GCP Newsletter #527

Welcome to issue #527 November 2nd, 2026

News

Unifying enterprise context and semantics: LookML in Knowledge Catalog is now GA - LookML metadata indexing in Google Cloud Knowledge Catalog is now GA, grounding Gemini Enterprise and AI agents in governed business semantics.

Scale agents securely with IAM Helper Agent Skills and MCP Tools - Today we’re introducing IAM Helper, a suite of intelligent, agent-facing building blocks that can automate complex, end-to-end IAM workflows.

Bringing Google TPUs to Oracle Cloud Infrastructure - Google and Oracle are partnering to bring Google TPUs to Oracle Cloud Infrastructure, making OCI the first hyperscaler outside Google to offer TPUs.

Gemini Robotics Embodied Reasoning 2 is now available on Google Cloud - Discover how Gemini Robotics Embodied Reasoning 2 on Google Cloud brings advanced spatial-temporal reasoning and physical AI to enterprise robotics.

Introducing VMware solution on Google Cloud - Google Cloud’s self-managed VMware solution gives you administrative authority for VMware Cloud Foundation (VCF) on dedicated Google Cloud bare metal.

BigQuery measures is now GA, unifying BI metrics and knowledge graphs for AI accuracy - BigQuery measures is now generally available, unifying BI metrics and knowledge graphs in one model so AI agents and dashboards share trusted data.

Introducing the AlloyDB Omni web UI for easier cluster observability - Gain direct visibility into AlloyDB Omni to isolate slow queries, inspect columnar engine metrics, and verify configuration flags.

Near-zero downtime upgrades: Announcing Cloud SQL for MySQL blue-green deployments - Upgrade Cloud SQL for MySQL with sub-second switchover on Enterprise Plus, real-data read validation, and automatic endpoint swapping.

Innovate on your own business terms: Google Cloud spend caps now generally available - Today, we’re announcing that spend caps on Google Cloud Budgets are generally available. With this release, we’re delivering ways to protect your workloads from runaway costs without risking resource deletion.

New Gemini courses for financial services and legal teams - Discover new, free Gemini video courses designed for financial services and legal professionals to master agentic workflows and boost productivity.

Articles, Tutorials

Infrastructure, Networking, Security, Kubernetes

How GKE networking scales to support high densities of concurrent AI agents - GKE Dataplane V2 optimizes network identity management, solves identity scaling limits, and enables sub-second provisioning for agentic workloads.

How to troubleshoot GKE workloads faster with VPC Flow Logs - For Google Kubernetes Engine (GKE), VPC Flow Logs provides workload-level attribution for L3/L4 traffic without deploying extra agents or sidecars.

Cloud CISO Perspectives: Introducing new $250,000 tier for Google Cloud VRP (Q&A) - We announce a new $250,000 vulnerability report program tier for root-in-cloud, and share a convo between CISO Chris Betz and VRP lead Michael Cote on the changing VRP landscape.

When the Kubernetes API went silent: A three-layer networking mystery - A tricky Google Cloud support ticket that spanned GKE, Private Service Connect (PSC), Networking, Hostnet, Kernel, and the Linux kernel itself.

ARTEX and Friends: Enter Agentic Offensive Frameworks - Mandiant and GTIG provide remediation guidance against a new paradigm of machine-speed intrusions driven by threat actors using ARTEX and similar agentic pentesting frameworks.

Media CDN EU Data Residency & Europe Flexible Origin Shielding - Google Cloud is introducing EU Data Residency for Media CDN and general availability of Europe Flexible Origin Shielding in Frankfurt to help European broadcasters and streaming platforms meet strict data protection regulations.

App Development, Serverless, Databases, DevOps

Shipping an MCP server on Google Cloud - This article provides a comprehensive, hands-on guide for turning a basic Model Context Protocol (MCP) server demo into a robust, production-ready service on Google Cloud.

