Kubernetes 1.37 (Garhwal): Production-Focused Reliability, Scheduling, and Resource Management

Kubernetes 1.37, themed Garhwal, delivers 67 enhancements: 16 graduating to Stable, 23 to Beta, 27 entering Alpha, and one categorized as a deprecation or removal. The release emphasizes control-plane resilience, workload-aware scheduling, Dynamic Resource Allocation (DRA), node resource management, storage operations, and stronger workload identity.

The official release announcement draws its theme and logo from the Garhwal Himalayan region of Uttarakhand, India. Terraced fields, rivers, mountain paths, deodar forests, traditional craft, and the Himalayan monal symbolize the interconnected layers and contributions that make up a Kubernetes release.

Key highlights and graduations

SIG API Machinery and control-plane reliability

Stable: resilient watch-cache initialization

The remaining WatchCacheInitializationPostStartHook feature gate is now Stable, locked on, and completes the resilient watch-cache initialization work whose primary feature gate reached Stable in Kubernetes 1.34.

During API server startup or cache reinitialization, kube-apiserver now avoids generating an unbounded traffic spike against etcd. Requests that cannot be safely delegated are rejected with HTTP 429 Too Many Requests rather than consuming excessive etcd or API Priority and Fairness capacity.

This reduces control-plane outage risk in large clusters. However, API clients—including custom controllers and operators—must correctly process HTTP 429 responses, honor Retry-After, and use exponential backoff.

Stable: in-tree Storage Version Migrator

The storagemigration.k8s.io/v1 API and the StorageVersionMigration feature gate are now Stable and enabled by default. A built-in control-plane controller can declaratively rewrite built-in and custom resources into an API’s current storage version.

This is useful after:

• Changing an API’s preferred storage version.
• Upgrading a CRD from an older storage version.
• Changing encryption-at-rest configuration and needing existing objects rewritten with the new settings.

Migration progress is exposed through StorageVersionMigration conditions, including the number of processed objects.

Beta: manifest-based admission control

The ManifestBasedAdmissionControlConfig feature gate graduates to Beta and is enabled by default. Admission webhooks and CEL-based policies can be loaded from files under the staticManifestsDir field of AdmissionConfiguration.

Manifest-based policies are available from API server startup, continue operating when etcd is unavailable, and can protect API-hosted admission resources from modification. Valid file changes are reloaded automatically; invalid updates leave the previously valid configuration active.

Operators should treat the manifest directory as security-sensitive control-plane configuration and include it in configuration management, change review, and recovery procedures.

Beta: etcd RangeStream

The EtcdRangeStream feature gate is Beta, applies to kube-apiserver, and is enabled by default. Instead of building a complete etcd range response in memory, the new server-streaming RPC returns snapshot-consistent chunks.

The primary beneficiary is watch-cache initialization, which can process objects as chunks arrive. This reduces memory spikes and avoids the repeated index-walking cost associated with paginated range requests.

Native RangeStream support requires etcd 3.7 or later. Against an older etcd server, kube-apiserver detects an Unimplemented response and automatically falls back to the unary Range RPC, so etcd 3.7 is not described as a hard cluster-wide minimum for this feature. Kubernetes 1.37 updates the default etcd version to 3.7.0 and the etcd client library to 3.6.10.

Beta: concurrent watch-object decoding

ConcurrentWatchObjectDecode is Beta and enabled by default. Watch-event decoding and transformation can use a bounded pool of ten worker goroutines while preserving original event order.

This is particularly valuable for CRDs whose served and stored versions differ and therefore require conversion. Operators should monitor conversion webhooks during cache initialization: the total number of conversions does not change, but up to ten conversions may now execute concurrently.

Beta: safer handling of undecryptable resources

AllowUnsafeMalformedObjectDeletion is Beta and enabled by default. Administrators can identify and remove resources that the API server cannot decrypt without directly editing etcd. Dry-run support allows deletion requests to be tested before destructive action.

This capability should remain a recovery mechanism rather than a substitute for encryption-key lifecycle management and tested backup procedures.

