#519 Issue
Sept. 7, 2026
Welcome to issue #518 August 31st, 2026
News
Google Cloud ConsultingOfficial BlogNew AI-powered quick assessments in Migration Center turbocharge modernization - New, AI-powered Quick Assessments in Migration Center deliver near-instant TCO modeling and automated service mapping.
GeminiOfficial BlogNow introducing Gemini Enterprise for Legal - Today, we’re bringing you Gemini Enterprise for Legal, part of our new suite of purpose-built industry solutions.
GeminiOfficial BlogNow introducing Gemini Enterprise for Financial Services - Announcing Gemini Enterprise for Financial Services, bringing Google’s agentic AI directly into the workflows of capital markets and corporate banking.
Google Kubernetes EngineOfficial BlogRayBringing gVisor sandboxes to distributed Ray clusters - By pairing Ray’s distributed runtime with gVisor, Ray on GKE can scale up to 100K sandboxes in 17.3 seconds, distributed over thousands of nodes.
AgentsAIFinOpsOfficial BlogFinOps for the AI era: New flexible billing and cost controls for agents - Expanding billing flexibility and new cost management tools for agent workloads across Google Cloud – spanning Gemini Enterprise app, Agent Platform, and developer tools like Google Antigravity and Android Studio.
NetworkingOfficial BlogSimplify your resilience testing strategy with Google Cloud Fault Injection Testing - Google Cloud Fault Injection Testing (FIT) can help you automate failure testing to ensure predictable behavior during disruptions.
Data AnalyticsKnowledge CatalogOfficial BlogUsing OKF with Knowledge Catalog to serve context for agents - Learn how Knowledge Catalog lets you share and govern access to an OKF bundle across an organization.
Gemini Enterprise Agent PlatformLLMGrok 4.6 available now on Gemini Enterprise Agent Platform - SpaceXAI’s advanced Grok 4.6 model is now available in Public Preview as a fully managed, serverless endpoint within Model Garden on the Gemini Enterprise Agent Platform. The integration provides developers with OpenAI-compatible APIs, enterprise-grade security, and native billing while supporting complex, long-running agentic tasks.
AgentsEventOfficial BlogYour chance to start building AI agents from the absolute basics - Want to build AI agents? Join Agent Valley, a free 5-week live learning series starting Sept 1. No ML background needed—RSVP at goo.gle/agent101!
Articles, Tutorials
Infrastructure, Networking, Security, Kubernetes
Agents AI Official Blog SecurityEmpowering autonomous agents with advanced security governance - To be useful and secure, AI agents need access — and also guardrails.
GCP Experience Networking Official BlogHow Uber improves network reliability while unblocking cloud migration - Uber and Google Cloud co-developed Application Awareness on Interconnect (AAI) to prioritize critical traffic, ensuring network reliability for their hybrid cloud migration.
AWS Cloud Interconnect TerraformHow to set up Multi-Cloud Interconnect between AWS and GCP using Terraform - This article demonstrates how to set up a direct Multi-Cloud Interconnect between AWS and GCP using Terraform to achieve secure, bidirectional private-IP communication.
DevOps TerraformI Turned Three Weeks of gcloud Commands Into Terraform - Codifying a private backend, load balancer, reusable networking module, remote state, and a real drift experiment on GCP.
AI Kubernetes LLMDeploying GKE Inference Gateway Powered by llm-d: The Ultimate Guide to Model-Aware Routing on Kubernetes - How to eliminate GPU bottlenecks, unlock prefix cache hits, and achieve predictable Time-to-First-Token (TTFT) at scale.
AI KubernetesNative CORS support on GKE Gateway: Offloading cross-origin policy management to infrastructure
Infrastructure Secure Web ProxySecuring Centralized Egress: A Deep Dive into GCP Secure Web Proxy (SWP) & PSC with TLS Inspection - This article provides a technical guide on securing centralized internet egress in Google Cloud using Secure Web Proxy combined with Private Service Connect and TLS inspection. It explains how to set up an enterprise multi-VPC architecture that dynamically mints certificates to perform Layer 7 path-based filtering and deep packet inspection.
ADK Agents SecurityBringing Your Own Agents into SecOps SOAR Playbooks with Google ADK - This article explores a custom prototype integration that brings Google’s Agent Development Kit (ADK) directly into Google SecOps SOAR playbooks. It covers building autonomous agents and structured workflows capable of handling security investigations, RAG queries, code execution sandboxes, and multi-agent communication via the Agent-to-Agent (A2A) protocol.
