Kubernetes 1.37 Released: Stable Metrics API  and Rootless Kubelet in Beta

The Cloud Native Computing Foundation released Kubernetes 1.37, codenamed "Garhwal", with 67 enhancements including the general availability of the metrics.k8s.io Metrics API and stable pod certificates for native pod-to-pod mTLS. The release also moves the KubeletInUserNamespace rootless kubelet mode to beta, enabled by default, and makes resilient watchcache initialization generally available so the kube-apiserver rejects excess requests with HTTP 429 instead of flooding etcd. Of the 67 enhancements, 27 are alpha, 23 graduate to beta, 16 reach general availability or stable, and 1 is deprecated or removed.

The Cloud Native Computing Foundation CNCF announced the release of Kubernetes 1.37, named "Garhwal", emphasizing its focus on stability, security, and AI/ML workload optimization. One of the main features in version 1.37 is the general availability of the Metrics API. The metrics.k8s.io the Horizontal Pod Autoscaler https://kubernetes.io/docs/concepts/workloads/autoscaling/horizontal-pod-autoscale/ HPA and Vertical Pod Autoscaler https://kubernetes.io/docs/concepts/workloads/autoscaling/vertical-pod-autoscale/ VPA , as well as commands like kubectl top. Alpha features in this release include workload-aware scheduling. This feature gate https://kubernetes.io/blog/2026/09/10/kubernetes-v1-37-scheduler-preemption-for-in-place-pod-resize-alpha/ architectural-mechanics-how-it-works , called InPlacePodVerticalScalingSchedulerPreemption , enables the scheduler to free up resources on a node at capacity by preempting low-priority workloads, enabling pending in-place resizing of high-priority applications to be scheduled. The new pod-level checkpoint and restore https://kubernetes.io/blog/2026/01/21/introducing-checkpoint-restore-wg/ feature in version 1.37 allows the kubelet to create a checkpoint and restore a pod from it, making it easier for practitioners to take a snapshot of a running container's memory, process trees, etc., for debugging or security analysis purposes. Another feature entering alpha is the Recreate strategy for StatefulSet rollouts. This deployment option for a StatefulSet deletes all existing pods. This feature flag https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/ recreate is off by default and allows clean recovery for stuck or pending pods during updates without manual pod deletion. In Kubernetes 1.27, HorizontalPodAutoscaler scale to zero https://www.kubernetes.dev/resources/keps/2021/ summary support graduated to beta and is enabled by default. This helps reduce costs, especially for AI/ML workloads requiring GPUs in cloud environments. Also, Kubelet in the user namespace or Rootless mode https://kubernetes.io/blog/2026/09/04/kubernetes-v1-37-rootless-beta/ graduated to beta in this release. The KubeletInUserNamespace feature gate is enabled by default, and it allows core node components such as the kubelet to run as non-root on the host using Linux user namespaces. This is intended to reduce the impact of container escape attacks. Resilient watchcache initialization https://kubernetes.io/blog/2026/08/26/kubernetes-v1-37-release/ stable-resilient-watchcache-initialization became generally available in version 1.37. Before that, when the kube-apiserver restarted or lost its cache connection in a large cluster, it would flood etcd with requests, causing performance issues and potential control plane outages. With this feature gate enabled by default, the kube-apiserver will safely delegate bounded requests and reject others with HTTP 429 responses to signal too many requests gracefully. Hoon Jo https://www.linkedin.com/in/hoonjo/ , a CNCF ambassador and tech evangelist at Megazone Corp, highlighted the feature's importance in a recent LinkedIn post https://www.linkedin.com/posts/hoonjo kubernetes-k8s-cloudnative-share-7498521952681246720-nVxa/ . Resilient watchcache initialization is stable and locked on so that kube-apiserver no longer floods etcd at startup In addition, pod certificates https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/ pod-certificate-requests graduated to stable in version 1.37. This provides native support for secure pod-to-pod communication without relying on external tools to bootstrap mTLS between internal services. Kubernetes version 1.37 includes 67 enhancements, 27 alpha features, 23 graduating to beta, 16 becoming generally available or stable, and 1 deprecation or removal. For more information on the Kubernetes 1.37 release, users can refer to the official release notes https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.37.md and documentation https://kubernetes.io/docs/home/ for a complete list of enhancements, deprecations, and removals. In addition, Users can join the release team on Wednesday, September 23, 2026, at 11:00 AM CDT for a live online webinar https://community2.cncf.io/events/details/cncf-cncf-online-programs-presents-cloud-native-live-kubernetes-v137-webinar/ . The next release, version 1.38, is expected by December 2026.