Loading...

Skip to main content

Infrastructure

Weekly, source-backed updates for infrastructure and platform on Google Cloud — anything in scope for the domain — plus notable moves across the wider industry. Newest first.

Week of Oct 12 – Oct 18, 2026​

What changed in Google Cloud​

  • GKE can now upgrade nodes in Standard CPU node pools by updating the existing Compute Engine VM in place, so nodes keep their capacity during upgrades; it applies to surge upgrades with maxUnavailable above 0 on all GKE versions, and opting out requires Cloud Customer Care. — GKE release notes, Oct 16
  • Google-managed public certificates signed by Google's public CA are gradually moving from 90-day to 45-day validity for Certificate Manager and load balancer certificates; renewal stays automatic, but anything that pins or tracks these certificates will see them rotate twice as often. — Certificate Manager release notes, Oct 14
  • The storage-optimized Z4M machine series is generally available, with up to 1,536 GB of memory, 168,000 GiB of local Titanium SSD and 400 Gbps networking. — Compute Engine release notes, Oct 15
  • Creating or growing an on-demand reservation now fails with RESERVATION_CAPACITY_LIMIT_EXCEEDED when the zone has reached its reservation capacity limit for that machine family. — Compute Engine release notes, Oct 15
  • Regional read-only projectViews and imageViews endpoints for global Compute Engine project and OS image resources are generally available, keeping control-plane reads working during global API disruptions. — Compute Engine release notes, Oct 13
  • Hyperdisk volumes in multi-writer mode can now be resized while attached to several instances, generally available. — Compute Engine release notes, Oct 14
  • C4N machine types with 375 GiB to 12,000 GiB of attached Titanium SSD are generally available. — Compute Engine release notes, Oct 12
  • Service rate limiting policies are in preview for regional internal Application Load Balancers, Secure Web Proxy and Cloud Armor. — Cloud Load Balancing release notes, Oct 14
  • RE2 regular expression matchers for paths, headers and query parameters in URL map route rules are generally available for global, regional and cross-region Application Load Balancers. — Cloud Load Balancing release notes, Oct 12
  • Cloud DNS outbound endpoints, which forward queries from VPC networks to on-premises or external resolvers over private IP addresses, are in preview. — Cloud DNS release notes, Oct 12
  • VPC Service Controls ingress and egress rules can now name Workload Identity Federation for GKE principals (a Kubernetes service account, a namespace or a whole cluster), in preview. — VPC Service Controls release notes, Oct 14
  • In-cluster Cloud Service Mesh 1.30.5-asm.8 and 1.29.8-asm.8 fix the Envoy denial-of-service vulnerability in security bulletin GCP-2026-067, alongside new 1.31.1-asm.16 and 1.28.10-asm.49 releases. — Cloud Service Mesh release notes, Oct 12
  • A managed Wiz Runtime Sensor add-on for GKE Standard and Autopilot clusters is in preview, with credentials synced from Secret Manager and lifecycle updates handled by GKE. — Google Cloud blog, Oct 16

Week of Oct 4 – Oct 11, 2026​

What changed in Google Cloud​

  • The microVM sandbox type for GKE Sandbox is now generally available on clusters running 1.37.0-gke.4713000 or later, using Kata Containers and Cloud Hypervisor to isolate untrusted workloads and AI agent runtimes. — GKE release notes, Oct 7
  • GKE flagged a known issue: from version 1.36, kube-dns uses CoreDNS, which returns NXDOMAIN for <a-b-c-d>.<namespace>.pod.cluster.local queries when the namespace does not exist, so workloads relying on that non-spec format should move to headless Service DNS records. — GKE release notes, Oct 6
  • Confidential GKE Nodes with Intel TDX now generally support c4-standard-* machine types of up to 192 vCPUs. — GKE release notes, Oct 5
  • VPC Flow Logs TCP connection logging, which records outbound TCP connection attempts and acknowledged inbound connections for VMs and serverless endpoints, is now generally available. — VPC release notes, Oct 7
  • VPC Service Controls' violation analyzer can now propose narrowly scoped remediation changes, such as ingress and egress rules or access levels, for perimeter denials, in preview. — VPC Service Controls release notes, Oct 8
  • External IPv6 addresses are now supported on Standard Tier networking, in preview. — Network Service Tiers release notes, Oct 5
  • Synchronizing a Compute Engine VM's clock with its host through chrony and ptp_kvm, for accuracy designed to be within 1 ms, is now generally available in all standard public regions. — Compute Engine release notes, Oct 8
  • Z3 machine types with 8 to 44 vCPUs can now use Hyperdisk Balanced High Availability volumes for synchronous replication across two zones, generally available. — Compute Engine release notes, Oct 5