Easy to integrate, compliant by design: Bringing the Swiss Franc to Google Cloud Universal Ledger - Looking to expand its offerings for an increasingly global clientele, Switzerland’s Crypto Finance Group wanted to show it could deploy payment innovations like a Swiss stablecoin in just weeks.

Behind the scenes, two months later: How we ship Google Agent Skills like products - Discover how Google ships agent skills like products by using automated quality gates, semantic versioning, evaluation suites, and an AI review agent.

How to upgrade embedding models in AlloyDB AI with zero downtime - Learn how to upgrade embedding models in AlloyDB AI with zero downtime using auto embeddings and ScaNN indexes without disrupting production traffic.

A semantic cache is easy to demo and hard to trust - This article explores the implementation and production challenges of using semantic caches with Apigee as an AI gateway for Large Language Models.

Breaking free from legacy ASP.NET MSDTC: A practical migration guide to the Transactional Outbox Pattern on Cloud SQL - This article provides a step-by-step blueprint for migrating legacy .NET and Java applications to managed cloud databases by replacing Microsoft Distributed Coordinator (MSDTC) and two-phase commits with the Transactional Outbox Pattern.

Modernizing Databases Without Live Cloud Connectivity via DMS - This article introduces an offline schema extraction and seeding feature for Google Cloud's Database Migration Service (DMS), designed to help organizations modernize enterprise databases like Oracle and SQL Server without live network connectivity.

Never let a request decide who pays - Token quotas, API products and cost reports in an Apigee AI gateway, and the one rule that keeps them honest: only the credential decides.

Google Cloud CLI Remote MCP Server (Part 4): Handling & Verifying Long-Running gcloud Commands (async) - This article explains how to prevent HTTP timeouts and track long-running infrastructure tasks by implementing a three-phase asynchronous workflow for Google Cloud CLI commands. It demonstrates how to use the Submit, Poll, and Verify pattern using both Google ADK workflows with cyclic polling loops and Gemini Enterprise Managed Agents.

Big Data, Analytics, ML&AI

Powering the agentic enterprise with latest innovations in Oracle AI Database@Google Cloud - Oracle AI Database@Google Cloud adds Gemini integration, MCP Server in GA, BigQuery federation, and Iceberg lakehouse access.

Securely connecting Gemini Enterprise to Snowflake data - Using MCP and the Agent Development Kit (ADK), agents can understand natural language, generate precise SQL via Snowflake Cortex, and execute queries.

Reprocessing BigQuery at Scale: The Hidden Failure Modes of Incremental dbt Pipelines - Designing deterministic backfills, safe partition replacement, and dependency-aware recovery in production data platforms.

Build cross-cloud agents with the borderless Lakehouse - This technical guide explains how to build cross-cloud AI agents using a borderless Lakehouse without needing to migrate data. It demonstrates how to federate a Databricks Unity Catalog on AWS with Google Cloud, enrich text and image data using Gemini models directly in SQL, and deploy an intelligent data agent via Gemini Enterprise.

Data Apps and Custom Dashboards Come to Looker (and Wire) - Google Cloud's Looker Data Apps feature allows users to build interactive, custom web applications on top of the Looker semantic layer using AI coding agents. The article explores how developers can leverage Google's AI toolkit alongside tools like Claude Code to streamline the creation, validation, and publishing of these data-driven dashboards.

Grounding agents in one context graph connecting semantic models you already trust - Give AI agents the definitions you already trust. Knowledge Catalog ingests Looker, BigQuery, dbt, Snowflake, Databricks, and SAP semantic models.

Querying Databricks Apache Iceberg Tables with the borderless Lakehouse - Learn how to query Databricks Iceberg tables with Lakehouse runtime catalog through bi-directional federation with Databricks Unity Catalog.

What Really Happens to Your Data When the Schema Changes in dbt (BigQuery Edition) - Incremental models, on_schema_change, and the quiet ways a pipeline can lose data.

