# Kubernetes v1.37.0

> Kubernetes Core · 2026-08-26

A feature-rich major API release with new capabilities, scheduling and node improvements, maturity promotions, and correctness and performance fixes. Upgrade planning includes API and feature-gate removals, deprecated interface cleanup, and SELinux and kubelet configuration changes that may require manifest, client, or cluster adjustments.

## Action needed
- **[security]** Malformed object deletion admission handling
  - An edge case that could allow malformed object deletion to bypass admission and graceful deletion of well-formed objects is removed.
- **[breaking]** The `WatchListCompression` default
  - This behavior is enabled by default and can be disabled with the `WatchListCompression` feature gate.
- **[breaking]** The `EtcdRangeStream` feature gate
  - The `EtcdRangeStream` feature gate is enabled by default and promoted to Beta.
- **[breaking]** The `AllowUnsafeMalformedObjectDeletion` feature gate
  - The `AllowUnsafeMalformedObjectDeletion` feature gate is promoted to Beta and enabled by default. List errors for objects that cannot be read from storage include the first underlying cause in the error message.
- **[breaking]** The `PodLevelResourceManagers` default
  - The `PodLevelResourceManagers` feature gate is disabled by default because of issues found before release.
- **[breaking]** `kube-scheduler` list-type attribute evaluation
  - `kube-scheduler` evaluates list-type attributes, the `.includes` function, and CEL macros even when the `ListTypeAttributes` feature gate is disabled. This prevents errors during rolling upgrades or when the feature gate is toggled.

