#524 Issue
Oct. 12, 2026
Welcome to issue #523 October 5th, 2026
News
Official BlogSwiftIntroducing the Server Side Cloud Swift SDK - Google has introduced the official Server Side Cloud Swift SDK, enabling developers to build high-throughput backend services and cloud automation tools using Swift 6.2 and newer. The new SDK provides native, non-blocking access to over one hundred Google Cloud services with built-in compile-time concurrency checking and memory safety.
Cloud SpannerDatabasesOfficial BlogAnnouncing Spanner queues: Transactional messaging for agentic workloads and beyond - Spanner queues offer native transactional messaging embedded within Spanner, so creating a message is simply another write in your transaction.
Cloud SpannerDatabasesOfficial BlogSpanner Omni, now GA: A distributed, multi-model database that you can deploy anywhere - At GA, Spanner Omni is ready to power your most demanding production workloads in your on-premises data center or across clouds.
Google Kubernetes EngineOfficial BlogGKE CPU startup boost: Accelerate app starts without over-provisioning - Cut cold start times by up to 2x without over-provisioning. GKE CPU startup boost uses in-place pod resize to temporarily elevate CPU during boot.
Google Kubernetes EngineOfficial BlogAccelerating agentic RL and evaluation research velocity with 45x faster GKE Agent Sandbox - Learn about GKE Agent Sandbox optimized for RL, the Agent Sandbox RL orchestration SDK, and native integrations for popular RL gyms and harnesses.
Data Agent KitOfficial BlogData Agent Kit is now GA: Bring Google Data Cloud to any coding agent - Google Cloud has announced the general availability of the Data Agent Kit, a free suite of Model Context Protocol tools and open-source agent skills that connects popular coding agents directly to Google Data Cloud services.
Data AnalyticsEarth EngineOfficial BlogIntroducing Ask, a new Google Earth Engine feature to accelerate geospatial coding - Accelerate geospatial coding with the new Ask feature in Google Earth Engine. Use Gemini to write, debug, and optimize queries in the Code Editor.
Cloud StorageOfficial BlogEnabling Cloud Storage end-to-end checksums for improved data integrity and durability - End-to-end checksums in Cloud Storage SDK are now enabled by default, for continuous chain-of-custody from the application down to the disk platter.
Compute EngineOfficial BlogStorage-optimized Z4D machine family, now GA, is designed for IO-intensive workloads - Z4D VMs and bare metal instances are optimized for IO-intensive workloads that require large local storage capacity and high storage performance.
Data AnalyticsMCPOfficial BlogEmpower your agents with the Google Cloud CLI remote MCP server - Today, we’re expanding our ecosystem of managed remote MCP servers by introducing the Google Cloud CLI remote MCP server in preview.
Articles, Tutorials
Infrastructure, Networking, Security, Kubernetes
Official Blog Threat IntelligenceDefending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances - GTIG is tracking exploitation of critical vulnerabilities in Citrix NetScaler ADC NetScaler Gateway products.
Official Blog SecurityGoogle Cloud partners deliver new security agents and AI defenses with Gemini Enterprise - We're expanding our catalog of partner-built security offerings in the Gemini Enterprise ecosystem to help you leverage your full security context.
AI Official Blog Threat IntelligenceVulnerability Discovery and Exploitation Trends in the AI Era - GTIG investigated vulnerability disclosure and exploitation statistics and found that AI is measurably changing the pace of vulnerability discovery, exploitation, and the types of vulnerabilities being discovered.
AI Hypercomputer GCP Experience GPUAI21 achieves an 83% reduction in time-to-start for AI workloads with AI Hypercomputer - AI21 trains its models on AI Hypercomputer using GKE and Google Cloud A3 and A3 Ultra instances powered by NVIDIA H100 and H200 Tensor Core GPUs.
Official Blog StartupsCloud CISO Perspectives: How cybersecurity startups can win CISOs - Cybersecurity startups need to win CISOs to succeed. Here’s our top 3 tips to help you make that happen.
DevOps SREYour GCP Project Shipped Insecure by Default. Here’s How to Fix It Fast. - Convenience is attack surface with better marketing.