App Development, Serverless, Databases, DevOps
Agents Compute Engine Infrastructure Official BlogInfrastructure for the AI era: Dynamic capacity management for agents - Learn how to build a flexible compute stack on Google Cloud to manage capacity wisely, reduce idle resources, and support AI workloads.
Agents Cloud Run ServerlessDeploy personal AI agents with Cloud Run instances - Cloud Run instances are cost-effective, dedicated, singleton compute runtimes designed to support long-lived workloads like personal AI agents.
Cloud Functions FirebaseServing a static site from a Cloud Functions seed bundle
Cloud StorageCloud Storage: Bucket Access, Evidence, and the Public-Exposure Problem - GCS buckets are both a common source of evidence and, misconfigured, one of the most common ways data actually leaves a GCP environment.
App Engine Cloud Run ServerlessDeploy your App Engine apps to Cloud Run in a single command - This article provides a step-by-step guide on how to seamlessly migrate and deploy web applications from Google App Engine to Cloud Run using automated CLI tooling. It explains how to assess application compatibility, handle legacy bundled services, and execute the deployment process with a single command to unlock modern serverless features.
Cloud Pub/Sub OracleOracle GoldenGate@Google Cloud CDC to Pub/Sub via Cloud Storage: A Step-by-Step Pattern - A practical guide to deploying managed GoldenGate in Google Cloud, with Oracle-to-Cloud-Storage-and-Pub/Sub as one implementation pattern.
Cloud Run PHP ServerlessAre Native PHP Binaries on Serverless for Real? Deployed It to Cloud Run — Here Are the Results - This article explores how compiling PHP code into a native standalone binary using TypePHP can drastically improve application performance on Google Cloud Run. By removing traditional interpreter and disk I/O overhead, the resulting serverless containers achieve significantly faster cold starts, microsecond response times, and a 90% reduction in image size.
Antigravity BigQuery FinOpsTracking Antigravity developer costs with BigQuery - Calculate per-user token costs for Antigravity with Cloud Logging and BigQuery Billing Export.
Big Data, Analytics, ML&AI
AI BigQueryA year of AI functions in BigQuery: the whole series in one place - This article explores a collection of built-in AI functions that Google Cloud has integrated directly into BigQuery over the past year.
BigQuery Google AnalyticsGA4 doesn’t send events in the order they happened. But the batch fields will tell you the truth! - When analyzing raw Google Analytics 4 data in BigQuery, simultaneous timestamps can make it difficult to determine the exact order of user actions due to device-level event batching. This article explains how to use three specific GCP export fields—`batch_page_id`, `batch_ordering_id`, and `batch_event_index`—to accurately reconstruct the true sequence of user behavior.
AI BigQuery FinOpsHow We Use AI to Lower Data Warehouse Query Costs
GemmaGemma in the Cloud - This article explores how to deploy a custom-trained Gemma 4 model within Google Cloud's Model Garden.
ADK AIHow to Evaluate Live & Voice Agents in ADK - Moving live voice agents from demo to production requires rigorous, automated testing to handle the unpredictability of real multi-turn conversations. ADK now provides native live evaluation, allowing developers to test graph-based agent workflows against LLM-driven simulated users that generate actual audio via Gemini TTS.
Cloud Storage MCPArchitecting Secure Enterprise AI Agents with MCP Toolbox - Build secure AI agents using MCP Toolbox, protecting both structured and unstructured data for reliable enterprise production systems.
Gemini Model ArmorHow to wear Model Armor 3: How you protect sensitive data from LLM. Do you need to? - Discover when to scrub sensitive data in GenAI agents and when to allow it using Google Cloud Sensitive Data Protection and Model Armor.
Agent Gateway Model ArmorSecuring your agent in Agent Platform with Agent Gateway and Model Armor - The Gemini Enterprise Agent Platform is a managed ecosystem for developing, deploying, and managing enterprise-grade AI agents.
How We Built AutoPatch: An Autonomous CI/CD Remediation Agent Powered by Google Gemini & GCP - Turning failed GitHub Actions workflows into verified, ready-to-merge Pull Requests in under 30 seconds.
