GCP Newsletter 525
Welcome to issue #525 October 19th, 2026
News
Gemini 4 Argon available on Google Cloud, built to help solve your business’ hardest problems - Starting today, we are making our new frontier model, Gemini 4 Argon, available for everyone on Google Cloud.
Trusted Data Apps for the Agentic Data Cloud, powered by Looker - With new Looker Data Apps, describe your BI dashboard in plain language, and an agent builds a production-grade application natively inside Looker.
Introducing TimesFM 3.0 with multivariate time-series forecasting in BigQuery - Google Research’s TimesFM 3.0 is a 330-million parameter foundation model that unlocks native multivariate time-series forecasting in BigQuery SQL.
Predictable AI spend in BigQuery: Introducing cost management for generative AI functions - Token-based cost management for BigQuery generative AI functions lets you set daily quotas on AI token consumption so you can keep within your budget.
Temporal Serverless Workers on Cloud Run: Scale workers ahead of demand - Temporal Serverless Workers on Cloud Run let you deploy your Temporal workers as a worker pool, and Temporal autoscales the pool for your task queues.
Modernizing perimeter security: Scalable perimeters with VPC Service Controls - Today, we're excited to announce key enhancements to VPC Service Controls that make perimeters easier to create, maintain, and scale.
Announcing Wiz Runtime Sensor add-on for GKE: Turnkey threat detection for Kubernetes - Introducing the Wiz Runtime Sensor add-on for Google Kubernetes Engine in preview, helping to manage deployment, lifecycle, credential security, and governance.
Day 0 support for Reflection’s Beam on Google Cloud: 5x faster perf with llm-d and NVIDIA Dynamo - Google Cloud has optimized running Reflection AI's Beam model for agentic workloads, using llm-d and NVIDIA Dynamo to achieve up to 5x higher throughput and 8x lower latency on A4X Max instances. These improvements come from smarter request routing, KV-cache management, and optimized GPU usage, with ready-to-use deployment configurations available for GKE.
Announcing MCP support in Apigee hybrid: agentic tools that run in your own cluster - Apigee hybrid 1.17.0 introduces native Model Context Protocol (MCP) support, enabling the MCP data plane to run directly within your own Kubernetes cluster. This architecture ensures that AI agent request traffic and tool execution remain entirely inside your infrastructure while pulling configuration updates from the control plane.
10 Years of the SRE book: Announcing the second edition of "Site Reliability Engineering” - The second edition of the Site Reliability Engineering book reflects the shifts in infrastructure management from AI, microservices, serverless, etc.
Announcing DPoP Support for Google OAuth: Securing Refresh Tokens - Google OAuth Platform now supports DPoP (Demonstrating Proof-of-Possession) to sender-constrain refresh tokens, neutralizing Infostealer malware and adversary-in-the-middle attacks.
Articles, Tutorials
Infrastructure, Networking, Security, Kubernetes
Cloud CISO Perspectives: New Gemini Notebook can help CISOs and policymakers prepare for PQC - Prepare for the PQC era with Google's new post-quantum cryptography Gemini Notebook.
ARMORY CASTLE Exploits BeyondTrust - ARMORY CASTLE exploited zero day vulnerabilities in BeyondTrust Remote Support appliances to establish persistent, stealthy access to compromised devices.
Investigating Ephemeral Supply Chain Tampering - GTIG and Mandiant uncovered a supply chain attack targeting AOMEI Technology's update infrastructure, where attackers used short-burst configuration tampering on origin servers to deploy tools like the SHINYROAD trojan.
Deploying an ADK agent on Agent Runtime with Terraform and CI/CD - This article provides a practical guide on bridging the gap between AI development and enterprise production by deploying an ADK agent onto Google Cloud's Agent Runtime using Terraform and CI/CD pipelines.
