Kubernetes 1.37 Release Highlights Discussion

[SwathiR03]

This is a discussion to collect the Release Highlights for the 1.37 release cycle.

Release Highlights are an essential part of the Kubernetes release cycle as they provide a birds-eye view of improvements, breaking or user-facing changes that are coming as part of the upcoming release. The release Comms team is asking for SIGs to comment on this discussion with items that we should highlight in release communications for v1.37.

For each submission, please include a link to the KEP, the stage the feature is moving to, and a brief description of the KEP that will be used as an outline for the blog post content.

The deadline for v1.37 Release Highlights is 28th July, 2026(Tuesday).

Here is the discussion thread from the last release cycle.

cc @kubernetes/release-team-leads
cc @RinkiyaKeDad @TineoC @kirti763 @SophiaUgo @troy0820 @dipesh-rawat @aibarbetta @Prajyot-Parab

Ref: #3027
xref to contacts issue: #3052

[TineoC]

Breaking Changes, Deprecations, and Removals for v1.37

SIG API Machinery

KEP	Change	Type
KEP-6178	ConcurrentWatchObjectDecode graduates to Beta, enabled by default	Behavioral Change

SIG Network

KEP	Change	Type
KEP-5495	kube-proxy IPVS mode deprecation warning added by kubeadm	Deprecation
KEP-5495	kube-proxy mode migration prep - empty mode field defaults to iptables, warning emitted if unset	Deprecation

SIG CLI

KEP	Change	Type
KEP-5295	KYAML feature gate locked to enabled (GA)	Locked

API Removals (expired API versions - no individual KEPs)

• v1alpha1 ClusterTrustBundles (certificates API)
• v1beta1 IPAddress (networking API)
• v1beta1 ServiceCIDR (networking API)
• v1beta1 VolumeAttributesClasses (storage API)

Additional deprecations (no KEP)

• kubectl run --filename/-f flag deprecated (already silently ignored)

cgroup v1 - heads up

cgroup v1 has been soft-disabled since v1.35 (failCgroupV1=true by default). The code is still present but no longer tested. Nothing changes in v1.37 for cgroup v1 - it remains in the same state. However, removal is expected in a future release. For more details, see KEP-5573.

[soltysh]

@TineoC that KYAML functionality is sig-cli 😉 see below: #3051 (comment)

[TineoC]

thx

[neolit123]

SIG Cluster Lifecycle

• kubeadm: the deprecated configuration API v1beta3 was removed and the work on v1 has started:
  • kubeadm: remove the v1beta3 API and PublicKeysECDSA feature gate kubernetes#136016

[SwathiR03]

SIG Autoscaling:

HPA scale to zero being promoted to Beta - kubernetes/kubernetes#139648

Link: https://kubernetes.slack.com/archives/C09R1LV8S/p1782218285551079

[troy0820]

Sig-Windows:

Nothing to highlight

Link: https://kubernetes.slack.com/archives/C0SJ4AFB7/p1783531799250149?thread_ts=1783517360.474399&cid=C0SJ4AFB7

[TineoC]

These are the ones that stood out to me:

Alpha

1. Pod-Level Checkpoint/Restore http://kubernetes.dev/resources/keps/5823
2. PV Health Monitor http://kubernetes.dev/resources/keps/1432

Beta

1. Kubelet-in-UserNS http://kubernetes.dev/resources/keps/2033
2. HPA scale to/from zero http://kubernetes.dev/resources/keps/2[021](http://kubernetes.dev/resources/keps/2033)

Stable

1. KYAML http://kubernetes.dev/resources/keps/5295
2. Pod Level Resources http://kubernetes.dev/resources/keps/2837 http://kubernetes.dev/resources/keps/552
3. Support for env files https://www.kubernetes.dev/resources/keps/3721
4. metrics.k8s.io is stable https://www.kubernetes.dev/resources/keps/5207/
5. Configurable Tolerance for HPA https://www.kubernetes.dev/resources/keps/4951
6. Arbitrary FQDN as Pod Hostname https://www.kubernetes.dev/resources/keps/4762

[soltysh]

For SIG-CLI:

• We're announcing KYAML as a stable output available across all of kubectl command that support passing --output flag, see KYAML enhancements#5295.

[soltysh]

For SIG-Apps:

• We're continuing integrating Workload API with Job Controller. This release we'll continue with another alpha release, in which we'll expand the Job API with the ability to specify Workload Aware Scheduling. See WAS: Integrate Workload APIs with Job controller enhancements#5547
• After a set of false-starts with maxUnavailable functionality in StatefulSet, we're bringing this functionality back to on by default. See maxUnavailable for StatefulSets enhancements#961.
• To help users alleviate problems with stuck statefulset rollouts, we're introducing a new Recreate strategy, which will recreate all the pods from scratch. See Add Recreate Update Strategy to StatefulSet enhancements#3541.