1. Stop Copy-Pasting SQL in Dataform: A Practical Guide to Reusable Functions - Six reusable SQL patterns for incremental models, and how to change a shared macro without breaking production.

Build Generative UI Apps with A2UI & CopilotKit Agents - See Google A2Ui in action! Learn how to natively render agentic UIs across Langchain, AWS Strands, Microsoft agents, and Google ADK using CopilotKit SDKs for A2UI.

Hill-Climbing Agent Quality with Agents CLI Evaluation - This post walks through the Agents CLI evaluation loop for systematically improving agent performance through continuous testing and grading. It demonstrates how to catch prompt regressions, evaluate model backend swaps using side-by-side trace comparisons, and automate evaluation passes. Developers will also learn how to integrate nightly scheduled runs with threshold-based alerting to track quality over time.

Building Conversational Commerce with Multi-Agent Swarms on GCP: A Working Prototype - This article demonstrates how to build a production-ready conversational commerce prototype called HappyDelivery using Google Cloud Platform, LangGraph, and Gemini. It breaks down a decoupled three-layer architecture utilizing an omnichannel webhook ingress, Redis session storage, and a specialized multi-agent swarm to handle automated customer orders efficiently.

Fast, reliable A2UI, with swappable inference formats - A2UI now supports swappable inference formats, introducing A2UI Express which uses up to 3x fewer tokens and cuts latency by compiling compact Python-style syntax into standard A2UI JSON via Agent SDKs. Developers can also use controlled generation with TypeSafe's Jev system-decision models to render known-shape screens in under 300 ms while smaller models stream text.

Building a vendor-agnostic patient health record search and summarization system with GEAP Agent Retrieval and Google ADK - The article presents an enterprise architectural blueprint for a unified clinical intelligence platform designed to address the fragmentation and inefficiencies of electronic health record systems in modern healthcare. By combining Google Cloud’s hybrid search capabilities and the Google Agent Development Kit, the system integrates structured medical data with unstructured notes and scanned documents to provide clinicians with rapid search tools, visual trend tracking, and verifiable AI-driven reasoning.

Tubi delivers brand safe contextual targeting across 500k titles in 20 days with Gemini - Discover how streaming platform Tubi leveraged the Google Cloud Gemini Enterprise platform to build Media Vision, an intelligent architectural layer that processes long-form video as a continuous narrative. By utilizing multimodal reasoning, tiered models, and batch inferencing, the system automatically identifies natural ad breaks and generates previews across 500k titles while saving tens of thousands of hours of manual work.

Data Governance at Scale with Gemini 4 Argon & BigQuery - Perform Agentic Data Remediation for 1 Million Records!

From single agents to complex multi-agent systems: addressing deployment in GCP - Part 3 of the series Building and deploying ADK and A2A agents on Google Cloud.

The 200 OK Lie: Google’s Open-Source Ambient Agent That Audits Production AI - Google has open-sourced AQuA (Ambient Quality Agent), an ambient AI tool designed to audit production LLM conversations in the background without impacting live traffic latency or costs.

Various

Google Cloud and NASA: Testing robotic systems for deep space missions - Google Public Sector and NASA have collaborated to develop a proof-of-concept robotic system powered by Google Cloud to support astronauts on deep space missions to the Moon and Mars. By leveraging advanced vision-language-action models and edge computing, this versatile technology aims to handle routine logistics and medical support, maximizing crew safety and efficiency in isolated environments.

Releases

Agent Platform Workbench - Custom organization policies for Agent Platform Workbench instances You can now use custom organization policies to allow or deny the creation and update of Agent Platform Workbench instances based on their configuration. Custom constraints for the notebooks.googleapis.com/Instance resource are enforced when you create or update an instance, and support dry-run mode. This feature is now generally available ( GA ). For more information, see Create custom organization policy constraints.

Agent Registry - Agent Registry supports cross-project management boundaries ( Preview ), letting you centrally discover, search, and govern AI agents, Model Context Protocol (MCP) servers, and tools across multiple Google Cloud projects from a central management project. For more information, see Cross-project boundaries and Configure a management boundary for multiple projects.

