Google Cloud CLI - Release Notes

Copyright 2014-2026 Google Inc. All rights reserved.

Subscribe to these release notes at https://groups.google.com/forum/#!forum/google-cloud-sdk-announce.

581.0.0 (2026-08-18)

Breaking Changes

  • (Cloud Services) Removed gcloud beta services mcp enable, gcloud beta services mcp disable, and gcloud beta services mcp list as MCP enablement is no longer required and they have been functioning as no-ops.

AI Platform

  • Added gcloud beta ai semantic-governance-policy-engine deprovision command to tear down a semantic governance policy engine, including its tenant project, GKE cluster, and PSC service attachments.

  • Promoted gcloud ai semantic-governance-policies (create, describe, update, delete, list) and gcloud ai semantic-governance-policy-engine (describe, update, deprovision) commands from beta to GA.

BigQuery

  • Added fields precedence and condition to the commands bq ls --reservation_assignment and bq show --reservation_assignment output.
  • Added the new AUTOMATIC_MATERIALIZED_VIEW_REFRESH job type for users to create reservation assignments with.

Cloud Auth

  • Enabled Enterprise Certificate Proxy (ECP) HTTP Proxy by default for context-aware mTLS requests.

Cloud Bigtable

  • Rebuilt cbt cli with newer version of bigtable client for CVE-2026-39883.

Cloud IAM

  • Updated gcloud iam workforce-pools create-cred-config and gcloud iam workforce-pools create-login-config to accept short-format provider audiences (<pool>/<provider>).
  • Added gcloud beta iam workforce-pools providers create-saml and gcloud beta iam workforce-pools providers update-saml commands.

Cloud Services

  • API Keys: Added --append flag to gcloud services api-keys update command to merge new application and API target restrictions with existing key restrictions instead of replacing them.

Cluster Director

  • Fixed gcloud cluster-director clusters create to not create default compute resources when they are overridden by the user.
  • Updated gcloud cluster-director clusters create to default to hyperdisk-balanced boot disks and restrict persistent disks (PD) for non-N2 and non-CT5P machine types.
  • Fixed a validation error during cluster updates that concurrently modified storage resources and Slurm node sets.

Compute Engine

  • Added gcloud compute target-ssl-proxies test-iam-permissions command to test IAM permissions on a Compute Engine target SSL proxy in beta, preview, and GA.
  • Added --max-stream-duration flag to gcloud compute backend-services create and update commands in beta, preview, and GA.
  • Added gcloud compute packet-mirrorings test-iam-permissions command for beta, preview and GA tracks.

Container

  • Fixed issue where gcloud CLI would crash on corrupted ~/.kube/config. Now you will now get a more detailed explanation about which section and line is wrong, to make troubleshooting easier. Corrupted kubeconfig will be backed up for further troubleshooting.

Database Migration

  • Added --reserved-public-ip and --reserved-public-ip-nat-ips-count flags to gcloud database-migration private-connections create.
  • Added --fetch-reserved-public-ips flag to gcloud database-migration connection-profiles fetch-static-ips.

Kubernetes Engine

  • Add --enable-slice-controller flag in gcloud container clusters create and gcloud container clusters update.

Oracle Database

  • Added --total-vm-storage-size-gb flag to gcloud oracle-database cloud-exadata-infrastructures configure-exascale and --properties-vm-backup-storage-type, --properties-vm-file-system-storage-type flags to gcloud oracle-database cloud-vm-clusters create to support Exascale VM storage options.

Subscribe to these release notes at https://groups.google.com/forum/#!forum/google-cloud-sdk-announce.

580.0.0 (2026-08-11)

Breaking Changes

Google Cloud CLI

  • Fixed Google Compute Engine residency detection to prevent authentication failures due to transient issues and command latency regressions in non-Google Cloud environments.

Apihub

  • Promoted gcloud apihub locations configure-and-deploy-server command to GA. This command configures and deploys an MCP (Model Context Protocol) server on Apigee X via API Hub.

Certificate Authority Service

  • Added first-party activation support to gcloud privateca subordinates activate via --issuer-pool, --issuer-location, and --issuer-ca flags.
  • Added suggestion to use gcloud privateca subordinates activate when gcloud privateca subordinates create with issuer flags fails due to an already existing subordinate CA.

Certificate Manager

  • Added --tags flag to gcloud certificate-manager create commands (certificates create, dns-authorizations create, issuance-configs create, maps create, and trust-configs create).

Cloud Backup DR

  • Added selective disk backup properties (boot-disk-only and disk-exclusion-labels) under --compute-instance-properties in gcloud backup-dr backup-plans create and update commands.
  • Added --source-instance-boot-disk and --source-instance-disk-device-name flags to gcloud backup-dr backups restore disk for individual disk restore from compute instance backup.

Cloud Composer

  • Enabled the 'backfill' Airflow CLI sub-command for Composer environments running Airflow 3.
  • Enabled the 'config lint' Airflow CLI sub-command for Composer environments running Airflow 2.11.0 or higher.

Cloud Dataflow

  • Added gcloud dataflow jobs pause and gcloud dataflow jobs resume commands.
  • Added --enable-turnkey-alerts flag to gcloud dataflow jobs run and gcloud dataflow flex-template run.

Cloud IAM

  • Added support for X.509 certificate-based credentials and locational mTLS endpoints to gcloud iam workload-identity-pools create-cred-config.

Cloud Spanner

  • Update gcloud spanner backups list command to display INSTANCE_PARTITIONS column in GA track.

