Announcement

Google Distributed Cloud (software only) for bare metal 1.33.1000-gke.59 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.33.1000-gke.59 runs on Kubernetes v1.33.11-gke.100.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the listing of our previously-qualified storage partners.

Fixed

The following issues were fixed in 1.33.1000-gke.59:

• Fixed vulnerabilities listed in Vulnerability fixes.
• Fixed an issue where Certificate Authority (CA) rotation failed for self-managing clusters (admin, hybrid, and standalone). The failure occurs during the final phase of the rotation when attempting to move management resources back from the temporary bootstrap cluster to the self-managing cluster, which can leave the cluster in an unmanageable state. You must upgrade your clusters to version 1.33.1000-gke.59 before you rotate your CAs. Running a CA rotation on self-managing clusters in versions prior to 1.33.1000-gke.59 triggers this issue and can disrupt your ability to manage the cluster.

Announcement

Google Distributed Cloud (software only) for bare metal 1.34.600-gke.53 is available. To upgrade, see Upgrade clusters. Runs on Kubernetes v1.34.7-gke.200.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Fixed

The following issues were fixed in 1.34.600-gke.53:

• Link to Vulnerability fixes for the list of security vulnerabilities addressed in this release.
• Fixed an issue where Certificate Authority (CA) rotation failed for self-managing clusters (admin, hybrid, and standalone). The failure occurs during the final phase of the rotation when attempting to move management resources back from the temporary bootstrap cluster to the self-managing cluster, which can leave the cluster in an unmanageable state. You must upgrade your clusters to version 1.34.600-gke.53 before you rotate your CAs. Running a CA rotation on self-managing clusters in versions prior to 1.34.600-gke.53 triggers this issue and can disrupt your ability to manage the cluster.
• Fixed an issue where a transient or partial failure during node pool updates could cause node taints or labels to become permanently stuck (stranded) on worker nodes, even after you removed them from the NodePool custom resource specification.

Announcement

Google Distributed Cloud (software only) for bare metal 1.35.200-gke.66 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.35.200-gke.66 runs on Kubernetes v1.35.3-gke.400.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Fixed

The following issues were fixed in 1.35.200-gke.66:

• Fixed vulnerabilities listed in Vulnerability fixes.
• Fixed an issue where a transient or partial failure during node pool updates could cause node taints or labels to become permanently stuck (stranded) on worker nodes, even after you removed them from the NodePool custom resource specification.
• Fixed an issue where, during the machine initialization phase, the etcd-events pod read the stale data directory when it started and attempted to reuse the old member ID to rejoin the cluster instead of the new one. Trying to use the old member ID to rejoin the cluster resulted in an infinite retry loop and caused the cluster to reject the connection. The fix ensures the /var/lib/etcd-events directory is cleared upon failure, and adds retry logic to kubeadm-reset to improve resiliency against transient API errors.
• Fixed an issue where, when enabling or updating etcd encryption, the API server was terminated abruptly, causing transient connection timeouts or failures for in-cluster workloads for up to five minutes.
• Fixed an issue where, during control plane certificate rotation or etcd encryption updates, the installer stalled for three minutes per control plane node while waiting for the local API server to restart, causing nodes to temporarily report an Unknown status and triggering transient routing disruptions (such as 503 Service Unavailable or ImagePullBackOff errors) for workloads scheduled on those nodes.

