The following issues were fixed in 1.36.0-gke.532:

The following issues were fixed in 1.36.0-gke.532:

• Fixed vulnerabilities listed in Vulnerability fixes.
• Fixed an issue where user clusters remained stuck in a Reconciling state after an admin cluster upgrade. The admin cluster controller skipped reconciling legacy cluster lifecycle components during upgrades unless an initial migration annotation was set. If legacy user clusters still existed on the admin cluster, missing legacy API discovery (cluster.k8s.io/v1alpha1) caused controller reconciliation to stall. With this fix, the controller preserves legacy components as long as any legacy user clusters exist, and prunes them only after all user clusters have migrated to advanced clusters.
• Fixed an issue where gkectl prepare failed with a permission denied error when attempting to read a private registry CA certificate. The certificate file permissions are now set to 644 so non-root processes can read it.
• Fixed an issue where retrying a failed upgrade to an Advanced Cluster (such as re-running with an existing bootstrap cluster) could wipe or strip the encryption keys in the generated-key-kms-plugin-config secret, preventing the control plane from decrypting existing Kubernetes secrets in etcd.
• Fixed an issue where upgrading a user cluster with Anthos Network Gateway (ANG) enabled to an Advanced Cluster would stall or fail. Previously, the upgrade process attempted to modify immutable spec.selector fields on existing ANG resources. The upgrade operator now preserves existing label selectors during reconciliation so that V1 to V2 cluster migrations complete successfully.
• Updated cluster-proportional-autoscaler to address security vulnerabilities.
• Fixed an issue where recreating a user cluster using a previously used name caused cluster provisioning to stall indefinitely in the PROVISIONING state because of a missing k8s-health-check service account.
• Fixed an issue where gkectl diagnose failed to run on non-advanced user clusters managed by an advanced admin cluster.
• Fixed an issue where creating a cluster on the root of a vSAN datastore failed during data disk creation because the installer used an unsupported API for top-level vSAN directory creation.
• Fixed an issue where control plane quorum restore stalled or failed due to IP address collisions. After the fix, gkectl restore quorum recreates missing IPAddress objects for VSphereMachine resources before waiting for cluster readiness.
• Fixed an issue where enabling generated key secrets encryption (KMSv1) during Day 2 cluster updates failed or got stuck in an infinite reconciliation loop.
• Fixed an issue where setting stackdriver.disableVsphereResourceMetrics to true caused cluster installations or upgrades to stall because the vsphere-ca-certificate ConfigMap was deleted, but still needed.