Welcome to issue #442 March 17th, 2025

News

Announcing Gemma 3 on Vertex AI - Gemma 3, a large language model, is now available on Vertex AI Model Garden. You can fine-tune Gemma 3 to your use case using Vertex AI's pre-built containers and deployment tools. Gemma 3 supports Parameter-Efficient Fine-Tuning (PEFT) and optimized deployment using vLLM on Vertex AI Model Garden, allowing for faster and more efficient fine-tuning and deployment.

Streamlined Security: Introducing Network Security Integration - Google Cloud introduces Network Security Integration, a solution that simplifies the integration of third-party network appliances or services with Google Cloud workloads. It enables consistent policies across hybrid and multicloud environments without changing routing policies or network architecture.

ScaNN for AlloyDB: The first PostgreSQL vector search index that works well from millions to billion of vectors - ScaNN for AlloyDB, the first Postgres-based vector search extension, supports vector indexes of all sizes, providing fast index builds, transactional updates, small memory footprint, and accurate and fast search. It outperforms pgvector HNSW, especially for large datasets, with up to 60x lower cost for index builds and 10x better latency when indices don't fit in memory.

Introducing tiered storage for Spanner - Spanner tiered storage is a new capability that lets you use larger datasets with Spanner by striking the right balance between cost and performance. It introduces a new storage tier based on hard disk drives (HDD) that is 80% cheaper than the existing tier based on solid-state drives (SSD).

Project Shield makes it easier to sign up, set up, automate DDoS protection - Project Shield, a free DDoS protection service from Google Cloud, has made several improvements to simplify the process of signing up, setting up, and automating protection for websites. The application process has been streamlined with real-time checks and improved navigation on mobile devices.

Companies achieve stronger results with Customer Engagement Suite, plus new AI-enabled capabilities - Google’s Customer Engagement Suite is helping companies deliver significant business impact, from boosting customer satisfaction to streamlining operations and reducing costs. New AI-enabled capabilities make building AI agents easier, help customer service representatives be more productive, and streamline contact center operations.

How Google Cloud measures its climate impact through Life Cycle Assessment (LCA) - Google Cloud uses Life Cycle Assessment (LCA) to measure its climate impact. LCA evaluates the environmental impact of a product or service throughout its entire life cycle, from raw material extraction to end-of-life treatment.

---

Webinar

Cut Kubernetes Costs: 4 Key Questions Every CFO Should Ask Their Engineering Leader

As a trusted Google Cloud partner of over a decade, DoiT delivers cloud optimization technology and unrivaled cloud expertise to help customers take full advantage of the public cloud. In this webinar, we’ll break down the four most common drivers of waste in containerized workloads and give you the exact questions to ask your engineering leader to take action. You’ll walk away with a CFO-friendly framework for tackling Kubernetes cost overruns, improving cloud efficiency, and strengthening collaboration between Finance and Engineering. Register

---

Articles, Tutorials

Infrastructure, Networking, Security, Kubernetes

Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers - In mid 2024, Mandiant discovered threat actors deployed custom backdoors on Juniper Networks’ Junos OS routers. Mandiant attributed these backdoors to the China-nexus espionage group, UNC3886.

Unraveling Time: A Deep Dive into TTD Instruction Emulation Bugs - Time Travel Debugging (TTD) is a powerful record-and-replay debugging framework for Windows user-mode applications. The analysis emphasizes the need for reliability in debugging tools, the impact on threat analysis, and the importance of collaboration and continuous improvement in maintaining the integrity and security of analysis tools.

Google SecOps Anonymization Pipeline on Google Cloud - Securely migrate SecOps logs from production to development with a Google Cloud anonymization pipeline leveraging a Terraform blueprint.

GKE Custom Compute Class API - GKE Custom Compute Class API allows users to define custom node configurations for their workloads in Google Kubernetes Engine (GKE). It provides granular control over infrastructure choices, ensuring applications always have the resources they need.

Back to basics — Simplifying Kubernetes concepts (Part 2) - Understanding Kubernetes components with an accelerated approach.

GKE weighted load balancing : what and how - The idea of this blog is to see in action how external load balancing works in GKE and how actually load is distributed by default.