App Development, Serverless, Databases, DevOps
AlloyDB Omni K8s Operator 1.9.0 release - We are thrilled to announce the General Availability (GA) of the AlloyDB Omni Kubernetes Operator version 1.9.0!
PHP on Cloud Run: Cut Your Latency with PHP 8.5 and Persistent Sockets - How cross-request HTTP/2 connection pooling drops Google Cloud SDK handshakes to 0ms — and two hidden libcurl gotchas to avoid.
The SAVE method: Learn the fundamentals to engineer trustworthy generative media - Google Cloud Consulting (GCC) shares the SAVE method. Learn the fundamentals to engineer trustworthy generative media.
Optimizing a 200,000-line Python codebase overnight with Gemini 4 Argon - How our engineering team ran Gemini 4 Argon unattended overnight with .agents/skills and /goal mode to cut in-memory session prep overhead by 40% in long sessions and speed up cold imports by 21% in Google's open-source Python Agent Development Kit (ADK).
Building Agents to Analyze Structured and Unstructured Data - This article demonstrates how to build an intelligent AI agent using the Agent Development Kit (ADK) and Cloud Spanner to seamlessly analyze both structured tables and unstructured text. It walks through generating vector embeddings directly via SQL, configuring a multi-tool agent to handle diverse natural language queries, and implementing essential security guardrails and observability.
IAP Desktop for Mac: how I reach GCP VMs with no public IP, without gcloud - This article explores how to connect to Google Cloud Platform virtual machines without public IPs using Identity-Aware Proxy (IAP) TCP forwarding on macOS.
Stop building one proxy per model - This article explores how organizations can avoid the complexity of managing separate proxies for every AI model by consolidating them into a single, OpenAI-compatible AI gateway using Apigee.
Big Data, Analytics, ML&AI
DuckLess: serverless DuckDB on Google Cloud, in your own project - This article introduces DuckLess, an open-source tool designed to run serverless DuckDB workloads directly within your own Google Cloud project using Cloud Batch and Cloud Run.
Don’t Assume Your Cloud T4 Runs at Spec: Gemma 4 Decode Falls 7% as the Card Warms - This article explores how thermal throttling affects the performance of NVIDIA T4 GPUs running large language models on Google Cloud.
Agentic data science with the Data Agent Kit - Learn how to use the Data Agent Kit inside the Antigravity IDE. Data Agent Kit helps you work with Google Cloud data through a plugin for coding agents or an extension for Visual Studio Code-based IDEs.
Learning BigQuery Graph with Nodes and Edges: Which Melbourne Cafes Are Neighbours? - A hands-on walkthrough of BigQuery’s property graph feature, using Melbourne’s cafe scene to explain nodes, edges and graph queries.
Domain-Driven BigQuery Column Security: Moving to Data Governance Tags - How to build domain-driven BigQuery column security using regional data policies, custom SQL masks, and dbt for data mesh architectures.
Cross-cloud conversational analytics made simple with open standards - Learn how borderless Lakehouse federates queries across Databricks, Snowflake, and AWS Glue with Apache Iceberg for in-place conversational analytics.
One Agent Development Kit, five languages - Build interoperable agents using shared MCP and A2A protocols with Google's Agent Development Kit (ADK) for Python, Go, TypeScript, Java, and Kotlin.
Bringing the borderless Lakehouse into the agentic era with innovations for Gemini - Security enhancements and integrations to enable governed Gemini-based agents across data managed by Google Cloud’s borderless Lakehouse.
Pub/Sub AI Bytes: Part 6 — Building a real-time streaming RAG pipeline - This article explores how to eliminate stale context in generative AI applications by building real-time streaming Retrieval-Augmented Generation (RAG) pipelines on Google Cloud. It compares two distinct architectural approaches using Cloud Pub/Sub: a zero-code pipeline leveraging AI Inference Single Message Transforms with Bigtable, and a composable data-processing pipeline utilizing Cloud Dataflow for advanced document chunking and custom models.
