Kubernetes v1.37 Garhwal: Rootless Kubelet, Gang Scheduling, and Native Pod Certificates

📷 "Docker HQ, San Francisco, California" by willbuckner is licensed under CC BY 2.0. To view a copy of this license, visit https://creativecommons.org/licenses/by/2.0/.

On August 26, 2026, Kubernetes v1.37 “Garhwal” was released – with 67 enhancements, including 16 stable and 23 beta features. While the release builds on the foundations of its predecessors, it sets a clear focus on operational security, resource efficiency, and the growing importance of AI/ML workloads. Which changes really matter for cluster operators.

Rootless Kubelet: A New Level of Security

The kubelet has historically run as a root process on the node – an attack vector that exposes the entire machine if compromised. With v1.37, the rootless kubelet (feature gate KubeletInUserNamespace) reaches beta status. The entire node stack – kubelet, kube-proxy, CRI and OCI runtime – can now run in a user namespace as an unprivileged user.

The practical consequence: code execution in the kubelet no longer ends with root privileges on the host. Combined with the stable user namespaces from v1.36, the trust boundary of a Kubernetes node shifts fundamentally – particularly relevant for edge deployments with physical access or multi-tenant clusters. The feature is disabled by default; cluster operators should pilot it on edge and scenarios with heightened security requirements.

Pod Certificates and KYAML: Stability for Daily Operations

Two long-awaited innovations reach stable status in v1.37:

Pod Certificates and Cluster Trust Bundles enable native mTLS certificates for pods directly from the cluster. The kubelet requests a certificate via a PodCertificateRequest object, an integrated signer issues it, and via a projected volume it lands directly in the pod’s filesystem. Management via ClusterTrustBundle objects distributes the trust anchors. This makes external solutions like cert-manager unnecessary in many scenarios – certificate rotation happens natively through the kubelet.

KYAML – a safer, ambiguity-free YAML subset specifically for Kubernetes – is now stable after graduating from alpha (v1.34) to beta (v1.35). Every KYAML file is valid YAML, but not every YAML is KYAML. Anyone who has ever experienced "NO" being interpreted as boolean false knows why that matters. The command kubectl get -o kyaml is now ready for production use.

Also after nine years of beta: the Metrics API (metrics.k8s.io) is stable. CPU and memory data for pods and nodes, which power features like kubectl top and the HPA, are now available via a GA API.

Gang Scheduling and DRA: AI/ML Workloads in Focus

Kubernetes is increasingly becoming the orchestrator for AI training and HPC simulations. This release addresses exactly that: Gang Scheduling (beta behind the feature gate GenericWorkload) allows an “all-or-nothing” strategy – a group of pods (a PodGroup) is only scheduled if the cluster has enough resources for the entire group. Previously, the scheduler could spread individual pods while others waited for capacity, leading to deadlocks.

The Workload and PodGroup APIs reach v1beta1, the minCount field is now mutable, and the scheduler only enqueues the PodGroup object – no longer each member individually. The new CompositePodGroup API (alpha) enables hierarchical scheduling structures for complex, heterogeneous workloads such as those managed by JobSet and LeaderWorkerSet (LWS).

In the area of Dynamic Resource Allocation (DRA), four features become stable, including ResourceClaim status with standardized network interface data and Device Taints/Tolerations – crucial for GPU workloads where fine-grained control over resource allocation is needed.

HPA Scale-to-Zero and Other Highlights

The HorizontalPodAutoscaler feature Scale-to-Zero (beta, now enabled by default) allows workloads to scale down to zero pods when there is no load – for example, queue consumers, batch jobs, or GPU workloads during idle periods. The metric must be based on object or external metrics, since CPU/memory metrics require active pods.

Other relevant innovations: Manifest-based Admission Control (beta) allows loading admission webhooks and CEL policies directly from disk, independent of etcd. The Storage Version Migration API (storagemigration.k8s.io/v1) is stable – data can be automatically migrated to the new storage version after API upgrades. And with Memory QoS (beta, enabled by default), cgroups-v2-based nodes get more effective memory isolation mechanisms.

Conclusion

Kubernetes v1.37 “Garhwal” continues the trajectory of previous releases: security and resource efficiency become first and foremost meaningful. The rootless kubelet, native pod certificates, and Memory QoS make the cluster more resilient, while Gang Scheduling and the DRA improvements pave the way for AI/ML workloads on Kubernetes. For operators, a closer look at the beta features is worthwhile – and those relying on edge nodes should put piloting the rootless kubelet on the agenda.

Preparations for v1.38 are already underway; the shadow team is looking for contributors.

Sources

🌐 Machine-translated from the German original, editorially reviewed. 🤖 Written with AI assistance.