GKE 1.35 changelog

This document lists the changes for the patch versions of the Google Kubernetes Engine (GKE) 1.35 minor version.

These changelogs are supplementary information about the updates to specific GKE system components. For information about features, changes, and security issues in GKE, see the following documents:

1.35.8-gke.1796000

The following sections describe changes in this patch version when compared with the previous patch version, 1.35.8-gke.1626001. For information about upstream Kubernetes changes, see the Kubernetes v1.35.8 changelog.

Component Updates

The following sections provide information about updates to specific GKE system components in this patch version.

accelerator-operator

Updated accelerator-operator component from version 1.35.1 to 1.35.3.

  • Security Fixes:
    • Updated go.opentelemetry.io/otel/sdk to v1.40.0 to address GO-2026-4394.
    • Updated golang.org/x/net to v0.53.0 to address GO-2026-4440, GO-2026-4559, and GO-2026-4918.
    • Updated google.golang.org/grpc to v1.79.3 to address GO-2026-4762.
  • Miscellaneous:
    • Updated base images to use Golang 1.25.10.
    • Backported CI/CD configurations, container build steps, and Go 1.25.0 toolchain fixes to the release branch.
    • Updated the component image to version 1.35.0-gke.8.

filestorecsi

Updated filestorecsi component from version 1.35.28 to 1.35.30.

gcp-controller-manager-combined

Updated gcp-controller-manager-combined component from version 35.0.10 to 35.0.11.

  • Miscellaneous:
    • Updated the build configuration to disable CGO, eliminating runtime dependencies on gcc.

gcsfusecsi

Updated gcsfusecsi component from version 1.35.64 to 1.35.65.

  • Security Fixes:
    • Updated Go modules go.opentelemetry.io/otel and golang.org/x/crypto to resolve CVE-2026-41178 and CVE-2026-78662.
    • Updated the container base image to address security vulnerabilities.

gpu-device-plugin

Updated gpu-device-plugin component from version 1.35.6-gke.0 to 1.35.6-gke.2.

  • Security Fixes:
    • Updated Go modules to address security vulnerabilities in gke-metrics-collector, nvidia-gpu-device-plugin, nvidia-partition-gpu, and nvidia-persistenced-installer.
  • Miscellaneous:
    • Updated container base images for nvidia-gpu-device-plugin, nvidia-partition-gpu, nvidia-persistenced-installer, and fastsocket-installer.

kubedns

Updated kubedns component from version 35.0.11 to 35.0.12.

  • Security Fixes:
  • Miscellaneous:
    • Updated the container base image to gke_distroless_20260901.00_p0.
    • Updated Go module go.etcd.io/etcd/client/pkg/v3 from v3.6.10 to v3.6.14.

networkpolicy-antrea

Updated networkpolicy-antrea component from version 0.6.10 to 0.6.11.

  • Bug Fixes:
    • Added exponential backoff and retry for Windows named pipe connections in the Antrea agent. This addresses a race condition where the container runtime might attempt to connect to the CNI socket before it has been fully initialized during node boot, preventing transient "file not found" errors.

nodelocaldns

Updated nodelocaldns component from version 35.0.10 to 35.0.11.

  • Miscellaneous:
    • Updated go.etcd.io/etcd/client/pkg/v3 from v3.6.10 to v3.6.14.

pdcsi

Updated pdcsi component from version 1.35.52 to 1.35.54.

  • Bug Fixes:
    • Fixed an issue where access modes were handled incorrectly for Hyperdisk Balanced and Throughput volumes during retried CreateVolume requests.
  • Security Fixes:

tpu-device-plugin

Updated tpu-device-plugin component from version 1.35.13-gke.8 to 1.35.13-gke.9.

  • Bug Fixes:
    • Stop emitting stale TPU runtime metrics after the last TPU container on a node exits. Replaces the periodic global GaugeVec.Reset (which caused metric flip-flop in Prometheus) with stateful per-container tracking that deletes label values only after six consecutive missed collection cycles (~60 seconds).
  • Security Fixes:
    • Updated google.golang.org/grpc to v1.85.0-dev.0.20260825072537-93e31b48545e to address vulnerability GO-2026-6443.
    • Updated golang.org/x/crypto from v0.53.0 to v0.56.0 to address vulnerabilities GO-2026-6303 and GO-2026-6354.
  • Miscellaneous:
    • Bumped the Go builder base image to golang 1.26.8 to match the go directive in go.mod, unblocking the release image build.
    • Updated gke-distroless/bash to gke_distroless_20260918.00_p0.

1.35.8-gke.1626001

There are no customer-facing updates in this version when compared to the previous patch version, 1.35.8-gke.1626000. For information about upstream Kubernetes changes, see the Kubernetes v1.35.8 changelog.

