Google Cloud release notes

Global Front End is a unified offering that simplifies billing by consolidating pricing across networking products. Cloud Armor is included in the Global Front End Enterprise billing tier. Enabling Global Front End Enterprise in a project enables specific Cloud Armor Enterprise features for your global external Application Load Balancers. For more information, see Global Front End.This feature is available in Preview.

If you delete your project, buckets that have soft delete enabled are now retained for a limited amount of time before being permanently deleted. If you restore a deleted project during this time period, these buckets are restored to the state that they were in when the project was deleted.

For more information about soft delete and the restoration window, see Soft delete.

Connectivity Tests supports using a Cloud Run job as a source endpoint for connectivity testing.

For more information, see Test from a Cloud Run job to a destination.

Secret Manager is generally available in your Google Cloud Dedicated universe.

General Availability: You can use Private Service Connect endpoints to access global Google APIs. For more information, see About accessing Google APIs through endpoints.

Access Transparency is generally available in Google Cloud Dedicated universe.

Preview: Cloud KMS supports quantum-safe key import. You can use the following quantum-safe import methods:

• HPKE_KEM_XWING_HKDF_SHA256_AES_256_GCM
• HPKE_KEM_ML_KEM_768_HKDF_SHA256_AES_256_GCM
• HPKE_KEM_ML_KEM_1024_HKDF_SHA256_AES_256_GCM

For more information about quantum-safe key import, see Quantum-safe key import.

Cloud SQL for MySQL supports resource groups. MySQL resource groups let you manage resource allocation for different workloads on your Cloud SQL for MySQL instance. By using resource groups, you can prevent less important workloads from consuming excessive CPU or memory resources.

To use MySQL resource groups, you must have maintenance version MYSQL_VERSION.R20260320.00_20 or later installed on your instance.

For more information, see Manage CPU allocation with MySQL resource groups.

Starting on August 1, 2026, when you create or clone a Cloud SQL instance enabled with Private Service Connect, or when you enable Private Service Connect for an existing instance, then connection reconciliation behavior is enabled by default and can't be disabled.

When you remove a project from the list of allowed projects, all existing Private Service Connect connections from the removed project are immediately closed (reconciled). This means that applications using Private Service Connect endpoints in those removed projects can't continue to connect to the Cloud SQL instance using those endpoints.

For more information, see Allowed Private Service Connect projects.

Starting on August 1, 2026, when you create or clone a Cloud SQL instance enabled with Private Service Connect, or when you enable Private Service Connect for an existing instance, then connection reconciliation behavior is enabled by default and can't be disabled.

When you remove a project from the list of allowed projects, all existing Private Service Connect connections from the removed project are immediately closed (reconciled). This means that applications using Private Service Connect endpoints in those removed projects can't continue to connect to the Cloud SQL instance using those endpoints.

For more information, see Allowed Private Service Connect projects.

Starting on August 1, 2026, when you create or clone a Cloud SQL instance enabled with Private Service Connect, or when you enable Private Service Connect for an existing instance, then connection reconciliation behavior is enabled by default and can't be disabled.

When you remove a project from the list of allowed projects, all existing Private Service Connect connections from the removed project are immediately closed (reconciled). This means that applications using Private Service Connect endpoints in those removed projects can't continue to connect to the Cloud SQL instance using those endpoints.

For more information, see Allowed Private Service Connect projects.

General Availability: You can use the Resolve subnet mask setting on a subnet to configure all attached Compute Engine instances with the same netmask as the subnet (instead of /32). Configuring larger instance netmasks lets compute instances discover the MAC addresses of other machines within the same subnet and directly communicate with them by using destination MAC addresses.

For more information, see Compute instance netmasks.

Cloud SQL for MySQL now supports significantly faster re-encryption of instances and replicas protected by customer-managed encryption keys (CMEKs), and re-encryption now completes with zero downtime. The steps to re-encrypt your instances and replicas are unchanged, but the operation now re-encrypts the underlying disks in-place, without creating re-encryption backups.

For more information, see Re-encrypt an existing CMEK-enabled instance or replica.

Cloud SQL for PostgreSQL now supports significantly faster re-encryption of instances and replicas protected by customer-managed encryption keys (CMEKs), and re-encryption now completes with zero downtime. The steps to re-encrypt your instances and replicas are unchanged, but the operation now re-encrypts the underlying disks in-place, without creating re-encryption backups.

For more information, see Re-encrypt an existing CMEK-enabled instance or replica.

Generally available: A3 High machine types with 1, 2, 4, or 8 NVIDIA H100 GPUs attached. These machine types are ideal for high performance computing (HPC) and machine learning (ML) workloads such as model inference, model training and fine tuning, and simulations.

To get started, see the Accelerator-optimized machine family guide.

