Kubernetes 1.37 Garhwal: what cluster operators should change first

Kubernetes v1.37 landed on 26 August 2026. The release name is Garhwal, after the Himalayan region in Uttarakhand. The logo is a window onto terraced fields, deodar forest, and a Himalayan monal. Cute. The changelog is not cute.

This is 67 enhancements: 16 Stable, 23 Beta, 27 Alpha, one deprecation. If you run kubeadm clusters, GPU nodes, or anything that still boots cgroup v1, read the upgrade notes before you kubeadm upgrade apply.

The official announcement is on the Kubernetes blog. Below is what actually changes the bill and the pager.

The three things that change operations this week

1. HPA can scale to zero (Beta, on by default)

spec.minReplicas: 0 now works for HorizontalPodAutoscalers that use object or external metrics. Idle queue consumers, batch jobs, and GPU inference pods can drop to zero and come back when the metric returns. CPU and memory metrics still cannot drive scale-to-zero, because those metrics need a running Pod.

While the controller holds a workload at zero it sets a ScaledToZero=True condition, so you can tell "HPA parked this" from "someone set replicas: 0 by hand".

If you rent L40S or H200 by the hour, this is the feature that stops you paying for empty GPUs overnight. Wire an external metric (queue depth, request rate) before you flip minReplicas. Do not expect kubectl top to wake the workload.

2. API server startup no longer stampedes etcd

Resilient watchcache initialization is finished. WatchCacheInitializationPostStartHook is Stable and locked on. During cache warm-up, kube-apiserver issues bounded requests to etcd and returns HTTP 429 with Retry-After instead of letting list/watch traffic exhaust API Priority and Fairness.

Your controllers must back off on 429. Operators that retry immediately will still melt the control plane. This is a cluster-size feature: small labs will not notice, 200-node GPU farms will.

3. DRA is no longer a science project for GPUs

Several Dynamic Resource Allocation pieces went Stable:

• ResourceClaim .status.devices (including standardized network interface data)
• Extended resource requests (example.com/gpu: 3) fulfilled by a DRA driver, no separate device plugin
• Device taints and tolerations
• Standard NUMA attribute resource.kubernetes.io/numaNode

If you schedule NVIDIA GPUs on bare metal, DRA is now the path that does not fight the old device plugin. Node declared features also went Stable, so the scheduler can see which kubelet actually supports a feature-gated capability during mixed-version rolling upgrades.

Stable items you will actually use

KYAML is Stable. It is a stricter YAML subset, not a new language. Every KYAML file is valid YAML. kubectl get -o kyaml is GA. You do not have to rewrite manifests.

metrics.k8s.io graduates to v1 after nearly nine years in Beta. HPA and kubectl top sit on this API. v1beta1 stays during the deprecation window.

SELinuxMount and SELinuxChangePolicy are Stable and on by default. Volumes mount with -o context=<label> when the CSI driver opts in. Pods with different SELinux labels sharing a volume on one node can now fail to start. Set .spec.seLinuxChangePolicy: Recursive on the Pod to keep the old recursive relabel behavior. Clusters without SELinux see nothing. This stays unlockable until v1.38.

StorageVersionMigration (storagemigration.k8s.io/v1) is Stable and on by default. Create a StorageVersionMigration object after a CRD or encryption-at-rest change instead of running kubectl get | kubectl replace scripts.

Pod certificates and ClusterTrustBundles are Stable. First-class private keys, X.509 certs, and trust anchors into Pods, via a signer controller watching PodCertificateRequest objects.

Manifest-based admission is Beta. Load webhooks and CEL policies from disk (staticManifestsDir) so they apply before etcd is healthy and cannot be deleted through the API. Worth it on any cluster that must boot into a known policy.

Upgrade landmines

Static Pods cannot reference Secrets or ConfigMaps. That was a bug. v1.37 forbids secretRef / configMapRef on static Pods. The PreventStaticPodAPIReferences gate is gone. If your kubeadm control plane manifests cheated this way, they will fail after upgrade.

cgroup v1 is on the way out. failCgroupV1 has defaulted to true since v1.35. kubelet will refuse to start on cgroup v1 unless you set:

apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
failCgroupV1: false

That override is a short-term patch. Memory QoS and in-place scaling for memory-backed volumes need cgroup v2. Plan the node OS move (Ubuntu 24.04, current RHEL, current Debian) before you need another emergency override.

Pod-level checkpoint/restore is Alpha (CheckpointPod / RestorePod CRI RPCs). Runtime support is required. Do not build production HA on it yet.

What we would do on a ServerGurus cluster

1. Inventory cgroup version on every node: stat -fc %T /sys/fs/cgroup. If you still see tmpfs (v1), schedule the OS upgrade first.
2. Grep static manifests for secretRef and configMapRef.
3. For GPU pools, pick one node to try DRA extended resources instead of the device plugin. Keep the old path until you have a passing Job.
4. For inference services with bursty traffic, add an external-metrics HPA with minReplicas: 0 on a non-prod Deployment and watch the ScaledToZero condition.
5. Point controllers at 429/Retry-After. If they use a naive client-go loop with no backoff, fix that before the watchcache change is the only thing standing between you and an etcd brownout.

kubeadm v1.37 bits are on the Kubernetes download page and GitHub v1.37.0. Release webinar: 23 September 2026, 16:00 UTC.

How ServerGurus helps

We run Kubernetes on dedicated hardware in Hyderabad, including NVIDIA L40S and H200 nodes, not on noisy shared hypervisors. HPA scale-to-zero only saves money if the GPU underneath is metered honestly and the node is still there when the queue comes back. Bare metal plus a local team that has done kubeadm skew upgrades is that combination.

If you want 1.37 on new nodes, or a cgroup v2 migration plan for an existing cluster, talk to us. We will tell you what will break before it does.

Conclusion

v1.37 is a control-plane hardening release with a GPU cost feature attached. Upgrade for the watchcache and DRA stability. Budget time for cgroup v2 and static-Pod secret cleanup. Use HPA scale-to-zero only after the metric path is real.

Need a cluster that can take 1.37 without a weekend incident? Contact ServerGurus.