Level Up Your Caching Game: Diving Deep into Google Cloud CDN Cache Tags - Google Cloud CDN cache tags allow you to invalidate cached content based on arbitrary metadata, providing granular control and improved performance for dynamic web applications. By attaching tags to cached objects, you can selectively invalidate only the content associated with specific tags, reducing over-invalidation and improving cache hit ratio.

App Development, Serverless, Databases, DevOps

Protecting your APIs from OWASP’s top 10 security threats - APIs are a vital part of modern services, but without proper security measures, organizations face increased cyberattack risks. OWASP's top 10 API security threats provide a starting point for organizations to address critical vulnerabilities.

How to deploy serverless AI with Gemma 3 on Cloud Run - Gemma 3, a family of lightweight, open AI models, is now available on Cloud Run. Gemma 3 is engineered for exceptional performance with lower memory footprints, making it ideal for cost-effective inference workloads.

Juggling Google Cloud Projects Like a Pro - Reduce the friction when working with multiple Google Cloud profiles.

Migrate Microsoft AD on GCP - This article discusses the best methods for migrating Microsoft Active Directory, including leveraging Google Cloud's fully managed Microsoft Active Directory service, installing and managing your own Active Directory on a GCE, keeping Active Directory on-premises, adding a Read-Only Domain Controller and shifting, implementing a full-copy Active Directory on GCP, or installing a new Active Directory domain on GCP.

Auto-Update Cloud Run Base Images - Cloud Run's automatic base image updates feature allows Google to automatically patch the operating system and language runtime components of your base image without requiring you to rebuild or redeploy your service. This feature ensures that your applications are always running on the latest secure base image, reducing the risk of vulnerabilities and improving overall security.

Ollama on Cloud Run with GPU in less than 20 seconds!

Cloud Run Revision Tags: Secure Routing and Automation

Big Data, Analytics, ML&AI

Introducing partial ordering mode for BigQuery DataFrames (bigframes) - BigQuery DataFrames introduces a new feature called partial ordering mode, which prevents the creation of a deterministic ordering and sequential index. This optimization allows for faster and more efficient data processing by pushing down row and column filters, especially on large clustered and partitioned tables.

Slowly Changing Dimensions in GCP: A Comprehensive Guide - This article explores how to efficiently implement Slowly Changing Dimensions using BigQuery and Dataflow. We will cover different types of SCDs, including Type 0 (Retain Original Data), Type 1 (Overwrite with Latest Data), Type 2 (Maintain Full History), Type 3 (Store Previous Data in Additional Columns), Type 4 (History in a Separate Table), and Type 6 (Hybrid Approach). We will also discuss how to implement SCD using Dataflow for real-time processing.

BigQuery data preparation: A Step-by-Step Guide - Learn how to use BigQuery data preparation, an AI-powered visual interface to transform raw data into analysis-ready tables.

Spark Stored Procedures in BigQuery: A Practical Guide That Works (Part 1) - A step-by-step practical guide to setting up serverless Spark stored procedures in BigQuery that actually works.

A Non-Obvious Partition Pruning Technique in BigQuery - By creating an index table and using partition pruning, it's possible to significantly reduce the amount of data scanned and slots used when retrieving specific transactions by their IDs.

10 months to innovation: Definity's leap to data agility with BigQuery and Vertex AI - Definity Insurance migrated its data platform to Google Cloud's BigQuery and Vertex AI in just ten months, achieving exceptional user satisfaction and significant cost savings. The migration improved performance, increased agility and innovation, and unlocked new analytical possibilities.

How SIGNAL IDUNA supercharges customer service with gen AI - SIGNAL IDUNA, a leading German full-service insurer, has introduced a cutting-edge AI knowledge assistant, powered by Google Cloud generative AI, to supercharge customer service. The AI assistant empowers service agents to quickly and accurately resolve complex customer inquiries, particularly those about health insurance, reducing the time spent searching for relevant information by 30%.

LangGraph meets Vertex AI: Debug and Evaluate your BigQuery data agent - Tutorial on debugging with LangGraph and Evaluating with Vertex AI Gen AI Model Eval Service.

Mastering Data Drift Detection with Google Vertex AI: A Step-by-Step Guide for Beginners - In this guide, we will deploy an AutoML model in Google Vertex AI using the Console. Then, we will set up Model Monitoring for Data Drift to ensure the model maintains its accuracy over time. Data drift describes how a machine learning model’s accuracy declines over time as the statistical properties of real-world data change compared to the historical data it was trained on. Google Vertex AI Model Monitoring is a feature that helps us to track and maintain the performance of machine learning (ML) models in production. It continuously monitors predictions to detect data drift, feature skew, concept drift, and anomalies.

