Google Cloud release notes

The BigQuery slot recommender is now available in Preview. The slot recommender creates recommendations for customers using on-demand billing. These recommendations help you to understand the cost and performance tradeoffs of purchasing different amounts of slot capacity.

Dataflow now supports the following Google-provided templates in GA:

• Pub/Sub Subscription to BigQuery
• Pub/Sub Topic to BigQuery
• Pub/Sub Avro to BigQuery
• Pub/Sub Proto to BigQuery
• Pub/Sub to Pub/Sub
• Pub/Sub to Cloud Storage Avro
• Pub/Sub to Cloud Storage Text
• Cloud Storage Text to BigQuery (Stream)
• Cloud Storage Text to Pub/Sub (Stream)
• Change Data Capture to BigQuery (Stream)
• Apache Kafka to BigQuery
• BigQuery export to Parquet (via Storage API)
• Firestore to Cloud Storage Text
• Cloud Spanner to Cloud Storage Text
• Cloud Storage Text to BigQuery
• Cloud Storage Text to Firestore
• Cloud Storage Text to Pub/Sub (Batch)
• Apache Cassandra to Bigtable
• Datastream to Cloud Spanner
• File Format Conversion
• Bulk Compress Cloud Storage Files
• Bulk Decompress Cloud Storage Files
• Firestore Bulk Delete
• Streaming Data Generator to Pub/Sub, BigQuery, and Cloud Storage

Beta stage support for the following integration:

• Migrate for Compute Engine

You can now explicitly specify a schema for BigQuery external tables created over Parquet, ORC, and Avro file formats. Previously, the schema was always auto-detected using the last lexicographic file.

Database Migration Service now supports version 14 of Cloud SQL for PostgreSQL. Click here to access the documentation.

General-purpose Tau T2D virtual machine instances are available in the following regions and zones:

• Northern Virginia (us-east4-a,b,c)
• South Carolina (us-east1-b,c,d)
• Frankfurt (europe-west3-a,b,c)
• Sydney (australia-southeast1-a,b,c)
• Taiwan (asia-east1-a,b,c)

See VM instance pricing for details.

Added support for IdentityPlatformConfig resource.

Added support for ARM binaries.

Starting in GKE version 1.22, the Compute Engine persistent disk CSI driver is generally available for Windows clusters.

Read replicas are now Generally Available for Memorystore for Redis.

Anthos clusters on VMware 1.8.8-gke.1 is now available. To upgrade, see Upgrading Anthos clusters on VMware. Anthos clusters on VMware 1.8.8-gke.1 runs on Kubernetes v1.20.12-gke.1500.

The supported versions offering the latest patches and updates for security vulnerabilities, exposures, and issues impacting Anthos clusters on VMware are 1.10, 1.9, and 1.8.

GraphQL policy now supports JSON-encoded payloads.

KVM pagination support now available.

Release 1.8.9

Anthos clusters on bare metal 1.8.9 is now available for download. To upgrade, see Upgrading Anthos on bare metal. Anthos clusters on bare metal 1.8.9 runs on Kubernetes 1.20.

The Java 17 runtime for App Engine standard environment is now available in Preview.

The Ruby 3.0 runtime for App Engine standard environment is now available in Preview.

Cloud Functions has added support for the following new runtimes at the Preview release level:

• Java 17
• Ruby 3.0

Backend subsetting for internal TCP/UDP load balancers lets you scale your internal TCP/UDP load balancer to support a larger number of backend VM instances per internal backend service.

This feature is in General availability.

Generally available: Compute Engine now supports Suspend and Resume in General Availability.

You can now collect RabbitMQ logs from the Ops Agent, starting with version 2.12.0. For more information, see Monitoring third-party applications: RabbitMQ.

You can now collect WildFly metrics from the Ops Agent, starting with version 2.12.0. For more information, see Monitoring third-party applications: WildFly.

The Cloud Talent Solutions dashboard management tool has added a Jobs and Companies page, which displays job statistics and metadata. You can use this page to troubleshoot data issues. The Jobs and Companies page has three tabs:

• On the Summary tab, see the latest job count snapshots and a visualization of job count statistics over time.
• On the Job Metadata tab, search for specific jobs and their available metadata.
• On the Exports tab, export your metadata to a BigQuery table for further analysis.

For more about this new feature, see the Jobs and Companies data documentation.

The following resource types are now publicly available through the resource search API (SearchAllResources) and policy search API (SearchAllIamPolicies):

• Network Management API
  • networkmanagement.googleapis.com/ConnectivityTest

Database Migration Service now supports adding dump flags for data dump customizations to migration jobs for Cloud SQL for MySQL instances. Click here to access the documentation.

Cloud Spanner now offers committed use discounts. You can get significantly discounted prices in exchange for your commitment to use Cloud Spanner compute resources continuously for a year or longer.

In GKE version 1.23.2-gke.300 and later, you can now use network tags to dynamically apply firewall rules to nodes in your GKE Autopilot clusters and auto-provisioned GKE Standard node pools without disrupting running workloads.

The following resource types are now publicly available through the Analyze Policy APIs (AnalyzeIamPolicy and AnalyzeIamPolicyLongrunning):

• Certificate Authority Service
  • privateca.googleapis.com/CaPool
  • privateca.googleapis.com/CertificateAuthority
  • privateca.googleapis.com/CertificateRevocationList
  • privateca.googleapis.com/CertificateTemplate
• DLP
  • dlp.googleapis.com/DlpJob
  • dlp.googleapis.com/DeidentifyTemplate
  • dlp.googleapis.com/InspectTemplate
  • dlp.googleapis.com/JobTrigger
  • dlp.googleapis.com/StoredInfoType

The _type and _since parameters are available for the fhirStores.export method. You can use these parameters to filter resources from exporting. This increases the speed of the export process and eliminates unwanted export data.

Basic Tier instances now preserve data during scaling and maintenance. For a full list of operations/scenarios that cause a cache flush for the Basic Tier, see cache flush for Basic Tier.

(Available without upgrading) New version aliases for Cloud Composer images. Now you can specify the latest version of Cloud Composer 2 with composer-2-airflow-x.y aliases. New composer-1-airflow-x.y aliases point to the latest version of Cloud Composer 1.

(Airflow 2) Added a new try-number label to Airflow task log entries.

You can now see and manage the views of your Cloud Spanner databases from the Google Cloud Console. To do so, visit a database's Overview page, and then click the Views tab.

Storage Transfer Service now offers more control over preserving metadata when transferring between Cloud Storage buckets. Choose to retain or discard metadata including object ACLs, customer-managed encryption keys (CMEK), temporary holds, and object creation time. In addition, storage class can be set to any supported value, allowing you to change storage class at scale.

For details, refer to Metadata preservation.

