GKE 1.37 changelog

This document lists the changes for the patch versions of the Google Kubernetes Engine (GKE) 1.37 minor version.

These changelogs are supplementary information about the updates to specific GKE system components. For information about features, changes, and security issues in GKE, see the following documents:

1.37.0-gke.2941000

The following sections describe changes in this patch version when compared with the previous patch version, 1.37.0-gke.2155000. For information about upstream Kubernetes changes, see the Kubernetes v1.37.0 changelog.

Component Updates

The following sections provide information about updates to specific GKE system components in this patch version.

customer-logs-exporter

Updated customer-logs-exporter component from version 1.36.0-gke.10 to 1.36.0-gke.11.

  • Security Fixes:
    • Updated google.golang.org/grpc to v1.82.1 to resolve GO-2026-6061.
  • Miscellaneous:
    • Introduced new configuration support for cloud logging endpoints and project-specific metadata via ComponentOptionsConfig.

gke-metrics-agent

Updated gke-metrics-agent component from version 2.137.1-gke.0 to 2.137.3-gke.0.

  • Features:
    • Implemented node-daemon Pressure Stall Information (PSI) collection.
  • Miscellaneous:
    • Optimized the container image size by refining vendor dependencies.
    • Updated Workload Autoscaler to version 0.28.0-gke.3.

gvisor

Updated gvisor component from version 1.37.7 to 1.37.11.

  • Miscellaneous:
    • Updated gVisor to version 20260727.0_RC04.

l7-lb-controller-combined

Updated l7-lb-controller-combined component from version 1.41.1-gke.0 to 1.41.3-gke.0.

  • Bug Fixes:
    • Improved L4 Address Manager IP validation to prevent false positive substring matches and enforce explicit Network Tier and Load Balancing Scheme validation.
  • Security Fixes:
    • Go version update to 1.26.6, Go kubernetes client dependency updates to v1.36.3, update google.golang.org/api and google.golang.org/grpc to the newest versions.

1.37.0-gke.2155000

The following sections describe changes in this patch version when compared with the previous patch version, 1.36.3-gke.1767000. For information about upstream Kubernetes changes, see the Kubernetes v1.37.0 changelog.

Component Updates

The following sections provide information about updates to specific GKE system components in this patch version.

accelerator-operator

Updated accelerator-operator component from version 1.35.1 to 1.35.3.

  • Security Fixes:
    • Updated go.opentelemetry.io/otel/sdk to v1.40.0 to resolve GO-2026-4394.
    • Updated golang.org/x/net to v0.53.0 to resolve GO-2026-4440, GO-2026-4559, and GO-2026-4918.
    • Updated google.golang.org/grpc to v1.79.3 to resolve GO-2026-4762.
  • Miscellaneous:
    • Updated base images to use Golang 1.25.10.
    • Backported CI/CD configurations, container build steps, and Go 1.25.0 toolchain fixes to the release branch.
    • Updated the component image to version 1.35.0-gke.8.

advanceddatapath

Updated advanceddatapath component from version 36.3.14 to 36.4.2.

  • Miscellaneous:
    • Added node tolerations for kubernetes.io/arch: arm64 to allow component pods to be scheduled on ARM64-based nodes with the NoSchedule effect.

customer-logs-exporter

Updated customer-logs-exporter component from version 1.36.0-gke.9 to 1.36.0-gke.10.

  • Security Fixes:
    • Updated google.golang.org/grpc to v1.82.1 to resolve GO-2026-6061.

filestorecsi

Updated filestorecsi component from version 1.36.17 to 1.36.18.

  • Miscellaneous:
    • Updated the Go runtime to version 1.25.11.
    • Updated base images to the latest distroless versions for improved security and stability.
    • Explicitly named an internal initialization container as imgSpnpInitContainer in the component manifest.

gcp-controller-manager-combined

Updated gcp-controller-manager-combined component from version 36.1.4 to 36.1.6.

  • Features:
    • Added support for the ToLocalhost type within the component configuration.
  • Miscellaneous:
    • Renamed the custom signerName delegation flag to allow-signing-kubelet-serving-for-non-gcp to improve clarity for signing kubelet serving certificates on non-GCP nodes.

gcsfusecsi

Updated gcsfusecsi component from version 1.36.41 to 1.37.3.

  • Features:
    • Introduced shared mount feature support for non-production environments.
    • Added csi-attacher component support, including associated PriorityClass and RBAC configurations for non-production environments.
  • Bug Fixes:
    • Renamed the controller flag --leader-election-namespace to --driver-namespace to correctly reflect its function.
    • Allow ToLocalhost egress in StaticPodNetworkPolicy for gcsfusecsi-controller to prevent SPNP firewall drops during local OAuth token exchange.
  • Security Fixes:
    • Remediated security vulnerability GHSA-gcjh-h69q-9w9g by upgrading github.com/google/cel-go to v0.29.0.
    • Updated github.com/google/cel-go to resolve GO-2026-6094.
    • Updated go.etcd.io/etcd/client/pkg/v3 to resolve GO-2026-6107.
    • Updated the Go base image and the csi-attacher sidecar container to address security vulnerabilities.
  • Miscellaneous:
    • Updated mount configurations to utilize distinct host paths for pods and plugin registration (kubelet-pods-dir and kubelet-plugins-dir).
    • Updated the addonmanager.kubernetes.io/mode from Reconcile to Recreate.

gvisor

Updated gvisor component from version 1.36.19 to 1.37.7.

  • Miscellaneous:
    • Updated gVisor to version 20260803.0_RC01.

managed-prometheus

Updated managed-prometheus component from version 0.18.2-gke.0 to 0.19.0-gke.1.

osimage

Updated osimage component from version 1.36.75 to 1.36.79.