Kubernetes v1.37.0-alpha.3 is live!

14 views

Skip to first unread message

Jenny Shu

unread,

Jul 8, 2026, 2:17:09 PM (3 days ago) Jul 8

to kubernetes-announce, dev

Kubernetes Community,

Kubernetes v1.37.0-alpha.3 has been built and pushed using Golang version 1.26.4.

The release notes have been updated in CHANGELOG-1.37.md, with a pointer to them on GitHub:

v1.37.0-alpha.3

Downloads for v1.37.0-alpha.3

Source Code

filename	sha512 hash
kubernetes.tar.gz	6ac747b1f3d8c6d341034ea37125829793dc3a3f8018eb0ba90e57b0190fed8a147ca56d3cf07562e932ae7e8291113e7e06c98d54c0c6577258f5844504ffd8
kubernetes-src.tar.gz	407aa7241cd88a8ee7bf1f1b18399cc3adedcc25adb8df7123e6b2b4a5856ed3972b88262c0ae0eb9eec7d84c67250fbadf0f1f76a88530c2cede1348bec8353

Client Binaries

filename	sha512 hash
kubernetes-client-darwin-amd64.tar.gz	923ff3c315fc2fbcbbd215cdb4946f6d9559e0e259e8ed87fa55279c718b29c7530bfbe315a5f8fb289545a55f08dda3742f993fde519c722e469e8dc93cfab6
kubernetes-client-darwin-arm64.tar.gz	6a9332c8aa9e548b967f492ab42b197a82c23555e2ea953dc8752d300a8ef38478042a74c0f6170af10cb35b41cb80e600d1a8575141ebb6d77f1e534fcf4b93
kubernetes-client-linux-386.tar.gz	f245cf9de14b216b5d1354a7d5fff1b216bbd2db10639657939719175b3d2fe486128ad0e276ad7aba796a1fd3b7b1ec6686768c0167167b8ca44303e334f3b1
kubernetes-client-linux-amd64.tar.gz	6fe93886ce95d8b5b29fffc0ea311eb50e2dd6cdf27a2ea05c5b78d33db2094a9a1e2e7af5cdf9d3740d1fa69b83ad0a5e1776edc8a2cba71e1a1b2671ccd030
kubernetes-client-linux-arm.tar.gz	69ec1be76b5216951ac7f2f2c4bfa5bf63bc7a2744f3ed973572aac8dabf8f2298520adf9230278f710dc95fe3db6c146ee1fd9311a01a887388cfe92a6a4845
kubernetes-client-linux-arm64.tar.gz	d0bb9c6cdadbc797c05512f4f73cbbd412f6e840feb54b7232bc9b64b8060629e06365adfda670c37885bafb8bfa1d6de7f530c7b2922c287f23219aaf063aed
kubernetes-client-linux-ppc64le.tar.gz	7abbc629713d7f07d740de5dfa91e496087db0df1fcf7b7bcb93e5b5417453080fc859b004317439ac112e83401b3d16a19de07e477f2b605c82562dcd376ada
kubernetes-client-linux-s390x.tar.gz	bbfd6060133b9203a33749f43b421dba9f6ba10c0d21f02ac8480165f4dcb25b0dd07639b5044a0b2fd0e8c32b16fa70460c40d56a59b3502026def632d7bc05
kubernetes-client-windows-386.tar.gz	a2913f208ceee865ba595b670d149b6edc10209f04fc494a05ba870fb1d51a99bad22080b840fc0d113453fa39fff89ef5558c7aa4225b17a49fb0ce2ee2cad7
kubernetes-client-windows-amd64.tar.gz	e4c153a764e58ed76c8892a6497aa9e094936b10c06f1226fb47d738c441d51e09182fa2bdd6e7e0e3bd678e7c9afb892c0a6ae21e920bd9f10231d2c94f77a2
kubernetes-client-windows-arm64.tar.gz	cb6fd57d3c3b9c4b72c0b1865ce4b438627afc3cb9a46e06e6bcb9a04cd0ac7581e0f4c736e176025f3fe1d65c1d154afe36f52735caaee4e9ea2e0b029c4f09

Server Binaries

filename	sha512 hash
kubernetes-server-linux-amd64.tar.gz	f2968084ef1cff88a85bb9ec4de2df25475f74ea342b6115657216a85d52ff10bbdedc76dd486eef25495c7f3f7e188f43a0cbcaa2cec07b730068f5c01a52da
kubernetes-server-linux-arm64.tar.gz	d5f8c06cc7d246112465d8435d01b99fda3a533171b34ead08ff64c26ddcc5329d540afd37df8013d3034540467ad99c93683c428eaad06a3bd1dc1640f2ac0b
kubernetes-server-linux-ppc64le.tar.gz	e589b92dbb0b39fcdceb430c4d87cc7564f8143128a808c8fd89e2a09c7ceb566f1471c53fe5c38464f0c5994df43106e3c1d2d43eea97adbb48e9d7f6f68aba
kubernetes-server-linux-s390x.tar.gz	78eb0a050205e9f9c35584130124809a3c66f5f6696bc749892130f4f7fc23963680fc6ac5eb23aafd61e0e762dadb9b4a2418ba8f7cd2dfc6b8a55911b103a5