Anthos component releases for February, 2022

Anthos clusters on VMware:

• February 07, 2022: Security bulletin
• February 10, 2022: 1.10.1 patch release
• February 11, 2022: Security bulletin
• February 14, 2022: Security bulletin
• February 17, 2022: 1.8.7 patch release
• February 23, 2022: 1.9.4 patch release
• February 24, 2022: Security bulletin

Anthos clusters on bare metal:

• February 01, 2022: 1.8.8 patch release
• February 04, 2022: Security bulletin
• February 25, 2022: 1.10.2 patch release and security bulletin
• February 28, 2022: 1.9.5 patch release

Anthos clusters on AWS:

• February 04, 2022: Security bulletin
• February 22, 2022: 1.21.6 patch release
• February 24, 2022: aws-1.10.2-gke.0 (previous generation) patch release

Anthos clusters on Azure:

• February 04, 2022: Security bulletin
• February 11, 2022: Security bulletin
• February 14, 2022: Security bulletin
• February 22, 2022: 1.21.6 patch release

Anthos Config Management:

• February 24, 2022: 1.10.2 patch release

Anthos Service Mesh:

• February 04, 2022: Managed Anthos Service Mesh patch release
• February 22, 2022: 1.10.x, 1.11.x, and 1.12.x patch release

Connect:

• February 18, 2020: General Availability (GA) release

Cloud Run for Anthos:

• February 23, 2022: release updates

Migrate for Anthos and GKE:

• N/A

Cloud Logging:

• February, 2022: release updates

Cloud Monitoring:

• February, 2022: release updates

Added Terraform support for Cloud Functions (2nd gen).

Generally available: NVIDIA® T4 GPUs are now available in the following additional regions and zones:

• Council Bluffs, Iowa, North America : us-central1-c
• Eemshaven, Netherlands, Europe : europe-west4-a

For more information about using GPUs on Compute Engine, see GPUs on Compute Engine.

Support for Firebase Remote Config and Firebase Test Lab triggers is now in Preview.

Identity Service for GKE is now generally available. You can authenticate to GKE clusters with external identity providers that use OpenID Connect (OIDC).

Exactly once delivery gives you the ability to receive any successfully published message exactly once.

For more information, see Exactly once delivery.

To support a rich query experience on complex array elements, the contains() filter function was introduced. You can use this function in your finding queries to do the following:

• Exact element matching: Match array elements that contain the exact string, "example".
• Specific number operations: Match array elements that are greater than or equal to 100.
• Complex filtering against array structures: Match array elements that contain property x with a corresponding value y.

For more information, see Filtering on array-type fields.

Vertex AI Feature Store online store autoscaling is available in Preview. The online store nodes automatically scale to balance performance and cost with different traffic patterns. The offline store already scales automatically.

You can now mount Network File System (NFS) shares to access remote files when you run a custom training job. For more information, see Mount an NFS share for custom training.

This feature is in Preview.

Google Cloud Pipeline Components SDK v1.0 is now generally available.

Session support for BigQuery is now generally available (GA). In addition to the features available in the preview, you can:

• Terminate a session automatically or manually.
• Set a label for all queries in a session.
• Get sessions metadata in INFORMATION_SCHEMA.SESSIONS_BY_* views.

You can now organize your dashboard widgets into collapsible groups. For more information, see Organize dashboard widgets.

Public Preview: You can set the maximum amount of time that Compute Engine waits before terminating or restarting an unresponsive VM. For more information, see Set VM availability policies.

Added support for BillingBudgetsBudget resource.

Added support for EventarcTrigger resource.

Added support for LoggingLogView resource.

Added field spec.rule[].rateLimitOptions into ComputeSecurityPolicy resource.

Added fields spec.addonsConfig.gcpFilestoreCsiDriverConfig and spec.clusterAutoscaling.autoProvisioningDefaults.imageType into ContainerCluster resource.

Added fields spec.maintenancePolicy and spec.maintenanceSchedule into RedisInstance resource.

Added fields spec.transferSpec.awsS3DataSource.roleArn, spec.transferSpec.posixDataSink and spec.transferSpec.posixDataSource into StorageTransferJob resource.

Added field status.selfLink into NetworkServicesGateway,NetworkServicesGRPCRoute, NetworkServicesHTTPRoute, NetworkServicesMesh and NetworkServicesTCPRoute resources.

You can now use the Apache Beam SDK for Go to create batch Dataflow pipelines. This feature is in Preview.

Anthos clusters on VMware 1.10.2-gke.34 is now available. To upgrade, see Upgrading Anthos clusters on VMware. Anthos clusters on VMware 1.10.2-gke.34 runs on Kubernetes 1.21.5-gke.1200.

The supported versions offering the latest patches and updates for security vulnerabilities, exposures, and issues impacting Anthos clusters on VMware are 1.10, 1.9, and 1.8.

HTTP request transforms are now available for use with configurable API proxies.

With HTTP request transforms, configurable API proxy developers can quickly rewrite HTTP request paths, header, and query parameters using HTTP Request Transforms. Rewriting is enabled using a simple configuration that can reference incoming path template segments, header values, or query parameter values.

For more information, see HTTP request transforms for configurable proxies.

Google authentication for securing targets is now supported when using configurable API proxies.

With this feature, configurable API proxy developers can secure their Google backend services using Google OAuth and automatically grant access to authorized API consumers. This offers the advantage of seamless integration with other Google services, without requiring API producers to manage private keys.

For more information, see Securing targets for configurable proxies.

Southbound mTLS can be enabled for use with configurable API proxies .

By adding south bound mTLS functionality to configurable proxies, Apigee customers can seamlessly maintain their current usage of mTLS when transitioning to the use of configurable proxies, or increase security for communications between existing configurable proxies and their backends.

For more information, see Enable south bound mTLS for configurable proxies.

Configurable API proxies now support the use of template variables.

Apigee property sets can be used to specify template variables for configurable API proxies in archive deployments. This feature enables customers to use string templates in their proxy configuration YAML files.

For more information, see Template variables for configurable proxies.

You can now use a combination of zonal NEGs (of type GCE_VM_IP_PORT) and hybrid NEGs (of type NON_GCP_PRIVATE_IP_PORT) as backends for your global external HTTP(S) load balancers. For all supported backend combinations, see the table at Backend services.

You can now view aggregated Cloud Spanner statistics related to transactions, reads, queries, and lock contentions in Cloud Monitoring. Additionally, the retention period for these metrics at one-minute intervals has been increased from six hours to six weeks.

You can now use deny policies to prevent principals from using certain permissions, regardless of the roles they're granted. This feature is in Preview.

Add a feature that supports adding node selectors for Kf Builds to isolate Kf Build pods in specific node pool.

Storage Transfer Service now supports Cloud Client Libraries, which are the recommended option for accessing Cloud APIs programmatically. This launch significantly reduces the amount of code you need to write; see Getting started and Migrating to the Cloud Client Library for more details.

Anthos Service Mesh now supports certificate templates with the Certificate Authority Service integration. See Install default features and CA Service for more information.

You can now configure automatic exports of Security Command Center findings to a BigQuery dataset. For more information, see Export findings to BigQuery for analysis.

The vulnerability.cve.upstreamFixAvailable attribute was added to the Finding object. This is a boolean field that specifies whether a Common Vulnerabilities and Exposures (CVE) fix is available. For more information, see the API documentation for the Finding object.

Cloud Composer 2 supports Customer Managed Encryption Keys (CMEK).

Java Client for Cloud Composer version 1.1.3 is released. You can use this library to interact with Cloud Composer API from Java.

A new multi-region instance configuration is now available in North America - nam13 (Iowa/Oklahoma/Salt Lake City).

Released Query Optimizer version 4. Version 3 remains the default optimizer version in production.

gRPC endpoint protocol is available in Preview.

Release 1.9.5

Anthos clusters on bare metal 1.9.5 is now available for download. To upgrade, see Upgrading Anthos on bare metal. Anthos clusters on bare metal 1.9.5 runs on Kubernetes 1.21.