Various

The ultimate guide to learning at Google Cloud Next 2025 - Google Cloud Next ‘25 offers a wide range of learning opportunities for cloud professionals, from hands-on challenges to expert-led workshops on AI and ML. The Skills Challenge is a new on-the-ground game that includes hands-on labs, certification kickstarters, and a leaderboard competition.

Tips for Passing (or Repassing!) the Google Professional Data Engineer (PCDE) Exam - What topics should you revise? What do you need to know? General tips for how to prepare and how to stay calm in the exam!

Slides, Videos, Audio

Kubernetes Podcast - #248 Kubernetes Ingress & Gateway API Updates, with Lior Lieberman.

Security Podcast - #214 Reconciling the Impossible: Engineering Cloud Systems for Diverging Regulations.

Podcast GCP Bytes - #12 In this episode we discuss; Queensland Cyclone, Google Bug Bounty, Google Layoffs, NBN and Kuiper, Gemini Code Assist, Chrome Divestment, Broadcom, AI Deepfakes, New Gemini capabilities.

Releases

Compute Engine - Generally available: The Create an instance page in the Google Cloud console has a Data protection pane where you can specify how to back up and replicate your data. Generally available: Memory-optimized M4 VMs are now generally available. Generally available: Compute flexible committed use discounts (CUDs) are available for Local SSD disks that you attach to instances of eligible machine types. Generally available: Configure the host error detection time, which is the the maximum amount of time Compute Engine waits to restart or terminate an instance after detecting that the instance is unresponsive.

Dataflow - Dataflow now supports data lineage.

Dataproc Serverless - New Dataproc Serverless for Spark runtime versions: 1.1.95 1.2.39 2.2.39.

Dataproc - New Dataproc on Compute Engine subminor image versions: 2.0.135-debian10, 2.0.135-rocky8, 2.0.135-ubuntu18 2.1.83-debian11, 2.1.83-rocky8, 2.1.83-ubuntu20, 2.1.83-ubuntu20-arm 2.2.49-debian12, 2.2.49-rocky9, 2.2.49-ubuntu22.

Deep Learning VM - M128 release Except for TensorFlow images, new images don't include conda.

Dialogflow - Dialogflow CX (Conversational Agents) generators: Model gemini-2.0-flash-001 is now a GA feature available in the following regions: global, us, us-central1, us-east1, us-west1, europe-west1, europe-west4. Dialogflow CX (Conversational Agents) data store handlers: Model gemini-2.0-flash-lite-001 is now a Preview feature available in the following regions: global, us, us-central1, us-east1, us-west1, europe-west1, europe-west4. Dialogflow CX (Conversational Agents): The Conversational Agents console has moved to a new location. Dialogflow CX (Conversational Agents): You can now use the console search feature to search for all resources, including playbooks, examples, and tools. Dialogflow CX (Conversational Agents): Playbooks now support the following new features: Two different playbook types: Task playbooks and routine playbooks. Dialogflow CX (Conversational Agents): You can now use the Conversational Agents console to manage languages. Dialogflow CX (Conversational Agents) data store handlers: New model gemini-2.0-flash-001 is now available to data store handlers as a Preview feature. Dialogflow CX (Conversational Agents): Text-to-speech used by Dialogflow now supports new Chirp 3 HD voices. Dialogflow CX (Conversational Agents): Git export/restore now supports additional Git providers and Google Secrets for token storage.

Gemini - Gemini Code Assist now supports data residency at rest. You can now use code customization for Gemini Code Assist Enterprise with VPC Service Controls.

Integration Connectors - The Microsoft Exchange connector is now generally available (GA).

GKE new features - JobSet metrics are automatically available on new GKE Standard and Autopilot clusters starting from version 1.32.1-gke.1357001 or later.

Cloud Logging - App Hub application labels are now attached to your log entries. You can now use the Observability API to set the default log scope. The API to create and manage Log Scopes is now Generally Available (GA).