Announcement

Google Distributed Cloud (software only) for bare metal 1.33.900-gke.90 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.33.900-gke.90 runs on Kubernetes v1.33.11-gke.100.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Fixed

The following issues were fixed in 1.33.900-gke.90:

• Fixed vulnerabilities listed in Vulnerability fixes.
• Fixed an issue where a transient or partial failure during node pool updates could cause node taints or labels to become permanently stuck (stranded) on worker nodes, even after you removed them from the NodePool custom resource specification.
• Fixed an issue where, if a new control plane node failed to join a cluster during bootstrapping or scaling (associated with installer Ansible runner job failures), orphaned etcd memberships were not cleaned up, causing the existing control plane's API server to restart repeatedly (flap) and blocking subsequent retry attempts.
• Fixed an issue where, during control plane certificate rotation or etcd encryption updates, the installer stalled for three minutes per control plane node while waiting for the local API server to restart, causing nodes to temporarily report an Unknown status and triggering transient routing disruptions (such as 503 Service Unavailable or ImagePullBackOff errors) for workloads scheduled on those nodes.
• Fixed an issue where, when enabling or updating etcd encryption, the API server was terminated abruptly, causing transient connection timeouts or failures for in-cluster workloads for up to five minutes.
• Fixed an issue where, when recreating a user cluster with a previously used name (which commonly occurs during Terraform deployments or manual reinstalls), cluster provisioning stalled indefinitely in the provisioning state due to a missing k8s-health-check service account. The installer ensures that the service account is created, eliminating the need to manually create the service account as a workaround.

Announcement

Google Distributed Cloud (software only) for bare metal 1.34.500-gke.108 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.34.500-gke.108 runs on Kubernetes v1.34.7-gke.200.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Fixed

The following issues were fixed in 1.34.500-gke.108:

• Fixed vulnerabilities listed in Vulnerability fixes.
• Fixed an issue where, if a new control plane node failed to join a cluster during bootstrapping or scaling (associated with installer Ansible runner job failures), orphaned etcd memberships were not cleaned up, causing the existing control plane's API server to restart repeatedly (flap) and blocking subsequent retry attempts.
• Fixed an issue where, during control plane certificate rotation or etcd encryption updates, the installer stalled for three minutes per control plane node while waiting for the local API server to restart, causing nodes to temporarily report an Unknown status and triggering transient routing disruptions (such as 503 Service Unavailable or ImagePullBackOff errors) for workloads scheduled on those nodes.
• Fixed an issue where, when enabling or updating etcd encryption, the API server was terminated abruptly, causing transient connection timeouts or failures for in-cluster workloads for up to five minutes.
• Fixed an issue where, when recreating a user cluster with a previously used name (which commonly occurs during Terraform deployments or manual reinstalls), cluster provisioning stalled indefinitely in the provisioning state due to a missing k8s-health-check service account. The installer ensures that the service account is created, eliminating the need to manually create the service account as a workaround.

Announcement

Google Distributed Cloud (software only) for bare metal 1.35.100-gke.72 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.35.100-gke.72 runs on Kubernetes v1.35.3-gke.400.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Fixed

The following issues were fixed in 1.35.100-gke.72:

• Fixed vulnerabilities listed in Vulnerability fixes.

Announcement

Google Distributed Cloud (software only) for bare metal 1.35.100-gke.72 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.35.100-gke.72 runs on Kubernetes v1.35.3-gke.400.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Fixed

The following issues were fixed in 1.35.100-gke.72:

• Fixed vulnerabilities listed in Vulnerability fixes.

Announcement

Google Distributed Cloud (software only) for bare metal 1.33.800-gke.75 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.33.800-gke.75 runs on Kubernetes v1.33.11-gke.100.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Fixed

The following issues were fixed in 1.33.800-gke.75:

• Fixed vulnerabilities listed in Vulnerability fixes.

Announcement

Google Distributed Cloud (software only) for bare metal 1.34.400-gke.88 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.34.400-gke.88 runs on Kubernetes v1.34.6-gke.200.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Announcement

The following features were added in 1.34.400-gke.88:

• Added a periodic health check to detect stale mounts of Secrets and ConfigMaps on pods. This helps identify rare scenarios where nodes serve outdated secret data after a rotation, which can lead to authentication failures. Currently enabled for GKE Identity Service pods, the check runs on each node and compares the locally cached volume content with the live data from the API server, reporting a mismatch only after a 5-minute grace period to allow for normal update delays.

