GKE 1.33 changelog

This document lists the changes for the patch versions of the Google Kubernetes Engine (GKE) 1.33 minor version.

These changelogs are supplementary information about the updates to specific GKE system components. For information about features, changes, and security issues in GKE, see the following documents:

1.33.13-gke.1721000

The following sections describe changes in this patch version when compared with the previous patch version, 1.33.13-gke.1647000. For information about upstream Kubernetes changes, see the Kubernetes v1.33.13 changelog.

Component Updates

The following sections provide information about updates to specific GKE system components in this patch version.

customer-logs-exporter

Updated customer-logs-exporter component from version 1.33.1-gke.21 to 1.33.1-gke.22.

  • Miscellaneous:
    • Updated the bash base image to a newer version.

filestorecsi

Updated filestorecsi component from version 0.18.43 to 0.18.44.

gcsfusecsi

Updated gcsfusecsi component from version 0.10.72 to 0.10.74.

  • Security Fixes:
    • Updated google.golang.org/grpc to v1.83.1 and updated the csi-node-driver-registrar image to resolve CVE-2026-84304.
  • Miscellaneous:
    • Updated the Go runtime and container base images for the following components: gcs-fuse-csi-driver, csi-node-driver-registrar, gcs-fuse-csi-driver-sidecar-mounter, and gcs-fuse-csi-driver-metadata-prefetch.

gvisor

Updated gvisor component from version 1.33.5 to 1.33.8.

  • Miscellaneous:
    • Updated container images for node_token_broker/init and gke-distroless/static.

osimage

Updated osimage component from version 1.33.193 to 1.33.208.

pdcsi

Updated pdcsi component from version 0.22.83 to 0.22.86.

workloadautoscaler

Updated workloadautoscaler component from version 16.14.0 to 16.15.0.

  • Miscellaneous:
    • Updated Vertical Pod Autoscaler components, including the admission controller, recommender, and updater, to version 0.24.0-gke.18.

1.33.13-gke.1647000

The following sections describe changes in this patch version when compared with the previous patch version, 1.33.13-gke.1636000. For information about upstream Kubernetes changes, see the Kubernetes v1.33.13 changelog.

Component Updates

The following sections provide information about updates to specific GKE system components in this patch version.

kube-addon-manager

Updated kube-addon-manager component from version 31.0.21 to 31.0.22.

  • Miscellaneous:
    • Updated the gke-distroless/bash container image to version gke_distroless_20260815.00_p0.

1.33.13-gke.1636000

The following sections describe changes in this patch version when compared with the previous patch version, 1.33.13-gke.1613000. For information about upstream Kubernetes changes, see the Kubernetes v1.33.13 changelog.

Component Updates

The following sections provide information about updates to specific GKE system components in this patch version.

envoy

Updated envoy component from version 1.0.21 to 1.0.22.

  • Security Fixes:
    • Updated kcp_envoy image to include TCP connection pool pointer validation security fix.

1.33.13-gke.1613000

The following sections describe changes in this patch version when compared with the previous patch version, 1.33.13-gke.1547000. For information about upstream Kubernetes changes, see the Kubernetes v1.33.13 changelog.

Component Updates

The following sections provide information about updates to specific GKE system components in this patch version.

advanceddatapath

Updated advanceddatapath component from version 33.7.45 to 33.7.46.

  • Security Fixes:
    • Updated golang.org/x/net to resolve GO-2026-4440 and GO-2026-5942.
    • Updated golang.org/x/text to resolve GO-2026-5970.
  • Miscellaneous:
    • Updated Debian base images for various internal components.

gcsfusecsi

Updated gcsfusecsi component from version 0.10.71 to 0.10.72.

tpu-device-plugin

Updated tpu-device-plugin component from version 1.33.22-gke.9 to 1.33.22-gke.10.

  • Security Fixes:
    • Updated google.golang.org/grpc to v1.82.1 to resolve GO-2026-6061.

1.33.13-gke.1547000

The following sections describe changes in this patch version when compared with the previous patch version, 1.33.13-gke.1499000. For information about upstream Kubernetes changes, see the Kubernetes v1.33.13 changelog.

Component Updates

The following sections provide information about updates to specific GKE system components in this patch version.

gcsfusecsi

Updated gcsfusecsi component from version 0.10.69 to 0.10.71.

l7-lb-controller-combined

Updated l7-lb-controller-combined component from version 1.36.6-gke.1 to 1.36.7-gke.1.

  • Features:
    • Added support for NEG pre-provisioning via service annotations and a new feature flag.
    • Introduced management of NEGBinding Custom Resources by the NEG controller, including ownership tracking and status reporting.
    • Enhanced Standalone L4 NEG controller observability with new metrics for service counts, sync latency, and status conditions for better troubleshooting.
    • Added support for Bring Your Own IPv6 (BYOIPv6) in Network Load Balancers (NetLB) via the ip-collection-v6 annotation.
    • Improved L4 Standalone NEG controller to support reading multiple IP addresses from Forwarding Rules.
    • Updated Topology Provider to be multi-network aware when retrieving zone and subnet information.
  • Bug Fixes:
    • Resolved a worker goroutine leak in the NEG controller that resulted in significant CPU spikes.
    • Fixed a nil pointer dereference panic in L4 NetLB occurring when sessionAffinityConfig was omitted from the service specification.
    • Improved L4 Address Manager validation by replacing unanchored regex matching with strict IP parsing to prevent false positive matches.
    • Fixed a bug in the address deletion logic where a target IP was incorrectly used instead of the region.
    • Implemented IPv6 address canonicalization and automated stripping of /96 prefixes from Forwarding Rule addresses to comply with strict Kubernetes API validation.
    • Fixed a flag collision between the Standalone NEG controller and L4 leader election.
    • Added handling for "tombstone" objects in the provider configuration to prevent filtering errors during resource deletion.
    • Ensured Service NEGs are available in the local lister immediately after creation and enabled parallel syncer execution for better performance.
  • Security Fixes:
    • Updated golang.org/x/net to v0.56.0 to address known security vulnerabilities in transitive dependencies.
    • Sanitized INI values in Google Compute Engine provider configurations to prevent potential CRLF injection.
  • Miscellaneous:
    • Optimized performance by retrieving specific Forwarding Rules instead of listing all rules when checking for address availability.
    • Enforced a limit of 10 Forwarding Rules within the Standalone NEG Controller.
    • Implemented allowMissing support in FilteredInformers for the Node informer to improve controller robustness.