kubernetes

Releases

1. ▸▾37.0.0b124 Sept 2026pre-release

   Kubernetes API Version: v1.37.0

   Kubernetes API Version: v1.37.0

   Open source →
2. ▸▾37.0.0a12 Sept 2026pre-releaseDeprecated

   The PKIXPublicKey and ProofOfPossession fields, deprecated in PodCertificateRequest v1beta1, are removed from the v1 API. Update clients that still se…

   Kubernetes API Version: v1.37.0

   API Change

   • Added Alpha support for DRA device compatibility groups, guarded by the DRADeviceCompatibilityGroups feature gate (disabled by default). DRA drivers can declare opaque compatibilityGroups on each device.consumesCounters[] entry of a ResourceSlice, and the scheduler only co-allocates devices drawing from the same counter set when their declared groups intersect. This moves detection of incompatible co-allocation from preparation-time failure to scheduling-time rejection. (kubernetes/kubernetes#139795, @omeryahud) [SIG API Machinery, Node, Scheduling and Testing]

   • Added Alpha support for binding service account tokens to webhook configurations with attestations, behind the APIServerWebhookAuthenticationToken feature gate. This enables API servers to authenticate to admission webhooks with scoped tokens. (kubernetes/kubernetes#140113, @pmengelbert) [SIG API Machinery, Apps, Auth and Testing]

   • Added Alpha support for defining the file owner of atomically written volume files, behind the AtomicWriteVolumeUserFields feature gate (disabled by default). (kubernetes/kubernetes#139764, @gavinkflam) [SIG API Machinery, Apps, Auth, Storage and Testing]

   • Added CompositePodGroup support to the building block APIs and the workloadbuilder library. (kubernetes/kubernetes#140717, @helayoty) [SIG API Machinery, Apps, Auth, Scheduling and Testing]

   • Added Workload-aware scheduling (WAS) support to the Job controller by integrating it with the workloadbuilder library and the Workload building block APIs. (kubernetes/kubernetes#140188, @helayoty) [SIG API Machinery, Apps, Auth, Network, Node, Scheduling, Storage and Testing]

   • Added CheckpointPod and RestorePod RPCs to the CRI v1 RuntimeService API for Pod-level checkpoint and restore. (kubernetes/kubernetes#140366, @rst0git) [SIG Node, Testing and Windows]

   • Added a PreemptionPolicy field to PodGroup, allowing users to control how kube-scheduler preempts Pods that belong to a PodGroup during workload-aware preemption. (kubernetes/kubernetes#139240, @ania-borowiec) [SIG Scheduling]

   • Added a protocol field to httpGet probes so that liveness, readiness, and startup probes can run over HTTP/2 cleartext (H2C). (kubernetes/kubernetes#139429, @amritansh1502) [SIG API Machinery, Apps, Node and Testing]

   • Added a defense-in-depth check to the NodeRestriction admission plugin for PodCertificateRequests. A node can only create a PodCertificateRequest referring to a particular signer name if the Pod actually mounts a podCertificate projected volume source that refers to that signer name, or if an authorization check for the user (with verb=request-podcertificate-signer and resource=<signerName>) succeeds. (kubernetes/kubernetes#140006, @ahmedtd) [SIG Auth and Testing]

   • Added a second Alpha of DRA resource availability visibility (KEP-5677), behind the DRAResourcePoolStatus feature gate (disabled by default). The ResourcePoolStatusRequest controller counts partitionable and consumable devices correctly, counting each device once, ignoring AdminAccess, and treating taints as unavailable. Optional fields describe partition and shareable availability. These accounting fixes change the numbers reported in v1.36. (kubernetes/kubernetes#140170, @nmn3m) [SIG API Machinery, Apps, Auth, Node and Testing]

   • Added an opt-in userspace TCP proxy to the nftables kube-proxy backend to serve localhost NodePort Services on IPv4 and IPv6. (kubernetes/kubernetes#138427, @AustinAbro321) [SIG Instrumentation, Network and Testing]

   • Added dry-run support to unsafe corrupt object deletion, letting administrators test deletion operations safely before running them. (kubernetes/kubernetes#134037, @ibihim) [SIG API Machinery and Testing]

   • Added generated declarative validation functions for Go consumers of the DRA device metadata v1alpha1 API. (kubernetes/kubernetes#140687, @alaypatel07) [SIG Node]

   • Added scheduler support for preempting lower-priority Pods to make room for Deferred in-place Pod resizes of higher-priority Pods when the InPlacePodVerticalScalingSchedulerPreemption Alpha feature gate is enabled. (kubernetes/kubernetes#140000, @natasha41575) [SIG API Machinery, Apps, Node, Scheduling, Storage and Testing]

   • Added support for derived attributes in DRA, allowing claims to define virtual attributes using CEL expressions and use them in device constraints. This enables co-allocation of devices across different domains, for example GPUs and NICs on the same NUMA node, even if their drivers publish physical attributes differently. (kubernetes/kubernetes#140029, @gauravkghildiyal) [SIG API Machinery, Node, Scheduling and Testing]

   • Added support for dynamically resizing memory-backed volumes behind the Alpha InPlacePodVerticalScalingMemoryBackedVolumes feature gate. (kubernetes/kubernetes#139425, @natasha41575) [SIG API Machinery, Apps, Autoscaling, CLI, Node, Scheduling, Storage and Testing]

   • Added support for selecting ResourceSlices by pool name with the field selector spec.pool.name. (kubernetes/kubernetes#138456, @yaroslavborbat) [SIG API Machinery, Node and Testing]

