GCP News - 2026-09-10

2026-09-10
最終更新: 2026-09-11 03:06:30 JST

AI による概要

10 記事

この日は 10 件で、Cloud Storage と Gemini Enterprise の機能追加、データベースの上限緩和、そして大規模ライブ配信の事例が並びました。リリースノートでは、組織・フォルダ・プロジェクトを横断して Cloud Storage 環境を大規模に監視・管理できる Storage Intelligence advisor が一般提供になりました。Gemini Enterprise app for Slack には、チャンネルでの @メンションとダイレクトメッセージでのマルチターン会話が加わり、有効化には Slack 管理者による再インストールと利用者の再認可が必要です。GKE のセキュリティ情報 GCP-2026-061 も公開されました。Google Cloud ブログでは、Spanner の DML トランザクションについて、従来は 1 トランザクションあたり約 80,000 件に制限されていた累積の変更 (行数 × 列数に依存インデックスを加えた概算) の上限を撤廃し、一貫性・スケーラビリティ・可用性を損なわずにより大きなトランザクションを扱えるようになったことが発表されました。DMS がインスタンスレベルのオブジェクトを意図的に移行しない設計であることを踏まえ、SQL Server のログインとユーザーを Cloud SQL へ移す手順の解説、AlloyDB Omni の Red Hat RPM オーケストレーターの一般提供 (AlloyDB Omni 18.3.0 と同時、4 つのデプロイモード)、Google が 2026 年 Gartner Magic Quadrant のエンタープライズ AI アシスタント部門で (初回評価で) リーダーに選出されたことも取り上げられました。AI/ML ブログでは、Airtel が IPL 2026 のクリケット中継で 74 試合・数百ペタバイトの下り転送を配信し、決勝だけで数百億リクエスト・ピーク数 Tbps を Media CDN のエッジ設計と試合当日のリアルタイム監視でさばいた事例が紹介されています。国内では、近畿大学と Google Cloud が包括連携協定を結び、全 16 学部の 1・2 年生 19,033 人と教職員 2,105 人の計 21,138 人へ Google AI Pro for Education を導入して「AI ネイティブ大学」を目指す取り組みが発表されました。

主要トピック
  • ストレージ: Storage Intelligence advisor が GA、組織・フォルダ・プロジェクト横断で Cloud Storage を監視・管理

  • コラボ: Gemini Enterprise app for Slack がチャンネルでの @メンションとマルチターン会話に対応 (管理者の再インストールが必要)

  • データベース: Spanner の DML トランザクションで約 80,000 件の累積変更上限を撤廃

  • 移行: DMS が移行しない SQL Server のログイン / ユーザーを Cloud SQL へ移す手順、AlloyDB Omni の RPM オーケストレーターが GA

  • 評価: Google が 2026 年 Gartner Magic Quadrant のエンタープライズ AI アシスタント部門でリーダーに選出

  • 事例: Airtel が IPL 2026 中継を 74 試合・数百 PB・ピーク数 Tbps で Media CDN により配信

  • 国内: 近畿大学と Google Cloud が包括連携協定、約 2 万人へ Google AI Pro for Education を導入

  • セキュリティ: GKE セキュリティ情報 GCP-2026-061 を公開

AI (Claude Opus 5) が生成 · 2026-09-11 07:54:56 JST

Google Cloud Release Notes

September 10, 2026

詳細を表示

Cloud Storage

Feature

Storage Intelligence advisor is now generally available. Storage Intelligence advisor lets you monitor and manage your Cloud Storage environment at scale across organizations, folders, and projects. For more information, see About Storage Intelligence advisor.

Gemini Enterprise

Feature

Gemini Enterprise: Support for channel mentions and multi-turn conversations in the Gemini Enterprise app for Slack

The Gemini Enterprise app for Slack has the following new capabilities:

  • Channel mentions: You can @mention the Gemini Enterprise app directly in Slack channels and conversational threads. The app returns responses privately so you can review them before choosing to share.
  • Multi-turn conversations: The Gemini Enterprise app remembers the context of your current session in direct messages. You can ask follow-up questions and refine previous responses. You can clear the context and start over by clicking New chat.

To enable these features, your Slack administrator must reinstall the Gemini Enterprise app. For more information, see Install the Gemini Enterprise app for Slack in your Slack workspace. After the administrator reinstalls the app, end users must authorize the Slack connector. For more information, see User authorization. If you don't reinstall and re-authorize the Gemini Enterprise app, your Slack workspace retains the legacy experience.

These features are generally available (GA). For more information, see Configure the Gemini Enterprise app for Slack.

Google Cloud Managed Service for Apache Kafka

Feature

You can configure a Managed Service for Apache Kafka cluster as a public cluster to let client applications connect over the public internet. For more information, see Connect clients to a public cluster.

Google Cloud Blog

How Airtel delivered its flawless Indian Premiere League 2026 cricket broadcasts

詳細を表示

For the millions of fervent fans of the Indian Premiere League (IPL), being able to count on a flawless live streaming cricket experience is never up for debate. For Airtel, producing league TV broadcasts with some of the world's most massive concurrent viewership, dropped packets and buffering are simply not options.

During the IPL 2026 season, Airtel partnered with Google Cloud to manage this digital delivery. Across 74 matches, the streaming infrastructure delivered several hundred petabytes of egress data. The final match alone processed tens of billions of requests, hitting a peak egress of several Tbps.

Delivering video under these concurrency spikes requires an edge architecture designed strictly around localization, paired with proactive operational monitoring. 

Our goal for IPL 2026 was to deliver an uninterrupted, stadium-grade viewing experience to cricket fans across India, regardless of concurrency surges or network conditions. Partnering with Google Cloud and using Media CDN gave us deep local edge proximity and excellent cache efficiency. Combined with proactive match-day real-time monitoring, we delivered a reliable broadcast experience from start to finish.

Architecting for concurrency and edge efficiency

<div class="article-module h-c-page">
  <div class="h-c-grid">


<figure class="article-image--large
  
  
    h-c-grid__col
    h-c-grid__col--6 h-c-grid__col--offset-3
    
    
  ">

  
  
    
    <img alt="IPL-BLog-Architecture" src="https://storage.googleapis.com/gweb-cloudblog-publish/images/IPL-BLog-Architecture.max-1000x1000.png" />
    
    </a>
  
</figure>


  </div>
</div>

One of the primary challenges in live sports broadcasting is seamlessly handling large traffic spikes and never degrading stream performance or overwhelming backend origins. That’s especially important when millions of viewers simultaneously tune in during a final over because every millisecond counts.

To accelerate content delivery across India’s diverse ISP landscape, Airtel leveraged Google Cloud’s Media CDN. By utilizing Google’s extensive global edge network, Airtel was able to serve viewer requests from edge locations that were physically close to end users. This deep localization was a cornerstone of the broadcast's success, with 99.9% of all tournament traffic being served locally from within India.

