Announcement

Google Distributed Cloud (software only) for bare metal 1.36.0-gke.532 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.36.0-gke.532 runs on Kubernetes v1.36.0-gke.2800.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the listing of our previously-qualified storage partners.

Feature

Google Distributed Cloud (software only) for bare metal includes the following feature enhancements:

• Upgraded the Ansible version to 2.18. This version requires Python 3.8+ on target nodes. Because RHEL 8 defaults to Python 3.6, you must have Python 3.9 installed on nodes using RHEL 8.10. RHEL 8.8 is no longer supported.
• Updated the Kubernetes version to 1.36.
• Upgraded containerd from 2.1 to 2.2
• Containerd is required for new cluster installations and cluster migrations to Node Agent mode.
• Added support for the layer 4 gateway controller.
• bmctl backup cluster in Node Agent mode requires at least 12 GB of free space in /tmp on the admin workstation and all target nodes to buffer backup archives. You can configure a custom temporary directory by setting TMPDIR.
• If you use Node Agent and receive an error that creating the backup fails to create an archive file, you might need 12 GBs of free space in the /tmp directory on the admin node and all target nodes. For more information, see Can't create a backup for a Node Agent node .
• Removed the deprecated anthos-metadata-agent component that kubestore-collector replaced.
• Removed the deprecated csi-snapshot-validation-webhook component. Upstream Kubernetes validation is now handled natively via Common Expression Language (CEL) rules within the deployed Custom Resource Definitions (CRDs). For more information, see Volume snapshots.
• Vertical pod autoscaling is generally available. For more information, see Configure vertical Pod autoscaling
• Unified registry mirror and private registry update behavior across all cluster types while preserving configurations.

Fixed

The following issues were fixed in 1.36.0-gke.532:

• Fixed vulnerabilities listed in Vulnerability fixes.
• Fixed an issue where CA certificate secrets with identical names across different namespaces stalled cluster upgrades. In this release, the system automatically prepends the target namespace prefix to all the CA certificate secret names when forwarding them to the destination namespace. The prefix makes sure each CA certificate secret name is unique so the upgrade doesn't stall.
• Fixed an issue where Certificate Authority (CA) rotation failed for self-managing clusters (admin, hybrid, and standalone). The failure occurs during the final phase of the rotation when attempting to move management resources back from the temporary bootstrap cluster to the self-managing cluster, which can leave the cluster in an unmanageable state. You must upgrade your clusters to version 1.33.1000-gke.59 before you rotate your CAs.
• Fixed an issue where the status for Ingress resources didn't update when using bundled ingress.
• Fixed an issue where rolling back a node pool failed because stale Cluster API (CAPI) bootstrap secrets retained deprecated kubelet flags.
• Updated cluster-proportional-autoscaler to address security vulnerabilities.
• Fixed an issue where etcd-events installation entered an infinite retry loop during machine initialization due to incomplete cleanup of the data directory after a learner promotion failure.
• Fixed an issue where the NodePool controller prematurely updated Status.ManagedFields on partial reconciliation failures, causing removed taints and labels to remain stranded on affected nodes.
• Fixed an issue where recreating a user cluster using a previously used name caused cluster provisioning to stall indefinitely in the PROVISIONING state because of a missing k8s-health-check Service account.
• Fixed an issue where restarting kube-apiserver during etcd encryption updates abruptly terminates the container, causing stale service endpoints and transient connection failures for in-cluster workloads.
• Fixed an issue where the installer stalled for three minutes per control plane node during certificate rotation or etcd encryption updates because of an incorrect kube-apiserver container termination check.

Announcement

Google Distributed Cloud (software only) for bare metal 1.34.800-gke.90 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.34.800-gke.90 runs on Kubernetes v1.34.7-gke.200.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the listing of our previously-qualified storage partners.

Fixed

The following issues were fixed in 1.34.800-gke.90:

• Fixed vulnerabilities listed in Vulnerability fixes.
• Removed csi-snapshot-validation-webhook, the Snapshot validation webhook component.

Announcement

Google Distributed Cloud (software only) for bare metal 1.35.400-gke.81 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.35.400-gke.81 runs on Kubernetes v1.35.3-gke.400.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the listing of our previously-qualified storage partners.

Fixed

The following issues were fixed in 1.35.400-gke.81:

• Link to Vulnerability fixes for the list of security vulnerabilities addressed in this release.