Node Binaries

filename	sha512 hash
kubernetes-node-linux-amd64.tar.gz	fc5cd6f7c3652bbdc58dd83d41fe33a4a36e901bd08ab12834a08510c9c9f48b2605e177394674b96b60d045f16dabe0461526943f9342f0bc92c75764a16c6f
kubernetes-node-linux-arm64.tar.gz	da21197d3902a96ea603485700f7e32b719ea22b6d2c642c0c537727709a2c656d65f52ce3216e2c99d86ad1de4d98338668ad9dd123d887030c395261e5124e
kubernetes-node-linux-ppc64le.tar.gz	8e850cbe8dffbe31a7d38821efc9c27fbe12d66ed363ed4fb2abc9a6ddf840ca3b3a3f89ced2947fb722c0f15f9163af8c96bcd2ed59c6fdcd664d36ba8e2d8c
kubernetes-node-linux-s390x.tar.gz	6ed014e999b24438e3266d7c111d7cedddc568862d0a2eca7ba6c9ae29faf613c1b5d54731dd464f298052d58dce591c308cbfb6eacd23b25e4460a706494b1f
kubernetes-node-windows-amd64.tar.gz	9926cdb6b198b2906c433788a09f802dd72c8ef44f608f06fd3999661801af0e3f5d272c278cc8fab366f3e5526a6b483d3304d58171c67628fa3cdc736453a3

Container Images

All container images are available as manifest lists and support the described architectures. It is also possible to pull a specific architecture directly by adding the "-$ARCH" suffix to the container image name.

name	architectures
registry.k8s.io/conformance:v1.37.0-alpha.3	amd64, arm64, ppc64le, s390x
registry.k8s.io/kube-apiserver:v1.37.0-alpha.3	amd64, arm64, ppc64le, s390x
registry.k8s.io/kube-controller-manager:v1.37.0-alpha.3	amd64, arm64, ppc64le, s390x
registry.k8s.io/kube-proxy:v1.37.0-alpha.3	amd64, arm64, ppc64le, s390x
registry.k8s.io/kube-scheduler:v1.37.0-alpha.3	amd64, arm64, ppc64le, s390x
registry.k8s.io/kubectl:v1.37.0-alpha.3	amd64, arm64, ppc64le, s390x

Changelog since v1.37.0-alpha.2

Urgent Upgrade Notes

(No, really, you MUST read this before you upgrade)

Kubelet logs effective configuration on start.

cluster admin should review permissions to only allow trusted users to nodes/logs cluster role. This is mostly the reminder as it was the best practice anyways and almost all of the effective configuration values can be already Inferred from other log messages or the kubelet behavior. (#139837, @SergeyKanzhelev) [SIG Node and Testing]

Changes by Kind

Dependency

DEPRECATION!!! The kubelet's embedded cAdvisor now uses the leaner github.com/google/cadvisor/lib module, which removes three long-deprecated or legacy surfaces:
- Deprecated cAdvisor flags are no longer accepted and the kubelet will fail to start if any are set (only --housekeeping-interval is kept): --application-metrics-count-limit, --boot-id-file, --container-hints, --containerd, --containerd-namespace, --enable-load-reader, --event-storage-age-limit, --event-storage-event-limit, --global-housekeeping-interval, --log-cadvisor-usage, --machine-id-file, --storage-driver-user, --storage-driver-password, --storage-driver-host, --storage-driver-db, --storage-driver-table, --storage-driver-secure, --storage-driver-buffer-duration. Remove these from your kubelet configuration.
- cAdvisor application/custom metrics are no longer collected: the userDefinedMetrics field in /stats/summary and the custom container_application_* families in /metrics/cadvisor.
- The /metrics/cadvisor series container_cpu_load_average_10s, container_cpu_load_d_average_10s, and container_tasks_state are no longer exported. (#139870, @dims) [SIG API Machinery, Auth, Instrumentation, Network, Node and Testing]