Automating Snowflake-to-BigQuery dbt Migrations with AI Skills - This article explores how to automate the complex process of migrating a dbt project from Snowflake to Google BigQuery using Google’s open-source AI skills.
How Visko streams real-time world models on Google Cloud TPUs - AI startup Visko brought Orbis, its interactive, continuously streaming video world model, to production with TPUs in just 30 days.
Architecting autonomy: A design pattern for high-compute, governed agents in biotech - As sustained, stateful, GPU-bound simulations that run on specialized silicon, biotech workloads require a different approach to agentic AI.
Four evaluation engineering lessons learned from building agent plugins - Here are four eval lessons we learned from building the new plugin that you can apply to your own builds.
Three layers, one repo: a tour of google/adk-recipes - The google/adk-recipes repository unifies Agent Development Kit (ADK) resources into three structured layers—core/, plugins/, and contrib/—serving as a single source of truth for building AI agents. Developers can leverage reference patterns, install modular vertical skills (such as retail product search and virtual try-on) directly into their coding assistants, and deploy production-ready services across multiple languages.
Evaluating AI agents: moving past the vibe check - A practical engineering guide and reference architecture for establishing continuous evaluation pipelines for multi-turn AI agents using Gemini Enterprise Agent Platform, Google ADK, and OpenInference standards.
Prompting LLMs over your data at scale in Python with bigframes and BigQuery AI - How to prompt Gemini, rank semantically, and build semantic search directly from your Python notebook without the infrastructure overhead.
Your Agent’s Memory Is Drifting and Your Dashboards Look Fine - This article explains why AI agent memory stores inevitably degrade over time due to issues like stale facts, contradictions, and duplicates, even when underlying monitoring dashboards look healthy. It details how to measure and audit this drift offline, and explores how Google Cloud's managed Agent Platform Memory Bank helps address these challenges.
Various
What the Gemini agent means for startups - Here’s 5 ways the new Gemini agent for business can help founders get more done across the Google ecosystem and their business.
Releases
Agent Assist - Gemini transcribe live is generally available. Live transcription converts streaming audio to text in real time to deliver quick, reliable intermediate transcriptions for live conversations. The model_id field in GeminiAsrConfig remains in preview. Leave model_id unset to use the default Gemini transcribe live model.
Anti Money Laundering AI - New minor engine version released for the commercial line of business within the v004.011 version line ( aml-commercial.default.v004.011.202610-000 ). This version extends support for the major engine version and includes no significant changes compared to the previous minor version.
Apigee Hybrid - Full text on the release page.
Apigee Integrated Portal - On October 15, 2026, we released a new version of the Apigee integrated portal. Bug ID Description 560310696 Fixed an issue where the Portal SSO endpoint inadvertently accepted deprecated TLS 1.1 connections. The endpoint now strictly enforces TLS 1.2+.
Application Integration - Starting October 15, 2026, Application Integration enforces security fixes for IAM, run-as service accounts, and iam.serviceAccounts.actAs checks, requiring the correct permissions for the test feature and any new integrations. For more information, see the GCP-2026-067 security bulletin and Prepare for upcoming authorization changes. An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Application Integration versions prior to August 27, 2026. For more information, see the GCP-2026-068 security bulletin.
Backup for GKE - Backup for GKE is now available in the following region: asia-southeast3 (Bangkok, Thailand). For more information, see Backup for GKE locations.