AlloyDB - Release highlights (full notes at the link): AlloyDB AI now offers preview support for in-database text extraction and classification functions alongside updated query engine parameter signatures. Generally available updates include four-level ScaNN vector indexes supporting up to 10 billion rows, vector assist deployment tools, and external search wrapper extensions. Additionally, IAM group authentication is generally available for PostgreSQL 15 and later clusters.

AlloyDB Omni - In AlloyDB Omni Kubernetes operator versions earlier than 1.8.2, the operator doesn't reload its renewed dbs-al-cert-l2-operator mutual TLS (mTLS) client certificate into existing high availability (HA) health-check connections. Approximately 60 days after the certificate is issued, health checks might fail with a tls: expired certificate error and trigger an unplanned failover. To prevent this issue, upgrade to operator version 1.8.2 or later. Until you upgrade, rotate the dbs-al-cert-l2-operator Secret in the alloydb-omni-system namespace and restart the local-controller-manager Deployment at least 10 days before the certificate expires. For instructions, see Mitigate operator client certificate expiration in operator versions earlier than 1.8.2.

Anti Money Laundering AI - New minor engine version released for the retail line of business within the v004.011 version line ( aml-retail.default.v004.011.202610-000 ). This version extends support for the major engine version and includes no significant changes compared to the previous minor version.

Apigee Hybrid - Release highlights (full notes at the link): Apigee hybrid versions v1.17.3 and v1.16.13 are now available, featuring fixes for proxy handling in the connect agent and the removal of compromised root certificates from container trust stores. Version v1.17.3 introduces general availability support for continuous-scan bidirectional gRPC streaming for Model Armor policies over Server-Sent Events, alongside various bug fixes and security updates.

Application Integration - A Deserialization of Untrusted Data vulnerability was discovered in the SubWorkflow task in Application Integration versions prior to September 11, 2026. For more information, see the GCP-2026-074 security bulletin. Application Integration agent skills Application Integration agent skills are available in the public google/skills repository: application-integration-basics, application-integration-authoring, and application-integration-troubleshooting. AI coding agents that use these skills can help you set up Application Integration; build, publish, and run integrations through the REST API; and troubleshoot failed runs. For more information, see Application Integration agent skills and Build an integration with an AI agent.

Backup and DR Service - You can now edit existing backup plans for Cloud SQL instances to update settings such as backup rules and maximum custom on-demand retention periods. To learn more, see Back up Cloud SQL instances to a backup vault.

BigQuery - Python user-defined functions now support volume mounts, which let you access dependency files from Cloud Storage directly from your Python UDF code. This feature is in Preview. The REGEXP_EXTRACT_GROUPS function produces substrings that match multiple capturing groups in a regular expression. This function is in Preview. Conversation logging for Conversational analytics in BigQuery is now generally available (GA). You can log data agent conversations to a BigQuery table in the agent's project. For more information, see Conversation logging overview and Configure settings. The Data Engineering Agent now integrates with Google Drive, letting you provide Google Sheets files, CSV, or JSONL files as input for your data engineering pipelines. This feature is generally available (GA). You can now use conversational analytics in Connected Sheets to ask questions and analyze your BigQuery data using natural language. The Gemini side panel can help you translate your questions into optimized SQL queries and execute them, summarize key trends, and insert live, refreshable database objects directly into your workbook. This feature is generally available (GA). You can manage and version control SQL scripts and notebooks with BigQuery Studio Git repositories, which provide a streamlined, folder-based integration with remote Git repositories. This feature is generally available (GA). You can now use conversational analytics in Connected Sheets to ask questions and analyze your BigQuery data using natural language. The Gemini side panel can help you translate your questions into optimized SQL queries and execute them, summarize key trends, and insert live, refreshable database objects directly into your workbook. This feature is in Preview. The AI.COUNT_TOKENS function, which estimates the token count of a text string, is generally available (GA). You can now retrieve query results directly in the Apache Arrow format for faster retrieval speed and improved serialization efficiency. This feature is in Preview.