Cloud Storage

  • gcloud storage rsync:
    • Skipping syncing files which goes outside of destination directory.

Cluster Director

  • Updated gcloud cluster-director clusters create to default to dynamic nodes when using flex start.

Compute Engine

  • Added gcloud compute resource-policies test-iam-permissions command to test IAM permissions on a Compute Engine resource policy in GA, beta, preview, and alpha.
  • Added gcloud compute snapshot-groups set-iam-policy command in beta.
  • Added --kms-key-service-account to gcloud compute disks create, gcloud compute images create, gcloud compute machine-images create and gcloud compute snapshots create for beta track.
  • Added --boot-disk-kms-key-service-account and --instance-kms-key-service-account to gcloud compute instances create and gcloud compute instance-templates create for beta track.
  • Added --consistent-hash-minimum-ring-size flag to gcloud compute backend-services create and update commands.
  • Added --circuit-breakers-max-requests flag to gcloud compute backend-services create and update commands.
  • Added gcloud compute backend-services test-iam-permissions command to test IAM permissions on a Compute Engine backend service in beta, preview, and GA.
  • Added gcloud compute ssl-policies test-iam-permissions command to test IAM permissions on a Compute Engine SSL policy in beta.
  • Added gcloud compute firewall-policies test-iam-permissions command.
  • Promoted --graceful-shutdown, --graceful-shutdown-max-duration, and --no-graceful-shutdown flags to the GA track for gcloud compute instances and gcloud compute instance-templates commands.
  • Added --identity-type flag to gcloud compute instances create, gcloud compute instances update, and gcloud compute instance-templates create in alpha.
  • Promoted exapool capacity flags to beta and GA tracks for gcloud compute storage-pools update command.
  • Added --maintenance-freeze-duration and --clear-maintenance-freeze-duration flags to gcloud compute instances set-scheduling and gcloud compute instances create in beta.
  • Added gcloud compute images test-iam-permissions command to test IAM permissions on a Compute Engine image in beta, preview, and GA.

Device Run

  • Promoted gcloud device-run sessions wait command to beta.
  • Updated --instrumentation-timeout flag of gcloud beta device-run sessions submit instrumentation to allow a maximum duration of 3 hours.
  • Updated gcloud device-run devices describe to display hardware_type instead of form.
  • Updated gcloud device-run devices list to display HARDWARE_TYPE column instead of FORM.

GKE Hub

  • Promoted API field schema for --fleet-default-member-config flag on gcloud container fleet|hub config-management enable command to beta.

Metastore

  • Updated gcloud beta metastore services migrations start to support migrations to Lakehouse runtime catalog(s).
  • Deprecated Cloud SQL migration arguments in gcloud beta metastore services migrations start.

Network Connectivity

  • Added --export-psc-published-services-and-regional-google-apis and --export-psc-global-google-apis flags to gcloud beta network-connectivity hubs create and gcloud beta network-connectivity hubs update commands.

Network Security

  • Promoted mcp and policyProfile fields to GA in gcloud network-security authz-policies import and export commands.
  • Made loadBalancingScheme optional in gcloud network-security authz-policies import and export commands.

Network Services

  • Promoted gcloud network-services telemetry-policies delete command to BETA.

Subscribe to these release notes at https://groups.google.com/forum/#!forum/google-cloud-sdk-announce.

579.0.0 (2026-08-04)

Breaking Changes

  • (API Registry) Removed gcloud api-registry mcp enable and gcloud api-registry mcp disable. MCP server enablement is no longer required; enabling the underlying service is sufficient.
  • (Compute Engine) Removed PRESERVED_STATE column from gcloud compute instance-groups managed list-instances output in beta.

AI

  • Route gcloud ai requests for the us multi-region to the Vertex AI multi-regional (REP) endpoint.

Agent Identity

  • Added --three-legged-oauth-default-continue-uri flag to gcloud agent-identity auth-providers create and update commands.

Cloud Auth

  • Enabled ECP HTTP Proxy support for external users (disabled by default).
  • Added optional --ecp-http-proxy flag to gcloud auth enterprise-certificate-config create to support custom ECP HTTP proxy binary paths.

Cloud Dataproc

  • Promoted --master-instance-selection, --master-instance-flexibility-policy-file, --worker-instance-selection, --worker-instance-flexibility-policy-file, --secondary-worker-instance-selection, and --secondary-worker-instance-flexibility-policy-file flags to GA for gcloud dataproc clusters create and gcloud dataproc workflow-templates set-managed-cluster.

Cloud Firestore Emulator

  • Added support for --require-indexes and --index-file flags in gcloud emulators firestore start command.

Cloud Functions

  • Added all-traffic as an allowed value for --direct-vpc-egress flag in gcloud functions deploy.
  • Promoted gcloud functions upgrade command to GA.

Cloud NetApp

  • Added gcloud netapp volumes start-split and gcloud netapp volumes get-split-status commands to GA track.

Cloud Quotas

  • Promoted gcloud quotas surface (info, preferences, and adjuster settings) to General Availability (GA).

Cloud SQL

  • Modified gcloud sql instances reencrypt to support zero-downtime re-encryption for most Cloud SQL instances, removing the previous downtime warning. Instances using C4, C4A, or N4 machine types are not yet supported for zero-downtime re-encryption; they will still restart during this operation and prompt a downtime warning.

Cloud Services

  • Updated gcloud beta services mcp enable command to be a no-op, as MCP enablement is no longer required.

