github.com/GoogleCloudPlatform/k8s-config-connector

• Special shout-outs to @acpana, @anfernee, @anhdle-sso, @barney-s, @codebot-robot, @fqbright, @gemmahou, @himanigulati01, @iamkonohamaru, @justinsb, @katrielt, @ldanielmadariaga, @maqiuyujoyce, @yuwenma for their contributions to this release.

New Beta Resources (Direct Reconciler):

• OrgPolicyPolicy
  • Manage Organization Policies to configure constraints across your Google Cloud resources.

New Alpha Resources (Direct Reconciler):

• AIStreamsCluster

  • Manage AI Streams clusters to ingest and process real-time video streams.

• AutoMLDataset

  • Manage AutoML datasets in Vertex AI.

• CloudBatchResourceAllowance

  • Manage Batch resource allowances to control resource usage and limits for batch jobs.

• BeyondCorpClientGateway

  • Manage BeyondCorp client gateways to secure access to private applications.

• BigLakeDatabase

  • Manage BigLake databases for unified analytics over data lakes.

• BigtableAuthorizedView

  • Manage Bigtable authorized views to control access to specific subsets of data in a table.

• BigtableBackup

  • Manage Bigtable backups to preserve table data.

• BillingAccount

  • Manage Billing accounts (read-only/reference representation).

• CertificateManagerCertificateIssuanceConfig

  • Manage Certificate Manager certificate issuance configurations for automated certificate provisioning.

• CloudDeployDeployPolicy

  • Manage Cloud Deploy deploy policies to define deployment constraints and approvals.

• FirestoreBackupSchedule

  • Manage Firestore backup schedules for automated database backups.

• IAMDenyPolicy

  • Manage IAM deny policies to explicitly deny permissions.

• NetworkSecurityMirroringDeployment

  • Manage Network Security mirroring deployments to mirror network traffic for inspection.

• NetworkSecurityMirroringEndpointGroup

  • Manage Network Security mirroring endpoint groups to associate mirroring endpoints.

• SecurityCenterBigQueryExport

  • Manage Security Command Center BigQuery exports to automatically export findings to BigQuery.

• SecurityCenterMuteConfig

  • Manage Security Command Center mute configs to control finding visibility.

• VertexAIExampleStore

  • Manage Vertex AI example stores for managing example data.

New features:

• Added the cnrm.cloud.google.com/remove-default-node-pool-allow-node-config annotation to the
  ContainerCluster resource. This annotation lets you set a
  field like spec.nodeConfig in a ContainerCluster resource, while still letting Config Connector
  remove the field after removing the default node pool. This annotation is intended for
  scenarios where defining spec.nodeConfig is necessary for organizational policy or
  system requirements during initial cluster provisioning. This release note was added on August 27, 2026.

New Fields:

• ContainerCluster

  • Added spec.confidentialNodes.confidentialInstanceType and spec.nodeConfig.confidentialNodes.confidentialInstanceType fields.

• ContainerNodePool

  • Added spec.nodeConfig.confidentialNodes.confidentialInstanceType field.
  • Added spec.nodeConfig.windowsNodeConfig field.

• RedisCluster

  • Added spec.automatedBackupConfig field.
  • Added spec.crossClusterReplicationConfig field.
  • Added spec.kmsKeyRef field.
  • Added spec.maintenancePolicy and status.observedState.maintenancePolicy fields.
  • Added status.observedState.pscServiceAttachments field.

• MemorystoreInstance

  • Added spec.maintenancePolicy and status.observedState.maintenancePolicy fields.
  • Added spec.kmsKeyRef field.
  • Added status.observedState.encryptionInfo field.

Reconciliation Improvements

We have added support for direct reconciliation to more resources, with opt-in behaviour. The API is unchanged. To use the direct reconciler, add the cnrm.cloud.google.com/reconciler: direct annotation to the corresponding Config Connector object.

• ArtifactRegistryRepository
• CertificateManagerCertificate
• DNSManagedZone
• DNSPolicy
• LoggingLogBucket
• LoggingLogSink
• LoggingLogView
• PubSubSchema
• PubSubTopic
• ServiceDirectoryService

Bug Fixes:

• ComposerEnvironment: Support resource reference resolution and fix drift on private environment config.
• ComputeBackendService: Prevent the automatic injection of subsetting: { policy: "NONE" } for regional backend services with INTERNAL_SELF_MANAGED load balancing scheme.
• DataprocCluster: userServiceAccountMapping field in DataprocCluster resources is now mutable.
• DNSPolicy: Fixes to DNSPolicy for real GCP integration.
• MemorystoreInstance: Fix crossInstanceReplicationConfig field, allowing replication roles to be synced and updated correctly.
• NetworkSecurity: Fix UpdateAuthorizationPolicy panic with empty updateMask.
• PrivilegedAccessManager: Fix mock drift in PrivilegedAccessManager by correcting Delete LRO and array element retention.
• RedisCluster: Fix permanent diff caused by automated backup configuration default value.