Announcement

Google Distributed Cloud (software only) for bare metal 1.33.1100-gke.72 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.33.1100-gke.72 runs on Kubernetes v1.33.11-gke.100.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the listing of our previously-qualified storage partners.

Feature

The following changes were added in 1.33.1100-gke.72:

• Removed the deprecated csi-snapshot-validation-webhook component. Upstream Kubernetes validation is now handled natively via Common Expression Language (CEL) rules within the deployed Custom Resource Definitions (CRDs). For more information, see Volume snapshots.

Fixed

The following issues were fixed in 1.33.1100-gke.72:

• Fixed vulnerabilities listed in Vulnerability fixes.

Fixed

A release note published on May 6, 2025 stated that each Keepalived instance virtual router redundancy protocol (VRRP) configuration is configured with a nopreempt flag to avoid elections when a non-master instance is restarted.

The nopreempt flag was removed in release 1.32.200 and later. For more information, see Control plane VIP isn't moved when HAProxy is unavailable.

Announcement

Google Distributed Cloud (software only) for bare metal 1.34.700-gke.93 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.34.700-gke.93 runs on Kubernetes v1.34.7-gke.200.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the listing of our previously-qualified storage partners.

Feature

The following change was added in 1.34.700-gke.93:

• Removed the deprecated csi-snapshot-validation-webhook component. Upstream Kubernetes validation is now handled natively via Common Expression Language (CEL) rules within the deployed Custom Resource Definitions (CRDs). For more information, see Volume snapshots.

Fixed

The following issues were fixed in 1.34.700-gke.93:

• Fixed vulnerabilities listed in Vulnerability fixes.

Announcement

Google Distributed Cloud (software only) for bare metal 1.35.300-gke.87 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.35.300-gke.87 runs on Kubernetes v1.35.3-gke.400.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Feature

The following change was added in 1.35.300-gke.87:

• Removed the deprecated csi-snapshot-validation-webhook component. Upstream Kubernetes validation is now handled natively via Common Expression Language (CEL) rules within the deployed Custom Resource Definitions (CRDs). For more information, see Volume snapshots.

Fixed

The following issues were fixed in 1.35.300-gke.87:

• Link to Vulnerability fixes for the list of security vulnerabilities addressed in this release.

Announcement

Google Distributed Cloud (software only) for bare metal 1.33.1000-gke.59 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.33.1000-gke.59 runs on Kubernetes v1.33.11-gke.100.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the listing of our previously-qualified storage partners.

Fixed

The following issues were fixed in 1.33.1000-gke.59:

• Fixed vulnerabilities listed in Vulnerability fixes.
• Fixed an issue where Certificate Authority (CA) rotation failed for self-managing clusters (admin, hybrid, and standalone). The failure occurs during the final phase of the rotation when attempting to move management resources back from the temporary bootstrap cluster to the self-managing cluster, which can leave the cluster in an unmanageable state. You must upgrade your clusters to version 1.33.1000-gke.59 before you rotate your CAs.

Announcement

Google Distributed Cloud (software only) for bare metal 1.34.600-gke.53 is available. To upgrade, see Upgrade clusters. Runs on Kubernetes v1.34.7-gke.200.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Fixed

The following issues were fixed in 1.34.600-gke.53:

• Link to Vulnerability fixes for the list of security vulnerabilities addressed in this release.
• Fixed an issue where Certificate Authority (CA) rotation failed for self-managing clusters (admin, hybrid, and standalone). The failure occurs during the final phase of the rotation when attempting to move management resources back from the temporary bootstrap cluster to the self-managing cluster, which can leave the cluster in an unmanageable state. You must upgrade your clusters to version 1.34.600-gke.53 before you rotate your CAs. Running a CA rotation on self-managing clusters in versions prior to 1.34.600-gke.53 triggers this issue and can disrupt your ability to manage the cluster.
• Fixed an issue where a transient or partial failure during node pool updates could cause node taints or labels to become permanently stuck (stranded) on worker nodes, even after you removed them from the NodePool custom resource specification.