Cluster Director

  • Fixed an issue where the default zone for cluster resources (storage, network, etc.) was always set to the location's "b" zone, overriding the user-specified zone in compute flags.
  • Renamed --blueprint flag to --reference-architecture in gcloud beta cluster-director clusters create.

Compute Engine

  • Promoted gcloud compute hosts and gcloud compute reservations hosts to GA.
  • Updated gcloud compute reservations hosts list and gcloud compute reservations hosts describe to require --reservation when --reservation-block is specified.
  • Added support for 3500GB, and 7000GB partition sizes when creating local SSDs via gcloud compute instances create and gcloud compute instance-templates create.
  • Promoted --igmp-query flag in --network-interface of gcloud compute instance-templates create to GA.
  • Promoted --igmp-query flag in gcloud compute instances network-interfaces add to GA.
  • Promoted --igmp-query flag in --network-interface of gcloud compute instances bulk create to GA.* Added gcloud compute http-health-checks test-iam-permissions command.
  • Added --routing-mode flag to gcloud compute service-attachments create and update commands in beta.
  • Added gcloud compute snapshot-groups test-iam-permissions command in beta release track.
  • Added gcloud compute instances test-iam-permissions command to test IAM permissions on a Compute Engine virtual machine instance in GA, beta, and preview.
  • Added gcloud compute interconnects groups set-iam-policy command to set IAM policy on an interconnect group in beta, preview, and GA.
  • Added --exapool-capacity-optimized-capacity, --exapool-read-optimized-capacity, and --exapool-write-optimized-capacity flags to gcloud alpha compute storage-pools update for Exapool storage pools.
  • Added Arm CCA support to the confidential-compute-type option in gcloud compute instance create.
  • Added gcloud compute network-firewall-policies test-iam-permissions command.
  • Added gcloud compute disks test-iam-permissions command to test IAM permissions on a Compute Engine disk.
  • Promoted --ipv6-network-tier flag of gcloud compute networks subnets create and gcloud compute networks subnets update to beta.
  • Added STANDARD option to --ipv6-network-tier flag of gcloud compute instances create, gcloud compute instance-templates create, gcloud compute instances network-interfaces add, and gcloud compute instances network-interfaces update in beta.
  • Added gcloud compute routers test-iam-permissions command to test specific IAM permissions on a Compute Engine router in beta.

Compute Firewall Policies

  • Promoted new ULL_POLICY value for --policy-type flag of gcloud compute network-firewall-policies create to GA.

Distributed Cloud Edge

  • Promoted gcloud edge-cloud zones list to GA.

GKE Hub

  • Promoted gcloud container fleet|hub config-management update command to beta.

Identity and Access Management

  • Added gcloud iam access-policies create|delete|describe|list|update|search-policy-bindings commands to allow management of access policy resources.
  • Added --target-resource flag to gcloud iam policy-bindings create.

Kpt

Kubernetes Engine

  • Updated default kubectl to 1.35.6.
  • Additional kubectl versions:
    • 1.30.14
    • 1.31.14
    • 1.32.13
    • 1.33.13
    • 1.34.10
    • 1.35.7
    • 1.36.3

Network Services

  • Deprecated clientTlsPolicy field in gcloud network-services endpoint-policies.
  • Updated gcloud network-services endpoint-policies resource name pattern to support regional locations.

Vmware Engine

  • Added --kms-key flag to gcloud vmware private-clouds create. Specifying this flag with a valid KMS key resource name enables CMEK.
  • Added --encryption-type and --kms-key flags to gcloud vmware private-clouds update. --kms-key (valid KMS key resource name) is required when --encryption-type is CMEK.

Subscribe to these release notes at https://groups.google.com/forum/#!forum/google-cloud-sdk-announce.

578.0.0 (2026-07-28)

Breaking Changes

  • (Database Migration) Made --auto-commit flag the default for gcloud database-migration conversion-workspaces seed|convert|import-rules operations. To disable auto-committing, use --no-auto-commit flag.

  • The run_bq_command tool exposes the BigQuery CLI (bq) within the Cloud CLI remote MCP server. You can send natural language prompts to your AI application to execute specific BigQuery SQL commands on your behalf.

    For more information, see Use the Cloud CLI remote MCP server.

Google Cloud CLI

  • Fixed an issue where running gcloud init crashed when Enterprise Certificate Proxy (ECP) binaries were missing from configuration.
  • Updated macOS Python Virtualenv for the gcloud CLI to 3.14.6.

AlloyDB

  • Promote AlloyDB Backup DR restore flags (--backupdr-backup and --backupdr-data-source) to the GA track.

BigLake

  • Fixed a bug where gcloud biglake iceberg tables commands failed to send the X-Iceberg-Access-Delegation: vended-credentials header.

BigQuery

  • Added -f/--force support to bq rm --connection to ignore NOT_FOUND errors if the connection does not exist.
  • Fixed reading configuration from gcloud CLI with --nouse_google_auth flag.
  • Added a predefined label for jobs created in specific metrics environments.
  • Updated the help text for several global flags.
  • Updated command format in the user-agent HTTP header of API requests.

Cloud Backup DR

  • Added --log-retention-days flag across gcloud backup-dr backup-plans create and update across all release tracks to enable Point-in-Time Recovery (PITR) log retention configuration.

Cloud Bigtable

  • Added --ignore-warnings flag to gcloud bigtable instances tables update and gcloud bigtable tables update.
  • Promoted --ignore-warnings flag of gcloud bigtable materialized-views create to GA.