Bigtable - You can use Apache Avro schema bundles to query individual fields within Avro records stored as serialized bytes in Bigtable. You can query your Avro data using GoogleSQL for Bigtable, continuous materialized views, and logical views. This feature is in Preview. You can configure Bigtable tables with microsecond timestamp granularity to capture and store high-frequency data. By supporting microsecond precision for cell timestamps, Bigtable helps you prevent data loss from write collisions in workloads with high event rates. This feature is generally available (GA) for instances in the Enterprise Plus edition. For more information, see Data type enforcement in Bigtable. You can use Knowledge Catalog to discover authorized views, logical views, and continuous materialized views. This integration lets you search for these granular data assets alongside your Bigtable instances and tables. This feature is generally available (GA). For more information, see Manage data assets using Knowledge Catalog.

Capacity Planner - Preview: You can use the Capacity Planner remote Model Context Protocol (MCP) server ( capacityplanner.googleapis.com ) to connect AI applications and agents to your Capacity Planner data ( Preview ). You can use the Capacity Planner MCP tools to query historical resource usage, usage forecasts, and reservation data across your projects, folders, and organizations. For more information, see the Capacity Planner MCP reference and Google Cloud MCP servers overview.

Chronicle SOAR - Release 6.3.104 is now available for all regions. Release 6.3.105 is being rolled out to the first phase of regions as listed here. This release contains internal and customer bug fixes.

Chronicle Security Operations - Release highlights (full notes at the link): Google SecOps is permanently shutting down legacy Google-managed BigQuery export datasets and API keys for non-Enterprise+ customers starting October 28, 2026. The Operations feature in the Emerging Threats Center feed is now generally available. Additionally, SIEM Search introduced a public preview of Basic Mode, a streamlined search-execution mode designed to reduce wait times by bypassing secondary enrichment steps.

Cloud Architecture Center - Agentic AI use case: Orchestrate access to disparate enterprise systems: Added security guidance for governing AI agents and tools by using Agent Identity, Agent Gateway, Agent Registry, and IAP. Harness CI/CD pipeline for RAG applications: Added security and reliability guidance for source code management, container image verification, runtime AI protection, and progressive revision rollouts by using Secure Source Manager, Artifact Analysis, Binary Authorization, Model Armor, and Cloud Run traffic splitting.

Cloud Asset Inventory - The following resource types are publicly available through the ExportAssets, ListAssets, BatchGetAssetsHistory, QueryAssets, Feed, and Search ( SearchAllResources, SearchAllIamPolicies ) APIs. Google Cloud Migration Center migrationcenter.googleapis.com/DiscoveryClient migrationcenter.googleapis.com/Group migrationcenter.googleapis.com/ImportJob migrationcenter.googleapis.com/PreferenceSet migrationcenter.googleapis.com/ReportConfig migrationcenter.googleapis.com/Settings migrationcenter.googleapis.com/Source

Cloud Networking Products - Release highlights (full notes at the link): Starting January 5, 2027, Cloud DNS CNAME chasing behavior will change to follow chains between public and private zones, utilizing the complete VPC name resolution order. Additionally, Cloud DNS will disable full responses to QTYPE=ANY queries in public authoritative zones, returning only a single resource record instead. Applications and services should be updated to query specific record types or use the Cloud DNS API to retrieve full zone records before the change takes effect.

Cloud Number Registry - Starting November 25, 2026, if your configuration doesn't have a designated project, Cloud Number Registry will stop discovering resources. For more information, see Project designation enforcement.

Cloud Run - You can run Cloud Run jobs with GPUs enabled for up to 12 hours ( Preview ).

