#524 Issue
Oct. 12, 2026
Welcome to issue #522 September 28th, 2026
News
Google Kubernetes EngineOfficial BlogGKE becomes more elastic: Scale to zero, save costs, and keep workloads responsive - Native GKE capabilities let you scale your workloads to zero so they stop consuming resources, and restart them quickly when demand returns.
AIGoogle Kubernetes EngineOfficial BlogScale your AI workloads faster and more efficiently with GKE Pod snapshots - New Google Kubernetes Engine (GKE) Pod snapshots save the running state of your workload, including CPU and GPU memory, and restore it on demand.
AIGoogle Kubernetes EngineOfficial BlogGlobal AI routing with <1% overhead on multi-cluster GKE Inference Gateway - We benchmarked a leading AI model on multi-cluster GKE Inference Gateway with a fleet of accelerators distributed across the US and Europe.
AgentsGoogle Kubernetes EngineOfficial BlogAn AI-assisted plugin for EKS-to-GKE migrations with built-in governance - The GKE agentic migration is an AI-assisted plugin with deterministic guardrails for moving from AWS EKS to Google Kubernetes Engine.
Google Kubernetes EngineMonitoringOfficial BlogScale your own way, using HPA with built-in support for PromQL metrics queries in GKE - With built-in support in GKE for processing Prometheus metrics, you can use expressive PromQL queries to customize autoscaling triggers.
Official BlogStrengthen your CI/CD pipeline with new Secure Source Manager capabilities - To help you better address software supply chain threats, our Secure Source Manager lets you manage your source and CI/CD systems with unified authentication and authorization mechanisms.
AlloyDBDatabasesOfficial BlogAlloyDB delivers PostgreSQL for agents: Real-time data at agent scale, with full workload isolation - AlloyDB now features a next-gen architecture that lets you scale PostgreSQL alongside millions of concurrent AI queries without impacting production.
Official BlogStorage Intelligence advisor: Know what changed in your storage estate and act on it - Updates to Storage Intelligence advisor and batch operations make it easier to surface and act upon insights into your Cloud Storage estate.
Chrome EnterpriseOfficial BlogSecure, intelligent experiences across every endpoint - Discover how Google Intelligent Endpoints enhance workforce productivity and enterprise security using agentic AI, Chrome Enterprise Premium, and next-gen devices.
AIAntigravityIntroducing Support for Local AI Models in the Antigravity SDK - The Google Antigravity SDK now empowers developers to execute offline, agentic workflows locally using models like Gemma 4 26B A4B via LiteRT. This update facilitates powerful hybrid orchestration architectures, allowing a cloud model to act as a lightweight planner while local models securely handle token-intensive tasks—like code auditing and patching—directly on-device. Furthermore, the SDK provides drop-in support for OpenAI-compatible inference servers like Ollama and vLLM, enabling the seamless creation of privacy-first, autonomous local utilities.
GeminiOfficial BlogPower your agents: Gemini 3.8 Live with Live Avatar is now generally available - Gemini 3.8 Live with Live Avatar is now available with US and EU endpoints, with provisioned throughput, enterprise compliance, and strict data governance. Try the model and its features in Gemini Enterprise, and start building now with API.
AIColabMachine LearningColab is now part of your Google AI plan - Unlock premium Google Colab compute with Google AI. Subscribers now get priority accelerators, Premium GPUs, and background execution for long training runs.
Cloud RunOfficial BlogQuadrantServerlessGoogle is a Leader in the 2026 Gartner Magic Quadrant for Container Management - Once again, Gartner named Google as a Leader in its 2026 Gartner® Magic Quadrant™ for Container Management, positioned highest Ability to Execute.
Articles, Tutorials
Infrastructure, Networking, Security, Kubernetes
Official Blog Threat IntelligenceProactive Defense: Hardening Code Pipelines and CI/CD Infrastructure - Establishing a foundational blueprint for securing the Software Development Lifecycle.
Official Blog Threat IntelligenceShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft - This follow-up report details how UNC6240 (ShinyHunters) is mass-exploiting Oracle PeopleSoft (CVE-2026-35273) by bypassing WAF rules via a single URL-encoded character, providing full analysis of the attack pipeline, observed post-exploitation activity, IOCs, and remediation steps.
