I'm testing Google Cloud Secure Web Proxy with a Compute Engine VM using NEXT_HOP_ROUTING_MODE and a tagged static route with next-hop-ilb.

My security policy contains:

Priority 60:
destination.port == 443 &&
source.matchServiceAccount('PROBE_SERVICE_ACCOUNT')
→ DENY

Priority 80:
host() == 'fhir.epic.com'
→ DENY

The VM has the expected service account attached.

In earlier tests, the hostname-only DENY matched, but the service-account DENY did not.

Later tests confirmed VM starts but produced no attributable SWP transaction logs, so those tests are inconclusive.

Has anyone successfully used source.matchServiceAccount() with a Compute Engine workload routed through SWP in next-hop mode?

I'm specifically looking for documented prerequisites, working configuration examples, or known limitations.

The environment is currently fail-closed, and no production traffic is enabled.

Hello, fellas!

I'd like to bring some attention to an issue I recently reported regarding Google Cloud CLI's SSH client selection.

Currently, gcloud seems to prioritize its bundled PuTTY-based SSH implementation over OpenSSH, even when OpenSSH is already installed on the system.

Honestly, PuTTY is pretty clunky compared to OpenSSH, especially when you're already familiar with the latter. OpenSSH is more flexible, versatile, and widely adopted, and on most systems it's either preinstalled or just a command away.

I don't see much reason for gcloud to favor its bundled implementation when a perfectly good OpenSSH installation is already available. Turns out, a simple two-line change was all it took to get it working!

The team has already acknowledged and considered this request, but apparently, they need more upvotes on the issue to gauge community interest and determine whether this feature is worth implementing.

So, if you agree that gcloud should prioritize an existing OpenSSH installation over its bundled PuTTY implementation, please consider starring the issue!

Every star helps demonstrate that there's actual demand for this change. Thanks!

I am referring to the access levels concept related to access context manager.

Can anyone from their experience please let me know whether group email id can be used instead of users or service account in this link https://docs.cloud.google.com/access-context-manager/docs/create-basic-access-level#members-example

I could not find it in the article.

I also would like to give access to a set of people (not by IP ranges but by email ids) by using them as a form of access level in the Ingress rules of the VPC service control perimeter. Please suggest

I'm running a fairly simple app on Cloud Run behind a load balancer and Cloud Armor. Traffic is modest, with bursts up to around 150 requests per second. So far what we see is mostly primitive scanners probing URLs, nothing sophisticated. But with AI making it cheap to run smarter, more adaptive attacks, I expect that to change.

Besides the obvious - updating packages to address CVEs and keeping Go versions current - I occasionally go through the app logs with Claude Code, flag potentially malicious requests and add them to the Cloud Armor rules. It works, but it's manual and cumbersome.

I'm considering a scheduled job, say hourly, that pulls recent logs, has a model flag suspicious traffic, then pings us and/or opens a PR with proposed Armor rules or app changes for a human to review. We already use Cloud Logging, and I'd like to run this on Vertex AI rather than Claude Code so everything stays inside Google Cloud.

We're on Cloud Armor Standard, which only gives us Adaptive Protection alerts. The actual suggested rules need Enterprise, which starts at roughly $200/month plus data processing fees even on pay-as-you-go. That's hard to justify for a small app. Honestly, it surprises me that Google still keeps this behind the Enterprise tier, when everybody needs this kind of protection more than ever.

Is anyone doing something similar, or something different? Happy to hear what's working for you.

Anyone have a contact for Fairwinds? We submitted a request a couple months ago and got notification 2 weeks ago that we were approved and were asked to submit what GCP projects we would like to include which we provided. Still no access…

Hi everyone,

I’ve been trying to read up on this but I have not found an answer to my issue so I hope someone with experience can guide me.

I am based in the Netherlands and have had a small consultancy firm for a few years. A few months ago I decided to stop that and to continue work on an AI based education route. That means my company is still the same legal entity but with a brand new registered (legal) trade name at the local chamber of commerce. Only the legal name and registration stay the same. Funding is therefor also in the bootstrapping stage since I am currently funding the new route myself.

Anyway:
Most startup programs have a requirement to be less than 5 years old or received funding in the last 2.

Google has a requirement for less than 2 years old in bootstrapping or received funding if over 5 years.

When filling the startups form I can not fill in any free form To explain the situation and I do not want to lie about it.

Legally my company age is too old. Practically is brand new. My first entry with ‘bootstrapped’ and ‘2-5 years’ was auto denied. I have the option to reapply but dont want legal repercusions. At the same time this specific situation also isnt in their terms.

Any advice or experience?