Beta: compressed WatchList responses

The WatchListCompression feature gate is Beta and enabled by default. Clients sending Accept-Encoding: gzip can receive compressed WatchList responses. Regular watch requests are unaffected.

SIG Scheduling and workload-aware scheduling

Beta: gang scheduling

The core Workload and PodGroup APIs graduate to scheduling.k8s.io/v1beta1. Gang scheduling provides an all-or-nothing strategy so that a group of Pods is scheduled only when sufficient resources exist for the group.

The Beta implementation includes:

• PodGroup queueing.
• Workload-aware preemption.
• Protection against workloads repeatedly interfering with one another without making progress.
• A PlacementFeasible scheduler extension point that can stop evaluation once a PodGroup’s minCount becomes unsatisfiable.

The earlier GangScheduling and WorkloadAwarePreemption feature gates have been removed. Core workload-aware scheduling is now controlled through GenericWorkload.

Beta: workload-aware preemption

The scheduler can consider a PodGroup as a workload when making preemption decisions. This reduces disruption of lower-priority Pods when those preemptions would still fail to create enough capacity for the requesting workload.

The PodGroup APIs also gain preemption-policy controls, and PodGroup priority validation ensures that evaluated Pods are consistent with the group.

Beta: DRA claims for workloads

DRAWorkloadResourceClaims is Beta but remains disabled by default. It allows Workload and PodGroup resources to associate ResourceClaim and ResourceClaimTemplate objects with groups of Pods, enabling claims to be shared or generated at workload scope.

Alpha: richer workload composition

Kubernetes 1.37 adds several Alpha building blocks for more complex AI/ML, batch, and HPC scheduling:

• CompositePodGroup represents hierarchical rather than flat Pod groups.
• Workload-aware scheduling controller APIs provide reusable scheduling.k8s.io primitives and shared libraries for workload controllers.
• batch/v1 Job gains a spec.scheduling field for scheduling policies, topology constraints, disruption modes, and resource claims.
• InPlacePodVerticalScalingSchedulerPreemption allows lower-priority Pods to be preempted to satisfy a higher-priority Pod’s deferred in-place resize.

These APIs are Alpha and should not be treated as stable integration contracts.

SIG Node and Dynamic Resource Allocation

Stable: node-declared features

NodeDeclaredFeatures is now Stable. Nodes report feature availability through .status.declaredFeatures, allowing control-plane components to make decisions safely in clusters with mixed node versions.

The kubelet calculates declared features from feature gates and static configuration at startup. Changes therefore require a kubelet restart.

Stable: DRA device status

ResourceClaim.status.devices and the DRAResourceClaimDeviceStatus feature gate graduate to Stable. Drivers can report per-device status, including standardized information useful for secondary network interfaces.

This gives operators and other components a supported way to inspect how an allocated device was configured.

Stable: DRA extended resources

DRA drivers can fulfill traditional extended-resource requests such as abc.example/gpu: 3 without requiring a separate device plugin or an explicit ResourceClaim in the workload.

An extended-resource name can be associated with a DeviceClass, allowing existing resource-request patterns to use DRA allocation.

Stable: device taints and tolerations

DRA device taints and tolerations are Stable through the resource.k8s.io/v1 API. Drivers can taint individual devices, while administrators can use DeviceTaintRule to select and taint groups of devices.

This provides finer control than node-level taints when only a particular accelerator, interface, or other device should be withheld from general allocation.

Stable: standard NUMA-node attribute

Kubernetes defines resource.kubernetes.io/numaNode as a standard DRA device attribute. Drivers can use a common name for NUMA placement, allowing devices from different drivers to be compared consistently.

Beta: memory QoS with cgroups v2

MemoryQoS graduates to Beta and is enabled by default. On Linux nodes using cgroups v2, Kubernetes can use controls such as memory.min, memory.low, and memory.high for memory protection and throttling.

The kubelet settings involved are:

• memoryReservationPolicy
• memoryThrottlingFactor

The changelog states that memoryThrottlingFactor defaults to nil and memory.high is not set unless explicitly configured. This avoids introducing unexpected throttling for existing workloads during upgrade.