   • Added support for setting Unix permission bits (0000-01777) through the mode field on emptyDir volume directories at creation time. (kubernetes/kubernetes#140244, @nispriha) [SIG API Machinery, Apps, Node, Storage and Testing]

   • Added support for specifying bind mount options (noexec, nodev, nosuid) per container volume mount. (kubernetes/kubernetes#140013, @nispriha) [SIG API Machinery, Apps, Autoscaling, Node, Scheduling and Testing]

   • Added the API changes required for reporting volume health. (kubernetes/kubernetes#140194, @gnufied) [SIG API Machinery, Apps, Architecture, Auth, Etcd, Instrumentation, Node, Storage and Testing]

   • Added the CompositePodGroup API to scheduling.k8s.io/v1alpha3. (kubernetes/kubernetes#139596, @jdzikowski) [SIG API Machinery, Apps, Auth, Etcd, Node, Scheduling and Testing]

   • Added the Recreate update strategy for StatefulSet, mirroring the Deployment Recreate strategy by deleting all Pods, waiting for them to terminate completely, and then creating Pods according to the podManagementPolicy field. (kubernetes/kubernetes#137187, @galal-hussein) [SIG Apps and Testing]

   • Added the --concurrent-disruption-syncs flag to kube-controller-manager to configure the number of concurrent disruption controller workers. (kubernetes/kubernetes#140014, @xigang) [SIG API Machinery, Apps, Auth and Testing]

   • Added the .spec.evictionResponders Pod field, along with the EvictionRequest and Eviction resources. A set of requesters and responders can use these to coordinate graceful eviction of Pods. (kubernetes/kubernetes#137050, @atiratree) [SIG API Machinery, Apps, Architecture, Auth, CLI, Etcd and Testing]

   • Added the DefaultPodSysctls kubelet configuration field for default Pod sysctls on Linux nodes, behind the Alpha DefaultPodSysctls feature gate (disabled by default). (kubernetes/kubernetes#140052, @VeraQin) [SIG Node and Testing]

   • Added the DisruptionMode and PreemptionPolicy fields to the Workload and CompositePodGroup APIs to support workload-aware preemption for CompositePodGroups. (kubernetes/kubernetes#140634, @tosi3k) [SIG API Machinery, Auth, Etcd, Node, Scheduling and Testing]

   • Added the GracefulNodeShutdownInProgress, DrainInProgress, Drained, MaintenancePlanned, and MaintenanceInProgress Node lifecycle conditions. (kubernetes/kubernetes#139993, @rthallisey) [SIG Apps and Node]

   • Added the PodGroupPostFilter extension point to the scheduling framework, replacing the internal hardcoding for WorkloadAwarePreemption with a configurable extension point for PodGroups. (kubernetes/kubernetes#139674, @GFilipek) [SIG Scheduling and Testing]

   • Added the PreemptionPolicy field to PodGroupTemplate to define the policy for workload-aware preemption. (kubernetes/kubernetes#140312, @ania-borowiec) [SIG API Machinery, Apps, Scheduling and Testing]

   • Added the SchedulerPreQueueingHints feature gate (Alpha, disabled by default). When enabled, scheduler plugins can provide a PreQueueingHintFn that narrows the set of Pods evaluated on cluster events, improving scheduling throughput. The DRA plugin implements this to optimize ResourceClaimTemplate-based workloads. (kubernetes/kubernetes#138916, @geetasg) [SIG API Machinery, Apps, Architecture, Auth, CLI, Cloud Provider, Instrumentation, Network, Node, Scheduling, Storage, Testing and Windows]

   • Added the core machinery for Conditional Authorization, which enables authorizers to allow requests conditionally based on the request's content, rather than only allowing or denying them outright. (kubernetes/kubernetes#137513, @luxas) [SIG API Machinery, Auth, Node and Testing]

   • Allowed HorizontalPodAutoscaler conditions to optionally include the observedGeneration at the time the condition was recorded. (kubernetes/kubernetes#138653, @adrianmoisey) [SIG API Machinery, Apps, Autoscaling and Testing]

   • Changed the kube-apiserver CBOR encoder to encode collections item by item instead of all at once. (kubernetes/kubernetes#138808, @chenk008) [SIG API Machinery, Apps, Auth, Autoscaling, CLI, Cloud Provider, Cluster Lifecycle, Contributor Experience, Instrumentation, Network, Node, Release, Scalability, Scheduling, Storage, Testing and Windows]

   • DRA: Added Alpha support for DRAOptionalNodeOperations (the SkipNodeOperations field in ResourceSlice and ResourceClaim), which allows skipping node-level preparation and cleanup operations. (kubernetes/kubernetes#139933, @troychiu) [SIG API Machinery, Autoscaling, Instrumentation, Node, Release, Scheduling and Testing]

   • Fixed CEL cost estimation for metadata.name and metadata.generateName in CRDs to correctly account for the default maximum length of 253 characters, unless additional validations are defined on those metadata fields. (kubernetes/kubernetes#139573, @jpbetz) [SIG API Machinery]

   • Fixed DRA CapacityRequestPolicyRange to support fractional quantities in milli-scale. (kubernetes/kubernetes#140161, @sunya-ch) [SIG API Machinery, Node and Scheduling]

   • Fixed Pod status validation for reported Linux container user UIDs to accept values above 2147483647 and up to the unsigned 32-bit UID limit. (kubernetes/kubernetes#138574, @Kunalbehbud) [SIG Apps and Node]

