Kubernetes v1.37.0 - SELinux Mount GA And cAdvisor Cut

Kubernetes v1.37.0 shipped on 26 August 2026. The change that should stop an unattended cluster bump is SELinuxMount going GA and turning on by default, which can break existing volume mounts on SELinux nodes. This tag is a stable release, not a beta, alpha, or release candidate.

The full release notes and downloads are on the GitHub release page. Binary hashes and the complete note set also live in CHANGELOG-1.37.md.

The SELinuxMount feature gate is GA in v1.37 and enabled by default. On nodes with SELinux, the new labeling path can fail workloads that previously mounted volumes under the older behavior. Clusters that never enable SELinux can ignore this note.

Operators still on v1.36 should inventory Pods that share volumes across different SELinux types before the bump. The changelog linked from the GitHub release page points at a Kubernetes blog post for how to find those workloads and how to opt out of the new labeling before moving to v1.37. Do that work on the current minor, not during the upgrade window.

If a batch Job or StatefulSet in a data pipeline mounts a host path or a projected volume with a custom SELinux context, treat it as suspect until proven otherwise.

Embedded cAdvisor now uses github.com/google/cadvisor/lib. Deprecated cAdvisor flags are rejected and the kubelet will refuse to start if any of them remain. The only kept flag is --housekeeping-interval. Flags such as --containerd, --enable-load-reader, --global-housekeeping-interval, and the storage driver family are gone. Strip them from node config before the first v1.37 kubelet starts.

Custom application metrics are no longer collected. The userDefinedMetrics field in /stats/summary is empty, and container_application_* series disappear from /metrics/cadvisor. Three more series are dropped: container_cpu_load_average_10s, container_cpu_load_d_average_10s, and container_tasks_state. Dashboards and HPA custom metrics that scrape those names will go blank.

The kubelet also logs its effective configuration at startup. Those lines can leak config. Restrict the nodes/logs ClusterRole to trusted users. Most of the same values were already inferable from other log lines, so this is a reminder more than a new exposure.

eventRecordQPS now treats 0 as unlimited, matching the docs. Anyone who depended on the old default should set an explicit value such as 50.

kube-proxy warns when started without an explicit mode (iptables, ipvs, or nftables). Linux defaults will move from iptables to nftables in a later release. kubeadm now writes KubeProxyConfiguration.mode to iptables when the field is empty, so kubeadm clusters get a pinned value instead of an implicit one.

ipvs mode has been deprecated since v1.35. On newer kernels the notes tell operators to move to nftables, which has been GA since v1.33. Older kernels can stay on iptables, still the default. A KubeProxyIPVS feature gate exists so the ipvs backend can be turned off and then removed later.

nftables mode uses netlink by default via the NFTablesNetlink gate (beta, on). That path lists rules without shelling out to the nft binary. Disable the gate to restore the old exec path. The kube-proxy image also bumps nft to v1.0.6.1 so resync works against rules written by recent nftables.

Localhost NodePort on nftables can use an opt in userspace TCP proxy for IPv4 and IPv6. Long Service names no longer break nftables sync; comments are truncated to the kernel 128 byte limit.

Default etcd is v3.7.0. The etcd client library in this tag is v3.7.0 as well. Plan the etcd bump with the control plane, not as an afterthought.

scheduling.k8s.io moves from v1alpha2 to v1alpha3 and drops v1alpha2. DisruptionMode is now a struct. Remove every v1alpha2 object from kube-apiserver before the cluster update. Workload aware scheduling types Workload and PodGroup land on scheduling.k8s.io/v1beta1. The GangScheduling and WorkloadAwarePreemption gates are gone; use GenericWorkload instead.

Pod certificates are GA. PKIXPublicKey and ProofOfPossession are removed from the v1 PodCertificateRequest API. Update clients that still set those fields. ClusterTrustBundle and ClusterTrustBundleProjection are GA and on by default. StorageVersionMigration is GA and storagemigration.k8s.io/v1 is on by default.

WatchList responses can be gzip compressed when the client sends Accept-Encoding: gzip. The WatchListCompression gate is beta and on. Regular watch is unchanged. EtcdRangeStream (beta) initializes the watch cache with one RangeStream RPC instead of paginated Range calls.

gRPC is v1.82.1. The server now limits HTTP/2 control frame flooding. GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING is gone; strict path checking is always on.