Google Distributed Cloud connected release notes

This is a patch release of Google Distributed Cloud connected (version 1.13.1). Google Distributed Cloud software updates roll out gradually across regions. The latest version might not be immediately available on your Google Distributed Cloud connected deployment.

Security mitigations for the following vulnerabilities have been implemented in this release of Google Distributed Cloud connected:

• OS layer security mitigations: CVE-2026-44973, CVE-2026-44740, CVE-2026-31431.

• GDC software-only security mitigations: All mitigations listed in the GDC software-only release notes up to version 1.34.500-gke.108 (inclusive).

• VMRuntime security mitigations: CVE-2026-7374, CVE-2026-33186, CVE-2026-27143, CVE-2025-68121, CVE-2026-39822, CVE-2026-34040, CVE-2026-28390, CVE-2026-34180, CVE-2026-32280, CVE-2026-28387, CVE-2026-42504, CVE-2026-32281, CVE-2025-6297, CVE-2026-27144, CVE-2026-42501, CVE-2026-45447, CVE-2026-40355, CVE-2026-40356, CVE-2026-28388, CVE-2025-69419, CVE-2026-0861, CVE-2026-39836, CVE-2026-33811, CVE-2026-25679, CVE-2025-61723, CVE-2026-25680.

The following Google Distributed Cloud connected components have been updated:

• GDC software-only has been updated to version 1.34.500-gke.108. (This component was formerly known as GKE on Bare Metal and as Anthos Clusters on Bare Metal.)

• Kubernetes has been updated to version 1.34.7-gke.200.

• VMRuntime has been updated to version 1.34.600-gke.4.

The following issues have been resolved in this release of Google Distributed Cloud connected:

• Virtual machine workloads no longer unexpectedly restart during GDC connected software upgrades. This was caused by live migrations of VM workloads queued on the cluster timing out prematurely.

• Virtual machine workloads using L2 networking with secondary IP addresses no longer lose network connectivity on anetd restarts. Source IP validation configurations are now properly preserved when anetd restarts.

• Access management toggle for VM workloads now works as expected. You can now enable or disable access management in your virtual machine workload configurations.

• Network resource provisioning no longer fails with an EOF error. The ClusterFabricConfig resource now reconciles properly and the relevant EdgeNetwork API calls complete successfully.

• Node-to-node connectivity metrics are now reliably collected. You can now monitor communication health and latency between nodes in your clusters.

• The angautomator component now automatically recovers when it encounters issues. The missing liveness probe for this component has been restored.

• Heterogeneous Digistor NVMe SSD configurations now function correctly. Google Distributed Cloud connected now enforces 4K LUKS sector size across all Digistor NVMe SSDs installed on a node.

• The GDC connected management plane VPN service can now resolve server addresses locally using an embedded region map. Previously, the service relied on the Kubernetes network for DNS resolution, which would cause the service to fail if the Kubernetes network was offline.

This release of Google Distributed Cloud connected contains the following known issues:

• VM workload metrics don't appear in Cloud Monitoring. This is because an invalid metrics agent configuration causes export batches to be rejected. This issue doesn't impact virtual machine availability or performance.

• Symcloud Storage volumes mounted as block devices in ROX mode remain writable. This is a bug in Symcloud Storage. To work around this issue, set the spec.volumes.readOnly field to true in the workload's configuration.

• Resource limits are not automatically applied to Robin system pods if the cluster contains worker nodes.. This doesn't impact clusters with only control plane nodes. If resource limits need to be applied to Robin system pods, contact Google Support.

• The unblock_mount operation fails on PVs with no storageClassName value set.. When the Robin agent restarts on a node, its unblock_mount operations may fail on persistent volumes whose storageClassName value is empty. To work around this issue, contact Google Support.

• After node failover, Robin services are unavailable and Robin CLI commands fail.. If a Robin master fails over to a node with a read-only file system, the newly elected robin-master pod can get stuck in its bootstrap process because it can't write to the read-only filesystem. This causes the robincrm container to never enter READY state. To work around this issue, contact Google Support.