Announcement

Google Distributed Cloud (software only) for bare metal 1.35.200-gke.66 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.35.200-gke.66 runs on Kubernetes v1.35.3-gke.400.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Fixed

The following issues were fixed in 1.35.200-gke.66:

• Fixed vulnerabilities listed in Vulnerability fixes.
• Fixed an issue where a transient or partial failure during node pool updates could cause node taints or labels to become permanently stuck (stranded) on worker nodes, even after you removed them from the NodePool custom resource specification.
• Fixed an issue where, during the machine initialization phase, the etcd-events pod read the stale data directory when it started and attempted to reuse the old member ID to rejoin the cluster instead of the new one. Trying to use the old member ID to rejoin the cluster resulted in an infinite retry loop and caused the cluster to reject the connection. The fix ensures the /var/lib/etcd-events directory is cleared upon failure, and adds retry logic to kubeadm-reset to improve resiliency against transient API errors.
• Fixed an issue where, when enabling or updating etcd encryption, the API server was terminated abruptly, causing transient connection timeouts or failures for in-cluster workloads for up to five minutes.
• Fixed an issue where, during control plane certificate rotation or etcd encryption updates, the installer stalled for three minutes per control plane node while waiting for the local API server to restart, causing nodes to temporarily report an Unknown status and triggering transient routing disruptions (such as 503 Service Unavailable or ImagePullBackOff errors) for workloads scheduled on those nodes.

Announcement

Google Distributed Cloud (software only) for bare metal 1.33.900-gke.90 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.33.900-gke.90 runs on Kubernetes v1.33.11-gke.100.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Fixed

The following issues were fixed in 1.33.900-gke.90:

• Fixed vulnerabilities listed in Vulnerability fixes.
• Fixed an issue where a transient or partial failure during node pool updates could cause node taints or labels to become permanently stuck (stranded) on worker nodes, even after you removed them from the NodePool custom resource specification.
• Fixed an issue where, if a new control plane node failed to join a cluster during bootstrapping or scaling (associated with installer Ansible runner job failures), orphaned etcd memberships were not cleaned up, causing the existing control plane's API server to restart repeatedly (flap) and blocking subsequent retry attempts.
• Fixed an issue where, during control plane certificate rotation or etcd encryption updates, the installer stalled for three minutes per control plane node while waiting for the local API server to restart, causing nodes to temporarily report an Unknown status and triggering transient routing disruptions (such as 503 Service Unavailable or ImagePullBackOff errors) for workloads scheduled on those nodes.
• Fixed an issue where, when enabling or updating etcd encryption, the API server was terminated abruptly, causing transient connection timeouts or failures for in-cluster workloads for up to five minutes.
• Fixed an issue where, when recreating a user cluster with a previously used name (which commonly occurs during Terraform deployments or manual reinstalls), cluster provisioning stalled indefinitely in the provisioning state due to a missing k8s-health-check service account. The installer ensures that the service account is created, eliminating the need to manually create the service account as a workaround.

Announcement

Google Distributed Cloud (software only) for bare metal 1.34.500-gke.108 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.34.500-gke.108 runs on Kubernetes v1.34.7-gke.200.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Fixed

The following issues were fixed in 1.34.500-gke.108:

• Fixed vulnerabilities listed in Vulnerability fixes.
• Fixed an issue where, if a new control plane node failed to join a cluster during bootstrapping or scaling (associated with installer Ansible runner job failures), orphaned etcd memberships were not cleaned up, causing the existing control plane's API server to restart repeatedly (flap) and blocking subsequent retry attempts.
• Fixed an issue where, during control plane certificate rotation or etcd encryption updates, the installer stalled for three minutes per control plane node while waiting for the local API server to restart, causing nodes to temporarily report an Unknown status and triggering transient routing disruptions (such as 503 Service Unavailable or ImagePullBackOff errors) for workloads scheduled on those nodes.
• Fixed an issue where, when enabling or updating etcd encryption, the API server was terminated abruptly, causing transient connection timeouts or failures for in-cluster workloads for up to five minutes.
• Fixed an issue where, when recreating a user cluster with a previously used name (which commonly occurs during Terraform deployments or manual reinstalls), cluster provisioning stalled indefinitely in the provisioning state due to a missing k8s-health-check service account. The installer ensures that the service account is created, eliminating the need to manually create the service account as a workaround.

Announcement

Google Distributed Cloud (software only) for bare metal 1.35.100-gke.72 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.35.100-gke.72 runs on Kubernetes v1.35.3-gke.400.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Fixed

The following issues were fixed in 1.35.100-gke.72:

• Fixed vulnerabilities listed in Vulnerability fixes.