Cloud Composer

  • Enabled Airflow CLI commands for Composer environments running Airflow 3.2.

Cloud IAM

  • Promoted enabled-for-users-groups option for --scim-usage flag to beta in gcloud beta iam workforce-pools providers.

Cloud Run

  • Added --sandbox-launcher flag to gcloud beta run jobs and gcloud beta run worker-pools command groups to allow setting a container as sandbox launcher when creating or updating a Cloud Run job or a worker pool.

Cloud Workstations

  • Added --idle-action flag to gcloud alpha workstations configs create, gcloud alpha workstations configs update, gcloud beta workstations configs create, and gcloud beta workstations configs update commands.

Compute Engine

  • Added --network-tier flag to gcloud compute public-advertised-prefixes create in beta.
  • Added --metadata-filter flag to gcloud compute forwarding-rules create command across all release tracks.
  • Added --metadata-filter flag to gcloud compute forwarding-rules update commands across all release tracks.
  • Added gcloud compute machine-images test-iam-permissions command to test IAM permissions on a Compute Engine machine image in beta, preview, and GA.
  • Promoted regex_rewrite support in url_rewrite block to beta for gcloud compute url-maps.
  • Promoted the following gcloud compute routers command groups to GA: add-named-set, add-named-set-element, download-named-set, get-named-set, list-named-sets, remove-named-set, remove-named-set-element, and upload-named-set.
  • Added gcloud compute health-sources test-iam-permissions command to test IAM permissions on a health source.
  • Added gcloud compute instant-snapshot-groups set-iam-policy command to set the IAM policy for a Compute Engine instant snapshot group.
  • Added gcloud compute networks subnets test-iam-permissions command in beta, preview, and GA.
  • Added gcloud compute image-views describe command in beta.
  • Added gcloud compute snapshots test-iam-permissions to test IAM permissions for Compute Engine snapshots.
  • Added gcloud compute interconnects attachments groups set-iam-policy command to set IAM policy on an interconnect attachment group in beta, preview, and GA.
  • Added --internal-range flag to gcloud compute addresses create to support allocating global internal IP addresses from an Internal Range for Private Service Connect.
  • Updated gcloud compute reservations hosts list and gcloud compute reservations hosts describe to require --reservation when --reservation-block is specified.

Developer Connect

  • Updated gcloud beta developer-connect account-connectors commands to support Bring Your Own (BYO) and Bitbucket Cloud (BBC) connection types.

GKE Hub

  • Promoted --view, --memberships, --filter, and --sort-by flags on gcloud container fleet|hub config-management describe command to beta.

Network Management

  • Added --source-dms-private-connection flag to gcloud network-management connectivity-tests.

Secret Manager

  • Added the --secret-type flag to gcloud secrets create to support creating secrets of different types (e.g. Cloud SQL credentials).
  • Added the gcloud secrets enable-managed-rotation command to enable managed rotation for a secret using Cloud SQL credentials.
  • Added the gcloud secrets rotate-secret command to rotate a secret.

Subscribe to these release notes at https://groups.google.com/forum/#!forum/google-cloud-sdk-announce.

577.0.0 (2026-07-21)

Agent Identity

  • Promoted gcloud agent-identity auth-providers and gcloud agent-identity access-summaries to GA.

AlloyDB

  • Modify flag --no-enable-autoscaler of gcloud beta alloydb instances create|update commands to only set the enabled field to false and not clear autoscaling config.
  • Modify gcloud beta alloydb instances update command to only allow one of --autoscaler-delete-schedule, --autoscaler-disable-schedule, --autoscaler-enable-schedule, or --autoscaler-set-schedule to be specified.

Artifact Registry

  • Added connector-repository mode to gcloud artifacts repositories create.

BigQuery

  • Added support for --s3_service_directory_service flag to pass custom Service Directory endpoints for AWS connection make and update operations. This is used for routing traffic over a private network connection through Cross-Cloud Interconnect.
  • Updated the data source of agent name value set in the user agent HTTP header.
  • Stopped enforcing bq init when --oauth_access_token is provided.

Cloud Bigtable

  • fix: cbt cli escape row keys and column qualifiers in printRow.

Cloud Firestore Emulator

  • Release Cloud Firestore emulator v1.22.0
    • Added DML support for the Firestore Pipelines API
    • Added ability to model when composite indexes are required in Datastore mode using new --require-indexes and --index-file flags
    • Added depreciation warning for JRE versions <25

Cloud Key Management Service

  • (GA) Added --folder flag to gcloud kms autokey-config show-effective-config to retrieve the effective Cloud KMS Autokey configuration for folders. The --project and --folder flags are now optional, defaulting to the current project.

Cloud Workstations

  • Added gcloud beta workstations suspend and gcloud alpha workstations suspend commands.

Compute Engine

  • Added gcloud compute machine-images test-iam-permissions command to test IAM permissions on a Compute Engine machine image in beta, preview, and GA.
  • Promoted regex_rewrite support in url_rewrite block to beta for gcloud compute url-maps.
  • Promoted the following gcloud compute routers command groups to GA: add-named-set, add-named-set-element, download-named-set, get-named-set, list-named-sets, remove-named-set, remove-named-set-element, and upload-named-set.
  • Added gcloud compute health-sources test-iam-permissions command to test IAM permissions on a health source.
  • Added --logging-http-request-headers and --logging-http-response-headers flags to gcloud compute backend-services create and update commands to configure Cloud Logging HTTP headers for external L7 load balancers.
  • Added --local-ssd-encryption-mode flag to gcloud compute instances create to specify the encryption mode for Local SSDs.
  • Deprecated customer-supplied encryption keys (CSEK) flags --csek-key-file, --require-csek-key-create, --source-machine-image-csek-key-file, --source-disk-csek-key, --source-disk-key-file, and --source-instant-snapshot-key-file for gcloud compute commands.