   • Fixed a v1.34+ regression handling containers with environment values set from Secret API objects containing binary non-utf8 data. (kubernetes/kubernetes#139168, @liggitt) [SIG Architecture, Node and Testing]

   • Fixed a bug in DRA consumable capacity where the DistinctAttribute constraint was not correctly enforced for each device when a request allocated multiple devices. (kubernetes/kubernetes#140600, @GunaKKIBM) [SIG API Machinery, Apps, CLI, Etcd, Network, Node, Release, Scheduling and Testing]

   • Fixed the overestimation of a Pod's resource footprint during resize operations for multi-container Pods. (kubernetes/kubernetes#140047, @natasha41575) [SIG Node and Scheduling]

   • Graduated Pod Certificates to GA, with the PodCertificateRequest feature gate enabled by default. The PKIXPublicKey and ProofOfPossession fields, deprecated in PodCertificateRequest v1beta1, are removed from the v1 API. Update clients that still set these fields before upgrading. (kubernetes/kubernetes#139579, @yt2985) [SIG API Machinery, Apps, Architecture, Auth, Etcd, Node, Scheduling and Testing]

   • Graduated Pod hostname overrides to GA. The HostnameOverride feature gate is locked to enabled. (kubernetes/kubernetes#139116, @HirazawaUi) [SIG API Machinery, Apps, Node and Testing]

   • Graduated the ClusterTrustBundle and ClusterTrustBundleProjection feature gates to GA and enabled them by default. (kubernetes/kubernetes#139437, @stlaz) [SIG API Machinery, Apps, Architecture, Auth, Etcd, Node, Storage and Testing]

   • Improved CEL error messages in Dynamic Resource Allocation to provide guidance when accessing non-existent device attributes. Error messages link to documentation on handling optional fields using orValue() and has(). (kubernetes/kubernetes#136709, @gzb1128) [SIG API Machinery, Node and Scheduling]

   • Moved the NodeSyncPeriod field from KubeCloudSharedConfiguration to CloudControllerManagerConfiguration.NodeLifecycleController.NodeMonitorPeriod. (kubernetes/kubernetes#137964, @niewysoki) [SIG API Machinery, Apps, Cloud Provider, Instrumentation and Node]

   • Promoted DRA Workload resource claims to Beta. The DRAWorkloadResourceClaims feature gate remains disabled by default. (kubernetes/kubernetes#140334, @nojnhuh) [SIG API Machinery, Apps, Etcd, Node, Scheduling and Testing]

   • Promoted kubelet volume metrics (storage_operation_duration_seconds, volume_operation_total_seconds) from Alpha to Beta stability, providing stronger API and label stability guarantees for metric consumers. (kubernetes/kubernetes#136189, @bhope) [SIG Instrumentation and Storage]

   • Promoted the DRA Device Taints and Tolerations feature to GA, making it available via the resource.k8s.io/v1 API. (kubernetes/kubernetes#138676, @pohly) [SIG API Machinery, Apps, Architecture, Auth, Etcd, Node, Scheduling, Storage and Testing]

   • Promoted the DRA extended resource feature to GA in v1.37. (kubernetes/kubernetes#138488, @yliaog) [SIG API Machinery, Apps, Node, Scheduling and Testing]

   • Promoted the DRA metadata API to Beta. DRA driver authors that enable the feature must explicitly select which versions to support in their metadata output. (kubernetes/kubernetes#140722, @pohly) [SIG Node and Testing]

   • Promoted the DRAResourceHealth kubelet gRPC API to v1; the schema is unchanged from v1alpha1. DRAPlugin.WatchHealthStatus is a mandatory method on the DRAPlugin interface in the k8s.io/dynamic-resource-allocation/kubeletplugin helper, replacing the optional versioned gRPC interface. This is a one-time Go API break: existing drivers must add the method to compile. Drivers without health support return ErrHealthNotSupported from it, or disable the service with HealthService(false). The helper serves both v1 and v1alpha1 by default, so drivers report health on kubelet v1.36 and older without extra configuration. The kubelet prefers v1 and, for three releases of transition, still consumes v1alpha1 from drivers that shipped before v1 existed. The v1alpha1 DRAResourceHealth API is deprecated and is planned to be removed in v1.40. The kubelet only opens the device health stream for plugins that advertise the service. (kubernetes/kubernetes#139477, @harche) [SIG Node and Testing]

   • Promoted the HPAConfigurableTolerance feature gate to GA. (kubernetes/kubernetes#140107, @jm-franc) [SIG API Machinery, Apps, Autoscaling and Testing]

   • Promoted the KubeletInUserNamespace feature gate to Beta. (kubernetes/kubernetes#134639, @AkihiroSuda) [SIG API Machinery, Apps, Node and Testing]

   • Promoted the MemoryQoS feature gate to Beta. memoryThrottlingFactor defaults to nil, and memory.high is not set unless explicitly configured. (kubernetes/kubernetes#140007, @QiWang19) [SIG Node and Testing]

   • Promoted the NodeDeclaredFeatures feature gate to GA. (kubernetes/kubernetes#139763, @pravk03) [SIG Apps, Autoscaling, Node, Scheduling and Testing]

   • Promoted the PersistentVolumeClaimUnusedSinceTime feature gate to Beta in v1.37 and enabled it by default. PersistentVolumeClaims report the Unused condition, indicating how long a PersistentVolumeClaim has been unused to help identify candidates for cleanup. (kubernetes/kubernetes#139620, @RomanBednar) [SIG Apps]

   • Promoted the StorageVersionMigration feature gate to GA. The storagemigration.k8s.io/v1 API group is enabled by default. (kubernetes/kubernetes#138560, @michaelasp) [SIG API Machinery, Apps, Architecture, Auth, Etcd and Testing]