Fixed

The following issues were fixed in 1.34.400-gke.88:

• Fixed vulnerabilities listed in Vulnerability fixes.
• Fixed an issue where, during the machine initialization phase, the etcd-events pod read the stale data directory when it started and attempted to reuse the old member ID to rejoin the cluster instead of the new one. Trying to use the old member ID to rejoin the cluster resulted in an infinite retry loop and caused the cluster to reject the connection. The fix ensures the /var/lib/etcd-events directory is cleared upon failure, and adds retry logic to kubeadm-reset to improve resiliency against transient API errors.
• Fixed an issue where concurrent tasks on the same node failed when containerd restarts. After the fix, tasks are locked and run sequentially to ensure each task completes successfully before the next begins. Each lock is held for up to 20 minutes or until the task reaches success or failure. To bypass this safety mechanism, you can run tasks concurrently by adding baremetal.cluster.gke.io/concurrent-machine-update: "true" to your cluster.
• Fixed an issue where node upgrades could hang indefinitely and bypass the 20-minute maintenance timeout. This issue occurred when a node contained completed pods within a namespace that was in a Terminating state. Because the Kubernetes Eviction API rejects operations in terminating namespaces, the cluster controller entered an infinite retry loop. The fix updates the drain process to skip eviction for pods in terminal phases, allowing the upgrade to proceed normally.

Announcement

Google Distributed Cloud (software only) for bare metal 1.35.0-gke.525 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.35.0-gke.525 runs on Kubernetes v1.35.2-gke.300.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Announcement

The following features were added in 1.35.0-gke.525:

• Platform update to Kubernetes 1.35: This release updates the underlying Kubernetes version to 1.35.

  • For customers using Red Hat Enterprise Linux (RHEL) 7 or 8, which default to cgroupsv1, you must manually configure your operating system to enable cgroupsv2 before upgrading. For instructions, see the Red Hat knowledge base article on enabling cgroup v2.
  • For more information on migrating to cgroupsv2, see the Kubernetes documentation on migrating to cgroupv2.
  • This release upgrades the container runtime, containerd, from version 2.0 to 2.1.

• Added a periodic health check to detect stale secret and ConfigMap mounts on Google Kubernetes Engine pods. To account for normal propagation delays, a content mismatch is only reported as an error if the data remains stale for more than 5 minutes.

• Upgraded the Ansible version to 2.18. This version requires Python 3.9 on target nodes. For customers using Red Hat Enterprise Linux, version 8.10 or later is required because the default Python version in earlier Red Hat 8 releases (Python 3.6) is not supported by Ansible 2.18.

• You can use the header section of the cluster configuration file to specify registry mirrors for your clusters. This simplifies the management of registry mirrors and provides a more consistent configuration experience. For instructions on how to update or remove these settings, see the Registry Mirror documentation.

• Preview Added support for EgressDSCP tagging. With this feature, you can mark IP headers with specific Differentiated Services Code Point (DSCP) values on packets leaving the cluster to prioritize network traffic. To use this feature, you must set preview.baremetal.cluster.gke.io/traffic-selector: to enable in your cluster configuration and manage traffic selection using the EgressDSCP and TrafficSelector custom resources. For more information, see Configure EgressDSCP tagging.

• bmctl prints the Operation ID and OperationType to the console after cluster installation and upgrade operations.

Fixed

The following issues were fixed in 1.35.0-gke.525:

