GKE 1.36 changelog

This document lists the changes for the patch versions of the Google Kubernetes Engine (GKE) 1.36 minor version.

These changelogs are supplementary information about the updates to specific GKE system components. For information about features, changes, and security issues in GKE, see the following documents:

1.36.4-gke.1247000

The following sections describe changes in this patch version when compared with the previous patch version, 1.36.4-gke.1082000. For information about upstream Kubernetes changes, see the Kubernetes v1.36.4 changelog.

Component Updates

The following sections provide information about updates to specific GKE system components in this patch version.

gcp-controller-manager-combined

Updated gcp-controller-manager-combined component from version 36.1.4 to 36.2.0.

  • Features:
    • Added support for the ToLocalhost type within the component configuration.
    • Added the --fetched_cert_validity flag to allow configuration of certificate TTL for fetched credentials.
  • Miscellaneous:
    • Renamed the custom signerName delegation flag to allow-signing-kubelet-serving-for-non-gcp to improve clarity for signing kubelet serving certificates on non-GCP nodes.
    • Removed legacy host-path volume mounts for /etc/srv/kubernetes/pki and associated command-line flags for cluster CA files (--cluster-root-ca-file and --cluster-ca-bundle) in favor of DCD.

gke-metrics-agent

Updated gke-metrics-agent component from version 2.136.20-gke.0 to 2.136.20-gke.1.

  • Features:
    • Implemented Pressure Stall Information (PSI) collection for node daemons.
  • Miscellaneous:
    • Reduced the container image size by optimizing vendor dependency trimming.

l7-lb-controller-combined

Updated l7-lb-controller-combined component from version 1.41.3-gke.0 to 1.41.4-gke.0.

  • Features:
    • Added support for BYOIPv6 NetLB via the ip-collection-v6 annotation.
  • Bug Fixes:
    • Improved Standalone NEG LB controller with better event messaging, rule sorting, IP sanitization, and user error classification (including BackendNotAttached condition).
    • Allowed static BYOIPv6 addresses without the ip-collection-v6 annotation, and added a warning when the annotation is mistakenly used on an ILB.
    • Refactored L4 standalone NEG controller logic.
  • Security Fixes:
    • Addressed a Confused Deputy vulnerability in the Standalone NEG controller by verifying that service NEGs are attached to the LB backend service before writing the LB VIP into the service status.

osimage

Updated osimage component from version 1.36.95 to 1.36.99.

  • Security Fixes:
  • Miscellaneous:
    • Updated system packages and dependencies: containerd and containerd-test to v2.2.7, fluent-bit to v4.2.8, unzip to v6.0_p31, dash to v0.5.13.5, libverto to v0.3.2-r1, popt to v1.19-r1, acl to v2.4.0-r2, and passwdqc to v2.0.3-r1.
    • Adjusted runtime sysctl configuration for net.ipv4.udp_mem.

1.36.4-gke.1082000

The following sections describe changes in this patch version when compared with the previous patch version, 1.36.3-gke.1767000. For information about upstream Kubernetes changes, see the Kubernetes v1.36.4 changelog.

Component Updates

The following sections provide information about updates to specific GKE system components in this patch version.

customer-logs-exporter

Updated customer-logs-exporter component from version 1.36.0-gke.9 to 1.36.0-gke.11.

  • Security Fixes:
    • Updated google.golang.org/grpc to v1.82.1 to resolve GO-2026-6061.
  • Miscellaneous:
    • Introduced new configuration support for cloud logging endpoints and project-specific metadata via ComponentOptionsConfig.

gke-metrics-agent

Updated gke-metrics-agent component from version 2.136.18-gke.1 to 2.136.20-gke.0.

  • Features:
    • Implemented node-level Pressure Stall Information (PSI) collection.
  • Miscellaneous:
    • Optimized the container image size by adjusting vendor dependencies, reducing the image size from approximately 64MB to 47MB.
    • Updated Workload Autoscaler to version 0.27.0-gke.17.

gvisor

Updated gvisor component from version 1.36.19 to 1.36.23.

  • Miscellaneous:
    • Updated gVisor to version 20260727.0_RC04.

l7-lb-controller-combined

Updated l7-lb-controller-combined component from version 1.41.1-gke.0 to 1.41.3-gke.0.

  • Bug Fixes:
    • Improved L4 Address Manager IP validation to prevent false positive substring matches and enforce explicit Network Tier and Load Balancing Scheme validation.
  • Security Fixes:
    • Go version update to 1.26.6, Go kubernetes client dependency updates to v1.36.3, update google.golang.org/api and google.golang.org/grpc to the newest versions.

osimage

Updated osimage component from version 1.36.75 to 1.36.95.

1.36.3-gke.1767000

The following sections describe changes in this patch version when compared with the previous patch version, 1.36.3-gke.1640000. For information about upstream Kubernetes changes, see the Kubernetes v1.36.3 changelog.

Component Updates

The following sections provide information about updates to specific GKE system components in this patch version.

clouddns

Updated clouddns component from version 36.3.2 to 36.3.3.

  • Bug Fixes:
    • Fix crash loop by mounting tmp as read-write in clouddns container.

gcsfusecsi

Updated gcsfusecsi component from version 1.36.38 to 1.36.41.

  • Security Fixes:
    • Updated golang.org/x/mod from v0.37.0 to v0.40.0 to address security vulnerability GO-2026-6179.

networkpolicy-calico

Updated networkpolicy-calico component from version 4.36.0 to 4.36.1.

  • Security Fixes:
    • Fixed CVE-2026-39822 by updating the Go build version to 1.25.12.
    • Updated golang.org/x/crypto to v0.52.0 to remediate security vulnerabilities in the Calico node component.