Beta: Pod and container statistics from CRI

PodAndContainerStatsFromCRI is Beta but disabled by default. It allows kubelet to obtain Pod and container statistics directly from a compatible container runtime rather than collecting the same information independently through cAdvisor.

Runtime compatibility and metric parity should be tested before enabling it in production.

Beta: Pod-level resource managers

Pod-level resource managers allow CPU, memory, and topology managers to consider a Pod’s aggregate resources when making allocation and NUMA-alignment decisions.

The supplied official excerpts conflict on the default state of PodLevelResourceManagers: the release blog says the Beta gate remains disabled by default, while the v1.37.0 changelog says it is enabled by default. Operators must verify the effective setting in their exact Kubernetes 1.37 build or distribution rather than relying on either summary alone.

Alpha: Pod checkpoint and restore

The CRI v1 RuntimeService API gains CheckpointPod and RestorePod RPCs. This is Alpha support and requires a container runtime that implements both RPCs; upgrading Kubernetes alone does not provide checkpoint-and-restore capability.

Alpha: node lifecycle conditions

Kubernetes introduces well-known Node conditions:

• DrainInProgress
• Drained
• MaintenancePlanned
• MaintenanceInProgress
• GracefulNodeShutdownInProgress

These provide a Kubernetes-owned location for lifecycle state that controllers and ecosystem tooling can consume.

SIG Storage

Stable: SELinux volume mount behavior

SELinuxMount and SELinuxChangePolicy reach Stable and are enabled by default. For CSI drivers that opt in with CSIDriver.spec.seLinuxMount: true, volumes use the mount option -o context=<label> instead of recursively relabeling the volume.

This is an important upgrade risk. A mount can carry only one SELinux context, so Pods with different SELinux labels that share a volume on the same node may fail to start. A workload can retain recursive relabeling by setting:

spec:
  seLinuxChangePolicy: Recursive

The behavior can still be disabled cluster-wide in 1.37, but the release announcement states that it becomes locked in Kubernetes 1.38. Clusters without SELinux enabled are unaffected.

Beta: PVC unused-since tracking

PersistentVolumeClaimUnusedSinceTime is Beta and enabled by default. The PVC protection controller adds an Unused condition to PersistentVolumeClaimStatus:

• True, with reason NoPodsUsingPVC, after no non-terminal Pod references the claim.
• False, with reason PodUsingPVC, once a Pod references it again.

The condition’s lastTransitionTime can be used as an “unused since” timestamp. Kubernetes does not automatically delete the PVC, and the timestamp reflects controller observation rather than the exact infrastructure-level unmount time.

Beta: storage-capacity scoring

StorageCapacityScoring allows the scheduler’s VolumeBinding plugin to score nodes for dynamically provisioned volumes using CSIStorageCapacity objects.

Administrators select the scoring strategy through VolumeBindingArgs.Shape. The default prefers the node with the maximum allocatable capacity. Dynamic-provisioning awareness requires StorageCapacity: true on the relevant CSIDriver.

This feature consolidates and deprecates the older VolumeCapacityPriority feature gate.

Beta: CSI attach limits and Cluster Autoscaler

VolumeLimitScaling is Beta and opt-in. Cluster Autoscaler can simulate scale-ups using templated CSINode objects so CSI attach limits are considered even when scaling a node group from zero.

A new CSIDriver field, PreventPodSchedulingIfMissing, can block placement on nodes that have not yet reported the required driver. Scheduling failures use dedicated CSIDriverMissingOnNode and CSINodeMissing errors.

Alpha: resizing memory-backed volumes

InPlacePodVerticalScalingMemoryBackedVolumes allows an explicit sizeLimit change for an emptyDir volume with medium: Memory through the Pod /resize subresource. The kubelet updates the underlying tmpfs mount without restarting containers.

The feature is Alpha, opt-in, and disabled by default.

SIG Auth and security

Stable: Pod certificates and ClusterTrustBundles

Pod certificates, ClusterTrustBundle, and ClusterTrustBundleProjection graduate to Stable and are enabled by default.

An administrator deploys a signer controller that watches PodCertificateRequest objects, issues and refreshes certificates, and maintains the associated trust bundles. Workloads consume identities and trust anchors through projected volumes.