Cloud SQL MySQL - Release highlights (full notes at the link): Managed replica indexes for Cloud SQL for MySQL are generally available, automatically rebuilding custom secondary indexes on read replicas after instance re-creation. Additionally, unpatched Cloud SQL for MySQL instances evaluating specific Canadian time zones will experience a one-hour lag starting November 1, 2026, unless updated to maintenance release R20260726.00_36 or later. Users can mitigate this time zone issue without downtime by adjusting the default_time_zone database session flag.

Cloud SQL Postgres - Release highlights (full notes at the link): Cloud SQL for PostgreSQL requires maintenance release `R20260712.01_44` or later to apply updated time zone rules for specific Canadian regions starting November 1, 2026. Users who cannot perform maintenance can avoid time calculation lags without downtime by configuring an anchor zone with a permanent offset using an `ALTER DATABASE` statement. Stored timestamp data remains unmodified.

Cloud Spanner - Spanner supports the ON DELETE SET NULL foreign key action for GoogleSQL and PostgreSQL dialects. Use ON DELETE SET NULL when you delete a referenced row to set the referencing columns to NULL. For more information, see Foreign key actions and Create and manage foreign key relationships. Spanner supports equality and ordering comparisons on JSONB and JSON values. You can use these values in GROUP_BY and ORDER BY clauses without first converting them to another data type. In GoogleSQL, you can also convert other data types to JSON using CAST(expression AS JSON) and compare JSON values directly with non-JSON values. Spanner can implicitly coerces the non-JSON value to JSON for comparison. Additionally, you can use search indexes to accelerate equality comparisons such as = or IN on JSONB and JSON columns and subpaths. For more information, see JSON comparison and sorting, JSON comparison coercion, CAST AS JSON, JSON search indexes, and Working with JSONB.

Cloud Storage - Security and compliance findings in Storage Intelligence advisor are available in Preview. You can use these findings to identify buckets with objects that violate default customer-managed encryption key (CMEK) policies or enforced encryption rules, and re-encrypt the affected objects. For more information, see the following resources: About Storage Intelligence advisor Re-encrypt objects that violate default CMEK bucket policies Re-encrypt objects that violate enforced encryption rules

Compute Engine - A vulnerability (CVE-2026-85299) about incorrect authorization in Compute Engine was discovered and has been addressed. For more information, see the GCP-2026-073 security bulletin.

Confidential Space - A new Confidential Space image (261001) is available. This image removes compromised CA certificates from the OS trust store. See the security bulletin for more details. This image also adds support for running workload containers as a non-root user. Workload authors can require non-root execution with the tee.launch_policy.nonroot_container launch policy, and workload operators can enable it with the tee-nonroot-container metadata variable. For more information, see Non-root container execution.

Config Connector - Release highlights (full notes at the link): Config Connector version 1.160.0 is now available, introducing new alpha resources for managing services such as Managed Service for Apache Kafka Connect and Dataplex data products. This release adds opt-in support for direct reconciliation across several resources alongside new annotations to configure backoff delay ceilings and halt delete operations. Additionally, new fields are now supported, including column family types for Bigtable tables and Google Cloud Storage sources for Memorystore instances.

Database Migration Service - Release highlights (full notes at the link): Database Migration Service now supports creating heterogeneous conversion workspaces by importing schema metadata files from a Cloud Storage bucket without direct source database connectivity. Additionally, Distributed Availability Group migrations for homogeneous SQL Server migrations are now generally available, enabling private network migrations from self-managed instances to Cloud SQL for SQL Server with support for reverse replication.

Dataflow - Dataflow has added the following features to tune horizontal autoscaling for Streaming Engine jobs: Latency tiers: You can configure the backlog threshold by choosing a latency tier ( low_latency, medium_latency, or high_latency ), allowing you to configure the autoscaler's sensitivity to backlog duration and balance latency requirements with resource costs. For more information, see Set the latency tier. Autoscaling schedules: You can configure recurring autoscaling schedules to automatically apply parameter overrides—such as minimum and maximum workers, worker utilization hints, or latency tiers—during specific time windows. For more information, see Schedule autoscaling changes. You can configure these features when you create a job or update them while the job is running.

