GKE Gateway now supports frontend mTLS (client certificate validation). Frontend mTLS allows the Gateway to authenticate client-presented certificates. This feature is available for the following GatewayClasses:

• gke-l7-global-external-managed
• gke-l7-regional-external-managed
• gke-l7-rilb

For more information, see Configure frontend mTLS for a Gateway.

GKE is introducing the following changes to expand the capabilities of maintenance exclusions:

• Per-node pool maintenance exclusions: Available in release channels, these replicate the functionality of disabling node pool auto-upgrades when your cluster isn't enrolled in a release channel.
• Extended "No upgrades" exclusion: The "No upgrades" default maintenance exclusion can now be up to 90 days long.

For more information, see Maintenance exclusions.

GKE Gateway now supports backend authenticated TLS for Gateway-originated connections to Pods or InferencePools for the following GatewayClasses:

• gke-l7-global-external-managed
• gke-l7-regional-external-managed
• gke-l7-rilb

C4A bare metal instances are generally available with GKE clusters. For more information, see the Arm workloads on GKE document, including the "Requirements and limitations" section for specific version requirements.

Feature

Confidential GKE Nodes now support cluster level enablement of AMD SEV-SNP and Intel TDX on GKE Autopilot.

Feature

In GKE versions 1.36.0-gke.2459000 and later, you can directly configure Cloud Logging for L4 load balancer backend services by using the L4LBConfig CustomResourceDefinition (CRD).

This feature is available for the following load balancer types:

• Internal L4 load balancers with subsetting enabled.
• External L4 load balancers with regional backend services (RBS) enabled.

Cloud Storage FUSE CSI driver is now supported for Google Cloud Dedicated clusters and node pools running GKE version 1.36.0-gke.1266000 and higher. To use the driver, you must specify the custom-endpoint mount option by using either the gcsfuse CLI or the configuration file format. For more information, see About Cloud Storage FUSE CSI driver for GKE.

To monitor the efficiency of the GKE training JobSet, the following two GKE system metrics are available in Preview:

• kubernetes.io/jobset/scheduling_goodput: the fraction of time that all the resources required to run the training JobSet are available.
• kubernetes.io/jobset/proxy_runtime_goodput: the fraction of time that all required accelerators are productive. This metric provides an estimate of the real runtime goodput.

For details about GKE metrics, see Kubernetes metrics. For details about goodput metrics that are used to measure efficiency, see Monitor goodput with the ML Goodput Measurement library.

You can also view these new GKE metrics in the JobSet monitoring dashboard.

GKE now supports concurrent node pool upgrades for clusters (Preview). By default, GKE automatically upgrades one node pool at a time. To decrease the total time required to upgrade your cluster, you can now configure the maximum number of node pools that GKE auto-upgrades simultaneously. This feature is supported for both Standard and Autopilot clusters. For more information, see Configure concurrent node pool upgrades.

Feature

Managed OpenTelemetry on GKE now supports the collection of multimodal prompts and responses (Preview) for LangGraph and Agent Development Kit (ADK) agents. You can view and analyze the data in the Trace Explorer and BigQuery platforms. For more details, see Collect multimodal prompts and responses data.

GKE Pod Snapshots is generally available on clusters that run version 1.35.3-gke.1234000 or later. For more information, see About GKE Pod snapshots.

Feature

In GKE Standard clusters, live migration is now supported on Confidential GKE Nodes that use C3D machine series with AMD SEV enabled.

New features in 1.36

• L4 Internal Load Balancer services now use GKE subsetting by default. This change transitions the default implementation from Instance Groups to Network Endpoint Groups (NEGs). This NEG-based approach provides improved scalability and enhanced performance through faster synchronization. This change applies only to newly created Internal Load Balancer services, while existing services remain unaffected and continue using Instance Groups.
• Mutating Admission Policies are now Generally Available. Mutating admission policies allow for resource mutations using Common Expression Language (CEL) expressions as a more efficient alternative to mutating admission webhooks. For more information, see the kubernetes documentation.
• The kube-dns image switches from an implementation based on kubernetes/dns to one based on CoreDNS. This implementation is more efficient, and it supports bigger headless services, more upstream DNS services, and more concurrent connections.

Google Kubernetes Engine now offers support for AI zones. To learn more, see AI zones.

