--- cuppy_hub: gcp cuppy_path: changelog/2026-10-21-release-notes.md cuppy_section: docs cuppy_doc: 1PRE-R4J9 cuppy_doc_uuid: 12e19edd-37f4-4a3d-a16c-2c31d1a079c4 cuppy_permalink: https://cuppy.io/gcp/d/1PRE-R4J9 cuppy_version: 1 cuppy_updated: 2026-10-23T16:16:52.575Z cuppy_canonical: https://cuppy.io/gcp/docs/changelog/2026-10-21-release-notes cuppy_mcp: https://cuppy.io/mcp cuppy_body_sha256: 98b06508936a9bc5822ca827ab9d8a0000c768921fa2aea0a1cf0e8a4a6e3941 # cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks. --- # Google Cloud hub — first release Ten families, built in one session on 2026-10-21 to `docs/sprints/PROMPTS-hub-generation-v2.md`. Per-family notes: `changelog/2026-10-21-identity-family.md` and the nine beside it. ## What was built References and one error catalogue per family; at least one guide per family; **a parity guide per family**; a top-level method guide; a drift-report guide; three patterns; one worked example; the overview map; and these notes. ## The facts that most change an answer | Fact | Why it matters | |---|---| | **Cloud Deployment Manager "reached end of support on March 31, 2026."** | a model answering from memory still writes it | | **"Cloud Functions" is now "Cloud Run functions"**, and a modern function **is** a Cloud Run service | the old names are what a model says | | **A function instance serves up to 1000 concurrent requests**; 1st gen and AWS Lambda serve one at a time | a **correctness risk** in a migration, not a tuning note | | **A Google Cloud VPC is global**; subnets are regional | `N` regional networks become one, and the transit object disappears | | **Cloud Storage `ARCHIVE` commits 365 days**, against 180 on both other clouds | every lifecycle rule carried in needs re-tuning | | **Uniform bucket-level access is reversible for 90 days, then permanent** | a one-way door in the middle of a routine setting | | **Cloud KMS key rings cannot be deleted**; deleted key names cannot be reused; protection level, purpose and type are immutable | four irreversible decisions in one service | | **Adding a second Bigtable cluster** changes the instance from strongly to **eventually consistent by default** | it produces no error at all | | **Spanner has no like-for-like counterpart** on AWS or Azure | a move off it is an architecture change | | **Oracle and SQL Server have documented paths onto PostgreSQL** | "migrate" and "drop the licence" can be one project | | **The Dataproc overview page is titled "Managed Service for Apache Spark"** | both names are live; neither is stale | | **OpenTelemetry is the recommended tracing instrumentation** | re-instrument on the source first; it pays for itself either way | | **A Dataproc cluster starts, scales and stops in "90 seconds or less, on average"** | clusters can be ephemeral; count cluster-hours | | **Three Pub/Sub subscription types write into BigQuery, Bigtable or Cloud Storage with no code** | a consumer service is deleted | ## The one vendor contradiction found `iam/docs/understanding-roles` describes custom roles as organization-scoped; `iam/quotas` counts them **per project and per organization** (300 each). Recorded with the hub's reading in `reference/identity/predefined-roles-and-permissions.md` §3 rather than quietly resolved. ## Absences recorded rather than filled in — the complete list 1. Secret Manager's overview gives **no resource-name format**, does not define `latest`, and does not enumerate the version states. 2. The GKE Workload Identity Federation page **does not say** whether the feature is on by default on Autopilot. 3. The IAM troubleshooting page **prints no verbatim denial string**. 4. Config Connector's overview **does not name the deletion-policy annotation** — and guessing it deletes a database. 5. Infrastructure Manager's overview states **no supported Terraform versions, no default identity, no API name, no limits**. 6. The Terraform-on-Google-Cloud overview makes **no provider-version and no authentication recommendation**. 7. The service enable/disable page **prints no verbatim not-enabled error**. 8. The Compute Engine disks overview **does not address multi-instance attachment**. 9. Filestore's service-tiers page **says nothing about changing tier** after creation. 10. The Cloud Storage classes page **does not describe a rehydration step** for `ARCHIVE`. 11. Cloud NAT's overview **names no port-allocation modes**. 12. Cloud Armor's overview **does not name distinct policy classes**. 13. **Cloud SQL publishes no verbatim connection error strings**, and **no version end-of-support information**. 14. Firestore's modes page **does not say whether a mode can be changed**. 15. Spanner's instance-configurations page **states no minimum** for nodes or processing units. 16. Pub/Sub's overview **states no default message retention**; **Pub/Sub Lite**'s status is not claimed. 17. Cloud Tasks' overview **does not compare itself to Pub/Sub** — the choose-between rule is labelled as the hub's reading. 18. **No error table was read for Dataflow or Dataproc**; the Dataproc overview states no cluster location and names no image versions. 19. **Cloud Logging's retention periods** live in a quotas document not read here, so **no retention figure is quoted anywhere in this hub**. 20. Cloud Monitoring's page references PromQL and **does not name Managed Service for Prometheus**; nothing about that product is claimed. 21. Cloud Trace's overview **states no sampling behaviour**. 22. Migrate to Virtual Machines' architecture page **does not detail the replication or test-clone mechanics** in the content read — the things a cut-over window depends on. 23. Database Migration Service **mentions "ongoing replication" without CDC specifics**, and its engine/version list is a separate living document. 24. Storage Transfer Service's overview **does not detail delete-after-transfer or overwrite behaviour** — both destructive-adjacent. ## Known missing — the whole list Each family's own release note has the detail. In summary: organization policy constraints and VPC Service Controls; IAM Conditions (CEL); Terraform import coverage per resource type; object lifecycle rules, retention policies and CMEK; snapshots and machine images; managed instance groups, Spot VMs and Confidential Computing; Artifact Registry; backend services, health checks, URL maps and certificates; Cloud Interconnect, Cloud VPN, Network Connectivity Center and Cloud DNS; VPC Flow Logs and Network Intelligence Center; Memorystore; backups and point-in-time recovery; Cloud SQL read replicas; Firestore security rules; Spanner schema design; Cloud Scheduler and Workflows; Pub/Sub schemas, snapshots, seek and filtering; BigQuery partitioning, clustering, reservations, ML and Omni; Dataflow pipeline options and the template catalogue; Cloud Data Fusion, Dataplex and Looker; Cloud Profiler and Error Reporting; audit log types; Compute Engine and GKE error catalogues; Migrate for Anthos; Transfer Appliance; Backup and DR; VMware Engine; and — the highest-value next addition — **cut-over runbooks and rollback procedures**. ## Conventions, fixed from day one `status: published` on every document, because the bundle **is** the published state and there is no promote command. `freshness: {tier: asserted, verified_at, verified_by}` — never `recheck:`, which the platform stores and never validates. One error catalogue per **family**, because the Google API status codes are the platform's rather than a service's. No address appears as one string: a service-account identity is written `` `` at `.iam.gserviceaccount.com` ``. Every document has a `next_read`, and everything is reachable from `_boot/START.md` or `HUB.md` by links. --- You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 91 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/gcp/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.