GKE Gateway supports SNI-based TLS passthrough routing; Agent Substrate is GA

GKE Gateway now supports Server Name Indication (SNI)-based routing with TLS passthrough. You can use TLS protocol-specific rules to route incoming TLS streams from the Gateway to Kubernetes Services based on SNI without terminating TLS at the GKE Gateway load balancer. Application developers can create TLSRoute resources to expose secure TLS traffic to applications that run in the GKE cluster.

Creating TLSRoute resources requires the Gateway API version 1.5.0 or later CRDs (Standard channel), which are installed in GKE version 1.35.2-gke.1842000 or later.

This feature supports single-cluster and multi-cluster GKE Gateway load balancers by using the following GatewayClass resources:

• gke-l7-rilb
• gke-l7-regional-external-managed
• gke-l7-rilb-mc
• gke-l7-regional-external-managed-mc
• gke-l7-cross-regional-internal-managed-mc

For more information, see Deploy a TLS passthrough Gateway.

Agent Substrate on GKE is now Generally Available (GA) for GKE Standard clusters running version 1.37 or later.

Agent Substrate is an infrastructure layer designed for large-scale, high-density AI agent workloads, such as personal assistants and coding agents. Because interactive agents often remain idle while waiting for user input, running them on traditional microservice infrastructure can underutilize CPU and memory resources. Agent Substrate uses a lightweight control plane that bypasses standard Kubernetes Pod scheduling limits to provide fast sandbox provisioning and efficient suspend-and-resume capabilities.

For more information, see About Agent Substrate on GKE.