• Fixed vulnerabilities listed in Vulnerability fixes.
• Fixed an issue where node upgrades could hang indefinitely and bypass the 20-minute maintenance timeout. This issue occurred when a node contained completed pods within a namespace that was in a Terminating state. Because the Kubernetes Eviction API rejects operations in terminating namespaces, the cluster controller entered an infinite retry loop. The fix updates the drain process to skip eviction for pods in terminal phases, allowing the upgrade to proceed normally.
• Fixed an issue where concurrent tasks on the same node failed when containerd restarts. After the fix, tasks are locked and run sequentially to ensure each task completes successfully before the next begins. Each lock is held for up to 20 minutes or until the task reaches success or failure. To bypass this safety mechanismrun and run tasks concurrently, add the following annotation to your cluster: baremetal.cluster.gke.io/concurrent-machine-update: "true".
• Fixed an issue where Metrics API operations—including kubectl top, Horizontal Pod Autoscaling, and Vertical Pod Autoscaling could fail with TLS verification errors during certificate authority rotation. This occurred because the leaf certificate was not immediately renewed when the certificate authority was rotated, causing a temporary mismatch between the trusted certificate authority bundle and the certificate presented by the metrics server.
• Fixed an issue where Cluster CA rotation could hang indefinitely on self-managed clusters, with the bmctl command hanging at the "Trust CA Bundle completed in 0/X machines" stage. This occurred due to a state deadlock during the resource pivot operation (moving resources between management and bootstrap clusters). This fix resolves the deadlock, eliminating the need to manually update cluster fields or remove lock ConfigMaps to recover.
• Fixed an issue where temporary API server connectivity failures (such as network timeouts) caused the system to unnecessarily re-register and redeploy the GKE Connect agent. This fix prevents these temporary errors from resetting manual or system-applied customizations to the agent deployment, improving cluster stability.
• Fixed an issue where bmctl could fail to capture the full log for long-running operations, resulting in empty or incomplete job logs in the workspace. This occurred because a strict internal timeout stopped log streaming prematurely. The fix ensures that log streaming continues for the full duration of the operation's pod lifecycle.
• Fixed an issue in the monitoring component of the cluster operator where delete operations could cause the operator to crash if the resource had no annotations. The fix ensures the system properly handles resources with empty annotation maps, preventing the crash.
• Fixed an issue where the anet-operator could be scheduled to an unreachable node and become stuck in a Pending state, eventually causing networking to fail. This occurred due to overly permissive scheduling rules. The fix restricts scheduling to prevent the operator from running on unreachable nodes and explicitly places it on control plane nodes to ensure reliability.

Announcement

Google Distributed Cloud (software only) for bare metal 1.32.1100-gke.84 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.32.1100-gke.84 runs on Kubernetes v1.32.13-gke.100.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Announcement

The following features were added in 1.32.1100-gke.84:

• Added a periodic health check to detect stale mounts of Secrets and ConfigMaps on pods. This helps identify rare scenarios where nodes serve outdated secret data after a rotation, which can lead to authentication failures. Currently enabled for GKE Identity Service pods, the check runs on each node and compares the locally cached volume content with the live data from the API server, reporting a mismatch only after a 5-minute grace period to allow for normal update delays.

Fixed

The following issues were fixed in 1.32.1100-gke.84:

• Fixed vulnerabilities listed in Vulnerability fixes.
• Fixed an issue where node upgrades could hang indefinitely and bypass the 20-minute maintenance timeout. This issue occurred when a node contained completed pods within a namespace that was in a Terminating state. Because the Kubernetes Eviction API rejects operations in terminating namespaces, the cluster controller entered an infinite retry loop. The fix updates the drain process to skip eviction for pods in terminal phases, allowing the upgrade to proceed normally.
• Fixed an issue where, during the machine initialization phase, the etcd-events pod read the stale data directory when it started and attempted to reuse the old member ID to rejoin the cluster instead of the new one. Trying to use the old member ID to rejoin the cluster resulted in an infinite retry loop and caused the cluster to reject the connection. The fix ensures the /var/lib/etcd-events directory is cleared upon failure, and adds retry logic to kubeadm-reset to improve resiliency against transient API errors.
• Fixed an issue where concurrent tasks on the same node failed when containerd restarts. After the fix, tasks are locked and run sequentially to ensure each task completes successfully before the next begins. Each lock is held for up to 20 minutes or until the task reaches success or failure. To bypass this safety mechanismrun and run tasks concurrently, add the following annotation to your cluster: baremetal.cluster.gke.io/ concurrent-machine-update: "true".
• Fixed an issue on clusters running Kubernetes 1.31 and later where running kubeadm-reset during an upgrade or reset could crash and enter an infinite retry loop, blocking the operation. This occurred because the tool failed to read cluster configuration on newer Kubernetes versions.