Google Kubernetes EngineRe-Architecting GKE: From Rigid Node Pools to Workload-Driven ComputeClasses - This article explores how to modernize Google Kubernetes Engine (GKE) environments by transitioning from rigid, static node pools to a dynamic, workload-driven model using namespace-scoped ComputeClasses.
Google Kubernetes Engine KubernetesKueue v0.20: What’s new? - The article explores the release of Kueue v0.20 on Google Kubernetes Engine, highlighting major new features designed to optimize multi-tenant AI clusters. Key updates include configurable preemptions for granular workload control, dynamic quota orchestration, advanced topology-aware scheduling, and elastic workload scaling.
SecurityNew to Google SecOps: |> WHERE Did Our Logs Go? - This article provides a practical guide on how to effectively use the WHERE pipe operator for data filtering when querying logs with SQL in Google Security Operations. It covers essential techniques such as handling case sensitivity, applying numeric ranges, using comparison operators like IN, and working with wildcards, regular expressions, and raw strings.
Google Kubernetes Engine Infrastructure KubernetesOne StorageClass, Two VM Generations - Running mixed-generation node fleets in Google Kubernetes Engine (GKE)—such as combining older N2 and newer N4 machine series—can lead to silent storage attachment failures due to asymmetric disk support. To solve this, platform engineers can leverage GKE's automated disk type selection and custom ComputeClasses to automatically match appropriate storage types to the correct VM generation.
DevOps SRE TerraformDetecting and Blocking Malicious DNS Queries on GCP - This article explores how to build an automated cybersecurity solution on Google Cloud Platform to detect and block malicious DNS queries in real time. It walks through a Terraform-managed architecture that uses Cloud DNS Armor, Pub/Sub, and Cloud Functions to instantly add threatening domains to a Response Policy Zone and neutralize command-and-control traffic.
App Development, Serverless, Databases, DevOps
Google Cloud Managed Lustre Official BlogDemocratizing Managed Lustre with lower cost and frictionless development - This article explores how Google Cloud Managed Lustre is transforming high-performance computing by combining cost-effective storage with high-speed parallel file capabilities. It highlights the new Dynamic Tier and performance optimizations that allow developers to handle everything from interactive coding to massive AI training within a single, unified environment.
Chrome Enterprise Official Blog SecurityThe future of browser-based security: Leveraging browser data for proactive defense - Discover how Chrome Enterprise Premium transforms the browser into a high-fidelity telemetry engine to defend against Shadow AI and agentic risks.
Agents AlloyDB Cloud Memorystore Databases Official BlogHow to implement long-term AI agent memory in AlloyDB and Memorystore for Valkey - Learn how to implement long-term AI agent memory with a 2-tier memory architecture using Memorystore for Valkey and AlloyDB AI.
FirebaseNew regions and networks: Firebase Phone Number Verification adds more networks - Firebase Phone Number Verification is an advanced, phishing-resistant authentication method that replaces traditional SMS OTPs with secure, tap-to-consent SIM-based verification. The article announces the expansion of its network coverage to 10 new carrier networks across multiple countries, including major providers in Europe and Asia.
Firebase SREGoogle Analytics for Firebase iOS SDK outage on September 28, 2026 - This article explains how a routine configuration cleanup in the Google Analytics for Firebase SDK accidentally caused widespread iOS app crashes. It details the two-hour outage, the engineering team's response, and the specific process improvements Google is implementing to prevent similar stability issues in the future.
Agents FirebaseThe Firebase plugin is now available in Codex - Google has released a new Firebase agent plugin for Codex, designed to seamlessly integrate Firebase services into your AI-assisted coding workflows. The plugin bundles essential agent skills, CLI tools, and MCP servers to enable Codex to automatically provision databases, configure authentication, and write secure rules.
Cloud Run DevOps Python ServerlessCloud Run CPU Throttling: Unraveling Serverless Performance Mysteries - This article explores the hidden performance pitfalls of Google Cloud Run's default CPU throttling model, particularly how it freezes post-response background tasks in applications like FastAPI.