AI Google Kubernetes Engine TPUEnterprise-Grade Precision for Long-Context Multimodal Embedding Inference on Cloud TPU - Google Cloud has natively integrated TPU support into the vLLM serving engine, allowing developers to elastically scale high-demand embedding pipelines using Google Kubernetes Engine (GKE). To handle massive 15K+ token contexts for models like Qwen3-Embedding-8B, the engineering team implemented TPU-specific optimizations such as hardware-safe tensor alignment, JAX/XLA compilation pre-warming, and a hybrid StepPool architecture for chunked prefill management.
Various
AI StartupsReimagining work: How Pythian’s internal AI playbook delivers customer ROI - By proving a complete AI model internally first, Pythian drove a 3x surge in active user engagement and cut our database incident resolution times by 80%.
Slides, Videos, Audio
Kubernetes Podcast - #271 Kubernetes 1.37, with Dipesh Rawat.
GCP Bytes Podcast - #48 In this episode we discuss; Homelab, Anthropic Data Change, Windows NT B’Day,Google Pro Agentic Architect Cert, GDG Events, Google Spending Money, Social Media Caution, NSW Data Centre Regs, Intel CPU Market Share, Azure Ex-filtration, Mythos 5 Hacks OSS, Deepmind Exodus, Nvidia Money, Stripe to buy Openrouter, Gemini Flash 3.7, Agent Safehouse.
Releases
Application Integration - Upcoming authorization changes for integration runs Application Integration is updating how identities are handled for integration runs. Every run will act as either the person who triggered it or a run-as service account that you configure, and running an integration will require permission to act as that service account. Integrations that run without a person, such as those started by a schedule or an event, will need an explicitly configured run-as service account. Action might be required before the change takes effect. For guidance on identifying affected integrations and updating them, see Prepare for upcoming authorization changes.
Backup and DR Service - Backup vault support for Filestore instances encrypted with customer-managed encryption keys (CMEK) is now generally available (GA). When you back up Filestore instances to a CMEK-enabled backup vault, the backups are encrypted using the backup vault CMEK key. For more information, see Customer-managed encryption keys (CMEK), Back up Filestore instances to a backup vault, and Restore a Filestore instance from a backup vault.
BigQuery - You can now monitor the performance, adoption, latency, and costs of your data agents and their conversations by using Google Cloud Observability in BigQuery. This feature is in Preview. BigQuery data governance tags are supported in Terraform. This feature is in Preview. An Improper Input Validation vulnerability was discovered in the JDBC driver in BigQuery Data Transfer Service versions prior to May 1, 2026. An authenticated attacker could use crafted JDBC connection string parameters to achieve remote code execution in the connector container and escalate privileges in the tenant project. For more information, see the GCP-2026-056 security bulletin. You can now view real-time logs for your Python UDFs in Cloud Logging. This feature is generally available. Core graph processing for BigQuery Graph requires an Enterprise or Enterprise Plus edition reservation. Existing allowlisted users can continue to use Standard edition or on-demand billing until April 26, 2027, after which these billing models will no longer be supported for core graph processing. Graph measures will remain available in the Enterprise and Enterprise Plus editions and for queries run using on-demand pricing. Measures are not available in Standard edition. You can now train models using XGBoost version 2.1 by using the XGBOOST_VERSION option. BigQuery uses the XGBoost 3.1.0 library to load and make predictions on XGBoost models. This feature is generally available. The Data Engineering Agent is now HIPAA compliant. For more information, see HIPAA compliance on Google Cloud.
Chronicle - Unroll Processor for Data Processing Pipelines Google SecOps data processing pipelines now support the Unroll processor (event breaking). This processor allows you to split log entries containing arrays or slices of events into multiple individual log events prior to parsing and ingestion. Key details: Event Breaking Capability: Automatically expands log arrays into discrete log events. Pre-parsing Requirement: The Unroll processor requires structured data inputs. Raw string payloads must first be parsed using a Transform processor (e.g., set(body, ParseJSON(body)) ) positioned prior to the Unroll processor in the pipeline execution sequence. For details on configuring data processing pipelines and processors, see Set up and manage data processing pipelines. [Spotlight Feature] Mandiant Frontline Threats rule packs Curated Detections has been enhanced with additional Mandiant Frontline Threats detections for Linux, MacOS, and Google Cloud. The following rule packs have been added to the Content Hub: Mandiant Frontline Threats for Linux Mandiant Frontline Threats for MacOS Mandiant Frontline Threats for Google Cloud
Chronicle SOAR - Scheduled maintenance SOAR database and infrastructure maintenance is scheduled to take place during the standard maintenance window on Sunday, August 30. During this window, your system will experience a brief period of downtime. You don't need to take any action. Scheduled maintenance SOAR database and infrastructure maintenance is scheduled to take place during the standard maintenance window on Sunday, August 16. During this window, your system will experience a brief period of downtime. You don't need to take any action. Release 6.3.98 is now available for all regions. Release 6.3.99 is being rolled out to the first phase of regions as listed here. This release contains internal and customer bug fixes.