Announcement

Google Distributed Cloud (software only) for bare metal 1.35.100-gke.72 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.35.100-gke.72 runs on Kubernetes v1.35.3-gke.400.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Fixed

The following issues were fixed in 1.35.100-gke.72:

• Fixed vulnerabilities listed in Vulnerability fixes.

Announcement

Google Distributed Cloud (software only) for bare metal 1.33.800-gke.75 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.33.800-gke.75 runs on Kubernetes v1.33.11-gke.100.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Fixed

The following issues were fixed in 1.33.800-gke.75:

• Fixed vulnerabilities listed in Vulnerability fixes.

Announcement

Google Distributed Cloud (software only) for bare metal 1.34.400-gke.88 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.34.400-gke.88 runs on Kubernetes v1.34.6-gke.200.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Announcement

The following features were added in 1.34.400-gke.88:

• Added a periodic health check to detect stale mounts of Secrets and ConfigMaps on pods. This helps identify rare scenarios where nodes serve outdated secret data after a rotation, which can lead to authentication failures. Currently enabled for GKE Identity Service pods, the check runs on each node and compares the locally cached volume content with the live data from the API server, reporting a mismatch only after a 5-minute grace period to allow for normal update delays.

Fixed

The following issues were fixed in 1.34.400-gke.88:

• Fixed vulnerabilities listed in Vulnerability fixes.
• Fixed an issue where, during the machine initialization phase, the etcd-events pod read the stale data directory when it started and attempted to reuse the old member ID to rejoin the cluster instead of the new one. Trying to use the old member ID to rejoin the cluster resulted in an infinite retry loop and caused the cluster to reject the connection. The fix ensures the /var/lib/etcd-events directory is cleared upon failure, and adds retry logic to kubeadm-reset to improve resiliency against transient API errors.
• Fixed an issue where concurrent tasks on the same node failed when containerd restarts. After the fix, tasks are locked and run sequentially to ensure each task completes successfully before the next begins. Each lock is held for up to 20 minutes or until the task reaches success or failure. To bypass this safety mechanism, you can run tasks concurrently by adding baremetal.cluster.gke.io/concurrent-machine-update: "true" to your cluster.
• Fixed an issue where node upgrades could hang indefinitely and bypass the 20-minute maintenance timeout. This issue occurred when a node contained completed pods within a namespace that was in a Terminating state. Because the Kubernetes Eviction API rejects operations in terminating namespaces, the cluster controller entered an infinite retry loop. The fix updates the drain process to skip eviction for pods in terminal phases, allowing the upgrade to proceed normally.

Announcement

Google Distributed Cloud (software only) for bare metal 1.35.0-gke.525 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.35.0-gke.525 runs on Kubernetes v1.35.2-gke.300.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Announcement

The following features were added in 1.35.0-gke.525:

• Platform update to Kubernetes 1.35: This release updates the underlying Kubernetes version to 1.35.

  • For customers using Red Hat Enterprise Linux (RHEL) 7 or 8, which default to cgroupsv1, you must manually configure your operating system to enable cgroupsv2 before upgrading. For instructions, see the Red Hat knowledge base article on enabling cgroup v2.
  • For more information on migrating to cgroupsv2, see the Kubernetes documentation on migrating to cgroupv2.
  • This release upgrades the container runtime, containerd, from version 2.0 to 2.1.

• Added a periodic health check to detect stale secret and ConfigMap mounts on Google Kubernetes Engine pods. To account for normal propagation delays, a content mismatch is only reported as an error if the data remains stale for more than 5 minutes.

• Upgraded the Ansible version to 2.18. This version requires Python 3.9 on target nodes. For customers using Red Hat Enterprise Linux, version 8.10 or later is required because the default Python version in earlier Red Hat 8 releases (Python 3.6) is not supported by Ansible 2.18.

• You can use the header section of the cluster configuration file to specify registry mirrors for your clusters. This simplifies the management of registry mirrors and provides a more consistent configuration experience. For instructions on how to update or remove these settings, see the Registry Mirror documentation.

• Preview Added support for EgressDSCP tagging. With this feature, you can mark IP headers with specific Differentiated Services Code Point (DSCP) values on packets leaving the cluster to prioritize network traffic. To use this feature, you must set preview.baremetal.cluster.gke.io/traffic-selector: to enable in your cluster configuration and manage traffic selection using the EgressDSCP and TrafficSelector custom resources. For more information, see Configure EgressDSCP tagging.

