GKE 1.37 changelog

This document lists the changes for the patch versions of the Google Kubernetes Engine (GKE) 1.37 minor version.

These changelogs are supplementary information about the updates to specific GKE system components. For information about features, changes, and security issues in GKE, see the following documents:

1.37.1-gke.1552000

The following sections describe changes in this patch version when compared with the previous patch version, 1.37.0-gke.3503000. For information about upstream Kubernetes changes, see the Kubernetes v1.37.1 changelog.

Kubernetes updates

k8s-api

Updated k8s-api cohort from version 1.37.0-gke.900 to 1.37.1-gke.300.

  • Features:
    • Implemented a package-based installation method for the crictl tool on GKE nodes to facilitate automated binary updates.
    • Updated the Google Secrets Manager (GSM) endpoint to support private registries in Transparent Proxy Configuration (TPC).
    • Added the ability to override the IP address of the kube-apiserver to allow controllers to connect via an Internal Load Balancer (ILB).
    • Added support for certificates in kubeconfig within the configuration helper.
    • Added zswap configuration support, allowing zswap to be enabled and configured via sysfs during swap setup.
    • Extended the GKE AppPkg installer to support extracting the full contents of compressed release tarballs into a specified destination directory and preserving the original tarball for compliance.
    • Added support for the autonomous execution of custom configuration scripts during the AppPkg installation process via the components.gke.io/configure-script-path annotation.
  • Bug fixes:
    • Updated the service account token audience configuration for Workload Identity image pulls to use the standard workload pool format (${project_id}.svc.id.goog). This resolves issues where image pulls were blocked by NodeRestriction admission control or rejected by Google STS with an invalid_grant error.
    • Updated Node Problem Detector custom plugins to v1.0.41 to resolve epoll stalls during inotify checks and fix a regex issue in the image pull monitor that caused false positives on successful pulls.
    • Forced chronyd to synchronize the system clock immediately upon VM resumption on COS and Ubuntu nodes to prevent time drift or stale pre-suspension time.
    • Resolved a resource leak in the host-level NFS wrapper where bind mounts accumulated in the host namespace, eventually preventing the node from creating new mounts and blocking Pod startup.
    • Fixed an issue where NFS unmount requests were incorrectly handled as mount commands, causing unmount operations to fail.
    • Improved the NFS wrapper node setup logic to reliably clear stale binds and help ensure the atomic installation of mount binaries.
    • Clamped the sunrpc port range during node bootstrap to improve configuration stability.
    • Fixed an issue where parts of the ControllerRevision outside of the .spec were incorrectly restored for StatefulSet objects.
    • Added a guard in the Windows kernel implementation of kube-proxy to handle load balancers that do not have port mappings.
    • Resolved an issue where Job Pods could not be removed if the finalizer removal process failed.
    • Prevented node-specific kubelet configurations from leaking into the ConfigMap.
    • Fixed a potential integer overflow in Dynamic Resource Allocation (DRA) during per-claim device-limit checks.
    • Updated Dynamic Resource Allocation (DRA) to help ensure that a nil DeviceTaintSelector correctly matches no devices.
    • Adjusted the execution order of legacy configuration scripts to help ensure they are skipped on EVE-based installations.
  • Security fixes:
    • Fixed a confused deputy vulnerability in the StatefulSet controller by restoring only the .Spec field from ControllerRevision, which helps prevent unauthorized cross-namespace Pod creation (CVE-2026-2270).
    • Improved security in Windows subPath resolution by refusing UNC symlink targets, which helps prevent potential forced NTLM authentication.
    • Enhanced system integrity by implementing cryptographic checksum validation of preserved installation tarballs and performing a fresh extraction of binaries on every reboot.
  • Miscellaneous:
    • Removed the --pod-sysctls kubelet command-line flag, as this setting has moved to the kubelet configuration.
    • Refined logging for NFS and rpcbind operations to help ensure that degraded behavior and configuration issues are recorded at appropriate severity levels.
    • Updated Go runtime to v1.26.8 and updated container base images to use distroless iptables.

