until you manually lift the spend cap. Spend caps typically use estimated costs to trigger the alerts and caps, enforcing a cap much faster than the actual costs are processed and appear on billing reports. Even though faster than reports, the enforcement of spend caps isn't instant and any cost overages are billed as normal. For more information about spend cap budgets, see: How spend cap budgets work to help you control spend Configure a spend cap budget Lift an enforced spend cap Limitations of spend cap budgets
Chronicle - View prebuilt parser version content You can now view the prebuilt parser preview version content even if you are using a custom parser for the same log type. Although the prebuilt parser version is inactive, you can still see the content of the new preview version for this parser.
Chronicle SOAR - Release 6.3.95 is being rolled out to the first phase of regions as listed here. This release contains internal and customer bug fixes.
Chronicle Security Operations - Full notes on the release page.
Cloud Composer - (Available without upgrading) The correct default task priority weight of 1 is now shown for tasks in the Google Cloud console. A new Managed Service for Apache Airflow release has started on July 29, 2026. Get ready for upcoming changes and features as we roll out the new release to all regions. This release is in progress at the moment. Listed changes and features might not be available in some regions yet. (Managed Airflow Gen 3 with Airflow 2) Default triggerer resources are changing to 1 vCPU and 2 GB memory to match Airflow 3 defaults. This change is available in the Google Cloud CLI, Terraform, and Cloud Composer API and is gradually rolling out in the Google Cloud console. (Airflow 3.2.2) Backported #69877 to restore the ability to deliver failure and retry alerts through a pluggable email backend (configured through the [email]email_backend Airflow configuration option). (Airflow 3.2.2) The Multi-Team Airflow feature isn't available. The [core]multi_team Airflow configuration option is set to False and it isn't possible to override it. New images are available in Managed Airflow (Gen 2): composer-2.17.8-airflow-2.11.1 (default) composer-2.17.8-airflow-2.10.5 New Airflow builds are available in Managed Airflow (Gen 3): composer-3-airflow-3.2.2-build.0 composer-3-airflow-3.1.8-build.2 composer-3-airflow-2.11.1-build.13 (default) composer-3-airflow-2.10.5-build.46 The following Managed Airflow versions and builds have reached their end of support period: composer-3-airflow-2.10.5-build.10, composer-3-airflow-2.9.3-build.30, composer-2.13.8-airflow-2.9.3, and composer-2.13.8-airflow-2.10.5. Airflow 3.2.2 is available in Managed Airflow (Gen 3). A correct error message is now generated when an environment creation request fails because of malformed network and subnetwork identifiers.
Cloud NGFW - Enabling WildFire in an existing firewall endpoint can cause a temporary data plane outage. As a result, the WildFire feature is temporarily removed.
Cloud Run - Support for the Node.js 26 runtime is in Preview. Support for Budget spend caps to pause your Cloud Run workloads is in Preview.
Cloud SQL - Cloud SQL now supports significantly faster re-encryption of instances and replicas protected by customer-managed encryption keys (CMEKs), and re-encryption now completes with zero downtime. The steps to re-encrypt your instances and replicas are unchanged, but the operation now re-encrypts the underlying disks in-place, without creating re-encryption backups. For more information, see Re-encrypt an existing CMEK-enabled instance or replica. Starting on August 1, 2026, when you create or clone a Cloud SQL instance enabled with Private Service Connect, or when you enable Private Service Connect for an existing instance, then connection reconciliation behavior is enabled by default and can't be disabled. When you remove a project from the list of allowed projects, all existing Private Service Connect connections from the removed project are immediately closed (reconciled). This means that applications using Private Service Connect endpoints in those removed projects can't continue to connect to the Cloud SQL instance using those endpoints. For more information, see Allowed Private Service Connect projects.
Cloud Spanner - Spanner supports creating tables without defining primary keys. When you create a table without a primary key, Spanner creates a hidden rowid column that serves as the primary key. For more information, see Create a table without defining a primary key.
