Google Kubernetes Engine

GKE has fixed a security issue in fleet management that could have allowed unauthorized configuration changes to clusters registered to a fleet, with the fix rolled out to all regions and no action required. GKE has also resolved the Cloud Storage FUSE CSI driver issue from October 2, 2026, which can now be fixed on ubuntu_containerd and older cos_containerd node pools by upgrading the cluster control plane to 1.36.5-gke.1032000 or later, 1.37.1-gke.1552000 or later, or one of the listed 1.36.4 mitigation patches.

Matters for: Teams running GKE clusters registered to a fleet, and those using the Cloud Storage FUSE CSI driver on ubuntu_containerd or older cos_containerd node pools.

Apigee Edge for Private Cloud 4.54.00 replaces Java 8 with Java 17 and Java 21, removes the Classic UI and apigee-sso component in favor of the New Edge UI and an integrated OIDC identity broker, and upgrades bundled Cassandra, Postgres, OpenLDAP, ZooKeeper, Qpid Broker-J, Nginx, and Consul versions. These changes are not backward-compatible, so deployments must migrate off the Classic UI and apigee-sso before upgrading, update firewall and load balancer rules for the New Edge UI's new default port 3001, take a validated LDAP backup, and review custom JavaCallout policies or resource JARs and any hardcoded TLS_RSA_* cipher suite overrides that can break under Java 21.

Matters for: Operators running Apigee Edge for Private Cloud with Apigee SSO enabled, custom Java-based proxy extensions, or firewall/load balancer rules pinned to the old Classic UI port.

GKE now offers new cluster versions for the Rapid channel, including 1.36.4-gke.2046002 as the new default for cluster creation, plus additional 1.34, 1.35, 1.36, and 1.37 patch versions and an alpha release 1.38.0-gke.2743000+preview.These versions are available for new clusters and for manual control plane and node upgrades on existing clusters, though rollout across all Google Cloud zones can take multiple days to complete.

Matters for: Platform teams managing GKE clusters on the Rapid release channel who need to plan control plane and node version upgrades.

This release note covers updates to Anti Money Laundering AI, Apigee hybrid, the App Optimize API, Cloud Run, and Gemini Enterprise, but it does not mention any new capability, fix, or change for Google Kubernetes Engine itself.Because no GKE-specific item is present, no action or configuration change is required for GKE users based on this text.

Matters for: This has no direct relevance to teams operating GKE clusters, since the listed changes apply to Apigee hybrid, Cloud Run, and Gemini Enterprise rather than to GKE.

This release note covers updates to Apigee X, BigQuery, Cloud NAT, Gemini Enterprise, and Google Cloud CCaaS, but contains no entries for Google Kubernetes Engine. Engineers relying on GKE-specific release information will need to consult a different source, since none of the listed fixes or features apply to GKE.

Matters for: Teams running Google Kubernetes Engine workloads that also depend on Apigee, BigQuery, or CCaaS services covered in this same Google Cloud release cycle.

Network Services Monitoring, now in Preview within Network Intelligence Center, visualizes communication paths and network metrics for Google Kubernetes Engine services and workloads that have ambient networking enabled. Previously this visibility into service-to-service communication and network metrics for ambient-networking-enabled GKE workloads was not available.

Matters for: Platform and networking teams running GKE clusters with ambient mesh/ambient networking enabled who need visibility into service communication paths and metrics.

Apigee hybrid v1.16.10 can now run on Google Kubernetes Engine clusters using Kubernetes 1.36, along with Google Distributed Cloud, Amazon EKS, Azure AKS, and RKE2. This release also patches multiple CVEs across Apigee hybrid components such as apigee-asm-ingress, apigee-asm-istiod, apigee-connect-agent, apigee-fluent-bit, apigee-hybrid-cassandra-client, apigee-mart-server, and apigee-mint-task-scheduler.

Matters for: Teams operating Apigee hybrid API gateways on GKE clusters that need to upgrade to Kubernetes 1.36 while maintaining current CVE patch levels.