Cloud Load Balancing Networking SecurityCertificate Manager: Zero downtime SSL certificate migration with LB authorization - This article introduces a hybrid migration pattern for Google Cloud that combines Certificate Manager and Google Public CA to achieve seamless, zero-downtime SSL/TLS certificate transitions. It provides a practical solution for large-scale cloud migrations by bypassing the need for restricted DNS access, preventing handshake failures, and automating long-term certificate lifecycle management.
DevOps IAM TerraformGCP IAM propagation lag and Terraform CI/CD - This article explores the challenges of Google Cloud Platform IAM propagation lag when running Terraform CI/CD pipelines, where newly created service accounts and permissions cause intermittent 403 and 404 errors due to eventual consistency.
NetworkingMastering GCP Multi-Org Hybrid Cloud DNS: Navigating Inbound Forwarding Patterns (Part 1) - This article explores the complex challenges of managing inbound DNS forwarding and resolution overlaps when scaling Google Cloud architecture across multiple organizations in a hybrid cloud environment.
NetworkingMastering GCP Multi-Org Hybrid Cloud DNS: Solving Outbound DNS and Asymmetric Routing Concerns (Part 2) - This article explores the challenges of outbound hybrid cloud DNS routing in multi-organization Google Cloud environments, specifically focusing on asymmetric routing conflicts caused by shared egress IP ranges.
IAM SecurityThe Cloud Guardrails : Mastering GCP Organization Policy - Why post-deployment alerts are failing your security posture, and how to stop missconfigurations before the API call even finishes.
App Development, Serverless, Databases, DevOps
Compute Engine Networking Official BlogHow Google Cloud Networking Supports Your Fluid Compute Choices for AI Workloads - Learn how Google Cloud networking supports fluid compute AI workloads across Standard VPC, GPUDirect-TCPX/TCPXO, RoCEv2 RDMA, Cloud TPU, and Cloud Run.
Databases Official BlogA new, no-compromises database architecture for the agentic era - Learn how this architecture delivers zero shared fate by design, predictable sub-millisecond storage I/O, and true zero-to-thousands compute scaling.
Cloud Memorystore Databases Official BlogUnlock 3x QPS and microsecond latency with Memorystore for Valkey 9.1 - Announcing Memorystore for Valkey 9.1 in General Availability. Achieve up to 3x QPS at microsecond latency for your most demanding caching workloads.
Agents AI MCPTurn your REST APIs into MCP tools with Google Cloud API Gateway - Google Cloud API Gateway now acts as a native remote Model Context Protocol (MCP) server, eliminating the need to build and maintain custom middleware to expose REST APIs to AI agents. By simply adding specific annotations (like x-google-api-management.mcp) to existing OpenAPI 3.x specifications, developers can instantly convert standard REST operations into discoverable, agent-ready tools.
AI BigQuery Cloud Run Data Science Machine LearningBring Jev to BigQuery with Cloud Run - Turn unstructured text into typed, queryable SQL columns with TypeSafe’s Jev model.
Separating metadata and prompt access for Antigravity logs - Role-based log access for Antigravity in Gemini Enterprise.
FinOps PythonWhat Nobody Is Using in Your Google Cloud Projects, and What It Costs - This article provides a step-by-step guide to building and running a local, read-only Python waste scanner for Google Cloud environments. It explains how the tool efficiently audits multiple projects to detect forgotten, idle resources—such as unattached disks and unused static IPs—and prices them using the Cloud Billing Catalog API.
Cloud FTPManaged SFTP on Google Cloud - This article explores Google Cloud's newly launched managed SFTP service, a feature designed to simplify how legacy systems ingest data into cloud storage. It provides a hands-on walkthrough of creating an SFTP server, setting up IAM-authenticated users, and connecting via an SFTP client to streamline ETL pipelines.
Cloud Load Balancing Cloud Run Cloud StoragePrivate GCS via Internal Load Balancers: No Client Auth Required - External Application Load Balancers can authenticate to a private Cloud Storage bucket. Internal ones can't. In this post you'll learn how to use traffic extensions with custom code on Cloud Run to create it yourself.
