Welcome to issue #371 November 6th, 2023

News

Ingress traffic to your GKE fleet with the Multi-cluster Gateway controller, now GA - Today, we are excited to announce the general availability of the Multi-cluster Gateway controller for GKE, which natively supports the deployment of a unified Application Load Balancer for a fleet of GKE clusters using the Kubernetes Gateway API.

Build your own gen AI-powered vector search applications with Vertex AI Search - Introducing new features and improvements to Vertex AI Search.

Vertex AI Search adds new generative AI capabilities and enterprise-ready features

Looker Studio Pro now available for Android and iOS - Today, we are bringing Looker Studio Pro to your mobile devices through a new application available for Android on Google Play and for iOS on the App Store, enabling you to view reports and get real-time data about your business from anywhere.

Gain access visibility and control with Access Transparency and Access Approval

Artifact Registry remote and virtual repositories are now generally available - Remote repository and virtual repository features are now generally available.

Develop your cloud skills this November with no-cost training - During November, we are featuring no-cost, on-demand and live training videos and courses for both technical and non-technical roles.

Detecting data deletion and threats to backups with Security Command Center - With new Backup and Disaster Recovery integration, customers can now receive automated alerts for events that threaten security posture.

Introducing React components for the Maps JavaScript API - The alpha release of @vis.gl/react-google-maps, the first Google-sponsored library for integrating Maps JavaScript API components in a React web app.

Advanced Markers, now available for iOS and Android: Easily customize your markers across platforms - In May, we made Advanced Markers generally available for the Maps JavaScript API and today we are announcing support for Android and iOS, enabling developers to build experiences that are consistent across platforms.

New educational lab for Security Command Center can help address security talent gap - To address the chronic shortage of security talent, Google Cloud has introduced a new virtual, lab-based training for Security Command Center. The new lab, Mitigate Threats and Vulnerabilities with Security Command Center, has no security knowledge prerequisites and can be completed in just six hours.

Articles, Tutorials

Infrastructure, Networking, Security, Kubernetes

A decade of Kubernetes leadership: why Google Cloud should be your choice for Kubernetes

Priority-based scheduling between node pools - In this blog we’ll discuss how to use four different node pools: E2 standard, N2 standard, N2d standard and N2 standard (spot VMs) to deploy workloads and help reduce costs for running a production workload.

reCAPTCHA Enterprise and Descope combine no-code authentication and fraud prevention - reCAPTCHA integrates with Descope, a comprehensive platform that allows developers to add authentication and user management capabilities to their consumer and business apps.

Cloud CISO Perspectives: It’s a multicloud jungle out there. Here’s how your security can survive — and thrive - A second Cloud CISO Perspectives for October 2023 about what security and business leaders need to know about securing our multicloud present and future.

Terraforming shared VPC (host & services), GCP private service access and firewall rules (5/17) - In this article, you will learn to create the network foundation for your organization.

Discovery and Mapping Your As-Is to Cloud, Using Cloud Migration Center (Google Cloud Adoption Series: Part 4A) - Discovery, Application-to-Infra Mapping, and Google Cloud Migration Center.

Terraform As A Service: Google Infrastructure Manager - An overview and walkthrough of Inftrastructure Manager.

Get real-time notifications on IAM privilege grants in Google Cloud - This blog shows how you can get alerted in real-time whenever new access permissions are granted across your Google Cloud environment.

Exposing gRPC services through GKE Ingress: A step-by-step guide - This blog post describes how to expose gRPC services through GKE Ingress.

GKE: The new home for your batch platform - Today’s post is the first in a series that will provide the reasons for why administrators and architects should build batch processing platforms on Google Kubernetes Engine (GKE).

App Development, Serverless, Databases, DevOps

Zero-downtime scaling with Memorystore for Redis Cluster: under the hood - This blog is the first of a series discussing the enhancements made to Redis Cluster.

Automate plant maintenance using MDE with ABAP SDK for Google Cloud - Manufacturing Data Engine (MDE) is a scalable solution that accelerates, simplifies, and enhances the ingestion, processing, contextualization, storage, and usage of manufacturing data for monitoring, analytical, and machine learning use cases.

How to properly — and easily — do data disk migrations to Google Cloud - In this blog post, we walk through how to use Migrate to Virtual Machines, which is built into Google Cloud’s Migration Center, for a fast, easy way to successfully migrate data disks to Google Cloud.

