The VM firewall rule (e.g. cluster-<hash>-vms) for non-legacy auto-mode networks now includes both the primary and reserved VM ranges (10.128/9) if the primary range lies outside of the reserved range.
You can now use the beta Ubuntu node image with clusters running Kubernetes version 1.6.4 or higher.