Big Data, Analytics, ML&AI
Cloud Dataproc Data Analytics Official BlogMaximizing Apache Spark availability: Mitigating compute stockouts with flexible VMs and other best practices - Configure flexible VMs on Managed Service for Apache Spark to prevent compute stockouts, optimize resource allocation, and protect pipeline SLAs.
BigQuery Data ScienceWhy I Reworked a BigQuery Sink from Pending Streams to Buffered Streams - This article explains how the Apache SeaTunnel data integration platform redesigned its BigQuery sink connector to improve reliability during failures.
AI Cloud Pub/Sub Data Analytics Machine LearningPub/Sub AI Bytes: Part 3 — Generate and edit SMTs with Gemini in seconds - Discover how the new Gemini integration in Google Cloud Pub/Sub allows data engineers to instantly generate, translate, and refine streaming Single Message Transforms using natural language.
Apache Beam Dataflow Paywall StreamingLessons From Streaming Pipelines on GCP - Batch forgives you. You can always re-run yesterday. Streaming doesn’t work like that.
BigQuery Billing FinOpsEliminate First: How We Architected a 60% + BigQuery Cost Reduction - From a struggling MySQL monolith to a high-performance, predictable-cost cloud analytics ecosystem.
AI BigQuery Data Science Machine LearningJev and BigQuery AI functions, from one row to ten million - Testing quality, latency, and cost across Jev and BigQuery’s AI Functions and how combining them in a model cascade gives the best of both.
AI Official BlogA guide to speeding up your video processing with AlphaEvolve - Today, we’ll show you how to use AlphaEvolve to speed up video processing—and apply these principles to your own performance bottlenecks.
GCP Experience Gemini Enterprise Agent Platform Official BlogScribd, Inc. classifies more than 400 million documents with Gemini batch inference on Gemini Enterprise - This past year, Scribd used Gemini's native PDF understanding and Gemini Enterprise batch prediction to run trust and safety classification across its entire user-generated content corpus of more than 400 million documents, spanning over 12 billion pages, in a matter of months.
Gemini Generative AI Official BlogBest practices guide for customizing Gemini models via Reinforcement Learning (RL) - In this guide, we will walk through practical best practices for using RL fine-tuning service. We'll start with a short tour of the RL training loop, how to decide if and when to use RL, and introduce how to get the most value from this approach.
Gemma LLM TPUGoogle's QAT Gemma 4 26B-A4B on One TPU v6e: 15.6x the KV Cache and 1.9x the Throughput of FP8 - This article provides a step-by-step guide to efficiently serving Google's quantization-aware-trained (QAT) Gemma 4 26B-A4B model on a single Google Cloud TPU v6e chip using vLLM.
AI JAX LLM TPUReproducing OLMo 3 7B Pre-training in MaxText: case study of large scale training on TPUs - The MaxText team successfully reproduced AI2’s OLMo 3 7B language model from scratch on Google Cloud TPUs using JAX/XLA, precisely matching the original PyTorch-on-GPU reference across pre-training and mid-training stages on all held-out evaluations. The implementation achieved up to 57.4% Model Flops Utilization (MFU) and demonstrated robust infrastructure portability by surviving mid-run cluster resizes and cross-generation TPU shifts without requiring recipe alterations.
Generative AI LLM Machine LearningHow to Run Open Models in the Cloud Without Going Broke - This article explores practical strategies for deploying open-weights machine learning models on Google Cloud’s Model Garden without incurring massive expenses. It highlights cost-saving techniques such as enabling scale-to-zero, leveraging spot virtual machines, and properly right-sizing hardware limits to make advanced cloud AI affordable for developers and smaller teams.
Cloud Run LLMHow to build a Jev-style classifier with DiffusionGemma and vLLM - Fast, calibrated routing on Cloud Run GPUs without fine-tuning.
Various
Business Official BlogHow growing Latin American midsize businesses are building in the AI era - Discover how midmarket companies across Latin America are leveraging AI to automate operations, scale lean teams, and compete globally.