Announcement

Google Distributed Cloud (software only) for bare metal 1.33.700-gke.71 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.33.700-gke.71 runs on Kubernetes v1.33.5-gke.2200.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Announcement

The following features were added in 1.33.700-gke.71:

A health check was added to detect when secrets or config maps mounted in pods become "stale," or out-of-sync with the Kubernetes API server. This feature addresses scenarios where the Kubelet's local cache fails to update with the latest versions of configuration data. The check performs the following actions:

• Iterates through all running pods on the node to verify their mounts.
• Compares the local data in the Kubelet's atomic update symlink structure against the live objects and update timestamps in the API server.
• Uses a 5-minute threshold to prevent false positives caused by normal propagation delays. A mismatch is only reported as an error if the staleness persists for more than 5 minutes.

Fixed

The following issues were fixed in 1.33.700-gke.71:

• Fixed vulnerabilities listed in Vulnerability fixes.
• Fixed an issue where concurrent tasks on the same node failed when containerd restarts. After the fix, tasks are locked and run sequentially to ensure each task completes successfully before the next begins. Each lock is held for up to 20 minutes or until the task reaches success or failure. To bypass this safety mechanismrun and run tasks concurrently, add the following annotation to your cluster: baremetal.cluster.gke.io/concurrent-machine-update: "true".
• Fixed an issue where, during the machine initialization phase, the etcd-events pod read the stale data directory when it started and attempted to reuse the old member ID to rejoin the cluster instead of the new one. Trying to use the old member ID to rejoin the cluster resulted in an infinite retry loop and caused the cluster to reject the connection. The fix ensures that the system clears the /var/lib/etcd-events directory upon failure, and adds retry logic to kubeadm-reset to improve resiliency against transient API errors.
• Fixed an issue where node upgrades could hang indefinitely and bypass the 20-minute maintenance timeout. This issue occurred when a node contained completed pods within a namespace that was in a Terminating state. Because the Kubernetes Eviction API rejects operations in terminating namespaces, the cluster controller entered an infinite retry loop. The fix updates the drain process to skip eviction for pods in terminal phases, allowing the upgrade to proceed normally.
• Fixed an issue where Metrics API operations—including kubectl top, Horizontal Pod Autoscaling, and Vertical Pod Autoscaling could fail with TLS verification errors during certificate authority rotation. This occurred because the leaf certificate was not immediately renewed when the certificate authority was rotated, causing a temporary mismatch between the trusted certificate authority bundle and the certificate presented by the metrics server.

Announcement

Google Distributed Cloud (software only) for bare metal 1.34.300-gke.59 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.34.300-gke.59 runs on Kubernetes v1.34.3-gke.400.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Fixed

The following issues were fixed in 1.34.300-gke.59:

• Fixed vulnerabilities listed in Vulnerability fixes
• Cluster and node pool failures are now surfaced in the RecentFailures field in the cluster status. This change provides a centralized location for viewing errors from both worker node pools and control plane nodes, improving the troubleshooting and debugging experience.
• Fixed an issue where Metrics API operations—including kubectl top, Horizontal Pod Autoscaling (HPA), and Vertical Pod Autoscaling (VPA)—could fail with TLS verification errors during CA rotation.

Fixed

The following issues were fixed in 1.32.1000-gke.57:

• Fixed vulnerabilities listed in Vulnerability fixes.
• Cluster and node pool failures are now surfaced in the RecentFailures field in the cluster status. This change provides a centralized location for viewing errors from both worker node pools and control plane nodes, improving the troubleshooting and debugging experience.
• Fixed an issue where Metrics API operations—including kubectl top, Horizontal Pod Autoscaling (HPA), and Vertical Pod Autoscaling (VPA)—could fail with TLS verification errors during CA rotation.
• Resolved an issue where Certificate Authority (CA) rotation became stuck on self-managed clusters (admin, hybrid, or standalone). This fix resolves an internal resource synchronization error that previously prevented the rotation process from completing successfully.

