GKE version 1.35.1-gke.1031000 and later include the following changes to automatically created firewall rules for...

GKE version 1.35.1-gke.1031000 and later include the following changes to automatically created firewall rules for Services:

• Changes the priority of multiple existing firewall rules for Services from 1000 to 999. • Creates additional firewall rules to deny traffic that is not explicitly allowed by other auto-created firewall rules.

If you use custom firewall rules to override GKE firewall rules for Services, these changes might cause unexpected behavior. Before you upgrade your clusters to version 1.35.1-gke.1031000 or later, do the following:

• If you have custom firewall rules that allow or deny traffic with a priority of 1000, change the priority of those rules to a numerically lower value (such as 999 or lower) to maintain their precedence. • Verify that the new auto-created deny rules do not block required traffic for load balancers that use external IP addresses.