Apigee LLMPer-User LLM Spend Capping on Apigee X - This article explores a comprehensive technical solution for enforcing per-user financial spending caps on Large Language Models using Apigee X on Google Cloud.
Big Data, Analytics, ML&AI
Data Analytics GCP Experience Official Blog Serverless SparkAccelerating analytics: PayPal’s journey with Managed Service for Apache Spark - Learn how PayPal migrated analytics workloads to Managed Service for Apache Spark on Google Cloud to scale and reduce operational costs.
AI TPUAccelerating Spatio-Temporal Attention for Video Diffusion on TPUs - To address the quadratic latency bottleneck of self-attention in high-resolution video diffusion models, developers implemented Sparse VideoGen (SVG) to dynamically route attention heads to highly structured spatial or temporal sparse masks. Translating this algorithmic sparsity into physical hardware speedups on TPUs required optimizing the Splash Attention kernel by bypassing empty memory tiles, restricting exact coordinate masking strictly to boundary tiles, and permuting token memory layouts into temporal-major order for contiguous access.
FinOpsGoverning LLM Spend on Google Cloud: The Three Levers - What the platform measures, what it alerts on, what it refuses, and the gap that is left for you.
ADK AgentsCreate an Agent that Remembers with Agent Platform Memory Bank - Discover how to build persistent, context-aware AI agents using the Google Cloud Agent Platform Memory Bank and the Agent Development Kit (ADK).
ADK Generative AI Official BlogGraph Workflows in ADK: Everything You Need to Know - This article explores graph workflows within the Agent Development Kit (ADK) on Google Cloud, using a practical refund example to demonstrate how developers can build efficient, automated processes.
AI DevOpsEnforcing Per-User AI Spend Limits on Google Cloud Vertex AI - Google Cloud gives you project-level quotas. Here is how to build per-user budget enforcement when that is not enough.
AI Cloud Pub/Sub Data Analytics Machine LearningPub/Sub AI Bytes: Part 4 — High-throughput ingestion for large-scale model training - This article explores how frontier AI labs utilize serverless Google Cloud Pub/Sub to build high-throughput, zero-ops telemetry firehoses for large-scale model training across GPUs and TPUs.
Gemma LLM TPUGemma 4 QAT on One TPU v5e: What Runs and What Doesn't - This article explores a step-by-step guide for repacking Google's Quantization-Aware-Trained (QAT) Gemma 4 weights to efficiently serve models up to the 12B and 26B sizes on a single Google Cloud TPU v5e chip.
Various
AI GCP CertificationCertification — How to Prepare for Google Cloud Professional Agentic Architect - This article serves as a comprehensive preparation guide for the Google Cloud Professional Agentic Architect certification exam.
Gemma LLM Official Blog StartupsWhy your startup needs open models alongside frontier APIs - With more than one billion downloads across the developer community, Gemma 4 is Google’s most capable open model family to date, with myriad applications available to diverse startup use cases.
AI Official Blog Public SectorDefending at machine speed: Securing the public sector in the agentic era - Learn how public sector organizations are using Google AI to move from reactive to autonomous, machine-speed defense.
Releases
API Gateway - Configure streaming for LLM responses and other traffic You can now create API Gateway gateways that stream requests and responses instead of buffering them. This Public Preview feature supports incremental response delivery over HTTP/2 or HTTP/1.1 chunked transfer encoding, Server-Sent Events (SSE), WebSockets, and gRPC bidirectional streaming. A common use is streaming token-by-token responses from a large language model (LLM). To enable streaming, create a gateway with the --enable-streaming flag. The streaming mode is fixed when you create the gateway and can't be changed later. For more information, see Configure streaming for LLM responses and other traffic. Authenticate MCP tool discovery with an API key API key authentication is now supported for the Model Context Protocol (MCP) tools/list method. You can name an API key security scheme in tools-list.security, in addition to a JWT security scheme. For more information, see Configure Model Context Protocol.
