The following issues were fixed in 1.35.600-gke.140:

The following issues were fixed in 1.35.600-gke.140:

• Fixed vulnerabilities listed in Vulnerability fixes.
• Improved containerd resilience against state corruption if a node reboots while unpacking container images.
• Fixed an issue where the periodic configuration drift health check failed with a version not supported error while a cluster upgrade or rollback was in progress.
• Fixed an issue where audit-proxy retried audit log exports indefinitely on permanent errors, generating excessive audit logging traffic.
• Fixed an issue where the Kubernetes preflight health check scanned all namespaces in the admin cluster instead of the target cluster's namespace, causing cluster upgrades to fail if an unrelated cluster had stale reconciling resources.
• Fixed an issue where upgrading or recreating a node during maintenance mode could proceed before storage volumes finished detaching, resulting in orphaned CSI VolumeAttachment resources or I/O errors. After the fix, node drain verifies that kubelet unmounts all host volumes and that CSI VolumeAttachment resources detach before completing the drain.
• Fixed an issue where Certificate Authority (CA) rotation failed for self-managing clusters (admin, hybrid, and standalone). The failure occurs during the final phase of the rotation when attempting to move management resources back from the temporary bootstrap cluster to the self-managing cluster, which can leave the cluster in an unmanageable state. You must upgrade your clusters to version 1.35.600-gke.140 before you rotate your CAs.
• Fixed an issue where BareMetalMachine status conditions prematurely reported nodes as ready and available during maintenance mode transitions.
• Fixed an issue in clusters using bundled BGP load balancing where control plane upgrades or configuration updates could cause up to 20 seconds of API server connection failures while a control plane node restarted. After the fix, failover to a healthy control plane node completes in approximately 4 seconds.
• Fixed an issue where user clusters repeatedly alternated between reconciling and running states if the management cluster configured a different pod density configuration than the user cluster.