GKE 1.33 changelog

Autopilot Standard

This document lists the changes for the patch versions of the Google Kubernetes Engine (GKE) 1.33 minor version.

These changelogs are supplementary information about the updates to specific GKE system components. For information about features, changes, and security issues in GKE, see the following documents:

• Product updates: GKE release notes
• Security vulnerabilities: Security bulletins

1.33.13-gke.1547000

The following sections describe changes in this patch version when compared with the previous patch version, 1.33.13-gke.1499000. For information about upstream Kubernetes changes, see the Kubernetes v1.33.13 changelog.

Component Updates

The following sections provide information about updates to specific GKE system components in this patch version.

gcsfusecsi

Updated gcsfusecsi component from version 0.10.69 to 0.10.71.

• Security Fixes:
  • Fixed the following container CVEs: CVE-2024-45337, CVE-2026-27143, CVE-2026-33186, CVE-2026-39821, CVE-2026-39822, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-42508, and CVE-2026-46595.
  • Updated Go modules to address identified security vulnerabilities.
  • Updated csi-node-driver-registrar to version v2.10.1-gke.91 to incorporate security patches.

l7-lb-controller-combined

Updated l7-lb-controller-combined component from version 1.36.6-gke.1 to 1.36.7-gke.1.

• Features:
  • Added support for NEG pre-provisioning via service annotations and a new feature flag.
  • Introduced management of NEGBinding Custom Resources by the NEG controller, including ownership tracking and status reporting.
  • Enhanced Standalone L4 NEG controller observability with new metrics for service counts, sync latency, and status conditions for better troubleshooting.
  • Added support for Bring Your Own IPv6 (BYOIPv6) in Network Load Balancers (NetLB) via the ip-collection-v6 annotation.
  • Improved L4 Standalone NEG controller to support reading multiple IP addresses from Forwarding Rules.
  • Updated Topology Provider to be multi-network aware when retrieving zone and subnet information.
• Bug Fixes:
  • Resolved a worker goroutine leak in the NEG controller that resulted in significant CPU spikes.
  • Fixed a nil pointer dereference panic in L4 NetLB occurring when sessionAffinityConfig was omitted from the service specification.
  • Improved L4 Address Manager validation by replacing unanchored regex matching with strict IP parsing to prevent false positive matches.
  • Fixed a bug in the address deletion logic where a target IP was incorrectly used instead of the region.
  • Implemented IPv6 address canonicalization and automated stripping of /96 prefixes from Forwarding Rule addresses to comply with strict Kubernetes API validation.
  • Fixed a flag collision between the Standalone NEG controller and L4 leader election.
  • Added handling for "tombstone" objects in the provider configuration to prevent filtering errors during resource deletion.
  • Ensured Service NEGs are available in the local lister immediately after creation and enabled parallel syncer execution for better performance.
• Security Fixes:
  • Updated golang.org/x/net to v0.56.0 to address known security vulnerabilities in transitive dependencies.
  • Sanitized INI values in Google Compute Engine provider configurations to prevent potential CRLF injection.
• Miscellaneous:
  • Optimized performance by retrieving specific Forwarding Rules instead of listing all rules when checking for address availability.
  • Enforced a limit of 10 Forwarding Rules within the Standalone NEG Controller.
  • Implemented allowMissing support in FilteredInformers for the Node informer to improve controller robustness.