The following resource types are now publicly available through the Export APIs (ExportAssets and BatchGetAssetsHistory) and the Feed API:

• Firestore
  • firestore.googleapis.com/Database

Cloud HSM resources are now available in the following regions:

• asia1
• eur3
• eur4
• nam3
• nam4
• nam6
• nam9

For information about which locations are supported by Cloud KMS, Cloud HSM, and Cloud EKM, see Cloud KMS locations.

Cloud SQL for MySQL 8.0.26 is now the default minor version. To upgrade your existing instance to the new version, see Set the MySQL minor version.

M90 Release

• CUDA has been upgraded from 11.3.0 to 11.3.1 to address some NCCL issues.
• VSlim GPU TensorFlow containers are available and have a significantly smaller size.
• TensorFlow 2.7 containers are re-released.

M90 Release

• Vertex AI sample notebooks are now included in the /usr/share/tutorials folder.
• Instances now allow the Jupyter options for disabling terminals and deleting files instead of sending them to the trash or recycling bin.

Eventarc triggers for Workflows is now available in Preview.

Deploying your application to Anthos user clusters is now supported in preview.

Eventarc triggers for Workflows is now available in Preview.

Release 1.10.2

Anthos clusters on bare metal 1.10.2 is now available for download. To upgrade, see Upgrade Anthos on bare metal. Anthos clusters on bare metal 1.10.2 runs on Kubernetes 1.21.

Cloud Data Fusion version 6.6.0 is in Preview. This release is in parallel with the CDAP 6.6.0 release .

Features in 6.6.0:

• Cluster reuse is generally available (GA).
• Predefined autoscaling is available in Preview.
• Cloud Data Fusion flow control prevents you from submitting too many requests, which can cause stuck or failed pipeline runs. It applies to API and scheduled pipeline launch requests for batch and real-time pipelines and replication jobs. It is available in Preview.

Cloud Run now supports using less than one CPU. Refer to CPU limits for details. (Available in public preview.)

The constraint template library includes new templates: K8sPSPAutomountServiceAccountTokenPod, RestrictNetworkExclusions, and K8sDisallowAnonymous.

The following resource types are now publicly available through the Export APIs (ExportAssets and BatchGetAssetsHistory), the Feed API, and the Search APIs (SearchAllResources and SearchAllIamPolicies):

• Cloud Healthcare API
  • healthcare.googleapis.com/ConsentStore
  • healthcare.googleapis.com/Dataset
  • healthcare.googleapis.com/DicomStore
  • healthcare.googleapis.com/FhirStore
  • healthcare.googleapis.com/Hl7V2Store

The restrict authentication types organizational constraint is now in Preview. * The constraint allows you to restrict the authentication types that can be used in requests for Cloud Storage resources.

Security Command Center can automatically send findings, assets, and security sources to the following SIEM and SOAR platforms:

• Cortex XSOAR—see Sending Security Command Center data to Cortex XSOAR.
• Elastic Stack—see Sending assets and findings to Elastic Stack and Exporting assets and findings with Docker and Elastic Stack.
• IBM QRadar—see Sending Security Command Center data to IBM QRadar.

Anthos clusters on VMware 1.9.4-gke.3 is now available. To upgrade, see Upgrading Anthos clusters on VMware. Anthos clusters on VMware 1.9.4-gke.3 runs on Kubernetes v1.21.5-gke.1200.

The supported versions offering the latest patches and updates for security vulnerabilities, exposures, and issues impacting Anthos clusters on VMware are 1.10, 1.9, and 1.8.

The following resource types are now publicly available through the resource search API (SearchAllResources) and policy search API (SearchAllIamPolicies):

• Vertex AI
  • aiplatform.googleapis.com/PipelineJob

If your primary instance uses a private IP address, you can now select an allocated IP range for clones and replicas created from the instance.

If your primary instance uses a private IP address, you can now select an allocated IP range for clones and replicas created from the instance.

If your primary instance uses a private IP address, you can now select an allocated IP range for clones and replicas created from the instance.

Public preview: Public tags that provide less strict access control as compared to private tags for searching and viewing tags is rolled out to all Data Catalog regions with minimal disruption and in a controlled way. Public tags support simple search and search with predicates while private tags support only search with predicates.

Networking Connectivity Center now supports the use of a third-party network virtual appliance in any Google Cloud region for the following use cases:

• Providing site-to-cloud connectivity
• Providing connectivity or managing traffic between VPC networks

A third-party network virtual appliance could be an SD-WAN router, a firewall appliance, a load balancer, or another appliance, as long as it uses BGP. After you create a Network Connectivity Center spoke to represent your router appliance instance, it can exchange routes dynamically with Cloud Router.

To view a list of partners whose solutions are integrated with Network Connectivity Center, see Network Connectivity Center partners.

For more information about Network Connectivity Center, see the product overview.

The following accessibility improvements have been made in the Apigee UI:

• In the Develop > API Proxies view, the screen reader now reads "Create new proxy" for the Create New button
• In the Traffic column of the API Proxies view, the screen reader now reads the traffic tooltip text, and the tooltip has been removed.
• In the Last Modified column, the screen reader now reads a message like "5 months ago on Sep 17, 2021 6:21 PM," and the tooltip has been removed.
• Hovering the mouse in the Action column now displays a menu showing the Delete item, to make it accessible.

Zonal Cloud DNS zones are now available in Preview.

You can create private DNS zones that are scoped only to a Google Cloud zone.

You can now stream and export FHIR resources to BigQuery using the FHIR analytics schema with support for repeated extension columns and contained resources as JSON strings.

You can now collect Apache CouchDB logs from the Ops Agent, starting with version 2.11.0. For more information, see Monitoring third-party applications: CouchDB.

You can now collect Apache Hadoop logs and metrics from the Ops Agent, starting with version 2.11.0. For more information, see Monitoring third-party applications: Hadoop.

You can now collect Apache HBase logs and metrics from the Ops Agent, starting with version 2.11.0. For more information, see Monitoring third-party applications: HBase.

You can now collect Apache ZooKeeper logs from the Ops Agent, starting with version 2.11.0. For more information, see Monitoring third-party applications: ZooKeeper.

You can now collect WildFly logs from the Ops Agent, starting with version 2.11.0. For more information, see Monitoring third-party applications: WildFly.

You can now collect Apache ActiveMQ metrics from the Ops Agent, starting with version 2.11.0. For more information, see Monitoring third-party applications: ActiveMQ.

You can now collect Apache Hadoop metrics and logs from the Ops Agent, starting with version 2.11.0. For more information, see Monitoring third-party applications: Hadoop.

You can now collect Apache HBase metrics and logs from the Ops Agent, starting with version 2.11.0. For more information, see Monitoring third-party applications: HBase.

You can now collect MongoDB metrics from the Ops Agent, starting with version 2.11.0. For more information, see Monitoring third-party applications: MongoDB.

You can now collect RabbitMQ metrics from the Ops Agent, starting with version 2.11.0. For more information, see Monitoring third-party applications: RabbitMQ.

Support for applying a path pattern when filtering is now available in Preview.

GKE Gateway traffic management is now in Preview for GKE 1.22 and later version clusters. You can now autoscale Pods or dynamically shift traffic between clusters based on Service traffic capacity.

MITRE ATT&CK framework details related to findings are now available as finding attributes for all Security Command Center services. The framework explains tactics and techniques for attacks against cloud resources, and provides remediation guidance. Although these attributes are available across all built-in and integrated services, only Container Threat Detection and Event Threat Detection are populating them at this time. For more information, see the API documentation for the Findings object.

