GKE 1.35 changelog

This document lists the changes for the patch versions of the Google Kubernetes Engine (GKE) 1.35 minor version.

These changelogs are supplementary information about the updates to specific GKE system components. For information about features, changes, and security issues in GKE, see the following documents:

1.35.8-gke.1626000

The following sections describe changes in this patch version when compared with the previous patch version, 1.35.8-gke.1439000. For information about upstream Kubernetes changes, see the Kubernetes v1.35.8 changelog.

Component Updates

The following sections provide information about updates to specific GKE system components in this patch version.

filestorecsi

Updated filestorecsi component from version 1.35.27 to 1.35.28.

  • Security Fixes:
  • Miscellaneous:
    • Updated the Go runtime to version 1.27.1 and updated container base images for CSI sidecar components including csi-provisioner, csi-resizer, and csi-snapshotter.

gcsfusecsi

Updated gcsfusecsi component from version 1.35.61 to 1.35.64.

  • Security Fixes:
  • Miscellaneous:
    • Updated the csi-node-driver-registrar image to v2.15.0-gke.47.

gvisor

Updated gvisor component from version 1.35.16 to 1.35.17.

  • Miscellaneous:
    • Updated the container base image to gke_distroless_20260915.00_p0.

kube-addon-manager

Updated kube-addon-manager component from version 35.0.2 to 35.0.5.

  • Features:
    • Added support for multi-architecture releases.
  • Miscellaneous:
    • Updated the kubectl prune whitelist to include flow control resources (FlowSchema and PriorityLevelConfiguration) for clusters running Kubernetes 1.23.0 and newer.
    • Added a configuration option to manage leader election modes for the addon manager.

managed-opentelemetry

Updated managed-opentelemetry component from version 1.35.13-gke.1 to 1.35.13-gke.2.

  • Security Fixes:
    • Upgraded otelcol-custom to 0.153.0-gke.5 to remediate golang.org/x/crypto CVEs.

osimage

Updated osimage component from version 1.35.152 to 1.35.160.

pdcsi

Updated pdcsi component from version 1.35.49 to 1.35.52.

  • Bug Fixes:
    • Fixed an issue where access modes were incorrectly handled for Hyperdisk Balanced and Hyperdisk Throughput volumes during retried CreateVolume calls.
  • Security Fixes:
  • Miscellaneous:
    • Updated the Go runtime and base container images to improve overall component stability.

workloadautoscaler

Updated workloadautoscaler component from version 18.10.0 to 18.11.0.

  • Bug Fixes:
    • Updated Vertical Pod Autoscaler components, including the admission-controller, recommender, and updater, to version 0.26.0-gke.18.

1.35.8-gke.1439000

The following sections describe changes in this patch version when compared with the previous patch version, 1.35.8-gke.1380000. For information about upstream Kubernetes changes, see the Kubernetes v1.35.8 changelog.

Kubernetes Updates

k8s-api

Updated k8s-api cohort from version 1.35.8-gke.100 to 1.35.8-gke.300.

  • Miscellaneous:
    • Added GOMEMLIMIT and GOGC environment variables to the kube-apiserver manifests to optimize memory usage and garbage collection behavior.

Component Updates

The following sections provide information about updates to specific GKE system components in this patch version.

gcsfusecsi

Updated gcsfusecsi component from version 1.35.60 to 1.35.61.

  • Miscellaneous:
    • Updated Go runtime to 1.27.0, Debian base image to bookworm-v1.0.8-gke.10, and csi-node-driver-registrar to v2.15.0-gke.45.

l7-lb-controller-combined

Updated l7-lb-controller-combined component from version 1.38.7-gke.0 to 1.38.8-gke.0.

  • Security Fixes:
    • Added a validation check for Standalone L4 Network Endpoint Groups (NEGs) to verify proper attachment.

networkpolicy-antrea

Updated networkpolicy-antrea component from version 0.6.9 to 0.6.10.

  • Miscellaneous:
    • Updated Antrea image to v1.4.0-gke.73 and Cilium Windows image to v1.17.8-gke.134.
    • Updated container base images and the Go runtime patch version.

tpu-device-plugin

Updated tpu-device-plugin component from version 1.35.13-gke.7 to 1.35.13-gke.8.

  • Bug Fixes:
    • Revert ACS Agent image to sha256:2c2cad2eff5811c906334bced6a00b6f938d4308a26921bab9f5fc7d7ef445fb to prevent synchronous informer cache sync stalls from blocking TPU device plugin registration and unblock Cluster Autoscaler qualification.

