GKE’s latest releases just moved what’s usually a quietly boring compatibility bump into something that will actively break clusters that haven’t kept up: Dataplane V2 in GKE (starting in 1.35.1-gke.1516000 and the 1.36 baseline) now ships CNI configuration files targeting the CNI spec 1.1.0. If your downstream CNI plugin — custom networking, observability sidecars, or a vendor integration — hasn’t implemented the 1.1.0 behaviour, expect pod networking regressions on control-plane or node upgrades.
This is the single most important operational change in this week’s GKE notes. It’s not a nice-to-have spec tweak: GKE is explicitly emitting configuration that assumes the 1.1.0 contract by setting cniVersion to 1.1.0. During cluster upgrades the kubelet and network plumbing will assume the newer hook semantics; older plugins can silently fail to create pod interfaces, apply IPAM, or attach eBPF programs. That’s an outage vector you won’t catch in unit tests.
There are other changes in the release that matter, but they’re secondary to the CNI story. GKE 1.36 promotes Kubernetes v1.36 across channels, updates containerd to newer 1.x patch releases (recent nodes ship 1.7+ patches), and widens Arm (aarch64) workload support in the 1.36 release series. Those runtime and architecture changes are sensible, but they compound upgrade complexity: you don’t want to be chasing both a runtime patchline change and a CNI contract change at the same time.
Cloud Run had a quieter but important move: importing public images from GitHub Container Registry (GHCR) is now GA. That makes GHCR a supported first-class image source for production Cloud Run services with the platform’s rollout and autoscaling semantics. It’s a good developer-ergonomics win — but it also raises supply-chain work: teams must manage GHCR IAM, provenance, and image immutability the same way they do for GCR or Artifact Registry.
On the AI side, Vertex AI pushed back a hard deadline: Gemini 2.5 Pro / Flash / Flash-Lite are scheduled for retirement on October 16, 2026. If your inference pipelines, agents, or embeddings still point at those model IDs via Vertex or the Gemini API, you need a migration plan to Gemini 3.x variants now. This is overdue — software that embeds fixed model IDs without a migration path is brittle — but the timeline is concrete, not theoretical.
Finally, Google published pricing for Data Cloud AI agents: $3 per million input tokens and $20 per million output tokens, with a free trial through September 30, 2026. That structure will surprise anyone modeling costs for agentic data pipelines where output is often larger than input. Expect analytics pipelines and conversational agents to see material cost shifts if they stream verbose responses or produce long explanations as part of ETL or BI workflows.
What to do today
-
Stop assuming your CNI plugin is "low-risk". Test CNI behaviour against a node image running the GKE Dataplane V2 config that sets cniVersion to 1.1.0 (this change begins in the 1.35.1 maintenance line and is in the 1.36 baseline). If your vendor hasn’t certified compatibility, pin node pools to the older image family or delay Dataplane V2 rollout.
-
Run upgrade drills in a non-prod region: simulate control-plane and node upgrades with traffic and observability on, not just unit-level link tests. A failed IPAM call or missing interface shows up only under load.
-
For Cloud Run + GHCR, adopt image immutability and signed manifests. Treat GHCR like any other external registry: role-bound write rights and a clear promotion pipeline.
-
If you rely on Gemini 2.5 model IDs, schedule migrations to Gemini 3.x now. Don’t wait until the retirement window forces emergency refactors.
-
Recompute cost projections for Data Agents: output-token-heavy workflows will be the first to surprise finance.
Opinion: Google is doing the right thing by standardizing the CNI contract and pushing GHCR support to GA — both are overdue moves that accelerate ecosystem stability. But making these changes via config emissions during upgrades without a clear, long transition window will bite teams that treat CNI as an uninteresting black box. Treat it like a first-class dependency.
If you run clusters at scale, this is the week to make CNI compatibility one of your upgrade blockers. If you don’t, you’ll find out the hard way during your next GKE scheduled update.