This efficient architecture minimized network hops and reduced transit congestion, translating into remarkable infrastructure and viewer experience metrics throughout the 74 matches:

  • Superior caching efficiency: Airtel saw an overall cache hit ratio exceeding 98%. By effectively absorbing massive viewer traffic load at the edge, origin server/video platform demands remained minimal even during peak playoff viewership.

  • Consistent ultra-low latency: Airtel maintained a p99 latency of < 300 ms during the tournament, which supported fast stream start times and minimized buffering risk during critical game moments.

Proactive strategies for operational readiness

While maintaining an intelligent backend architecture was vital to Airtel’s IPL streaming strategy, it was  only half the equation. Executing high-stakes live broadcasts across 74 consecutive matches also demanded meticulous operational preparation and proactive match-day execution.

Because Airtel and Google Cloud recognized that potential bottlenecks had to be identified long before the first ball, they established a deeply integrated operational support model:

  1. Pre-tournament support readiness reviews: Well ahead of the opening match, joint engineering teams conducted comprehensive support readiness reviews. By auditing traffic projections, reviewing manifest configurations, and validating failover mechanisms early, the teams supported robust client readiness, resulting in low operational friction during the tournament.

  2. Monitoring as a service (MaaS): The teams maintained continuous, proactive telemetry monitoring through MaaS on Media CDN, and real-time observability enabled early detection and mitigation of network shifts before anomalies could impact viewer playback.

  3. Dedicated match-day and weekend support: Live sports don't play by the rules of  standard business hours, so Airtel established comprehensive monitoring protocols for every match. During critical weekend fixtures and the high-stakes playoff stage, Google Cloud’s Technical Account Management and MaaS teams worked hand-in-hand with Airtel engineering to provide dedicated, real-time event support.

A blueprint for live broadcast excellence

Airtel’s successful streaming of IPL 2026 demonstrates that handling extreme concurrency is only possible with an integrated strategy across architecture, edge localization, and operational governance. By combining a 98%+ cache hit ratio with 99.9% local delivery and proactive match-day monitoring, Airtel hit a benchmark for live sports broadcasting at scale.

This deployment provides an overview of the technical architecture and operational strategies involved in scaling live media delivery for high-concurrency events. To learn more about optimizing live broadcasts and edge delivery, review the Media CDN developer documentation.

Spanner: Removing cumulative mutation limits for DML transactions

詳細を表示

Spanner is Google Cloud’s no-compromise operational database that gives you the horizontal scale and always-on availability of a modern distributed system along with the rich feature set and familiar ecosystem of a relational database. Innovators in industries like banking, retail, media and entertainment, and AI infrastructure rely on Spanner today for their most critical workloads. We’re excited to announce a new, flexible way to handle larger, more complex transactions in Spanner, simplifying applications that need the highest levels of data consistency.

Operational workloads typically combine real-time decision making with granular updates: Think: identifying fraud as part of a multi-step checkout process in an ecommerce app. These changes must be transactional; either all of them succeed or none of them do and subsequent requests see the correct data. This update to Spanner’s ACID transactions allows applications to handle more data in an update without compromising on consistency, scalability, or availability using familiar DML. 

Higher ceiling, more flexibility

Previously, Spanner capped the changes a query could perform in a transaction, for example using DML, at 80,000. That was roughly computed as the product of the number of rows and number of columns updated, plus any dependent indexes. Applications evolve over time to handle more data and provide new functionality. These changes increase the size of transactions, potentially causing previously small transactions to hit this limit. 

This update shifts the 80,000 mutation mod limit from the transaction to individual DML statements. DML statements no longer contribute to an overall transaction-level mutation limit. A single transaction can now contain any number of DML statements, such as INSERT, UPDATE, or DELETE, provided that each individual statement generates fewer than 80,000 mutation mods.

Key benefits

  1. Larger transactions: Group DML statements logically based on business requirements rather than artificially splitting them to comply with cumulative mutation limits.

  2. Seamless transition: This change is compatible with all existing Spanner client libraries and requires no updates to application code.

Technical considerations

Locking and aborts

While you can now include more DML statements in a single transaction, be aware that larger and longer-running transactions hold locks for a greater duration. This may increase the likelihood of lock contention and transaction aborts. Keeping transactions concise helps maintain high performance and minimize resource contention.

DML vs. Mutation API

The application of limits depends on the method used to modify data:

  • DML Statements: Each statement (e.g., executeUpdate) is evaluated independently against the 80,000 mod limit.

  • Mutation API: When using client library methods like insert() or update(), mutations are provided during the Commit call. The 80,000 limit continues to apply to the entire set of mutations included in that single call.

Understanding mutation mods

Spanner counts "mods" based on the complexity of changes, including modified cells, primary keys, and secondary index updates. Please look at this blog for more details on how mutations are counted. You can monitor the total mods for a committed transaction via the mutation_count in the CommitStats. Note that the mutation_count will include all the mutations that are part of the transaction, across all DML statements and commit calls. 

Java implementation example

The following example demonstrates how multiple DML statements can be executed within a single transaction under the new limit logic.

code_block
<ListValue: [StructValue([('code', 'import com.google.cloud.spanner.DatabaseClient;\r\nimport com.google.cloud.spanner.Statement;\r\nimport com.google.cloud.spanner.TransactionContext;\r\nimport com.google.cloud.spanner.TransactionRunner.Work;\r\n\r\n// Assuming dbClient is your initialized DatabaseClient\r\ndbClient\r\n .readWriteTransaction()\r\n .run(\r\n new Work<Void>() {\r\n @Override\r\n public Void doWork(TransactionContext transaction) throws Exception {\r\n // Each executeUpdate call is evaluated separately against the 80k mod limit.\r\n\r\n // Example 1: Updating specific products\r\n Statement stmt1 = Statement.newBuilder(\r\n "UPDATE Products SET InStock = FALSE WHERE ProductId = @productId")\r\n .bind("productId").to(1L)\r\n .build();\r\n transaction.executeUpdate(stmt1); // Verified against 80k limit\r\n\r\n Statement stmt2 = Statement.newBuilder(\r\n "UPDATE Products SET InStock = FALSE WHERE ProductId = @productId")\r\n .bind("productId").to(2L)\r\n .build();\r\n transaction.executeUpdate(stmt2); // Verified against 80k limit separately\r\n\r\n // Example 2: Inserting related order data\r\n Statement stmt3 = Statement.newBuilder(\r\n "INSERT INTO OrderItems (OrderId, ItemId, Quantity) VALUES (@orderId, @itemId, @qty)")\r\n .bind("orderId").to(100L)\r\n .bind("itemId").to(1L)\r\n .bind("qty").to(2)\r\n .build();\r\n transaction.executeUpdate(stmt3); \r\n\r\n Statement stmt4 = Statement.newBuilder(\r\n "UPDATE Orders SET LastUpdated = PENDING_COMMIT_TIMESTAMP() WHERE OrderId = @orderId")\r\n .bind("orderId").to(100L)\r\n .build();\r\n transaction.executeUpdate(stmt4); \r\n\r\n return null;\r\n }\r\n });'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f308074a7c0>)])]>

What has not changed

  • Individual statement limit: Any single DML statement that generates more than 80,000 mods on its own will still return the same error as we do today. 