AI Official Blog StartupsThe three things today's hottest startups are looking for in their AI stack - Top models, AI-specialized infrastructure, and an open, enterprise-grade platform to run training are essential components.
Slides, Videos, Audio
Agents Official BlogAgent Factory recap: Agent harnesses, shifting left, and autonomous coding - This article explores how to build and scale autonomous coding agents in production using modern agent harnesses, rich context curation, and fast inference models. It breaks down key engineering practices like shifting guardrails left into the development cycle, structuring reliable tooling, and leveraging the three-layer agent stack of models, harnesses, and knowledge.
GCP Bytes Podcast - #50 In this episode we discuss; Claude Control, 128gb RAM, Peak Vide Coding, AWS Regin Gone, Pixel 11 Pro Feature, Frankie AI, GDG, Self Managed GCVE, Oracle Layoffs, Smart Glasses, US Made Memory, Google Book, Obscurity Through Obscurity, Gitlab CVSS, AI Slowdown, Kamikaze Drown Swams, Gemini Hack, Anthropic in QLD, Grok4.7, GPT 6 Sol & Luna, Opus5.5, JEV, Plane Project Management.
Releases
API Keys - The API Keys remote Model Context Protocol (MCP) server is available in Preview. You can connect to the API Keys remote MCP server from AI applications to create, inspect, restrict, and manage the lifecycle of API keys in your Google Cloud projects. For more information, see the API Keys MCP reference.
Access Context Manager - Access Context Manager supports extended session length for Workforce Identity Federation. This feature is in Preview for Looker (Google Cloud core) customers. For more information, see Configure extended session length for Workforce Identity Federation.
AlloyDB - You can now use the AlloyDB Columnar Engine as a read-optimized, in-memory cache for HNSW vector indexes. This feature is generally available ( GA ). It accelerates vector search performance and increases queries per second (QPS) for vector workloads. For more information, see Accelerate queries with the Columnar Engine.
Apigee API Hub - Preview launch of AWS API Gateway and Azure API Management plugins API hub now includes two new built-in plugins for ingesting API metadata from third-party gateways: AWS API Gateway and Azure API Management. Both plugins are in Public Preview, extending API hub's multi-cloud governance to give you a single pane of glass across your Google Cloud, AWS, and Azure APIs. What's new Automated discovery and onboarding: Connect your AWS account or Azure API Management (APIM) service and API hub automatically discovers your existing deployed APIs and related metadata. Scheduled pull sync: A full metadata sync runs every 6 hours by default, with reconciliation (upserts and orphan deletes) to keep your catalog in sync with the source gateway. Optional near-real-time push sync: Deploy a customer-managed AWS Lambda function (for AWS API Gateway) or Azure Function (for Azure API Management) to relay control-plane change events to API hub in near real time. For sample deployment code, see the apigee-samples repository. For more information, see About plugins, Manage third-party plugins, and Create a plugin instance. Spec-to-deployment linkage and gateway revision tracking in API hub (GA) API hub now provides a first-class, bidirectional link between API specifications, operations, and the deployments that serve them, together with native tracking of the underlying gateway revision. What's new Direct visibility between specs and deployments: See exactly which API specification and operations are served by a specific deployment, and navigate from a spec to the deployments that serve it. Native gateway revision tracking: Deployments now capture and display their underlying gateway revision (for example, an Apigee proxy revision) via the new source_revision field on the Deployment resource. More accurate operation resolution: When multiple revisions expose overlapping operations (same method and path), API hub associates each operation with its specific specification instead of dropping duplicates. Multiple spec revisions per API: API hub can store multiple revisions of the same spec for an API deployed across different environments.
Apigee Hybrid - Full details on the release page.