Dynamically building docker image for cloud workstation with Github actions - Setting up a remote development environment on cloud workstation — Part3.

Secure Your GitLab CI/CD Pipelines: Moving Away from Service Account Keys - Optimize your security practices with Workload Identity Federation at the branch level and ditch those risky JSON keys.

KYC - Know your Container(image) with SLSA, SBOM and Binary Authorization - In this blog post we take a practical spin at container security and look at SLSA buid attestations, SBOM, and Binary Authorization in GCP.

Big Data, Analytics, ML&AI

SQL-only ML Predictions in Spanner with Vertex AI Integration - In this blog, we will explore the steps to perform ML predictions from Spanner using a model deployed in Vertex AI. This is possible by registering the ML model in Spanner that has already been deployed to a Vertex AI endpoint.

Key considerations for evaluating AI-powered tools for enterprise developers

How TEKsystems Global Services is helping retail brands break down data silos through platform modernization - A break down of what retail brands experience and how Google Cloud can help overcome these challenges.

Built with BigQuery: Expedite GTM insights with ZoomInfo B2B data in Analytics Hub

Built with BigQuery: Drive growth through data monetization - Companies shares key ways they are using BigQuery and Google Data and AI Cloud to drive growth through data monetization.

Built with BigQuery: How Tausight enables ePHI security at scale - Tausight is healthcare startup that built their platform on GCP.

How Looker helps startups uncover data-driven insights - An overview of Looker, a business intelligence and data analytics platform.

Reduce costs and improve job run times with Dataproc autoscaling enhancements - This blog post highlights the cost and job performance improvements resulting from Dataproc autoscaling enhancements, without the administrator needing to change the cluster configuration or autoscaling policy.

Reshaping Flipkart’s technological landscape with a mammoth cloud migration - Flipkart migrated their data platform to GCP.

Migrating Geospatial Data to BigQuery - A review of common hurdles one may stumble at when moving data from another system to BigQuery Geospatial.

Data analytics in the age of AI: How we’ve enhanced our data platforms this year - In this blog, we will summarize the key innovations to our Data and AI Cloud in 2023 across three strategic areas.

Automating the redaction from PDF files using GCP - Redact and mask data from PDF files at scale using GCP.

Background Change with Imagen on Vertex AI : A Step-by-Step Guide - With Imagen on Vertex AI, application developers can build next-generation AI products that transform their user’s imagination into high quality visual assets, in seconds.

Securely Exposing Vertex AI APIs using Cloud Run and Cloud Endpoints - This blog post describes how to expose a secure API connection to Vertex AI APIs by deploying a Cloud Endpoint on a Cloud Run instance.

Slides, Videos, Audio

Security Podcast - #145 Cloud Security: Shared Responsibility, Shared Fate, Shared Faith?

GCP Life Podcast - #52 “Sounds like technobabble to me!“ – In this episode we discuss; Kurian Award, Google Undersea Cable, Q3 Results, MS Crushing Google, Falcon, GKE HA, WinRAR Exploit, AFP Members at risk, NDIS HWLE Breach, Okta Breach, Frontier Model Forum, Anthropic Startup, Silicon Valley & Europe.