Object Lifecycle Management conditions for sizeAboveBytes and sizeBelowBytes let you define a minimum and maximum size threshold for lifecycle actions.

Preview: You can reserve static external IPv6 addresses from bring your own IP addresses (BYOIP) sub-prefixes that are in EXTERNAL_IPV6_FORWARDING_RULE_CREATION mode.

You can assign these addresses to forwarding rules for external passthrough Network Load Balancers and external protocol forwarding. You can also promote ephemeral IPv6 BYOIP addresses that are used by external forwarding rules to reserved static IP addresses.

For more information, see Create external forwarding rules.

Cloud KMS supports the following post-quantum computing (PQC) signing algorithms in General Availability:

• PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256
• PQ_SIGN_ML_DSA_44
• PQ_SIGN_ML_DSA_44_EXTERNAL_MU
• PQ_SIGN_ML_DSA_65
• PQ_SIGN_ML_DSA_65_EXTERNAL_MU
• PQ_SIGN_ML_DSA_87
• PQ_SIGN_ML_DSA_87_EXTERNAL_MU
• PQ_SIGN_SLH_DSA_SHA2_128S

For more information about supported algorithms, see PQC signing algorithms. For more information about PQC signing, see Post-quantum cryptography (PQC) digital signature.

Changed: The following operations on the boot disk of a Compute Engine instance that has a service account attached no longer require the iam.serviceAccounts.actAs permission. In the following list, the boot disk of such an instance is referred to as the source disk.

• Creating a standard or archive snapshot of the source disk.
• Cloning the source disk.
• Creating a machine image of the instance.
• Creating a custom image of the source disk.
• Starting asynchronous replication of the source disk to another region.
• Creating a new disk when you create an instance, if the new disk is created from an instant snapshot of the source disk.

Preview: Advanced Compute Images are available in Google Cloud Dedicated. These images provide high-performance images to support your artificial intelligence (AI), machine learning (ML), and high-performance computing (HPC) workloads on Google Cloud.

Advanced Compute Images provide a single source of trusted, performance-tuned OS images that remove the need for manual image building for specialized workloads. Each image version is pre-installed with the necessary drivers, network fabrics, and Slurm agents to help you run your workloads.

For more information, see Overview of Advanced Compute Images.

Generally available: Compute flexible committed use discounts (CUDs) are available in Google Cloud Dedicated. Compute flexible commitments are spend-based commitments that you can purchase to cover eligible spend across Compute Engine, Google Kubernetes Engine, and Cloud Run.

To purchase spend-based commitments, contact Billing support. For more information, see Billing differences in Google Cloud Dedicated.

Cloud Armor preconfigured rules support ModSecurity Core Rule Set (CRS) 4.22 as a rule source. For more information, see Tuning Google Cloud Armor WAF rules. This feature is Generally Available.

Certificate Authority Service is generally available (GA) in Google Cloud Dedicated.

In Google Cloud Dedicated, CA Service supports only software-backed keys in Cloud Key Management Service for Certificate Authorities.

For full list of differences, see CA Service differences for Google Cloud Dedicated.

You can now create and configure project-level resources for application layer inspection in Cloud NGFW, including project-level firewall endpoints, security profile groups, and security profiles. For more information, see Organization-level and project-level resources, Firewall endpoints overview, Security profile groups overview, and Security profiles overview. This feature is available in General Availability.

To restrict traffic to the managed Envoy proxies in a proxy-only subnet, you can configure global network firewall policies and regional network firewall policies to protect internal Application Load Balancers and internal proxy Network Load Balancers. For more information, see Use global network firewall policies to protect Envoy-based load balancers and Use regional network firewall policies to protect internal Application Load Balancers and internal proxy Network Load Balancers. This feature is available in General Availability.

MySQL 8.0.45 is now the default minor version for Cloud SQL for MySQL 8.0.

For more information about minor version support in Cloud SQL for MySQL, see MySQL 8.0.

Generally available: In a managed instance group (MIG), you can use a health check to monitor your application health without triggering repairs for an unhealthy VM, if the application fails the health check. You can prevent the MIG from repairing an unhealthy VM by turning off autohealing. For more information, see Turn off repairs in a MIG.

Cloud SQL now supports Private Service Connect outbound connectivity on the following additional types of instances:

• Read replica instances.

• Instances that use advanced disaster recovery features such as switchover and failover operations.

For more information about Private Service Connect outbound connectivity see About Private Service Connect.

Cloud SQL now supports Private Service Connect outbound connectivity on the following additional types of instances:

• Read replica instances.

• Instances that use advanced disaster recovery features such as switchover and failover operations.

For more information about Private Service Connect outbound connectivity see About Private Service Connect.

General Availability: You can cancel pending deletion requests for VPC Network Peering connections that are in consensus mode. For more information, see Cancel a deletion request.