The Stable PodCertificateRequest API removes the PKIXPublicKey and ProofOfPossession fields that were deprecated in v1beta1. Clients still setting those fields must be updated before migration to the Stable API.

Kubernetes 1.37 also strengthens NodeRestriction: a node may request a signer only when the referenced Pod mounts a matching podCertificate projected volume, unless a separate authorization check succeeds.

Beta: native histograms and security observability

NativeHistograms is Beta. When enabled and scraped with the PrometheusProto protocol, Kubernetes components can expose both classic and native histogram forms, allowing existing dashboards to continue working during migration.

Several security-related metrics also move to Beta, including service-account token metrics and API server webhook metrics for missing SANs and insecure SHA-1 certificates.

SIG Autoscaling

Beta: HorizontalPodAutoscaler scaling to zero

HPA scaling to and from zero is Beta and enabled by default. For object or external metrics, setting:

spec:
  minReplicas: 0

allows a workload to reach zero replicas while idle and scale back up when demand returns.

CPU and memory metrics cannot drive scale-from-zero because they depend on running Pods. The HPA records a ScaledToZero=True condition while it is holding the workload at zero, distinguishing that state from a workload manually set to zero replicas.

SIG Network and cloud provider

Stable: relaxed Service-name validation

RelaxedServiceNameValidation is Stable. This is one of the release’s 16 Stable enhancements and broadens accepted Service names under the graduated behavior.

Beta: watch-based route reconciliation

CloudControllerManagerWatchBasedRoutesReconciliation is Beta but disabled by default. Route reconciliation can react to relevant Node events instead of waiting for the default periodic interval, while retaining a less frequent periodic reconciliation to detect drift.

The Alpha route_controller_route_sync_total metric includes:

• trigger: periodic or node_change
• outcome: changed, noop, or error

The change affects when reconciliation starts, not the route-reconciliation logic itself.

Alpha: localhost NodePort support for nftables

The nftables kube-proxy backend gains an opt-in userspace proxy for accessing NodePort Services through localhost over IPv4 or IPv6. It is activated when localhost or a loopback address is included in kube-proxy’s --nodeport-addresses configuration.

The iptables and IPVS backends retain their existing behavior.

Improved nftables performance

The nftables backend now uses the kernel’s netlink interface directly instead of invoking the nft command-line tool, reducing overhead when inspecting and updating rules.

SIG CLI and instrumentation

Stable: KYAML

KYAML is a safer, less ambiguous subset of YAML designed for Kubernetes. It is not a YAML replacement: every KYAML document is valid YAML, and existing manifests and pipelines do not need to change.

The following output form is now Stable:

kubectl get -o kyaml

Stable: metrics.k8s.io/v1

The metrics.k8s.io API graduates from v1beta1 to v1 without schema changes. It supplies CPU and memory usage for Pods and Nodes and supports consumers such as HPA and kubectl top.

v1beta1 remains available during the API deprecation-policy transition, allowing metrics components and clients to move incrementally. Kubernetes 1.37 adds metrics.k8s.io/v1 support to kubectl top.

Complete Stable graduation summary

The release announcement identifies these 16 Stable enhancements:

1. Faster recursive SELinux label changes.
2. ClusterTrustBundles.
3. Pod certificates.
4. Arbitrary FQDN as a Pod hostname.
5. DRA ResourceClaim device status.
6. Configurable HPA tolerance.
7. Relaxed Service-name validation.
8. Resource health status in Pod status for Device Plugin and DRA.
9. DRA device taints and tolerations.
10. Extended-resource requests fulfilled through DRA.
11. Node-declared features.
12. Sandbox-creation condition.
13. In-tree Storage Version Migrator.
14. Resilient watch-cache initialization.
15. Standard DRA numaNode device attribute.
16. metrics.k8s.io/v1 and Stable KYAML output, as listed in the official release material.

Because the supplied release text presents KYAML as a Stable graduation while also describing a 16-item total whose surrounding list formatting is ambiguous, consult the complete official v1.37 changelog when building a machine-readable graduation inventory.