## Check if affected
- **[security]** `kubeconfig` migration permissions
  - Applies if you configure a `kubeconfig` file for migration.
  - `client-go` now preserves the source file's permissions when migrating a `kubeconfig` file, such as from `~/.kube/.kubeconfig` to `~/.kube/config`. Previously, the destination file was created with broader permissions.
- **[breaking]** The `SELinuxMount` default
  - Applies if your cluster has SELinux enabled.
  - `SELinuxMount` is enabled by default in `v1.37`. Existing workloads in clusters with SELinux enabled may break.
- **[breaking]** The Workload-Aware Scheduling API types
  - Applies if you use `scheduling.k8s.io/v1alpha2` or `scheduling.k8s.io/v1beta1`.
  - The core Workload-Aware Scheduling API types `Workload` and `PodGroup` are promoted to `scheduling.k8s.io/v1beta1`.
- **[breaking]** The `DisruptionMode` field type
  - Applies if you use `DisruptionMode`.
  - The `DisruptionMode` enum field is converted to a struct to support future extensibility.
- **[breaking]** The `eventRecordQPS` zero value
  - Applies if you configure `eventRecordQPS`.
  - `eventRecordQPS` handling in `kubelet` configuration now treats `0` as unlimited, with no rate limit.
- **[breaking]** The deprecated `cAdvisor` flags
  - Applies if you configure any of `--application-metrics-count-limit`, `--boot-id-file`, `--container-hints`, `--containerd`, `--containerd-namespace`, `--enable-load-reader`, `--event-storage-age-limit`, `--event-storage-event-limit`, `--global-housekeeping-interval`, `--log-cadvisor-usage`, `--machine-id-file`, `--storage-driver-user`, `--storage-driver-password`, `--storage-driver-host`, `--storage-driver-db`, `--storage-driver-table`, `--storage-driver-secure`, or `--storage-driver-buffer-duration`.
  - Deprecated `cAdvisor` flags are no longer accepted. `kubelet` fails to start if any of these flags are set: `--application-metrics-count-limit`, `--boot-id-file`, `--container-hints`, `--containerd`, `--containerd-namespace`, `--enable-load-reader`, `--event-storage-age-limit`, `--event-storage-event-limit`, `--global-housekeeping-interval`, `--log-cadvisor-usage`, `--machine-id-file`, `--storage-driver-user`, `--storage-driver-password`, `--storage-driver-host`, `--storage-driver-db`, `--storage-driver-table`, `--storage-driver-secure`, and `--storage-driver-buffer-duration`.
- **[breaking]** The `DeclarativeValidationTakeover` feature gate
  - Applies if you configure `DeclarativeValidationTakeover`.
  - The `DeclarativeValidationTakeover` feature gate can no longer be set.
- **[breaking]** The `PodCertificateRequest` `v1` fields
  - Applies if you use `PodCertificateRequest v1beta1`.
  - The deprecated `PKIXPublicKey` and `ProofOfPossession` fields in `PodCertificateRequest` `v1beta1` are removed from the `v1` API.
- **[breaking]** The `PKIXPublicKey` and `ProofOfPossession` fields
  - Applies if you use `PKIXPublicKey` or `ProofOfPossession`.
  - `PKIXPublicKey` and `ProofOfPossession` are removed from the `v1` API.
- **[breaking]** The `HostnameOverride` feature gate
  - Applies if you configure `HostnameOverride`.
  - The `HostnameOverride` feature gate is locked to enabled.
- **[breaking]** The `DRAPlugin.WatchHealthStatus` method
  - Applies if you use `DRAPlugin.WatchHealthStatus`.
  - `DRAPlugin.WatchHealthStatus` is now a mandatory method.
- **[breaking]** The Workload-Aware Scheduling feature gates
  - Applies if you configure `GangScheduling` or `WorkloadAwarePreemption`.
  - The `GangScheduling` and `WorkloadAwarePreemption` feature gates are removed. `GenericWorkload` is the replacement feature gate.
- **[breaking]** The `AnyVolumeDataSource` feature gate
  - Applies if you configure `AnyVolumeDataSource`.
  - The generally available `AnyVolumeDataSource` feature gate is removed.
- **[breaking]** Admission webhook round-trip load balancing
  - Applies if you configure `--enable-aggregator-routing=true`.
  - With `--enable-aggregator-routing=true`, `kube-apiserver` evenly load-balances requests across admission webhook endpoints instead of routing concurrent requests to a single cached backend endpoint. The `WebhookRoundTripLoadBalancing` feature gate is Beta and enabled by default, with an opt-out option.
- **[breaking]** `HorizontalPodAutoscaler` scaling to and from zero
  - Applies if you use the `HorizontalPodAutoscaler` (HPA).
  - Scaling the `HorizontalPodAutoscaler` to and from zero is enabled by default.
- **[breaking]** The `MaxUnavailableStatefulSet` default
  - Applies if you use `MaxUnavailableStatefulSet`.
  - The `MaxUnavailableStatefulSet` feature is enabled by default.
- **[breaking]** Admission webhook virtual resource exclusions
  - Applies if you use admission webhooks.
  - Admission webhooks now skip auth and authz virtual resources such as `tokenreviews` and `subjectaccessreviews`, which are already excluded by ValidatingAdmissionPolicy and MutatingAdmissionPolicy. The Beta `ExcludeAdmissionWebhookVirtualResources` feature gate is enabled by default and provides an opt-out.
- **[breaking]** The `NodeLocalCRISocket` feature gate
  - Applies if you run `kubeadm`.
  - `kubeadm` removes the `NodeLocalCRISocket` feature gate, which graduated to GA and was locked to enabled by default in a previous release.
- **[breaking]** The `HPAOptimizedSelectorStore` feature gate
  - Applies if you run the HorizontalPodAutoscaler controller.
  - The Beta `HPAOptimizedSelectorStore` feature gate is enabled by default. It reduces lock contention in the HorizontalPodAutoscaler controller's selector overlap detection and improves reconciliation throughput at high HorizontalPodAutoscaler counts and concurrency.
- **[breaking]** The `kubectl get` `--label-columns` constraint
  - Applies if you configure `--label-columns`.
  - `kubectl get` now returns an error when `--label-columns` is used with custom-columns output.
- **[breaking]** The `image.reference` validation
  - Applies if you configure `image.reference`.
  - Image volume validation now rejects empty `image.reference` fields in Pod templates, including Deployment, StatefulSet, DaemonSet, and Job templates.
- **[breaking]** The `kubelet` logs endpoint methods
  - Applies if you run `kubelet`.
  - `kubelet` enforces explicit HTTP method restrictions for logs-related endpoints. Read-only `kubelet` server endpoints reject non-GET methods with 405, while `NodeLogQuery` accepts only GET and POST.
- **[breaking]** The `NFTablesNetlink` default
  - Applies if you run `kube-proxy` nftables mode.
  - Netlink support is enabled by default in `kube-proxy` nftables mode.
- **[breaking]** The PodGroup validation Alpha admission plugin
  - Applies if you use the Alpha admission plugin.
  - The Alpha admission plugin that validated PodGroup references to existing Workload resources and matched declared PodGroupTemplate specifications is removed.
- **[breaking]** The `kube-proxy` Node state response
  - Applies if you run `kube-proxy`.
  - `kube-proxy` exits when the watched Node's IPs change or when the Node object is deleted, so it can restart with updated node networking state.
- **[breaking]** Hugepage-aware `memory.available` eviction
  - Applies if your nodes use hugepages.
  - The `kubelet` eviction manager excludes hugepage-reserved RAM from `AvailableBytes` when calculating `memory.available` on nodes with hugepages. The `HugepageAwareEviction` feature gate is enabled by default and can be disabled to restore the previous behavior.
- **[breaking]** The `DRAPrioritizedList` feature gate
  - Applies if you use DRA.
  - The `DRAPrioritizedList` feature gate is locked to enabled by default. The Prioritized List feature reached GA in `v1.36` and can no longer be disabled.
- **[breaking]** The `RelaxedDNSSearchValidation` feature gate
  - Applies if you configure `RelaxedDNSSearchValidation`.
  - The `RelaxedDNSSearchValidation` feature gate is removed.
- **[breaking]** The locked GA feature gates
  - Applies if you configure `RetryGenerateName`, `BtreeWatchCache`, `OrderedNamespaceDeletion`, `StreamingCollectionEncodingToJSON`, `StreamingCollectionEncodingToProtobuf`, `APIServerTracing`, `ResilientWatchCacheInitialization`, or `ConsistentListFromCache`.
  - The locked GA feature gates `RetryGenerateName`, `BtreeWatchCache`, `OrderedNamespaceDeletion`, `StreamingCollectionEncodingToJSON`, `StreamingCollectionEncodingToProtobuf`, `APIServerTracing`, `ResilientWatchCacheInitialization`, and `ConsistentListFromCache` are removed.
- **[breaking]** The `--concurrent-service-syncs` flag
  - Applies if you configure `--concurrent-service-syncs`.
  - The `--concurrent-service-syncs` `kube-controller-manager` flag is removed. It has been a no-op since `v1.31`.
- **[breaking]** The `PreventStaticPodAPIReferences` feature gate
  - Applies if you configure `PreventStaticPodAPIReferences`.
  - The `PreventStaticPodAPIReferences` feature gate is removed. Static Pods can no longer reference API resources, and this behavior can no longer be disabled.
- **[breaking]** The `SidecarContainers` feature gate
  - Applies if you configure `SidecarContainers`.
  - The `SidecarContainers` feature gate, unconditionally enabled since `v1.33`, is removed.
- **[breaking]** The deprecated API server cache list metrics
  - Applies if you use `apiserver_cache_list_total`, `apiserver_cache_list_fetched_objects_total`, or `apiserver_cache_list_returned_objects_total`.
  - The deprecated Alpha metrics `apiserver_cache_list_total`, `apiserver_cache_list_fetched_objects_total`, and `apiserver_cache_list_returned_objects_total` are no longer exposed by default. Consumers should migrate to the unified `apiserver_storage_list_*` metrics with the `storage="watchcache"` label.
- **[breaking]** The `DefaultWatchCacheSize` field
  - Applies if you configure `DefaultWatchCacheSize`.
  - The no-op `DefaultWatchCacheSize` field of `k8s.io/apiserver/pkg/server/options.EtcdOptions` is removed.
- **[breaking]** The `kubeadm` `v1beta3` API and `PublicKeysECDSA` feature gate
  - Applies if you use the `v1beta3` API or configure `PublicKeysECDSA`.
  - `kubeadm` removes the deprecated `v1beta3` API and the `PublicKeysECDSA` feature gate. `v1beta4` uses `ClusterConfiguration.EncryptionAlgorithm` for ECDSA key support, and a placeholder experimental `v1` API is added but cannot yet be used.