Backup and DR Service - Beginning September 21, 2026, the Backup and DR API ( backupdr.googleapis.com ) is automatically enabled in a project whenever any of the following APIs are enabled: Compute Engine API ( compute.googleapis.com ) Cloud SQL Admin API ( sqladmin.googleapis.com ) AlloyDB for PostgreSQL API ( alloydb.googleapis.com ) Filestore API ( file.googleapis.com ) This update provides seamless access to enhanced backup and disaster recovery options with reduced onboarding friction. To avoid conflicts in environments where the API was intentionally kept disabled or where strict governance is required, automatic enablement respects existing controls: Resource usage restrictions configured using the constraints/gcp.restrictServiceUsage organization policy constraint. Assured Workloads folders with configured service boundary restrictions. Project-level or organization-level opt-out requests submitted before the launch date.
BigQuery - Lakehouse now supports Workday Data Lake as a remote catalog provider for cross-cloud data access ( Preview ). You can configure federated catalogs to query data stored in Workday Data Lake directly from Google Cloud using BigQuery or Apache Spark without migrating data or building complex ETL pipelines. For more information, see Set up cross-cloud connection for Workday Data Lake. The Query results pane in the BigQuery Studio query editor lets you view a short history of recent runs for a query, including multi-statement queries, without having to navigate to the Job history tab. This feature is generally available (GA). BigQuery generative AI functions now support the gemini-3.8-flash Gemini model. You can now publish a BigQuery data agent in Gemini Enterprise by registering the agent with Agent Registry and importing it using default Google-managed credentials. When BigQuery and Gemini Enterprise are in the same Google Cloud project and configured with a matching Agent Gateway region, you don't need to manually copy the Agent-to-Agent (A2A) JSON card or configure OAuth client credentials. These features are in Preview. In the BigQuery Studio query editor, the Query results table now keeps the row numbers visible on the left as you scroll horizontally. This helps you maintain context and track data across wide tables. This feature is generally available (GA).
Bigtable - You can use the Google Cloud console to create and manage protobuf schemas (schema bundles) for your Bigtable tables. You can also view schema bundle definitions in Bigtable Studio. This feature is generally available (GA). For more information, see Create and manage protobuf schemas.
Certificate Manager - You can now attach tags to Certificate Manager resources during creation. This feature is available in Preview. For more information, see Create and manage tags for Certificate Manager resources.
Chronicle - Google Cloud organization ID enrichment for direct ingestion Google SecOps now automatically enriches logs ingested through Google Cloud direct ingestion with the originating Google Cloud organization ID. Previously, direct ingestion did not include organization-level identifiers, requiring customers with multiple Google Cloud organizations to configure separate Cloud Logging sinks and feeds to distinguish their log sources. With this update, you can easily identify the source organization for each event, filter UDM searches, scope detection rules, and configure Data RBAC or Data Processing Pipelines across multi-organization environments without additional configuration. In UDM events, the organization ID appears automatically under metadata.base_labels.ingestion_kv_labels: key: "gcp_organization_id" value: "
Chronicle SOAR - Release 6.3.100 is now available for all regions. Release 6.3.101 is being rolled out to the first phase of regions as listed here. This release contains internal and customer bug fixes.
Chronicle Security Operations - Google Cloud organization ID enrichment for direct ingestion Google SecOps now automatically enriches logs ingested through Google Cloud direct ingestion with the originating Google Cloud organization ID. Previously, direct ingestion did not include organization-level identifiers, requiring customers with multiple Google Cloud organizations to configure separate Cloud Logging sinks and feeds to distinguish their log sources. With this update, you can easily identify the source organization for each event, filter UDM searches, scope detection rules, and configure Data RBAC or Data Processing Pipelines across multi-organization environments without additional configuration. In UDM events, the organization ID appears automatically under metadata.base_labels.ingestion_kv_labels: key: "gcp_organization_id" value: "
Cloud Architecture Center - Google Cloud infrastructure reliability guide: Added guidance about cross-region internal load balancing for multi-region deployments. Added links to guides about high availability and failover strategies for external load balancers. Updated block storage examples to use Google Cloud Hyperdisk instead of Persistent Disk. Refreshed architecture diagrams and product names.