Releases

Anthos clusters on bare metal - 1.15. Release 1.15.6 Anthos clusters on bare metal 1.15.6 is now available for download. Functionality changes: Removed hardcoded timeout value for the bmctl backup operation. Fixes: Fixed a memory leak in Dataplane V2. Fixes: Fixed the following vulnerabilities: Critical container vulnerabilities: CVE-2022-1996 High-severity container vulnerabilities: CVE-2019-11253 CVE-2020-8558 CVE-2021-20206 CVE-2021-25741 CVE-2022-3064 CVE-2022-39189 CVE-2023-1380 CVE-2023-2007 CVE-2023-2124 CVE-2023-3090 CVE-2023-3111 CVE-2023-3268 CVE-2023-3390 CVE-2023-3609 CVE-2023-3611 CVE-2023-3776 CVE-2023-4128 CVE-2023-4206 CVE-2023-4207 CVE-2023-4208 CVE-2023-21255 CVE-2023-28840 CVE-2023-34319 CVE-2023-35001 CVE-2023-35788 CVE-2023-40283 Medium-severity container vulnerabilities: CVE-2019-11250 CVE-2019-11251 CVE-2020-8554 CVE-2020-8555 CVE-2020-8561 CVE-2020-8564 CVE-2020-21047 CVE-2021-4235 CVE-2021-25735 CVE-2022-4269 CVE-2022-40982 CVE-2022-46146 CVE-2023-1206 CVE-2023-2002 CVE-2023-2269 CVE-2023-3212 CVE-2023-3338 CVE-2023-3863 CVE-2023-4132 CVE-2023-4194 CVE-2023-4273 CVE-2023-20569 CVE-2023-20593 CVE-2023-28841 CVE-2023-28842 CVE-2023-31084 CVE-2023-41333 Low-severity container vulnerabilities: CVE-2020-8562 CVE-2021-25740 CVE-2021-32292 CVE-2022-45886 CVE-2022-45887 CVE-2022-45919 CVE-2023-2156 CVE-2023-2898 CVE-2023-3141 CVE-2023-3389 CVE-2023-3610 CVE-2023-3777 CVE-2023-4004 CVE-2023-4147 CVE-2023-21400 CVE-2023-31248 CVE-2023-34242 CVE-2023-34256 CVE-2023-35823 CVE-2023-35824 CVE-2023-35828 CVE-2023-35829 CVE-2023-41332 GHSA-qq97-vm5h-rrhg. Known issues: For information about the latest known issues, see Anthos clusters on bare metal known issues in the Troubleshooting section. 1.16. Release 1.16.2 Anthos clusters on bare metal 1.16.2 is now available for download. Functionality changes: Increased the certificate time to live (TTL) for metrics-providers-ca and stackdriver-prometheus-scrape for third-party monitoring. Fixes: Fixed the spec.featureGates.annotationBasedApplicationMetrics feature gate in the stackdriver custom resource to enable collection of annotation-based workload metrics. The following container image security vulnerabilities have been fixed in release 1.16.2: High-severity container vulnerabilities: CVE-2019-11253 CVE-2020-7919 CVE-2020-8558 CVE-2020-9283 CVE-2021-25741 CVE-2021-27918 CVE-2022-39189 CVE-2022-41721 CVE-2023-1380 CVE-2023-2007 CVE-2023-2124 CVE-2023-3090 CVE-2023-3111 CVE-2023-3268 CVE-2023-3390 CVE-2023-3609 CVE-2023-3611 CVE-2023-3776 CVE-2023-4128 CVE-2023-4206 CVE-2023-4207 CVE-2023-4208 CVE-2023-21255 CVE-2023-28840 CVE-2023-34319 CVE-2023-35001 CVE-2023-35788 CVE-2023-40283 GHSA-74fp-r6jw-h4mp Medium-severity container vulnerabilities: CVE-2019-11250 CVE-2019-11251 CVE-2019-11254 CVE-2020-8554 CVE-2020-8555 CVE-2020-8561 CVE-2020-8564 CVE-2020-8911 CVE-2020-14040 CVE-2020-21047 CVE-2021-3114 CVE-2021-25735 CVE-2022-2582 CVE-2022-4269 CVE-2022-40982 CVE-2022-46146 CVE-2023-1206 CVE-2023-2002 CVE-2023-2269 CVE-2023-3212 CVE-2023-3338 CVE-2023-3863 CVE-2023-4132 CVE-2023-4194 CVE-2023-4273 CVE-2023-20569 CVE-2023-20593 CVE-2023-28841 CVE-2023-28842 CVE-2023-31084 CVE-2023-40577 CVE-2023-41333 GHSA-2w8w-qhg4-f78j GHSA-76wf-9vgp-pj7w GHSA-rm8v-mxj3-5rmq Low-severity container vulnerabilities: CVE-2020-8562 CVE-2020-8912 CVE-2021-25740 CVE-2021-32292 CVE-2022-45886 CVE-2022-45887 CVE-2022-45919 CVE-2022-48554 CVE-2023-2156 CVE-2023-2898 CVE-2023-3141 CVE-2023-3389 CVE-2023-3610 CVE-2023-3777 CVE-2023-4004 CVE-2023-4147 CVE-2023-21400 CVE-2023-31248 CVE-2023-34242 CVE-2023-34256 CVE-2023-35823 CVE-2023-35824 CVE-2023-35828 CVE-2023-35829 CVE-2023-41332 GHSA-qq97-vm5h-rrhg. Known issues: For information about the latest known issues, see Anthos clusters on bare metal known issues in the Troubleshooting section.