API Change

Add PreemptionPolicy field to PodGroup to define policy for workload-aware preemption (#139240, @ania-borowiec) [SIG API Machinery, Apps, Architecture, Auth, Autoscaling, CLI, Cloud Provider, Cluster Lifecycle, Etcd, Instrumentation, Network, Node, Scheduling, Storage, Testing and Windows]
Graduated the SELinuxMount feature gate to GA. SELinuxMount is now enabled by default in Kubernetes 1.37, which may break existing workloads in Kubernetes clusters with SELinux enabled. Please see our blog to identify potentially problematic workloads in your 1.36 cluster and how to fix them or opt out of SELinuxMount changes before upgrading to 1.37. Admins of clusters without SELinux enabled can ignore this release note, as nothing changes for them. (#139956, @jsafrane) [SIG API Machinery, Apps and Node]
Implementation of core Conditional Authorization machinery (#137513, @luxas) [SIG API Machinery, Auth, Node and Testing]
Promoted node declared features to GA. (#139763, @pravk03) [SIG Apps, Autoscaling, Node, Scheduling and Testing]
StorageVersionMigration is now enabled by default and GA with the StorageMigration/v1 API (#138560, @michaelasp) [SIG API Machinery, Apps, Architecture, Auth, Etcd and Testing]
The DRA Device Taints and Toleration feature is now generally available via the resource.k8s.io/v1 API. (#138676, @pohly) [SIG API Machinery, Apps, Architecture, Auth, Etcd, Node, Scheduling, Storage and Testing]
The NodeRestriction admission plugin now adds a defense-in-depth check for PodCertificateRequests. A node may only create a PodCertificateRequest referring to a particular signer name if the pod actually mounts a podCertificate projected volume source that refers to that signer name, or if an authorization check for the user (verb=request-podcertificate-signer resource=) succeeds. (#140006, @ahmedtd) [SIG Auth and Testing]
Update to PodGroup API that converts the PodGroupTemplateRef to a simpler and more direct WorkloadRef that is aligned with the CompositePodGroup planned future changes. (#140080, @dom4ha) [SIG API Machinery, Apps, Etcd, Node, Scheduling and Testing]

Feature

A FailedScheduling event and PodScheduled PodCondition for a pod for which the default preemption found a potential node will now contain "preemption: found a potential placement for pod on node <node_name>, preempting <victim_count> victims" mesage. (#140180, @Argh4k) [SIG Scheduling]
Add progress to SVM conditions, allowing users to see the amount of objects a StorageVersionMigration has migrated. (#138875, @michaelasp) [SIG API Machinery and Apps]
Added Beta support for compressed responses to WatchList requests. When a client sends Accept-Encoding: gzip, the API server returns a gzip compressed response. This behavior is enabled by default and can be disabled using the WatchListCompression feature gate. Regular Watch requests are unaffected. (#140140, @p0lyn0mial) [SIG API Machinery]
Added PodGroup methods to PodGroupManager and SharedLister, allowing scheduler plugins to obtain a consistent PodGroup state. (#140077, @macsko) [SIG Node, Scheduling and Testing]
Added the PodGroup field to the PodGroupInfo object in kube-scheduler to enable plugins to obtain a consistent state throughout the scheduling cycle. (#140075, @macsko) [SIG Scheduling]
Added the incompletePodGroupPods data structure to the scheduling queue to store pods waiting for their PodGroup object to be observed by kube-scheduler. (#139952, @macsko) [SIG Node, Scheduling and Testing]
Added validation to PodGroup scheduling which ensures priorities of the evaluated pods match the priority of the PodGroup. (#139920, @brejman) [SIG Scheduling and Testing]
After successful scheduling of a podgroup, its remaining unscheduled pods are requeued directly to active queue rather than backoff queue. These pods preserve their old timestamp so they have precedence in scheduling unless a higher priority entity comes in between. (#139613, @iomarsayed) [SIG Scheduling and Testing]
Client-go now has context-aware APIs for REST mapping and discovery. This addresses a long-standing problem that the implementations under the hood made blocking API calls with context.TODO. Consumers of client-go are encouraged to switch to the new APIs and therefore they get marked as Deprecated. However, there is no plan to ever remove the old APIs. (#129109, @pohly) [SIG API Machinery, Apps, Auth, Instrumentation, Node and Testing]
Kube-proxy now warns you if you start it without explicitly specifying the proxy mode that you want (iptables, ipvs, or nftables), because the default on Linux will be switching from 'iptables' to 'nftables' in a future release. (#139957, @danwinship) [SIG Network]
Support for kubectl get -o kyaml is promoted to stable. (#140076, @soltysh) [SIG CLI]
Volume mount host path type mismatches log the actual path type along with the expected path type. (#121873, @skitt) [SIG Storage]

Documentation

Client-go and apimachinery now track Go API changes in a Go-API/CHANGELOG.md file. (#138351, @pohly) [SIG API Machinery]

