Kubernetes 1.37 "Garhwal": stable Metrics API, KYAML and HPA scaling to zero

Kubernetes v1.37, named “Garhwal”, came out on August 26, 2026. According to the official announcement, the release has 67 enhancements: 16 graduated to stable, 23 to beta, 27 entering alpha and one deprecation or removal. The cycle ran for 15 weeks, from May 18 to August 26. It’s not a disruptive release, but it closes several long-standing items and gives clear warnings about what’s leaving.

Graduations to stable

The most symbolic one is the Metrics API. metrics.k8s.io reached stable after nearly nine years in beta. Now that v1 exists, upcoming Kubernetes releases will move over to it, and v1beta1 remains usable during the transition, in line with the API deprecation policy. Anyone with tools reading resource metrics doesn’t need to rush, but can start planning the switch.

KYAML is also stable, with conformance testing complete, and kubectl get -o kyaml is now stable. The announcement makes a point of explaining that KYAML is a safer and less ambiguous subset of YAML designed for Kubernetes, not a replacement: every KYAML file is valid YAML. For anyone who has tripped over YAML interpreting values in unexpected ways, it’s good news.

Pod certificates and ClusterTrustBundles reached stable together. The flow is: you choose a signer name and deploy a controller that watches PodCertificateRequest objects, issues and refreshes certificates for eligible Pods and maintains the corresponding ClusterTrustBundle objects. Workloads opt in by defining a podCertificate projected volume. In practice, it’s native certificate-based workload identity, without relying on external tools for the basics.

HPA scaling to zero

For me, the most practical news is HorizontalPodAutoscaler scale-to-zero, which reached beta and is enabled by default. The idea was introduced back in v1.16 and only now is it ready for broad use. You just set spec.minReplicas: 0, but there’s an important restriction: it only applies to workloads using object or external metrics. Scaling to zero based on CPU or memory isn’t supported, because those metrics depend on active Pods.

An example HPA for a worker that consumes a queue, using an external metric:

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: worker
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: worker
  minReplicas: 0
  maxReplicas: 10
  metrics:
    - type: External
      external:
        metric:
          name: queue_messages_ready
        target:
          type: AverageValue
          averageValue: "30"

While at zero, the HPA records the ScaledToZero condition as True. When it scales back up, it becomes False with the reason NotScaledToZero.

Other graduations to beta

Gang scheduling reached beta, using the Workload API and the PodGroup concept. The strategy is “all or nothing”: a group of Pods is only scheduled when the cluster has resources for the whole group, which is exactly what distributed training workloads need. The beta adds workload-aware preemption and PodGroup queueing.

Manifest-based admission control also moved to beta. Admission webhooks and CEL policies can be loaded from files on disk, through the staticManifestsDir field in AdmissionConfiguration. These policies are enforced from API server startup, keep working while etcd is unavailable, and can protect the admission resources themselves from modification.

And etcd RangeStream, which cuts memory use on large list reads, is in beta behind the EtcdRangeStream feature gate, on by default. It requires etcd 3.7 or later; against older versions, kube-apiserver automatically falls back to the traditional Range.

What’s on the way out

Three warnings deserve attention. kube-dns was deprecated: CoreDNS has been the default DNS since v1.13, and no new kube-dns packages are expected to be built after v1.40. kube-proxy’s ipvs mode now logs a deprecation warning on startup, is expected to be disabled by default in v1.40 and removed in v1.43. And cgroup v1 support still depends on a temporary override (failCgroupV1: false in KubeletConfiguration), with removal planned for a future release.

My take

v1.37 is a maintenance release in the best sense. HPA scale-to-zero enabled by default is the kind of feature that used to require extra tooling and now comes with the cluster itself, as long as your metrics are external. A stable Metrics API, after almost a decade, and KYAML show a project tidying up the house.

What I’d do now: check whether any cluster still uses kube-dns, ipvs or nodes with cgroup v1. These migrations don’t hurt today, but they will when the deadline arrives.