Google Cloud: Cloud SQL viewer roles can no longer export data, and Cloud Service Mesh’s ISTIOD control planes lose support on 1 March 2028

Google Cloud: Cloud SQL viewer roles can no longer export data, and Cloud Service Mesh’s ISTIOD control planes lose support on 1 March 2028

2 October 2026 — Google Cloud's release notes of 28 September 2026 carry two changes that platform and data teams need to act on: one breaks existing jobs now, the other sets an end-of-support date.

Not yet independently verified. This rests on Google Cloud’s own release notes; no independent report was found. We read the Cloud SQL change in the PostgreSQL notes and in Google’s combined release-notes feed under MySQL; check the notes for your database engine. We will update this when it can be confirmed, and remove this note.

Cloud SQL: export removed from read-only roles

Google marked this as a breaking change: "To improve security, removed the cloudsql.instances.export permission" from three roles:

• Cloud SQL Viewer (roles/cloudsql.viewer)
• Basic Reader (roles/reader)
• Basic Viewer, legacy (roles/viewer)

Until now, anyone with read-only access to a project could export a whole Cloud SQL database to a storage bucket. That was a quiet data-exfiltration route, and closing it is sensible. But scheduled exports, backup scripts, analytics pipelines and service accounts that were given a viewer role "just to export" will now fail. Google's guidance is to grant the Cloud SQL Editor role or a custom role that includes the permission.

What to do: search for failed export jobs since 28 September; list service accounts that export with a viewer or reader role; give them a narrow custom role with only the permissions they need rather than Editor; and check whether your own access reviews assumed viewers could not move data.

Cloud Service Mesh: ISTIOD control planes deprecated

Google has deprecated two ways of running Cloud Service Mesh on GKE: the in-cluster ISTIOD control plane and the managed ISTIOD control plane. Support ends on 1 March 2028. After that the control-plane components receive no updates, security patches or support, and for managed ISTIOD, "workload sidecars on unmodernized clusters will fail and be unable to receive or send requests".

Customers must move to managed Cloud Service Mesh with the TRAFFIC_DIRECTOR control plane. Google's steps: confirm you are affected, check that the features you use are supported with TRAFFIC_DIRECTOR, check your fleet's eligibility, and follow the modernisation guide. The in-cluster option on Google Distributed Cloud (software only) remains supported.

What to do: inventory clusters by control-plane type, test feature compatibility early, and plan the migration well before 2028; a service mesh change touches every service's traffic.

Sources

• Google Cloud: Cloud SQL for PostgreSQL release notes, 28 September 2026 — 28 September 2026
• Google Cloud: Cloud Service Mesh release notes, 28 September 2026 — 28 September 2026