Dataplex - Support for Looker (Google Cloud core) in Data lineage is now generally available. This support includes lineage views for LookML views and Explores, Looker dashboards, dashboard elements, Looks, LookML dashboards, and Conversational Analytics agents. You can control data lineage ingestion at the organization, folder, and project levels. You can also visualize the end-to-end flow of your data from BigQuery sources through the Looker semantic layer to downstream assets. For more information, see Track data lineage with Knowledge Catalog, About data lineage, and About data lineage ingestion control.

Datastream - Datastream integration with Knowledge Catalog is now generally available (GA). For more information, see the documentation.

Dialogflow - Dialogflow ES: The Dialogflow ES LINE integration validates the X-Line-Signature HTTP header on incoming webhook requests using your LINE channel secret and rejects requests with missing, duplicate, or invalid signatures with an HTTP 400 Bad Request error. Make sure your configured channel secret matches your LINE Messaging API channel and that any intermediate proxy forwards the X-Line-Signature header and raw request body unmodified.

GKE new features - Release highlights (full notes at the link): C4D bare metal machine types are now generally available on GKE, supporting cluster autoscaling and custom ComputeClasses on specific versions. Managed OpenTelemetry for GKE is also generally available, enabling the collection of OTLP telemetry data via a Google-managed collector. Additionally, related tooling integrations including the gcloud CLI flag and Terraform provider configurations for managed OpenTelemetry have reached general availability.

Gemini Code Assist - Bug fixes in VS Code Various bug fixes and minor product enhancements.

Gemini Enterprise - Release highlights (full notes at the link): Gemini Enterprise now generally offers VPC connectivity and static IP egress for custom MCP servers, alongside a regionally restricted Brazil deployment available by allowlist. Gemini Notebook Enterprise introduces a generally available visual refresh with customizable summaries, audio language selection, and updated research options. Additionally, the S&P Global Adaptive Retrieval data store is now available in Public Preview for Gemini Enterprise.

Gemini Enterprise Agent Platform - Release highlights (full notes at the link): Gemini 3.8 Flash TTS, Gemini 3.8 Flash-Lite TTS, Grok 4.7, and the Computer use tool with HITL safety governance are now generally available. Direct Cloud Storage output persistence for image generation models and inference request metadata logging are also generally available. In addition, Gemini Robotics ER 2 is now available in preview for robotics applications.

Google Cloud Armor - Cloud Armor supports advanced match conditions to include attributes for inspecting request body content and parameters. This lets you write custom CEL rules to filter traffic based on raw body content, structured data (JSON, Form Data, GraphQL), and query parameters. For more information, see Configure custom rules language attributes. This feature is generally available (GA).

Google Cloud Managed Lustre - Google Cloud Managed Lustre now supports self-service maintenance. You can upgrade your Managed Lustre instances to newer software versions on demand using Google Cloud CLI or the REST API, without waiting for automated maintenance to occur. You can also view available maintenance updates directly in the Google Cloud console. For more information, see Perform self-service maintenance.

Google Distributed Cloud for bare metal - Release highlights (full notes at the link): Google Cloud released GKE fixes that prevent the Whereabouts IPAM garbage collector from prematurely deleting active IP address reservations on secondary networks. Additionally, a fix resolves an issue where Metrics API operations, Horizontal Pod Autoscaling, and Vertical Pod Autoscaling failed with TLS verification errors during certificate authority rotation.

IAM - The Admin ( roles/admin ), Writer ( roles/writer ), and Reader ( roles/reader ) basic roles are generally available ( GA ). For more information, see Basic roles. The legacy basic roles—Owner ( roles/owner ), Editor ( roles/editor ), and Viewer ( roles/viewer )—are still available for use and are being actively maintained. However, if you need to grant a basic role, we recommend granting the Admin, Writer, or Reader role instead of a legacy basic role. This is because the newer roles support additional features, such as the use of IAM Conditions.