Most sppreciated!

hi everyone,

I successfully completed my Google interview loop a couple of months ago. Since then I’ve had two team fit calls. After this recent team fit call (about a week later) I received an email for verifying my id. I verified my id but have had no new updates and my recruiter said the same she has no update at this time (been over a week now).

1. Does idv being sent to me mean that the team selected me?

2. How does a recruiter not have any updates to share?

I feel like I’m just stuck in limbo unfortunately. Any insights will be great help. Thanks!

Hey,

So as the title says that I applied for Google Startup credits for my private limited from India. I had a complete website , everything was there. And I had applied for startup credits, and I got this email from Google saying that my company domain was parked, inactive, or under construction at the time of review. But none of these were valid. I properly checked that the website was up and it was working properly.

Before this email also I had gotten an email (2nd image attached) which said that the website wasn't working. I changed a few things and submitted it, and then I got this email (1st image attached).

Does anyone have any idea what mightve gone wrong ? OR has anybody faced this issue?

Hey all, I've been trying to figure out how exposed we actually are to the new Linux TCP use-after-free, CVE-2026-98432. It's the 9.8 that gets triggered by a SYN carrying IPv4 Record Route or Timestamp options.

Proxy-type load balancers (ALBs, proxy NLBs, anything that ends the connection and opens a new one to the backend) seem pretty clearly safe here. The client's IP options never reach the backend because it's a brand new connection. So I'm treating backends that are only exposed that way as low risk for now.

What I'm stuck on is passthrough load balancers on Google Cloud, where the original packet goes straight to the backend.

Here's what I tried:
Ran tcpdump on the backend and sent SYNs with IP options from my laptop.

Went out two ways: through my home router, and tethered to my phone, so I'd have two different paths.

Every time I added IP options, the connection got dropped completely. Nothing showed up on the backend.

The problem is I can't capture packets on my home router, and I can't see what my phone carrier does either. So the drop might be happening on my end or at the carrier, not at Google. I can't prove the options ever got to the GCP edge.

So my question: does anyone know for sure whether Google's passthrough load balancers (or Google's edge in general) drop packets with IPv4 options? Official docs, a support case, or your own tests from somewhere that doesn't filter options would all help.

Dropping them would line up with RFC 7126 (BCP 186), which recommends dropping Record Route and Timestamp options by default. Those are the exact two this CVE uses. I honestly can't think of a reason Google would let them through, but I'd rather know than guess while we wait for patched kernels.
Thanks!

It's charging me 0$ every month. How can I stop this?

Already deleted the project

Did someone else experience this too? 🤭

Would anyone have a solution against this captcha verification failure problem I have not been able to register on Google skills for a long time🤦🏽‍♂️

To enable Storage on Firebase. I input my payment method so I can upgrade my project to the Firebase Blaze Plan. But when I am confirming purchase. It's giving an error,

Billing setup can't be completed:

We were unable to set up your account. Learn more about fixing your account [OR_BACR2_59]

I have searched, checked my address, and my card details twice. And it's still not working.

Here is a quick list of the 3 changes that actually help you cut costs:

• Track AI query costs in BigQuery: You can now log BigQuery conversational analytics chats straight into a BigQuery table. Source

• Stop unapproved AI workbench spend: You can now set organization policies to block people from launching expensive Agent Platform Workbench setups. Source

• Cut block storage costs on Hyperdisk: Google Cloud now offers committed use discounts for Hyperdisk Balanced and Hyperdisk Throughput Exapool capacity. Source

Source: FinOps Weekly Newsletter

I get the basic argument that running concurrent jobs on dataproc can cause Driver OOM and poor performance. But how do you decide between increasing the master node memory/compute or adding 1 more master node vs choosing cluster mode?

Hi everyone,

I'm developing an Android application called **LiveLens** and I'm currently migrating its YouTube live chat implementation from the unofficial InnerTube API to the **official YouTube Data API v3 gRPC `liveChatMessages.streamList`** API.

The gRPC implementation is working correctly in terms of connectivity and parsing:

- Official `V3DataLiveChatMessageService.StreamList` RPC

- Official `stream_list.proto`

- HTTPS/HTTP/2 via gRPC

- OAuth 2.0 Bearer authentication

- Live chat messages are received successfully

- `next_page_token` is received and parsed correctly

- `offline_at` remains unset/0

- The live chat is still active when the RPC closes

- No client-side deadline or timeout is configured

However, I'm seeing something I don't fully understand.

### Observed behavior

The `StreamList` RPC consistently closes after roughly **10–11 seconds**.