  • Other transaction limits: Other constraints such as the maximum transaction size in bytes remain in effect. They are documented here.

Best practices

  • Monitor CommitStats: Utilize the mutation_count returned in CommitStats to understand the load generated by your operations.

  • Optimize large operations: If a single statement (like a bulk update) exceeds the limit, consider using Partitioned DML or paginating through keys.

Spanner is the trusted choice for operational applications that need to scale without downtime. This increase to the mutation limit provides developers new flexibility to run larger transactions that leverage Spanner’s global consistency. Learn how Spanner can help your teams innovate faster with less risk, or try it on your own, with a free trial or production instances starting as low as $54/month.

External references

Beyond DMS: Accelerating Migrations SQL Server Logins and Users to Cloud SQL

詳細を表示

So, you’ve planned your database modernization journey. You’ve set up Google Cloud’s Database Migration Service (DMS), configured replication, and successfully synchronized your application databases from your on-premises or cloud systems to a fully managed Cloud SQL for SQL Server instance.

The replication is complete, the data is up to date, and you’re ready for cutover. But when your application attempts to connect to the newly migrated database, you’re hit with a frustrating roadblock:

Msg 18456, Level 14, State 1, Line 1: Login failed for user 'app_user.

The culprit is simple: your SQL Server logins didn't migrate with your database. In this post, we’ll look at why this gap exists, why it actually protects your organization's security posture, and how easy it is to bridge using standard, time-tested SQL Server tools. 

Why DMS doesn't migrate logins: Security and compliance

Database Migration Service (DMS) is highly efficient at replicating database-level schemas and transactional data. However, it purposefully doesn’t migrate instance-level objects, such as the system master database or server logins and permissions.

While this might feel like a missing feature, it is actually a deliberate design choice built around three core pillars:

  1. Security Isolation and Privilege Boundaries: The source environment and the destination Cloud SQL environment operate under different security paradigms. Replicating the master system database directly could lead to unauthorized privilege escalation. For example, an on-premises login with sysadmin privileges shouldn’t have unrestricted sysadmin access to a fully managed Google Cloud database. When the cloud provider manages physical backups, patching, and security, it needs to limit underlying operating system access to ensure correct operation.

  2. Compliance and Audit Governance: Automated migration of encrypted password hashes and server-level security credentials without explicit administrator oversight frequently violates enterprise compliance frameworks such as PCI-DSS or SOC 2. By keeping security object migration as a deliberate, administrator-driven step, organizations can guarantee that only approved identities are provisioned in the cloud landing zone.

  3. The Need for Identity Modernization: Migrating to the cloud is the perfect opportunity to update and prune stale credentials. Frequently, on-premises instances carry legacy SQL logins that are no longer used. Replicating them blindly to a cloud-managed service is a security anti-pattern. Furthermore, moving to Cloud SQL is often the catalyst for shifting away from legacy SQL authentication toward modern, cloud-native identity solutions like Customer-Managed Active Directory (CMAD).

Understanding logins vs. users: The SID connection

To migrate logins successfully, let’s briefly revisit how SQL Server manages security. SQL Server separates identity into two distinct layers:

  • Logins (server-level): Stored in the master database. These authenticate a client connection to the SQL Server instance.

  • Users (database-level): Stored inside individual user databases. These authorize what actions a connection can perform within that specific database.

The bridge between a server login and a database user is a unique Security Identifier (SID).

When you backup and restore a database (or use DMS to replicate it), the database-level users (and their corresponding SIDs) are migrated inside the database files. However, if the corresponding server-level login does not exist in the destination master database—or exists but has a different SID—the mapping breaks. This results in "orphaned users" who have database access permissions but no way to authenticate at the server level.

<div class="article-module h-c-page">
  <div class="h-c-grid">


<figure class="article-image--large
  
  
    h-c-grid__col
    h-c-grid__col--6 h-c-grid__col--offset-3
    
    
  ">

  
  
    
    <img alt="SQL Server Logins 1" src="https://storage.googleapis.com/gweb-cloudblog-publish/images/image1_kO5uMVL.max-1000x1000.png" />
    
    </a>
  
    <figcaption class="article-image__caption "><p>Figure 1: How migrating databases without corresponding logins or with mismatched security identifiers (SIDs) results in orphaned users on the destination instance.</p></figcaption>
  
</figure>


  </div>
</div>

The recommended solution: Replicating logins using sp_help_revlogin

Instead of manually recreating every login and guessing password hashes, we can rely on a classic Microsoft-provided script: sp_help_revlogin.

This script generates a T-SQL query containing the CREATE LOGIN statement for every SQL Server authentication login on your source instance, complete with its original, encrypted password hash and its exact Security Identifier (SID).

Step 1: Create the helper procedures on your source instance

Connect to your source SQL Server instance using SQL Server Management Studio (SSMS). Copy and execute the official Microsoft script to create the two required stored procedures in your source master database: sp_hexadecimal and sp_help_revlogin.

Step 2: Generate the migration script

Once the procedures are created, run the following statement in your SSMS query window. Make sure to toggle your output settings to Results to Text (Ctrl + T) to copy the output cleanly:

code_block
<ListValue: [StructValue([('code', 'EXEC master.dbo.sp_help_revlogin;'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f3080c98b20>)])]>

The output will contain auto-generated T-SQL statements that look similar to this:

code_block
<ListValue: [StructValue([('code', 'CREATE LOGIN [app_user] WITH PASSWORD = 0x01004F3D... HASHED, SID = 0x8D2F..., DEFAULT_DATABASE = [CustomerDB]'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f3080c981c0>)])]>

By scripting out the login with the HASHED password option and the original SID, SQL Server allows us to safely recreate the login with its original password and secure link intact.

Step 3: Apply the script to Cloud SQL

Copy the generated script, connect to your destination Cloud SQL for SQL Server instance, and execute the query. Your logins are instantly created in the cloud with their correct passwords.

By running the script generated by sp_help_revlogin, we replicate the logins onto the destination Cloud SQL instance with their exact security identifiers (SIDs) and password hashes intact. As shown below, this ensures that the database-level users automatically map to their server-level logins upon database migration, avoiding “orphaned users” entirely.

<div class="article-module h-c-page">
  <div class="h-c-grid">


<figure class="article-image--large
  
  
    h-c-grid__col
    h-c-grid__col--6 h-c-grid__col--offset-3
    
    
  ">

  
  
    
    <img alt="SQL Server Logins 2" src="https://storage.googleapis.com/gweb-cloudblog-publish/images/image2_lFILOIi.max-1000x1000.png" />
    
    </a>
  
    <figcaption class="article-image__caption "><p>Figure 2: The unified migration process using the sp_help_revlogin script to preserve password hashes and original SIDs, resolving user mapping on Cloud SQL for SQL Server.</p></figcaption>
  
</figure>


  </div>
</div>

Note: 
sp_help_revlogin is a stored procedure that was created and is maintained by Microsoft. Make sure to download the latest version and read the documentation. 