Network Load Balancing introduces a new monitoring resource type loadbalancing.googleapis.com/ExternalNetworkLoadBalancerRule that lets you monitor all the supported protocols including TCP, UDP, ESP, and ICMP.

For details, see Monitoring Network Load Balancing.

This feature is available in General Availability.

The organization policy for integrations with services such as GitHub is now generally available. Users can now apply the policy to control triggered builds from external services, such as GitHub. To learn more, see Limiting builds triggered from external services.

VPC Service Controls support for Cloud Build is now generally available. For instructions on using this feature, see Using VPC Service Controls.

Added support for PrivateCACertificateAuthority resource

Added support for Enhanced Flexibility Mode (EFM) with primary worker shuffle mode on Spark for image version 2.0.

Checking for the existence of a key in a list is supported.

Anthos clusters on VMware 1.8.7-gke.0 is now available. To upgrade, see Upgrading Anthos clusters on VMware. Anthos clusters on VMware 1.8.7-gke.0 runs on Kubernetes v1.20.12-gke.1500.

The supported versions offering the latest patches and updates for security vulnerabilities, exposures, and issues impacting Anthos clusters on VMware are 1.10, 1.9, and 1.8.

The following resource types are now publicly available through the resource search API (SearchAllResources) and policy search API (SearchAllIamPolicies):

• Vertex AI
  • aiplatform.googleapis.com/MetadataStore
  • aiplatform.googleapis.com/ModelDeploymentMonitoringJob

DAG UI is available in Preview.

(Cloud Composer 2) Tasks that take less than 25 minutes to execute are not impacted by maintenance operations. Cloud Composer waits until such tasks are finished before the maintenance operation starts.

Dynamic port allocation for Cloud NAT is available in General Availability.

Cloud SQL now supports the use of tags on instances. Tags are key-value pairs you can apply to your resources, such as a project or a Cloud SQL instance, which are used for fine-grained access control. To learn more, see Access control with Google Cloud tags. To use tags now, see Attach and manage tags on Cloud SQL instances.

Cloud SQL now supports the use of tags on instances. Tags are key-value pairs you can apply to your resources, such as a project or a Cloud SQL instance, which are used for fine-grained access control. To learn more, see Access control with Google Cloud tags. To use tags now, see Attach and manage tags on Cloud SQL instances.

Cloud SQL now supports the use of tags on instances. Tags are key-value pairs you can apply to your resources, such as a project or a Cloud SQL instance, which are used for fine-grained access control. To learn more, see Access control with Google Cloud tags. To use tags now, see Attach and manage tags on Cloud SQL instances.

Dataplex Explore is available in Preview. Explore provides a fully-managed, serverless data exploration experience that enables you to query your data using Apache SparkSQL queries and Jupyter notebooks.

Remote functions are now available for preview. Remote functions allow you to implement your function in other languages than SQL and Javascript, or with libraries or services which are not allowed in BigQuery user-defined functions.

Dynamic compression allows Cloud CDN to automatically compress responses as they are being served between the origin and the client. The size of the data sent over the network is reduced by 60% to 85% in typical cases. This feature is supported in Preview.

Cloud Functions has added support for low-configuration access to private dependencies on Artifact Registry in in Node.js and Python.

Profiling Dataflow pipelines with Cloud Profiler is generally available (GA). Use Dataflow integration with Cloud Profiler to monitor pipeline performance.

You can now use a pre-built container to perform custom training with TensorFlow 2.8.

Runtime version 2.8 is available. You can use runtime version 2.8 to train with TensorFlow 2.8, scikit-learn 1.0.2, or XGBoost 1.5.2. Runtime version 2.8 supports training with CPUs, GPUs, or TPUs.

See the full list of updated dependencies in runtime version 2.8.

New Overview Tab in Proxy Editor

We have released a new version of the Overview tab in the Proxy Editor. See Introducing the new Proxy Editor.

Note: The new features in this release will be rolled out over the next week, so you might not be able to view them until the rollout is complete.

The UI now shows a warning when an API Product is in legacy format, stating that some of the displayed fields might be legacy fields.

Backend target routing with Private Service Connect

You can now use Private Service Connect (PSC) to connect Apigee with backend target services running in VPC networks other than the one that is peered with your Apigee organization. For details, see Southbound networking patterns.

Node.js apps now support private dependencies hosted on an Artifact Registry Node.js package repository. To include private dependencies, list the Artifact Registry repository and configure settings for authenticating with the registry in your .npmrc file.

Python 3 apps now support private dependencies hosted on an Artifact Registry Python registry. To include private dependencies, add the Artifact Registry URL and the relevant packages in your requirements.txt file.

On-Demand Scanning for Go packages is now generally available.

You can scan your container images and identify Go package vulnerabilities.

The table clones feature in BigQuery is now in Preview. A table clone is a lightweight, writable copy of a table. You are only charged for storing the data in a table clone that differs from its base table.

DeleteSubject

The DeleteSubject method has been added to the Chronicle Role-Based Access Control (RBAC) API. DeleteSubject enables you to remove user and group role assignments.

Internal TCP/UDP Load Balancing now supports source-IP address session affinity (CLIENT_IP_NO_DESTINATION) in Public Preview.

Data Catalog now supports cataloguing and searching data entries from Dataplex lakes, zones, tables, and filesets. For more information, see the Dataplex documentation and Data Catalog documentation.

Service Directory integration with Traffic Director is available in Preview .

After you register a service with Service Directory, the integration makes services in the service registry available to the applications in your mesh and to gateways configured by Traffic Director. Your service mesh and self- managed gateways can then send traffic to these services

Traffic Director is now integrated with Service Directory. After you register a service with Service Directory, the integration makes services in the service registry available to the applications in your mesh and to gateways configured by Traffic Director. Your service mesh and self- managed gateways can then send traffic to these services.

The INFORMATION_SCHEMA.STREAMING_TIMELINE_* views are now generally available (GA).

The QUALIFY clause, which lets you filter the results of analytic functions in Google Standard SQL, is now generally available (GA).

This release adds filters to ListCustomers. You can use these filters to exclude selected customers from search results. For more information, visit our article about these new filters.

Support for configuring triggers to use a particular service account is now generally available. To learn more, see Configuring user-specified service accounts.

Cloud Functions has released Cloud Functions (2nd gen), available at the Preview release level. Cloud Functions (2nd gen) is Google Cloud's next-generation Functions-as-a-Service offering. This new version of Cloud Functions comes with an advanced feature set, giving you more powerful infrastructure, advanced control over performance and scalability, more control around the functions runtime, and triggers from over 90 event sources.

See the Cloud Functions (2nd gen) documentation for details.

You can now configure default storage regions and disabled _Default sinks for your Google Cloud organizations and all of their new projects and folders. For details, see Configure default resource settings for Logging.

You can now collect Apache Solr metrics and logs from the Ops Agent, starting with version 2.10.0. For more information, see Monitoring third-party applications: Solr.

You can now collect Apache Kafka metrics and logs from the Ops Agent, starting with version 2.10.0. For more information, see Monitoring third-party applications: Kafka.

You can now collect MongoDB logs from the Ops Agent, starting with version 2.10.0. For more information, see Collect logs from third-party applications: MongoDB.