• bmctl prints the Operation ID and OperationType to the console after cluster installation and upgrade operations.

Fixed

The following issues were fixed in 1.35.0-gke.525:

• Fixed vulnerabilities listed in Vulnerability fixes.
• Fixed an issue where node upgrades could hang indefinitely and bypass the 20-minute maintenance timeout. This issue occurred when a node contained completed pods within a namespace that was in a Terminating state. Because the Kubernetes Eviction API rejects operations in terminating namespaces, the cluster controller entered an infinite retry loop. The fix updates the drain process to skip eviction for pods in terminal phases, allowing the upgrade to proceed normally.
• Fixed an issue where concurrent tasks on the same node failed when containerd restarts. After the fix, tasks are locked and run sequentially to ensure each task completes successfully before the next begins. Each lock is held for up to 20 minutes or until the task reaches success or failure. To bypass this safety mechanismrun and run tasks concurrently, add the following annotation to your cluster: baremetal.cluster.gke.io/concurrent-machine-update: "true".
• Fixed an issue where Metrics API operations—including kubectl top, Horizontal Pod Autoscaling, and Vertical Pod Autoscaling could fail with TLS verification errors during certificate authority rotation. This occurred because the leaf certificate was not immediately renewed when the certificate authority was rotated, causing a temporary mismatch between the trusted certificate authority bundle and the certificate presented by the metrics server.
• Fixed an issue where Cluster CA rotation could hang indefinitely on self-managed clusters, with the bmctl command hanging at the "Trust CA Bundle completed in 0/X machines" stage. This occurred due to a state deadlock during the resource pivot operation (moving resources between management and bootstrap clusters). This fix resolves the deadlock, eliminating the need to manually update cluster fields or remove lock ConfigMaps to recover.
• Fixed an issue where temporary API server connectivity failures (such as network timeouts) caused the system to unnecessarily re-register and redeploy the GKE Connect agent. This fix prevents these temporary errors from resetting manual or system-applied customizations to the agent deployment, improving cluster stability.
• Fixed an issue where bmctl could fail to capture the full log for long-running operations, resulting in empty or incomplete job logs in the workspace. This occurred because a strict internal timeout stopped log streaming prematurely. The fix ensures that log streaming continues for the full duration of the operation's pod lifecycle.
• Fixed an issue in the monitoring component of the cluster operator where delete operations could cause the operator to crash if the resource had no annotations. The fix ensures the system properly handles resources with empty annotation maps, preventing the crash.
• Fixed an issue where the anet-operator could be scheduled to an unreachable node and become stuck in a Pending state, eventually causing networking to fail. This occurred due to overly permissive scheduling rules. The fix restricts scheduling to prevent the operator from running on unreachable nodes and explicitly places it on control plane nodes to ensure reliability.

Announcement

Google Distributed Cloud (software only) for bare metal 1.32.1100-gke.84 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.32.1100-gke.84 runs on Kubernetes v1.32.13-gke.100.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Announcement

The following features were added in 1.32.1100-gke.84:

• Added a periodic health check to detect stale mounts of Secrets and ConfigMaps on pods. This helps identify rare scenarios where nodes serve outdated secret data after a rotation, which can lead to authentication failures. Currently enabled for GKE Identity Service pods, the check runs on each node and compares the locally cached volume content with the live data from the API server, reporting a mismatch only after a 5-minute grace period to allow for normal update delays.

Fixed

The following issues were fixed in 1.32.1100-gke.84:

• Fixed vulnerabilities listed in Vulnerability fixes.
• Fixed an issue where node upgrades could hang indefinitely and bypass the 20-minute maintenance timeout. This issue occurred when a node contained completed pods within a namespace that was in a Terminating state. Because the Kubernetes Eviction API rejects operations in terminating namespaces, the cluster controller entered an infinite retry loop. The fix updates the drain process to skip eviction for pods in terminal phases, allowing the upgrade to proceed normally.
• Fixed an issue where, during the machine initialization phase, the etcd-events pod read the stale data directory when it started and attempted to reuse the old member ID to rejoin the cluster instead of the new one. Trying to use the old member ID to rejoin the cluster resulted in an infinite retry loop and caused the cluster to reject the connection. The fix ensures the /var/lib/etcd-events directory is cleared upon failure, and adds retry logic to kubeadm-reset to improve resiliency against transient API errors.
• Fixed an issue where concurrent tasks on the same node failed when containerd restarts. After the fix, tasks are locked and run sequentially to ensure each task completes successfully before the next begins. Each lock is held for up to 20 minutes or until the task reaches success or failure. To bypass this safety mechanismrun and run tasks concurrently, add the following annotation to your cluster: baremetal.cluster.gke.io/ concurrent-machine-update: "true".
• Fixed an issue on clusters running Kubernetes 1.31 and later where running kubeadm-reset during an upgrade or reset could crash and enter an infinite retry loop, blocking the operation. This occurred because the tool failed to read cluster configuration on newer Kubernetes versions.