Compute Engine - The maximum IOPS per GiB for Hyperdisk Balanced Storage Pools have increased from 4 IOPS per GiB. The new limits depend on the provisioning type: Standard performance: 30 IOPS per GiB Advanced performance: 6 IOPS per GiB For more information, see Limits for Hyperdisk Storage Pools. Hyperdisk Balanced volumes on C4D instances have increased maximum throughput limits for these machine types: c4d-*-96: 3,125 MiB/s (up from 2,800 MiB/s). c4d-*-192: 6,250 MiB/s (up from 4,800 MiB/s). c4d-*-384: 12,500 MiB/s (up from 10,000 MiB/s). For detailed performance limits, see Hyperdisk Balanced performance limits when attached to an instance.
Confidential VM - Starting August 2026, Confidential VM instances using AMD SEV-SNP might have longer boot times and performance changes due to a guest kernel migration and security updates. This issue is expected to be resolved by November 2026. Confidential VM instances using AMD SEV or Intel TDX aren't affected. Confidential VM instances with AMD SEV on C3D and C4D machine types now support configurations with more than 255 vCPUs.
Contact Center AI Platform - Extensive release description on the release page.
Dataform - Dataform deployments provide a centralized experience for creating and managing pipeline deployments connected to remote Git repositories. This feature is available in Preview.
Dataproc - New Managed Service for Apache Spark on Google Kubernetes Engine (formerly Dataproc on Google Kubernetes Engine) subminor image version: 3.5-dataproc-28 Key updates in this image version include: Conda channels: The new 3.5-dataproc-28 subminor image version doesn't have preconfigured Conda channels, and is mapped to default aliases (such as 3.5 and latest ). Impact: When creating clusters with 3.5-dataproc-28 or using default aliases ( 3.5, latest ), packages cannot be installed using Conda unless channels are manually configured during cluster initialization. Mitigation: If your workloads require preconfigured Conda channels, pin your clusters to the previous image versions before August 25, 2026. Default change schedule: All workloads must transition to image versions without preconfigured Conda channels after August 25, 2026 since the use of prior subminor versions with preconfigured Conda channels will be disallowed. You may need to delete and replace existing clusters After August 25, 2026, existing clusters created with images that have preconfigured Conda channels (even if cluster jobs don't use Conda to install packages) need to be deleted and replaced with new clusters created or recreated with images that don't have preconfigured Conda channels.
Datastream - You can now create a Datastream stream directly from the instance or database overview page in Spanner using the automated flow. For more information, see Create a Spanner stream using the automated flow. You can now replicate change data from Workday with Datastream. For more information, see Stream data from Workday. This feature is in Preview.
GKE new features - In version 1.36.2-gke.1498000 and later, GKE supports mixed-protocol Services of type LoadBalancer in general availability (GA). Mixed-protocol Services let both external (NetLB) and internal (ILB) passthrough Network Load Balancers handle simultaneous TCP and UDP traffic on a single IP address across IPv4, IPv6, and dual-stack environments. In GKE version 1.36 and later, GKE Dataplane V2 with NetworkPolicies supports up to 15,000 nodes per cluster, increased from the previous limit of 7,500 nodes. For clusters exceeding 5,000 nodes, contact Cloud Customer Care to request a quota increase. For more information, see Cluster size limits and requirements. GKE now supports opting out of the default kubernetes.io/arch=arm64:NoSchedule taint on Arm nodes in Standard node pools and in custom ComputeClasses. To opt out of the default taint, set the --node-architecture-taint-behavior gcloud CLI flag to NONE for a node pool or set the taintConfig.architectureTaintBehavior field to NONE for a ComputeClass. By configuring this behavior, you allow workloads that lack explicit Arm tolerations to be scheduled on Arm-based machine families (such as N4A and C4A). This is useful for running multi-architecture workloads or simplifying scheduling in mixed-mode clusters. For more information, see Configure the default Arm architecture taint. GKE Gateway and Inference Gateway now support Cross-Origin Resource Sharing (CORS). You can configure a CORS filter directly on an HTTPRoute resource by using the portable syntax standardized by Gateway API. This feature is available in Preview in GKE version 1.35 and later for the following GatewayClasses: gke-l7-rilb gke-l7-regional-external-managed gke-l7-global-external-managed For more information, see Configure Cross-Origin Resource Sharing.
