Google Distributed Cloud air-gapped 1.16.1 release notes

June 5, 2026

Announcement
Google Distributed Cloud (GDC) air-gapped 1.16.1 is available.
See the product overview to learn about the features of Distributed Cloud.
Feature
The following new features are available:

Cluster management

  • Added support for A-series H200 and B300 machines for Kubernetes cluster nodes. For more information, see Cluster node machine types.

Infrastructure

  • Added support for B300 bare metal machines in an organization.

Managed Harbor Services

  • Added support for project Service Accounts. This lets you use your service account identity to securely interact with your Harbor instances and manage container repositories. For more information, see Managed Harbor Service overview.

Networking

  • Cloud DNS is now generally available. This service provides a reliable, scalable way to manage Domain Name Service records, using a Kubernetes API or the command line. For more information, See About Cloud DNS.

  • DNS now supports TLS based encryption of all DNS traffic for system and first party services, both internally within Distributed Cloud, and between Distributed Cloud and customer networks.

Observability

  • Added observability tracking for workloads. This feature provides monitoring and logging capabilities designed to streamline the tracking and troubleshooting of workloads. For more information, see Observability tracking for workloads.

Storage

  • Added support for auto-synchronous dual-zone buckets. During normal operations, the ingest policy synchronously writes object copies to both designated zones, with fallback to asynchronous replication during outages.

  • Added support for supplying checksums in trailing HTTP headers in object uploads. This improves data integrity and error detection. For more information, see Upload and download storage objects.

  • Added enhancement that ensures object storage credentials are automatically deleted when their associated Service Account is removed. This prevents orphaned secrets in a project namespace. For more information, see Delete storage buckets.

  • Added support for windowed uptime SLO for zonal S3 availability. This change ensures that health metrics are not skewed by multiple retries from single high-volume projects, providing a more accurate reflection of the actual user experience across an organization.

Virtual machines

  • Added A-series A4 B300 machines to the list of supported VM machine types. For more information, see View VM machine type.

  • Added Windows 2022 image support for bring-your-own (BYO) custom images. For more information, see GDC-supported VM images.

  • Added Secure Boot certificate renewal support for VMs with expiring certificates. For more information, see Update Secure Boot certificates.

Security
Updated the Rocky OS image version to 20260318 to apply the latest security patches and important updates.

The following security vulnerabilities are fixed:

Issue
The following issues are identified:

Cluster management

  • Kubernetes cluster is not removed after deletion.

Endpoint detection and response

  • The Isolate Host option is visible but not effective in the Kibana UI.

GDC console

  • Documentation hosted in the GDC console shows a 404 error.

Identity and access management

  • A CustomRole resource that includes a zonalRules section might not grant permissions reliably.

Infrastructure as Code (IAC)

  • Upgrades from GDC version 1.15 to 1.16 with IAC might fail.

Inventory

  • During inventory validation, a warning is shown when a cable has FS as a transceiver vendor.

Key management system:

  • KMS configured to use a CTM root key does not failover when an HSM is unavailable.

Resource Manager

  • The Resource Manager project controller might enter a crash loop state due to out-of-memory errors.

Servers

  • The server bootstrap fails with an iDRAC error.

  • Server provisioning fails with a BMCConfigPreinstallLicenseInstallCompleted status condition error for Dell servers.

  • A BareMetalHostNetwork custom resource might contain multiple management gateway routes.

Storage

  • When performing list object requests on buckets containing multi-part uploads, the requests might fail and the obj-s3-availability metric might drop.

  • Object storage audit log forwarding might fail during a sequential upgrade due to missing Bucket custom resources.

  • StorageGRID upgrades might get stuck with a no upgrade uploaded error.

Virtual machines

  • A-series a4-ultragpu-8g VMs that use a guest OS with a 4.x kernel might take over 25 minutes to start.

Vulnerability management

  • Vulnerability scans using Tenable Enclave might not complete.
Fixed
The following issues are fixed:

Firewall

  • Legacy firewall rules might block organization to root admin traffic after upgrade.

Identity and access management

  • An OPA Gatekeeper trust issue after a root CA rotation prevents IAM role creation in new projects.

Storage

  • Frequent OBJ-A0003 alerts persist despite standard silencing efforts.

  • After StorageGRID primary admin node downtime, object storage upgrade attempts performed using an ObjectStorageUpgradeRequest CR might fail due to requests being directed to the non-primary StorageGRID admin node.

Change
The following changes are identified:

Version updates:

Deprecated
The following features are deprecated:

Database services

  • The Database Service is deprecating its legacy high availability (HA) implementation in versions 1.14.12 and earlier. Legacy HA database clusters will be supported until its sunset date, which is to be announced. There is no user-facing change in the new HA feature, as the API for enabling and disabling HA remains the same. To verify if your HA database cluster is using the new implementation, check if the annotation dbcluster.dbadmin.goog/raasEnabled exists on your HA database cluster CR. This annotation will only appear on HA database clusters using the new implementation. If you don't have this annotation, you can migrate to the latest HA implementation.