Kubernetes Release Notes

Kubernetes Community

Kubernetes v1.36.3 has been built and pushed using Golang version 1.26.5.

The release notes have been updated in CHANGELOG-1.36.md, with a pointer to them on GitHub:

v1.36.3

Downloads for v1.36.3

Source Code

Client Binaries

Server Binaries

Node Binaries

Container Images

All container images are available as manifest lists and support the described architectures. It is also possible to pull a specific architecture directly by adding the "-$ARCH" suffix to the container image name.

Changelog since v1.36.2

Changes by Kind

Feature

• Kubernetes is now built with Go 1.26.5 (#140581, @palnabarun) [SIG Release and Testing]

Failing Test

• Fixed a bug when the DRADeviceTaintRules feature is enabled that caused kube-scheduler to panic when DeviceTaintRules exist and ResourceSlices are changed or to ignore new changes to DeviceTaintRules. (#139681, @nojnhuh) [SIG Node and Testing]

Bug or Regression

• Cri-api: Reverts to pre-1.34 JSON encoding of the KeyValue value field (#139965, @liggitt) [SIG Node]
• Fixed DRA scheduling bugs where the structured allocator mis-counted a device's shared counters while exploring candidates: it could keep a counter reserved after rejecting or backtracking a candidate, or drop a shared device's in-use marker so a later share was charged the counter twice. Either way the allocator could treat a counter set as exhausted and leave a pod pending on a node that could satisfy it. This affected the allocator used by the default feature configuration. (#140663, @thc1006) [SIG Node]
• Fixed a kubelet memory leak regression in 1.36 caused by leaked contexts on every Pod sync. (#140066, @compumike) [SIG Node]
• Fixes a 1.36 regression in server side apply where patching a container type (list or map) could result in 422 required errors for apply requests that previously succeeded. (#140296, @jpbetz) [SIG API Machinery, Architecture, Auth, CLI, Cloud Provider, Cluster Lifecycle, Network, Node, Scheduling and Storage]
• Kubeadm: Improved resilience of kubeadm etcd learner promotion. kubeadm now correctly handles cases where learner promotion succeeds on the etcd side but a transient client-side error is returned, preventing unnecessary etcd-join failures. (#139910, @jihyun-huh) [SIG Cluster Lifecycle]
• Kubeadm: during "kubeadm join", use the KubernetesAPICall timeout (default 1 minute) when fetching the kubeadm-config ConfigMap, instead of the short 350ms retry used for optional component configs. A new shortConfigMapGet parameter is added to FetchInitConfigurationFromCluster so that callers like "kubeadm reset" can still use the short retry. (#139808, @damdo) [SIG Cluster Lifecycle]
• Kubeadm: fix MemberPromote to skip the etcd promote API call when the member is already a voting member, avoiding unnecessary retries and timeout. (#138493, @wgkingk) [SIG Cluster Lifecycle]
• Kubelet no longer emits V(4) "Label not found" logs for missing optional container annotations. (#140322, @HirazawaUi) [SIG Node]

Dependencies

Added

Nothing has changed.

Changed

• sigs.k8s.io/structured-merge-diff/v6: v6.3.2 → v6.3.3

Removed

Nothing has changed.

Contributors, the CHANGELOG-1.36.md has been bootstrapped with v1.36.3 release notes and you may edit now as needed.

Published by your Kubernetes Release Managers.

Original source

Kubernetes Community,

Kubernetes v1.35.7 has been built and pushed using Golang version 1.25.12.

The release notes have been updated in CHANGELOG-1.35.md, with a pointer to them on GitHub:

v1.35.7

Downloads for v1.35.7

Source Code filename sha512 hash kubernetes.tar.gz 4b0e8827fddd8ca281856cbed66e8b0c70c36d7dc63772b4bf05edff187a820cc2b22d7e673b2519412f980bea99b3e6ca36765b3e6ad54aafaa7a3d2bf8cb9d kubernetes-src.tar.gz 03a61008e9203cc862cbebec3dcb5ef00ec564ccd1825ef0bd2933a250e14de37433e9405f8b1df7c75e88eb65fa3654f037a55fc21c6e65a927c80e61e3711a Client Binaries filename sha512 hash kubernetes-client-darwin-amd64.tar.gz 00e57bc27b3ed2afddb7aa86b15176e8f42fb962ef33a453684d32ae6d4cd055dd1c21e953ec13d34fa99e667006c03982ee02e8bb17371f61fa5ae0536bf8e1 kubernetes-client-darwin-arm64.tar.gz 0fbc27b0aea9d78197fb47667e27013ad31390cb2922ca562f22ddaddcba8f50fdb272c358db06c30c1b2f2f866cf3cac28ab974df957477eb0f59d627e48663 kubernetes-client-linux-386.tar.gz 541e21f7033d35a1fb6eb75fdc7c1cc0cd28aa2927d8ffa6c9dc8724a7f9717266f6cc0d25aadd38cec1f4e00d665ff083be968d383027ed6566014991dd6004 kubernetes-client-linux-amd64.tar.gz 923f50fd1fd1b959d7c609732db59523281c10fe3c4f2ff2c677163e7403fcf0c78c9e1fc06b6b60fad4a76647c3a92be8d6e08514d1e5a6459c74757b2a1082 kubernetes-client-linux-arm.tar.gz 18c6a6d2b8703cfe60e2475e7c1352fead5c2956af313d9dbd05b1b1a5fe3be47f1343d7d3cc83ae74667f808accd8f2fa5703b8faa9f2d369d328c57ab1f7cc kubernetes-client-linux-arm64.tar.gz 218770474da60916a1485e48c649898618e9a4fe9ad91e5557a6862035fbbccedabe6d9330aa8e2e8fb649a39b2ba2df15c0bdcb8f6287775ed746e46f04bcb6 kubernetes-client-linux-ppc64le.tar.gz e87ae90862c8af2b0e43426b2c9681adf1fa0d9bf96148a83984e01e8148362162c47a25460651fbbc452b0dcf6f90f45834a99f470804ff480a8c65e47532c1 kubernetes-client-linux-s390x.tar.gz b708d1a265ab8c514c064a908bbc57b3b1125d0eae399686a1d8623265a110b12b8a6fd43c89a6d1a221f4b0f2e4d32f43600b43e322394835d149454bf2bc89 kubernetes-client-windows-386.tar.gz cd64ded1984657a0622f1680cd419d49670982942fd68fba8d40de727dd2239b1c19fff56b16e5b4b53581f6a8f36f5a832e5e271731bc22f6b9fc0a221cb170 kubernetes-client-windows-amd64.tar.gz 4056e4e8714ba89b8bc2c162bd16b36eafb7ba208d2f73eefc17b27f739b667adb4141c817e03e25504e5fc33ae657de76c0195fbdd801273a17c854f41d088e kubernetes-client-windows-arm64.tar.gz 752151ce21e2a9fa7d5448c21838e34f4b21c252305cc7009f6074a31c409bfe8abb13b98c62f491cd60dabecf2e8993c19eb48b8f2b11863a7bef9f0712320d Server Binaries filename sha512 hash kubernetes-server-linux-amd64.tar.gz 4a4a16e47cba5f862e743fc6cbaed1f3a8abf58cd7acaab289d66ac11b6772daeb166a70475136ef5cea6318c240052572288506c15fbc17423d2a344e2dc363 kubernetes-server-linux-arm64.tar.gz 134dafeab6ce82bcc3f8ea4174b220c4dbbdb2a021a54654d932d11be6f0e22b11280017e08da46a1f1a583a272872212d7a1c0bade8f45bed97f0a88c8c7f25 kubernetes-server-linux-ppc64le.tar.gz 9e6a9efbeedc6b2da3182c36be98964e239eb7d65fe404cfb492369a81c8b844a71716ec391c2ac173a1b9e3a9014ff267fe7c1f171decf9d85feeccc13b4313 kubernetes-server-linux-s390x.tar.gz 3666446ccdbdb7a9e99860563f56afe6e404211e44154da7a0eabf76489dea028594b7fea887c15c23938fdcca21cfc29b37414f02e5592564ce6f78e8b99c04 Node Binaries filename sha512 hash kubernetes-node-linux-amd64.tar.gz 712b856b5aababc0958f9bd620c22f37cefaefd10bfb25f0a11f9a23b97812cadb11795eb6f269b32fc1fe3a87ce988f9ddb2772aadf974b39d94cda0470a9e8 kubernetes-node-linux-arm64.tar.gz b0540aa6ad0faf9615e13e30ac90ae3264c8f94aa7c81e3b01adb64e725087ad09e46e52c6acbf580977df8a5e81d6eb917665d5a1e05ed4deafe0e65f184ece kubernetes-node-linux-ppc64le.tar.gz afb18e3d98df96b699d6a8c68b013046355e82444cf97d30838a95b4b6926c44a90e9650c11b9f686c6b369d6165ccb4ad9a8e4181b09b5548e7c00cb7b21cf2 kubernetes-node-linux-s390x.tar.gz 778c36eac6bd55001eb7d227a039a4ced11b94bc071a600a88a0b685c02d16125f7f6dd0fd76d2438794db2eebeccff59422005d45208e72027961bb4a891039 kubernetes-node-windows-amd64.tar.gz cc38a9627b2aceb1bf8e2de04b31ff81a9e80a39cadbdd6ac6a6fc39d8a64809bb786cb0b42be146abb03558853a2a4724b66fd8311d5f3de84180245e38b4cd Container Images

All container images are available as manifest lists and support the described architectures. It is also possible to pull a specific architecture directly by adding the "-$ARCH" suffix to the container image name.