For clusters running GKE version 1.35.3-gke.1389000 or later, you can now use the c4a-highmem-96-metal (Preview) machine type from the C4A machine series with the following features:

• Autopilot mode
• Node auto-provisioning
• ComputeClasses that auto-create node pools
• Cluster autoscaling

Feature

Starting in GKE version 1.35.2-gke.1842000, you can install the Slurm Operator add-on for GKE (Preview). This managed installation of the Slurm Operator allows you to enable Slurm scheduling capabilities on any GKE cluster. The add-on provides the foundation to build customized AI and HPC platforms, including CPU, GPU, and TPU machines (covering specific scenarios). For more information, see About Slurm on GKE.

Accelerator network profile is Generally Available (GA), simplifying your AI/ML node pool setup. Accelerator network profile automates networking configuration, including the creation of necessary VPCs and subnets, removing the need for complex, manual steps previously required for configuring GPU and TPU workloads. For details, see Configure automated networking for accelerator VMs.

Gateway API v1.5 is supported in GKE version 1.35.2-gke.1842000 and later. The GKE Gateway controller passes core conformance tests for this version of the Gateway API.

Feature

GKE managed DRANET is now Generally Available (GA) for GKE version 1.35.2-gke.1842000 or later.

GKE DRANET is a managed feature that implements the Kubernetes Dynamic Resource Allocation (DRA) API for high-performance networking. The GA release expands support beyond the preview phase to include the following hardware:

• NVIDIA GPU Instances: Support for instances starting from A3 Ultra, including A4, A4X, and A4X Max.
• Cloud TPU Instances: Support for TPU v6e and TPU v7x.

For more information, see Allocate network resources by using GKE managed DRANET.

To provide more controls over the control plane version upgrade, you can now do the following:

• Configure a frequency of disruption from auto-upgrades by using the cluster disruption budget. For more information, see Control the frequency of disruption from auto-upgrades.
• Continue using an existing control plane patch for a longer period, which facilitates large-scale upgrade and downgrade operations. For more information, see Patch version support.

In GKE version 1.35 and later, all organization and cluster administrators can granularly control which privileged Autopilot partner workloads can run in GKE clusters. Additionally, approved customers can authorize and run their own privileged workloads in Autopilot mode by using custom allowlists.

For more information, see About Autopilot privileged workloads.

Managed OpenTelemetry for GKE is available in Preview for clusters running version 1.34.1-gke.2178000 or later. Managed OpenTelemetry for GKE provides a fully managed and simplified experience for collecting OpenTelemetry Protocol (OTLP) traces, metrics, and logs on GKE. This feature includes the following characteristics:

• Managed collection: an in-cluster OTLP endpoint that automatically routes telemetry to the Cloud Telemetry API.
• Automatic configuration: a new Instrumentation custom resource that automatically injects environment variables into your workloads to simplify OTLP ingestion.

For more information, see Managed OpenTelemetry for GKE.

GKE Inference Quickstart (GIQ) now offers recommendations for distributed AI inference. This enables you to deploy optimized, full configurations for advanced models, such as the Qwen and gpt-oss model families, on NVIDIA GPUs and Cloud TPUs.

This release introduces GKE Inference Gateway by integrating llm-d inference scheduling. You can select optimized configurations for workloads like Advanced Customer Support, Code Completion, and Deep Research. This tunes your infrastructure to meet the specific latency and throughput requirements of these applications.

For more information, see Analyze model serving performance and costs with Inference Quickstart.

Feature

You can use automated disk type selection for Hyperdisk volumes on GKE. This feature allows GKE to automatically select the most appropriate disk type based on the machine type of the node where your workload is scheduled.

With this feature, you can create a single StorageClass that supports clusters with mixed VM generations. For example, GKE can provision Hyperdisk on compatible instances (such as C3 or C4) while automatically falling back to Persistent Disk on other generations.

For more information, see Automated disk type selection.

Feature

The H4D machine series, designed for high performance computing (HPC) workloads, is generally available for GKE clusters. Based on 5th generation AMD EPYC Turin with Cloud RDMA 200 Gbps networking, H4D VMs offer 192 cores (SMT disabled), up to 1,488 GB of memory, and 3,750 GiB of Local SSD. H4D is optimized for tightly-coupled applications that scale across multiple nodes and offers RDMA-enabled 200 Gbps networking.