KMS - Cloud KMS Autokey with same-project key storage (formerly known as Autokey for delegated key management) is generally available. Autokey with same-project key storage can be used on its own or alongside Autokey with dedicated-project key storage (formerly known as Autokey for centralized key management). For more information, see Enable Cloud KMS Autokey. To learn how to set guardrails to constrain how Autokey is used in your organization, see Control Autokey usage.
Load Balancing - Service load balancing policies ( serviceLbPolicy ) are now supported for regional external Application Load Balancers and regional internal Application Load Balancers. This feature enables advanced load balancing optimizations such as custom load balancing algorithms, auto-capacity draining, failover thresholds, and the ability to designate preferred backends for these load balancers. For more information, see Advanced load balancing optimizations. This feature is in Preview. Cloud Load Balancing introduces a new version of the Network Load Balancer—the global external passthrough Network Load Balancer, which is the global variant of the regional external passthrough Network Load Balancer. The load balancer is available in Preview. This load balancer variant solves use cases for Security Service Edge (SSE), DNS hosting, Adtech (real-time bidding), real-time communications (RTC), live streaming, and online gaming, among others. Global external passthrough Network Load Balancers are Layer 4 passthrough load balancers that distribute external traffic among backends (instance groups or network endpoint groups) that can reside in multiple Google Cloud regions. By using Google's global anycast IP routing, the global external passthrough Network Load Balancer steers user traffic to the closest region with healthy backends and available capacity, delivering ultra-low latency and dynamic cross-region failover to ensure resilience to regional outages. The load balancer provides you with two external IP addresses, each served by a disjoint and isolated global load balancing control and data plane server infrastructure (also known as an availability group ) to provide high availability. The load balancer supports TCP, UDP, ESP, GRE, ICMP, and ICMPv6 traffic and can handle both IPv4 and IPv6 traffic. You can deploy your backends in any of the following Google Cloud regions: North America: us-west1, us-west4, us-east4, us-east5 Europe: europe-west2, europe-west3 Asia: asia-southeast1, asia-south1, asia-northeast1 South America: southamerica-east1 Africa: africa-south1 Australia: australia-southeast1 Note that this release doesn't support GKE backends for the global external passthrough Network Load Balancer. For details on the new load balancer, see Global external passthrough Network Load Balancer overview.
Looker - Now available in preview ( Preview ), verified queries (also referred to as golden queries ) are predefined pairs of natural language questions and their exact, corresponding Looker Explore queries that act as verified standards of truth to teach your Explore data agent how to handle complex business requests without guessing. To enable verified queries, a Looker admin must turn on the Verified Queries setting on the Gemini in Looker admin page. The Conversational Analytics setting must also be enabled to use verified queries. From July 27 through July 30, 2026, the following features will be automatically enabled for Looker (original) instances running Looker 26.12. Complimentary Data Studio Pro licenses aren't available for Looker instances that are affiliated with Looker contracts that are signed after August 1, 2026. Looker admins now have the ability to configure a Looker instance to require multi-factor authentication (MFA) whenever a user tries to log in by using an email and a password. This feature is enabled by default. The custom calendar feature is now generally available. The Expression Assistant is now generally available. The Enhanced search feature is now generally available. Looker Continuous Integration (CI) now supports email alerts. When you create or edit a CI suite, you can enable the Enable email alerts toggle to specify email recipients and select which run statuses will trigger emails ( Failed, Error, Passed, or Cancelled ). For more information, see Set up alerting. The LookML Projects page has been updated with a more performant tabbed layout, which features three tabs: Models and Projects, Pending Projects, and Marketplace Projects. Now available in preview, the new Modern User Interface feature enables modernized layouts and design alongside new configuration settings for visualizations and dashboards. When this preview feature is enabled, users can apply a Modern visualization theme that features updated typography and modern, accessible color palettes for improved data legibility. Additionally, a new Modern dashboard style provides a high-density, streamlined design that optimizes data viewing and aligns with Google's latest design standards. Now available in preview, verified queries (also referred to as golden queries ) are predefined pairs of natural language questions and their exact, corresponding Looker Explore queries that act as verified standards of truth to teach your Explore data agent how to handle complex business requests without guessing. To enable verified queries, a Looker admin must turn on the Verified Queries setting on the Gemini in Looker admin page. The Conversational Analytics setting must also be enabled for verified queries to be used. When you chat in Gemini Enterprise with data agents that you create in Looker, agent responses now include charts and visualizations. The Insight Assistant now displays the process the assistant uses to generate the response, showing key details in your data that it used to generate the response, and listing the fields from your Explore that it used.