Announcement

Google Distributed Cloud (software only) for bare metal 1.32.1000-gke.57 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.32.1000-gke.57 runs on Kubernetes v1.32.13-gke.1000.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Announcement

Google Distributed Cloud (software only) for bare metal 1.33.600-gke.39 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.33.600-gke.39 runs on Kubernetes v1.33.5-gke.2200.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Fixed

The following issues were fixed in 1.33.600-gke.39:

• Resolved an issue where Certificate Authority (CA) rotation became stuck on self-managed clusters (admin, hybrid, or standalone). This fix resolves an internal resource synchronization error that previously prevented the rotation process from completing successfully.
• Fixed vulnerabilities listed in Vulnerability fixes.

Announcement

Google Distributed Cloud (software only) for bare metal 1.34.200-gke.68 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.34.200-gke.68 runs on Kubernetes v1.34.3-gke.400.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Fixed

The following issues were fixed in 1.34.200-gke.68:

• Fixed vulnerabilities listed in Vulnerability fixes.

Fixed

The following issues were fixed in 1.32.900-gke.60:

• Fixed vulnerabilities listed in Vulnerability fixes.

Announcement

Google Distributed Cloud (software only) for bare metal 1.32.900-gke.60 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.32.900-gke.60 runs on Kubernetes v1.32.11-gke.200.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Security

The following issues were fixed in 1.33.500-gke.63:

• Fixed vulnerabilities listed in Vulnerability fixes.

Announcement

Google Distributed Cloud (software only) for bare metal 1.33.500-gke.63 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.33.500-gke.63 runs on Kubernetes v1.33.5-gke.2200.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Announcement

In Google Distributed Cloud (software only) for bare metal versions 1.33.0 and later, bmctl operations can fail to stream logs from pods to the local workspace, causing empty or incomplete logs in bmctl-workspace/{CLUSTER NAME}/log directory.

This issue occurred because a recent Kubernetes library upgrade introduced a required context parameter for pod log streaming. The bmctl tool was incorrectly passing a context with a 10-second timeout, causing the log streamer to terminate prematurely for pods with long lifecycles, such as Ansible runner jobs.

This issue is resolved in the following versions:

• 1.33.500 and later
• 1.34.100 and later
• 1.35.0 and later

If you use an affected version and require the logs for a failed or ongoing operation, check logs using kubectl. If the cluster is accessible, you can manually retrieve logs directly from the relevant pods using the kubectl logs command.

It is recommended to upgrade to a fixed version to ensure that all bmctl operation logs are correctly captured in your local workspace for troubleshooting and auditing purposes

Announcement

Google Distributed Cloud (software only) for bare metal 1.34.100-gke.93 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.34.100-gke.93 runs on Kubernetes v1.34.1-gke.4700.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Feature

The following feature was added in 1.34.100-gke.93:

The spec.taints field in the NodePoolClaim resource is mutable. You can add or remove taints on existing node pools without recreating the NodePoolClaim. You can use this field to manage GPU nodes.

Fixed

The following issues were fixed in 1.32.800-gke.126:

• Fixed vulnerabilities listed in Vulnerability fixes.

Announcement

Google Distributed Cloud (software only) for bare metal 1.32.800-gke.126 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.32.800-gke.126 runs on Kubernetes v1.32.11-gke.200.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Announcement

Google Distributed Cloud (software only) for bare metal 1.33.400-gke.113 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.33.400-gke.113 runs on Kubernetes v1.33.5-gke.1900.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Security

Multiple security vulnerabilities have been identified in the OpenSSL library. The most significant finding is CVE-2025-15467, a critical vulnerability that might allow for remote code execution (RCE) or denial of service (DoS) attacks via network-based vectors.