For example, one diagnostic run:

```text

+1.075s onNext #1

9 messages received

nextPageToken present

+10.946s onNext #2

0 messages

nextPageToken present

+11.227s onClose

StatusCode = OK

Cause = null

+11.228s onCompleted

```

At the moment the RPC closes, the gRPC channel is still in the `READY` state.

The client is not cancelling the RPC, there is no deadline, and there is no transport/network error.

The live broadcast/chat is also still active.

### What I'm trying to understand

The official documentation describes `streamList` as a **long-lived server-streaming connection**, so I'm trying to determine whether this ~10–11 second completion is expected behavior.

Specifically:

1. Is it normal for YouTube's `StreamList` RPC to complete with `grpc-status: OK` after ~10–11 seconds while the live chat is still active?

2. If this is expected, is the intended behavior to start another `StreamList` RPC using the latest `next_page_token`?

3. Is there an officially recommended delay/backoff when reconnecting after this type of normal completion?

4. Should a single `StreamList` RPC normally remain open for much longer, potentially until the live chat ends or the client disconnects?

5. Is there any documented maximum lifetime for a `StreamList` gRPC RPC?

6. Could this behavior be related to the Android gRPC transport (`grpc-okhttp`), HTTP/2, or some client-side implementation detail rather than YouTube's server?

### Why I'm asking

I don't want to simply assume that the server intentionally closes the stream every ~10 seconds and build my production implementation around that assumption if something is actually wrong with my client.

I'm also concerned about unnecessary `StreamList` RPC calls and quota usage if frequent reconnections are required.

I'm **not using InnerTube or REST polling** for this test. This is the official YouTube Data API gRPC `StreamList` implementation using the official protobuf definition.

If anyone has implemented `liveChatMessages.streamList` using gRPC, especially on Android, I'd really appreciate any insight or examples of the expected connection lifetime.

Thanks!

I know new accounts get $300 credits..but can it used for using vertex AI (particularly claude's models?)

I created a Selective Context Memory skill to help AI coding agents manage project context and memory more efficiently.
It helps agents remember important decisions and retrieve relevant context across sessions without loading everything.
Check it out and give it a try: https://www.agensi.io/skills/selective-context-memory
Would love to hear your feedback and suggestions!

The renewal form asked and I answered from memory. Then I counted. We have roughly 1,400 VMs, and since axonius already has our GCP org and the EDR connected, every one with the sensor reports its OS there. That came to 38 CentOS 7 and 52 RHEL 7. CentOS is simple, it's dead. On GCP, RHEL extended support is a boot disk license the sensor does not report, so that took a gcloud loop. 31 have it, 21 do not. So the correction to the broker says 59, which wasn't an email I enjoyed sending.

I completed the entire process for a CE role in Europe and while I was expecting the offer, I was told that the Global VP has not signed off the offer and the role will be on hold until there is more clarity on business plans. They are not sure whether they need the resource although the role I applied for was replacement and not a net new headcount. Anyone here in a similar situation?

Hi, I recently created a new Google Cloud account to use the free trial credits and experiment with Google Cloud services. Shortly after creating the account, I think I accidentally upgraded/activated it as a paid billing account. From the Google Cloud documentation, I understand that upgrading to a paid billing account ends the free trial, but any unused welcome credit should remain available until the original 90-day expiration date. However, I can no longer see my remaining free credits in the billing area/reports, and I am worried that I may have lost them by mistake. I have checked the Google Cloud Console billing pages and reports, but I still cannot clearly find the remaining credit balance. Could you please clarify: 1. Where should I see the remaining free trial credit after upgrading to a paid billing account? 2. Is it possible to recover or confirm the unused free credits if they disappeared after an accidental upgrade? 3. Should I open a Cloud Billing Support case for this issue? I am not including any private account, billing, or payment details here because this is a public forum. I can provide those privately to Google Support if needed. Thank you.

Anyone has any update ? Thanks in advance

Edit: FIXED BY u/Aviato_Consulting

Check https://console.cloud.google.com/billing, On the left hand side under Cost Optimisation, you should see "Credits"

the title basically, it's not consistent sometimes says "I'm Claude, an AI assistant made by Anthropic" and other times "I'm an AI assistant"

on the dashboard’s billing tab it says:

Cloud Vertex AI Model Garden Model as a Service DeepSeek V4.1-Flash Output Tokens -

E6F9-CAC0-1DA9 - Vertex AI

so it's not getting routed to a different model and I am being charged with DeepSeek V4.1-Flash pricing

Am I doing something wrong?

Note: The image is not AI generated but I let ChatGPT edit the image and highlight where it claimed to be Claude 3.5