BigQuery - Incremental data transfers for the BigQuery Data Transfer Service for PostgreSQL and ServiceNow are now generally available (GA). BigQuery generative AI functions now support the gemini-4-argon model. This model is generally available. The AI.AGG function is generally available (GA). You can use this function to semantically aggregate unstructured input data based on natural language instructions. You can publish a BigQuery Conversational Analytics agent in Gemini Enterprise. This feature is now generally available (GA). The AI.AGG function now supports the output_schema argument, which lets you specify the schema of the function output as a comma-separated list of fields. This feature is generally available (GA). Metadata migration from Dataproc Metastore to Lakehouse is now generally available (GA). You can perform a one-time backfill migration or dry run to migrate metadata from a Dataproc Metastore service to an Apache Iceberg REST catalog endpoint or a Hive catalog endpoint using the Google Cloud console, the gcloud CLI, or the REST API. For more information, see Migrate metadata from Dataproc Metastore to Lakehouse. The Apache Hive catalog endpoint in the Lakehouse runtime catalog is now generally available (GA). This integration lets you use the metastore as a serverless, central metadata layer, enabling seamless data sharing and unified querying across Apache Spark, Apache Hive, and BigQuery. For more information, see About the Hive catalog endpoint and Set up Spark and Hive with the Lakehouse runtime catalog. Conversational analytics now lets you create a conversation with all of the data sources in multiple projects, or create a conversation with a dataset. These features are generally available (GA). You can copy tables across regions. This feature is now generally available (GA). You can now use column aliases in GoogleSQL. This feature lets you define an alias for an expression in the SELECT clause of a SQL query and immediately reference that alias within the same SELECT list or in the WHERE clause of the same query block. Column aliases also streamline the migration of workloads from other data warehouses such as Snowflake and Teradata, by supporting their syntax. This feature is generally available, and is opt-in only. To use column aliases, you must first enable the feature. You can export a conversational analytics agent's answer, including text, visualizations, tables, and citations, to a PDF or CSV file. This feature is generally available (GA). Conversational analytics in BigQuery is now available in the following locations: northamerica-northeast1 (Montréal) northamerica-northeast2 (Toronto) For more information, see Locations.
Billing - Spend cap budgets are now generally available for a limited set of services For eligible services, you can configure a spend cap budget to automatically pause usage when your estimated spend exceeds the budget amount you set. You can manage spend cap budgets in the Budgets page in the Google Cloud console and using the Cloud Billing Budget API. Spend caps are a cost control mechanism. A spend cap is enforced when usage costs exceed your budget target amount. When enforced, any new request to the eligible services, within the specified project, are paused and no further usage costs are accrued until the spend cap is lifted. You can manually lift an enforced spend cap, or wait until the start of the next month when the spend cap is automatically lifted. Spend caps use gross, estimated costs to trigger the alerts and caps, enforcing a cap much faster than the actual costs are processed and appear on billing reports. Even though faster than reports, the enforcement of spend caps isn't instant and any cost overages are billed as normal. More information about spend cap budgets For managing spend cap budgets in the Google Cloud console, see: How spend cap budgets work to help you control spend Limitations of spend cap budgets Configure a spend cap budget Lift an enforced spend cap For managing spend cap budgets using the Cloud Billing Budget API, see: Using the Cloud Billing Budget API for spend cap budgets Spend cap budget concepts and limitations Create a spend cap budget Lift an enforced spend cap Cloud Billing Budget API REST reference
Certificate Manager - Google-managed public SSL certificates signed by Google Public CA (pki.goog) are gradually transitioning from a 90-day validity period to a 45-day validity period to improve security. To align with modern industry-wide security standards and promote shorter certificate lifespans, Google-managed public certificates now rotate more frequently. This proactive rotation enhances the overall security posture of load balancers. The transition requires no manual intervention or configuration changes as Certificate Manager automatically manages both issuance and renewal. For more information, see Google-managed certificates and Use Google-managed certificates.
Chronicle - Applied Threat Intelligence curated rules now use the GTI_IOC feed As a follow-up to the release of the GTI_IOC feed and the deprecation of the legacy MANDIANT_ACTIVE_BREACH_IOC, MANDIANT_FUSION_IOC, and OPEN_SOURCE_INTEL_IOC feeds, the Applied Threat Intelligence (ATI) curated detection rules are being updated to match against the GTI_IOC feed. You don't need to take any action for curated rules. Updated rules continue to match only on reviewed, stable indicators. If you have custom rules that still reference the legacy feeds, update them to use the GTI_IOC feed. For more information, see Migrate to GTI_IOC. The update follows the standard Google SecOps rollout schedule. It starts on Monday, October 12, 2026 and rolls out to all regions during the week.