Component updates

The following sections provide information about updates to specific GKE system components in this patch version.

accelerator-operator

Updated accelerator-operator component from version 1.35.3 to 1.37.1.

  • Miscellaneous:
    • Added support for new metadata fields: ClusterHash, ClusterName, Location, MasterProjectNumber, and ProjectNumber.

clouddns

Updated clouddns component from version 36.3.3 to 36.3.5.

  • Bug fixes:
    • Cloud DNS Controller: Improved shutdown logic for Cloud DNS controllers in multi-tenant environments. The improved logic helps to ensure that reconcilers, updaters, and informers are properly cleaned up when a controller shuts down, which helps prevent resource leaks.

filestorecsi

Updated filestorecsi component from version 1.36.19 to 1.37.7.

gcp-controller-manager-combined

Updated gcp-controller-manager-combined component from version 36.2.1 to 36.2.3.

  • Features:
    • Added support in nodeannotator to populate TPU partition topology labels for TPU8i.
  • Security fixes:
    • Updated github.com/google/cel-go to v0.29.2 to address security vulnerability GHSA-gcjh-h69q-9w9g.
  • Miscellaneous:
    • Updated the configuration flag for custom signerName delegation to allow-signing-kubelet-serving-for-non-gcp.
    • Updated the gcp-controller-manager container image.

gcsfusecsi

Updated gcsfusecsi component from version 1.37.6 to 1.37.17.

  • Features:
    • Added support for per-tenant rendering and multi-tenant cluster configurations.
    • Introduced support for tenant-specific identity pools and identity providers for authentication.
    • Added support for Dataplane over Google Kubernetes Engine Front End (GKFE) using projected service account tokens.
  • Security fixes:
    • Updated google.golang.org/grpc to v1.83.1 and the csi-attacher container image to resolve CVE-2026-84304.
  • Miscellaneous:
    • Updated manifest templates to dynamically configure namespaces, labels, and resource names based on tenant parameters.
    • Configured DNS policies and Kubernetes service environment variables to utilize tenant-specific endpoints.
    • Added tenancy-related metadata labels including access-level, project, and tenant identifiers to component manifests.
    • Updated csi-node-driver-registrar image to v2.15.0-gke.47.
    • Conditioned shared mount flags, CSIDriver attachRequired, PriorityClass, and csi-attacher sidecar/RBAC on not.GKEAutopilotEnabled.
    • Bumped GCSFuse binary to v3.12.0.
    • Enabled gRPC by default plumbing via --enable-grpc-by-default and sidecar passthrough.
    • Updated gcsfusecsi container images to v1.24.8-gke.2.

gke-metrics-agent

Updated gke-metrics-agent component from version 2.137.3-gke.0 to 2.137.3-gke.1.

  • Features:
    • Implemented Pressure Stall Information (PSI) collection for node-daemon.
  • Security fixes:
    • Updated the autoscaling-metrics-exporter to version 0.3.2-gke to address security vulnerabilities.

gpu-device-plugin

Updated gpu-device-plugin component from version 1.37.0-gke.0 to 1.37.1-gke.2.

  • Features:
    • Added support for GPUDirect Storage by passing the --nvidia-fs flag to COS GPU installer when the cloud.google.com/gke-gpudirect-storage node label is set to true.
    • Added support for a pinned driver specified via the node label cloud.google.com/gke-gpu-driver-version in the form of RWWW and WWW.YY.ZZ.
    • Bumped gpu-device-plugin to v1.36.5-gke.0 for vulnerability fixes.
    • Bumped nvidia-partition-gpu to v1.36.5-gke.0 for vulnerability fixes.
    • Bumped nvidia-persistenced-installer to v1.36.5-gke.0 for vulnerability fixes.
  • Security fixes:
    • Updated Go modules to address security vulnerabilities.
  • Miscellaneous:
    • Updated component manifest to support GKE Autopilot enablement and internal migration configuration settings.
    • Updated gke-metrics-collector image to 20261003_2300_RC0.

gvisor

Updated gvisor component from version 1.37.13 to 1.37.18.