Agent Assist - Agent Assist offers companion agent in General Availability (GA). Companion agent unifies real-time agent assistance into a single interface that operates in both proactive and on-demand modes: Proactive guidance: Monitors live customer conversations to surface context-aware next-best-action recommendations and follow configured instructions. On-demand assistant ( StreamingReactiveCompanionSuggestions ): Enables human agents to ask natural-language questions in an interactive panel and receive streamed, source-cited answers grounded in conversation context. Tool execution and grounding: Connects to data store tools, OpenAPI tools, custom tools, and Grounding with Google Search to retrieve live data and automate tasks, with built-in human-in-the-loop confirmation for state-modifying actions. Companion agent is available across supported Agent Assist regions with default resource allocation and token quotas.
Apigee API Hub - Service type system attribute (GA) API hub now includes Service type, a system attribute that classifies an API as Code, Model, Agent, or Skill. Service type describes what a service is. API style describes how you call it. Use Service type to find and govern your APIs, agents, models, and skills. Set Service type when you register or edit an API. To show only your agents, filter the API list by Service type, or select the new Agent chip. In the API, use the service_type field. This feature is Generally Available (GA). For more information, see Supported system attributes. AI performance and Tool performance dashboards in API insights API insights in API hub now includes two dashboards for AI and agent traffic: AI performance reports token usage and model latency for the large language models called through your gateways, with filters for model and provider. Tool performance reports traffic, throughput, payload sizes, and latency for your Model Context Protocol (MCP) tools, with filters for MCP server, deployment, and tool name. For more information, see API insights dashboards.
Apigee Hybrid - Full details on the release page.
AppEngine Standard - App Engine permanently blocks insecure traffic with TLS version 1.1 and earlier. For appspot.com domains, this block occurs at the connection level. For custom domains, the connection might succeed, but the requests are blocked. For more information, see Secure minimum TLS.
Application Integration - A Confused Deputy vulnerability was discovered in the Email Task component in Application Integration versions prior to June 30, 2026. For more information, see the GCP-2026-066 security bulletin. A Deserialization of Untrusted Data vulnerability was discovered in the JavaScript Task in Application Integration versions prior to June 28, 2026. For more information, see the GCP-2026-065 security bulletin. An Incorrect Authorization vulnerability was discovered in the task configuration in Application Integration versions prior to June 17, 2026. For more information, see the GCP-2026-064 security bulletin.
Backup and DR Service - Support for backing up and restoring workloads managed via the legacy appliance management console is deprecated. Key milestones for this deprecation include the following: End of Support for New Backups: After September 30, 2027, you will no longer be able to run new backups using the legacy stack. End of Standard Restores: Support for standard restores, exports, and migrations using the legacy appliance management console continues till March 31, 2028. For more information, see Deprecations.
BigQuery - The BigQuery Data Transfer Service MCP server is now Generally Available (GA). You can now write the output rows produced by BigQuery continuous queries directly into Apache Iceberg managed tables. This lets you continuously process streaming data from BigQuery and write it into your open-format lakehouse by using an INSERT DML statement. The AI.KEY_DRIVERS function is now generally available (GA). You can use the AI.KEY_DRIVERS function to identify segments of data that cause statistically significant changes to a summable metric. You can query the INFORMATION_SCHEMA.FAILOVER_HISTORY view to retrieve a near real-time list of failover events for reservations within an administration project that use managed disaster recovery. This feature is now in ( Preview ). You can now use the OBJ.LIST function to perform spontaneous discovery and analysis of unstructured data. The OBJ.LIST function returns a table of metadata and ObjectRef values for files stored in Cloud Storage, and does not require you to create a persistent object table. This feature is generally available (GA). The BigQuery Security center is now available in the Google Cloud console. You can use the Security center to analyze your data security profile, create and manage row- and column-level security policies, and configure and manage data governance and policy tags. This feature is generally available (GA). You can now view the UPDATE, DELETE, MERGE, and EXPORT execution steps in your query plans. BigQuery jobs explorer layout and filtering improvements, including status counts in the filter bar, resource grouping, and timeline metric charts, are generally available (GA). Chatting with graphs in conversational analytics is now generally available. You can use a combination of multiple graphs, tables, views, and UDFs as data sources. BigQuery pipelines provides support for automated metadata enrichment and Knowledge Catalog data quality scorecard integration. In addition, the Data Engineering Agent can proactively generate semantic metadata for your pipeline assets. For more information, see Metadata enrichment and data quality scorecard integration. These features are generally available. An updated version of the Simba JDBC driver for BigQuery is now available. The Rust SDK for BigQuery is now generally available (GA). The Data Engineering Agent now supports the gemini-3.7-flash model for the us, eu, and global multi-regional endpoints.