   • Promoted the VolumeLimitScaling feature gate, which adds the preventPodSchedulingIfMissing field to CSIDriver to prevent Pod scheduling on nodes missing a required CSI driver, to Beta. (kubernetes/kubernetes#140612, @gnufied) [SIG API Machinery, Storage and Testing]

   • Promoted the metrics.k8s.io API from v1beta1 to v1 without changes. (kubernetes/kubernetes#139223, @tico88612) [SIG Instrumentation]

   • Promoted the core Workload-Aware Scheduling (WAS) API types Workload and PodGroup to scheduling.k8s.io/v1beta1. Remove all v1alpha2 objects from the kube-apiserver before upgrading from v1.36 to v1.37. (kubernetes/kubernetes#140184, @tosi3k) [SIG API Machinery, Apps, Auth, Etcd, Node, Scheduling and Testing]

   • Relaxed container security context validation so that updates to Pods may set allowPrivilegeEscalation together with CAP_SYSADMIN. Pod creation still rejects this combination. (kubernetes/kubernetes#138834, @haircommander) [SIG Apps]

   • Removed the GangScheduling and WorkloadAwarePreemption feature gates. Use the GenericWorkload feature gate to enable core workload-aware scheduling functionality. (kubernetes/kubernetes#139520, @macsko) [SIG API Machinery, Node, Scheduling and Testing]

   • Removed the generally available feature gate AnyVolumeDataSource, which was locked and enabled since v1.33. (kubernetes/kubernetes#135336, @carlory) [SIG API Machinery, Apps, Storage and Testing]

   • Removed the unused PodStatusResult type from the Kubernetes API. This type had no REST endpoint and has been unused since 2015. (kubernetes/kubernetes#136271, @adityasharmawork) [SIG API Machinery, Apps, Node and Testing]

   • Renamed signal enum keys in cri-api, which are prefixed with SIGNAL_ in the api.proto definition, to avoid conflicts with C++ macros. The wire format is unchanged. (kubernetes/kubernetes#139251, @SergeyKanzhelev) [SIG Apps, Node and Testing]

   • Renamed the PodGroup condition PodGroupScheduled to PodGroupInitiallyScheduled to clarify that the condition is set only after a PodGroup is first scheduled successfully and may not reflect the PodGroup's current scheduling state. (kubernetes/kubernetes#139743, @antekjb) [SIG API Machinery, Scheduling and Testing]

   • Switched the json tag for inlined TypeMeta fields in the API Go types from ",inline" to "". inline was not a recognized json serializer option and did not modify marshal or unmarshal behavior. (kubernetes/kubernetes#138260, @liggitt) [SIG API Machinery, Apps, Architecture, Auth, CLI, Cloud Provider, Cluster Lifecycle, Etcd, Instrumentation, Network, Node, Scheduling, Storage and Testing]

   • Updated CDI spec version selection to be dynamic, preventing the generation of incompatible CDI specifications. (kubernetes/kubernetes#137699, @alaypatel07) [SIG Apps, Node, Scheduling and Testing]

   • Updated Pod-level resource handling so that Pod resources determine QoS only when they include a resource request or limit. Empty Pod resources ({}, {requests:{}}, or {limits:{}}) no longer affect QoS calculation. (kubernetes/kubernetes#137150, @KevinTMtz) [SIG Apps, CLI, Node and Scheduling]

   • Updated PodGroup and PodGroupTemplate to allow modifying minCount after creation. Changes to a PodGroupTemplate do not affect existing PodGroups. (kubernetes/kubernetes#139279, @antekjb) [SIG API Machinery, Scheduling and Testing]

   • Updated the Alpha DRANodeAllocatableResources feature:

     • ResourceSlice mappings and PodStatus support direct allocations, for DRA drivers modeling CPU, memory, and hugepages as a resource, and overhead allocations, for accelerator host overhead.
     • The kubelet accounts for DRA allocated resources when configuring Pod and container cgroups, OOM scores, and Memory QoS thresholds.
     • Standard resource requests and limits can be resized in place for Pods that use DRA claims.
     • The scheduler supports unreferenced Pod-level claims, enforces resource limits with DRA, and enforces claim sharing rules, allowing claim sharing across Pods for overhead allocations.
     • Validation enforces constraints for the updated API and uses node declared features to confirm that target nodes have the NodeAllocatableDRA feature gate enabled. (kubernetes/kubernetes#140009, @pravk03) [SIG API Machinery, Apps, Auth, Autoscaling, Node, Scheduling and Testing]

   • Updated the PodGroup API to replace PodGroupTemplateRef with WorkloadRef, a simpler and more direct way to reference the workload a PodGroup belongs to. (kubernetes/kubernetes#140080, @dom4ha) [SIG API Machinery, Apps, Etcd, Node, Scheduling and Testing]

   • client-go: Removed nearly all context.TODO calls by introducing APIs where the caller passes in the context. Log calls use the logger provided by the caller when available. (kubernetes/kubernetes#129125, @pohly) [SIG API Machinery, Apps, Architecture, Auth, CLI, Cloud Provider, Instrumentation, Network, Node, Storage and Testing]

   • kubelet: Added TLS support for gRPC container probes (behind a feature gate). (kubernetes/kubernetes#137762, @amritansh1502) [SIG API Machinery, Apps, Node and Testing]