• After upgrading GDC connected software, nodes might report inconsistent Kubernetes versions. After upgrading Google Distributed Cloud connected software on a cluster, you might encounter inconsistent Kubernetes versions being reported by the kubectl get nodes command. To work around this issue, contact Google Support.

This is a patch release of Google Distributed Cloud connected (version 1.12.2). Google Distributed Cloud software updates roll out gradually across regions. The latest version might not be immediately available on your Google Distributed Cloud connected deployment.

The following issues have been resolved in this release of Google Distributed Cloud connected:

• Virtual machine workloads no longer unexpectedly restart during GDC connected software upgrades. This was caused by live migrations of VM workloads queued on the cluster timing out prematurely.

• Virtual machine workloads using L2 networking with secondary IP addresses no longer lose network connectivity on anetd restarts. Source IP validation configurations are now properly preserved when anetd restarts.

• Access management toggle for VM workloads now works as expected. You can now enable or disable access management in your virtual machine workload configurations.

This release of Google Distributed Cloud connected contains the following known issues:

• Symcloud Storage volumes mounted as block devices in ROX mode remain writable. This is a bug in Symcloud Storage. To work around this issue, set the spec.volumes.readOnly field to true in the workload's configuration.

• Resource limits are not automatically applied to Robin system pods if the cluster contains worker nodes. This doesn't impact clusters with only control plane nodes. If resource limits need to be applied to Robin system pods, contact Google Support.

• The unblock_mount operation fails on PVs with no storageClassName value set. When the Robin agent restarts on a node, its unblock_mount operations may fail on persistent volumes whose storageClassName value is empty. To work around this issue, contact Google Support.

• After node failover, Robin services are unavailable and Robin CLI commands fail. If a Robin master fails over to a node with a read-only file system, the newly elected robin-master pod can get stuck in its bootstrap process because it can't write to the read-only filesystem. This causes the robincrm container to never enter READY state. To work around this issue, contact Google Support.

• Symcloud Storage activation can stall due to scheduling conflicts following transient pre-install job failures. The pre-installation job does not tolerate transient failures, such as containerd issues. If a job pod fails but isn't automatically deleted, existing pod affinity constraints prevent a replacement pod from being scheduled. This leaves the job incomplete and stalls the Symcloud Storage activation process. To remedy this issue, contact Google Support.

• After upgrading GDC connected software, nodes might report inconsistent Kubernetes versions. After upgrading Google Distributed Cloud connected software on a cluster, you might encounter inconsistent Kubernetes versions being reported by the kubectl get nodes command. To work around this issue, contact Google Support.

This is a patch release of Google Distributed Cloud connected (version 1.11.2). Google Distributed Cloud software updates roll out gradually across regions. The latest version might not be immediately available on your Google Distributed Cloud connected deployment.

The following issues have been resolved in this release of Google Distributed Cloud connected:

• The dataplane no longer refuses to forward traffic from secondary IPs after a cluster software upgrade. The Google Distributed Cloud connected dataplane no longer refuses to forward traffic from secondary IPs of virtual machines after the Google Distributed Cloud connected software has been upgraded, even if the affected virtual machine has the networking.gke.io/disable-source-ip-validation: "true" annotation in its configuration.

This is a minor release of Google Distributed Cloud connected (version 1.13.0). Google Distributed Cloud software updates roll out gradually across regions. The latest version might not be immediately available on your Google Distributed Cloud connected deployment.

The following new functionality has been introduced in this release of Google Distributed Cloud connected:

• New GDC connected servers G2 hardware. We are now shipping a new Google Distributed Cloud connected servers G2 hardware configuration with 48 vCPUs. For more information, see Plan the hardware configuration.

• Symcloud Storage in-transit data encryption. Symcloud Storage now encrypts data in-transit between nodes, in addition to already encrypting data at rest stored in Symcloud Storage volumes.