Bigtable - You can use Google Cloud Data Agent Kit to browse Bigtable instances and tables, design schemas, and run GoogleSQL queries from your IDE or coding agent. This feature is generally available (GA). For more information, see Data Agent Kit is now GA: Bring Google Data Cloud to any coding agent.
Chronicle SOAR - Release 6.3.101 is now available for all regions. Release 6.3.102 is being rolled out to the first phase of regions as listed here. This release contains internal and customer bug fixes.
Chronicle Security Operations - Expanded read-only permissions for Chronicle API Restricted Data Access Viewer Google SecOps has updated the predefined Chronicle API Restricted Data Access Viewer ( roles/chronicle.restrictedDataAccessViewer ) IAM role to include all read-only permissions available in the Chronicle API Viewer ( roles/chronicle.viewer ) role, excluding global data access ( chronicle.globalDataAccessScopes.permit ). With this update, users assigned to roles/chronicle.restrictedDataAccessViewer IAM role will have read-only access across Google SecOps features—including SOAR cases and playbooks, investigations, threat collections, findings, security validation, and ingestion resources within their assigned data access scopes. For more information, see Configure data RBAC for users.
Cloud Architecture Center - Design an optimal storage strategy for your cloud workload: Updated the specifications for capacity limits, scaling, sharing, encryption, availability, and performance. Added design options for Google Cloud Managed Lustre. Updated block storage recommendations for Google Cloud Hyperdisk and Persistent Disk, including multi-writer and regional high-availability options. Updated file storage recommendations to include the Google Cloud NetApp Volumes Flex Unified service level. Added recommendations for using Rapid Bucket and the Rapid storage class in Cloud Storage.
Cloud Asset Inventory - The following resource types are publicly available through the ExportAssets, ListAssets, BatchGetAssetsHistory, QueryAssets, Feed, and Search (SearchAllResources, SearchAllIamPolicies) APIs. Agent Identity API agentidentity.googleapis.com/AuthProvider
Cloud Interconnect - Network Connectivity Center (NCC) support for Partner Cross-Cloud Interconnect for Amazon Web Services (AWS) is Generally Available.
Cloud Logging - The legacy Logging agent has officially reached its end of support. All standard maintenance and regular bug fixes for the agent have ceased. We recommend migrating to one of the supported alternatives. For more information about this deprecation, see Legacy Monitoring and Logging agents end of support. Only platform services can write log entries to billing accounts. These logs have names with the format billingAccounts/[BILLING_ACCOUNT_ID]/logs/[LOG_ID]. For more information, see entries.write.
Cloud Monitoring - The legacy Monitoring agent has officially reached its end of support. All standard maintenance and regular bug fixes for the agent have ceased. We recommend migrating to one of the supported alternatives. For more information about this deprecation, see Legacy Monitoring and Logging agent end of support. The application topology graph is now generally available (GA). This graph helps you to understand relationships between applications, services, and workloads, and shows you traffic flow and incidents in the context of your applications.
Cloud NAT - Preview: Cloud NAT gateways for Private NAT support source-based NAT rules for IPv4 addresses. General Availability: Cloud NAT gateways for Private NAT support IPv6 to IPv4 network address translation. For more information, see NAT64 in Private NAT.
Cloud PubSub - You can use Gemini Enterprise to generate code for user-defined function (UDF) single-message transforms (SMTs). For more information, see Create a UDF SMT.
Cloud Run - Create custom URLs, like example.cloud.run, that are easy to remember and globally available for your Cloud Run services. No DNS configuration, load balancers, or extra costs required ( Preview ). Support for specifying custom target CPU or concurrency utilization using scaling controls is in General Availability (GA).