You can now collect Apache Solr metrics and logs from the Ops Agent, starting with version 2.10.0. For more information, see Monitoring third-party applications: Solr.

You can now collect Apache Kafka metrics and logs from the Ops Agent, starting with version 2.10.0. For more information, see Monitoring third-party applications: Kafka.

You can now collect Apache CouchDB metrics from the Ops Agent, starting with version 2.10.0. For more information, see Monitoring third-party applications: CouchDB.

You can now collect Apache ZooKeeper metrics from the Ops Agent, starting with version 2.10.0. For more information, see Monitoring third-party applications: ZooKeeper.

You can now collect Elasticsearch metrics from the Ops Agent, starting with version 2.10.0. For more information, see Monitoring third-party applications: Elasticsearch.

Added support for enabling read replicas (preview) on existing instances. For more information, see Behavior of enabling read replicas on an existing instance. Also added the capability to perform version upgrade and manual failover operations on instances that use read replicas.

Cloud Spanner now optimizes the way it processes groups of similar statements in DML batches, significantly improving the speed at which it performs batched data writes under certain conditions.

Added support for ComputeFirewallPolicyAssociation resource.

Added support in IAMPartialPolicy and IAMPolicy to cover Organization and BillingAccount resources.

Config Controller is now supported in region us-east1.

Anthos clusters on VMware 1.10.1-gke.19 is now available. To upgrade, see Upgrading Anthos clusters on VMware. Anthos clusters on VMware 1.10.1-gke.19 runs on Kubernetes v1.21.5-gke.1200.

The supported versions offering the latest patches and updates for security vulnerabilities, exposures, and issues impacting Anthos clusters on VMware are 1.10, 1.9, and 1.8.

BigQuery Omni now supports INFORMATION_SCHEMA.JOBS_* and INFORMATION_SCHEMA.RESERVATION* views. This feature is in Preview. For more information, see View resource metadata (AWS) and View resource metadata (Azure).

Your regional preferences, including date and time formatting, are now supported in the Logs Explorer.

Generally available: Compute-optimized C2D machine types are now generally available. C2D machine types are built on top of third generation AMD EPYC Milan processors and are a great fit for high-performance computing (HPC) workloads. For more information, see Compute-optimized machine family.

Access-related details are now available as finding attributes for all Security Command Center services. These attributes relate to an access event associated with a finding. They contain details such as the caller's IP address, which service and method was called, and what region the access event occurred in. Although access-related attributes are available across all built-in and integrated services, they're only populated by Event Threat Detection at this time. For more information, see the API documentation for the Findings object.

Compute Engine resource names, alongside their corresponding resource IDs, are now supported in the Logs Explorer. For details, see View Compute Engine logs.

Public Preview: You can now use the security keys registered for 2-Step Verification in your Google account to connect to VMs that use OS Login. For more information, see Enable security keys with OS Login.

Network Load Balancing now supports load-balancing ESP (Encapsulating Security Payload) and ICMP (Internet Control Message Protocol) traffic. To handle these protocols, you specify the new L3_DEFAULT protocol on the load balancer's forwarding rule.

For details, see:

• Forwarding rule protocols for backend service-based network load balancers
• Setting up Network Load Balancing for multiple protocols

This feature is available in General Availability.

External TCP/UDP Network Load Balancing now allows you to configure a connection tracking policy. A connection tracking policy introduces the following new properties to let you customize your load balancer's connection tracking behavior:

• Tracking mode
• Connection persistence on unhealthy backends

To learn about how connection tracking works, see Backend selection and connection tracking.

To learn how to configure a connection tracking policy, see Configure a connection tracking policy.

This feature is available in General Availability.

Network Load Balancing introduces a new monitoring resource type loadbalancing.googleapis.com/ExternalNetworkLoadBalancerRule that lets you monitor all the supported protocols including TCP, UDP, ESP, and ICMP.

For details, see Monitoring Network Load Balancing.

This feature is available in Preview.

You can now view information about your user-defined metrics by using the Diagnostics tab located on the Metrics Explorer page. The Diagnostics tab displays summary information about the user-defined metrics your project injests, charts usage metrics, lists all user-defined metrics. You can use features on this page to create alerts, view audit logs, and get detailed information about individual metrics. For more information, see View metric diagnostics.

Cloud SQL supports the max_parallel_maintenance_workers, max_parallel_workers,
max_parallel_workers_per_gather, and max_pred_locks_per_transaction flags:

• max_parallel_maintenance_workers sets the maximum number of parallel workers that can be started by a single utility command.
• max_parallel_workers sets the maximum number of workers that the system can support for parallel operations.
• max_parallel_workers_per_gather sets the maximum number of workers that can be started by a single Gather or Gather Merge node.
• max_pred_locks_per_transaction controls the average number of object locks allocated for each transaction.

For more information, see Supported flags.

Cross-region replication is now generally available in Cloud SQL for SQL Server.

You can use replication to scale the use of data in a database without degrading performance. Other reasons include migrating or maintaining data duplicates between regions.

For more information, see Replication in Cloud SQL.

Query statistics now cover DML statements, including inserts, updates, and deletes.

Added support for upgrading the Redis version of an instance to any higher version.

Support for agent pools is now generally available (GA) .

You can use agent pools to create isolated groups of agents as a source or sink entity in a transfer job. This enables you to transfer data from multiple data centers and filesystems concurrently, without creating multiple projects for a large transfer spanning multiple filesystems and data centers.

Cloud Build's Bitbucket Server and Bitbucket Data Center integration is now generally available. Users can build repositories from Bitbucket Server and Bitbucket Data Center, including on-premises instances. For more information, see Building repositories from Bitbucket Server and Building repositories from Bitbucket Data Center.

Airflow 2.2.3 is available in Cloud Composer images.

Using the new Integrations page in the Google Cloud Console, you can now configure third-party application integrations that the Ops Agent supports. The Integrations page provides links to install instructions, displays example dashboards, and lists the metrics and logs that the Ops Agent collects for each integration. For more information, see Manage integrations

Bidirectional Forwarding Detection (BFD) for Cloud Router is Generally Available (GA).

Cloud SQL supports the wal_receiver_timeout and wal_sender_timeout flags:

• The wal_receiver_timeout flag ends replication connections that are inactive for the specified time.
• The wal_sender_timeout flag, which is for detection by the ending server, ends replication connections that are inactive for the specified time.

For more information, see Supported flags.

SQL Server 2019 is now the default version. See Database versions and version policies.

Cloud Spanner's CPU Utilization metrics now provide grouping by all task priorities: low, medium, and high.

Relatedly, Cloud Spanner's monitoring console now lets you view the CPU utilization of your instance by operation type, filtered by task priority.

Added cluster_type field to job and operation metrics in Cloud Monitoring.

Google Cloud Armor Rate Limiting is now in General Availability.

Security Health Analytics, a built-in service of Security Command Center, released the OPEN_GROUP_IAM_MEMBER detector to General Availability.

Using the fleet feature API to set up managed Anthos Service Mesh with automatic control plane management is now available as a preview feature in the rapid, regular, and stable release channels. For more information, see Configure managed Anthos Service Mesh with fleet API.

The following PostgreSQL minor versions and extension versions are now available. If you use maintenance windows, you might not yet have these versions. In this case, you will see the new versions after your maintenance update occurs. To find your maintenance window or manage maintenance updates, see Finding and setting maintenance windows.