You can use H4D with GKE clusters in Standard, or with the Performance compute class in Autopilot. For more information, see Run high performance computing (HPC) workloads with H4D.

The release note for November 11, 2025 has been updated to correct the version requirements for using N4D machine types. Cluster autoscaler was incorrectly included in the list of features requiring GKE version 1.34.1-gke.2037000 or later. You can use any available GKE version to use N4D and Cluster autoscaler.

Feature

You can create a bare metal instance from the C4A machine series with the c4a-highmem-96-metal machine type. This machine type is available in Public Preview for Standard clusters running GKE version 1.35.0-gke.2232000 or later. You can select this machine type by using the --machine-type flag when creating a cluster or node pool. For more information about the requirements and limitations of this machine type, see the Requirements and limitations section of the "Arm workloads on GKE" document.

You can now determine the status and health of a TPU slice and partition by monitoring these new beta system metrics:

• kubernetes.io/accelerator/slice/state: Indicates the current status of the slice.
• kubernetes.io/accelerator/partition/state: Indicates the health of the partition.

For more information, see the GKE system metrics documentation.

Image streaming is now available in the asia-southeast3 region. For more information, see the Image streaming documentation.

Image streaming and secondary boot disks are now generally available (GA) for nodes using the Ubuntu with containerd (UBUNTU_CONTAINERD) image type. These features improve workload startup performance on GKE Standard and Autopilot clusters through image data streaming and preloaded disk data. To use these features on Ubuntu nodes, your cluster must be running GKE version 1.35.0-gke.1403000 or later.

For more information, see the documentation for Image Streaming and Using Secondary Boot Disks.

Stream Control Transmission Protocol (SCTP) support on GKE Dataplane V2 is now generally available (GA). You can now deploy workloads that use SCTP on GKE Standard clusters. This feature enables direct SCTP communication for Pod-to-Pod and Pod-to-Service traffic.

SCTP support requires clusters to use GKE Dataplane V2 and Ubuntu node images. This feature is available in GKE version 1.32.2-gke.1297000 or later.

For more information, see Deploy workloads with SCTP.

The N4A machine series is generally available for GKE clusters in Autopilot and Standard modes. For more information, see Arm workloads on GKE.

You can now determine which Kubernetes JobSets are scheduled on which GKE node pools and nodes by monitoring the new generally available system metrics:

• kubernetes.io/jobset/assigned_node_pools: GKE node pools where a Kubernetes JobSet has scheduled Pods.
• kubernetes.io/jobset/assigned_nodes: GKE nodes where a Kubernetes JobSet has scheduled Pods.
• kubernetes.io/node_pool/assigned_jobsets: Kubernetes JobSets that have scheduled Pods on a GKE node pool.
• kubernetes.io/node/assigned_jobsets: Kubernetes JobSets that have scheduled Pods on a GKE node.

The asia-southeast3 region in Bangkok, Thailand is available. For more information, see the Global Locations.

NodeLocal DNSCache is enabled by default on new Standard GKE clusters which are created running version 1.34.1-gke.3720000 or later. NodeLocal DNSCache is a GKE add-on that improves DNS performance by running a DNS cache directly on each cluster node as a DaemonSet. To learn more, see Set up NodeLocal DNSCache.

New features in 1.35

• In-place Pod Resize: In-place Pod Resize is now GA. This feature allows Pod CPU and memory requests and limits to be modified in-place without Pod or container restart.
• Writable cgroups: GKE Writable cgroups for containers is now GA. This feature allows workloads to manage resources for child processes using the Linux cgroups API, improving reliability for applications like Ray.

Rollout sequencing with custom stages is now available in Preview. This feature offers granular control over upgrading groups of clusters within a fleet, allowing you to progressively roll out GKE versions across environments. For more information see About rollout sequencing with custom stages.

GKE Autopilot now supports N4A machine types in Public Preview, available on clusters running version 1.34.1-gke.3403001 or later.

In GKE version 1.34.1-gke.2541000 and later, you can specify secure tags for firewalls in the spec.nodePoolConfig.resourceManagerTags field in ComputeClasses. GKE adds those secure tags to the nodes that GKE creates for that ComputeClass, so that you can target nodes by using these tags in firewall policies. For more information, see Selectively enforce firewall policies in GKE.