   • Add a new .spec.evictionResponders Pod field, EvictionRequest and Eviction Resource. This can be used by a set of requesters and responders to coordinate graceful eviction of pods. (kubernetes/kubernetes#137050, @atiratree) [SIG API Machinery, Apps, Architecture, Auth, CLI, Etcd and Testing]

   • Add alpha support (behind APIServerWebhookAuthenticationToken feature gate) for binding service account tokens to webhook configurations with attestations, enabling API servers to authenticate to admission webhooks with scoped tokens. (kubernetes/kubernetes#140113, @pmengelbert) [SIG API Machinery, Apps, Auth and Testing]

   • Add supports for CompositePodGroup to building block APIs and workloadbuilder library. (kubernetes/kubernetes#140717, @helayoty) [SIG API Machinery, Apps, Auth, Scheduling and Testing]

   • Added Alpha support for users to define the desired file owner of atomically written volume files. This is behind the AtomicWriteVolumeUserFields feature gate (disabled by default). (kubernetes/kubernetes#139764, @gavinkflam) [SIG API Machinery, Apps, Auth, Storage and Testing]

   • Added CheckpointPod and RestorePod RPCs to the CRI v1 RuntimeService API for Pod-level checkpoint and restore. (kubernetes/kubernetes#140366, @rst0git) [SIG Node, Testing and Windows]

   • Added DisruptionMode and PreemptionPolicy fields to Workload and CompositePodGroup APIs to support workload-aware preemption for CompositePodGroups. (kubernetes/kubernetes#140634, @tosi3k) [SIG API Machinery, Auth, Etcd, Node, Scheduling and Testing]

   • Added a new beta feature gate SchedulerPreQueueingHints (on by default). When enabled, scheduler plugins can provide a PreQueueingHintFn that narrows the set of pods evaluated on cluster events, improving scheduling throughput. The DRA plugin implements this to optimize ResourceClaimTemplate-based workloads. (kubernetes/kubernetes#138916, @geetasg) [SIG API Machinery, Apps, Architecture, Auth, CLI, Cloud Provider, Instrumentation, Network, Node, Scheduling, Storage, Testing and Windows]

   • Added a second alpha of DRA resource availability visibility (KEP-5677, feature gate DRAResourcePoolStatus, default off): the ResourcePoolStatusRequest controller now counts partitionable and consumable devices correctly (each device counted once, AdminAccess ignored, taints treated as unavailable), and new optional fields describe partition and shareable availability. The accounting fixes change the numbers reported by 1.36. (kubernetes/kubernetes#140170, @nmn3m) [SIG API Machinery, Apps, Auth, Node and Testing]

   • Added alpha support for DRA device compatibility groups, guarded by the new DRADeviceCompatibilityGroups feature gate (off by default). DRA drivers can declare opaque compatibilityGroups on each device.consumesCounters[] entry of a ResourceSlice, and the scheduler only co-allocates devices drawing from the same counter set when their declared groups intersect, moving detection of incompatible co-allocation from preparation-time failure to scheduling-time rejection. (kubernetes/kubernetes#139795, @omeryahud) [SIG API Machinery, Node, Scheduling and Testing]

   • Added kubelet configuration field DefaultPodSysctls for default Pod sysctls on Linux nodes. This is Alpha and behind the off-by-default DefaultPodSysctls feature gate. (kubernetes/kubernetes#140052, @VeraQin) [SIG Node and Testing]

   • Added support for derived attributes in DRA, allowing claims to define virtual attributes using CEL expressions and use them in device constraints. This enables co-allocation of devices across different domains (e.g. GPUs and NICs on the same NUMA node) even if their drivers publish physical attributes differently. (kubernetes/kubernetes#140029, @gauravkghildiyal) [SIG API Machinery, Node, Scheduling and Testing]

   • Added support for selecting ResourceSlices by pool name with the field selector spec.pool.name. (kubernetes/kubernetes#138456, @yaroslavborbat) [SIG API Machinery, Node and Testing]

   • Adds protocol field to httpGet probes to run HTTP/2 cleartext (H2C) liveness, readiness, and startup probes. (kubernetes/kubernetes#139429, @amritansh1502) [SIG API Machinery, Apps, Node and Testing]

   • Allow API server CBOR encoder to encode collections item by item, instead of all at once. (kubernetes/kubernetes#138808, @chenk008) [SIG API Machinery, Apps, Auth, Autoscaling, CLI, Cloud Provider, Cluster Lifecycle, Contributor Experience, Instrumentation, Network, Node, Release, Scalability, Scheduling, Storage, Testing and Windows]

   • Client-go: with very few exceptions, context.TODO calls got removed by introducing new APIs where the caller passes in the context. Log calls use the logger provided by the caller when available. (kubernetes/kubernetes#129125, @pohly) [SIG API Machinery, Apps, Architecture, Auth, CLI, Cloud Provider, Instrumentation, Network, Node, Storage and Testing]

   • DRA device metadata v1alpha1 now provides generated declarative validation functions for Go consumers. (kubernetes/kubernetes#140687, @alaypatel07) [SIG Node]

   • DRA metadata API: the feature is now beta. DRA driver authors must explicitly select which versions to support in their metadata output if they enable the feature. (kubernetes/kubernetes#140722, @pohly) [SIG Node and Testing]

   • DRA: Introduced alpha support for DRAOptionalNodeOperations (SkipNodeOperations field in ResourceSlice and ResourceClaim) to allow skipping node-level preparation and cleanup operations. (kubernetes/kubernetes#139933, @troychiu) [SIG API Machinery, Autoscaling, Instrumentation, Node, Release, Scheduling and Testing]