name architectures registry.k8s.io/conformance:v1.35.7 amd64, arm64, ppc64le, s390x registry.k8s.io/kube-apiserver:v1.35.7 amd64, arm64, ppc64le, s390x registry.k8s.io/kube-controller-manager:v1.35.7 amd64, arm64, ppc64le, s390x registry.k8s.io/kube-proxy:v1.35.7 amd64, arm64, ppc64le, s390x registry.k8s.io/kube-scheduler:v1.35.7 amd64, arm64, ppc64le, s390x registry.k8s.io/kubectl:v1.35.7 amd64, arm64, ppc64le, s390x

Changelog since v1.35.6

Changes by Kind

Feature

• Kubernetes is now built with Go 1.25.12 (#140585, @palnabarun) [SIG Release and Testing]

Bug or Regression

• Cri-api: Reverts to pre-1.34 JSON encoding of the KeyValue value field (#139966, @liggitt) [SIG Node]
• Kubeadm: Improved resilience of kubeadm etcd learner promotion. kubeadm now correctly handles cases where learner promotion succeeds on the etcd side but a transient client-side error is returned, preventing unnecessary etcd-join failures. (#139909, @jihyun-huh) [SIG Cluster Lifecycle]
• Kubeadm: during "kubeadm join", use the KubernetesAPICall timeout (default 1 minute) when fetching the kubeadm-config ConfigMap, instead of the short 350ms retry used for optional component configs. A new shortConfigMapGet parameter is added to FetchInitConfigurationFromCluster so that callers like "kubeadm reset" can still use the short retry. (#139809, @damdo) [SIG Cluster Lifecycle]
• Kubeadm: fix MemberPromote to skip the etcd promote API call when the member is already a voting member, avoiding unnecessary retries and timeout. (#138492, @wgkingk) [SIG Cluster Lifecycle]
• Kubelet no longer emits V(4) "Label not found" logs for missing optional container annotations. (#140321, @HirazawaUi) [SIG Node]

Dependencies

Added

Nothing has changed.

Changed

• google.golang.org/protobuf: v1.36.8 → f2248ac

Removed

Nothing has changed.

Contributors, the CHANGELOG-1.35.md has been bootstrapped with v1.35.7 release notes and you may edit now as needed.

Published by your Kubernetes Release Managers.

Original source

Kubernetes Community,

Kubernetes v1.34.10 has been built and pushed using Golang version 1.25.12.

The release notes have been updated in CHANGELOG-1.34.md, with a pointer to them on GitHub:

v1.34.10

Downloads for v1.34.10

Source Code

Client Binaries

Server Binaries

Node Binaries

Container Images

All container images are available as manifest lists and support the described architectures. It is also possible to pull a specific architecture directly by adding the "-$ARCH" suffix to the container image name.

Changelog since v1.34.9

Changes by Kind

Feature

• Kubernetes is now built with Go 1.25.12 (#140584, @palnabarun) [SIG Release and Testing]

Bug or Regression

• Cri-api: Reverts to pre-1.34 JSON encoding of the KeyValue value field (#139967, @liggitt) [SIG Node]
• Kubeadm: Improved resilience of kubeadm etcd learner promotion. kubeadm now correctly handles cases where learner promotion succeeds on the etcd side but a transient client-side error is returned, preventing unnecessary etcd-join failures. (#139908, @jihyun-huh) [SIG Cluster Lifecycle]
• Kubeadm: during "kubeadm join", use the KubernetesAPICall timeout (default 1 minute) when fetching the kubeadm-config ConfigMap, instead of the short 350ms retry used for optional component configs. A new shortConfigMapGet parameter is added to FetchInitConfigurationFromCluster so that callers like "kubeadm reset" can still use the short retry. (#139810, @damdo) [SIG Cluster Lifecycle]
• Kubeadm: fix MemberPromote to skip the etcd promote API call when the member is already a voting member, avoiding unnecessary retries and timeout. (#138491, @wgkingk) [SIG Cluster Lifecycle]
• Kubelet no longer emits V(4) "Label not found" logs for missing optional container annotations. (#140320, @HirazawaUi) [SIG Node]

Other (Cleanup or Flake)

• Kubelet: defer the configurations flags (and the related fallback behavior) deprecation removal timeline from 1.37 to 1.38 to align with containerd v1.7 support (#139269, @carlory) [SIG Node and Testing]

Dependencies

Added

Nothing has changed.

Changed

• google.golang.org/protobuf: v1.36.5 → f2248ac

Removed

Nothing has changed.

Contributors, the CHANGELOG-1.34.md has been bootstrapped with v1.34.10 release notes and you may edit now as needed.

Published by your Kubernetes Release Managers.

Original source

Kubernetes v1.37.0-beta.0 has been built and pushed using Golang version 1.26.5.
The release notes have been updated in CHANGELOG-1.37.md, with a pointer to them on GitHub:

v1.37.0-beta.0

Downloads for v1.37.0-beta.0

Source Code

Client Binaries

Server Binaries

Node Binaries

Container Images
All container images are available as manifest lists and support the described architectures. It is also possible to pull a specific architecture directly by adding the "-$ARCH" suffix to the container image name.