Troubleshooting orphaned users

If you had created a login on the target Cloud SQL instance manually before running sp_help_revlogin, the SIDs might not match, causing the user to become "orphaned."

If you find an orphaned user (say, app_user), you can easily remap it to the newly created server login with a single command:

code_block
<ListValue: [StructValue([('code', 'ALTER USER [app_user] WITH LOGIN = [app_user];'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f3080c98580>)])]>

With that command, the database user and the server login are immediately reunited via their SIDs, and application connectivity is fully restored.

Take your security a step further

While migrating SQL logins using sp_help_revlogin is the easiest path for a lift-and-shift migration, consider utilizing your cloud migration to modernize your authentication. Cloud SQL for SQL Server supports robust integrations with Customer-Managed Active Directory (CMAD). Integrating your destination instance with Active Directory allows you to deprecate legacy SQL logins in favor of centralized, enterprise-grade Kerberos authentication.

Wrap up

Database migration is more than just shifting rows of data—it’s about ensuring your applications remain secure, compliant, and operational from day one. While Google Cloud’s DMS handles the heavy lifting of data replication, migrating your logins is a straightforward, three-step process that guarantees a seamless cutover.

To learn more about optimizing your migration strategy, check out the Cloud SQL for SQL Server Migration Guide and explore how Database Migration Service can streamline your move to Google Cloud.

Google is a Leader in the 2026 Gartner® Magic Quadrant™ for Enterprise AI Assistants

詳細を表示

We are excited to share that Gartner has named Google a Leader in its inaugural 2026 Magic Quadrant for Enterprise AI Assistants. In this comprehensive evaluation of top enterprise AI assistant vendors, Gartner placed Google in the Leaders quadrant for its evaluation across both Completeness of Vision and Ability to Execute.

Gemini Enterprise helps organizations bring helpful, secure AI directly into the daily work of their employees. It moves teams past basic chat interactions to automating multi-step, end-to-end workflows with AI agents. It connects with the tools and infrastructure companies already use and scales easily and cost-effectively, all with security and governance in place. 

We see this recognition from Gartner as validation of our goal: creating a unified platform where everyone — from business users to developers — can work alongside AI agents to accomplish more together.

<div class="article-module h-c-page">
  <div class="h-c-grid">


<figure class="article-image--large
  
  
    h-c-grid__col
    h-c-grid__col--6 h-c-grid__col--offset-3
    
    
  ">

  
  
    
    <img alt="[High Res] Gartner EAIA Magic Quadrant" src="https://storage.googleapis.com/gweb-cloudblog-publish/images/High_Res_Gartner_EAIA_Magic_Quadrant.max-1000x1000.png" />
    
    </a>
  
</figure>


  </div>
</div>

Our take on Google as a Leader

Amid a complex landscape of standalone AI tools and emerging platforms, Gemini Enterprise emerges as a unified, open agentic platform backed by Google’s full AI stack, with strengths mentioned in the report such as:

  • Unified “AI front door”: Gemini Enterprise unifies enterprise chat and search, first and third-party agents, a no-code agent designer, Google Workspace integration, and third-party connectors all in one platform, eliminating the need for organizations to piece together disparate AI tools.

  • Open connectivity: Gemini Enterprise offers extensive connectivity beyond Google's ecosystem — extending to Microsoft 365, other third-party software, and internal enterprise data sources. This open connectivity lets organizations adopt Gemini Enterprise alongside their existing infrastructure without costly system overhauls.

  • Simple economics: Gemini Enterprise offers a straightforward pricing model, with actions like chat and search included in the base SKU. Organizations can select per-user seat subscriptions, as well as a pay-as-you-go option that lets users run agent workloads without hitting quota limits mid-task.

  • Built-in governance: Gemini Enterprise provides robust agent governance out-of-the- box at no extra cost, enabling enterprises to seamlessly manage users, agents, and data permissions while curbing security risks and agent sprawl.

  • Full-stack depth and scale: Google’s vertically-integrated stack provides global infrastructure, custom silicon, world-class models, and a secure, enterprise-ready foundation — all optimized for security, interoperability, and cost. 

To read the full report, download it here.

Accelerating our vision with the latest Gemini Enterprise advancements

Over the past months, we have accelerated Gemini Enterprise with significant product advancements:

  • Tailored industry solutions: We introduced specialized solutions for legal and financial services last month. These tailored solutions bring pre-built agents, domain-specific skills, secure data connectors, and an open partner ecosystem, allowing for rapid deployment. They are also built on top of Gemini Enterprise’s governed control plane so you can create and manage workflows in these highly regulated industries. 

  • Google Antigravity in Gemini Enterprise: With the introduction of AI developer tools in Gemini Enterprise, enterprises can now easily enable agentic dev tools like Antigravity and Android Studio for their developer teams with eligible Gemini Enterprise licenses, and maintain full governance and observability inside the admin console.

  • FinOps and cost controls: New FinOps and cost-control capabilities were introduced last month, allowing organizations to optimize AI spend through more pricing options, Flexible Savings Plans, and granular spend management.

Gemini Enterprise customers are also seeing the value

Hearing this recognition from Gartner is great, but it's not just them—our customers are seeing this real-world value too, and it's driving a positive impact across their organizations every day. 

Check out what our customers are saying about the recent product advancements.

“Deploying Antigravity in Gemini Enterprise allows Accenture to arm our engineers with Google DeepMind’s premier technology on the secure, trusted foundation of Google Cloud. Abstracting away operational complexity ensures our teams don't have to choose between developer speed and enterprise-grade governance — freeing them to deliver high-velocity engineering and transformative value for our clients.” — Chetna Sehgal, Global Practice Lead, Accenture Google Business Group. Learn more here. 

“Cleary is committed to embedding AI into our workflows in strategic and competitive ways. Using Google’s Gemini Enterprise, which can slot in seamlessly with other daily work tools, we can unlock greater efficiencies for our teams and help them deliver even higher quality work for our clients.” — Jeff Karpf, Managing Partner, Cleary Gottlieb. Learn more here.

“As a design partner for the Financial Research agent, Deutsche Bank has helped shape this capability in view of the realities of a highly regulated industry – from data protection and governance to the workflows our teams use every day,” – Marie-Jeanne Deverdun, Chief Technology, Data and Innovation Officer, and Member of the Deutsche Bank Management Board. Learn more here. 

“We’re thrilled to partner with Google Cloud in the early adoption of Gemini Enterprise for Legal. We look forward to integrating Google’s technology to streamline workflow and further support our litigators in shaping outcomes critical to our clients’ futures.” — Joe Petrosinelli, Chairman, Williams & Connolly. Learn more here.

Get started today

Enterprise-grade PostgreSQL with AlloyDB Omni RPM Orchestrator is generally available

詳細を表示

We are thrilled to announce the general availability of the AlloyDB Omni Red Hat RPM orchestrator, that brings production-ready security, resiliency, and low-downtime operations to PostgreSQL workloads in your enterprise environments. This GA milestone builds on the foundation laid during our preview release and launches alongside AlloyDB Omni version 18.3.0 to bring cloud-like database automation directly to your virtual machines and bare-metal servers with Google’s AI capabilities.