   • Graduated Pod hostname overrides to GA. The HostnameOverride feature gate is now locked to enabled. (kubernetes/kubernetes#139116, @HirazawaUi) [SIG API Machinery, Apps, Node and Testing]

   • Implement APIs required for reporting volume health (kubernetes/kubernetes#140194, @gnufied) [SIG API Machinery, Apps, Architecture, Auth, Etcd, Instrumentation, Node, Storage and Testing]

   • KEP-2033: promote KubeletInUserNamespace feature to beta (kubernetes/kubernetes#134639, @AkihiroSuda) [SIG API Machinery, Apps, Node and Testing]

   • Kubelet: add support for TLS when using gRPC container probes (behind feature gate; see KEP-4939). (kubernetes/kubernetes#137762, @amritansh1502) [SIG API Machinery, Apps, Node and Testing]

   • Move prevention of pod scheduling to nodes without CSI driver beta (kubernetes/kubernetes#140612, @gnufied) [SIG API Machinery, Storage and Testing]

   • Opt-in userspace TCP proxy to the nftables kube-proxy backend to serve localhost NodePort services on IPv4 and IPv6. (kubernetes/kubernetes#138427, @AustinAbro321) [SIG Instrumentation, Network and Testing]

   • Promote MemoryQoS to beta. memoryThrottlingFactor now defaults to nil; memory.high is not set unless explicitly configured. (kubernetes/kubernetes#140007, @QiWang19) [SIG Node and Testing]

   • Promoted DRA Workload resource claims to Beta. The DRAWorkloadResourceClaims feature gate remains disabled by default. (kubernetes/kubernetes#140334, @nojnhuh) [SIG API Machinery, Apps, Etcd, Node, Scheduling and Testing]

   • Support Workload-aware scheduling (WAS) APIs by integrating Job controller with workloadbuilder library and the Workload building blocks APIs. (kubernetes/kubernetes#140188, @helayoty) [SIG API Machinery, Apps, Auth, Network, Node, Scheduling, Storage and Testing]

   • Support dynamically resizing memory-backed volumes behind the Alpha feature gate InPlacePodVerticalScalingMemoryBackedVolumes. (kubernetes/kubernetes#139425, @natasha41575) [SIG API Machinery, Apps, Autoscaling, CLI, Node, Scheduling, Storage and Testing]

   • The DRAResourceHealth kubelet gRPC API has been promoted to v1; the schema is unchanged from v1alpha1. DRAPlugin.WatchHealthStatus is a new mandatory method on the k8s.io/dynamic-resource-allocation/kubeletplugin helper's DRAPlugin interface, replacing the optional versioned gRPC interface (one-time Go API break, existing drivers must add the method to compile). Drivers without health support return ErrHealthNotSupported from it or disable the service with HealthService(false). The helper serves both v1 and v1alpha1 by default, so drivers report health on kubelets 1.36 and older without extra configuration. The kubelet prefers v1 and, for three releases of transition, still consumes v1alpha1 from drivers which shipped before v1 existed. The v1alpha1 DRAResourceHealth API is deprecated and gets removed in the 1.40 era. The kubelet only opens the device health stream for plugins that advertise the service. (kubernetes/kubernetes#139477, @harche) [SIG Node and Testing]

   • The Pod Certificates feature is moving to GA. The PodCertificateRequest feature gate is set true by default. Two fields PKIXPublicKey and ProofOfPossession which were deprecated in PodCertificateRequest v1beta1 are removed from the v1 API. (kubernetes/kubernetes#139579, @yt2985) [SIG API Machinery, Apps, Architecture, Auth, Etcd, Node, Scheduling and Testing]

   • The core Workload-Aware Scheduling (WAS) API types Workload and PodGroup are promoted to scheduling.k8s.io/v1beta1. If using the v1alpha2 version in 1.36, remember to remove all v1alpha2 objects from the api-server before upgrading from 1.36 to 1.37. (kubernetes/kubernetes#140184, @tosi3k) [SIG API Machinery, Apps, Auth, Etcd, Node, Scheduling and Testing]

   • The unsafe corrupt object deletion feature now supports dry-run mode, allowing administrators to test deletion operations safely before execution. (kubernetes/kubernetes#134037, @ibihim) [SIG API Machinery and Testing]

   • This change updates the DRANodeAllocatableResources alpha feature, which includes:

     • Updating ResourceSlice mappings and PodStatus to support direct allocations (for DRA drivers modeling CPU/memory/hugepages as a resource) and overhead allocations (for accelerator host overhead).
     • Updating kubelet to account for DRA allocated resources while configuring pod and container cgroups, OOM scores, and Memory QoS thresholds.
     • Allowing in-place resizing of standard resource requests and limits for pods utilizing DRA claims.
     • Updating the scheduler to support unreferenced pod-level claims, enforce resource limits with DRA, and enforce claim sharing rules (allowing claim sharing across pods for overhead allocations).
     • Updating validation to enforce constraints for the updated API and using node declared features to ensure target nodes have the NodeAllocatableDRA feature gate enabled. (kubernetes/kubernetes#140009, @pravk03) [SIG API Machinery, Apps, Auth, Autoscaling, Node, Scheduling and Testing]

   • Update validation logic for container security context to allow edits to pods to have allowPrivilegeEscalation and CAP_SYSADMIN. In the future, this relaxation will apply for pod creation as well. (kubernetes/kubernetes#138834, @haircommander) [SIG Apps]

   • Users can set Unix permission bits (0000-01777) through the 'mode' field on emptyDir volume directories at creation time. (kubernetes/kubernetes#140244, @nispriha) [SIG API Machinery, Apps, Node, Storage and Testing]