For more details, see the GCP-2026-006 security bulletin.

Change

Updated the multiple network interfaces for Pods and bundled load balancing with BGP features to support admin clusters for version 1.34 or higher. Admin cluster support for these features has also been added to the GKE On-Prem API, so you can specify these features with clients like Terraform.

Announcement

distributed_cloud_name for bare metal 1.34.0-gke.566 is now available for download. To upgrade, see Upgrade clusters. distributed_cloud_name for bare metal 1.34.0-gke.566 runs on Kubernetes v1.34.1-gke.2900.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Distributed Cloud for bare metal.

Feature

The following features were added in 1.34.0-gke.566:

• Preview: Vertical Pod autoscaling can now be configured to use your Prometheus instance as a persistent history provider for long-term CPU and memory usage data.

• Preview: Added support for horizontal Pod autoscaling that uses custom metrics from your Prometheus server to scale your applications, eliminating the operational burden of manually deploying and managing the adapter, its configuration, and RBAC. The automated solution handles the entire lifecycle, making it simpler to scale applications based on the metrics that matter most to your business.

• Preview: Added support for fast failover for the egress NAT gateway running in high availability. This feature improves both the reliability and throughput of egress traffic.

• GA: Added support for skip minor version cluster upgrades. You can directly upgrade your cluster control plane nodes (and entire cluster if worker node pools aren't pinned at a lower version) to two minor versions above the current version. Added the bmctl upgrade intermediate-version command to print the intermediate version for a skip minor version upgrade.

• Preview: Added support for advanced networking features on admin clusters. This capability lets you specify multiple network interfaces for Pods and lets you use bundled load balancing with BGP on your version 1.34 or higher admin clusters.

  This note is incorrect; see entry for January 16, 2026.

Change

The following functional changes were made in 1.34.0-gke.566:

• Enabled Ansible SSH pipelining by default to improve performance. This can be disabled by adding the annotation preview.baremetal.cluster.gke.io/ansible-ssh-pipelining: "disable" to the Cluster custom resource.

• During cluster creation and update operations, NodePools validate IP address uniqueness against all existing underlay Nodes, regardless of status. Node deprovisioning is blocked until the associated Kubernetes Node is deleted, unless the node-deletion-timeout-seconds annotation is present on the cluster.

• Upgraded containerd from 1.7 to 2.0.

• Registry mirror configuration information has been migrated to the hosts.toml containerd config file.

• Upgrade preflight checks now validate PodDisruptionBudgets.

• GKE Identity Service has been migrated from a Deployment to a DaemonSet for improved reliability on control plane nodes.

• Added support for Red Hat Enterprise Linux 9.6.

• Removed support for Red Hat Enterprise Linux 9.2 as it is beyond the Red Hat support window.

• Added support for the 6.14 kernel package is supported for use with Ubuntu 24.04 LTS.

Fixed

The following issues were fixed in 1.34.0-gke.566:

• Updated the bmctl restore command so that it restores the Node Problem Detector systemd Service for admin clusters.

• Fixed the etcd-cleanup job timeout issue caused by the use of incorrect certificates.

• Fixed an issue where the cluster restore process leaves the Kubelet certificate files as regular files instead of symbolic links, preventing certificate rotation.

Issue

For information about the latest known issues, see distributed_cloud_name for bare metal known issues in the Troubleshooting section.

Issue

For information about the latest known issues, see Google Distributed Cloud for bare metal known issues in the Troubleshooting section.

Fixed

The following issues were fixed in 1.33.300-gke.60:

• Fixed vulnerabilities listed in Vulnerability fixes.

Announcement

Google Distributed Cloud for bare metal 1.33.300-gke.60 is now available for download. To upgrade, see Upgrade clusters. Distributed Cloud for bare metal 1.33.300-gke.60 runs on Kubernetes v1.33.5-gke.900.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Distributed Cloud for bare metal.