  • Bug fixes:
    • shim (GCSFuse Deadlocks):
    • Unwedged containers and reactively aborted FUSE connections on gofer exit during teardown (#14811).
    • Added opt-in reactive timeout-guarded FUSE abort on container teardown (#14635).
    • shim: Fixed shim to not transition to stopped state prematurely from a state query (#14646).
    • shim: Updated shim to report container as running while any init task is still alive (#14645).
    • runsc: Allowed killing a container in the Created state (#14533).
    • kernel: Fixed setsid deadlock when orphaning a shared-sighand process group (#14534).
    • fs/overlayfs: Updated overlayfs to use caller credentials for upper xattr operations rather than root (#14560).
    • fs/host: Updated HostReadiness to report hangup on closed FD and made beforeSave idempotent (#14588).
  • Miscellaneous:
    • Updated gVisor to version 20260817.0_RC03.
    • Updated the gke-distroless/static base image to gke_distroless_20260915.00_p0.
    • Updated internal component configuration to explicitly include cluster parameters.

kube-addon-manager

Updated kube-addon-manager component from version 35.0.5 to 35.0.6.

  • Features:
    • Added support for multi-architecture releases.

kubedns

Updated kubedns component from version 36.0.4 to 36.0.5.

managed-opentelemetry

Updated managed-opentelemetry component from version 1.36.21-gke.2 to 1.37.8-gke.0.

  • Features:
    • Added support for OTLP gRPC exporters for log records, push metrics, and spans.
    • Introduced configuration options and validations to allow selection between OTLP HTTP and OTLP gRPC transports for telemetry data.
    • Updated Google-Built OpenTelemetry Collector (imgOtelCollector) to 0.153.0-gke.7.
    • Updated Google-Built OpenTelemetry Collector (imgOtelCollector) to 0.159.0-gke.6.
    • Replaced the batch/logs, batch/metrics, and batch/traces processors with native exporterhelper sending_queue and batch configurations on otlp_grpc/logs, otlp_grpc/traces, otlp_grpc/metrics, and otlp_grpc/self-metrics exporters, using byte-sized queues (sizer: bytes, block_on_overflow: true) for logs, traces, and metrics to help ensure predictable memory bounds and reliable backpressure.
    • Split the shared otlp_grpc exporter into dedicated per-signal exporters (otlp_grpc/logs, otlp_grpc/traces, otlp_grpc/metrics) so each telemetry signal has isolated queue capacity, consumer worker pools, and batching parameters.
    • Set terminationGracePeriodSeconds: 60 on the collector Deployment to allow in-memory exporter sending queues to drain gracefully during Pod termination.
    • Lowered OTLP gRPC receiver keepalive.server_parameters.max_connection_age from 10m to 1m (and removed redundant max_connection_idle, time, and timeout overrides) so long-lived gRPC client connections periodically reconnect and rebalance across newly scaled collector replicas.
    • Added soft topologySpreadConstraints (maxSkew: 1, whenUnsatisfiable: ScheduleAnyway) across topology.kubernetes.io/zone and kubernetes.io/hostname on the collector Deployment so scaled-out replicas are distributed across distinct availability zones and nodes.
  • Bug fixes:
    • Fixed Pod metadata cache memory leaks in k8s_attributes when Pod IPs are cleared prior to delete events, across container restarts, and during association state transitions.
    • Fixed CPU-burning forced-GC loop in memory_limiter under downstream exporter backpressure by applying exponential backoff when GC is ineffective.
    • Fixed exporterhelper otelcol_exporter_queue_batch_send_size and otelcol_exporter_queue_batch_send_size_bytes metrics to record batch sizes post-batching with byte-scale histogram buckets up to 16 MiB.
    • Fixed receivers so they start strictly after all processors and exporters to prevent startup race conditions across shared otlp receivers.
  • Security fixes:
  • Miscellaneous:
    • Removed deprecated extract.deployment_name_from_replicaset setting from the k8s_attributes processor configuration to eliminate startup deprecation warnings and prepare for OpenTelemetry Collector 0.160.0+.