GKE Hub

  • Changed both --config flag on gcloud beta container fleet|hub config-management apply command and --fleet-default-member-config flag on gcloud beta container fleet|hub config-management enable command to no longer default spec.upgrades: manual population since auto-upgrades is no longer supported from Config Sync version 1.21.0 and spec.upgrades: manual is behaviorally equivalent to not setting this field.

Kubernetes Engine

  • Fix overwriting autoscaling settings in gcloud container clusters update.

Network Security

  • Updated gcloud beta network-security authz-policies import to support networkRules and snis fields.

Recaptcha

  • Added --universal option to gcloud recaptcha keys create and gcloud recaptcha keys update.

Subscribe to these release notes at https://groups.google.com/forum/#!forum/google-cloud-sdk-announce.

576.0.0 (2026-07-14)

Breaking Changes

  • (Cloud Storage) Updated gcloud storage rsync to default decompresses downloaded gzip files to match the behavior of gcloud storage cp. To retain the previous behavior, use the new --do-not-decompress flag.

Google Cloud CLI

  • Updated Linux bundled Python for the gcloud CLI to 3.14.6 to resolve CVE-2026-34182.

  • The Cloud CLI remote MCP server provides a secure environment that lets you send natural language prompts to your AI application to execute command-line interface (CLI) commands on your behalf. Only gcloud commands are supported.

    For more information, see Use the Cloud CLI remote MCP server.

Artifact Registry

  • Fixed a performance regression in gcloud artifacts docker images list when listing a large number of image versions.

BigLake

  • Promoted gcloud biglake delta-sharing <catalogs|shares|schemas|tables> to GA.
  • Promoted gcloud biglake data-product-sharing publish to GA.
  • Added lakehouse option to --catalog=type flag to gcloud biglake iceberg catalogs.
  • Added gcloud biglake hive tables update to beta.

BigQuery

  • Added environment information to the user-agent HTTP header.
  • Added support for --label flag in bq cp, bq extract, and bq load commands to configure job-level labels.
  • Fixed 'bq show' command failures displaying timestamps without fractional seconds.

Cloud Data Lineage

  • Added gcloud datalineage runs command group to manage data lineage runs.
  • Added gcloud datalineage lineage-events command group to manage data lineage runs.

Cloud Dataplex

  • Added --enable-catalog-publishing flag to gcloud dataplex datascans create data-documentation and gcloud dataplex datascans update data-documentation commands.
  • Added --mode flag to gcloud dataplex datascans create data-profile and gcloud dataplex datascans update data-profile commands to support specifying profiling mode.

Cloud Dataproc

  • Promoted gcloud dataproc batches submit pyspark-notebook to GA.

Cloud Identity-Aware Proxy

  • Promoted support for agent-registry resource type in gcloud iap web IAM commands to GA.

Cloud Key Management Service

  • (Alpha, Beta) Added --folder flag to gcloud kms autokey-config show-effective-config to retrieve the effective Cloud KMS Autokey configuration for folders. The --project and --folder flags are now optional, defaulting to the current project.
  • Added --hsm-trusted-wrapping flag to gcloud kms keys create and gcloud kms keys versions import to enable trusted wrapping capabilities.
  • Promoted gcloud kms keys versions export-trusted-key-wrapped and gcloud kms keys versions import-trusted-key-wrapped to GA.
  • Added --crypto-key-version-name and --two-factor-public-key-pem flags to gcloud kms single-tenant-hsm proposal create for --operation-type=upgrade_key_trust.

Cloud Managed Kafka

  • Added util function to validate and remove byte units from broker disk input.

Cloud Run

  • Modified gcloud run services proxy to fail immediately if the service has its default URL disabled.

Cloud SQL

  • Upgraded --storage-auto-increase-limit flag for gcloud sql instances create and gcloud sql instances patch commands to GA.

Cloud Storage

Cluster Director

  • Added support for Lustre dynamic tier in gcloud cluster-director clusters commands.

Compliance Manager

  • Updated gcloud compliance-manager commands to support project-level resources.