   • Users can specify bind mount options (noexec, nodev, nosuid) per container volume mount. (kubernetes/kubernetes#140013, @nispriha) [SIG API Machinery, Apps, Autoscaling, Node, Scheduling and Testing]

   • Add PreemptionPolicy field to PodGroupTemplate to define policy for workload-aware preemption (kubernetes/kubernetes#140312, @ania-borowiec) [SIG API Machinery, Apps, Scheduling and Testing]

   • Add a new Recreate update strategy for StatefulSets, mirroring Deployments' Recreate strategy, which deletes all pods and waits for full termination before creating new pods according to podManagementPolicy. (kubernetes/kubernetes#137187, @galal-hussein) [SIG Apps and Testing]

   • Added --concurrent-disruption-syncs to kube-controller-manager to configure the number of concurrent disruption controller workers. (kubernetes/kubernetes#140014, @xigang) [SIG API Machinery, Apps, Auth and Testing]

   • Added the CompositePodGroup API into scheduling.k8s.io/v1alpha3. (kubernetes/kubernetes#139596, @jdzikowski) [SIG API Machinery, Apps, Auth, Etcd, Node, Scheduling and Testing]

   • DRA consumable capacity: when a request allocated multiple devices, the DistinctAttribute constraint was not checked properly for each device. (kubernetes/kubernetes#140600, @GunaKKIBM) [SIG API Machinery, Apps, CLI, Etcd, Network, Node, Release, Scheduling and Testing]

   • Fix DRA CapacityRequestPolicyRange to support fractional quantities in milli-scale. (kubernetes/kubernetes#140161, @sunya-ch) [SIG API Machinery, Node and Scheduling]

   • Fix the overestimation of the pod's resource footprint for multi-container pods undergoing a resize. (kubernetes/kubernetes#140047, @natasha41575) [SIG Node and Scheduling]

   • Fixed pod status validation for reported Linux container user UIDs so values above 2147483647 and up to the unsigned 32-bit UID limit are accepted. (kubernetes/kubernetes#138574, @Kunalbehbud) [SIG Apps and Node]

   • Introduce new Node Lifecycle Conditions (kubernetes/kubernetes#139993, @rthallisey) [SIG Apps and Node]

   • Introduces PodGroupPostFilter extension point to the scheduling framework. This replaces internal hardcoding for WorkloadAwarePreemption with a proper, configurable extension point for operating on PodGroups. (kubernetes/kubernetes#139674, @GFilipek) [SIG Scheduling and Testing]

   • Kep-5304: make cdi spec version dynamic to avoid incompatible spec generation (kubernetes/kubernetes#137699, @alaypatel07) [SIG Apps, Node, Scheduling and Testing]

   • Pod-level resources only determine the QoS when they include a resource request or limit. Empty pod-level resources ({}, {requests:{}}, or {limits:{}}) no longer affect QoS calculation. (kubernetes/kubernetes#137150, @KevinTMtz) [SIG Apps, CLI, Node and Scheduling]

   • Promoted the HPAConfigurableTolerance feature gate to GA. (kubernetes/kubernetes#140107, @jm-franc) [SIG API Machinery, Apps, Autoscaling and Testing]

   • Promoted the PersistentVolumeClaimUnusedSinceTime feature gate to beta in v1.37 (enabled by default). PersistentVolumeClaims now report an Unused condition indicating how long a PVC has been unused, helping identify candidates for cleanup. (kubernetes/kubernetes#139620, @RomanBednar) [SIG Apps]

   • The ClusterTrustBundle and ClusterTrustBundleProjection features move to stable and enabled by default, along with the ClusterTrustBundle API. (kubernetes/kubernetes#139437, @stlaz) [SIG API Machinery, Apps, Architecture, Auth, Etcd, Node, Storage and Testing]

   • The metrics.k8s.io API is promoted from v1beta1 to v1 without any modifications (kubernetes/kubernetes#139223, @tico88612) [SIG Instrumentation]

   • The unsafe corrupt object deletion feature now supports dry-run mode, allowing administrators to test deletion operations safely before execution. (kubernetes/kubernetes#134037, @ibihim) [SIG API Machinery and Testing]

   • When the alpha feature gate InPlacePodVertifcalScalingSchedulerPreemption is enabled, the scheduler preempts lower-priority pods to make room for the Deferred in-place pod resizes of higher-priority pods. (kubernetes/kubernetes#140000, @natasha41575) [SIG API Machinery, Apps, Node, Scheduling, Storage and Testing]

   • Add PreemptionPolicy field to PodGroup to define policy for workload-aware preemption (kubernetes/kubernetes#139240, @ania-borowiec) [SIG API Machinery, Apps, Architecture, Auth, Autoscaling, CLI, Cloud Provider, Cluster Lifecycle, Etcd, Instrumentation, Network, Node, Scheduling, Storage, Testing and Windows]

   • Graduated the SELinuxMount feature gate to GA. SELinuxMount is now enabled by default in Kubernetes 1.37, which may break existing workloads in Kubernetes clusters with SELinux enabled. Please see our blog to identify potentially problematic workloads in your 1.36 cluster and how to fix them or opt out of SELinuxMount changes before upgrading to 1.37. Admins of clusters without SELinux enabled can ignore this release note, as nothing changes for them. (kubernetes/kubernetes#139956, @jsafrane) [SIG API Machinery, Apps and Node]

   • Implementation of core Conditional Authorization machinery (kubernetes/kubernetes#137513, @luxas) [SIG API Machinery, Auth, Node and Testing]