Deprecations, removals, and breaking changes

scheduling.k8s.io/v1alpha2 removed

The scheduling.k8s.io API moves from v1alpha2 to v1alpha3 for Alpha objects, while the core Workload and PodGroup types graduate to v1beta1. The v1alpha2 version is dropped entirely.

Required action: remove all scheduling.k8s.io/v1alpha2 objects from kube-apiserver before upgrading from Kubernetes 1.36 to 1.37. The DisruptionMode enum also changes to a struct, so clients and manifests must be updated for the newer schema.

PodCertificateRequest fields removed

The Stable PodCertificateRequest API removes:

• PKIXPublicKey
• ProofOfPossession

These fields were deprecated in v1beta1. Update clients that still set them before adopting the Stable API.

Kubelet cAdvisor flags removed

After moving to the leaner github.com/google/cadvisor/lib module, kubelet no longer accepts the following deprecated cAdvisor flags:

--application-metrics-count-limit
--boot-id-file
--container-hints
--containerd
--containerd-namespace
--enable-load-reader
--event-storage-age-limit
--event-storage-event-limit
--global-housekeeping-interval
--log-cadvisor-usage
--machine-id-file
--storage-driver-user
--storage-driver-password
--storage-driver-host
--storage-driver-db
--storage-driver-table
--storage-driver-secure
--storage-driver-buffer-duration

Only --housekeeping-interval remains. Kubelet will fail to start if any removed flag is still configured.

The following cAdvisor surfaces are also removed:

• userDefinedMetrics from /stats/summary.
• Custom container_application_* metrics.
• container_cpu_load_average_10s.
• container_cpu_load_d_average_10s.
• container_tasks_state.

Audit node configuration and monitoring rules before worker upgrades.

Kubelet eventRecordQPS behavior corrected

A value of 0 for eventRecordQPS now means unlimited, matching the documentation. Deployments that depended on the earlier effective behavior must set an explicit non-zero value, such as 50.

Kubelet configuration logging and nodes/logs

Kubelet now logs its effective configuration at startup. Because this can expose configuration details, access to the nodes/logs ClusterRole should be restricted to trusted users.

DRA resource-health API transition

The DRA resource-health kubelet gRPC API graduates to v1. The v1alpha1 API is deprecated and planned for removal in Kubernetes 1.40.

Driver authors using the k8s.io/dynamic-resource-allocation/kubeletplugin helper must implement DRAPlugin.WatchHealthStatus. Drivers without health support must return ErrHealthNotSupported or disable the service with HealthService(false).

This is a Go API compile-time break for existing drivers, although the helper serves both v1 and v1alpha1 during the transition.

Feature gates removed or locked

• GangScheduling and WorkloadAwarePreemption are removed; use GenericWorkload.
• AnyVolumeDataSource is removed after being locked on since Kubernetes 1.33.
• DeclarativeValidationTakeover is locked to its default and can no longer be set.
• HostnameOverride is locked enabled after reaching Stable.

Remove obsolete feature-gate entries from component configuration.

PodStatusResult removed

The unused PodStatusResult API type is removed. It had no REST endpoint and had been unused since 2015. Go clients or generated code referencing this type must be updated.

Cloud-controller-manager configuration field moved

NodeSyncPeriod moves from KubeCloudSharedConfiguration to:

CloudControllerManagerConfiguration.NodeLifecycleController.NodeMonitorPeriod

Review cloud-controller-manager configuration before upgrading.

gRPC strict path checking

google.golang.org/grpc is updated to 1.82.1. The GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING environment variable is removed, and strict path checking is always enabled.

kube-proxy deprecations and future defaults

Kubernetes 1.37 warns when kube-proxy mode is not explicitly configured because the future Linux default is planned to change from iptables to nftables.

Additional points:

• kubeadm explicitly sets KubeProxyConfiguration.mode to iptables when the configuration or mode is omitted.
• IPVS mode has been deprecated since Kubernetes 1.35.
• A KubeProxyIPVS feature gate is added in preparation for deactivating and eventually removing IPVS mode.
• The ignored --filename / -f flag on kubectl run is deprecated.
• VolumeCapacityPriority is deprecated in favor of StorageCapacityScoring.

kube-dns deprecation

CoreDNS has been the default cluster DNS add-on since Kubernetes 1.13. The kube-dns subproject has been retired, does not support capabilities such as EndpointSlices and dual-stack Services, and is not expected to receive new packages.