Compute Engine

  • Promoted --nat-ips-per-endpoint flag to GA in gcloud compute service-attachments create and gcloud compute service-attachments update.
  • Promoted gcloud compute hosts and gcloud compute reservations hosts to beta.
  • Added gcloud compute sole-tenancy node-templates test-iam-permissions command to test IAM permissions on a node template in beta, preview, and GA.
  • Added gcloud compute instant-snapshots set-iam-policy command to support setting IAM policy bindings for instant snapshots in alpha, beta, preview, and GA.
  • Added gcloud compute network-attachments test-iam-permissions command to test IAM permissions on a network attachment in beta, preview, and GA.
  • Added gcloud beta compute instance-groups managed adopt-instances to support adopting instances into regional managed instance groups.
  • Added gcloud compute instant-snapshots test-iam-permissions command to test IAM permissions on an instant snapshot in beta, preview, and GA.
  • Added get-iam-policy and set-iam-policy commands to gcloud compute firewall-policies and gcloud compute network-firewall-policies to manage policy-level IAM policy.
  • Promote the --location flag of gcloud compute interconnects update to GA.
  • Added gcloud compute backend-buckets test-iam-permissions command to test IAM permissions on backend buckets.
  • Promoted --on-repair-allow-changing-zone flag to GA in gcloud compute instance-groups managed create and gcloud compute instance-groups managed update.
  • Added gcloud compute interconnects test-iam-permissions command to test IAM permissions on a Compute Engine interconnect in beta.
  • Added gcloud compute instant-snapshot-groups test-iam-permissions command.
  • Added test-iam-permissions command to gcloud compute target-tcp-proxies to test IAM permissions on a target TCP proxy. Global proxies are supported in all tracks, and regional proxies are supported in alpha and beta tracks.
  • Added support for displaying dynamic field GRACEFUL_SHUTDOWN_TIMESTAMP to gcloud compute instance-groups managed list-instances in GA, beta and alpha.
  • Added gcloud compute service-attachments set-iam-policy command to set IAM policy on a service attachment in beta, preview, and GA.
  • Added --async flag to gcloud compute instance-groups managed delete.
  • Promoted --load-balancing-scheme flag to GA in gcloud compute target-tcp-proxies create.
  • Promoted --instances flag of gcloud create instance-groups managed resize-requests create to GA to support specific instance names.
  • Added gcloud compute reservations sub-blocks test-iam-permissions command to beta, preview and GA release tracks.
  • Added on-update-action enum class to --create-disk flag for an instance creation. And it is added to the following release tracks alpha, beta, preview, and GA.
  • Added gcloud compute external-vpn-gateways test-iam-permissions command to test IAM permissions on an external VPN gateway.
  • Added gcloud compute sole-tenancy node-groups test-iam-permissions command to test IAM permissions on a node group in alpha, beta, GA, and preview.
  • Promoted --identity, --identity-certificate and --most-disruptive-allowed-action flags to GA.
  • Added gcloud compute disks bulk set-labels command to alpha, beta, ga, and preview release tracks.

Developer Connect

  • Promoted gcloud developer-connect insights-configs deployment-events list and describe commands to GA.

Kubernetes Engine

  • Added KCP_VPA option to --logging flag of gcloud container clusters create to enable VPA Decision Logs feature.
  • Added KCP_VPA option to --logging flag of gcloud container clusters create-auto to enable VPA Decision Logs feature.
  • Added KCP_VPA option to --logging flag of gcloud container clusters update to enable VPA Decision Logs feature.
  • Added node config options nodeVfioConfig to gcloud container clusters create, gcloud container node-pools create, and gcloud container node-pools update command which contains VFIO-related configurations for this node.
  • Added node config options diskIoScheduler to gcloud container clusters create, gcloud container node-pools create, and gcloud container node-pools update command which contains the configuration for the disk IO scheduler.
  • Promoted Rollbackable Upgrades (Two-Step Upgrades) to GA. Added --control-plane-soak-duration flag to gcloud container clusters upgrade and promoted gcloud container clusters complete-control-plane-upgrade to GA.
  • Promoted --managed-otel-scope flag to GA in gcloud container clusters create to enable Managed OpenTelemetry feature.
  • Promoted --managed-otel-scope flag to GA in gcloud container clusters create-auto to enable Managed OpenTelemetry feature.
  • Promoted --managed-otel-scope flag to GA in gcloud container clusters update to enable Managed OpenTelemetry feature.
  • Additional kubectl versions:
    • kubectl.1.30 (1.30.14)
    • kubectl.1.31 (1.31.14)
    • kubectl.1.32 (1.32.13)
    • kubectl.1.33 (1.33.13)
    • kubectl.1.34 (1.34.9)
    • kubectl.1.35 (1.35.6)
    • kubectl.1.36 (1.36.2)

Looker

  • Promoted --release-channel and --accelerated-security-patch-enabled flags to GA for gcloud looker instances create and gcloud looker instances update.
  • Added RELEASE_CHANNEL and ACCELERATED_SECURITY_PATCH_ENABLED columns to gcloud looker instances describe output in GA track.

Network Security

  • Added support for project-level security profiles to gcloud network-security security-profiles wildfire-analysis commands in BETA.

Transfer

  • Deprecated --s3-compatible-mode flag in gcloud transfer agents install. It is no longer needed as Transfer Service automatically detects S3-compatible job.

Vmware Engine

  • Updated gcloud vmware private-clouds create command to use full resource names for --preferred-zone and --secondary-zone flags when creating a stretched private cloud. This update ensures compliance with VPC Service Controls.

Subscribe to these release notes at https://groups.google.com/forum/#!forum/google-cloud-sdk-announce.

575.0.1 (2026-07-07)

Google Cloud CLI

  • Updated Windows bundled Python for the gcloud CLI to 3.14.6 to resolve CVE-2026-34182.

Subscribe to these release notes at https://groups.google.com/forum/#!forum/google-cloud-sdk-announce.

575.0.0 (2026-06-30)

Google Cloud CLI

  • Added any-reservation-then-fail argument for flag --reservation-affinity in gcloud container clusters node-pools create.

Agent Registry

  • Added gcloud agent-registry command group to manage Agent Registry resources.

AlloyDB

  • Added --failover flag to gcloud beta alloydb clusters promote to support cross-region failover.

Apigee

  • Added gcloud apigee apis import which allows customers to upload API Proxy bundles in archive ZIP or feature template YAML format.

