GCP News - 2026-07-31

Access Approval

Feature

App Topology (including One Graph) is generally available (GA).

Access Transparency

Feature

App Topology (including One Graph) is generally available (GA).

Apigee hybrid

Announcement

v1.15.7

On July 31, 2026 we released an updated version of the Apigee hybrid software, v1.15.7.

• For information on upgrading, see Upgrading Apigee hybrid to version v1.15.7.
• For information on new installations, see The big picture.

Feature

Runtime rollout strategy configuration

In this release, you can configure the rollout strategy used when updating runtime (message processor) ReplicaSets by setting the runtime.release.strategy property (with options rolling, scale-down-first, or none) or per-environment with envs[].components.runtime.release.strategy in your overrides configuration file. The property defaults to rolling.

Security

Various security and CVE fixes are included in this release.

Cloud Load Balancing

Feature

Cloud Load Balancing introduces a new version of the Network Load Balancer—the global external passthrough Network Load Balancer, which is the global variant of the regional external passthrough Network Load Balancer. The load balancer is available in Preview.

This load balancer variant solves use cases for Security Service Edge (SSE), DNS hosting, Adtech (real-time bidding), real-time communications (RTC), live streaming, and online gaming, among others.

Global external passthrough Network Load Balancers are Layer 4 passthrough load balancers that distribute external traffic among backends (instance groups or network endpoint groups) that can reside in multiple Google Cloud regions. By using Google's global anycast IP routing, the global external passthrough Network Load Balancer steers user traffic to the closest region with healthy backends and available capacity, delivering ultra-low latency and dynamic cross-region failover to ensure resilience to regional outages.

The load balancer provides you with two external IP addresses, each served by a disjoint and isolated global load balancing control and data plane server infrastructure (also known as an availability group) to provide high availability.

The load balancer supports TCP, UDP, ESP, GRE, ICMP, and ICMPv6 traffic and can handle both IPv4 and IPv6 traffic. You can deploy your backends in any of the following Google Cloud regions:

• North America: us-west1, us-west4, us-east4, us-east5
• Europe: europe-west2, europe-west3
• Asia: asia-southeast1, asia-south1, asia-northeast1
• South America: southamerica-east1
• Africa: africa-south1
• Australia: australia-southeast1

Note that this release doesn't support GKE backends for the global external passthrough Network Load Balancer.

For details on the new load balancer, see Global external passthrough Network Load Balancer overview.

Cloud SQL for MySQL

Change

Starting on August 1, 2026, when you create or clone a Cloud SQL instance enabled with Private Service Connect, or when you enable Private Service Connect for an existing instance, then connection reconciliation behavior is enabled by default and can't be disabled.

When you remove a project from the list of allowed projects, all existing Private Service Connect connections from the removed project are immediately closed (reconciled). This means that applications using Private Service Connect endpoints in those removed projects can't continue to connect to the Cloud SQL instance using those endpoints.

For more information, see Allowed Private Service Connect projects.

Feature

QueryData adds support for parameterized secure views (PSVs) to help secure applications that use natural language queries. For more information, see Secure and control access to application data.

This feature is in Preview.

Cloud SQL for PostgreSQL

Change

Starting on August 1, 2026, when you create or clone a Cloud SQL instance enabled with Private Service Connect, or when you enable Private Service Connect for an existing instance, then connection reconciliation behavior is enabled by default and can't be disabled.

When you remove a project from the list of allowed projects, all existing Private Service Connect connections from the removed project are immediately closed (reconciled). This means that applications using Private Service Connect endpoints in those removed projects can't continue to connect to the Cloud SQL instance using those endpoints.

For more information, see Allowed Private Service Connect projects.

Cloud SQL for SQL Server

Change

Starting on August 1, 2026, when you create or clone a Cloud SQL instance enabled with Private Service Connect, or when you enable Private Service Connect for an existing instance, then connection reconciliation behavior is enabled by default and can't be disabled.

When you remove a project from the list of allowed projects, all existing Private Service Connect connections from the removed project are immediately closed (reconciled). This means that applications using Private Service Connect endpoints in those removed projects can't continue to connect to the Cloud SQL instance using those endpoints.

For more information, see Allowed Private Service Connect projects.

Feature

Cloud SQL for SQL Server now supports executing SQL statements using the Cloud SQL Data API.

Confidential VM

Security

Support for Intel TDX on c4-standard-* machine types is available in Preview.

Dataflow

Feature

You can now pause a Dataflow batch job using the pause_on_failure service option. This feature lets you preserve the state of your batch pipeline job, address external issues, and resume processing without losing completed work. You can use this option to automatically pause a job on failure, or use this feature to manually pause a job when you chose to. For more information, see Pause a Dataflow job.

Datastream

Feature

You can now replicate change data from Workday with Datastream. For more information, see Stream data from Workday.

This feature is in Preview.

Google Cloud Managed Service for Apache Kafka

Feature

You can generate synthetic data for a Managed Service for Apache Kafka cluster by using Dataflow. For more information, see Generate synthetic data for a Managed Service for Apache Kafka cluster.

Memorystore for Valkey

Feature

You can use custom organization policies to improve the security, compliance, and governance of your Memorystore for Valkey instances by enforcing consistent configurations and restrictions for the instances. This ensures that your instances adhere to security best practices and regulatory requirements. This feature is Generally Available.

Security Command Center

Feature

Organizations that are enrolled in the data residency Preview program can update their organization's data residency and data encryption configuration. For more information, see Modify data residency or data encryption configuration.

Feature

Agent Platform Vulnerability Assessment (Preview) scans for plaintext secrets, such as credentials, access tokens, and API keys, in customer-deployed Gemini Enterprise Agent Platform containers. For more information, see Agent Platform Vulnerability Assessment.