managed-prometheus

Updated managed-prometheus component from version 0.19.0-gke.1 to 0.19.2-gke.0.

managedcertificates

Updated managedcertificates component from version 3.4.8 to 3.4.10.

networkpolicy-calico

Updated networkpolicy-calico component from version 4.36.1 to 4.36.3.

nodelocaldns

Updated nodelocaldns component from version 36.1.2 to 36.1.5.

  • Security fixes:
    • Updated Go modules to address security vulnerabilities.

osimage

Updated osimage component from version 1.36.79 to 1.37.15.

pdcsi

Updated pdcsi component from version 1.36.24 to 1.37.9.

  • Features:
    • Implemented dynamic default StorageClass selection for PVCs based on access mode.
    • Added default-sc-rollback-handler standard container for rollback support.
    • Added --http-endpoint=:9931 and a /healthz readinessProbe to the csi-driver-registrar container, so the node startup taint readiness.k8s.io/gke-pd-csi-ready is only removed after Kubelet finishes registering the PD CSI plugin.
    • Allowed ToLocalhost egress on multi-tenant clusters for pdcsi static Pods.
    • Added /debug/pprof and /metrics endpoints to emit Go runtime metrics and profiling data when invoked with --http-endpoint.
    • Added --universe-domain flag support for sovereign cloud environments.
    • Added an overlay with /etc/selinux and /sys/fs/selinux mounts to support the SELinuxMount feature.
    • Updated the PD CSI driver image to v1.27.1-gke.2, which adds an optional node readiness reporter (--enable-node-readiness-condition) that sets the pd.csi.storage.gke.io/Ready Node condition to True once csi-driver-registrar is healthy.
    • Enabled the node readiness reporter on the Linux node DaemonSet.
    • Granted nodes/status patch permission to pdcsi-driver-role and added a ValidatingAdmissionPolicy restricting pdcsi-node-sa to only patch status conditions on its own node.
  • Bug fixes:
    • Fixed manual device path updates in VerifyDevicePath so manually created device symlinks are properly used and stale symlinks (EEXIST) are cleaned up before recreation.
    • Fixed concurrent map read/write race conditions in csiErrorBackoff, DeviceCache (using non-blocking updates), ListVolumes, and ListSnapshots.
    • Fixed host PID exhaustion caused by zombie process leaks and prevented unchecked type assertion panics in execPipeCommand.
    • Fixed GKE Data Cache volume handling on Spot VMs.
    • Refactored the node_taint webhook to prevent dropping existing node data.
    • Added ResponseHeaderTimeout to the GCE OAuth HTTP client transport to prevent hung connections.
    • Reduced log spam by skipping instance disks with empty sources.
  • Security fixes:
    • Removed unused service account credentials from taint-controller in the noauth overlay.
    • Updated google.golang.org/grpc to resolve CVE-2026-84304.
    • Updated the google.golang.org/grpc library and container base images to resolve CVE-2026-84445.
  • Miscellaneous:
    • Updated the Go runtime to version 1.26.5 and updated Go module dependencies (golang.org/x, gopkg.in/ini.v1, ginkgo, and gomega).
    • Updated Go runtime to 1.27.1 and refreshed Debian and Distroless base images for CSI driver components, including the provisioner, registrar, and snapshotter.
    • Updated the csi-resizer sidecar to version v2.1.0-gke.25.

tpu-device-plugin

Updated tpu-device-plugin component from version 1.36.8-gke.0 to 1.36.9-gke.1.