Chronicle Security Operations - Full release description in the release notes.
Cloud Architecture Center - (New guide) NCC Cross-Cloud Network with NVAs and regional failover: A reference architecture for including NVAs in an NCC deployment. This deployment allows for regional failover.
Cloud Build - An Incorrect Authorization vulnerability CVE-2026-19410, in GitHub Trigger Comment Control in Cloud Build, was fixed. No customer action is needed. You can now update access tokens from the Connection details page for your 2nd generation Bitbucket and 2nd generation Gitlab host connections. For more information, see the following: Rotate old or expired Bitbucket Cloud access tokens Rotate old or expired Bitbucket Data Center access tokens Rotate old or expired Bitbucket Server access tokens Rotate old or expired GitLab Enterprise Edition access tokens Rotate old or expired GitLab access tokens
Cloud Composer - Managed Airflow remote Model Context Protocol (MCP) server is now generally available (GA). Managed Airflow Agent is now available in Google Cloud Console. The agent can help you understand, diagnose, and resolve issues with failed Airflow tasks and DAG runs, optimize your environment's performance, identify existing or potential issues, bottlenecks, and areas for optimization. Orchestration Pipelines are now generally available (GA).
Cloud Logging - VM Extension Manager extension policies for the Ops Agent are Generally Available (GA). Extension policies provide zonal and project-wide Ops Agent installation, version upgrades, and configuration management. For more information, see Install and manage the Ops Agent by using VM Extension Manager policies.
Cloud Monitoring - VM Extension Manager extension policies for the Ops Agent are Generally Available (GA). Extension policies provide zonal and project-wide Ops Agent installation, version upgrades, and configuration management. For more information, see Install and manage the Ops Agent by using VM Extension Manager policies.
Cloud Run - Cloud Run instances are available in Preview. Instances are specifically designed for running long-lived and individually addressable workloads. To learn more, see the product overview, resource comparison, and instance lifecycle pages. Cloud Run instances are available in Preview. Instances are specifically designed for running long-lived and individually addressable workloads.
Cloud SQL MySQL - Cloud SQL now makes it easier to configure Private Service Connect for your Cloud SQL instance. When you create an instance that's enabled with Private Service Connect, you can choose to automatically create the service connection policy and endpoint in the VPC network that you want to use with Private Service Connect. For more information, see Configure Private Service Connect.
Cloud SQL Postgres - Use assessments ( Preview ) in Database Center to assess and test the performance impact of database recommendations before you apply them to your production database fleet. The assessments workflow performs these operations: Clones your database instance. Runs benchmarking simulation tests on the clone. Compares the baseline performance of the clone against the performance after you apply the recommended configuration changes. For more information, see Assessments in Database Center. The rollout of the following extension upgrades is complete: pg_partman is upgraded from 5.2.4 to 5.4.3. pgfincore is upgraded from 1.3.1 to 1.4. pgvector is upgraded from 0.8.1 to 0.8.5. For more information, see Configure PostgreSQL extensions. Cloud SQL now makes it easier to configure Private Service Connect for your Cloud SQL instance. When you create an instance that's enabled with Private Service Connect, you can choose to automatically create the service connection policy and endpoint in the VPC network that you want to use with Private Service Connect. For more information, see Configure Private Service Connect.
Cloud SQL SQL Server - Cloud SQL now makes it easier to configure Private Service Connect for your Cloud SQL instance. When you create an instance that's enabled with Private Service Connect, you can choose to automatically create the service connection policy and endpoint in the VPC network that you want to use with Private Service Connect. For more information, see Configure Private Service Connect.