Changelog since v1.37.0-alpha.3

Changes by Kind

Dependency
• Updated the default etcd version to 3.7.0 (#140333, @Jefftree) [SIG API Machinery, Auth, Cloud Provider, Cluster Lifecycle, Etcd, Node, Scheduling and Testing]

API Change
• Add PreemptionPolicy field to PodGroupTemplate to define policy for workload-aware preemption (#140312, @ania-borowiec) [SIG API Machinery, Apps, Scheduling and Testing]
• Add a new Recreate update strategy for StatefulSets, mirroring Deployments' Recreate strategy, which deletes all pods and waits for full termination before creating new pods according to podManagementPolicy. (#137187, @galal-hussein) [SIG Apps and Testing]
• Added --concurrent-disruption-syncs to kube-controller-manager to configure the number of concurrent disruption controller workers. (#140014, @xigang) [SIG API Machinery, Apps, Auth and Testing]
• Added the CompositePodGroup API into scheduling.k8s.io/v1alpha3. (#139596, @jdzikowski) [SIG API Machinery, Apps, Auth, Etcd, Node, Scheduling and Testing]
• DRA consumable capacity: when a request allocated multiple devices, the DistinctAttribute constraint was not checked properly for each device. (#140600, @GunaKKIBM) [SIG API Machinery, Apps, CLI, Etcd, Network, Node, Release, Scheduling and Testing]
• Fix DRA CapacityRequestPolicyRange to support fractional quantities in milli-scale. (#140161, @sunya-ch) [SIG API Machinery, Node and Scheduling]
• Fix the overestimation of the pod's resource footprint for multi-container pods undergoing a resize. (#140047, @natasha41575) [SIG Node and Scheduling]
• Fixed pod status validation for reported Linux container user UIDs so values above 2147483647 and up to the unsigned 32-bit UID limit are accepted. (#138574, @Kunalbehbud) [SIG Apps and Node]
• Introduce new Node Lifecycle Conditions (#139993, @rthallisey) [SIG Apps and Node]
• Introduces PodGroupPostFilter extension point to the scheduling framework. This replaces internal hardcoding for WorkloadAwarePreemption with a proper, configurable extension point for operating on PodGroups. (#139674, @GFilipek) [SIG Scheduling and Testing]
• Kep-5304: make cdi spec version dynamic to avoid incompatible spec generation (#137699, @alaypatel07) [SIG Apps, Node, Scheduling and Testing]
• Pod-level resources only determine the QoS when they include a resource request or limit. Empty pod-level resources {}, {requests:{}}, or {limits:{}} no longer affect QoS calculation. (#137150, @KevinTMtz) [SIG Apps, CLI, Node and Scheduling]
• Promoted the HPAConfigurableTolerance feature gate to GA. (#140107, @jm-franc) [SIG API Machinery, Apps, Autoscaling and Testing]
• Promoted the PersistentVolumeClaimUnusedSinceTime feature gate to beta in v1.37 (enabled by default). PersistentVolumeClaims now report an Unused condition indicating how long a PVC has been unused, helping identify candidates for cleanup. (#139620, @RomanBednar) [SIG Apps]
• The ClusterTrustBundle and ClusterTrustBundleProjection features move to stable and enabled by default, along with the ClusterTrustBundle API. (#139437, @stlaz) [SIG API Machinery, Apps, Architecture, Auth, Etcd, Node, Storage and Testing]
• The metrics.k8s.io API is promoted from v1beta1 to v1 without any modifications (#139223, @tico88612) [SIG Instrumentation]
• The unsafe corrupt object deletion feature now supports dry-run mode, allowing administrators to test deletion operations safely before execution. (#134037, @ibihim) [SIG API Machinery and Testing]
• When the alpha feature gate InPlacePodVertifcalScalingSchedulerPreemption is enabled, the scheduler preempts lower-priority pods to make room for the Deferred in-place pod resizes of higher-priority pods. (#140000, @natasha41575) [SIG API Machinery, Apps, Node, Scheduling, Storage and Testing]