Cloud SQL MySQL - Cloud SQL for MySQL 8.4.10 is upgraded to MySQL 8.4.11. For more information, see the MySQL 8.4.11 Release Notes and Cloud SQL database versions. To improve security, removed the cloudsql.instances.export permission from the following roles: Cloud SQL Viewer ( roles/cloudsql.viewer ) Basic Reader ( roles/reader ) Basic Viewer (Legacy) ( roles/viewer ) To retain export capabilities, assign the Cloud SQL Editor ( roles/cloudsql.editor ) role or update custom roles to include the cloudsql.instances.export permission. For more information, see Cloud SQL roles. Cloud SQL for MySQL 9.7.1 is upgraded to MySQL 9.7.2. For more information, see the MySQL 9.7.2 Release Notes and Cloud SQL database versions.
Cloud SQL Postgres - To improve security, removed the cloudsql.instances.export permission from the following roles: Cloud SQL Viewer ( roles/cloudsql.viewer ) Basic Reader ( roles/reader ) Basic Viewer (Legacy) ( roles/viewer ) To retain export capabilities, assign the Cloud SQL Editor ( roles/cloudsql.editor ) role or update custom roles to include the cloudsql.instances.export permission. For more information, see Cloud SQL roles. You can use the pgAudit extension to prevent string literals that might indicate sensitive information, such as passwords and secrets, from appearing in your log query results. This release provides minor bug fixes to the previous version. This pgAudit extension capability is supported on [PostgreSQL version].R20260712.01_RC31 or later. For more information, see Audit for PostgreSQL using pgAudit.
Cloud SQL SQL Server - To improve security, removed the cloudsql.instances.export permission from the following roles: Cloud SQL Viewer ( roles/cloudsql.viewer ) Basic Reader ( roles/reader ) Basic Viewer (Legacy) ( roles/viewer ) To retain export capabilities, assign the Cloud SQL Editor ( roles/cloudsql.editor ) role or update custom roles to include the cloudsql.instances.export permission. For more information, see Cloud SQL roles.
Cloud Scheduler - Cloud Scheduler is available in the following locations: asia-south2 (Delhi, India) europe-west12 (Turin, Italy) northamerica-northeast2 (Toronto, Ontario, Canada)
Cloud Storage - Cloud Storage client libraries now provide automated, end-to-end checksumming by default for object read and write operations to help maintain data integrity from client to storage. For more information, see data validation.
Cloud Storage Transfer - Storage Transfer Service now supports transferring data from multiple containers within a Microsoft Azure Storage account in a single transfer job. For more information, see Transfer all containers in an Azure Storage account.
Cloud Tasks - Cloud Tasks support for the following is generally available (GA): Set retry parameters when creating a task and override the queue-level retry configuration for the task. Create a batch of tasks and add the batch to an existing queue. Delete a batch of tasks from a queue.
Compute Engine - Allowlisted GA: You can expose the host ID of a Compute Engine instance to verify its physical location in relation to other compute instances in your Google Cloud organization. Use compute instance proximity in a zone to optimize latency-sensitive workloads or improve the reliability of your applications. For more information, see View the physical location of a Compute Engine instance. Generally available: The C4D machine series supports Hyperdisk Throughput. For more information, see About Hyperdisk Throughput and Hyperdisk Throughput performance limits. Interface-based versioning (IBV) for the Compute Engine API is now generally available. IBV lets you call a specific, date-based API version so you can adopt API changes on your own schedule. For more information, see Compute Engine API versioning. Generally available: Compute Engine API version 2026-09-01 is now generally available. In this version, aggregatedList methods return partial results by default when a scope is unreachable. The returnPartialSuccess query parameter is no longer available in aggregatedList and list methods. For more information, see the 2026-09-01 REST reference. Preview: Compute Engine API version 2026-10-01-preview is now available in Preview. In this version, the quotas field is no longer available in responses from the projects.get, regions.get, and regions.list methods. To view and manage quota information, use the Cloud Quotas API. For more information, see the 2026-10-01-preview REST reference. Generally available: You can create a standard or archive snapshot of a disk and protect the snapshot with a customer-managed encryption key (CMEK), even if the source disk isn't protected with a CMEK. If the source disk is protected with a CMEK, then you can use a different CMEK to encrypt the new snapshot. For more information, see Create a CMEK-encrypted snapshot. Generally available: You can specify a 120-second preemption notice duration while creating Spot VMs. Use this feature for workloads on Spot VMs where you want up to an additional 120 seconds for handling preemption. If you want to migrate existing Spot VMs workloads, make sure you update your workload to handle preemption outside of a shutdown script and test preemption. For more information, see Spot VMs and Create and use Spot VMs.