Anthos clusters on Azure - You can now launch clusters with the following Kubernetes versions 1.25.14-gke.700, 1.26.9-gke.700, 1.27.6-gke.700.

Anthos clusters on VMware - Anthos clusters on VMware 1.15.6-gke.25 is now available. The following vulnerabilities are fixed in 1.15.6-gke.25: Critical container vulnerabilities: CVE-2023-38408 High-severity container vulnerabilities: CVE-2023-43787 CVE-2023-28840 CVE-2023-34241 CVE-2023-3341 Container-optimized OS vulnerabilities: CVE-2023-4623 CVE-2023-42753 CVE-2023-4622 CVE-2023-38545 CVE-2022-48560 CVE-2023-4921 Ubuntu vulnerabilities: CVE-2023-38545 CVE-2023-38546 CVE-2023-1206 CVE-2023-20569 CVE-2023-2156 CVE-2023-3338 CVE-2023-38432 CVE-2023-3863 CVE-2023-3865 CVE-2023-3866 CVE-2023-4132 CVE-2023-4155 CVE-2023-4194 CVE-2023-4273 CVE-2023-44466 Windows vulnerabilities: CVE-2023-3893.

Apigee X - On November 3, 2023, we updated the following security bulletin: Bug ID Description 304599411 Security bulletin updated GCP-2023-32 A Denial-of-Service (DoS) vulnerability was recently discovered in multiple implementations of the HTTP/2 protocol (CVE-2023-44487), including the Apigee Ingress (Anthos Service Mesh) server used by Apigee X. The shutdown of the Configurable API Proxy (Preview) feature is approaching.

Artifact Registry - Artifact Registry remote repositories now support authentication to Docker Hub upstream repositories.

Cloud Asset Inventory - The following resource types are now publicly available through the ExportAssets, ListAssets, BatchGetAssetsHistory, QueryAssets, and Feed APIs: iam.googleapis.com/PolicyV2.

BigQuery - BigQuery now supports text analysis configuration options for the following: CREATE SEARCH INDEX DDL Existing LOG_ANALYZER and new PATTERN_ANALYZER analyzers, which are used in various functions, including SEARCH New TEXT_ANALYZE function BigQuery now also provides support for the following advanced processing functions: ML.BAG_OF_WORDS ML.TF_IDF BAG_OF_WORDS TF_IDF COSINE_DISTANCE EUCLIDEAN_DISTANCE EDIT_DISTANCE These features are now in preview. The following INFORMATION_SCHEMA views that show metadata for table storage usage are now in preview: Use the TABLE_STORAGE_USAGE_TIMELINE view to get total billable bytes per table per day at the project level. You can now use cached results from the same query issued by other users in the same project when you use Enterprise or Enterprise Plus edition. BigQuery support for change data capture (CDC) by processing and applying streamed changes in real-time to existing data using the BigQuery Storage Write API is now generally available (GA). You can now use data manipulation language (DML) to modify rows that have been recently written by the Storage Write API. The BigQuery Data Transfer Service can now transfer data from Azure Blob Storage into BigQuery. The administrative resource charts now supports the following features in preview: View your resource utilization chart at the project level.

Chronicle - Some supported default parsers have changed. Chronicle Curated Detections has been enhanced with new detection content for Google Cloud threats.

Access Transparency - Access Transparency supports Agent Assist in the GA stage.

Cloud Composer - Cloud Composer 2.5.0 release started on October 30, 2023. Bring your own bucket feature is now generally available (GA). Directories with names ending in .py are no longer synchronized. Fixed the cause of workers and schedulers failing when Cloud Storage objects with invalid filesystem names are synchronized. Fixed the validation of the constraints/gcp.restrictServiceUsage Organization Policy constraint. The apache-airflow-providers-google package is upgraded to version 10.10.0 in images with Airflow 2.6.3 and 2.5.3. In November 2023, newly created Cloud Composer 2 environments will stop storing task logs in the environment's bucket by default: Task logs will be available in Cloud Logging and Airflow UI. The default version of Airflow is changed to 2.6.3. Airflow 2.4.3 is no longer included in Cloud Composer images. Cloud Composer 2.5.0 images are available: composer-2.5.0-airflow-2.5.3 composer-2.5.0-airflow-2.6.3 (default). Cloud Composer versions 2.0.29 and 1.19.12 have reached their end of full support period.