1.35.8-gke.1380000

The following sections describe changes in this patch version when compared with the previous patch version, 1.35.8-gke.1225000. For information about upstream Kubernetes changes, see the Kubernetes v1.35.8 changelog.

Component Updates

The following sections provide information about updates to specific GKE system components in this patch version.

gcsfusecsi

Updated gcsfusecsi component from version 1.35.58 to 1.35.60.

gpu-device-plugin

Updated gpu-device-plugin component from version 1.35.5-gke.0 to 1.35.6-gke.0.

  • Miscellaneous:
    • bump gpu-device-plugin to v1.35.5-gke.0
    • bump nvidia-partition-gpu to v1.35.5-gke.0
    • bump nvidia-persistenced-installer to v1.35.5-gke.0

gvisor

Updated gvisor component from version 1.35.13 to 1.35.16.

  • Miscellaneous:
    • Updated the gke-distroless/static container base image.
    • Updated gke-gvisor-installer to version 20260727.0_RC04.

pdcsi

Updated pdcsi component from version 1.35.48 to 1.35.49.

tpu-device-plugin

Updated tpu-device-plugin component from version 1.35.13-gke.6 to 1.35.13-gke.7.

  • Features:
    • Update ACS Agent image to include FatalErrorInfo and TPU Halt diagnostic collection.

1.35.8-gke.1225000

The following sections describe changes in this patch version when compared with the previous patch version, 1.35.8-gke.1036000. For information about upstream Kubernetes changes, see the Kubernetes v1.35.8 changelog.

Component Updates

The following sections provide information about updates to specific GKE system components in this patch version.

osimage

Updated osimage component from version 1.35.148 to 1.35.152.

  • Features:
    • Updated Linux kernel to COS-6.12.94.
    • Updated Docker to v27.5.1.
    • Updated Containerd to v2.2.7.
    • Updated cos-gpu-installer to v2.7.7.
  • Bug Fixes:
    • Added support for net-fs/lustre-client-drivers v2.14.0_p259.
    • Upgraded sys-apps/xemu to v0.0.10.
  • Security Fixes:
  • Miscellaneous:
    • Modified runtime sysctl configuration for net.ipv4.udp_mem.

workloadautoscaler

Updated workloadautoscaler component from version 18.8.0 to 18.10.0.

  • Miscellaneous:
    • Updated Vertical Pod Autoscaler (VPA) admission-controller, recommender, and updater to version 0.26.0-gke.17.

1.35.8-gke.1036000

There are no customer-facing updates in this version when compared to the previous patch version, 1.35.8-gke.1026000. For information about upstream Kubernetes changes, see the Kubernetes v1.35.8 changelog.

1.35.8-gke.1026000

The following sections describe changes in this patch version when compared with the previous patch version, 1.35.7-gke.1222000. For information about upstream Kubernetes changes, see the Kubernetes v1.35.8 changelog.

Component Updates

The following sections provide information about updates to specific GKE system components in this patch version.

advanceddatapath

Updated advanceddatapath component from version 35.3.22 to 35.3.23.

  • Security Fixes:
    • Updated golang.org/x/net to address GO-2026-5942.
    • Updated golang.org/x/text to address GO-2026-5970.

customer-logs-exporter

Updated customer-logs-exporter component from version 1.35.1-gke.7 to 1.35.1-gke.8.

  • Miscellaneous:
    • Updated base image digests for the component.

gcsfusecsi

Updated gcsfusecsi component from version 1.35.55 to 1.35.58.

gpu-device-plugin

Updated gpu-device-plugin component from version 1.35.4-gke.4 to 1.35.5-gke.0.

  • Security Fixes:
    • Updated Ubuntu base images to 22.04 and 24.04 to address vulnerabilities.

networkpolicy-antrea

Updated networkpolicy-antrea component from version 0.6.8 to 0.6.9.

  • Miscellaneous:
    • Updated cluster-proportional-autoscaler image to v1.10.2-gke.54.

networkpolicy-calico

Updated networkpolicy-calico component from version 4.35.3 to 4.35.4.

  • Security Fixes:
    • Fixed CVE-2026-39822 by updating the Go build version to 1.25.12.
    • Updated golang.org/x/crypto to v0.52.0 to resolve security vulnerabilities in calico/node.

osimage

Updated osimage component from version 1.35.132 to 1.35.148.

tpu-device-plugin

Updated tpu-device-plugin component from version 1.35.13-gke.5 to 1.35.13-gke.6.

  • Security Fixes:
    • Updated google.golang.org/grpc to v1.82.1 to address vulnerability GO-2026-6061.