Issue

For information about the latest known issues, see Google Distributed Cloud for bare metal known issues in the Troubleshooting section.

Fixed

The following issues were fixed in 1.32.700-gke.64:

• Fixed vulnerabilities listed in Vulnerability fixes.

Announcement

Google Distributed Cloud for bare metal 1.32.700-gke.64 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.32.700-gke.64 runs on Kubernetes v1.32.9-gke.700.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Issue

For information about the latest known issues, see Google Distributed Cloud for bare metal known issues in the Troubleshooting section.

Fixed

The following issues were fixed in 1.33.200-gke.70:

• Fixed an issue where configuring your cluster to use Workload Identity Cluster Authentication together with a registry mirror caused containerd instability. To use the fix, add the baremetal.cluster.gke.io/enable-gcr-image-credential-refresh: "false" cluster annotation.

• Fixed a timeout issue for the kubeadm API server health check that runs during bootstrap cluster creation. The timeout issue blocked some cluster operations, such as restoring a cluster.

• This patch release doesn't include new fixes for specific, externally-cited vulnerabilities.

Announcement

Google Distributed Cloud for bare metal 1.33.200-gke.70 is now available for download. To upgrade, see Upgrade clusters. Distributed Cloud for bare metal 1.33.200-gke.70 runs on Kubernetes v1.33.-gke.900.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Distributed Cloud for bare metal.

Announcement

Google Distributed Cloud for bare metal 1.31.1100-gke.40 is now available for download. To upgrade, see Upgrade clusters. Distributed Cloud for bare metal 1.31.1100-gke.40 runs on Kubernetes v1.31.12-gke.600.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Distributed Cloud for bare metal.

Issue

For information about the latest known issues, see Google Distributed Cloud for bare metal known issues in the Troubleshooting section.

Announcement

Google Distributed Cloud for bare metal 1.32.600-gke.53 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.32.600-gke.53 runs on Kubernetes v1.32.9-gke.200.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Issue

For information about the latest known issues, see Google Distributed Cloud for bare metal known issues in the Troubleshooting section.

Fixed

The following issues were fixed in 1.32.600-gke.53:

• Fixed the etcd-cleanup job timeout issue caused by the use of incorrect certificates.

• Fixed vulnerabilities listed in Vulnerability fixes.

Fixed

The following issues were fixed in 1.31.1000-gke.44:

• Fixed an issue where the cluster restore process leaves the Kubelet certificate files as regular files instead of symbolic links, preventing certificate rotation.

• Fixed the etcd-cleanup job timeout issue caused by the use of incorrect certificates.

• Fixed vulnerabilities listed in Vulnerability fixes.

Announcement

Google Distributed Cloud for bare metal 1.31.1000-gke.44 is now available for download. To upgrade, see Upgrade clusters. Distributed Cloud for bare metal 1.31.1000-gke.44 runs on Kubernetes v1.31.12-gke.600.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Distributed Cloud for bare metal.

Issue

For information about the latest known issues, see Google Distributed Cloud for bare metal known issues in the Troubleshooting section.

Issue

For information about the latest known issues, see Google Distributed Cloud for bare metal known issues in the Troubleshooting section.

Announcement

Google Distributed Cloud for bare metal 1.33.100-gke.89 is now available for download. To upgrade, see Upgrade clusters. Distributed Cloud for bare metal 1.33.100-gke.89 runs on Kubernetes v1.33.4-gke.900.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Distributed Cloud for bare metal.

Fixed

The following issues were fixed in 1.33.100-gke.89:

• Fixed an issue where the cluster restore process leaves the Kubelet certificate files as regular files instead of symbolic links, preventing certificate rotation.

• Fixed the etcd-cleanup job timeout issue caused by the use of incorrect certificates.

• This patch release doesn't include new fixes for specific, externally-cited vulnerabilities.