As of this GA release, AlloyDB Omni can be deployed in four modes to suit your requirements. Visit AlloyDB Omni documentation for more information.

  1. Standalone container (Debian / UBI)

  2. Container with Kubernetes operator for Highly Available enterprise deployment

  3. Standalone RPM

  4. With RPM orchestrator for Highly Available enterprise deployment

Why run a self-managed database?

For many use cases, a managed cloud database service is the simplest and most cost-effective option. However, there are scenarios where you may choose to run a PostgreSQL database yourself, on or off the cloud. The AlloyDB Omni RPM deployment is built for organizations that need the performance of the cloud with the control of local, non-containerized infrastructure, with use cases including:

  • Workload Modernization: AlloyDB Omni is more than 2X faster for transactional workloads and can deliver up to 100X faster analytical queries than standard PostgreSQL L , revitalizing existing infrastructure without a full migration.

  • Regulated Environments: For industries with strict data residency and security requirements, the RPM orchestrator provides the necessary tools like SELinux and local audit logging to stay compliant.

  • Edge and On-Premises Deployment: Deploying at the edge or on bare-metal servers allows for low-latency processing and disconnected operation.

  • AI-Ready Infrastructure: You can provision database clusters for AI integrations, using AlloyDB AI capabilities such as vector search for modern generative AI applications directly on-premises.

Flexible Reference Architectures

The AlloyDB Omni RPM orchestrator offers flexible deployment models tailored to your organization's specific operational requirements—whether your focus is maximizing performance, scaling read throughput, or ensuring robust high availability (HA). For more details, refer to the AlloyDB Omni availability reference architecture overview. The orchestrator simplifies cluster provisioning and lifecycle management by allowing you to define reference architecture specifications, customizable by adjusting instance parameters, node configurations, and networking options. Here is an example deployment view of scalable AlloyDB Omni HA reference architecture.

<div class="article-module h-c-page">
  <div class="h-c-grid">


<figure class="article-image--large
  
  
    h-c-grid__col
    h-c-grid__col--6 h-c-grid__col--offset-3
    
    
  ">

  
  
    
    <img alt="1" src="https://storage.googleapis.com/gweb-cloudblog-publish/images/1_8L3W52J.max-1000x1000.jpg" />
    
    </a>
  
    <figcaption class="article-image__caption "><p>High availability reference architecture for AlloyDB Omni clusters with RPM Orchestrator</p></figcaption>
  
</figure>


  </div>
</div>

The diagram illustrates a highly available, distributed database reference architecture for AlloyDB Omni managed by the RPM Orchestrator. It shows that the client applications connect to a robust load-balancing tier and the load balancer routes read-write traffic directly to the active primary database node, while read-only traffic is routed to the replica nodes. The load balancer uses a Virtual IP (VIP) and is highly available itself, with Keepalived (for VIP failover), PgBouncer (for PostgreSQL connection pooling), and Haproxy (for routing and load balancing). The AlloyDB Omni Primary instance database nodes achieve high availability by replicating data synchronously across multiple zones. To scale out read-heavy workloads without impacting the primary HA cluster, separate Read Pool instances are deployed. These receive Async Replication (asynchronous) from the active node and can be scaled out. 

It shows how an independent control plane manages the entire configuration and health of the clusters. The administrator interacts with the RPM Orchestrator, to oversee the lifecycle of the databases. The control plane includes redundant Cluster Managers and a 3-node etcd based Distributed Configuration Store to reliably maintain cluster state, and manage configurations.  The controllers directly interface with the Node Manager running on each individual database node. For deploying only a single cluster, you may run control and data plane components on the same set of nodes.

High Availability and Read Scalability

Maintaining uptime and scaling reads for demanding workloads is simpler with the RPM orchestrator. It provides a resilient architecture capable of automatically handling failures across the stack, including the ability to handle failure of all Data / Control Path components, Readable Standby, as well as mitigating any network disruptions between the nodes.

The orchestrator now supports read pools for scaling out your read workloads and gives you the ability to create or add read pools to a cluster dynamically to meet the needs of analytical queries or similar workloads. The system also configures dedicated read endpoints for both standby nodes and readpools.

We are continuously expanding the capabilities of the AlloyDB Omni RPM orchestrator. Stay tuned for upcoming features, including advanced enterprise-grade capabilities to further strengthen business continuity and cross-region resiliency.

Data Protection and Security

Data security and recovery are at the core of the RPM Orchestrator. In this release, we have integrated automated backup and restore capabilities that enable you to configure a backup schedule and manage fully automated backup to GCS or S3-compatible storage automatically. The orchestrator allows you to execute backups to S3 or GCS buckets, or locally. Additionally, point-in-time recovery and fully automated in-place PIT restore are natively supported.

The RPM orchestrator supports SELinux enforcement at or after bootstrap to satisfy strict enterprise compliance and security standards and ensure mandatory access control and strong process isolation.

 Database Operations

We’ve reduced the operational overhead associated with managing database fleets:

  • Zero-Hassle Low-Downtime Maintenance: Managing lifecycle updates and scaling operations is easier with the new, fully automated Low Downtime Maintenance (LDTM). Minor version upgrades as well as CPU and memory resource adjustments are executed with minimized downtime and automatic rollback support for maximum availability.

  • Dynamic Configuration: Database administrators can dynamically tune settings without hassle, including the ability to Modify GUCs/configs at or after bootstrap. You can also provision a cluster for AI integrations.

  • Simplified Cluster Maintenance: Managing your cluster footprint is straightforward, with native operational capabilities to add or remove database nodes as your workload demands shift.

Observability, AI, and Extensions

Monitoring and tuning your fleet requires deep visibility and the right set of tools:

  • Advanced Logging: The orchestrator simplifies auditability and debugging by providing Data and Control Path log direction to log disk.

  • Rich Observability: Custom metrics support allows you to fine-tune observability to suit your monitoring ecosystem. With custom metrics, you can track business-level events directly from the database, such as the number of new user registrations per minute, active sessions for a specific tenant, or the volume of orders processed, and export these to your company's central observability platform.

  • AI & Extensions: In addition to the list of extensions supported with AlloyDB Omni, the orchestrator includes support for all AlloyDB Omni's AI features such as query using natural language, AI-powered searches, AI functions, etc. 

Get Started Today

The AlloyDB Omni Red Hat RPM orchestrator offers a new way to manage PostgreSQL-compatible workloads on bare metal or VM platforms, combining the high performance of AlloyDB, access to generative AI features and Gemini models to build AI agents and applications, and full automation.

Ready to elevate your on-premises database operations? Dive into our AlloyDB documentation to get started with the GA release today. Sign-up today !!

You can also try our new codelab to deploy a highly available AlloyDB Omni cluster using the RPM Orchestrator.

