Kubernetes 1.37 strengthens security, scaling and scheduling

Kubernetes 1.37, released on August 26 as Garhwal, bolsters the container orchestration platform's security, autoscaling, and workload-scheduling features. The update includes 67 improvements, with 16 moving to stable status, 23 to Beta, 27 to Alpha, and one feature undergoing deprecation or removal. Notable security enhancements include the graduation of Pod Certificates and Cluster Trust Bundles to general availability, offering a Kubernetes-native mechanism for issuing X.509 certificates and distributing certificate-authority trust information.

Rootless node mode, controlled by KubeletInUserNamespace feature gate, has been promoted to Beta, allowing kubelet, container runtimes, networking components, and kube-proxy to function as non-root users on the host. Admission security has been strengthened through manifest-based admission control, now in Beta and enabled by default.

This enables administrators to load validating and mutating admission policies and webhooks from files on the API-server host. Autoscaling sees significant operational changes, with HorizontalPodAutoscaler support for scaling workloads to zero advancing to Beta and defaulting on. This allows workloads driven by object or external metrics to fall to zero Pods while idle and scale back when demand returns.

Cluster Autoscaler integration with CSI volume-attach limits has reached Beta, enabling scale-up simulations to estimate the number of nodes needed for pending storage-backed Pods. Scheduling changes focus on coordinated groups of Pods, with native gang scheduling graduating to Beta. Workload-aware pre-emption and PodGroup queueing are introduced to reduce deadlocks, inefficient partial placement, and interference between competing jobs.

Dynamic Resource Allocation extends support for extended-resources, including accelerator-style resources, reaching general availability. An Alpha scheduler optimization narrows Dynamic Resource Allocation requeue processing to affected Pods, improving throughput during large scale-ups.