1.35.8-gke.1439001

There are no customer-facing updates in this version when compared to the previous patch version, 1.35.8-gke.1439000. For information about upstream Kubernetes changes, see the Kubernetes v1.35.8 changelog.

1.35.8-gke.1380001

There are no customer-facing updates in this version when compared to the previous patch version, 1.35.8-gke.1380000. For information about upstream Kubernetes changes, see the Kubernetes v1.35.8 changelog.

1.35.6-gke.1250001

There are no customer-facing updates in this version when compared to the previous patch version, 1.35.6-gke.1250000. For information about upstream Kubernetes changes, see the Kubernetes v1.35.6 changelog.

1.35.8-gke.1626000

The following sections describe changes in this patch version when compared with the previous patch version, 1.35.8-gke.1439000. For information about upstream Kubernetes changes, see the Kubernetes v1.35.8 changelog.

Component Updates

The following sections provide information about updates to specific GKE system components in this patch version.

filestorecsi

Updated filestorecsi component from version 1.35.27 to 1.35.28.

  • Security Fixes:
  • Miscellaneous:
    • Updated the Go runtime to version 1.27.1 and updated container base images for CSI sidecar components including csi-provisioner, csi-resizer, and csi-snapshotter.

gcsfusecsi

Updated gcsfusecsi component from version 1.35.61 to 1.35.64.

  • Security Fixes:
  • Miscellaneous:
    • Updated the csi-node-driver-registrar image to v2.15.0-gke.47.

gvisor

Updated gvisor component from version 1.35.16 to 1.35.17.

  • Miscellaneous:
    • Updated the container base image to gke_distroless_20260915.00_p0.

kube-addon-manager

Updated kube-addon-manager component from version 35.0.2 to 35.0.5.

  • Features:
    • Added support for multi-architecture releases.
  • Miscellaneous:
    • Updated the kubectl prune whitelist to include flow control resources (FlowSchema and PriorityLevelConfiguration) for clusters running Kubernetes 1.23.0 and newer.
    • Added a configuration option to manage leader election modes for the addon manager.

managed-opentelemetry

Updated managed-opentelemetry component from version 1.35.13-gke.1 to 1.35.13-gke.2.

  • Security Fixes:
    • Upgraded otelcol-custom to 0.153.0-gke.5 to remediate golang.org/x/crypto CVEs.

osimage

Updated osimage component from version 1.35.152 to 1.35.160.

pdcsi

Updated pdcsi component from version 1.35.49 to 1.35.52.

  • Bug Fixes:
    • Fixed an issue where access modes were incorrectly handled for Hyperdisk Balanced and Hyperdisk Throughput volumes during retried CreateVolume calls.
  • Security Fixes:
  • Miscellaneous:
    • Updated the Go runtime and base container images to improve overall component stability.

workloadautoscaler

Updated workloadautoscaler component from version 18.10.0 to 18.11.0.

  • Bug Fixes:
    • Updated Vertical Pod Autoscaler components, including the admission-controller, recommender, and updater, to version 0.26.0-gke.18.

1.35.8-gke.1439000

The following sections describe changes in this patch version when compared with the previous patch version, 1.35.8-gke.1380000. For information about upstream Kubernetes changes, see the Kubernetes v1.35.8 changelog.

Kubernetes Updates

k8s-api

Updated k8s-api cohort from version 1.35.8-gke.100 to 1.35.8-gke.300.

  • Miscellaneous:
    • Added GOMEMLIMIT and GOGC environment variables to the kube-apiserver manifests to optimize memory usage and garbage collection behavior.

Component Updates

The following sections provide information about updates to specific GKE system components in this patch version.

gcsfusecsi

Updated gcsfusecsi component from version 1.35.60 to 1.35.61.

  • Miscellaneous:
    • Updated Go runtime to 1.27.0, Debian base image to bookworm-v1.0.8-gke.10, and csi-node-driver-registrar to v2.15.0-gke.45.

l7-lb-controller-combined

Updated l7-lb-controller-combined component from version 1.38.7-gke.0 to 1.38.8-gke.0.

  • Security Fixes:
    • Added a validation check for Standalone L4 Network Endpoint Groups (NEGs) to verify proper attachment.

networkpolicy-antrea

Updated networkpolicy-antrea component from version 0.6.9 to 0.6.10.

  • Miscellaneous:
    • Updated Antrea image to v1.4.0-gke.73 and Cilium Windows image to v1.17.8-gke.134.
    • Updated container base images and the Go runtime patch version.

tpu-device-plugin

Updated tpu-device-plugin component from version 1.35.13-gke.7 to 1.35.13-gke.8.