Load Balancing - Regular expression URL rewrites ( regexRewrite ) for route rules in URL maps are now generally available (GA) for Application Load Balancers. You can use regular expression pattern rewrite actions to rewrite URL paths by substituting or removing URL path components before forwarding requests to your backends. This feature is available in: Global external Application Load Balancers Regional external Application Load Balancers Cross-region internal Application Load Balancers Regional internal Application Load Balancers For more information, see Regular expression URL rewrites for route rules.

Looker - Release highlights (full notes at the link): The Looker-managed Model Context Protocol server and data lineage tracking are now generally available, enabling secure AI agent integration and end-to-end visibility. The new Dashboard Tile Groups feature is available in preview to organize related tiles, and the updated Explore and merge query experience is now generally available as the default interface. Additionally, the legacy database connection workflow has been removed in favor of the current connection process.

Media CDN - Media CDN supports EU data residency in Private GA. This feature helps ensure that your content and end-user data are processed within the EU. To enable this feature, contact Google Cloud sales. Media CDN supports flexible origin shielding in Frankfurt ( europe-west3 ). This feature is generally available (GA). For more information, see Flexible shielding. Media CDN supports EU data residency (Private GA), along with a new Europe flexible origin shielding region. Media CDN supports EU Data Residency in Private GA. This feature ensures that customer content and end-user data are processed within the EU. This feature is available via support allowlist. Media CDN supports flexible origin shielding in Frankfurt ( europe-west3 ). This feature is Generally Available. For more information, see Flexible shielding.

Memorystore for Redis Cluster - The basic token-based authentication feature is Generally Available.

Model Armor - Release highlights (full notes at the link): Model Armor is now generally available in the Brazil region with support for key security filters and data residency compliance. Additionally, a new generally available organization policy constraint enforces data residency compliance by default for template creation and updates. Users can also now test Model Armor templates directly in the console using custom sample prompts to evaluate filter behavior and data redaction.

Oracle Database@Google Cloud - The Oracle Database@Google Cloud remote MCP server is generally available (GA) and adds tools to create and manage Database Connections and run SQL statements with database_connection_executesql. It lets you interact easily with Oracle Database@Google Cloud resources from LLMs, AI applications, and AI-enabled development platforms. For more information, see Use the Oracle Database@Google Cloud remote MCP server. For Exadata Database Service, Oracle Database@Google Cloud is available in northamerica-south1 (Querétaro, Mexico) region. For a list of supported locations, see Supported regions and zones.

SAP on Google Cloud - Release highlights (full notes at the link): ABAP SDK for Google Cloud version 1.15 is generally available, improving binary data handling for downloads without character decoding when using Cloud Storage as an SAP content repository. Google SecOps for SAP is also generally available, enabling unified threat detection, log ingestion from SAP RISE and self-managed environments, and preview automated threat response using SOAR playbooks.

Secure Source Manager - You can now enable vulnerability scanning to detect known vulnerabilities in your dependencies.

Spanner Omni - Spanner Omni patch release 2026.r4-lts.1 is available. This patch includes security and other critical bug fixes. Spanner Omni release 2026.r5 is available. Release version 2026.r5 includes all updates in the cloud-based, managed Spanner service up to the October 27, 2026 release. For more information, see Differences between Spanner and Spanner Omni and Container image versions.

VMware Engine - Release highlights (full notes at the link): VMware solution on Google Cloud is now generally available, enabling the deployment of VMware Cloud Foundation on dedicated bare-metal Compute Engine instances using a Bring Your Own License model. Users can provision z3-highmem-192-highlssd-metal ESXi nodes directly in their VPC and automate infrastructure setup using Terraform and the VMware solution toolkit. The architecture supports high availability by distributing nodes across isolated availability domains with spread placement policies aligned to vSAN fault domains.

VPC Service Controls - Preview stage support for the following integration: App Optimize API