Cloud Asset Inventory - The following resource types are publicly available through the ExportAssets, ListAssets, BatchGetAssetsHistory, QueryAssets, Feed, and Search ( SearchAllResources, SearchAllIamPolicies ) APIs. Google Cloud Migration Center migrationcenter.googleapis.com/Asset migrationcenter.googleapis.com/CostAssessmentJob
Cloud NGFW - You can now use Cloud NGFW Enterprise advanced threat prevention with cross-region internal Application Load Balancers ( Preview ). You can configure global network firewall policies with security profile groups to inspect incoming traffic targeting load balancer forwarding rules. This integration supports intrusion detection and prevention service and Advanced malware sandbox (WildFire) to protect workloads and backends. For more information, see Supported load balancers. This feature is available in Preview.
Cloud SQL - The C4 machine series is available for Cloud SQL for PostgreSQL Enterprise Plus instances in the following regions: asia-east2 — Hong Kong asia-southeast2 — Jakarta, Indonesia europe-west3 — Frankfurt, Germany europe-west4 — Eemshaven, Netherlands europe-west8 — Milan, Italy us-east5 — Columbus, Ohio, USA us-south1 — Dallas, Texas, USA us-west4 — Las Vegas, Nevada, USA The C4 machine series provides the following benefits: Supports fifth and sixth generation Intel Xeon Scalable processors. Offers a price-performance balance that makes it suitable for high-demand workloads.
Cloud Scheduler - Cloud Scheduler is available in the following locations: asia-south2 (Delhi, India) europe-west12 (Turin, Italy) northamerica-northeast2 (Toronto, Ontario, Canada)
Cloud Storage Transfer - Storage Transfer Service now supports filtering Amazon S3 source objects by storage class. You can specify a list of storage classes to include when creating or updating transfer jobs using the Google Cloud console, the gcloud CLI, or the REST API. For more information, see Filter source objects by storage class. Storage Transfer Service now supports filtering source objects using glob patterns with wildcard characters such as * and?. Glob filtering is supported for transfers from Amazon S3 and Microsoft Azure Blob Storage when configuring transfer jobs using the gcloud CLI or the REST API. For more information, see Filter source objects using wildcards.
Cloud Trace - The following remote Google Cloud MCP servers automatically generate a trace span for tools/call operations. Identity and Access Management Organization Policy Service Policy Analyzer Security Command Center Spanner Unified Maintenance These spans can help you understand the behavior of your agentic applications. For more information, see Investigate MCP calls using Trace. You can use Terraform to configure resources managed by the Observability API. For example, you can use Terraform to create and update observability buckets, create links on datasets, and configure default settings. For more information, see the following documents: Set defaults for observability buckets Create observability buckets Update observability buckets List buckets and manage datasets The Google Cloud CLI version 586.0.0 includes the following changes: Added create and update methods to the gcloud observability buckets command group. Promoted the gcloud observability commands from BETA to GA. For more information, see the gcloud observability reference pages. For example usage, see the guides that describe how to configure and manage observability buckets: Create observability buckets Update observability buckets List buckets and manage datasets
Compute Engine - As of September 15, 2026, NVIDIA P100 ( nvidia-tesla-p100 and nvidia-tesla-p100-vws ) GPUs have reached end of support (EOS) and are shut down. You can no longer create, launch, or access Compute Engine instances or other Google Cloud resources that use NVIDIA P100 GPUs. For information about migrating your workloads to supported GPU alternatives such as the G2 (NVIDIA L4) or G4 (NVIDIA RTX PRO 6000) machine series, see NVIDIA P100 end of support. NVIDIA T4 ( nvidia-tesla-t4 and nvidia-tesla-t4-vws ) and NVIDIA P4 ( nvidia-tesla-p4 and nvidia-tesla-p4-vws ) GPUs are deprecated and will reach end of support (EOS) on August 1, 2027. After August 1, 2027, you won't be able to create, launch, or access Compute Engine instances or other Google Cloud resources that run NVIDIA T4 or P4 GPUs. In addition, you can no longer purchase or renew 3-year committed use discounts (CUDs) for NVIDIA T4 or P4 GPUs. To transition your workloads to supported GPU models such as the G2 (NVIDIA L4) or G4 (NVIDIA RTX PRO 6000) machine series before the EOS date, see NVIDIA T4 end of support and NVIDIA P4 end of support. Preview: To protect standard snapshots from accidental or malicious deletion, Compute Engine retains deleted snapshots in the recycle bin for three days before permanently erasing the snapshots. For more information, see Retain deleted resources in the recycle bin. Generally available: New X5 series with 50% larger memory instances: Breaking the previous 32TB memory limit of the X4 memory-optimized machine type, a new X5 series introduces massive 48TB configurations. This empowers the largest SAP HANA and RISE with SAP customers to easily scale up their mission-critical databases on a single node.