• Priority class support for workloads. You can now specify a runtime priority for your workloads using the PriorityClass resource. For more information, see Specify the runtime priority for a Pod.

• VM guest OS version reporting in guest environments. Google Distributed Cloud connected now reports the version of the guest operating system installed on a virtual machine when the guest environment feature is enabled. The operating system version is annotated within the corresponding virtual machine configuration resource.

The following changes to existing functionality have been introduced in this release of Google Distributed Cloud connected:

• Improved resilience to network disconnections. Google Distributed Cloud connected now auto-selects the network interface for system and control plane management after a node reboot or a power failure.

• CPU optimization for system workloads. Google Distributed Cloud connected has been optimized to more efficiently allocate CPU time for system workloads.

Security mitigations for the following vulnerabilities have been implemented in this release of Google Distributed Cloud connected:

• OS layer security mitigations: All CVEs that have been resolved up to the LTS kernel version 6.12.65 (inclusive).

• GDC software-only security mitigations: All mitigations listed in the GDC software-only release notes up to version 1.34.100-gke.93 (inclusive).

The following Google Distributed Cloud connected components have been updated:

• GDC software-only has been updated to version 1.34.100-gke.97. (This component was formerly known as GKE on Bare Metal and as Anthos Clusters on Bare Metal.)

• Kubernetes has been updated to version 1.34.1-gke.4700.

• EdgeOS kernel has been updated to version 6.12.65.

• Symcloud Storage has been updated to version 6.0.0-226.

The following issues have been resolved in this release of Google Distributed Cloud connected:

• Symcloud Storage pods no longer enter a CrashLoopBackOff state due to bootstrapping failures. The Symcloud Storage worker pods no longer intermittently restart multiple times while bootstrapping, preventing the config.ini file from being generated, which caused the pods to fail repeatedly.

• Symcloud Storage jobs no longer stall due to thread lock contention. A race condition caused by lock contention between multiple threads has been resolved. This race condition prevented Symcloud Storage jobs, such as volume attachment, detachment, creation, or deletion to stall.

• Symcloud Storage activation no longer stalls due to scheduling conflicts following transient pre-install job failures. The pre-installation job is now resilient to transient failures, such as containerd issues. Pod affinity constraints have been adjusted to allow the scheduling of a replacement pod when a job pod fails but isn't automatically deleted.

• RobinCluster status updates are no longer delayed after reconciliation. The RobinCluster status now immediately reflects a READY state after reconciliation has completed.

• Missing Network Operator metrics have been restored in Cloud Monitoring. Metrics for Network Function operators are now properly reported in Cloud Monitoring when the Google Cloud project hosting the cluster exceeds its Cloud Monitoring API ingestion quota limits.

• Healthy nodes no longer report stale or inaccurate errors. Healthy nodes no longer erroneously report read-only filesystem or containerd errors through the Kubernetes API or Cloud Monitoring.

• Symcloud Storage services no longer fail on single nodes after software upgrades. After upgrading a node to a new version of the Google Distributed Cloud connected software, the /etc/consul/client/checks.json file is no longer erroneously emptied, and the Consul services no longer encounter registration errors.

• Standby robin-master pods are no longer reported as 2/3 containers ready. This was caused by an internal error when a standby robin-master pod started up.

• VM disk image importing no longer fails with the ErrorPvcNotFound error. This was caused by a StorageProfile resource management conflict between Config Sync and the VMRuntime subsystem.

This release of Google Distributed Cloud connected contains the following known issues:

• VM workload metrics don't appear in Cloud Monitoring. This is because an invalid metrics agent configuration causes export batches to be rejected. This issue doesn't impact virtual machine availability or performance.

• Symcloud Storage volumes mounted as block devices in ROX mode remain writable. This is a bug in Symcloud Storage. To work around this issue, set the spec.volumes.readOnly field to true in the workload's configuration.

• Resource limits are not automatically applied to Robin system pods if the cluster contains worker nodes.. This doesn't impact clusters with only control plane nodes. If resource limits need to be applied to Robin system pods, contact