  • Bug Fixes:
    • Revert ACS Agent image to sha256:2c2cad2eff5811c906334bced6a00b6f938d4308a26921bab9f5fc7d7ef445fb to prevent synchronous informer cache sync stalls from blocking TPU device plugin registration and unblock Cluster Autoscaler qualification.

1.35.8-gke.1380000

The following sections describe changes in this patch version when compared with the previous patch version, 1.35.8-gke.1225000. For information about upstream Kubernetes changes, see the Kubernetes v1.35.8 changelog.

Component Updates

The following sections provide information about updates to specific GKE system components in this patch version.

gcsfusecsi

Updated gcsfusecsi component from version 1.35.58 to 1.35.60.

gpu-device-plugin

Updated gpu-device-plugin component from version 1.35.5-gke.0 to 1.35.6-gke.0.

  • Miscellaneous:
    • bump gpu-device-plugin to v1.35.5-gke.0
    • bump nvidia-partition-gpu to v1.35.5-gke.0
    • bump nvidia-persistenced-installer to v1.35.5-gke.0

gvisor

Updated gvisor component from version 1.35.13 to 1.35.16.

  • Miscellaneous:
    • Updated the gke-distroless/static container base image.
    • Updated gke-gvisor-installer to version 20260727.0_RC04.

pdcsi

Updated pdcsi component from version 1.35.48 to 1.35.49.

tpu-device-plugin

Updated tpu-device-plugin component from version 1.35.13-gke.6 to 1.35.13-gke.7.

  • Features:
    • Update ACS Agent image to include FatalErrorInfo and TPU Halt diagnostic collection.

1.35.8-gke.1225000

The following sections describe changes in this patch version when compared with the previous patch version, 1.35.8-gke.1036000. For information about upstream Kubernetes changes, see the Kubernetes v1.35.8 changelog.

Component Updates

The following sections provide information about updates to specific GKE system components in this patch version.

osimage

Updated osimage component from version 1.35.148 to 1.35.152.

  • Features:
    • Updated Linux kernel to COS-6.12.94.
    • Updated Docker to v27.5.1.
    • Updated Containerd to v2.2.7.
    • Updated cos-gpu-installer to v2.7.7.
  • Bug Fixes:
    • Added support for net-fs/lustre-client-drivers v2.14.0_p259.
    • Upgraded sys-apps/xemu to v0.0.10.
  • Security Fixes:
  • Miscellaneous:
    • Modified runtime sysctl configuration for net.ipv4.udp_mem.

workloadautoscaler

Updated workloadautoscaler component from version 18.8.0 to 18.10.0.

  • Miscellaneous:
    • Updated Vertical Pod Autoscaler (VPA) admission-controller, recommender, and updater to version 0.26.0-gke.17.

1.35.8-gke.1036000

There are no customer-facing updates in this version when compared to the previous patch version, 1.35.8-gke.1026000. For information about upstream Kubernetes changes, see the Kubernetes v1.35.8 changelog.

1.35.8-gke.1026000

The following sections describe changes in this patch version when compared with the previous patch version, 1.35.7-gke.1222000. For information about upstream Kubernetes changes, see the Kubernetes v1.35.8 changelog.

Component Updates

The following sections provide information about updates to specific GKE system components in this patch version.

advanceddatapath

Updated advanceddatapath component from version 35.3.22 to 35.3.23.

  • Security Fixes:
    • Updated golang.org/x/net to address GO-2026-5942.
    • Updated golang.org/x/text to address GO-2026-5970.

customer-logs-exporter

Updated customer-logs-exporter component from version 1.35.1-gke.7 to 1.35.1-gke.8.

  • Miscellaneous:
    • Updated base image digests for the component.

gcsfusecsi

Updated gcsfusecsi component from version 1.35.55 to 1.35.58.

gpu-device-plugin

Updated gpu-device-plugin component from version 1.35.4-gke.4 to 1.35.5-gke.0.

  • Security Fixes:
    • Updated Ubuntu base images to 22.04 and 24.04 to address vulnerabilities.

networkpolicy-antrea

Updated networkpolicy-antrea component from version 0.6.8 to 0.6.9.

  • Miscellaneous:
    • Updated cluster-proportional-autoscaler image to v1.10.2-gke.54.

networkpolicy-calico

Updated networkpolicy-calico component from version 4.35.3 to 4.35.4.

  • Security Fixes:
    • Fixed CVE-2026-39822 by updating the Go build version to 1.25.12.
    • Updated golang.org/x/crypto to v0.52.0 to resolve security vulnerabilities in calico/node.

osimage

Updated osimage component from version 1.35.132 to 1.35.148.

tpu-device-plugin

Updated tpu-device-plugin component from version 1.35.13-gke.5 to 1.35.13-gke.6.

  • Security Fixes:
    • Updated google.golang.org/grpc to v1.82.1 to address vulnerability GO-2026-6061.