Kubernetes 1.37, Landing August 26, Graduates KYAML and Pod Certificates to Stable While Moving Rootless Kubelet to Beta
Kubernetes 1.37, due August 26, graduates the Metrics API, KYAML output, and Pod Certificates to stable, moves rootless kubelet to beta, and keeps phasing out kube-proxy's ipvs mode.
Overview
Kubernetes 1.37 is scheduled for release on Wednesday, August 26, 2026, according to the Kubernetes project’s official sneak-peek post, which is corroborated by Cloudsmith and PerfectScale. The release graduates the long-standing Metrics API to stable, adds a stable KYAML output format for kubectl, moves certificate-based pod identity to stable, and pushes kubelet’s rootless mode to beta, while continuing a multi-release phaseout of kube-proxy’s ipvs networking mode.
What We Know
Metrics API finally goes stable
The metrics.k8s.io API — the interface behind kubectl top and the CPU/memory metrics that drive the Horizontal Pod Autoscaler — is expected to graduate to stable after nearly nine years in beta, according to the official Kubernetes blog. The graduation, tracked as KEP-5207, brings no functional changes: both the v1 and v1beta1 versions of the API will keep working, letting teams adopt the stable version on their own schedule, per the same post. PerfectScale independently confirms the graduation, noting the API has been in beta “for years.”
Kubelet’s rootless mode moves to beta
Kubernetes node components such as the kubelet traditionally run with root privileges on the host, meaning a vulnerability in one of them could have an outsized impact on the underlying system, the Kubernetes blog explains. Kubelet in User Namespace — also called Rootless Mode and tracked as KEP-2033 — is expected to graduate to beta in 1.37. The feature lets node components run inside a Linux user namespace as an unprivileged host user while still behaving as root within the namespace, adding what the release team calls “an extra layer of isolation” that limits the blast radius of a compromised node component. PerfectScale corroborates the KEP number and beta status, describing the change as adding isolation “without changing how you use the kubelet day to day.”
KYAML output reaches stable
Outside the official sneak-peek post but confirmed independently by both Cloudsmith and PerfectScale, KYAML — tracked as KEP-5295 under SIG CLI — graduates to stable as an output format for kubectl. Cloudsmith describes it as a Kubernetes-compliant subset of YAML that always uses curly braces for maps, square brackets for lists, and double quotes for strings, removing whitespace sensitivity and type-coercion bugs while still allowing comments and trailing commas. PerfectScale confirms it becomes “a stable output option for kubectl.”
Pod Certificates go stable, ClusterTrustBundles reach beta
Also confirmed by both Cloudsmith and PerfectScale under matching KEP number 4317, Pod Certificates graduates to stable. The feature, run by SIG Auth, introduces a PodCertificateRequest API for certificate issuance and a PodCertificate projected volume source that lets the kubelet deliver short-lived X.509 keys and certificates directly to pods without bearer tokens, with PerfectScale adding that rotation happens automatically. A related feature, ClusterTrustBundles — a cluster-scoped API for distributing X.509 trust anchors to workloads without copying ConfigMaps into every namespace — graduates to beta, according to Cloudsmith.
More graduations: HPA tolerance, DRA device taints, CBOR
PerfectScale, citing KEP-4951, reports that the Horizontal Pod Autoscaler’s configurable tolerance feature goes stable in 1.37, letting operators set separate scale-up and scale-down tolerances per HPA instead of relying on a fixed cluster-wide 10% threshold. Dynamic Resource Allocation also gains device-level taints and tolerations (KEP-5055, per PerfectScale), which Cloudsmith separately lists among the 16 enhancements graduating to stable in this release — letting a DRA driver mark a specific device, such as an overheating GPU, as unschedulable without cordoning the whole node. A separate HPA enhancement, adding a ScaledToZero status condition (KEP-2021), moves to beta, and a CBOR binary serializer for the API server (tracked as #4222, according to Cloudsmith) also reaches beta, with benchmarks Cloudsmith cites showing up to 8x faster encoding and 2x faster decoding for custom resources compared to JSON.
ipvs deprecation continues, nftables path forward
The deprecation of kube-proxy’s ipvs mode — introduced in Kubernetes 1.8 to work around iptables performance bottlenecks — keeps moving forward. Per the official blog, ipvs mode is expected to be disabled by default by version 1.40 (though still selectable via feature gate) and removed entirely by version 1.43, a timeline PerfectScale also cites. Cloudsmith reports that 1.37 separately lays groundwork toward eventually making nftables the default kube-proxy backend altogether, a shift that requires Linux kernel 5.13 or newer; starting in 1.37, clusters relying on the default iptables setting will see log warnings advising administrators to either lock in iptables explicitly or begin migrating to nftables ahead of a planned default switch in version 1.40.
Other changes and removals
The --filename (-f) flag for kubectl run is being deprecated, since pods created that way are always built purely from CLI arguments like NAME and --image, according to the Kubernetes blog. Separately, a bug that let Static Pods reference Secrets or ConfigMaps via configMapRef or secretRef has been fixed; as of 1.37 those references are strictly prohibited, and the PreventStaticPodAPIReferences feature gate that previously allowed opting out has been removed. The kubelet will also continue refusing to initialize on nodes still running cgroup v1 unless operators apply an explicit override — a default in place since version 1.35 — since features like in-place pod resizing depend entirely on cgroup v2. The Volume Health Monitor KEP, which introduces four new CSI RPCs so storage drivers can report volume health in a machine-readable way, resets to alpha in 1.37 after an earlier implementation attempt in version 1.21, per the official blog and corroborated by PerfectScale.
What We Don’t Know
The Kubernetes project describes its sneak-peek post as reflecting the “current status” of the release, which “may change before the actual release date,” and Cloudsmith and PerfectScale similarly frame their coverage as pre-release previews. The exact release name for 1.37 has not been announced and, per PerfectScale, is traditionally revealed on release day. Cloudsmith’s count of 86 total tracked enhancements, 28 graduating changes, and 34 net-new alpha features reflects the state of the public enhancement tracker as of its July 21 publication date and could shift before August 26.
Analysis
Taken together, the confirmed 1.37 changes point toward a release focused on closing long-running gaps rather than introducing dramatic new capability: a nine-year-old beta API finally becoming stable, a rootless kubelet mode inching toward production readiness, and a multi-release ipvs-to-nftables migration path that Kubernetes has been signaling for several versions. The stabilization of Pod Certificates and the beta of ClusterTrustBundles both extend Kubernetes’ native certificate machinery further into territory previously covered by third-party service-mesh tooling, while KYAML’s graduation to stable gives kubectl users a stricter output format aimed at eliminating a class of YAML parsing bugs without requiring a new file format entirely.