Announcement

Google Distributed Cloud (software only) for bare metal 1.33.700-gke.71 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.33.700-gke.71 runs on Kubernetes v1.33.5-gke.2200.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Announcement

The following features were added in 1.33.700-gke.71:

A health check was added to detect when secrets or config maps mounted in pods become "stale," or out-of-sync with the Kubernetes API server. This feature addresses scenarios where the Kubelet's local cache fails to update with the latest versions of configuration data. The check performs the following actions:

• Iterates through all running pods on the node to verify their mounts.
• Compares the local data in the Kubelet's atomic update symlink structure against the live objects and update timestamps in the API server.
• Uses a 5-minute threshold to prevent false positives caused by normal propagation delays. A mismatch is only reported as an error if the staleness persists for more than 5 minutes.

Fixed

The following issues were fixed in 1.33.700-gke.71:

• Fixed vulnerabilities listed in Vulnerability fixes.
• Fixed an issue where concurrent tasks on the same node failed when containerd restarts. After the fix, tasks are locked and run sequentially to ensure each task completes successfully before the next begins. Each lock is held for up to 20 minutes or until the task reaches success or failure. To bypass this safety mechanismrun and run tasks concurrently, add the following annotation to your cluster: baremetal.cluster.gke.io/concurrent-machine-update: "true".
• Fixed an issue where, during the machine initialization phase, the etcd-events pod read the stale data directory when it started and attempted to reuse the old member ID to rejoin the cluster instead of the new one. Trying to use the old member ID to rejoin the cluster resulted in an infinite retry loop and caused the cluster to reject the connection. The fix ensures that the system clears the /var/lib/etcd-events directory upon failure, and adds retry logic to kubeadm-reset to improve resiliency against transient API errors.
• Fixed an issue where node upgrades could hang indefinitely and bypass the 20-minute maintenance timeout. This issue occurred when a node contained completed pods within a namespace that was in a Terminating state. Because the Kubernetes Eviction API rejects operations in terminating namespaces, the cluster controller entered an infinite retry loop. The fix updates the drain process to skip eviction for pods in terminal phases, allowing the upgrade to proceed normally.
• Fixed an issue where Metrics API operations—including kubectl top, Horizontal Pod Autoscaling, and Vertical Pod Autoscaling could fail with TLS verification errors during certificate authority rotation. This occurred because the leaf certificate was not immediately renewed when the certificate authority was rotated, causing a temporary mismatch between the trusted certificate authority bundle and the certificate presented by the metrics server.

Announcement

Google Distributed Cloud (software only) for bare metal 1.34.300-gke.59 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.34.300-gke.59 runs on Kubernetes v1.34.3-gke.400.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Fixed

The following issues were fixed in 1.34.300-gke.59:

• Fixed vulnerabilities listed in Vulnerability fixes
• Cluster and node pool failures are now surfaced in the RecentFailures field in the cluster status. This change provides a centralized location for viewing errors from both worker node pools and control plane nodes, improving the troubleshooting and debugging experience.
• Fixed an issue where Metrics API operations—including kubectl top, Horizontal Pod Autoscaling (HPA), and Vertical Pod Autoscaling (VPA)—could fail with TLS verification errors during CA rotation.

Fixed

The following issues were fixed in 1.32.1000-gke.57:

• Fixed vulnerabilities listed in Vulnerability fixes.
• Cluster and node pool failures are now surfaced in the RecentFailures field in the cluster status. This change provides a centralized location for viewing errors from both worker node pools and control plane nodes, improving the troubleshooting and debugging experience.
• Fixed an issue where Metrics API operations—including kubectl top, Horizontal Pod Autoscaling (HPA), and Vertical Pod Autoscaling (VPA)—could fail with TLS verification errors during CA rotation.
• Resolved an issue where Certificate Authority (CA) rotation became stuck on self-managed clusters (admin, hybrid, or standalone). This fix resolves an internal resource synchronization error that previously prevented the rotation process from completing successfully.