Looker - Looker (Google Cloud core) and Looker (original) changes. Looker 25.4 is expected to include the following changes, features, and fixes: Expected Looker (original) deployment start: Monday, March 17, 2025 Expected Looker (original) final deployment and download available: Thursday, March 27, 2025 Expected Looker (Google Cloud core) deployment start: Monday, March 17, 2025 Expected Looker (Google Cloud core) final deployment: Monday, March 31, 2025. The gemini_in_looker permission, available only in the Looker Gemini role, is now being enforced at the Looker instance level. By default, Looker connects to your database using the latest version of the JDBC driver for your database dialect. The Open SQL Interface feature now supports Explores that use the conditionally_filters parameter. The Chart Config Editor now supports dynamic annotations. Looker now supports key-pair authentication for Snowflake connections. An issue has been fixed where deployed LookML could still appear on the Uncommitted Changes pages. An issue has been fixed where the PDT Activity Dashboard would only include one model that the PDT is included in. An issue has been fixed where the text for the Query Tracker was misaligned in German. An issue has been fixed where circular references in Liquid could cause the LookML validator to crash. An issue has been fixed where an unspecified 'hidden' attribute could cause the LookML validator to crash if localization was enabled. An issue has been fixed where some schedules did not appear in the User Schedules page. An issue has been fixed where Liquid references to parameters required view scoping even if the parameter was defined in the same view file. An issue has been fixed where downloading a dashboard with a radial chart with no data as a PDF in the French locale could cause a rendering failure. An issue has been fixed where using the legacy dashboards-next URL path for an embedded dashboard could cause a blank screen. An issue has been fixed where the Explore page could crash while using Google Chrome. An issue has been fixed where dashboard filters could not be saved if two or more filters shared a name. An issue has been fixed where Snowflake connection certificates in the .p12 file format were not accepted. When you change the sorting type or direction for folder contents, Looker now brings you to the first page of results. An issue has been fixed where selecting "Sort by Favorited Date" in a folder would sort incorrectly. An issue has been fixed where users with different "bqserviceaccount" user attribute values could access the same cached results. Looker (original) only changes. The Content Validator scoping feature is now out of Labs and generally available. The New Database Connection Setup feature is now out of Labs and generally available. A new Labs feature, Fast Dev Mode Transition, improves the performance of Development Mode on your instance by loading LookML projects in read-only mode until a developer clicks the Create Developer Copy button for the project. Looker (Google Cloud core) only changes. Looker (Google Cloud core) instances now support the Admin via IAM Looker role. The Content Validator scoping feature is now generally available. The New Database Connection Setup feature is now generally available.

Cloud Monitoring - Documentation for Slack notification channels now supports Markdown. You can now see changes made to a dashboard by viewing the version history.

Network Connectivity Center - VPC spoke updates for IPv6 subnet exchange is available in public preview.

Cloud Run - A new region is now available for Cloud Run GPUs: europe-west1.

Security Command Center - The Execution: Malicious Python Executed detector in Container Threat Detection released to General Availability. Security Command Center has released the Artifact Registry vulnerability assessment detection service, which includes the CONTAINER_IMAGE_VULNERABILITY detector. The following detectors have been added to Container Threat Detection.

Service Mesh - Managed Cloud Service Mesh. The rollout of managed Cloud Service Mesh version 1.20 to the rapid channel has completed.

Cloud Spanner - Tiered storage is Generally Available in Spanner.

Cloud SQL MySQL - Cloud SQL for MySQL introduces a set of improvements that adjust MySQL configurations dynamically based on workload demands and underlying infrastructure to optimize write performance and reduce latency.

Cloud SQL SQL Server - You can use PITR to restore a Cloud SQL for SQL Server instance that isn't available.

Cloud Storage - Anywhere Cache for Cloud Storage is now generally available (GA).

Vertex AI Workbench - The M128 release of Vertex AI Workbench user-managed notebooks includes the following: Miscellaneous package updates. The M128 release of Vertex AI Workbench managed notebooks includes the following: Miscellaneous package updates. The M128 release of Vertex AI Workbench instances includes the following: Miscellaneous package updates.

AlloyDB - You can automatically create CMEKs using Cloud KMS Autokey to protect your AlloyDB resources.

Anthos clusters on VMware - Google Distributed Cloud (software only) for VMware 1.30.700-gke.56 is now available for download. The 1.30.700-gke.56 release includes many vulnerability fixes.