  • Features:
    • Added support for the enable_full_hierarchy_labels KCP trait.
    • Moved ACS Agent (acs-agent) container from tpu-device-plugin DaemonSet to ai-telemetry-collector DaemonSet to prevent guest diagnostic telemetry failures from impacting device plugin health and scheduling availability.
  • Bug fixes:
    • Reverted ACS Agent image to sha256:2c2cad2eff5811c906334bced6a00b6f938d4308a26921bab9f5fc7d7ef445fb to prevent synchronous informer cache sync stalls from blocking TPU device plugin registration and unblock Cluster Autoscaler qualification.
  • Miscellaneous:
    • Updated the builder image to Golang 1.27.0 and updated runtime base images to Debian 13-based distroless versions.

workloadautoscaler

Updated workloadautoscaler component from version 20.2.0 to 20.5.0.

  • Features:
    • Added the --fetched_cert_validity configuration flag to manage the validity period of fetched certificates.
    • Introduced support for Multidimensional Pod Autoscaler (MPA).
    • Added support for in-place Pod resizing for Vertical Pod Autoscaler (VPA) without requiring Pod restarts.
    • Implemented an enhanced autoscaling metrics pipeline, including support for Unified Horizontal Pod Autoscaling (UAS) and custom metrics integration.
  • Miscellaneous:
    • Simplified deployment configuration by removing the init-cert container and the associated tls-certs host path volume.
    • Removed the dependency on the gke-distroless/bash image previously used for certificate initialization.
    • Configured API throttling (QPS and Burst) and controller memory limits to scale dynamically based on the master's CPU capacity.
    • Updated configuration for Horizontal Pod Autoscaling (HPA), including performance profiles and ambiguous selector checks.
    • Defined feature gates for Vertical Pod Autoscaling (VPA) recommendation shadow mode.
    • Updated Workload Autoscaler to version 0.28.0-gke.3.

1.37.0-gke.3503000

The following sections describe changes in this patch version when compared with the previous patch version, 1.37.0-gke.3165000. For information about upstream Kubernetes changes, see the Kubernetes v1.37.0 changelog.

Component Updates

The following sections provide information about updates to specific GKE system components in this patch version.

gpu-device-plugin

Updated gpu-device-plugin component from version 1.36.3-gke.2 to 1.37.0-gke.0.

  • Miscellaneous:
    • Initial scaffolding for the 1.37 component directory.

gvisor

Updated gvisor component from version 1.37.11 to 1.37.13.

  • Miscellaneous:
    • Updated gVisor to version 20260803.0_RC01.

l7-lb-controller-combined

Updated l7-lb-controller-combined component from version 1.41.3-gke.0 to 1.42.1-gke.0.

  • Bug Fixes:
    • Resolved a runtime panic error caused by improper context management.

1.37.0-gke.3165000

The following sections describe changes in this patch version when compared with the previous patch version, 1.37.0-gke.2941000. For information about upstream Kubernetes changes, see the Kubernetes v1.37.0 changelog.

Component Updates

The following sections provide information about updates to specific GKE system components in this patch version.

customer-logs-exporter

Updated customer-logs-exporter component from version 1.36.0-gke.11 to 1.36.0-gke.12.

  • Security Fixes:
    • Updated google.golang.org/grpc to v1.82.1 to resolve security advisory GO-2026-6061.

filestorecsi

Updated filestorecsi component from version 1.36.18 to 1.36.19.

  • Miscellaneous:
    • Updated the Go runtime to version 1.25.11 and refreshed container base images for csi-provisioner, csi-resizer, csi-snapshotter, snapshot-controller, and snapshot-validation-webhook.

gcp-controller-manager-combined

Updated gcp-controller-manager-combined component from version 36.1.6 to 36.2.1.