Artifact Registry

  • Expose the Registry URL in the output of gcloud artifacts repositories describe and in the output of gcloud artifacts repositories create (upon synchronous creation).

Assured Workloads

  • Added SWITZERLAND_DATA_BOUNDARY_WITH_ACCESS_JUSTIFICATIONS option to --compliance-regime flag of gcloud assured workloads create.

BigLake

  • Added gcloud biglake hive tables create to beta.

Cloud Access Context Manager

  • Exposed --service-account and --service-account-project-number for gcloud access-context-manager cloud-bindings commands in the GA track.

Cloud Bigtable

  • Added support for --tags flag to gcloud bigtable instances create to allow binding tags on instance creation.

Cloud Data Lineage

  • Added gcloud datalineage processes command group to manage data lineage processes.

Cloud Dataproc

  • Added --master-machine-types flag in gcloud dataproc clusters create.

Cloud IAM

  • Updated gcloud iam service-accounts create to print the created service account's email address.

Cloud Run

  • Made the FILE positional argument optional for all gcloud run * replace commands, defaulting to their respective standard filenames if not specified.
  • Promoted regional inference to beta for Cloud Run services, jobs, and worker pools. When --region or the run/region property is not specified, the command line looks for a resource with that name in all regions.
  • Added --sandbox-launcher flag to gcloud beta run deploy and gcloud beta run services update to allow setting a container as sandbox launcher.
  • Promoted --workdir flag for gcloud run commands to GA.
  • Promoted interactive project prompt when project is not specified in gcloud run deploy to GA.
  • Promoted suggesting project and region from Artifact Registry URL in gcloud run deploy to GA.
  • Added --tail flag to gcloud beta run jobs execute to tail logs of the running execution.
  • Added --dry-run flag to gcloud beta run deploy, gcloud beta run services update, gcloud beta run services delete, gcloud beta run worker-pools deploy, gcloud beta run worker-pools update, and gcloud beta run worker-pools delete to validate configuration without persisting changes.
  • Added gcloud run jobs executions describe-latest command to describe the latest execution of a job.
  • Call out proxy when deploying or updating services with gcloud run deploy or gcloud run services update that require authentication in all tracks.

Cloud SQL

  • Added --user and --password-secret-version to gcloud sql instances execute-sql.

Cloud Storage

Cloud Workstations

  • Promoted --pd-disk-size flag of gcloud workstations update to GA.

Cluster Director

  • Users must supply a staticNodeCount if they want one. This no longer defaults to 1.

Compute Engine

  • Added gcloud alpha compute instance-groups managed configure-accelerator-topologies command to configure accelerator topologies of a managed instance group.
  • Added gcloud compute instances set-machine-resources command to allow setting machine resources for a virtual machine instances in alpha, beta, and GA.
  • Added test-iam-permissions command to gcloud compute storage-pools to return permissions that a caller has on the specified storage pool.
  • Added gcloud compute reservations sub-blocks set-iam-policy command to beta and GA release tracks.
  • Added gcloud compute reservations blocks set-iam-policy command to set IAM policy on a reservation block in beta, preview, and GA.
  • Promoted support for gcloud compute instance-groups managed resize-requests create for regional MIG to GA.
  • Promoted support for gcloud compute instance-groups managed resize-requests cancel for regional MIG to GA.
  • Promoted support for gcloud compute instance-groups managed resize-requests delete for regional MIG to GA.
  • Promoted support for gcloud compute instance-groups managed resize-requests describe for regional MIG to GA.
  • Promoted support for gcloud compute instance-groups managed resize-requests list for regional MIG to GA.
  • Added gcloud compute instance-templates test-iam-permissions command to test IAM permissions on an instance template in alpha, beta, GA, and preview.
  • Added gcloud compute target-https-proxies set-quic-override command in beta, preview, and GA.
  • Added gcloud compute reservations test-iam-permissions to test IAM permissions on Compute Engine reservations.
  • Added gcloud compute network-attachments set-iam-policy command to set IAM policy on a network attachment in alpha, beta, preview, and GA.
  • Added gcloud compute instances list-referrers command to alpha, beta, and GA release tracks.
  • Added gcloud compute reservations blocks test-iam-permissions command to test IAM permissions on a reservation block in beta.
  • Added gcloud compute interconnects attachments groups test-iam-permissions command to test IAM permissions on an interconnect attachment group in beta, preview, and GA.
  • Added support for displaying dynamic fields (such as TERMINATION_TIMESTAMP) to gcloud compute instance-groups managed list-instances in GA.

Database Migration

  • Added --source-database-name-override flag to gcloud database-migration conversion-workspaces seed|update to allow overriding the database name for the seed operation.

GKE Hub

  • Promoted gcloud container fleet rollouts to GA.
  • Promoted gcloud container fleet rolloutsequences to GA.

Kpt

Kubernetes Engine

  • Promoted GKE custom image flags (--image and --image-project) to GA, making them publicly visible in gcloud container clusters create, gcloud container clusters create-auto, and gcloud container node-pools create (and --image/--image-project in gcloud container clusters upgrade).
  • Added stack-type option to --additional-node-network flag of gcloud container node-pools create to configure the stack type (ipv4, ipv4-ipv6, or ipv6) for additional network interfaces.

Network Management

  • Added --source-cloud-run-job flag to gcloud network-management connectivity-tests.