Contact Center AI Platform - Full details on the release page.
Dataform - Extended access options and user credentials authentication for running and scheduling Dataform workflows are now generally available (GA). Dataform provides support for automated metadata enrichment and Knowledge Catalog data quality scorecard integration for Dataform workflows and BigQuery pipelines. For more information, see Add metadata for Knowledge Catalog. This feature is generally available.
Datastream - Datastream now supports partial backfill for SQL Server, Spanner, Oracle, PostgreSQL, and MySQL sources. Partial backfill lets you load a specific subset of data from the source into the destination by providing a SQL WHERE clause as a custom filter. For more information, see Initiate partial backfill.
Eventarc - Eventarc support for creating triggers for direct events from Firebase Authentication is available in Preview.
GKE new features - The storage-optimized Z4D machine series is available with GKE clusters running 1.36.3-gke.1244000 or later. You can use Z4D machine types in Standard or Autopilot mode. For more information about limitations for this machine series in GKE, see About machine support with GKE clusters. GKE now automatically applies protection tier labels to TPU node pools created from Compute Engine reservations. Depending on your configuration, GKE adds: Node pool resource label: goog-gke-node-pool-protection-tier ( standard or capacity_optimized ) Kubernetes node label: cloud.google.com/protection-tier ( STANDARD or CAPACITY_OPTIMIZED ) To learn more, see Automatically applied labels. You can use Vertical Pod Autoscaler (VPA) with Horizontal Pod Autoscaler (HPA) to automatically optimize container CPU requests for workloads that scale replicas based on CPU utilization. This feature is available in Public Preview on clusters running GKE version 1.36.3-gke.1630000 or later. For more information, see Rightsize HPA workloads with VPA.
Load Balancing - Zonal network endpoint groups (NEGs) with GCE_VM_IP and GCE_VM_IP_PORT endpoints support IPv6-only endpoints that reference IPv6-only or dual-stack Compute Engine VM network interfaces. This feature is available in Preview. For more information, see Zonal network endpoint groups overview. A new quota system governing the configuration size of Application Load Balancers is now generally available. This update increases the individual URL map size limit from 64 KB and 128 KB to 1 MB. For more information, see URL map size and quota units. Key aspects of this feature include: Complexity-based quota: Quota units reflect URL map complexity (number of rules, hostnames, and path matchers). Scoped measurement: Quota is measured and enforced on a per-project, per-region, or per-VPC depending on Application Load Balancer type. Active consumption: Only URL maps currently referenced by forwarding rules contribute to quota usage. New URL map size limit: Projects enabled for the new quota have a new URL map size limit increased to 1 MB for global and regional external and internal Application Load Balancers. Classic Application Load Balancers remain restricted to 64 KB. For more information on increasing your limit, please contact Google Cloud Support.
Looker - The latest versions in the Looker (Google Cloud core) release channels are beginning deployment as follows: Latest version in the Rapid channel: Looker 26.18 Latest version in the No Channel channel: Looker 26.18 The Regular channel remains on Looker 26.14. Enhanced observability metrics, including user engagement and estimated token usage data on the Token usage tab of the Conversational Analytics System Activity dashboard, are now generally available ( GA ) for Looker (original) instances that are on Looker 26.16 or later. This launch also adds a Daily Token Utilization visualization and supports token usage observability for Conversational Analytics data agents that are published to Gemini Enterprise. (For Looker (Google Cloud core) instances, token usage observability remains in Preview when the Conversational Analytics Agent Token usage preview feature is enabled.)