Cloud Trace - The following remote MCP servers automatically generate a trace span for tools/call operations. Policy Troubleshooter Managed Service for Apache Airflow These spans can help you understand the behavior of your agentic applications. For more information, see Investigate MCP calls using Trace. You can manually create the _Trace observability bucket before your project receives trace data. When creating the bucket, you must specify a storage location. Google Cloud Observability applies the Cloud KMS key defined in your default settings unless you explicitly specify a different key in your create request. For more information, see the following documents: Create observability buckets Set defaults for observability buckets You can update the display name, description, and Cloud KMS key applied to a _Trace observability bucket. For more information, see Update observability buckets. The following remote MCP server automatically generates a trace span for tools/call operations. Datastream These spans can help you understand the behavior of your agentic applications. For more information, see Investigate MCP calls using Trace.
Compute Engine - Generally available: Red Hat Enterprise Linux (RHEL) images pre-configured with Logical Volume Manager (LVM) partitioning are available for Compute Engine in the Google Cloud console. LVM-enabled images let you manage volumes flexibly and size partitions dynamically on your boot disk. For more information, see Red Hat Enterprise Linux (RHEL). Generally available: Red Hat Enterprise Linux (RHEL) Extended Update Support (EUS) images are available for Compute Engine in the Google Cloud console. RHEL EUS images let you lock your VMs to a specific minor version while receiving critical security updates and bug fixes for up to two years. For more information, see Red Hat Enterprise Linux (RHEL).
Contact Center AI Platform - Full release description in the release notes.
Dataplex - Knowledge Catalog support for importing metadata from dbt Core and MetricFlow is available in Preview. You can use the gcloud alpha dataplex dbt metadata-jobs command to extract and import technical, semantic (MetricFlow), operational, data quality, and lineage metadata from dbt Core artifacts into Knowledge Catalog. For more information, see Import metadata from dbt Core and About metadata connectors.
GKE new features - In GKE version 1.36 and later, GCPAuthzPolicy and GCPAuthzExtension resources for GKE Gateway are now available in Preview. You can use these resources to enforce identity-based access control and zero-trust authorization on incoming traffic at the Gateway layer. These capabilities are supported on the following GatewayClasses: gke-l7-global-external-managed gke-l7-regional-external-managed gke-l7-rilb For more information, see Configure the GCPAuthzExtension resource. Network Endpoint Group (NEG) pre-provisioning is now available in Preview. With this feature, you can force the creation of empty zonal GCE_VM_IP_PORT NEGs in specified zones (or all zones within a region) during Service creation, regardless of whether the cluster has nodes in those zones. By extending the cloud.google.com/neg Service annotation with a custom zones parameter, you can seamlessly automate infrastructure deployments (such as attaching NEGs to backend services) without waiting for workloads to deploy. For more information, see Pre-provisioning empty NEGs.
Load Balancing - SSL policy cross-project referencing is now available for Application Load Balancers and proxy Network Load Balancers in Preview. You can use cross-project referencing to define and maintain a central SSL policy in an administrative project and reference it from target HTTPS proxies or target SSL proxies in different projects. Cross-project referencing is supported for global and regional SSL policies. You can use cross-project referencing with the following load balancers: Global external Application Load Balancer Regional external Application Load Balancer Cross-region internal Application Load Balancer Regional internal Application Load Balancer Global external proxy Network Load Balancer For more information, see Cross-project SSL policy referencing. For regional external passthrough Network Load Balancers, reserving specific or automatically allocated bring your own IP (BYOIP) IPv6 addresses before creating a load balancer, and promoting an ephemeral BYOIP IPv6 address in use by a load balancer to a reserved static IP address, is generally available (GA). For more information, see the following documentation: Set up a regional external passthrough Network Load Balancer with a backend service. Set up a regional external passthrough Network Load Balancer for multiple IP protocols Set up a regional external passthrough Network Load Balancer with zonal NEGs
Looker - Full release description in the release notes.
Service Mesh - Full release description in the release notes.
VMware Engine - VMware component updates: The VMware Engine operations team is updating vCenter Server and ESXi to version 8.0 Update 3k to address security vulnerabilities described in Broadcom Security Advisory VMSA-2026-0006. For details about the update and schedule, see the Latest service announcements.
VPC Service Controls - Preview stage support for the following integration: Cloud FTP
Virtual Private Cloud - General availability: You can reserve static external IPv6 addresses from bring your own IP addresses (BYOIP) sub-prefixes that are in EXTERNAL_IPV6_FORWARDING_RULE_CREATION mode. You can assign these addresses to forwarding rules for external passthrough Network Load Balancers and external protocol forwarding. You can also promote ephemeral IPv6 BYOIP addresses that are used by external forwarding rules to reserved static IP addresses. For more information, see Create external forwarding rules.