Feature
• Added a --max-depth flag to kubectl explain --recursive to limit the depth of nested fields displayed in the output. (#138809, @shady0503) [SIG CLI and Testing]
• Added metrics related to workload preemption in alpha stability behind WorkloadAwarePreemption feature gate. (#139373, @brejman) [SIG Instrumentation and Scheduling]
• Added validation to PodGroup scheduling which, if the feature gate PodGroupPreemptionPolicy is enabled, ensures that preemption policies of the evaluated pods match the priority of the PodGroup. (#140359, @ania-borowiec) [SIG Scheduling and Testing]
• Admission webhooks now skip the auth/authz virtual resources (e.g. tokenreviews, subjectaccessreviews) that ValidatingAdmissionPolicy/MutatingAdmissionPolicy already exclude, via the new ExcludeAdmissionWebhookVirtualResources feature gate (beta, on by default; opt out to restore the old behavior). (#140019, @BenTheElder) [SIG API Machinery and Testing]
• After successful scheduling of a podgroup, its remaining unscheduled pods are requeued directly to active queue rather than backoff queue. These pods preserve their old timestamp so they have precedence in scheduling unless a higher priority entity comes in between. (#139613, @iomarsayed) [SIG Scheduling and Testing]
• Bump coredns to 1.14.6 (#140497, @yashsingh74) [SIG Cloud Provider and Cluster Lifecycle]
• DRA: Add resource.kubernetes.io/numaNode as a standard device attribute with sysfs-based helper functions for DRA drivers (KEP-6072). (#139929, @johnahull) [SIG Node]
• Enhanced Pod-by-Pod preemption to support PodGroups as preemption victims. (#137981, @vshkrabkov) [SIG Scheduling and Testing]
• Graduate scheduler metrics scheduler_plugin_execution_duration_seconds and scheduler_scheduling_algorithm_duration_seconds from ALPHA to BETA stability. (#138176, @abhay1999) [SIG Instrumentation, Scheduling and Testing]
• Gradute NativeHistograms feature to beta (#140124, @richabanker) [SIG Architecture and Instrumentation]
• Kubernetes is now built with Go 1.26.5 (#140576, @palnabarun) [SIG Release and Testing]
• PostFilter plugins are no longer run during PodGroup cycle for pods from PodGroup. Instead the PodGroupPostFilter is run if the whole PodGroup is unschedulable. (#140412, @Argh4k) [SIG Scheduling and Testing]
• The EtcdRangeStream feature gate is now enabled by default (Beta). (#140085, @Jefftree) [SIG API Machinery]
• The ManifestBasedAdmissionControlConfig feature is now beta and enabled by default. (#140559, @BenTheElder) [SIG API Machinery]
• We are adding two new metrics:
"queued_entities": This metric tracks the current entities (individual pods or podgroups) in queues (active, backoff, etc..) of scheduler.
"queue_incoming_entities_total": This metric tracks total number of entities (individual pods or podgroups) added to scheduling queues (active, backoff, etc..). (#139840, @iomarsayed) [SIG Instrumentation, Network and Scheduling]
• When workload aware preemption finds a placement for the PodGroup, the status of the PodGroup will contain "pod group preemption found a placement for podgroup, preempting victims" message. (#140311, @Argh4k) [SIG Scheduling and Testing]
• Workload-Aware Preemption now runs only one scheduling attempt, on a cluster with all potential victims removed. This can lead to a suboptimal preemption victims choice at the cost of significant performance improvement. (#139980, @Argh4k) [SIG Scheduling and Testing]

Documentation
• Kube-proxy: Corrected the --metrics-bind-address flag documentation by removing the incorrect claim that setting it to an empty string disables the metrics server. (#138940, @kairosci) [SIG Network]

