Kubernetes 1.37: Metrics API, Rootless Mode, and Farewell to ipvs

📷 "Docker HQ, San Francisco, California" by willbuckner is licensed under CC BY 2.0. To view a copy of this license, visit https://creativecommons.org/licenses/by/2.0/.

On August 26, 2026, Kubernetes 1.37 will be released – right on time in the three-month rhythm of the Cloud Native Computing Forum. The official sneak peek from July 31 paints a clear picture: This release brings long-awaited stabilizations, an important security boost, and marks the end of several era features. There is plenty to do for platform teams and cluster operators.

Metrics API finally becomes stable after nine years of beta

The most significant innovation in Kubernetes 1.37 is the graduation of the metrics.k8s.io API to General Availability (GA). For almost nine years, this interface was in beta status – yet it was the foundation for essential functions such as the Horizontal Pod Autoscaler (HPA) and kubectl top. The stabilization brings no functional changes, but the long-awaited stability promise. Both v1 and v1beta1 remain usable during the transition period, so existing workflows can migrate without breakage. The associated KEP 5207 defines the API formalization.

Rootless Mode: Kubelet in the User Namespace

A milestone for Kubernetes security: The Kubelet Rootless Mode (User Namespace) reaches Beta status in 1.37. Until now, all node components ran with root privileges on the host. The new feature allows the kubelet to run in a Linux user namespace as an unprivileged user – while still behaving as root within the namespace. This drastically limits lateral movement in the event of a compromise. KEP 2033 (or the updated KEP 4960) describes the exact architecture. For security-critical environments – for example, according to the requirements of DORA, NIS2, or the EU AI Act – this is a decisive step forward.

SELinuxMount becomes GA – with a breaking change

Also reaching GA in Kubernetes 1.37 is the SELinuxMount feature. Volumes will now be mounted with the mount option -o context=<label> instead of recursively relabeling – but only if the respective CSI driver enables this via CSIDriver.spec.seLinuxMount: true. The downside: A single mount can only carry one SELinux context. Pods with different SELinux labels that share the same volume on a node may no longer start. Those who need the old recursive behavior can set seLinuxChangePolicy: Recursive in the Pod spec. For clusters without SELinux, nothing changes.

Farewells: ipvs, cgroup v1, and kubectl run -f

Three deprecations equally shape the release:

kube-proxy ipvs mode is deprecated – removal is planned for v1.43. The ipvs mode was introduced in v1.8 to solve iptables performance bottlenecks, but it was never able to fully do without iptables (KEP 3866). Affected clusters should migrate to nftables-based kube-proxy or other implementations such as Cilium. The current mode can be checked via ConfigMap.
cgroup v1 support will be phased out as planned. Since v1.35, the kubelet refuses to start on cgroup-v1 nodes by default, unless the temporary override option failCgroupV1: false is set. Advanced features like In-Place Pod Resizing require cgroup v2. KEP 5573 outlines the complete roadmap.
kubectl run --filename/-f is deprecated – the parameter was misleading, since kubectl run only generates a pod from CLI arguments anyway.

In addition, a bug was fixed that previously allowed static pods to reference Secrets or ConfigMaps – a behavior that was never intended. Starting with v1.37, this is strictly prohibited; the previous feature gate PreventStaticPodAPIReferences is removed.

Volume Health Monitor as Alpha

New to Alpha status is the Volume Health Monitor (KEP 1432). It introduces four new CSI RPCs: ControllerListVolumeHealth and ControllerGetVolumeHealth on the controller side, NodeGetVolumeHealth and NodeGetStorageHealth on the node side. The results land in PersistentVolumeClaim.status.healthStatus or Pod.status.volumeHealth and CSINode.status.storageHealth. The error vocabulary is deliberately simple and machine-readable (Inaccessible, Degraded). Remediation controllers can thus react automatically to storage problems for the first time, without relying on external dashboards.

Conclusion

Kubernetes 1.37 is a release of consolidation. The Metrics API as GA, the Rootless Kubelet as Beta, and the Volume Health Monitor as Alpha show a clear direction: stability and security take precedence over new shiny features. At the same time, the deprecations of ipvs and cgroup v1 force many teams to take action – the transition period is known, but migration requires planning. Cluster operators should check the current configuration of their kube-proxy modes and cgroup version before the release date on August 26.

Sources

🌐 Machine-translated from the German original, editorially reviewed. 🤖 Written with AI assistance.