Week of Sep 27 – Oct 3, 2026​

What changed in Google Cloud​

  • Compute Engine now generally supports specifying a 120-second preemption notice duration when creating Spot VMs, giving workloads more time to handle interruptions. — Compute Engine release notes, Sep 30
  • Cloud NAT gateways for Private NAT now generally support NAT64, translating IPv6 traffic to IPv4 destinations. — Cloud NAT release notes, Oct 2
  • VPC Service Controls now generally supports using Google Cloud folders and organizations as resources in ingress and egress rules. — VPC Service Controls release notes, Sep 30
  • Cloud Monitoring's application topology graph, which visualizes relationships, traffic flow, and incidents across applications, services, and workloads, is now generally available. — Cloud Monitoring release notes, Sep 30
  • GKE added public preview support for integrating Vertical Pod Autoscaler recommendations with Horizontal Pod Autoscaler to right-size container CPU requests on scaling workloads. — GKE release notes, Oct 2

Week of Sep 20 – Sep 26, 2026​

What changed in Google Cloud​

  • The storage-optimized X5 machine series for Compute Engine is now generally available, offering up to 48 TB of memory for large-scale SAP HANA and RISE with SAP deployments. — Compute Engine release notes, Sep 25
  • GKE Standard clusters now support up to 512 maximum Pods per node, up from 256, with nodes configured above 256 Pods allocated a larger /22 Pod CIDR block. — GKE release notes, Sep 25
  • GKE ambient networking, a sidecarless service mesh model that moves proxy functionality into GKE Dataplane V2 nodes, is now available in preview through an allowlist. — GKE release notes, Sep 24
  • Memorystore for Valkey now generally supports Valkey version 9.1. — Memorystore for Valkey release notes, Sep 24
  • Cloud Service Mesh released versions 1.30.4-asm.14, 1.29.7-asm.18, and 1.28.10-asm.40, fixing a large batch of platform CVEs. — Cloud Service Mesh release notes, Sep 23
  • Cloud KMS's external key manager (Cloud EKM) now supports migrating existing external key versions between protection levels without service interruption. — Cloud KMS release notes, Sep 23

Week of Sep 14 – Sep 20, 2026​

What changed in Google Cloud​

  • Managed workload identity for backend mTLS is now generally available for global and regional external Application Load Balancers and for regional and cross-region internal Application Load Balancers, automating certificate issuance, rotation, and trust management via Certificate Authority Service and Certificate Manager. — Cloud Load Balancing release notes, Sep 18
  • The storage-optimized Z4D machine series for Compute Engine is now generally available, offering up to 3 TB of memory and 42,000 GiB of local Titanium SSD for databases, analytics, and AI/ML parallel file systems. — Compute Engine release notes, Sep 17
  • Memorystore for Valkey's basic token-based authentication feature is now generally available. — Memorystore for Valkey release notes, Sep 18
  • Backup and DR now supports auto-protection policies that use resource labels, in preview, to automatically assign backup plans to qualifying Compute Engine instances and Persistent Disks at scale across projects. — Backup and DR release notes, Sep 16

Week of Sep 6 – Sep 12, 2026​

What changed in Google Cloud​

  • Compute Engine now generally supports converting a single-project reservation into a shared reservation, or a shared reservation back into a single-project reservation. — Compute Engine release notes, Sep 8
  • Cloud Storage's Storage Intelligence advisor, which lets you monitor and manage your Cloud Storage environment at scale across organizations, folders, and projects, is now generally available. — Cloud Storage release notes, Sep 10
  • Support for the Observability API in VPC Service Controls is now generally available. — VPC Service Controls release notes, Sep 8
  • Google published security bulletin GCP-2026-062 disclosing multiple high-severity Slurm vulnerabilities, including CVE-2026-65107, affecting Cluster Toolkit blueprints, and recommends upgrading to Cluster Toolkit v1.103.0 or later, which updates Slurm to version 25.11.8. — Cluster Toolkit security bulletins, Sep 11
  • Network Connectivity Center now supports propagating global Google APIs endpoints, available in preview. — Network Connectivity Center release notes, Sep 10

Industry​

  • Commentary: HashiCorp disclosed four Consul security bulletins (HCSEC-2026-34 through -37), including a denial-of-service vulnerability in the native RPC listener, fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4 — worth checking for any team running Consul service mesh alongside GCP workloads. — HashiCorp security advisory HCSEC-2026-35, Sep 10