[kirti763]

Sig UI- has nothing to highlight
https://kubernetes.slack.com/archives/C09R1JVU6/p1782896783506689?thread_ts=1782561557.386749&cid=C09R1JVU6

[TineoC]

Sig Architecture: nothing to highlight for the moment 21 Jul 2026

Slack: https://kubernetes.slack.com/archives/C5P3FE08M/p1784653840348789?thread_ts=1783511484.412809&cid=C5P3FE08M

[TineoC]

Sig Testing: nothing to highlight

Slack: https://kubernetes.slack.com/archives/C09QZ4DQB/p1784654060369279?thread_ts=1783511517.027919&cid=C09QZ4DQB

[TineoC]

Sig Cloud Provider:

highlights:

• KEP 5237: Watch-based route controller reconciliation https://kubernetes.slack.com/archives/C718BPBQ8/p1784654827426579?thread_ts=1783511460.104659&cid=C718BPBQ8

[lukasmetzner]

Better observability for the cloud-provider route controller

The route controller's ALPHA metric route_sync_total gains two labels: trigger (periodic or node_change) and outcome (changed, noop, or error). Operators can now see whether periodic reconciliation is actually correcting route drift or just running as a no-op, and track failed reconciles directly. Part of KEP-5237's push toward beta.

[xing-yang]

SIG Storage:
New Features:

• SELinux Relabeling with Mount Options
  Speeds up container startup by mounting volumes with the correct SELinux label
  The SELinuxChangePolicy and SELinuxMount feature targets GA in Kubernetes v1.37
• Add storage capacity scoring
  The Storage Capacity Scoring of Nodes for Dynamic Provisioning feature targets Beta in Kubernetes v1.37.
• Integrate CSI Volume attach limits with cluster autoscaler
  Integrate CSI volume attach limits with cluster feature targets Beta in Kubernetes v1.37.
• Report last used time on a PVC
  The reporting last used time on a PVC feature targets Beta in Kubernetes v1.37.

Driver disabled:

• Starting in Kubernetes v1.36, the gitRepo volume plugin has been disabled and cannot be enabled. In Kubernetes v1.37, this feature moved to GA.

cc @gnufied @msau42 @jsafrane

[danwinship]

SIG-Network:

• (The note above in the "breaking changes" table about "kube-proxy mode migration prep - empty mode field defaults to iptables, warning emitted if unset" is actually part of KEP-5343 "Make nftables the default kube-proxy backend", not KEP-5495 "Remove ipvs mode in kube-proxy".)

• KEP-4817, "DRA: Resource Claim Status with possible standardized network interface data" is now GA, providing a standardized way for DRA drivers that work with network interfaces to fully describe the attached network interface.

• KEP-6032 adds support for localhost nodeports, eg for running an image registry on localhost. This is currently Alpha, and to enable it you need to both enable a feature gate (--feature-gates=KubeProxyNFTablesLocalhostNodePorts) and also change the nodeport config (--nodeport-addresses=primary,localhost).

• Though it didn't get a KEP, kube-proxy now bypasses the nft command-line tool for "list" operations, and instead uses the kernel netlink interface to nftables directly, allowing it to be much more efficient. (knftables #38, kubernetes #137536)

[danwinship]

@SwathiR03 belatedly, I remembered that we had wanted to mention in the release notes that kube-dns is now deprecated (in favor of CoreDNS, which is what almost everyone was already running anyway). We intend to stop building new packages of it after 1.40.

[SwathiR03]

@danwinship, thanks for bringing this up! Although it didn't make the mid-cycle blog, we'll include it in the release announcement.

[kirti763]

SIG security: Nothing to highlight
https://kubernetes.slack.com/archives/C019LFTGNQ3/p1784907281355849?thread_ts=1784648507.837799&cid=C019LFTGNQ3

[jberkus]

SIG-etcd:

New Features:

• KEP 5966: RangeStream etcd query support for the Kubernetes APIserver is alpha and available for Kubernetes v1.37 users who have enabled the EtcdRangeStream feature gate. Among other benefits, this should speed up Watch Cache initialization while reducing memory usage. This feature requires etcd v3.7 or greater.

[macsko]

SIG Scheduling: Workload-aware scheduling remains our topmost priority with several KEPs around that initiative:

• Workload API ang gang scheduling went to beta
• Workload-aware preemption went to beta
• DRA ResourceClaim support for Workloads went to beta
• CompositePodGroup API was added as alpha
• Controller integration API aka Workload building blocks API was added as alpha
• Job integration with Workload API (together with SIG Apps) remains in alpha, but now uses the building blocks API

Also, for non-WAS features:

• Opportunistic batching remains in beta, but with improvement for multi-pod per node cases using rescoring
• Scheduler preemption for in-place Pod resize was added as alpha
• DRA extended resources went to GA
• DRA device taints and tolerations went to GA
• DRA Node allocatable resource requests remains in alpha, but with new improvements and API changes
• DRA Derived attributes was added as alpha
• DRA Device compatibility groups was added as alpha

[haircommander]

SIG Node:

• Long awaited beta graduated with CRI Stats, Memory QOS and pod-level resource managers
• Node declared features goes GA, unblocking faster feature rollout
• We continue to stabalize DRA features, as well as have added some small new DRA features (numaNode device attribute and node allocatable resource requests))
• Incremental progress on some WG KEPs we’re participating in: API merged for eviction request, and CRI merged for checkpoint/restore.

