STACK MOMENTSDAILY TECH BRIEF

Daily brief · September 9, 2026

Recovery paths must preserve encryption state.

One infrastructure development cleared the verification and significance bar. It links to the primary source and includes the engineering implication.

3 minute read1 developmentVerified source
01
Cloud & Infrastructure3 min read

Google fixes a Distributed Cloud upgrade retry that could strip encryption keys

Google released Distributed Cloud for VMware 1.34.800-gke.90 with a fix for failed Advanced Cluster upgrades. Retrying an upgrade with an existing bootstrap cluster could wipe or strip keys from the generated-key KMS plugin configuration, leaving the control plane unable to decrypt existing Kubernetes secrets in etcd.

Why it mattersEncryption-key state is part of the recovery boundary, not ordinary configuration. Operators should move to the fixed release, protect key material before cluster changes and explicitly test failed-upgrade recovery—not only the successful upgrade path.

Source: Google Cloud release notes ↗ · Published September 8, 2026

#Google Distributed Cloud#Kubernetes#etcd#KMS

Shareable visual

Poster of the Day

A fixed Distributed Cloud release protects encryption-key state during failed-upgrade recovery.

Daily StackMoments poster: Google fixes a Distributed Cloud upgrade retry that could strip encryption keysDownload poster ↓