• 14.0 is upgraded to 14.1.
• 13.4 is upgraded to 13.5.
• 12.8 is upgraded to 12.9.
• 11.13 is upgraded to 11.14.
• 10.18 is upgraded to 10.19.
• 9.6.23 is upgraded to 9.6.24.

Additionally, the following extensions have been upgraded. For more information about these and other extensions, see PostgreSQL extensions.

• The pglogical extension is upgraded to 2.4.1.

• The pgaudit extension is upgraded as follows:

  • For PostgreSQL 14, upgraded to 1.6.1.
  • For PostgreSQL 13, upgraded to 1.5.1.
  • For PostgreSQL 12, upgraded to 1.4.2.
  • For PostgreSQL 11, upgraded to 1.3.3.
  • For PostgreSQL 10, upgraded to 1.2.3.
  • For PostgreSQL 9.6, upgraded to 1.1.4.

Generally available: Support for the Intel Ice Lake processor on general purpose N2 VMs has reached general availablity.

Generally available: The n2-node-128-864 sole-tenant node type.

Traffic Director new service routing APIs are available in preview. The new APIs simplify routing and service mesh configuration with new Mesh, Gateway, and Route resources.

Related to this change, new options are available for automated Envoy deployment.

The BigQuery migration assessment is now available in Preview. Use this feature to assess the complexity of migrating from your current data warehouse to BigQuery.

BigQuery ML Hyperparameter tuning is now generally available (GA). You can use this feature to improve model performance by searching for the optimal hyperparameters when training ML models using CREATE MODEL statements.

To learn more, check out the following topics:

• BigQuery ML Hyperparameter Tuning Overview
• Using the BigQuery ML Hyperparameter Tuning to improve model performance
• End-to-end user journey for each model

You can now save a copy of a chart on a predefined dashboard to one of your custom dashboards by selecting Add to Custom Dashboard from the More Options menu on the chart. When you select a custom dashboard, you also have the option of renaming the copied chart.

In the Data Catalog table details page, there is now an additional section called Schema and column tags that lets you view the applied schema and their values. For more information, see View table details.

Pub/Sub Lite now supports regional Lite topics that replicate data to a secondary zone.

Secret manager now supports data checksums when adding or accessing a secret version.

Anthos component releases for January, 2022

Anthos clusters on VMware:

• Jan 24, 2022: 1.9.3 and 1.8.6 patch releases

Anthos clusters on bare metal:

• Jan 27, 2022: 1.9.4 and 1.10.1 patch releases
• Feb 01, 2022: 1.8.8 patch release

Anthos clusters on AWS:

• Jan 27, 2022: aws-1.10.1-gke.0 (previous generation) patch release

Anthos Config Management:

• Jan 27, 2022: 1.10.1 patch release

Anthos Service Mesh:

• Jan 19, 2022: Managed Anthos Service Mesh patch release
• Jan 20, 2022: 1.10.6 and 1.12.2 patch releases

Connect:

• N/A

Cloud Run for Anthos:

• N/A

Migrate for Anthos and GKE:

• Jan 11, 2022: patch release

Cloud Logging:

• Jan 2022 release updates

Cloud Monitoring:

• Jan 2022 release updates

The Apigee provisioning wizard can now auto-allocate /22 and /28 IP address ranges, instead of the larger /21 range

This feature makes it easier to allocate IP address ranges when you are provisioning Apigee. The feature is an enhancement to the IP range feature released on Jan. 24, 2022.

The WITH RECURSIVE feature has been added to Google Standard SQL for BigQuery and is now in Preview. This feature allows a query in a WITH clause to refer to either itself or to queries defined later in the WITH clause.

The following resource types are now publicly available through the Export APIs (ExportAssets and BatchGetAssetsHistory) and the Feed API:

• Google Kubernetes Engine
  • apps.k8s.io/Deployment
• Cloud Billing
  • cloudbilling.googleapis.com/ProjectBillingInfo

The following resource types are now publicly available through the resource search API (SearchAllResources) and policy search API (SearchAllIamPolicies):

• Cloud Billing
  • cloudbilling.googleapis.com/ProjectBillingInfo

Cloud Debugger now has Preview support for VPC Service Controls.

M89 release

• TensorFlow Enterprise 2.8 is now available and includes Long Term Version Support. TensorFlow Enterprise 2.8 is available in both Deep Learning Containers and Deep Learning VM Images.
• Upgraded TensorFlow Enterprise 2.6.2 to 2.6.3.

M89 release

• TensorFlow Enterprise 2.8 is now available and includes Long Term Version Support. TensorFlow Enterprise 2.8 is available in both Deep Learning VM Images and Deep Learning Containers.
• Upgraded TensorFlow Enterprise 2.6.2 to 2.6.3.

Event Threat Detection, a built-in service of Security Command Center, launched the Exfiltration: BigQuery Data to Google Drive rule to Preview. This rule detects events where the protected organization's BigQuery data is saved, through extraction operations, to a Google Drive folder. For more information, see Event Threat Detection rules.

TensorFlow Enterprise 2.8 is now available and includes Long Term Version Support.

Release 1.8.8

Anthos clusters on bare metal 1.8.8 is now available for download. To upgrade, see Upgrading Anthos on bare metal. Anthos clusters on bare metal 1.8.8 runs on Kubernetes 1.20.

You can now view SLOs on a custom dashboard. For more information, see Display SLOs on a dashboard.

Query Insights lets you configure the query sampling rate. For information, see Using Query Insights to improve query performance.

Enabled the Resource Manager UI and HA capable UIs in HA cluster mode.

Added buildTimeout configuration feature.

Added v1 gcloud commands.

Added a guide on how to concatenate multiple input videos into a single output video.

Added a guide on how to include captions and subtitles in an output video.

General availability for the following integrations:

• Cloud TPU

Preview support for the following integration:

• Cloud Debugger

BigQuery now supports materialized views without aggregation and materialized views with inner join. This feature is generally available (GA).

The SAP OData plugin is generally available (GA). You can use SAP as a source for batch-based data extraction in Cloud Data Fusion using the Open Data Protocol (OData). This plugin is available in any Cloud Data Fusion edition, version 6.4.0 and later.

You can now use Cloud EKM with a Virtual Private Network (preview). This means you can access your external key manager with a private endpoint.

See Using Cloud EKM with VPC to learn more.

The Key Access Justifications (KAJ) feature is now generally available in Cloud SQL. You can use KAJ as part of Cloud External Key Manager (EKM). KAJ enables you to view the reason for each Cloud EKM request. Additionally, based on the justification provided, you can automatically approve or deny a request. For related information, see the Overview.

The Key Access Justifications (KAJ) feature is now generally available in Cloud SQL. You can use KAJ as part of Cloud External Key Manager (EKM). KAJ enables you to view the reason for each Cloud EKM request. Additionally, based on the justification provided, you can automatically approve or deny a request. For related information, see the Overview.

The Key Access Justifications (KAJ) feature is now generally available in Cloud SQL. You can use KAJ as part of Cloud External Key Manager (EKM). KAJ enables you to view the reason for each Cloud EKM request. Additionally, based on the justification provided, you can automatically approve or deny a request. For related information, see the Overview.

In GKE, you can now filter Pub/Sub cluster notifications by notification type. For more information, see Receive cluster notifications.

When creating a maintenance exclusion window, you can restrict the exclusion to specify types of maintenance. For example, during a specific time period you can exclude minor upgrades from occurring on your cluster. For more information, see Maintenance exclusions documentation.

