Google Distributed Cloud air-gapped 1.15.3 hotfixes

Hotfix upgrade instructions for version 1.15.3

You must account for the following requirements to ensure a successful upgrade to GDC 1.15.3:

  • For new bootstraps, you must bootstrap the root organization directly to the 1.15.3-gdch.3086 binary.

  • To prevent a critical operating system (OS) downgrade when upgrading your environment from version 1.14.12, you must complete the following:

    1. Load all available hotfixes and version 1.15.3-gdch.3086 into the system first.

    2. Verify hotfixes are loaded prior to starting the upgrade to ensure the correct OS version is used.

Hotfix 5

Fixed
The 1.15.3-gdch.3086-5 hotfix is available. This hotfix fixes the following issues:

Operating system:

  • Added SLO dashboards for operating systems in the root admin cluster and management API server.

  • Fixes the missing delete permission for the OSPolicy controller.

Hotfix 4

Fixed
The 1.15.3-gdch.3086-4 hotfix is available. This hotfix fixes the following issues:

Backup:

  • Prevents backup plans from running overlapping backups to conserve system resources, especially against aggressive schedules.

  • Fixes an issue where the VirtualMachineRestore object couldn't be deleted properly.

  • Fixes an issue where an imported backup without a creation time couldn't be deleted.

Billing:

  • Introduces a new billing SKU required for Gemini 2.5 Flash.

Cluster management:

  • Fixes an issue where the Kubernetes cluster is not removed after deletion.

Database Service:

  • Improves the reliability of creating and deleting databases and backups.

Cloud DNS:

  • Fixes the issue where wildcard DNS records aren't created at the zone apex level.

  • Fixes the issue where it takes over 25 minutes to create a managed DNS zone.

Health:

  • Prevents alerts for SLOs marked as experimental by submitting an Infrastructure as Code (IaC) change.

Inventory management:

  • Fixes the issue where the gdcloud system assets add command failed to generate splitInterface configurations for breakout cables during dynamic expansion.

Lifecycle management:

  • Fixes an issue that prevented successful upgrades for subcomponents that used the lcm.private.gdc.goog/paused-remote: "true" annotation.

Logging:

  • Fixes the egress label of the org infrastructure cluster for external security information and event management.

Networking:

  • Fixes an issue where a cluster gets stuck in a deleting state.

  • Adds new networking dashboards for runtime metrics.

Platform authentication:

  • Adds additional probers to the system.

Security:

  • Fixes the SSH machine certificate generation process so it's an atomic operation.

  • Fixes an issue during the Nessus activation process for new installations.

Storage:

  • Fixes the persistence of dual-zone buckets after deletion in the GDC console.

  • Fixes the storage bucket versioning errors in the GDC console.

  • Fixes the issue where security key materials could be mismatched across zones in a dual-zone bucket.

  • Fixes the issue where the StorageGRID load balancer endpoint server certificates don't automatically rotate.

Upgrade:

  • Fixes an issue that causes the siem-cluster subcomponent to become unresponsive.

Virtual machines:

  • Fixes data population issues in the following IO dashboards:

    • VMM-R0006: VM SSH connection problems
    • VMM Control Plane: pods (expected versus observed)
    • VMM GPU Control Plane: pods (expected versus observed)

  • Fixes an erroneous alert that occurs when creating a virtual machine disk.

Hotfix 3

Fixed
The 1.15.3-gdch.3086-3 hotfix is available. This hotfix fixes the following issues:

Security:

  • Updates Transport Layer Security (TLS) standards to restrict and enforce approved cipher suites (AES-256).

Hotfix 2

Fixed
The 1.15.3-gdch.3086-2 hotfix is available. This hotfix fixes the following issues:

Firewall:

  • The FirewallNode resource is in a NotReady state after upgrade.

Networking:

  • The unet-root-admin-cm job fails due to a missing organization.

Node OS:

  • Linux Unified Key Setup (LUKS) keys are missing after upgrade prevents node from booting.

Operations lifecycle:

  • The iam-ais subcomponent fails due to a race condition.

Hotfix 1

Fixed
The 1.15.3-gdch.3086-1 hotfix is available. This hotfix fixes the following issues:

Node OS:

  • Updated the Rocky OS image version to 20260107 to apply the latest security patches and important updates.