Kubernetes v1.37 (Garhwal): metrics.k8s.io v1, PodCertificates and trust bundles graduate

Your pods can now request TLS identities from a stable Kubernetes API — and the container runtime world is already bumping its own API to stay in step. v1.37 (“Garhwal”) is less about flashy new toys and more about hardening the platform contract: 67 enhancements across a 15‑week cycle, 16 of those graduating to stable, and a raft of behavioral changes that will bite clusters still running legacy modes.

The headline changes are concrete and operational. metrics.k8s.io is now v1, and the release surfaces GA primitives for pod certificates and cluster trust bundles. That matters because both observability and identity are now solid, supported contracts rather than shifting KEP experiments. Autoscalers, HPA implementations, custom metrics adapters and observability tooling get a predictable schema with metrics.k8s.io v1. Meanwhile, PodCertificate and cluster trust-bundle APIs give platform teams a standard way to issue and distribute workload identities and trust anchors — the primitive many service meshes and mTLS setups have been improvising around for years.

But Garhwal is also a release that forces housekeeping.

kube-proxy: IPVS mode is deprecated; migrate to the nftables-based proxy mode (or other supported backends) and add nftables testing to your upgrade plan. If you rely on IPVS internals for tuning or debugging, schedule migration work in your upgrade sprint. This is a compatibility decision — not an optional clean‑up.
Static pods: static pod manifest behavior changed — static pods can no longer rely on in‑manifest Secrets or ConfigMaps. Teams using static manifests for control‑plane components must move those Secrets/ConfigMaps into a different delivery mechanism.
Kubelet/SELinux: SELinux remount behavior and kubelet SELinux handling have tightened; cgroup v1 clusters may see additional failures. These are subtle changes that can cause permission or volume failures during upgrades.

If you want a clean, blunt opinion: if you haven’t migrated off IPVS or still run control plane pieces as static pods that reference Secrets/ConfigMaps in manifests, treat v1.37 as the deadline. The project’s focus here is consolidation — fewer surface‑area experiments, more long‑term maintenance. That reduces churn for downstream tooling, but raises the bar for upgrade testing.

Runtime alignment is the other operational subplot. containerd and other runtimes are coordinating minor releases with Kubernetes more closely; test your kubelet integrations against the latest stable containerd and its release candidates early. Practically, this means runtime shims, CRI integrations and system agents should be exercised against the upcoming runtime releases — expect API surface and behavior changes that matter for image management, snapshotters, and plug‑ins.

There’s also a governance footnote: CNCF updated guidance on project governance. This is background, but important — the ecosystem is codifying how projects shift from contributor‑led models to structured maintainer boards and technical oversight. For large projects adjacent to Kubernetes, that matters for release predictability and security ownership.

Why this release matters more than it looks: stability in identity and metrics is the infrastructure equivalent of establishing a standard socket. Once these APIs are stable, operators and vendors stop re‑inventing slightly incompatible solutions. The tradeoff is immediate upgrade friction — tighter kubelet behavior, IPVS removal, runtime API bumps — which will surface in CI and post‑upgrade incidents if you ignore them.

If you want to act: prioritize a test pass that covers nftables routing, static pod manifest migration, SELinux relabeling scenarios, and node‑level containerd compatibility. Also update autoscaler and metrics tooling to rely on metrics.k8s.io v1 where possible — the contract is no longer experimental.

Garhwal is a maintenance release dressed as progress. It’s the kind of release platform engineers value: fewer surprises in APIs going forward, and a short, sharp penalty now if you haven’t finished the migrations everyone knew were coming. Expect fewer API churn headaches in the next two minor releases — but also expect more aggressive removals of legacy paths. Treat this as the checkpoint for finishing migrations, not the moment to defer them.

Kubernetes v1.37 (Garhwal): metrics.k8s.io v1, PodCertificates and trust bundles graduate

Sources

Kubernetes 1.37 (Garhwal): SELinux remounts default, cgroupv2 tightening, IPVS deprecation

Kubernetes: metrics.k8s.io API graduates to v1 stable

Kubernetes 1.37: Metrics API Graduates to Stable