Kubernetes v1.37: Key Changes You Need to Know
Kubernetes v1.37 is set to introduce pivotal updates that address long-standing issues and enhance security and performance. One of the most important changes is the graduation of SELinuxMount to GA, which will be enabled by default. This means you can expect better security context management for your pods, reducing the risk of misconfigurations that could lead to vulnerabilities.
In addition, the support for legacy cgroup v1 is being phased out. If your nodes still rely on cgroup v1, the kubelet will fail to initialize unless you explicitly override this setting. To manage this, you can set the failCgroupV1 parameter to false as a temporary fix. However, this should be viewed as a short-term solution. The kubelet in User Namespace (Rootless Mode) is also moving to Beta, allowing for more secure pod management. The metrics.k8s.io API is graduating to Stable, which means you can rely on it for consistent performance monitoring. Be aware that static pods can no longer reference Secrets or ConfigMaps, which may require you to adjust your deployment strategies.
As you prepare for the v1.37 release, keep in mind that using the override for cgroup v1 is not a permanent fix. It’s crucial to transition to cgroup v2 to avoid potential issues down the line. Additionally, if you have pods with different SELinux labels sharing a volume on the same node, you may encounter startup failures due to the single mount holding only one SELinux context. This release is planned for August 26, 2026, so start planning your migration strategies now.
Key takeaways
- →Enable SELinuxMount by default to enhance security.
- →Transition away from cgroup v1 to avoid kubelet initialization failures.
- →Use the `failCgroupV1` parameter as a temporary override only.
- →Monitor your storage volumes with the metrics.k8s.io API as it graduates to Stable.
- →Adjust your pod configurations to avoid issues with SELinux contexts.
Why it matters
These changes are crucial for maintaining a secure and efficient Kubernetes environment. Transitioning to cgroup v2 and enabling SELinuxMount will help mitigate security risks and improve resource management in your clusters.
Code examples
kubectl -n kube-system get configmap kube-proxy -o jsonpath='{.data.config\.conf}' | grep 'mode:'apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
failCgroupV1: false
# temporary overrideWhen NOT to use this
The official docs don't call out specific anti-patterns here. Use your judgment based on your scale and requirements.
Want the complete reference?
Read official docsIndustry-standard certifications built by the people behind Linux and Kubernetes. Earn the CKA — the gold standard Kubernetes administrator cert. OpsCanary readers get 30% off year-round with code OPSCANARY3.
Get CKA certified →Zero-Downtime Migration of Kubernetes Deployments: The ExternalName Approach
Migrating critical Kubernetes deployments can be a daunting task, especially when aiming for zero downtime. By leveraging an ExternalName service, you can seamlessly redirect traffic to a new namespace without disrupting your application.
Kubernetes v1.37: Embrace Storage Version Migration by Default
Kubernetes v1.37 introduces Storage Version Migration (SVM) enabled by default, simplifying the upgrade path for your custom resources. With a simple declarative object, you can migrate existing resources to the latest API version effortlessly.
Mastering kubeadm Upgrades: Strategies for Smooth Transitions
Upgrading your kubeadm cluster is crucial for maintaining security and performance. Understanding the upgrade workflow and the role of etcd can prevent downtime and ensure a seamless transition. Dive in to learn the best practices for managing your upgrades effectively.
Get the daily digest
One email. 5 articles. Every morning.
No spam. Unsubscribe anytime.