Chronicle SOAR - The deadline for the migration of SOAR APIs to the Chronicle API has been extended from November 30, 2026 until March 31, 2027. For more information, refer to SOAR Migration overview
Chronicle Security Operations - Full text on the release page.
Cloud Architecture Center - Agentic AI use case: Orchestrate security operations workflows: Added security guidance for governing AI agents and tools by using Agent Identity, Agent Gateway, Agent Registry, and Model Armor, and organized the design considerations by security, reliability, and cost optimization. Agentic AI use case: Administer interactive learning: Added security guidance for governing AI agents and tools by using Agent Identity, Agent Gateway, Agent Registry, and Model Armor. Agentic AI use case: Classify multimodal data: Added security guidance for governing AI agents and tools by using Agent Identity, Agent Gateway, Agent Registry, and Model Armor, and organized the design considerations by security, cost optimization, and performance optimization. Choose a design pattern for your agentic AI system: Added security guidance for multi-agent systems by using Agent Gateway, Agent Identity, and Agent Registry. Agentic AI use case: Automate data science workflows: Added security guidance for governing AI agents and tools by using Agent Identity, Agent Gateway, Agent Registry, and Model Armor. Agentic AI use case: Enable live bidirectional multimodal streaming: Added security guidance for governing AI agents and tools by using Agent Identity, Agent Gateway, Agent Registry, and Model Armor, and organized the design considerations by security, operational efficiency, cost optimization, and performance optimization. Agentic AI use case: Build a borderless open data lakehouse: Added security guidance for governing AI agents and tools by using Agent Identity, Agent Gateway, Agent Registry, and Model Armor, and organized the design considerations by security and cost and performance optimization. Agentic AI use case: Multimodal GraphRAG resource orchestration: Added security guidance for governing AI agents and tools by using Agent Identity, Agent Gateway, Agent Registry, and Model Armor, and organized the design considerations by AI agent design, security, reliability, operational efficiency, cost optimization, and performance optimization. Stream logs from Google Cloud to Splunk: Updated the recommendation for new customers to use Dataflow Streaming Engine to reduce worker VM storage costs. Multi-tenant agentic AI system: Added security guidance for governing AI agents and tools by using Agent Identity, Agent Gateway, Agent Registry, and Model Armor. Implement agentic analytics workflows for distributed data: Added guidance about securing and governing AI agents, MCP tools, and data access. Added information about using cross-cloud data access to federate external catalogs.
Cloud Asset Inventory - The following resource types are publicly available through the ExportAssets, ListAssets, BatchGetAssetsHistory, QueryAssets, Feed, and Search ( SearchAllResources, SearchAllIamPolicies ) APIs. Cloud Service Mesh: networkservices.googleapis.com/AgentGateway
Cloud Build - You can now choose the release channel for your build config or private pool. The release channel determines how frequently the underlying versions of Debian and Docker are updated.
Cloud Composer - Full text on the release page.
Cloud Networking Products - Outbound Endpoints for Cloud DNS is available in Preview. Attach Outbound Endpoints to forwarding zones or server policies to enable direct DNS query forwarding from VPC networks to external and on-premises DNS resolvers using private IP addresses. For more information, see Outbound Endpoints overview.
Cloud Run - Support for Budget spend caps to pause your Cloud Run workloads is in General Availability (GA).