Confidential VM - Confidential Space.

Compute Engine - The h3-node-88-352 sole-tenant node type is now Generally Available. Generally available: When assigning a custom queue count for the receive and transmit queues for a vNIC, under certain conditions, you can configure a number of custom queue counts that exceeds the number of vCPUs allocated to the VM. Preview: Advanced maintenance control for sole-tenancy lets you control planned maintenance events for sole-tenant node groups and minimise maintenance-related disruptions.

Data Fusion - The Cloud Data Fusion version 6.8.3.1 patch release is generally available (GA). The Cloud Data Fusion version 6.9.2.1 patch release is generally available (GA).

Dataproc - Announcing the Preview release of Dataproc Flexible VMs. New Dataproc on Compute Engine subminor image versions: 2.0.82-debian10, 2.0.82-rocky8, 2.0.82-ubuntu18 2.1.30-debian11, 2.1.30-rocky8, 2.1.30-ubuntu20, 2.1.30-ubuntu20-arm. Increased the TTL for Dataproc on Compute Engine custom images from 60 days to 365 days. Fixed Knox rewrite rules for Zeppelin URLs in some cases in the latest 2.0 and 2.1 Dataproc on Compute Engine image versions.

Cloud Deploy - Cloud Deploy support for deploy hooks is now generally available.

Dialogflow - Data store agents now support additional languages and regions. Dialogflow CX now supports the DIVIDE and MULTIPLY system functions.

Error Reporting - Troubleshooting errors with Duet AI assistance is now generally available.

Cloud Filestore - The zonal service tier is now generally available.

Google Kubernetes Engine - A bug that caused failures when many concurrent operations were run on the same cluster (such as when creating multiple node pools) has been fixed. GKE multi-cluster Gateway is now generally available in GKE versions 1.24 and later for GKE Standard clusters, and versions 1.26 and later for GKE Autopilot clusters. You can now use GKE node service account insights to troubleshoot common GKE node service account issues.

Cloud Logging - Summarizing log entries with Duet AI assistance is now generally available.

Cloud Monitoring - Synthetic monitors are now GA.

Network Intelligence Center - Network Analyzer now includes an insight that gives a summary of the Google Kubernetes Engine (GKE) node service account.

Retail Recommendations AI - Retail API: Configure logging You can configure which service logs are written to Cloud Logging.

Cloud Run - Job overrides are now at general availability (GA).

Secret Manager - Preview: Key Access Justifications is now available in preview with Secret Manager.

Service Mesh - 1.19.x. 1.19.3-asm.0 is now available for in-cluster Anthos Service Mesh.

Cloud Shell - Duet AI for Cloud Shell is now available.

SAP Solutions - Google Cloud storage manager for SAP HANA standby nodes version 2.6 Version 2.6 of the Google Cloud storage manager for SAP HANA standby nodes is now available.

Cloud Spanner - Table and index operations statistics are now generally available. The Cloud Spanner ExecuteBatchDml API now applies optimizations to groups of statements within a batch to enable faster and more efficient data updates.

Cloud SQL Postgres - The rollout of the following items is complete: The oracle_fdw extension, version 1.2 The minor versions, extension versions, and plugin versions listed in the September 21 release note.

Cloud Storage Transfer - Storage Transfer Service has updated transfer agent behavior when transferring to Cloud Storage.

Cloud Storage - The Autoclass feature can now be enabled for existing buckets.

Cloud Text-to-Speech - Cloud Text-to-Speech now offers en-GB Studio voices: en-GB-Studio-B and en-GB-Studio-C.

Vertex AI - The following models have been added to Model Garden: ImageBind: Multimodal embedding model. Model Garden Improved language model serving throughput. Generative AI support on Vertex AI Generative AI on Vertex AI can be accessed through 12 regional APIs in North America, Europe, and Asia. Inline code completion with Duet AI assistance is now generally available (GA). Deep Learning VM Images is a set of prepackaged virtual machine images with a deep learning framework that are ready to be run out of the box.

VPC Service Controls - General availability support for the following integration: Duet AI in Google Cloud.

Workflows - Workflows is available in the following additional region: europe-west10 (Berlin, Germany).