Network Connectivity Center - Network Connectivity Center (NCC) support for Partner Cross-Cloud Interconnect for Amazon Web Services (AWS) is Generally Available. Billing for Partner Cross-Cloud Interconnect for Amazon Web Services (AWS) is going to commence over the next 30 days following General Availability. For the most current billing information, see Network Connectivity Center pricing. Network Connectivity Center supports site-to-site data transfer in the following country: Poland
Network Intelligence Center - Network Services Monitoring is available in Preview. Network Services Monitoring visualizes communication paths and network metrics for Google Kubernetes Engine services and workloads with ambient networking enabled. Cloud Network Insights supports using Google Cloud CLI commands to download Microsoft Azure and Amazon Web Services (AWS) Monitoring Point installation bundles.
Secure Source Manager - Secure Source Manager webhooks now support service account authorization. For more information, see Webhooks overview and Set up webhooks.
Security Command Center - Risk Engine detects and reports reasoning engines that can modify IAM policies and perform lateral movement. These findings are generated as a toxic combination. Event Threat Detection integrates with Sensitive Data Protection to enrich findings that affect sensitive resources. For more information, see Sensitive data enrichment.
Sensitive Data Protection - A new version with an updated name dictionary is available for the PERSON_NAME infoType detector. You can try it out by setting InfoType.version to latest when including the PERSON_NAME infoType in your InspectConfig. You can still use the previous functionality by setting InfoType.version to stable or leaving it unset when using the PERSON_NAME infoType. In 30 days, the new version will be promoted to stable.
Service Mesh - Cloud Service Mesh support for the managed ISTIOD control plane on Google Kubernetes Engine (GKE) on Google Cloud is deprecated as of September 28, 2026, and support will end on March 1, 2028. After March 1, 2028, managed ISTIOD control plane components on GKE on Google Cloud will not receive updates, security patches, or support from Google Cloud, and workload sidecars on unmodernized clusters will fail and be unable to receive or send requests. Google Cloud is transitioning managed Cloud Service Mesh with Istio APIs to the TRAFFIC_DIRECTOR control plane implementation using Istio APIs. As part of this transition, support will also end for any features that are incompatible with the TRAFFIC_DIRECTOR control plane. To continue using managed Cloud Service Mesh on GKE, you must modernize your clusters by March 1, 2028: Confirm that you affected. Check your compatibility. Review the Supported features to confirm feature compatibility with the TRAFFIC_DIRECTOR control plane and evaluate a fleet's compatibility for control plane modernization. Plan your modernization following the modernization guide. For more details on the transition, see Managed control plane documentation and monitor the release notes for ongoing updates. Cloud Service Mesh support for the in-cluster ISTIOD control plane on Google Kubernetes Engine (GKE) on Google Cloud is deprecated as of September 28, 2026, and support will end on March 1, 2028. After March 1, 2028, in-cluster control plane components on GKE will not receive updates, security patches, or support from Google Cloud. Cloud Service Mesh with the in-cluster ISTIOD control plane on Google Distributed Cloud (software only) continues to be supported as described in Supported platforms. You must migrate your clusters to managed Cloud Service Mesh by March 1, 2028. review the Supported features to confirm feature compatibility, and follow the migration guide to transition to managed Cloud Service Mesh with the TRAFFIC_DIRECTOR control plane. For more details on the deprecation schedule, see Deprecations.
VMware Engine - Generally available: Bring Your Own License (BYOL) license management for Google Cloud VMware Engine is generally available (GA). BYOL license management lets you register and manage portable VMware Cloud Foundation (VCF) license keys in the Google Cloud console across projects associated with your Cloud Billing account. For more information, see License management.
VPC Service Controls - VPC Service Controls feature: Support for using Google Cloud folders and organizations as resources in ingress and egress rules is generally available. With this update, you can create rules that allow access to and from the resources protected by service perimeters and bypass common resource size limitations. For more information, see Ingress and egress rules. Preview stage support for the following integration: Universal Ledger VPC Service Controls feature: Folder membership support in VPC Service Controls service perimeters is generally available. You can configure Google Cloud folders as members in service perimeters to automatically protect all projects and subfolders within that folder hierarchy. For more information, see Folder support in service perimeters and Configure folders in service perimeters.