  • Features:
    • Added the --fetched_cert_validity flag to allow configuration of certificate TTL for fetched credentials.
  • Miscellaneous:
    • Removed legacy host-path volume mounts for /etc/srv/kubernetes/pki and associated command-line flags for cluster CA files (--cluster-root-ca-file and --cluster-ca-bundle) in favor of DCD.
    • Updated the flag name for custom signer name delegation to allow-signing-kubelet-serving-for-non-gcp.

kube-addon-manager

Updated kube-addon-manager component from version 35.0.2 to 35.0.5.

  • Features:
    • Added support for multi-architecture releases.
  • Miscellaneous:
    • Updated the kubectl prune whitelist to include flow control resources (FlowSchema and PriorityLevelConfiguration) for clusters running Kubernetes 1.23.0 and newer.
    • Added a configuration option to manage leader election modes for the addon manager.

pdcsi

Updated pdcsi component from version 1.36.23 to 1.36.24.

  • Security Fixes:
  • Miscellaneous:
    • Updated the Go runtime to version 1.26.5.
    • Updated the debian-base and distroless-static container base images for the CSI driver, snapshotter, and related sidecar components.

tpu-device-plugin

Updated tpu-device-plugin component from version 1.36.7-gke.2 to 1.36.8-gke.0.

  • Features:
    • Update ACS Agent image to include FatalErrorInfo and TPU Halt diagnostic collection.
    • Introduce TPU baremetal node support via --enable-baremetal-mode.
    • Skip MDS partition topology label polling for TPU8i (populated by cloud-provider-gcp).
    • Add multislice network, compute and transfer size/latency metrics.
  • Bug Fixes:
    • Add bounds checks for bucket count in TPU device plugin metrics.
    • Restore vbar.sock permission-change log.
  • Security Fixes:
    • Updated google.golang.org/grpc to version 1.82.1 to address security vulnerability GO-2026-6061.
    • Block vbar.sock symlink privilege escalation by mounting vbar directory read-only into workloads and enforcing safeChmod.
    • Updated google.golang.org/grpc to v1.82.1 to address vulnerability GO-2026-6061.
    • Updated runtime base image to gcr.io/distroless/static-debian13 and builder to Golang 1.27.0 to fix base image vulnerabilities.
  • Miscellaneous:
    • Updated the gke-distroless/bash base image.

1.37.0-gke.2941000

The following sections describe changes in this patch version when compared with the previous patch version, 1.37.0-gke.2155000. For information about upstream Kubernetes changes, see the Kubernetes v1.37.0 changelog.

Component Updates

The following sections provide information about updates to specific GKE system components in this patch version.

customer-logs-exporter

Updated customer-logs-exporter component from version 1.36.0-gke.10 to 1.36.0-gke.11.

  • Security Fixes:
    • Updated google.golang.org/grpc to v1.82.1 to resolve GO-2026-6061.
  • Miscellaneous:
    • Introduced new configuration support for cloud logging endpoints and project-specific metadata via ComponentOptionsConfig.

gke-metrics-agent

Updated gke-metrics-agent component from version 2.137.1-gke.0 to 2.137.3-gke.0.

  • Features:
    • Implemented node-daemon Pressure Stall Information (PSI) collection.
  • Miscellaneous:
    • Optimized the container image size by refining vendor dependencies.
    • Updated Workload Autoscaler to version 0.28.0-gke.3.

gvisor

Updated gvisor component from version 1.37.7 to 1.37.11.

  • Miscellaneous:
    • Updated gVisor to version 20260727.0_RC04.

l7-lb-controller-combined

Updated l7-lb-controller-combined component from version 1.41.1-gke.0 to 1.41.3-gke.0.

  • Bug Fixes:
    • Improved L4 Address Manager IP validation to prevent false positive substring matches and enforce explicit Network Tier and Load Balancing Scheme validation.
  • Security Fixes:
    • Go version update to 1.26.6, Go kubernetes client dependency updates to v1.36.3, update google.golang.org/api and google.golang.org/grpc to the newest versions.