Bug or Regression

Changed to only emit FailedToRetrieveImagePullSecret events if an image pull has failed. (#138432, @Jamstah) [SIG Node]
Config file migration changed to use source file's permissions when creating destination file. (#138142, @brianpursley) [SIG API Machinery]
Fix a regression in server side apply where patching a container type (list or map) could result in 422 required errors for apply requests that previously succeeded. (#140294, @jpbetz) [SIG API Machinery, Architecture, Auth, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation, Network, Node, Scheduling, Storage and Testing]
Fix audit request logging of malformed patch request bodies (#139419, @hoskeri) [SIG API Machinery, Auth and Testing]
Fixed a bug in kube-apiserver where a request matching multiple ValidatingAdmissionPolicy bindings with audit actions only recorded the first validation failure in the audit annotation; all audit failures are now published in a single annotation. (#140001, @lalitc375) [SIG API Machinery]
Fixed a bug in the DRA kubelet plugin helper where drivers with names longer than ~30 characters could not enable rolling updates because the plugin registration socket path exceeded the AF_UNIX path length limit. Rolling-update registration sockets now pick the shortest basename that fits under the configured registry directory, preferring <driver>-<pod UID>-reg.sock, then <driver>-<hashed UID>-reg.sock, then dra-<hashed driver+UID>-reg.sock. (#139623, @vishalanarase) [SIG Node and Testing]
Fixed a bug that caused Pods in a PodGroup sharing a ResourceClaim to get stuck scheduling. (#140269, @nojnhuh) [SIG Node, Scheduling and Testing]
Fixed a bug where Pods in a PodGroup sharing a ResourceClaim could be scheduled to Nodes where the ResourceClaim is not available. (#140089, @nojnhuh) [SIG Node, Scheduling and Testing]
Fixed a bug where ValidatingAdmissionPolicy and MutatingAdmissionPolicy evaluation could observe subtle differences (particularly around quantity fields and type meta fields) in object representation. The bug could occur when a parameter object was loaded via an alternative path, due to a cache miss. CEL expressions now behave deterministically against params. (#140201, @jpbetz) [SIG API Machinery]
Fixed a bug where successfully scheduled Pods could be stuck with the PodScheduled=False condition. (#139602, @nojnhuh) [SIG Node and Scheduling]
Fixed a kubelet memory leak regression in 1.36 caused by leaked contexts on every Pod sync. (#139850, @compumike) [SIG Node]
Fixed a panic in ResourceSlice validation that could occur when the DRAConsumableCapacity feature was enabled and a capacity request policy set validRange.step to zero. (#139698, @wilmerdooley)
KEP-5491: the list-type attributes, .includes function, and macros can now be evaluated even when the ListTypeAttributes feature gate is disabled in the scheduler to avoid users from facing errors during rolling-upgrade or flipping the feature gate scenario. (#139395, @everpeace) [SIG Node]
Kube-scheduler: fixed inter-pod (anti-)affinity and volume restriction evaluation during PodGroup scheduling cycles. The scheduler snapshot's AssumePod and ForgetPod now correctly maintain affinity node lists and PVC usage tracking. (#139054, @net0pyr) [SIG Scheduling and Testing]
Kubeadm: improved the logic around warnings when the user sets a non-default bindAddress in KubeProxyConfiguration. (#139989, @vinayakray19) [SIG Cluster Lifecycle]
Kubelet no longer emits V(4) "Label not found" logs for missing optional container annotations. (#140163, @HirazawaUi) [SIG Node]
On nodes with hugepages, memory.available used by Kubelet eviction manager now correctly excludes hugepage-reserved RAM from AvailableBytes. This fixes delayed eviction and OOM kills caused by inflated available memory reporting. The HugepageAwareEviction feature gate (default: enabled) can be disabled to restore the previous behavior. (#138127, @jingczhang) [SIG Node and Testing]
PodGroup.Status.Conditions now reflects the failure reason when scheduling is rejected due to mismatched .spec.schedulerName across pods in a group. (#140183, @Argh4k) [SIG Scheduling]
The pods/binding endpoint now validates the specified node name consistently. (#136776, @yakir-shriker) [SIG Apps and Scheduling]

Other (Cleanup or Flake)

Changed kubelet to log a warning if static pods are defined with an invalid priority or priorityClassName. (#136705, @sreeram-venkitesh) [SIG Node]
Kubelet/DRA: fixed a bug where deleting a pod could un-prepare resources still in use by another pod. (#140212, @bart0sh) [SIG Node]
PreventStaticPodAPIReferences feature gate has been removed and cannot be disabled anymore to allow static pods to reference API resources (#140226, @sreeram-venkitesh) [SIG Node]

Dependencies

Added

github.com/google/cadvisor/lib: v0.60.3

Changed

Removed

Contributors, the CHANGELOG-1.37.md has been bootstrapped with v1.37.0-alpha.3 release notes and you may edit now as needed.