## Plan ahead
- **[deprecated]** The `kube-proxy` ipvs mode
  - Applies if you run `kube-proxy`'s ipvs mode.
  - deprecated since v1.35
  - The `kube-proxy` ipvs mode is deprecated since `v1.35`.
- **[deprecated]** The `v1alpha1` DRAResourceHealth API
  - Applies if you use the `v1alpha1 DRAResourceHealth` API.
  - removal planned in v1.40
  - The `v1alpha1` DRAResourceHealth API is deprecated and planned for removal in `v1.40`.
- **[deprecated]** The `kubectl run` `--filename` and `-f` flags
  - Applies if you configure `--filename` or `-f`.
  - The ignored `--filename` and `-f` flags on `kubectl run` are deprecated.
- **[deprecated]** The old `client-go` APIs
  - Applicability is not stated in the release notes.
  - The old `client-go` APIs are deprecated, with no plan to remove them.
- **[deprecated]** The `client-go` leader election resourcelock types
  - Applies if you use `MultiLock`, `UnknownLeader`, or `ConcatRawRecord`.
  - `MultiLock`, `UnknownLeader`, and `ConcatRawRecord` are deprecated in the `client-go` leader election resourcelock package.

## Other recorded changes
- 403 (value_changed 171, defect_corrected 123, added 75, constraint_changed 17, default_changed 10, renamed 5, removed 2)

[Full analysis](https://ratatosk.io/en/releases/kubernetes/v1.37.0)

[Original release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.37.0)