Cloud SQL Postgres - Private Service Connect is now the default private IP connectivity option when you create a Cloud SQL for PostgreSQL instance in a new Google Cloud project. Private Service Connect lets you connect to your instance from multiple Virtual Private Cloud (VPC) networks across different groups, projects, or organizations, and supports automatic endpoint and DNS record provisioning. When you configure private IP for an instance, you can still choose to use private services access or both connectivity options. For more information, see Private IP configuration options and Configure Private Service Connect. When you enable the Knowledge Catalog (formerly Dataplex Universal Catalog) integration on a Cloud SQL for PostgreSQL instance created before April 18, 2026, the integration defaults to once a day instead of near real-time. Near real-time updates upon Knowledge Catalog enablement aren't yet available for all existing instances. A new announcement will be published when this feature becomes available.
Cloud Storage - Storage Insights datasets include the Object Contexts Catalog view ( object_contexts_catalog_view ), which you can use to analyze object contexts in BigQuery. For more information, see Object contexts catalog and Analyze object contexts. Object contexts with extended data are available in Preview. Google services attach these contexts to your objects during automated analysis, such as machine learning labeling. To retrieve a context and its extended data, use the viewFullContext JSON API method. Object enrichments is now available in Preview. When you configure object enrichments, Cloud Storage applies Google's pre-trained machine learning models to eligible images and PDF documents in your buckets and attaches the resulting metadata to your objects as object contexts. You can inspect enrichments on individual objects or query them at scale in BigQuery by using Storage Insights datasets. For more information, see About object enrichments and Configure object enrichments.
Cloud Video Intelligence API - We are deprecating the emotion label response in the API. Going forward, the API will return UNKNOWN for all emotion related labels.
Cloud Vision API - Face detection model update The emotion label response in the Cloud Vision API is deprecated. Going forward, the Cloud Vision API face detection ( FACE_DETECTION feature) will return UNKNOWN for all emotion-related labels.
Compute Engine - Generally available: The network-optimized C4N machine types with 375 GiB to 12,000 GiB of attached Titanium SSD are now generally available. For more information, see C4N machine series and About Local SSD disks. Generally available: You can query regional views of global Compute Engine project and OS image resources by using the regional read-only projectViews and imageViews endpoints. Querying regional views isolates your control-plane read requests to a specific region, helping your workloads stay available during global API disruptions. For more information, see Use regional views for resilient control-plane reads and Access global resources regionally for high availability. Generally available: When you reserve capacity by using future reservation requests, you can specify that Compute Engine delivers your reserved capacity as specifically targeted reservations. Specifically targeted reservations help you track and control which Compute Engine instances consume your reserved capacity. For more information, see About future reservation requests. Generally available: You can increase the size of a Google Cloud Hyperdisk volume that's in multi-writer mode while the volume is attached to multiple instances. Previously, you had to detach the volume from all instances before you could resize it. For more information, see Share disks between instances and Change the size or provisioned performance of a Hyperdisk volume. If you try to create an on-demand reservation or increase the number of reserved Compute Engine instances in a reservation when the zone has reached its reservation capacity limit for your requested machine family, then the request fails with a RESERVATION_CAPACITY_LIMIT_EXCEEDED error. For more information, see Reservation capacity limit exceeded. Generally available: The storage-optimized Z4M machine series is generally available for Compute Engine. Powered by fifth generation Intel Emerald Rapids Xeon Scalable processors and Titanium offload processors, Z4M instances are purpose-built for workloads that require larger storage capacity, such as: Parallel file systems to support AI/ML workloads I/O intensive workloads such as SQL, NoSQL, and vector databases AI/ML training and inference workloads such as checkpointing and distributed Key-Value (KV) cache The Z4M machine series delivers up to 1,536 GB of memory and 168,000 GiB of local Titanium SSD capacity. Z4M also supports up to 400 Gbps of network bandwidth using two physical NICs. Z4M instances use Titanium and Cloud RDMA to help enable higher levels of networking performance, isolation, and security. For more information, see Storage-optimized machine family. Preview: You can create regional disks, including Hyperdisk Balanced High Availability volumes, by cloning a zonal boot disk. For more information, see Duplicate a disk with clones.