Bug or Regression
• DRA consumable capacity: fixed a scheduler bug where a ResourceSlice with a device capacity requirement stored as a high-precision decimal (a fine-grained fractional value, or a value above the int64 range) could have that ResourceSlice mutated in place in the informer cache during allocation, which could then make allocation fail incorrectly for subsequent pods. (#140702, @weizhoublue) [SIG Node]
• DRA drivers might not have re-created ResourcSlices that were deleted by someone else, depending on timing (driver updates, then someone else shortly afterwards deletes them). (#140063, @pohly) [SIG API Machinery, Apps, Node and Testing]
• DRA partitionable devices: if a DRA driver published counters which were outside of the normal int64 range, the counters in the informer cache got mutated and allocation may have failed incorrectly for future pods. (#140518, @weizhoublue) [SIG Node]
• Fix bug in CEL where quantity.Add would mutate the receiver. (#140556, @jpbetz) [SIG API Machinery]
• Fix: Prevent CEL Admission Panics on Three-Key Typed Map Lists (#140386, @weizhoublue) [SIG API Machinery]
• Fixed CEL for "set" and "map" lists: equality == no longer matches lists containing duplicates, and concatenation + now correctly applies set/map merge semantics to appended elements. (#140293, @jpbetz) [SIG API Machinery]
• Fixed DRA scheduling bugs where the structured allocator mis-counted a device's shared counters while exploring candidates: it could keep a counter reserved after rejecting or backtracking a candidate, or drop a shared device's in-use marker so a later share was charged the counter twice. Either way the allocator could treat a counter set as exhausted and leave a pod pending on a node that could satisfy it. This affected the allocator used by the default feature configuration. (#140431, @thc1006) [SIG Node]
• Fixed kubectl cluster-info dump --output-directory creating world-readable dump files. Files are now created with mode 0600 and kubectl-created directories with mode 0700, since dumped pod logs can contain sensitive data. (#140189, @ashvinctrl) [SIG CLI and Security]
• Fixed a DRA scheduling bug where the structured allocator keyed its shared-counter caches by pool name alone, so two drivers publishing a pool with the same name on a node could use each other's counter definitions and incorrectly accept or reject device allocations in the second driver's pool. (#140435, @thc1006) [SIG Node]
• Fixed a bug where burstable pod memory.low (soft protection) was ineffective because the parent cgroup lacked ancestor coverage required by the kernel's hierarchical protection model (#140267, @sohankunkerkar) [SIG Node and Testing]
• Fixed a case where Pods from PodGroup that evaluated successfully during the pod group cycle that eventually failed would have NNN set from this evaluation instead of from Pod Group preemption. (#140590, @Argh4k) [SIG Scheduling]
• Fixed a concurrent map read/write data race condition in handleSchedulingFailure during scheduling failure handling. (#140623, @SparshGarg999) [SIG Scheduling]
• Fixed a panic (integer divide by zero) and incorrect validation in ResourceSlice admission when a DRA consumable-capacity validRange step, min, max or default is negative or larger than 9223372036854775807. (#140666, @thc1006) [SIG Node]
• Fixed a panic in the kube-controller-manager that could crash it when a StorageVersionMigration targeted a resource not present in the RESTMapper (for example, a CRD deleted while its migration was pending). (#140586, @zwindler) [SIG API Machinery and Apps]
• Fixed kube-apiserver hanging forever on SIGTERM when its identity Lease cannot be created (e.g. hostname longer than 63 bytes). (#140241, @camilamacedo86) [SIG API Machinery]
• Fixes a regression in the retry of deferred resizes that occurred due to a change in the way a pod resource footprint is calculated. (#140646, @natasha41575) [SIG Node and Scheduling]
• KEP-5491: Fixed a bug where DRAListTypeAttributes feature gate enabled could fail to allocate devices even when a valid combination exists. This occurred when the allocator needed to backtrack during allocation of multiple devices with a matchAttribute constraint using list-type attribute values. (#140325, @everpeace) [SIG Node and Scheduling]
• Kube-proxy now exits when the watched Node's IPs change or when the Node object is deleted, allowing it to restart with updated node networking state. (#138183, @abishekgiri) [SIG Network]
• Kubectl run: error messages for invalid --restart and --image-pull-policy values now list the accepted values (#138188, @ogormans-deptstack) [SIG CLI]
• Kubelet/DRA: fixed a race where PrepareResources could attach a pod to a ResourceClaim that was concurrently being unprepared, leaving the pod running with unprepared devices. (#140527, @bart0sh) [SIG Node]
• Kubelet: fixed device health updates being applied to the wrong pod's status when device plugins for different resources expose devices with identical IDs. Affected pods now reflect device health changes immediately instead of waiting for the next periodic pod sync. (#140323, @harche) [SIG Node]
• The scheduler is less likely to get stuck scheduling large PodGroups when member Pods transiently fail to bind to Nodes (as is common when many Pods share the same ResourceClaim). (#140478, @nojnhuh) [SIG Scheduling]
• Updated the version of the nft binary in the kube-proxy image to nftables 1.0.6.1, to fix problems resyncing kube-proxy in nftables mode on systems containing rules created by recent versions of nftables. (#140405, @danwinship) [SIG Testing]

Other (Cleanup or Flake)
• DRA: when a Pod is a member of a PodGroup, the ResourceClaim controller will no longer create ResourceClaims from ResourceClaimTemplates referenced by the Pod unless the DRAWorkloadResourceClaims feature gate is enabled. This prevents the controller from generating a ResourceClaim for the individual Pod in case it was intended to be generated for the PodGroup. (#138363, @nojnhuh) [SIG API Machinery, Apps, Node, Scheduling and Testing]
• Improve memory usage of kube-proxy by dropping the .metadata.managedFields field that kube-proxy doesn't require. (#140056, @adrianmoisey) [SIG Network]
• MutatingAdmissionPolicy and MutatingAdmissionPolicyBinding are now stored in etcd as admissionregistration.k8s.io/v1 (#137375, @Jefftree) [SIG API Machinery, Etcd and Testing]
• Server-side apply now correctly drops status changes when tracking field owership for PodGroup, PodCompositeGroup and PodCertificateRequest. (#140654, @jpbetz) [SIG API Machinery, Auth, Scheduling and Testing]