Confidential VM - Support for Intel TDX on c4-standard-* machine types is generally available ( GA ).
Config Connector - Config Connector version 1.157.0 is now available. New Alpha Resources (Direct Reconciler): AIPlatformModel Manage Vertex AI models. APIHubExternalAPI Manage API Hub external APIs. NotebookInstanceV2 Manage Agent Platform Workbench instance. RedisClusterEndpoint Manage Memorystore for Redis Cluster endpoints. New Fields: NetworkServicesEdgeCacheService Added routeMethods and compressionMode support. Bug Fixes: NetworkConnectivityInternalRange Fixed continuous reconciliation loop and 400 error on NetworkConnectivityInternalRange when auto-allocation fields are set. Other: BeyondCorpClientGateway: Removed support for the deprecated BeyondCorp Enterprise client connector.
Contact Center AI Platform - Full details on the release page.
Dataform - The Dataform remote Model Context Protocol (MCP) server now supports pipeline authoring in development workspaces and Git repository operations. AI agents can create and list workspaces, search and edit files, commit changes and push commits to remote Git providers, update repository settings, and organize repositories in folders. For more information, see Use the Dataform remote MCP server and the Dataform MCP reference. This feature is generally available (GA).
Dataplex - Knowledge Catalog support for importing dbt metadata is now generally available and includes the following updates: You can import metadata from dbt Cloud job runs using the dbt Cloud interface, the dbt platform CLI, or the dbt Administrative API and webhooks. You can generate and import metadata artifacts from dbt Core 2.x and dbt Fusion in addition to dbt Core 1.x. You can import entry links ( --include-entry-links and --skip-bigquery-link ) to capture dbt lineage and semantic relationships and link materialized dbt nodes to physical BigQuery tables, and search related BigQuery entries using the lookupEntryLinks method. You can configure dbt metadata import jobs and search or view imported dbt entries using the Google Cloud console, the Google Cloud CLI, or the Dataplex REST API. For more information, see Import metadata from dbt Core. Data products now support configuring a default IAM role in an access group. The default role, once configured, is automatically granted on all packaged and supported assets in the data product. Data product owners can override the default role for individual assets. In addition, the assets table in a data product now shows the permission state of each asset ( Applied, Failed, or Unsupported ). For more information, see Create data products and Manage data products.
Document AI - Gemini layout parser model pretrained-layout-parser-v3.1-lite-2026-08-11 is in Preview. Custom extractor model pretrained-foundation-model-v3.1-lite-2026-07-15 powered by Gemini 3.1 Flash Lite LLM is available in Preview. This processor version supports fine-tuning and is serving multi-region locations in the US and EU. CMEK is not fully supported in all regions, support requires being allowlisted. Contact your Google Cloud account team for more information. For more information about available models, see the custom extractor page.
GKE new features - GKE ambient networking is now available in Preview through an allowlist. GKE ambient networking provides a simplified, sidecarless deployment model for a service mesh with Layer 4 capabilities. By moving proxy functionality to node-level components integrated into GKE Dataplane V2, ambient networking reduces resource overhead, eliminates workload restarts for proxy updates, and simplifies mesh lifecycle management. The Preview release supports single-cluster Layer 4 mesh capabilities using the Gateway API, which includes mutual TLS (mTLS), service discovery, Layer 4 traffic management, and Layer 4 telemetry. For more information, see Ambient networking overview and Prepare GKE ambient networking. GKE Standard clusters now support up to 512 maximum Pods per node, an increase from the previous limit of 256. Nodes configured for 257 to 512 Pods will now be allocated a /22 Pod CIDR block (1,024 IP addresses).