Config Connector - Bug Fixes: BigQueryDataset ( #13352 ) Fixed false-positive diffs for access entries and avoided redundant PATCH requests when the resource is already up to date. ComputeRouterNAT ( #13472 ) Fixed false drift and steady-state reconciliation issues during direct controller takeover. MonitoringDashboard ( #13574 ) Fixed reconciliation errors caused by unrecognized enum values by migrating the direct controller to the Google REST client. New Features: Added support for Cloud SQL Enterprise Plus edition disaster recovery (DR) pair setup and drift suppression for SQLInstance by using the cnrm.cloud.google.com/sqlinstance-advanced-dr: "enabled" annotation. Manager Pods now restart automatically when resourceSettings changes in the operator configuration. Added a guide for managing Config Connector by using GitOps tools (such as Argo CD). New Fields: ArtifactRegistryRepository Added support for spec.remoteRepositoryConfig.commonRepository. ComposerEnvironment Added support for updating spec.config.workloadsConfig.dagProcessor in Cloud Composer 3 environments. ContainerCluster Added support for spec.privilegedAdmissionConfig to configure privileged admission in Autopilot clusters. SQLInstance Added support for disaster recovery observed state fields under status.observedState.replicationCluster ( failoverDRReplicaName, drReplica, psaWriteEndpoint ) and status.observedState.masterInstanceName. New Alpha Resources (Direct Reconciler): AIPlatformReasoningEngine Manage Gemini Enterprise Agent Platform reasoning engines to deploy and run customized reasoning applications. CloudDeployCustomTargetType Manage Cloud Deploy custom target types to define custom deployment targets and rendering actions. EventarcPipeline Manage Eventarc pipelines to transform and route events across Google Cloud services. LiveStreamChannel Manage Live Stream channels to ingest, encode, and distribute live video streams. LiveStreamInput Manage Live Stream inputs to configure video ingestion endpoints. MapManagementStyleConfig Manage Map Management API style configurations to define custom map styles. NetworkSecurityDNSThreatDetector Manage Network Security DNS threat detectors to monitor and mitigate DNS-based threats. Config Connector version 1.159.0 is now available.
Contact Center AI Platform - Full text on the release page.
Dataflow - Dataflow Auto VM Selection now supports 4th generation Compute Engine machine series. When Auto VM Selection is enabled, the service prioritizes these newer generation VMs for improved performance. If 4th generation VMs are unavailable at startup, the service automatically falls back to widely available 2nd generation machine families to ensure that your jobs can start without unnecessary delays. For more information, see Auto VM Selection.
Dataform - You can use Developer Connect to connect Dataform repositories to Secure Source Manager repositories. This feature is in Preview. You can automatically preserve BigQuery data policies and data governance tags (Preview) applied to tables across Dataform executions by enabling the preserveGovernanceControls option in your table or workflow configuration. For more information, see Preserve access controls metadata. This feature is generally available (GA).
Dataproc - Managed Service for Apache Spark (formerly Dataproc on Compute Engine): A bug has been fixed to add-back py4j library in image version 2.1.120. New Managed Service for Apache Spark (formerly Dataproc on Compute Engine) subminor cluster image versions: 2.1.120-debian11, 2.1.120-rocky8, 2.1.120-ubuntu20, 2.1.120-ubuntu20-arm
Dialogflow - gemini-3.5-flash-lite has become generally available (GA). See Generative quotas for how to request quota for Gemini 3 and later models.
Google Cloud Armor - Cloud Armor supports service rate limiting. For more information, see Cloud Armor and service rate limiting. This feature is available in Preview.
