Google Distributed Cloud (software only) for VMware 1.34.1100-gke.125 is now available

## Announcement Announcement Google Distributed Cloud (software only) for VMware 1.34.1100-gke.125 is now available for download. To upgrade, see [Upgrade clusters](https://cloud.google.com/kubernetes-engine/distributed-cloud/vmware/docs/how-to/upgrading). Google Distributed Cloud 1.34.1100-gke.125 runs on Kubernetes v1.34.12-gke.500. If you use a third-party storage vendor, check the listing of our previously-qualified [storage partners](https://cloud.google.com/kubernetes-engine/enterprise/docs/resources/partner-storage). After a release, it takes approximately 7 to 14 days for the version to become available for use with GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform. ## Feature Feature The following changes were added in 1.34.1100-gke.125: * Updated system components and container base images to remove the distrusted eMudhra (emSign) and AAA Certificate Services root CAs and reject compromised eMudhra intermediate CAs. * Upgraded Container-Optimized OS (COS) to milestone 121 (`cos-121-18867-652-7`), which removes the distrusted eMudhra (emSign) and AAA Certificate Services root CAs. * Updated the Ubuntu 22.04 node and admin workstation base image to`ubuntu-gke-op-2204-1-33-v20261024` to remove the distrusted eMudhra (emSign) root CAs (USN-8944-1). ## Fix Fixed The following issues were fixed in 1.34.1100-gke.125: * Fixed vulnerabilities listed in [Vulnerability fixes](https://cloud.google.com/kubernetes-engine/distributed-cloud/vmware/docs/vulnerabilities). * Fixed an issue where deleting a user cluster left an orphaned`k8s-health-check-reader-binding-<cluster-namespace>` `ClusterRoleBinding` on the admin cluster. Health check permissions now use a namespaced`RoleBinding`, and legacy `ClusterRoleBinding` objects are automatically cleaned up. * Fixed an issue where adding IP addresses to an existing MetalLB address pool of an advanced user cluster left the cluster stuck in the `UPDATING` state. The update is now rejected during validation; to add IP addresses, add a new address pool instead. * Fixed an issue where preflight checks erroneously required the control plane VIP (`loadBalancer.vips.controlPlaneVIP`) to be in the control plane node subnet when the control plane load balancer mode is set to `manual`. * Fixed an issue where `audit-proxy` retried audit log exports indefinitely on permanent errors, generating excessive audit logging traffic. * Fixed an issue where the Kubernetes preflight health check scanned all namespaces in the admin cluster instead of the target cluster's namespace, causing cluster upgrades to fail if an unrelated cluster had stale reconciling resources.