SELinux mount labelling
Volumes from opted-in CSI drivers get one SELinux context at mount time instead of recursive relabelling. Pods with different labels sharing a volume may fail; seLinuxChangePolicy: Recursive keeps the old behaviour.
Kubernetes minor release · “Garhwal”
Kubernetes 1.37
Garhwal makes KYAML, the metrics.k8s.io API, Pod certificates, ClusterTrustBundles, in-tree storage version migration and SELinux mount labelling GA, brings HPA scale-to-zero to beta, and deprecates kube-dns and kube-proxy's ipvs mode.
Supported
Supported for another 12 months, until 28 Oct 2027.
Released26 Aug 2026
Maintenance mode28 Aug 2027
End of life28 Oct 2027
Latest patch1.37.228 Oct 2026
Patch releases2
Support span14.1 months
What 1.37 brought
Resilient watch cache initialization
While its cache warms, kube-apiserver no longer floods etcd: it serves bounded requests and answers others with HTTP 429, so clients should honour Retry-After and back off.
HPA scale to zero
Now on by default. With object or external metrics, an HPA can use minReplicas: 0 to idle a workload until work arrives. CPU and memory metrics cannot trigger it.
metrics.k8s.io API
The resource metrics API behind HPA and kubectl top gets a stable v1 after almost nine years in beta; v1beta1 stays usable during the transition.
Pod certificates and ClusterTrustBundles
Pods can receive private keys, X.509 certificates and trust bundles through projected volumes, issued by a signer controller that you deploy.
Storage version migration
The built-in StorageVersionMigration API (storagemigration.k8s.io/v1) is on by default and rewrites stored objects after storage version or encryption-at-rest changes, replacing manual get/replace scripts.
Summarised in our own words from the official “Kubernetes v1.37: Garhwal” announcement (67 tracked enhancements), © The Kubernetes Authors, CC BY 4.0.
APIs that stopped being served in 1.37
Only alpha or off-by-default beta APIs were removed: they matter only if you switched them on with --runtime-config.
| Kind | API version | Stops being served | Use instead |
|---|---|---|---|
| ClusterTrustBundle | certificates.k8s.io/v1alpha1 alpha · off |
1.37 | certificates.k8s.io/v1 |
| IPAddress | networking.k8s.io/v1beta1 beta · off by default | 1.37 | networking.k8s.io/v1 |
| ServiceCIDR | networking.k8s.io/v1beta1 beta · off by default | 1.37 | networking.k8s.io/v1 |
| VolumeAttributesClass | storage.k8s.io/v1beta1 beta · off by default | 1.37 | storage.k8s.io/v1 |
Other removals and deprecations
Removed
- Static Pods can no longer reference Secrets or ConfigMaps, and the PreventStaticPodAPIReferences gate that allowed opting out of this restriction is gone.
Deprecated
- kube-dns is deprecated; CoreDNS has been the default since v1.13. No new kube-dns packages are expected after v1.40, so plan a migration.
- kube-proxy ipvs mode now logs a deprecation warning; it is expected to be off by default by v1.40 and removed by v1.43.
- The kubectl run --filename/-f flag is being deprecated, since the generated Pod is built only from command-line arguments.
- cgroup v1: since v1.35 the kubelet refuses cgroup v1 nodes unless failCgroupV1 is set to false. That override still exists, but full removal is planned.
From the release announcement; our wording.
API versions deprecated in 1.37
Still served in 1.37, but the API server answers with a deprecation warning and a removal is scheduled.
| Kind | API version | Stops being served | Use instead |
|---|---|---|---|
| MutatingAdmissionPolicy | admissionregistration.k8s.io/v1beta1 beta · off by default | 1.40 | admissionregistration.k8s.io/v1 |
| MutatingAdmissionPolicyBinding | admissionregistration.k8s.io/v1beta1 beta · off by default | 1.40 | admissionregistration.k8s.io/v1 |
| ClusterTrustBundle | certificates.k8s.io/v1beta1 beta · off by default | 1.40 | certificates.k8s.io/v1 |
| PodCertificateRequest | certificates.k8s.io/v1beta1 beta · off by default | 1.40 | certificates.k8s.io/v1 |
| StorageVersionMigration | storagemigration.k8s.io/v1beta1 beta · off by default | 1.40 | storagemigration.k8s.io/v1 |
Stable (GA) API kinds new in 1.37
ClusterTrustBundle certificates.k8s.io/v1PodCertificateRequest certificates.k8s.io/v1DeviceTaintRule resource.k8s.io/v1StorageVersionMigration storagemigration.k8s.io/v1
Upgrading
Version skew with a 1.37 API server
- kubelet, kube-proxy: 1.34 to 1.37
- kube-controller-manager, scheduler: 1.36 to 1.37
- kubectl: 1.36 to 1.38
From the official version skew policy as it stands today.
One minor at a time
The API server must not skip minor versions.
1.37 on managed Kubernetes
| Service | Available | End of standard support | End of extended support |
|---|---|---|---|
| Upstream Kubernetes | 26 Aug 2026 | 28 Oct 2027 | — |
| Amazon EKS | 1 Oct 2026 | 1 Dec 2027 | 1 Dec 2028 |
| Google Kubernetes Engine | 22 Oct 2026 | 22 Dec 2027 | 22 Oct 2028 |
| Azure Kubernetes Service | 2026-10 | 31 Oct 2027 | 31 Oct 2028 |
As published by each provider; see managed Kubernetes support for what “extended” means on each and when we last checked.