Google Cloud Japan Blog

近畿大学と Google Cloud が包括連携協定を締結 - 約 2 万人超へ「Google AI Pro for Education」を導入し、「AI ネイティブ大学」の実現を支援

詳細を表示

Google Cloud は、近畿大学(大阪府東大阪市)と、AI 人材育成モデルの確立ならびに生成 AI を活用した大学運営、学生支援、研究支援の高度化に向け、包括連携協定を締結しました。

本協定に基づく具体的な取り組みとして、全 16 学部の 1・2 年生 19,033 人および教職員 2,105 人、合わせて 21,138 人を対象に、教育機関向け Gemini アプリケーションの有償版である「Google AI Pro for Education」のライセンス導入を Google Cloud がサポートします。また、2026 年度後期の授業開始に合わせて近畿大学が進める、生成 AI 技術を活用した学生支援窓口のオンライン化に向けたトライアルも、Google Cloud が技術面から後押しします。

近畿大学の大規模かつ多様な教育・研究環境と、Google Cloud が提供する生成 AI、クラウド、データ分析などの技術を組み合わせ、AI 人材育成、大学運営、学生支援、研究支援の各領域を横断した「AI ネイティブ大学」の実現を強力に支援してまいります。

【本協定のポイント】

● Google Cloud が近畿大学との包括連携協定を通じて、生成 AI 活用による大学全体の変革を支援

● 全 16 学部の 1・2 年生および教職員合わせて約 2 万人を対象に、「Google AI Pro for Education」のライセンス導入をサポート

● 「AI ネイティブ大学」の実現に向け、AI 人材育成、大学運営、学生支援、研究支援の 4 領域で取り組みを推進

【本件の内容】

近畿大学ではこれまで、従来の教育向け生成 AI サービスの試験導入などを通じて、学生および教職員による生成 AI の活用方法や導入効果を検証してきました。学生の学修支援に加え、教職員による文書作成、要点整理、議事録作成、規程・マニュアルの検索・要約など、さまざまな場面で生成 AI の活用を進めています。

また、学生支援においては、チャットボットやオンライン問い合わせフォームを活用し、対面とオンラインを組み合わせた相談・問い合わせ体制の検証にも取り組んできました。

近畿大学は本協定を機に、これまで培ってきた実績を Google Cloud の技術支援を通じて大学全体の変革へとつなげていきます。

Google Cloud が支援する「AI ネイティブ大学」とは、単に生成 AI サービスを導入するだけではなく、学生と教職員が生成 AI を日常的かつ適切に活用し、AI 人材育成、大学運営、学生支援、研究支援の仕組みそのものを継続的に改善していく大学です。

本協定を通じて、近畿大学は 4 領域で生成 AI を活用した具体的な取り組みを進めます。Google Cloud は、その取り組みを技術面から支えるとともに、そこで得られた知見が国内の高等教育における新たな生成 AI 活用モデルとなることを期待しています。

【近畿大学がめざす 4 つの領域への Google Cloud の支援】

◼︎ AI 人材育成モデルの確立
近畿大学は、自身の持つ多様な教育環境と Google Cloud の生成 AI・クラウド技術を掛け合わせ、全学的な AI 人材育成モデルの確立を目指します。具体的には、全 16 学部の 1・2 年生および教職員の約 2 万人を対象に、「Google AI Pro for Education」のライセンスを導入します。さらに、近畿大学では 2027 年 4 月から全学部で情報リテラシー関連科目を必修化する予定です。Google for Education の協力を得て、生成 AI の仕組み、ファクトチェック、著作権、情報セキュリティ、学術公正などを学ぶこの教育を技術・コンテンツの両面から支援し、学生が専門教育や研究・制作活動において Gemini などの生成 AI を目的に応じて適切に活用できる力の育成を後押しします。

◼︎ AI ネイティブ大学運営モデルの共同構築
近畿大学は、既存業務に生成 AI を追加するにとどまらず、問い合わせ、申請、決裁、文書作成、情報検索、会議運営などの大学業務を生成 AI 活用前提で再設計し、次世代の大学運営モデルの構築を推進します。また、複数のシステムやデータを横断して処理する業務や、複雑な判断・手順を伴う業務、学内 LMS の活用などについて、Gemini Enterprise の AI エージェント機能を活用した自動化・高度化の可能性を Google Cloud とともに検証していきます。

◼︎ AI を活用した「24 時間学生支援モデル」の構築(学生支援窓口のオンライン化)
近畿大学は、2026 年度後期の授業開始に合わせて、AI チャットボット、オンライン問い合わせフォーム、予約制相談を組み合わせた学生支援窓口のオンライン化に向けた移行トライアルを開始します。

学生が時間や場所を問わず必要な情報にアクセスできる環境を目指し、FAQ、学内規程、手続案内、シラバスなどを活用した検索・回答支援の充実に向けた取り組みを、Google Cloud が技術面から後押しします。

◼︎ 研究者と AI が協働する「次世代研究支援基盤」の構築
近畿大学は、論文・研究情報の収集、先行研究の整理、研究データの分析、共同研究者の探索などを支える全学的な研究支援基盤の構築に取り組みます。Google Cloud は、Gemini Enterprise や BigQuery などのサービス提供および技術支援を通じて、研究者と AI が協働する新たな研究環境の創出を支えます。

【近畿大学長 松村 到のコメント】

生成 AI は、知識を得るためのツールにとどまらず、私たちの思考を広げ、学びを深め、新たな価値を生み出す大きな可能性を持っています。一方で、AI が示す答えをそのまま受け入れるのではなく、情報の正確性を確かめ、自ら考え、判断し、責任を持って活用する力が、これまで以上に重要になります。

今回の Google Cloud との包括連携は、単に新しい AI サービスを導入するものではありません。Google Cloud が持つ生成 AI やクラウド、データ活用に関する技術・知見と、本学の大規模かつ多様な教育・研究環境を掛け合わせ、両者が共に新しい大学のあり方を創り上げていく取り組みです。約 2 万人の学生・教職員への「Google AI Pro for Education」の導入を一つの起点として、教育、学生支援、大学運営、研究の各分野において、生成 AI の活用を前提とした「AI ネイティブ大学」の実現をめざします。

近畿大学はこれまで、社会の変化を先取りし、実社会の課題に向き合う「実学教育」を大切にしてきました。生成 AI が社会に広く浸透する時代だからこそ、学生には AI に使われるのではなく、AI を使いこなし、人にしかできない発想や判断、対話を通じて、新しい価値を生み出せる人材へと成長してほしいと考えています。

令和 9 年(2027 年)4 月から全学部で必修化する情報リテラシー関連科目などを通じて、AI の可能性とリスクの双方を正しく理解し、実践的に活用する力を育んでまいります。さらに、学生支援や大学業務、研究支援にも AI 活用を広げ、大学全体の仕組みそのものを進化させていきます。

Google Cloud との共創を通じて、学生、教職員、研究者が安心・安全に AI を活用し、新しい価値を生み出し続ける大学へ。近畿大学はこれからも、実学教育を進化させながら、これからの高等教育の新しい姿を切り拓いてまいります。