Network Services

  • Updated gcloud edge-cache services import schemas to support specifying up to 100 allowed origins in CORSPolicy.allowOrigins and a client TTL of 0s in CDNPolicy.clientTtl.

Subscribe to these release notes at https://groups.google.com/forum/#!forum/google-cloud-sdk-announce.

574.0.0 (2026-06-23)

AI Platform

  • Added gcloud beta ai semantic-governance-policy-engine deprovision command to tear down a semantic governance policy engine, including its tenant project, GKE cluster, and PSC service attachments.

Agent Identity

  • Added gcloud beta agent-identity auth-providers get-iam-policy|set-iam-policy|add-iam-policy-binding|remove-iam-policy-binding|test-iam-permissions commands.

Agent Registry

  • Added gcloud agent-registry command group to manage Agent Registry resources.

Backup For GKE

  • Made gcloud container backup-restore command groups compatible with non-default universe domains.

BigQuery

  • Fixed a bug where stderr messages from gcloud CLI output would be printed to stdout.
  • Added --gcloud_config_cache flag to enable caching data retrieved from the gcloud CLI.
  • Added display of container request concurrency of BigQuery Python UDF in bq show --routine.
  • Added information about AI Agent in the execution environment to the user-agent HTTP header in the API request.

Cloud Datastream

  • Added Regional Endpoints (REP) support for all Datastream commands.

Cloud Memorystore

  • Added --zone-distribution-config-zones flag to gcloud memorystore instances create command. This flag lets users specify multiple zones when they create a MULTI_ZONE cluster.
  • Added --zone-distribution-config-zones flag to gcloud redis clusters create command. This flag lets users specify multiple zones when they create a MULTI_ZONE cluster.

Cluster Director

  • Added support for creating clusters using --quickstart-cluster in gcloud beta cluster-director clusters create.

Colab

  • Added Hyperdisk options to --disk-type of gcloud colab runtime-templates create: HYPERDISK_BALANCED.

Compute Engine

  • Fixed an issue where gcloud compute url-maps import reset custom timeout and retryPolicy (specifically numRetries) values to defaults when updating an existing URL map.
  • Added --vsock-mode flag to gcloud compute instances create, gcloud compute instance-templates create, gcloud compute instances bulk create, and gcloud compute queued-resources create in ALPHA to support enabling/disabling VSOCK mode.
  • Promoted --purpose flag to gcloud compute public-delegated-prefixes create in beta.

Database Migration

  • Added Regional Endpoints (REP) support for all Database Migration Service (DMS) commands.

Kubernetes Engine

  • Updated default kubectl from 1.35.3 to 1.35.6.
  • Added new kubectl version 1.36.2 for the RAPID channel.
  • Additional kubectl versions:
    • kubectl.1.30 (1.30.14)
    • kubectl.1.31 (1.31.14)
    • kubectl.1.32 (1.32.13)
    • kubectl.1.33 (1.33.13)
    • kubectl.1.34 (1.34.9)
    • kubectl.1.35 (1.35.6)
    • kubectl.1.36 (1.36.2)

Network Security

  • Promoted gcloud network-security ull-mirroring-engines and gcloud network-security ull-mirroring-collectors commands to beta.
  • Promoted gcloud network-security ull-mirroring-engines and gcloud network-security ull-mirroring-collectors commands to GA.

Subscribe to these release notes at https://groups.google.com/forum/#!forum/google-cloud-sdk-announce.

573.0.0 (2026-06-16)

Breaking Changes

  • (Anthos Multi-Cloud) Deprecated gcloud container attached clusters get-credentials. Use gcloud container fleet memberships get-credentials to get credentials for a running Attached cluster.

Google Cloud CLI

  • Updated Windows bundled Python for the gcloud CLI to 3.14.5.

AI

  • Added gcloud ai tuning-jobs command group to manage Vertex AI supervised fine-tuning jobs.

App Engine

Artifact Registry

  • Added gcloud artifacts image-streaming-cache command group to manage image streaming caches per region. This group includes create, describe, delete, and list commands.

BigLake

  • Promoted --unity-service-principal-application-id flag for gcloud biglake iceberg catalogs create and update to BETA, making it publicly visible.
  • Promoted BigLake catalogs and arguments for gcloud biglake iceberg catalogs to GA.

Cloud Data Lineage

  • Added gcloud datalineage command group to manage Cloud Data Lineage resources.
  • Added gcloud datalineage config describe and gcloud datalineage config update commands to manage Data Lineage configurations.

Cloud Datastream

  • Added support for Dataverse, Salesforce Marketing Cloud, and ServiceNow connection profiles to gcloud datastream connection-profiles create and update commands.
  • Added support for Dataverse, Salesforce Marketing Cloud, and ServiceNow streams to gcloud datastream streams create and update commands.

Cloud Run

  • Promoted --readiness_probe in gcloud run deploy and gcloud run services update to GA.

Cloud Services

  • API Keys: Updated gcloud services api-keys create and update commands' --api-target flag to accept a colon-separated list of methods inline (e.g. --api-target="service=foo,methods=m1:m2").

Cloud Storage

  • Promoted gcloud storage batch-operations bucket-operations commands to GA.

Cluster Director

  • Added support for creating clusters using blueprints in gcloud beta cluster-director clusters create.

Compute Engine

  • Promoted --action-on-vm-failed-health-check flag to GA for gcloud compute instance-groups managed create and gcloud compute instance-groups managed update.
  • Fixed an issue where waiting for asynchronous operations would fail for certain global nested resources (like