Upgrade hop
Kubernetes 1.36 → 1.37
1 · Fix removed APIs first
Only alpha or off-by-default beta versions are removed in this hop.
| Kind | API version | Stops being served | Use instead |
|---|---|---|---|
| ClusterTrustBundle | certificates.k8s.io/v1alpha1 alpha · off |
1.37 | certificates.k8s.io/v1 |
| IPAddress | networking.k8s.io/v1beta1 beta · off by default | 1.37 | networking.k8s.io/v1 |
| ServiceCIDR | networking.k8s.io/v1beta1 beta · off by default | 1.37 | networking.k8s.io/v1 |
| VolumeAttributesClass | storage.k8s.io/v1beta1 beta · off by default | 1.37 | storage.k8s.io/v1 |
Check your files with the manifest checker; in a live cluster, the API server metric apiserver_requested_deprecated_apis shows which deprecated APIs clients still call.
2 · Other changes that can bite
Removed in 1.37
- Static Pods can no longer reference Secrets or ConfigMaps, and the PreventStaticPodAPIReferences gate that allowed opting out of this restriction is gone.
Deprecated in 1.37
- kube-dns is deprecated; CoreDNS has been the default since v1.13. No new kube-dns packages are expected after v1.40, so plan a migration.
- kube-proxy ipvs mode now logs a deprecation warning; it is expected to be off by default by v1.40 and removed by v1.43.
- The kubectl run --filename/-f flag is being deprecated, since the generated Pod is built only from command-line arguments.
- cgroup v1: since v1.35 the kubelet refuses cgroup v1 nodes unless failCgroupV1 is set to false. That override still exists, but full removal is planned.
Our summary of the 1.37 release announcement (CC BY 4.0). Read the full changelog for your components.
3 · Upgrade in this order
- Prepare. Move every node to 1.34 or newer if any are older: a 1.37 API server supports kubelets back to 1.34 only. Upgrade to the newest 1.36 patch,
1.36.6. - kube-apiserver to 1.37 (in HA clusters, one instance at a time; old and new may differ by one minor during the roll). Use the newest patch,
1.37.2. - kube-controller-manager, kube-scheduler, cloud-controller-manager to 1.37, once every API server is on 1.37.
- kubelet on each node (drain first). Optional in this hop: kubelets from 1.34 to 1.37 all work with a 1.37 control plane.
- kube-proxy: no newer than the API server, and within the same window as the kubelet it runs beside.
- kubectl: 1.36 to 1.38 all talk to a 1.37 API server.
From the official version skew policy. Managed services run the control-plane steps for you; node pools are still yours to schedule.