Virtual Machine Threat Detection, a built-in service of Security Command Center Premium, is in Preview. During the Preview, VM Threat Detection detects cryptocurrency mining software, which is among the most common types of software installed in compromised cloud environments.

For more information, see Virtual Machine Threat Detection conceptual overview.

Web Security Scanner, a built-in service of Security Command Center, released the CACHEABLE_PASSWORD_INPUT and SESSION_ID_LEAK finding types.

For more information, see Web Security Scanner findings.

Web Security Scanner, a built-in service of Security Command Center, provides detectors for the OWASP Top 10 2017 and OWASP Top 10 2021. For more information, see Detectors and Compliance.

The Anthos Service Mesh dashboard in the Cloud Console now supports cross-project clusters, Anthos on GKE-on-vSphere (on-prem), and Anthos on Bare Metal. For more information, see Observability overview.

UI updates for service networking and instance creation

UI updates were made to support changes to network IP CIDR range requirements for service networking and instance creation. These changes simplify Apigee provisioning.

Cloud CDN support for custom named cookies and headers in the cache key are Generally Available. You can use these features for A/B (multivariate) testing, canary testing, and similar scenarios. Allowlisting of query parameters is now also enabled for backend buckets, to allow for cache busting.

For details, see the caching documentation.

The Healthcare Natural Language API now uses Vertex AI to extract medical insights from medical text. A new model is now used for healthcare-specific entity extraction.

Cloud EKM now supports Cloud Run, Dataproc, and Vertex AI. For more information, see Cloud External Key Manager.

Cloud Translation - Advanced (v3) support for a regional EU endpoint is now generally available (GA).

Beta stage support for the following integration:

• Cloud Monitoring

Workflows is now available in the following regions:

• europe-west1 (Belgium)
• europe-west6 (Zurich)
• us-east1 (South Carolina)

Release 1.9.4

Anthos clusters on bare metal 1.9.4 is now available for download. To upgrade, see Upgrade Anthos on bare metal. Anthos clusters on bare metal 1.9.4 runs on Kubernetes 1.21.

Release 1.10.1

Anthos clusters on bare metal 1.10.1 is now available for download. To upgrade, see Upgrading Anthos on bare metal. Anthos clusters on bare metal 1.10.1 runs on Kubernetes 1.21.

The following resource types are now publicly available through the resource search API (SearchAllResources) and policy search API (SearchAllIamPolicies):

• Access Policy (VPC Service Controls Policy)
  • identity.accesscontextmanager.googleapis.com/AccessLevel
  • identity.accesscontextmanager.googleapis.com/AccessPolicy
  • identity.accesscontextmanager.googleapis.com/ServicePerimeter

You can now set an expiry time for all newly created service account keys in your project, folder, or organization. This feature is in Preview. To use this feature, request access to the Preview release.

Storage Transfer Service now offers Preview support for moving data between two filesystems and keeping them in sync on a periodic schedule. Transfers can be orchestrated by creating a transfer job through the API or gcloud command-line tool. See Transfer data between POSIX file systems for details.

This launch offers a managed way to migrate from a self-managed filesystem to Filestore. If you have on-premises systems generating massive amounts of data that needs to be processed in Google Cloud, you can now use Storage Transfer Service to accelerate data transfer from an on-prem filesystem to a cloud filesystem.

Storage Transfer Service now offers Preview support for preserving POSIX attributes and symlinks when transferring to, from, and between POSIX filesystems. Attributes include the user ID of the owner, the group ID of the owning group, the mode or permissions, the modification time, and the size of the file. See Metadata preservation for details.

Internal HTTP(S) Load Balancing now supports Shared VPC configurations where the load balancer's frontend and URL map can be created in a host or service project, while the backend services and backends can be distributed across multiple service projects in the Shared VPC environment. This is referred to as cross-project service referencing. Cross-project backend services can be referenced in a single URL map.

Cross-project service referencing gives service developers and admins autonomy over the exposure of their services through the centrally managed load balancer.

For details, see:

• Shared VPC architectures
• Setting up Internal HTTP(S) Load Balancing with Shared VPC

This feature is available in Preview.

You can now collect Apache Tomcat metrics and logs from the Ops Agent, starting with version 2.9.0. For more information, see Monitoring third-party applications: Apache Tomcat.

You can now collect PostgreSQL metrics and logs from the Ops Agent, starting with version 2.9.0. For more information, see Monitoring third-party applications: PostgreSQL.

You can now collect Elasticsearch logs from the Ops Agent, starting with version 2.9.0. For more information, see Monitoring third-party applications: Elasticsearch.

Starting with Ops Agent version 2.9.0, you can use the exclude_logs logging processor to prevent the Ops Agent from ingesting specific logs. For more information, see Logging processors.

You can now collect Apache Tomcat metrics and logs from the Ops Agent, starting with version 2.9.0. For more information, see Monitoring third-party applications: Apache Tomcat.

You can now collect PostgreSQL metrics and logs from the Ops Agent, starting with version 2.9.0. For more information, see Monitoring third-party applications: PostgreSQL.

Generally available: Support for up to 48 vCPUs and 312 GB memory on virtual machine (VM) instances that have a single T4 GPU attached is now generally available.

For more information, see Network bandwidths and GPUs.

Dataproc Metastore Auxiliary versions are available in Preview.

Spanner database type is available in Preview.

Enrichment using the Knowledge Graph is now Generally Available.

For more information, see Enterprise Knowledge Graph field enrichment.

Security Command Center supports CIS Google Cloud Computing Foundations Benchmark v1.2.0 (CIS Google Cloud Foundation 1.2.0).

The following detectors have been added:

• BIGQUERY_TABLE_CMEK_DISABLED
• CONFIDENTIAL_COMPUTING_DISABLED
• DNS_LOGGING_DISABLED
• SQL_EXTERNAL_SCRIPTS_ENABLED
• SQL_LOG_DURATION_DISABLED
• SQL_LOG_ERROR_VERBOSITY
• SQL_LOG_EXECUTOR_STATS_ENABLED
• SQL_LOG_HOSTNAME_ENABLED
• SQL_LOG_MIN_ERROR_STATEMENT_SEVERITY
• SQL_LOG_MIN_MESSAGES
• SQL_LOG_PARSER_STATS_ENABLED
• SQL_LOG_PLANNER_STATS_ENABLED
• SQL_LOG_STATEMENT
• SQL_LOG_STATEMENT_STATS_ENABLED
• SQL_REMOTE_ACCESS_ENABLED
• SQL_SKIP_SHOW_DATABASE_DISABLED
• SQL_TRACE_FLAG_3625
• SQL_USER_CONNECTIONS_CONFIGURED
• SQL_USER_OPTIONS_CONFIGURED

For more information, see Detectors and compliance.

Explainable AI in BigQuery ML is now generally available (GA). This feature helps you understand BigQuery ML prediction or forecasting results at scale. For additional information about explainable AI, see the following:

• Explainable AI documentation
• Blog post: BigQuery Explainable AI helps you interpret your ML models
• Tutorials for regression, classification, and forecasting tasks

The following resource types are now publicly available through the Analyze Policy APIs (AnalyzeIamPolicy and AnalyzeIamPolicyLongrunning):

• Cloud Dataplex
  • dataplex.googleapis.com/Asset
  • dataplex.googleapis.com/Zone
  • dataplex.googleapis.com/Task
  • dataplex.googleapis.com/Lake

Added support for LoggingLogBucket resource.