1.37.0-gke.2155000

The following sections describe changes in this patch version when compared with the previous patch version, 1.36.3-gke.1767000. For information about upstream Kubernetes changes, see the Kubernetes v1.37.0 changelog.

Component Updates

The following sections provide information about updates to specific GKE system components in this patch version.

accelerator-operator

Updated accelerator-operator component from version 1.35.1 to 1.35.3.

  • Security Fixes:
    • Updated go.opentelemetry.io/otel/sdk to v1.40.0 to resolve GO-2026-4394.
    • Updated golang.org/x/net to v0.53.0 to resolve GO-2026-4440, GO-2026-4559, and GO-2026-4918.
    • Updated google.golang.org/grpc to v1.79.3 to resolve GO-2026-4762.
  • Miscellaneous:
    • Updated base images to use Golang 1.25.10.
    • Backported CI/CD configurations, container build steps, and Go 1.25.0 toolchain fixes to the release branch.
    • Updated the component image to version 1.35.0-gke.8.

advanceddatapath

Updated advanceddatapath component from version 36.3.14 to 36.4.2.

  • Miscellaneous:
    • Added node tolerations for kubernetes.io/arch: arm64 to allow component pods to be scheduled on ARM64-based nodes with the NoSchedule effect.

customer-logs-exporter

Updated customer-logs-exporter component from version 1.36.0-gke.9 to 1.36.0-gke.10.

  • Security Fixes:
    • Updated google.golang.org/grpc to v1.82.1 to resolve GO-2026-6061.

filestorecsi

Updated filestorecsi component from version 1.36.17 to 1.36.18.

  • Miscellaneous:
    • Updated the Go runtime to version 1.25.11.
    • Updated base images to the latest distroless versions for improved security and stability.
    • Explicitly named an internal initialization container as imgSpnpInitContainer in the component manifest.

gcp-controller-manager-combined

Updated gcp-controller-manager-combined component from version 36.1.4 to 36.1.6.

  • Features:
    • Added support for the ToLocalhost type within the component configuration.
  • Miscellaneous:
    • Renamed the custom signerName delegation flag to allow-signing-kubelet-serving-for-non-gcp to improve clarity for signing kubelet serving certificates on non-GCP nodes.

gcsfusecsi

Updated gcsfusecsi component from version 1.36.41 to 1.37.3.

  • Features:
    • Introduced shared mount feature support for non-production environments.
    • Added csi-attacher component support, including associated PriorityClass and RBAC configurations for non-production environments.
  • Bug Fixes:
    • Renamed the controller flag --leader-election-namespace to --driver-namespace to correctly reflect its function.
    • Allow ToLocalhost egress in StaticPodNetworkPolicy for gcsfusecsi-controller to prevent SPNP firewall drops during local OAuth token exchange.
  • Security Fixes:
    • Remediated security vulnerability GHSA-gcjh-h69q-9w9g by upgrading github.com/google/cel-go to v0.29.0.
    • Updated github.com/google/cel-go to resolve GO-2026-6094.
    • Updated go.etcd.io/etcd/client/pkg/v3 to resolve GO-2026-6107.
    • Updated the Go base image and the csi-attacher sidecar container to address security vulnerabilities.
  • Miscellaneous:
    • Updated mount configurations to utilize distinct host paths for pods and plugin registration (kubelet-pods-dir and kubelet-plugins-dir).
    • Updated the addonmanager.kubernetes.io/mode from Reconcile to Recreate.

gvisor

Updated gvisor component from version 1.36.19 to 1.37.7.

  • Miscellaneous:
    • Updated gVisor to version 20260803.0_RC01.

managed-prometheus

Updated managed-prometheus component from version 0.18.2-gke.0 to 0.19.0-gke.1.

osimage

Updated osimage component from version 1.36.75 to 1.36.79.