Releasesby GlyphGKE support for using the c3-standard-*-lssd machine types as Confidential GKE Nodes with Intel TDX is...
GKE support for using the c3-standard-*-lssd machine types as Confidential GKE Nodes with Intel TDX is generally available. For more information, see the following: To use this feature with GKE, see Encrypt workload data in-use with Confidential GKE Nodes . To learn more about the feature from Compute Engine, see Confidential VM overview .
Also shipped Sep 3, 2026Google Cloud in September 2026 →
External lineage (General availability)
External lineage is now generally available and is no longer in Preview .
Restricted Session Scope for agents (General availability)
With this release, Restricted Session Scope (RSS) is generally available. An RSS is a privilege ceiling that limits what an agent can do on behalf of a user. It intersects with RBAC and never grants privileges the user doesn't already have through their roles.
Share metric views with OpenSharing (Beta)
You can now share metric views with Databricks users in other metastores or accounts using OpenSharing. See Add metric views to a share and Read shared metric views .
Genie One enhancements
- Ask Genie button hidden when unsupported : In embedded dashboards, the Ask Genie button is now hidden when it isn't supported. See Ask Genie in embedded dashboards . Push notifications for scheduled tasks (Public Preview) : The Genie mobile app can now send push notifications for scheduled tasks to iOS devices. See Push notifications .
Web search in Genie One (Beta)
Genie One can now search the public web to answer questions that need current information, such as recent releases, third-party documentation, or news. Genie One decides when to search and cites the sources it uses, showing each as a link you can open. See Search the web .
Workspace Outbound Access Protection (OAP) for Operations Agent and Fabric Maps (Preview)
Co-authors: Andre Terceros and Bodhisatva Gautam Workspace Outbound Access Protection (OAP) in Microsoft Fabric helps WS admins secure outbound connections from workspace items to external resources. Administrators can control outbound access by blocking unwanted connections by default and allowing only approved connections through configured rules.
More from Google Kubernetes EngineEvery Google Kubernetes Engine release →
Kubernetes 1.37 is available
Kubernetes 1.37 is now available in the Rapid channel. For more information about the content of Kubernetes 1.37, read the Kubernetes 1.37 Release Notes and Kubernetes 1.37 Release Blog .
Removed in 1.37
- Identity Service for GKE is no longer supported starting in GKE 1.37: Creating new clusters or upgrading existing clusters to GKE version 1.37 or later with Identity Service for GKE enabled is blocked. For external OIDC authentication, please migrate to Workforce Identity Federation .
Other changes in 1.37
- Starting with GKE version 1.37.0-gke.2100000, newly created clusters default to using control plane node creation, which improves cluster security by having the control plane manage node registration instead of kubelet self-registration. Existing clusters are not affected.
New features in 1.37
- The PodCertificateRequest and ClusterTrustBundle APIs are generally available and promoted to certificates.k8s.io/v1. DRA device metadata publishing is enabled with beta support (for use with DRA drivers which include this feature). HorizontalPodAutoscaler enables beta support for scaling to zero . StatefulSet maxUnavailable support is now enabled.
(2026-R37) Version updates
GKE cluster versions have been updated. New versions available for upgrades and new clusters. The following versions are now available for new GKE clusters, and for manual control plane upgrades and node upgrades for existing clusters. For more information about versioning and upgrades, see GKE versioning and support and About GKE cluster upgrades .
Note : Your clusters might not have these versions available
Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. Version 1.36.3-gke.1767000 is now the default version for cluster creation in the Rapid channel.
GKE version 1.35.1-gke.1031000 and later include the following changes to automatically created firewall...
GKE version 1.35.1-gke.1031000 and later include the following changes to automatically created firewall rules for Services : Changes the priority of multiple existing firewall rules for Services from 1000 to 999 . Creates additional firewall rules to deny traffic that is not explicitly allowed by other auto-created firewall rules.
The bare metal machine types from the C3 machine series are now generally available with GKE clusters
The bare metal machine types from the C3 machine series are now generally available with GKE clusters. You can now provision machine types such as c3-standard-192-metal in Standard mode with any available GKE version.