Added support for CloudFunctionsFunction resource.

Added fields spec.alertStrategy and spec.conditions.conditionMatchedLog to MonitoringAlertPolicy resource.

Anthos clusters on VMware 1.9.3-gke.4 is now available. To upgrade, see Upgrading Anthos clusters on VMware. Anthos clusters on VMware 1.9.3-gke.4 runs on Kubernetes v1.21.5-gke.1200.

The supported versions offering the latest patches and updates for security vulnerabilities, exposures, and issues impacting Anthos clusters on VMware are 1.10, 1.9, and 1.8.

Anthos clusters on VMware 1.8.6-gke.4 is now available. To upgrade, see Upgrading Anthos clusters on VMware. Anthos clusters on VMware 1.8.6-gke.4 runs on Kubernetes 1.20.12-gke.1500.

Reduce the IP range required to peer your VPC network

The required IP range needed to peer your VPC network to the Apigee network is now limited to a non-overlapping CIDR range of /22. This change simplifies Apigee provisioning. Note that the provisioning step for service network configuration has been updated to reflect this change. For more information, see Understanding peering ranges.

Dialogflow CX has a new agent design best practices guide.

Released the RDB Snapshots (Preview) feature for Memorystore for Redis. For more details, see RDB Snapshots.

Web Security Scanner, a built-in service of Security Command Center, released the SQL_INJECTION and STRUTS_INSECURE_DESERIALIZATION finding types.

For more information, see Web Security Scanner findings.

Private network access in Service Directory is available in GA.

Private network access helps supported Google Cloud services to connect directly to VPC networks.

Accessing supported regional service endpoints using Private Service Connect with consumer HTTP(S) controls is available in General Availability.

Accessing managed services using Private Service Connect with consumer HTTP(S) controls is available in Preview.

Callback endpoints are now generally available (GA).

Managing routing policies in Cloud DNS is available in GA.

The Intelligent Document Quality Processor is now publicly accessible and now supports 3 more defect types:

• quality/defect_document_cutoff
• quality/defect_text_cutoff
• quality/defect_glare

Notable features

Beta: PodSecurity admission

PodSecurity replaces the deprecated PodSecurityPolicy admission controller (which will be removed in 1.25). PodSecurity is an admission controller that enforces Pod Security Standards on Pods in a Namespace based on specific namespace labels that set the enforcement level. In 1.23, the PodSecurity feature is enabled by default, and applies to namespaces that opt into enforcement. Refer to the PodSecurity documentation and PodSecurityPolicy migration guide for more information.

The Retail console is now available to all Recommendations AI users. The Retail Console is a new way to manage both Recommendations AI and Retail Search seamlessly in one project through a unified onboarding and admin console experience.

We recommend switching to the Retail console and using the Retail documentation, which documents Recommendations AI, the Retail console, and Retail Search.

To switch, go to the new console and click Enable the Retail API. You can then view and manage your project from the new console.

You can now use reCAPTCHA Enterprise account defender to detect and prevent account-related fraudulent activities. This feature is in Public Preview.

A Carbon Footprint Looker block is available to create custom dashboards using Looker.

The following resource types are now publicly available through the Analyze Policy APIs (AnalyzeIamPolicy and AnalyzeIamPolicyLongrunning):

• Game Services
  • gameservices.googleapis.com/GameServerCluster
  • gameservices.googleapis.com/Realm
  • gameservices.googleapis.com/GameServerConfig
  • gameservices.googleapis.com/GameServerDeployment

Public preview: Creating rich-text overview and adding data stewards to your data entries is rolled out to all Data Catalog regions with minimal disruption and in a controlled way. For more information, see Create tag templates, tags, overviews, and data stewards.

VPC-scoped DNS for GKE using Cloud DNS is now generally available for GKE versions 1.21 and later. This allows for seamless VPC-wide DNS resolution of GKE Services. Note that cluster-scoped DNS using Cloud DNS is still in public preview.

A new kubernetes metric, Network policy event count (kubernetes.io/pod/network/policy_event_count), is available (beta) for GKE Dataplane V2 clusters in GKE versions 1.22.3-gke.700 and later.

This metric can be viewed in the Metrics Explorer in Cloud Monitoring for resource type, Kubernetes Pod.

This metric provides visibility into network policy events and shows the Change in the number of network policy events seen in the dataplane, each event has the following metric labels:

• verdict: Policy verdict, possible values: [allow, deny].
• workload_kind: Kind of the workload, policy-enforced-pod belongs to, for example, "Deployment", "Replicaset", "StatefulSet", "DaemonSet", "Job", or "CronJob".
• workload_name: Name of the workload, policy-enforced-pod belongs to.
• direction: Direction of the traffic from the point of view of policy-enforced-pod, possible values: [ingress, egress].

In addition to these metric labels, customers can also see usual resource labels for resource type, Kubernetes Pod: project_id, location, cluster_name, namespace_name, and pod_name.

This metric can be used for setting up automated alerts for specific behaviors (denials higher than a threshold), identifying security issues, gaining better understanding of traffic flow, and troubleshooting.

Managed Anthos Service Mesh now supports GKE Autopilot in the Regular and Rapid channels. For more information, see Configure managed Anthos Service Mesh.

Managed Anthos Service Mesh control plane now displays its provisioning status in the ControlPlaneRevision API. For more information, see Verify the control plane has been provisioned.

Managed Anthos Service Mesh now supports deploying a proxy built on the distroless base image. Note that distroless proxy images do not work with managed data plane.

The distroless base image ensures that the proxy image contains the minimal number of packages required to run the proxy. This improves security posture by reducing the overall attack surface of the image and gets cleaner results with CVE scanners. See Distroless proxy image for more information.

Filter clause in the Connectors task

You can add a filter to restrict the amount of data processed by an entity operation. For more information, see Add a filter for an operation.

Upload and download integrations

The Upload/download menu button in the integration designer lets you upload and download integrations in a JSON file format. For more information, see Upload and download integrations.

Users of the App Engine Bundled Services for Python 3 can now access Blobstore, Deferred, and Mail handlers in preview, through language-idiomatic libraries.

Generally available: You can now use the SSH troubleshooting tool to help you determine the cause of failed SSH connections.

Generally Available: Configure commitments to renew automatically. For more information, see Renew commitments automatically.

Added support for LoggingLogMetric resource.

Added support for NetworkConnectivitySpoke resource.

Added regional support for ComputeTargetHTTP(S)Proxy resource(s).

Added spec.build.availableSecrets to CloudBuildTrigger resource.

Added spec.nodeConfig.nodeGroupRef and spec.nodeConfig.spot to ContainerCluster and ContainerNodePool resources.

Added spec.readReplicaMode, spec.replicaCount and status.nodes to RedisInstance resources.

Added spec.settings.ipConfiguration.allocatedIpRange to SQLInstance resource.

Added spec.publicAccessPrevention to StorageBucket resource.

Added spec.identityServiceConfig to ContainerCluster resource.

Dialogflow CX now provides an IDENTITY system function, which is useful to copy a composite parameter object in a parameter preset field.

You can now roll back targets from the delivery pipeline visualization in Google Cloud Console.

Preview support for the following integration:

• Image streaming for container images stored in Artifact Registry.

Added support for Dataproc Metastore's beta NetworkConfig field. Beta services using this field can now be used in conjunction with v1 Dataproc clusters.