IAM - You can use System for Cross-domain Identity Management (SCIM) data as the source for both user and group claims in the OAuth sign-in workflows for Looker. You can also use Extended Session Length (ESL) when using SCIM. This feature is in Preview. For more information, see the following: SCIM provisioning for Workforce Identity Federation Configure SCIM with Microsoft Entra ID Configure SCIM with Okta Troubleshoot SCIM provisioning and synchronization You can use System for Cross-domain Identity Management (SCIM) data as the source for both user and group claims in the OAuth sign-in workflows for Looker. You can also use Extended Session Length (ESL) when using SCIM. This feature is in Preview. For more information, see the following: SCIM provisioning for Workforce Identity Federation Configure SCIM with Microsoft Entra ID Configure SCIM with Okta Configure SCIM with OIDC or SAML Troubleshoot SCIM provisioning and synchronization
KMS - Preview: Cloud EKM supports external key migration. For keys with the EXTERNAL or EXTERNAL_VPC protection levels, you can create new key versions with either of these protection levels. You can also change the protection level of existing external key versions to change how you access your existing key material with zero downtime and without reconfiguring your applications. For more information about migrating external keys, see Migrate external keys.
Looker - Looker now includes a Filters on Visualization Tiles preview feature that lets dashboard creators place filter controls directly on individual visualization tiles rather than only in the dashboard filter bar. Looker now displays an Authorize OAuth Connection dialog when users initiate an OAuth authorization flow for database connections. This dialog notifies users that authorizing the connection allows Looker to access data on their behalf, and that privileged Looker users—such as administrators and developers—may have visibility into their data (for example, when an administrator runs queries by using another user's active OAuth token during a sudo session). Looker now includes a long polling concurrency guard. This prevents issues where queries cause long poll requests that oversaturate Looker and cause Looker to freeze. If a query causes a long poll request, Looker will display the error message Query polling capacity reached. Please try again later. Beginning September 21, 2026, the following features will be automatically enabled for Looker (original) instances running Looker 26.16. The latest versions in the Looker (Google Cloud core) release channels are beginning deployment as follows: Latest version in the Rapid channel: Looker 26.16 Latest version in the Regular channel: Looker 26.14 Latest version in the No Channel channel: Looker 26.16
Network Intelligence Center - Connectivity Tests analyzes firewall policy rules that use Google Threat Intelligence data.
Security Command Center - The following Security Command Center finding category names from AI Protection have new names to clarify that AI Protection detects tuned models and to remove the legacy VERTEX_1P_ prefix: VERTEX_1P_TUNED_MODEL_DETECTED changes to TUNED_MODEL_DETECTED. VERTEX_1P_TUNED_MODEL_NOT_PROTECTED_BY_MODEL_ARMOR changes to TUNED_MODEL_NOT_PROTECTED_BY_MODEL_ARMOR. For more information about AI Protection findings, see AI Protection overview and AI Discovery service findings.
Service Extensions - Support for route and traffic extensions that use plugins is generally available (GA) for regional external Application Load Balancers and regional internal Application Load Balancers. For more information, see Supported Application Load Balancers for user-managed extensions.
Service Mesh - Full details on the relase page.
Workstation - Regional endpoints ( workstations. REGION.rep.googleapis.com ) are generally available (GA) for Cloud Workstations. Regional endpoints help you meet data residency requirements by routing and terminating HTTPS connections to the Cloud Workstations API within a specific region, keeping data in transit within your chosen regional boundary. Regional endpoints for Cloud Workstations are available in the following regions: asia-south1 (Mumbai, India, APAC) europe-west6 (Zurich, Switzerland, Europe) us-central1 (Council Bluffs, Iowa, North America) us-east1 (Moncks Corner, South Carolina, North America) us-east4 (Ashburn, Virginia, North America) us-east5 (Columbus, Ohio, North America) us-west1 (The Dalles, Oregon, North America) us-west4 (Las Vegas, Nevada, North America) You can also use the Google Cloud CLI gcloud workstations command group to configure regional endpoints. For more information, see Regional service endpoints and the Cloud Workstations REST API reference. Cloud Workstations is a covered product under Google Cloud HIPAA BAA.