Dependencies

Added
• tags.cncf.io/container-device-interface/specs-go: v1.1.0

Changed
• cyphar.com/go-pathrs: v0.2.2 → v0.2.5
• github.com/containerd/containerd/api: v1.11.0 → v1.11.1
• github.com/containerd/ttrpc: v1.2.8 → v1.2.9
• github.com/containerd/typeurl/v2: v2.2.3 → v2.3.0
• github.com/coredns/corefile-migration: v1.0.33 → v1.0.34
• github.com/cyphar/filepath-securejoin: v0.6.1 → v0.7.0
• github.com/google/cadvisor/lib: v0.60.3 → v0.60.4
• github.com/onsi/ginkgo/v2: v2.28.3 → v2.32.0
• github.com/opencontainers/cgroups: v0.0.6 → v0.0.7
• github.com/opencontainers/selinux: v1.13.1 → v1.15.1
• go.etcd.io/bbolt: v1.5.0-rc.0 → v1.5.0
• go.etcd.io/etcd/api/v3: v3.7.0-rc.0 → v3.7.0
• go.etcd.io/etcd/client/pkg/v3: v3.7.0-rc.0 → v3.7.0
• go.etcd.io/etcd/client/v3: v3.7.0-rc.0 → v3.7.0
• go.etcd.io/etcd/pkg/v3: v3.7.0-rc.0 → v3.7.0
• go.etcd.io/etcd/server/v3: v3.7.0-rc.0 → v3.7.0
• go.etcd.io/raft/v3: v3.7.0-rc.1 → v3.7.0
• golang.org/x/crypto: v0.52.0 → v0.54.0
• golang.org/x/mod: v0.35.0 → v0.37.0
• golang.org/x/net: 42abb85 → v0.57.0
• golang.org/x/sync: v0.20.0 → v0.22.0
• golang.org/x/sys: v0.45.0 → v0.47.0
• golang.org/x/telemetry: be6f6cb → 59b4966
• golang.org/x/term: v0.43.0 → v0.45.0
• golang.org/x/text: v0.37.0 → v0.40.0
• golang.org/x/tools: v0.44.0 → v0.47.0

Removed

Nothing has changed.

Contributors, the CHANGELOG-1.37.md has been bootstrapped with v1.37.0-beta.0 release notes and you may edit now as needed.

Published by your Kubernetes Release Managers.

Original source

Kubernetes Community,

Kubernetes v1.37.0-alpha.3 has been built and pushed using Golang version 1.26.4.

The release notes have been updated in CHANGELOG-1.37.md, with a pointer to them on GitHub:

v1.37.0-alpha.3

Downloads for v1.37.0-alpha.3

Source Code

filename sha512 hash

kubernetes.tar.gz 6ac747b1f3d8c6d341034ea37125829793dc3a3f8018eb0ba90e57b0190fed8a147ca56d3cf07562e932ae7e8291113e7e06c98d54c0c6577258f5844504ffd8

kubernetes-src.tar.gz 407aa7241cd88a8ee7bf1f1b18399cc3adedcc25adb8df7123e6b2b4a5856ed3972b88262c0ae0eb9eec7d84c67250fbadf0f1f76a88530c2cede1348bec8353

Client Binaries

filename sha512 hash

kubernetes-client-darwin-amd64.tar.gz 923ff3c315fc2fbcbbd215cdb4946f6d9559e0e259e8ed87fa55279c718b29c7530bfbe315a5f8fb289545a55f08dda3742f993fde519c722e469e8dc93cfab6

kubernetes-client-darwin-arm64.tar.gz 6a9332c8aa9e548b967f492ab42b197a82c23555e2ea953dc8752d300a8ef38478042a74c0f6170af10cb35b41cb80e600d1a8575141ebb6d77f1e534fcf4b93

kubernetes-client-linux-386.tar.gz f245cf9de14b216b5d1354a7d5fff1b216bbd2db10639657939719175b3d2fe486128ad0e276ad7aba796a1fd3b7b1ec6686768c0167167b8ca44303e334f3b1

kubernetes-client-linux-amd64.tar.gz 6fe93886ce95d8b5b29fffc0ea311eb50e2dd6cdf27a2ea05c5b78d33db2094a9a1e2e7af5cdf9d3740d1fa69b83ad0a5e1776edc8a2cba71e1a1b2671ccd030

kubernetes-client-linux-arm.tar.gz 69ec1be76b5216951ac7f2f2c4bfa5bf63bc7a2744f3ed973572aac8dabf8f2298520adf9230278f710dc95fe3db6c146ee1fd9311a01a887388cfe92a6a4845

kubernetes-client-linux-arm64.tar.gz d0bb9c6cdadbc797c05512f4f73cbbd412f6e840feb54b7232bc9b64b8060629e06365adfda670c37885bafb8bfa1d6de7f530c7b2922c287f23219aaf063aed

kubernetes-client-linux-ppc64le.tar.gz 7abbc629713d7f07d740de5dfa91e496087db0df1fcf7b7bcb93e5b5417453080fc859b004317439ac112e83401b3d16a19de07e477f2b605c82562dcd376ada

kubernetes-client-linux-s390x.tar.gz bbfd6060133b9203a33749f43b421dba9f6ba10c0d21f02ac8480165f4dcb25b0dd07639b5044a0b2fd0e8c32b16fa70460c40d56a59b3502026def632d7bc05

kubernetes-client-windows-386.tar.gz a2913f208ceee865ba595b670d149b6edc10209f04fc494a05ba870fb1d51a99bad22080b840fc0d113453fa39fff89ef5558c7aa4225b17a49fb0ce2ee2cad7

kubernetes-client-windows-amd64.tar.gz e4c153a764e58ed76c8892a6497aa9e094936b10c06f1226fb47d738c441d51e09182fa2bdd6e7e0e3bd678e7c9afb892c0a6ae21e920bd9f10231d2c94f77a2

kubernetes-client-windows-arm64.tar.gz cb6fd57d3c3b9c4b72c0b1865ce4b438627afc3cb9a46e06e6bcb9a04cd0ac7581e0f4c736e176025f3fe1d65c1d154afe36f52735caaee4e9ea2e0b029c4f09