【グーグル・クラウド・ジャパン合同会社 執行役員 パブリックセクター & ヘルスケア・ライフサイエンス 事業本部長 和泉 綾志のコメント】

先進的な教育を牽引される近畿大学様との包括連携協定の締結を、大変光栄に思います。

Google Cloud は最先端の AI 技術である Gemini、クラウド基盤そしてセキュアなデータ基盤などを提供することで、学生の皆様がこれからの時代に求められる AI スキルを実践的に学べる教育・研究環境づくりを全面的に支援いたします。

また、教職員の皆様の校務、教務等の業務環境 DX、AX 推進を支え、より質の高い学習体験を提供できる基盤づくりに貢献してまいります。

Google Cloud の技術を活用いただくことで、近畿大学様の実学教育による次世代の AI 人材の育成に貢献してまいります。

<div class="article-module h-c-page">
  <div class="h-c-grid">


<figure class="article-image--large
  
  
    h-c-grid__col
    h-c-grid__col--6 h-c-grid__col--offset-3
    
    
  ">

  
  
    
    <img alt="image3" src="https://storage.googleapis.com/gweb-cloudblog-publish/images/image3_unhmMqN.max-1000x1000.jpg" />
    
    </a>
  
</figure>


  </div>
</div>

Google Cloud Blog (AI & ML)

How Airtel delivered its flawless Indian Premiere League 2026 cricket broadcasts

詳細を表示

For the millions of fervent fans of the Indian Premiere League (IPL), being able to count on a flawless live streaming cricket experience is never up for debate. For Airtel, producing league TV broadcasts with some of the world's most massive concurrent viewership, dropped packets and buffering are simply not options.

During the IPL 2026 season, Airtel partnered with Google Cloud to manage this digital delivery. Across 74 matches, the streaming infrastructure delivered several hundred petabytes of egress data. The final match alone processed tens of billions of requests, hitting a peak egress of several Tbps.

Delivering video under these concurrency spikes requires an edge architecture designed strictly around localization, paired with proactive operational monitoring. 

Our goal for IPL 2026 was to deliver an uninterrupted, stadium-grade viewing experience to cricket fans across India, regardless of concurrency surges or network conditions. Partnering with Google Cloud and using Media CDN gave us deep local edge proximity and excellent cache efficiency. Combined with proactive match-day real-time monitoring, we delivered a reliable broadcast experience from start to finish.

Architecting for concurrency and edge efficiency

<div class="article-module h-c-page">
  <div class="h-c-grid">


<figure class="article-image--large
  
  
    h-c-grid__col
    h-c-grid__col--6 h-c-grid__col--offset-3
    
    
  ">

  
  
    
    <img alt="IPL-BLog-Architecture" src="https://storage.googleapis.com/gweb-cloudblog-publish/images/IPL-BLog-Architecture.max-1000x1000.png" />
    
    </a>
  
</figure>


  </div>
</div>

One of the primary challenges in live sports broadcasting is seamlessly handling large traffic spikes and never degrading stream performance or overwhelming backend origins. That’s especially important when millions of viewers simultaneously tune in during a final over because every millisecond counts.

To accelerate content delivery across India’s diverse ISP landscape, Airtel leveraged Google Cloud’s Media CDN. By utilizing Google’s extensive global edge network, Airtel was able to serve viewer requests from edge locations that were physically close to end users. This deep localization was a cornerstone of the broadcast's success, with 99.9% of all tournament traffic being served locally from within India.

This efficient architecture minimized network hops and reduced transit congestion, translating into remarkable infrastructure and viewer experience metrics throughout the 74 matches:

  • Superior caching efficiency: Airtel saw an overall cache hit ratio exceeding 98%. By effectively absorbing massive viewer traffic load at the edge, origin server/video platform demands remained minimal even during peak playoff viewership.

  • Consistent ultra-low latency: Airtel maintained a p99 latency of < 300 ms during the tournament, which supported fast stream start times and minimized buffering risk during critical game moments.

Proactive strategies for operational readiness

While maintaining an intelligent backend architecture was vital to Airtel’s IPL streaming strategy, it was  only half the equation. Executing high-stakes live broadcasts across 74 consecutive matches also demanded meticulous operational preparation and proactive match-day execution.

Because Airtel and Google Cloud recognized that potential bottlenecks had to be identified long before the first ball, they established a deeply integrated operational support model:

  1. Pre-tournament support readiness reviews: Well ahead of the opening match, joint engineering teams conducted comprehensive support readiness reviews. By auditing traffic projections, reviewing manifest configurations, and validating failover mechanisms early, the teams supported robust client readiness, resulting in low operational friction during the tournament.

  2. Monitoring as a service (MaaS): The teams maintained continuous, proactive telemetry monitoring through MaaS on Media CDN, and real-time observability enabled early detection and mitigation of network shifts before anomalies could impact viewer playback.

  3. Dedicated match-day and weekend support: Live sports don't play by the rules of  standard business hours, so Airtel established comprehensive monitoring protocols for every match. During critical weekend fixtures and the high-stakes playoff stage, Google Cloud’s Technical Account Management and MaaS teams worked hand-in-hand with Airtel engineering to provide dedicated, real-time event support.

A blueprint for live broadcast excellence

Airtel’s successful streaming of IPL 2026 demonstrates that handling extreme concurrency is only possible with an integrated strategy across architecture, edge localization, and operational governance. By combining a 98%+ cache hit ratio with 99.9% local delivery and proactive match-day monitoring, Airtel hit a benchmark for live sports broadcasting at scale.

This deployment provides an overview of the technical architecture and operational strategies involved in scaling live media delivery for high-concurrency events. To learn more about optimizing live broadcasts and edge delivery, review the Media CDN developer documentation.

Google is a Leader in the 2026 Gartner® Magic Quadrant™ for Enterprise AI Assistants

詳細を表示

We are excited to share that Gartner has named Google a Leader in its inaugural 2026 Magic Quadrant for Enterprise AI Assistants. In this comprehensive evaluation of top enterprise AI assistant vendors, Gartner placed Google in the Leaders quadrant for its evaluation across both Completeness of Vision and Ability to Execute.

Gemini Enterprise helps organizations bring helpful, secure AI directly into the daily work of their employees. It moves teams past basic chat interactions to automating multi-step, end-to-end workflows with AI agents. It connects with the tools and infrastructure companies already use and scales easily and cost-effectively, all with security and governance in place. 

We see this recognition from Gartner as validation of our goal: creating a unified platform where everyone — from business users to developers — can work alongside AI agents to accomplish more together.