Marketplace Partners - We've added the city field to Customer Insights reports and Detailed Disbursements reports. For more information, see Customer Insights report fields and Detailed Disbursements report fields.
Secret Manager - Automatic rotation of regional Cloud SQL database credentials in Secret Manager is available in Preview. This feature lets you automatically generate secure passwords, update target Cloud SQL database instances (PostgreSQL or SQL Server), and rotate secret versions on a configured schedule without custom Cloud Run functions. For more information, see Automatic rotation of Cloud SQL secrets.
Security Command Center - For the Security Command Center Premium tier, you can enable AI Protection at the project level. Project-level activations include access to the AI security dashboard, AI threat detection, and AI vulnerability and misconfiguration findings. For more information, see Configure AI Protection. Version 1.2.0 of the Google SCC ITSM app and version 1.3.0 of the Google SCC SIR app have been released. To reflect this update, the ServiceNow integration guide is updated with the following changes: Added support for ServiceNow Yokohama, Zurich, and Australia versions. Added the following features: Mute and unmute findings Create mute rules Create Configuration Item (CI) lookup rules View the action log Updated setup instructions for Java KeyStore certificates. Added additional troubleshooting steps for maximum execution time exceeded errors, data collection issues, and ECC Queue timeout errors. For more information, see Sending Security Command Center data to ServiceNow. Agent Platform Vulnerability Assessment ( Preview ) scans for plaintext secrets, such as credentials, access tokens, and API keys, in customer-deployed Gemini Enterprise Agent Platform containers. For more information, see Agent Platform Vulnerability Assessment. Organizations that are enrolled in the data residency Preview program can update their organization's data residency and data encryption configuration. For more information, see Modify data residency or data encryption configuration. Version 1.2.0 of the Google SCC ITSM app and version 1.3.0 of the Google SCC SIR app have been released. To reflect this update, the ServiceNow integration guide is updated with the following changes: Support for ServiceNow Yokohama, Zurich, and Australia versions. Added the following features: Mute and unmute findings Create mute rules Create Configuration Item (CI) lookup rules View the action log Updated setup instructions for Java KeyStore certificates. Additional troubleshooting steps for maximum execution time exceeded errors, data collection issues, and ECC Queue timeout errors. For more information, see Sending Security Command Center data to ServiceNow.
Service Mesh - For the clusters using TRAFFIC_DIRECTOR implementation, IP auto-allocation with DNS Proxy is now supported in Rapid release channel.
Virtual Private Cloud - General Availability: You can use the Resolve subnet mask setting on a subnet to configure all attached Compute Engine instances with the same netmask as the subnet (instead of /32 ). Configuring larger instance netmasks lets compute instances discover the MAC addresses of other machines within the same subnet and directly communicate with them by using destination MAC addresses. For more information, see Compute instance netmasks.