Apigee Integrated Portal - On March 11, 2025 we released a new version of the Apigee integrated portal. Bug ID Description 380076166 For an app in a portal, the status for each key will now show approved, revoked, partially approved or inactive based on the approval status of all the API products on that key (or if the key has been revoked).

Apigee UI - On March 14, 2025, we released an updated version of the Apigee UI. Bug ID Description 401574741 Fixed issue with loading API resource and path configurations when opening the Product detail pages of legacy API products. On March 12, 2025, we released an updated version of the Apigee UI. With this release, the Filter display name for the proxy field in the Custom reports page of the Apigee UI in Cloud console is changed to Proxy Endpoint.

Apigee Hybrid - v1.13.3 & v1.12.4 & v1.14.1. v1.13.3 , v1.14.1, v1.12.4 The Nimbus JOSE + JWT library may cause a java.lang.ClassCircularityError when using a JavaCallout policy.For more information, see Apigee known issues.

Artifact Registry - Artifact Registry remote repositories and virtual repositories for Go are now Generally Available. Security Command Center ingests Artifact Analysis scanning findings from images scanned in Artifact Registry and deployed to supported runtimes.

Cloud Asset Inventory - The following resource types are now publicly available through the ExportAssets, ListAssets, BatchGetAssetsHistory, QueryAssets, Feed, and Search (SearchAllResources, SearchAllIamPolicies). The following resource types are now publicly available through the ExportAssets, ListAssets, BatchGetAssetsHistory, QueryAssets, Feed, and Search (SearchAllResources, SearchAllIamPolicies).

Batch - Cancelling jobs is generally available (GA).

BigQuery - Dataform now supports the CMEK organization policy. You can now use Gemini Cloud Assist chat to generate SQL queries and Python code. You can configure reusable, default Cloud resource connections in a project. An updated version of ODBC driver for BigQuery is now available. Analytics Hub egress controls and data clean room subscriptions are now available in all BigQuery editions and on-demand pricing.

Bigtable - You can use Cloud KMS Autokey to automate the creation and use of customer-managed encryption keys (CMEK) in Bigtable clusters. Data lineage for Dataflow jobs is generally available (GA) in the Bigtable Beam connector (BigtableIO) and the Bigtable HBase Beam connector (CloudBigtableIO).

Chronicle - Within Curated Detections, the following rules have been added to the Cloud Hacktool rule pack for Google Cloud data in the "Broad" category. URL indicators are now available for matching as part of Applied Threat Intelligence. The following rule has been removed from its associated rule pack in Curated Detections due to high alert volume across the Google SecOps customer base: Serverless Threats Potential Cryptomining Payload running in Cloud Run Service or Cloud Run Job.

Chronicle Security Operations - Remote agent high availability This feature is currently in preview. Remote agent downtime notifications Customers using remote agents can now opt in to receive in-app or email notifications when the agent is down. Pause or resume Case SLA Users can now pause and resume service level agreement (SLA) timers on cases. Within Curated Detections, the following rules have been added to the Cloud Hacktool rule pack for Google Cloud data in the "Broad" category. URL indicators are now available for matching as part of Applied Threat Intelligence. The following rule has been removed from its associated rule pack in Curated Detections due to high alert volume across the Google SecOps customer base: Serverless Threats Potential Cryptomining Payload running in Cloud Run Service or Cloud Run Job.

Chronicle SOAR - Release 6.3.38 is now in General Availability. Theme enhancement for SOAR platform The header and left hand navigation menu now fully reflect the selected theme. Release 6.3.39 is being rolled out to the first wave of regions as listed here. Remote agent high availability This feature is currently in preview. Remote agent downtime notifications Customers using remote agents can now opt in to receive in-app or email notifications when the agent is down. Pause or resume Case SLA Users can now pause and resume service level agreement (SLA) timers on cases.

Cloud Composer - The Custom constraints with Organization Policy feature is now generally available (GA). Some upgrade operations for Cloud Composer 2 might lead to unhealthy environments. A new Cloud Composer release has started on March 11, 2025. (Cloud Composer 3) Validation error messages now use the correct format for image versions. New Airflow builds are available in Cloud Composer 3: composer-3-airflow-2.10.2-build.11 (default) composer-3-airflow-2.9.3-build.18. New images are available in Cloud Composer 2: composer-2.11.5-airflow-2.10.2 (default) composer-2.11.5-airflow-2.9.3.