   • Promoted node declared features to GA. (kubernetes/kubernetes#139763, @pravk03) [SIG Apps, Autoscaling, Node, Scheduling and Testing]

   • StorageVersionMigration is now enabled by default and GA with the StorageMigration/v1 API (kubernetes/kubernetes#138560, @michaelasp) [SIG API Machinery, Apps, Architecture, Auth, Etcd and Testing]

   • The DRA Device Taints and Toleration feature is now generally available via the resource.k8s.io/v1 API. (kubernetes/kubernetes#138676, @pohly) [SIG API Machinery, Apps, Architecture, Auth, Etcd, Node, Scheduling, Storage and Testing]

   • The NodeRestriction admission plugin now adds a defense-in-depth check for PodCertificateRequests. A node may only create a PodCertificateRequest referring to a particular signer name if the pod actually mounts a podCertificate projected volume source that refers to that signer name, or if an authorization check for the user (verb=request-podcertificate-signer resource=<signerName>) succeeds. (kubernetes/kubernetes#140006, @ahmedtd) [SIG Auth and Testing]

   • Update to PodGroup API that converts the PodGroupTemplateRef to a simpler and more direct WorkloadRef that is aligned with the CompositePodGroup planned future changes. (kubernetes/kubernetes#140080, @dom4ha) [SIG API Machinery, Apps, Etcd, Node, Scheduling and Testing]

   • Cloud-provider: the NodeSyncPeriod field was moved from KubeCloudSharedConfiguration to CloudControllerManagerConfiguration.NodeLifecycleController.NodeMonitorPeriod (kubernetes/kubernetes#137964, @niewysoki) [SIG API Machinery, Apps, Cloud Provider, Instrumentation and Node]

   • Fix CEL estimated cost of metadata.name and metadata.generateName for CRDs to match what the 253 limit that is validated by default unless the CRD author adds sets validations on the metadata fields. (kubernetes/kubernetes#139573, @jpbetz) [SIG API Machinery]

   • MinCount can be modify after setting in PodGroup and PodGroupTemplate, modifying template is not influencing already existing podgroups. (kubernetes/kubernetes#139279, @antekjb) [SIG API Machinery, Scheduling and Testing]

   • Rename podGroup condition from PodGroupScheduled to PodGroupInitiallyScheduled, to express clearly that this condition is set after the PodGroup first becomes scheduled successfully, and may not reflect the latest state of the PodGroup. (kubernetes/kubernetes#139743, @antekjb) [SIG API Machinery, Scheduling and Testing]

   • The GangScheduling and WorkloadAwarePreemption feature gates were removed, and GenericWorkload is used instead to enable all core workload-aware scheduling functionalities altogether. (kubernetes/kubernetes#139520, @macsko) [SIG API Machinery, Node, Scheduling and Testing]

   • API Go types switched the json tag for inlined TypeMeta fields from ",inline" to simply "". inline was not a recognized json serializer option and did not modify marshal or unmarshal behavior. (kubernetes/kubernetes#138260, @liggitt) [SIG API Machinery, Apps, Architecture, Auth, CLI, Cloud Provider, Cluster Lifecycle, Etcd, Instrumentation, Network, Node, Scheduling, Storage and Testing]

   • Converts the DisruptionMode enum field to struct to support future extensibility. Promotes the scheduling.k8s.io API group from v1alpha2 to v1alpha3 and drops v1alpha2 entirely. Remember to remove all v1alpha2 objects from the api-server while performing the cluster update. (kubernetes/kubernetes#138572, @dom4ha) [SIG API Machinery, Apps, CLI, Etcd, Node, Scheduling and Testing]

   • DRA extended resource feature is promoted to GA in 1.37 (kubernetes/kubernetes#138488, @yliaog) [SIG API Machinery, Apps, Node, Scheduling and Testing]

   • Fixes a 1.34+ regression handling containers with environment values set from Secret API objects containing binary non-utf8 data. (kubernetes/kubernetes#139168, @liggitt) [SIG Architecture, Node and Testing]

   • HorizontalPodAutoscaler conditions allow optionally including the observedGeneration at the time the condition was recorded (kubernetes/kubernetes#138653, @adrianmoisey) [SIG API Machinery, Apps, Autoscaling and Testing]

   • Improved CEL error messages in Dynamic Resource Allocation to provide guidance when accessing non-existent device attributes. Error messages now link to documentation on handling optional fields using orValue() and has(). (kubernetes/kubernetes#136709, @gzb1128) [SIG API Machinery, Node and Scheduling]

   • Promoted kubelet volume metrics (storage_operation_duration_seconds, volume_operation_total_seconds) from Alpha to Beta stability, providing stronger API and label stability guarantees for metric consumers. (kubernetes/kubernetes#136189, @bhope) [SIG Instrumentation and Storage]

   • Removed the generally available feature gate AnyVolumeDataSource, which was locked and enabled since 1.33. (kubernetes/kubernetes#135336, @carlory) [SIG API Machinery, Apps, Storage and Testing]

   • Removed the unused PodStatusResult type from the Kubernetes API. This type had no REST endpoint and has been unused since 2015. (kubernetes/kubernetes#136271, @adityasharmawork) [SIG API Machinery, Apps, Node and Testing]

   • The change is for developers building against cri-api. Enum keys of Signal are now prefixed with SIGNAL_ in api.proto definition to avoid conflicts with C++ macroses. The wire format is unchanged. (kubernetes/kubernetes#139251, @SergeyKanzhelev) [SIG Apps, Node and Testing]