Clusters still using kube-dns should plan a migration to CoreDNS. The supplied excerpts do not include a verified migration procedure, so distribution-specific instructions must be checked manually.

Upgrade impact and operational notes

Before upgrading the control plane

Review the official v1.37 changelog , particularly its urgent upgrade notes, and verify:

1. No scheduling.k8s.io/v1alpha2 objects remain.
2. Admission manifests and staticManifestsDir ownership are controlled.
3. Custom API clients handle HTTP 429 responses with backoff.
4. Conversion webhooks can tolerate up to ten concurrent conversions during watch-cache initialization.
5. Pod certificate clients no longer depend on removed fields.
6. Obsolete feature-gate entries have been removed.
7. Cloud-controller-manager configuration uses the new NodeMonitorPeriod location.
8. Encryption recovery procedures account for the Beta undecryptable-resource deletion capability.

If etcd is older than 3.7, EtcdRangeStream falls back automatically. Operators seeking its streaming benefits must verify that their etcd deployment supports the new RPC.

Before upgrading workers

Audit every kubelet configuration for the removed cAdvisor flags. A remaining flag can prevent kubelet startup.

Also verify:

• The intended eventRecordQPS value is explicit.
• Access to nodes/logs is restricted.
• SELinux-enabled nodes and CSI drivers have been assessed for shared-volume label conflicts.
• Container runtimes support any optional CRI-dependent functionality being enabled.
• Monitoring does not depend on removed cAdvisor fields or metric series.
• DRA drivers are compatible with the Stable and Beta API changes.

SELinux deserves a dedicated rollout check

For SELinux-enabled clusters, identify workloads that:

• Share the same volume on one node.
• Use different SELinux labels.
• Use a CSI driver with CSIDriver.spec.seLinuxMount: true.

Those workloads can fail after the new mount behavior takes effect. Use per-Pod spec.seLinuxChangePolicy: Recursive where the older recursive behavior is required, or use the temporary cluster-wide opt-out available in Kubernetes 1.37.

Revalidate feature-gate defaults

Several capabilities are Beta but remain opt-in, including:

• PodAndContainerStatsFromCRI
• DRAWorkloadResourceClaims
• CloudControllerManagerWatchBasedRoutesReconciliation
• VolumeLimitScaling

Others are enabled by default, including:

• EtcdRangeStream
• ConcurrentWatchObjectDecode
• ManifestBasedAdmissionControlConfig
• PersistentVolumeClaimUnusedSinceTime
• WatchListCompression
• HPA scale to zero
• MemoryQoS

Because the official excerpts conflict about PodLevelResourceManagers, confirm its effective value directly in the Kubernetes build or managed service being upgraded.

StatefulSet behavior

MaxUnavailableStatefulSet is re-enabled by default after a Kubernetes 1.36 bug was fixed. The bug could leave a Pod from a faulty initial revision stuck in CrashLoopBackOff rather than updating it to a corrected revision.

Kubernetes 1.37 also introduces an Alpha Recreate strategy for StatefulSets behind StatefulSetRecreateStrategy. It deletes all StatefulSet Pods, waits for complete termination, and then recreates them according to podManagementPolicy.

Conclusion

Kubernetes 1.37 is a substantial release for operators running large, resource-intensive, or security-sensitive clusters. Its most immediate production benefits are stronger API server recovery behavior, streaming and concurrent watch-cache initialization, Stable storage-version migration, better DRA support, workload-aware scheduling, PVC usage visibility, and first-class Pod identity distribution.

The upgrade is not risk-free. SELinux mount behavior, removal of scheduling.k8s.io/v1alpha2, rejected cAdvisor flags, kubelet event-rate semantics, Pod certificate API cleanup, and DRA driver compatibility all require explicit review before rollout.

Official resources

• Kubernetes 1.37 “Garhwal” release announcement
• Official Kubernetes 1.37 changelog and release notes
• Kubernetes v1.37.0 GitHub release tag
• Kubernetes documentation