Load Balancing - Regular expression matchers in host and route rules in URL maps are now generally available (GA). You can now use regular expressions (regex) matchers to configure more flexible and precise traffic routing rules within URL maps for Application Load Balancers. This feature allows you to leverage the power of RE2 syntax for matching on: URL Paths: Using the regexMatch field within routeRules. HTTP Headers: Using the regexMatch field within headerMatches in routeRules. HTTP Query Parameters: Using the regexMatch field within queryParameterMatches in routeRules. This feature is available in: Global external Application Load Balancers Regional internal Application Load Balancers Cross-region internal Application Load Balancers Regional external Application Load Balancers For more information, see URL map concepts: Regular expressions matchers in host and route rules. Google-managed public SSL certificates signed by Public Certificate Authority ( pki.goog ) are gradually transitioning from a 90-day validity period to a 45-day validity period to improve security. To align with modern industry-wide security standards and promote shorter certificate lifespans, Google-managed public certificates signed by Public Certificate Authority now rotate more frequently. This proactive rotation enhances the overall security posture of load balancers. Transition requires no manual intervention or configuration changes as Google Cloud automatically manages issuance and renewal for both Certificate Manager and Compute Engine SSL certificates. For more information, see Renew a Google-managed SSL certificate. Service rate limiting policies are now available in Preview for regional internal Application Load Balancers and Secure Web Proxies. Service rate limiting policies let you maintain service availability among trusted clients that might consume an inordinate amount of resources. For more information, see the Service rate limiting overview.
Looker - Looker (Google Cloud core) now supports Workforce Identity Federation in preview for instances that use Looker 26.18 and later. Workforce Identity Federation allows users to authenticate by using external identity providers without the need to manage individual Google Accounts. Administrators can select Workforce Identity as the primary authentication method when they create or edit an instance and, optionally, enable secondary Google OAuth for secure backup access. The Looker 26.18 features have begun to be enabled for Looker (Google Cloud core) instances.
NetApp - Google Cloud NetApp Volumes now lets you test Active Directory policy connections for the Flex Unified service level in Preview. You can use the Google Cloud console to verify that a policy is properly connected to the Active Directory service and troubleshoot configuration errors. For more information, see Test the Active Directory policy connection. Google Cloud NetApp Volumes now supports the Flex Unified service level, including custom performance, in the following region: europe-west8 (Milan) For more information about available regions, see Supported regions.
Network Connectivity Center - The technical issue causing incorrect billing for producer VPC spokes has been fixed. Starting today, projects with producer VPC spokes linked to Network Connectivity Center hubs will reflect hourly usage fees. Charges on your future billing invoices are based on Network Connectivity Center pricing.
Secure Web Proxy - Secure Web Proxy supports service rate limiting policies. Use these policies to protect external destinations from traffic overloads and manage the costs of your outbound web traffic. You can attach a service rate limiting policy to your Secure Web Proxy gateways, whether they use an authorization policy or a gateway security policy. For more information, see Configure service rate limiting policies. This feature is available in Preview.
Security Command Center - To increase the precision of attack path analysis and provide attack exposure scores that help you prioritize confirmed internet exposures, Risk Engine attack path simulations support the EXTERNALLY_EXPOSED_VM_INSTANCE External Exposure finding category ( Preview ). This finding category identifies Compute Engine or Google Kubernetes Engine (GKE) resources with a direct public IP address that allows host OS access. For more information, see Detect exposed resources, Risk Engine feature support, and Overview of attack exposure scores and attack paths.
Service Mesh - Full text on the release page.
VPC Service Controls - VPC Service Controls feature (Status: Preview ): Support for using Workload Identity Federation for GKE in ingress and egress rules to allow access to resources protected by a service perimeter is available in Preview. You can specify the following Workload Identity Federation for GKE principals in ingress and egress rules: All GKE Pods that use a Kubernetes service account (by service account name or ID) All GKE Pods in a Kubernetes namespace All GKE Pods in a cluster For more information, see Configure identity groups and third-party identities in ingress and egress rules and Supported identities for ingress and egress rules.
If you have a suggestion, feedback, or a link you want to share, feel free to email me at [email protected]
Have a great week,
Zdenko