<div class="article-module h-c-page">
  <div class="h-c-grid">


<figure class="article-image--large
  
  
    h-c-grid__col
    h-c-grid__col--6 h-c-grid__col--offset-3
    
    
  ">

  
  
    
    <img alt="[High Res] Gartner EAIA Magic Quadrant" src="https://storage.googleapis.com/gweb-cloudblog-publish/images/High_Res_Gartner_EAIA_Magic_Quadrant.max-1000x1000.png" />
    
    </a>
  
</figure>


  </div>
</div>

Our take on Google as a Leader

Amid a complex landscape of standalone AI tools and emerging platforms, Gemini Enterprise emerges as a unified, open agentic platform backed by Google’s full AI stack, with strengths mentioned in the report such as:

  • Unified “AI front door”: Gemini Enterprise unifies enterprise chat and search, first and third-party agents, a no-code agent designer, Google Workspace integration, and third-party connectors all in one platform, eliminating the need for organizations to piece together disparate AI tools.

  • Open connectivity: Gemini Enterprise offers extensive connectivity beyond Google's ecosystem — extending to Microsoft 365, other third-party software, and internal enterprise data sources. This open connectivity lets organizations adopt Gemini Enterprise alongside their existing infrastructure without costly system overhauls.

  • Simple economics: Gemini Enterprise offers a straightforward pricing model, with actions like chat and search included in the base SKU. Organizations can select per-user seat subscriptions, as well as a pay-as-you-go option that lets users run agent workloads without hitting quota limits mid-task.

  • Built-in governance: Gemini Enterprise provides robust agent governance out-of-the- box at no extra cost, enabling enterprises to seamlessly manage users, agents, and data permissions while curbing security risks and agent sprawl.

  • Full-stack depth and scale: Google’s vertically-integrated stack provides global infrastructure, custom silicon, world-class models, and a secure, enterprise-ready foundation — all optimized for security, interoperability, and cost. 

To read the full report, download it here.

Accelerating our vision with the latest Gemini Enterprise advancements

Over the past months, we have accelerated Gemini Enterprise with significant product advancements:

  • Tailored industry solutions: We introduced specialized solutions for legal and financial services last month. These tailored solutions bring pre-built agents, domain-specific skills, secure data connectors, and an open partner ecosystem, allowing for rapid deployment. They are also built on top of Gemini Enterprise’s governed control plane so you can create and manage workflows in these highly regulated industries. 

  • Google Antigravity in Gemini Enterprise: With the introduction of AI developer tools in Gemini Enterprise, enterprises can now easily enable agentic dev tools like Antigravity and Android Studio for their developer teams with eligible Gemini Enterprise licenses, and maintain full governance and observability inside the admin console.

  • FinOps and cost controls: New FinOps and cost-control capabilities were introduced last month, allowing organizations to optimize AI spend through more pricing options, Flexible Savings Plans, and granular spend management.

Gemini Enterprise customers are also seeing the value

Hearing this recognition from Gartner is great, but it's not just them—our customers are seeing this real-world value too, and it's driving a positive impact across their organizations every day. 

Check out what our customers are saying about the recent product advancements.

“Deploying Antigravity in Gemini Enterprise allows Accenture to arm our engineers with Google DeepMind’s premier technology on the secure, trusted foundation of Google Cloud. Abstracting away operational complexity ensures our teams don't have to choose between developer speed and enterprise-grade governance — freeing them to deliver high-velocity engineering and transformative value for our clients.” — Chetna Sehgal, Global Practice Lead, Accenture Google Business Group. Learn more here. 

“Cleary is committed to embedding AI into our workflows in strategic and competitive ways. Using Google’s Gemini Enterprise, which can slot in seamlessly with other daily work tools, we can unlock greater efficiencies for our teams and help them deliver even higher quality work for our clients.” — Jeff Karpf, Managing Partner, Cleary Gottlieb. Learn more here.

“As a design partner for the Financial Research agent, Deutsche Bank has helped shape this capability in view of the realities of a highly regulated industry – from data protection and governance to the workflows our teams use every day,” – Marie-Jeanne Deverdun, Chief Technology, Data and Innovation Officer, and Member of the Deutsche Bank Management Board. Learn more here. 

“We’re thrilled to partner with Google Cloud in the early adoption of Gemini Enterprise for Legal. We look forward to integrating Google’s technology to streamline workflow and further support our litigators in shaping outcomes critical to our clients’ futures.” — Joe Petrosinelli, Chairman, Williams & Connolly. Learn more here.

Get started today

GKE Security Bulletins

GCP-2026-061

詳細を表示

Published: 2026-09-09

Reference: GHSA-p7v4-vr35-mj6f

Description Severity

A security vulnerability GHSA-p7v4-vr35-mj6f (CVE assignment pending) in containerd's CRI implementation allows a container restored from an untrusted checkpoint through the CreateContainer API to bypass the destination security context and execute with elevated privileges. When restoring a container from a checkpoint archive or annotated OCI image, CRIU restores process credentials, Linux capabilities, no_new_privs, and seccomp state directly from checkpoint data rather than enforcing the destination CRI ContainerConfig. An attacker who can run a container with a crafted checkpoint image can execute processes as the root user with full capabilities and no enforced seccomp filters despite restrictive security policies requested by the orchestrator. Additionally, containerd's CRI status reporting reflects the requested configuration rather than the actual restored process state, masking the privilege discrepancy from orchestrators.

GKE clusters are not vulnerable by default. GKE node images do not include the criu tool. Implicit container restore is not supported without criu installed on the node. Standard container creation operations in GKE Standard and GKE Autopilot remain unaffected. GKE Autopilot clusters do not support custom runtime configuration and are not impacted.

Additionally, Pod snapshots in GKE do not exercise the vulnerable implicit restore codepath.

In updated containerd versions (2.3.4 and later, or 2.2.7 and later), implicit restore is disabled by default through the enable_experimental_restore_via_create configuration option. Version 2.4 of containerd will remove this codepath completely in favor of the explicit Pod-level restore API (KEP-5823).

What should I do?

Because GKE does not include the criu binary on default node images, no immediate cluster upgrades or configuration changes are required for default workloads.

If you install custom runtime software or node tools on your nodes that include the criu binary, consider taking the following actions as appropriate for your environment:

  • Re-create existing restored containers: Stop, delete, and re-create any running containers that were restored from untrusted checkpoints.
  • Disable experimental restore (containerd 2.3.4 and later, or 2.2.7 and later): If operating nodes with containerd (2.3.4 and later, or 2.2.7 and later) and custom criu installations, ensure the enable_experimental_restore_via_create configuration option remains set to false in your containerd node configuration.
  • Audit containerd logs: If criu is installed, inspect node logs for implicit restore log entries containing search strings such as "Found checkpoint of container", "Prepared <id> for restore", or "Restored container <id> successfully".
  • Monitor deprecation warnings for containerd: Look for the following deprecation warning event: io.containerd.deprecation/cri-create-container-checkpoint-restore.
  • Restrict Pod creation permissions: Ensure Kubernetes RBAC restricts Pod creation permissions (create pods) strictly to trusted users and service accounts.
  • Enforce trusted image registries: Ensure that the values for the Pod's image: field reference verified image repositories.
  • Prepare for KEP-5823: Update operational procedures to rely on explicit Pod-level Checkpoint or Restore APIs after they are available in future Kubernetes releases.
Medium