This content was generated with the help of AI and published without prior human review. It may contain errors and is not professional advice. Report a problem: info@delionsoft.com.
The Cloud Native Computing Foundation has released Kubernetes 1.37, named "Garhwal", with 67 enhancements in total. According to the original report, the release leans towards stability, security and support for AI/ML workloads rather than new surface area. Several long-running features finally reach general availability, and two changes that touch security and cost move to beta enabled by default.
What happened
The metrics.k8s.io API is now generally available. It is the interface behind kubectl top and the resource-based Horizontal and Vertical Pod Autoscalers, so a stable contract here matters for anyone whose scaling depends on it.
Resilient watchcache initialization also reached GA and is on by default. Previously, when the kube-apiserver restarted or lost its cache in a large cluster, it could overwhelm etcd with requests and degrade or take down the control plane. The apiserver now bounds what it delegates and returns HTTP 429 for the rest.
Pod certificates graduated to stable, giving native support for bootstrapping mTLS between internal services without an external tool.
In beta: the kubelet can run in a Linux user namespace (KubeletInUserNamespace), enabled by default, so core node components run as non-root on the host, which is meant to limit the blast radius of container escapes. HorizontalPodAutoscaler scale-to-zero is also beta and enabled by default, aimed at cutting idle cost for workloads such as GPU-backed inference.
Alpha additions include workload-aware scheduling that can preempt low-priority pods to make room for in-place vertical resizing of higher-priority ones, pod-level checkpoint and restore for debugging or forensic analysis, and a Recreate rollout strategy for StatefulSets that clears stuck pods without manual deletion. The release contains 27 alpha features, 23 graduating to beta, 16 going GA or stable and one deprecation or removal. Version 1.38 is expected in December 2026.
Why it matters
For a small or medium business, most of the value here is operational rather than novel. The Metrics API going stable removes a small but real source of breakage during upgrades for anyone running autoscaling. The watchcache change is insurance against a failure mode that tends to hit precisely when a cluster is already under stress, and it costs nothing to get.
Rootless kubelet is the most interesting security item, but it is beta and on by default, which means it can change node behaviour on upgrade without anyone opting in. Pod certificates may let smaller teams drop a piece of home-grown or third-party PKI tooling, though replacing a working mTLS setup is rarely urgent.
Scale-to-zero is worth attention if you pay for GPU capacity that sits idle between requests. It also introduces cold starts, so it is a trade-off, not a free saving.
What to do
- Before upgrading, read the release notes for the two default-on beta gates: run the kubelet in user namespaces in a staging cluster first, especially if you use privileged pods, host paths or custom CSI and CNI plugins.
- If you rely on a metrics adapter or older autoscaler tooling, confirm it works against the GA Metrics API.
- Evaluate HPA scale-to-zero only for workloads that tolerate cold starts, and measure the actual cost delta before rolling it out.
- Treat the alpha features as evaluation material. Checkpoint and restore in particular produces memory snapshots, which are sensitive artefacts and need storage and access rules before use.