(cc @SergeyKanzhelev @mrunalp @dchen1107 for any additional thoughts)

[richabanker]

SIG Instrumentation:

• KEP-5207: metrics.k8s.io API definition moves to GA. After a lengthy beta period spanning back to Kubernetes v1.8, the metrics.k8s.io API is officially graduating to stable (v1). This API has proven stable in production environments and has been relied upon for years by consumers such as the Horizontal Pod Autoscaler and kubectl top. The new v1 API surface is structurally identical to v1beta1, ensuring a smooth transition
• KEP-5808: Native Histogram Support for Kubernetes Metrics moves to beta. This feature introduces support for Prometheus Native Histograms to Kubernetes components. By utilizing dynamic exponential bucket boundaries instead of fixed boundaries, native histograms offer significant storage efficiency (roughly a 10x reduction in time series count per histogram), improved query performance, and finer-grained visibility into distributions. To ensure backward compatibility and avoid breaking dashboards and alerts during the migration, users must configure their Prometheus scrape config with scrape_native_histograms: true and always_scrape_classic_histograms: true to receive both formats
• KEP-3077: Contextual Logging: Support for context handling and contextual logging in client-go is now considered complete. There remains a known exception for some authentication plugin log calls reached through APIs that do not support passing a context, which will continue to fall back to the global klog logger

[liggitt]

SIG-auth:

• KEP-4317: Pod Certificates moves to GA. This feature enables delivering X.509 certificates to workloads running in a Kubernetes cluster. Pods request certificates from a specific signer, mounted as a volume. Issuers/signers can be implemented as controllers which monitor PodCertificateRequest API objects (in the certificates.k8s.io/v1 API group), issue / sign the certificates.
• KEP-3257: ClusterTrustBundles moves to GA. This provides a standardized mechanism for certificate signers to distribute their trust anchors to workloads. Signers create ClusterTrustBundle API objects (in the certificates.k8s.io/v1 API group), and pods can request trust bundles from a specific signer be mounted as a volume. This eliminates the need to replicate configmaps in every namespace to distribute certificate trust bundles.

[fedebongio]

SIG API Machinery:

Stable

KEP-4192: Move Storage Version Migrator in-tree moves to GA. Storage-version migration is now a built-in control-plane capability — no external migrator to deploy and operate. The control plane can automatically rewrite stored objects to the current storage version, which matters most for encryption-at-rest key rotation and for safely progressing API versions without leaving stale bytes in etcd.
KEP-4568: Resilient Watchcache Initialization (with SIG Scalability) moves to GA. Enabled by default since v1.31, this hardens API server startup and recovery: watch cache (re)initialization no longer triggers thundering-herd load against etcd, and requests are handled gracefully instead of piling up while the cache warms.

Beta

KEP-6178: Concurrent Watch Object Decode moves to beta, enabled by default. Watch events from etcd are now decoded and transformed across a bounded worker pool instead of serially, preserving exact event ordering — cutting watch cache initialization time by ~40% (up to ~55% with EtcdRangeStream) and preventing conversion-heavy CRDs from stalling cache init past the etcd compaction interval. Operator note: CRD conversion webhooks may see up to 10 concurrent calls during cache initialization (total call volume unchanged).
KEP-5647: Staleness Mitigation and Observability for Controllers moves to beta: staleness metrics plus read-your-own-writes semantics for key kube-controller-manager controllers, with this cycle focused on circuit-breaking and hardening.
KEP-5793: Manifest-Based Admission Control Config moves to beta: admission webhooks and validating/mutating admission policies configured from files at kube-apiserver startup — guaranteed active before the first request is served, and impossible to bypass or delete via the Kubernetes API, enabling platform-level policy guarantees.
KEP-3926: Handling undecryptable resources (with SIG Auth) moves to beta. When encryption-at-rest goes wrong — e.g. a lost KMS key leaving objects that can no longer be decrypted — the API server now clearly identifies undecryptable resources, and cluster admins can remove them through the API rather than performing etcd surgery by hand.

@jpbetz @deads2k @sttts

[SwathiR03]

Hello! I'm Swathi from the release comms team!

We’re currently working on the release announcement blog on issue kubernetes/website#56990 for version 1.37 and are seeking technical reviews for the KEP write-ups included in this cycle.

Please review the announcement blog post and evaluate the KEPs for technical accuracy. We would also appreciate any suggestions for additional details or context that could improve the clarity and completeness of the write-ups! I see Christopher has tagged authors/SIG Chairs on each write-up and while some progress has been made there, I would appreciate if folks who haven't had the chance to review write-ups for KEPs relevant to them can also review them. :)

We would appreciate if the technical review could be completed this week so that we have enough time for any final adjustments next week. Thank you!

cc: @dipesh-rawat @RinkiyaKeDad @kirti763 @TineoC @SophiaUgo @troy0820