Announcement

Google Distributed Cloud (software only) for bare metal 1.32.1000-gke.57 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.32.1000-gke.57 runs on Kubernetes v1.32.13-gke.1000.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Announcement

Google Distributed Cloud (software only) for bare metal 1.33.600-gke.39 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.33.600-gke.39 runs on Kubernetes v1.33.5-gke.2200.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Fixed

The following issues were fixed in 1.33.600-gke.39:

• Resolved an issue where Certificate Authority (CA) rotation became stuck on self-managed clusters (admin, hybrid, or standalone). This fix resolves an internal resource synchronization error that previously prevented the rotation process from completing successfully.
• Fixed vulnerabilities listed in Vulnerability fixes.

Announcement

Google Distributed Cloud (software only) for bare metal 1.34.200-gke.68 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.34.200-gke.68 runs on Kubernetes v1.34.3-gke.400.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Fixed

The following issues were fixed in 1.34.200-gke.68:

• Fixed vulnerabilities listed in Vulnerability fixes.

Fixed

The following issues were fixed in 1.32.900-gke.60:

• Fixed vulnerabilities listed in Vulnerability fixes.

Announcement

Google Distributed Cloud (software only) for bare metal 1.32.900-gke.60 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.32.900-gke.60 runs on Kubernetes v1.32.11-gke.200.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Security

The following issues were fixed in 1.33.500-gke.63:

• Fixed vulnerabilities listed in Vulnerability fixes.

Announcement

Google Distributed Cloud (software only) for bare metal 1.33.500-gke.63 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.33.500-gke.63 runs on Kubernetes v1.33.5-gke.2200.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Announcement

In Google Distributed Cloud (software only) for bare metal versions 1.33.0 and later, bmctl operations can fail to stream logs from pods to the local workspace, causing empty or incomplete logs in bmctl-workspace/{CLUSTER NAME}/log directory.

This issue occurred because a recent Kubernetes library upgrade introduced a required context parameter for pod log streaming. The bmctl tool was incorrectly passing a context with a 10-second timeout, causing the log streamer to terminate prematurely for pods with long lifecycles, such as Ansible runner jobs.

This issue is resolved in the following versions:

• 1.33.500 and later
• 1.34.100 and later
• 1.35.0 and later

If you use an affected version and require the logs for a failed or ongoing operation, check logs using kubectl. If the cluster is accessible, you can manually retrieve logs directly from the relevant pods using the kubectl logs command.

It is recommended to upgrade to a fixed version to ensure that all bmctl operation logs are correctly captured in your local workspace for troubleshooting and auditing purposes

Announcement

Google Distributed Cloud (software only) for bare metal 1.34.100-gke.93 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.34.100-gke.93 runs on Kubernetes v1.34.1-gke.4700.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Feature

The following feature was added in 1.34.100-gke.93:

The spec.taints field in the NodePoolClaim resource is mutable. You can add or remove taints on existing node pools without recreating the NodePoolClaim. You can use this field to manage GPU nodes.

Fixed

The following issues were fixed in 1.32.800-gke.126:

• Fixed vulnerabilities listed in Vulnerability fixes.

Announcement

Google Distributed Cloud (software only) for bare metal 1.32.800-gke.126 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.32.800-gke.126 runs on Kubernetes v1.32.11-gke.200.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Announcement

Google Distributed Cloud (software only) for bare metal 1.33.400-gke.113 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.33.400-gke.113 runs on Kubernetes v1.33.5-gke.1900.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Security

Multiple security vulnerabilities have been identified in the OpenSSL library. The most significant finding is CVE-2025-15467, a critical vulnerability that might allow for remote code execution (RCE) or denial of service (DoS) attacks via network-based vectors.

For more details, see the GCP-2026-006 security bulletin.

Change

Updated the multiple network interfaces for Pods and bundled load balancing with BGP features to support admin clusters for version 1.34 or higher. Admin cluster support for these features has also been added to the GKE On-Prem API, so you can specify these features with clients like Terraform.