Server Binaries

filename sha512 hash

kubernetes-server-linux-amd64.tar.gz f2968084ef1cff88a85bb9ec4de2df25475f74ea342b6115657216a85d52ff10bbdedc76dd486eef25495c7f3f7e188f43a0cbcaa2cec07b730068f5c01a52da

kubernetes-server-linux-arm64.tar.gz d5f8c06cc7d246112465d8435d01b99fda3a533171b34ead08ff64c26ddcc5329d540afd37df8013d3034540467ad99c93683c428eaad06a3bd1dc1640f2ac0b

kubernetes-server-linux-ppc64le.tar.gz e589b92dbb0b39fcdceb430c4d87cc7564f8143128a808c8fd89e2a09c7ceb566f1471c53fe5c38464f0c5994df43106e3c1d2d43eea97adbb48e9d7f6f68aba

kubernetes-server-linux-s390x.tar.gz 78eb0a050205e9f9c35584130124809a3c66f5f6696bc749892130f4f7fc23963680fc6ac5eb23aafd61e0e762dadb9b4a2418ba8f7cd2dfc6b8a55911b103a5

Node Binaries

filename sha512 hash

kubernetes-node-linux-amd64.tar.gz fc5cd6f7c3652bbdc58dd83d41fe33a4a36e901bd08ab12834a08510c9c9f48b2605e177394674b96b60d045f16dabe0461526943f9342f0bc92c75764a16c6f

kubernetes-node-linux-arm64.tar.gz da21197d3902a96ea603485700f7e32b719ea22b6d2c642c0c537727709a2c656d65f52ce3216e2c99d86ad1de4d98338668ad9dd123d887030c395261e5124e

kubernetes-node-linux-ppc64le.tar.gz 8e850cbe8dffbe31a7d38821efc9c27fbe12d66ed363ed4fb2abc9a6ddf840ca3b3a3f89ced2947fb722c0f15f9163af8c96bcd2ed59c6fdcd664d36ba8e2d8c

kubernetes-node-linux-s390x.tar.gz 6ed014e999b24438e3266d7c111d7cedddc568862d0a2eca7ba6c9ae29faf613c1b5d54731dd464f298052d58dce591c308cbfb6eacd23b25e4460a706494b1f

kubernetes-node-windows-amd64.tar.gz 9926cdb6b198b2906c433788a09f802dd72c8ef44f608f06fd3999661801af0e3f5d272c278cc8fab366f3e5526a6b483d3304d58171c67628fa3cdc736453a3

Container Images

All container images are available as manifest lists and support the described architectures. It is also possible to pull a specific architecture directly by adding the "-$ARCH" suffix to the container image name.

name architectures

registry.k8s.io/conformance:v1.37.0-alpha.3 amd64, arm64, ppc64le, s390x

registry.k8s.io/kube-apiserver:v1.37.0-alpha.3 amd64, arm64, ppc64le, s390x

registry.k8s.io/kube-controller-manager:v1.37.0-alpha.3 amd64, arm64, ppc64le, s390x

registry.k8s.io/kube-proxy:v1.37.0-alpha.3 amd64, arm64, ppc64le, s390x

registry.k8s.io/kube-scheduler:v1.37.0-alpha.3 amd64, arm64, ppc64le, s390x

registry.k8s.io/kubectl:v1.37.0-alpha.3 amd64, arm64, ppc64le, s390x

Changelog since v1.37.0-alpha.2

Urgent Upgrade Notes

(No, really, you MUST read this before you upgrade)

• Kubelet logs effective configuration on start.
  cluster admin should review permissions to only allow trusted users to nodes/logs cluster role. This is mostly the reminder as it was the best practice anyways and almost all of the effective configuration values can be already Inferred from other log messages or the kubelet behavior. (#139837, @SergeyKanzhelev) [SIG Node and Testing]

Changes by Kind

Dependency

• DEPRECATION!!! The kubelet's embedded cAdvisor now uses the leaner github.com/google/cadvisor/lib module, which removes three long-deprecated or legacy surfaces:
  • Deprecated cAdvisor flags are no longer accepted and the kubelet will fail to start if any are set (only --housekeeping-interval is kept): --application-metrics-count-limit, --boot-id-file, --container-hints, --containerd, --containerd-namespace, --enable-load-reader, --event-storage-age-limit, --event-storage-event-limit, --global-housekeeping-interval, --log-cadvisor-usage, --machine-id-file, --storage-driver-user, --storage-driver-password, --storage-driver-host, --storage-driver-db, --storage-driver-table, --storage-driver-secure, --storage-driver-buffer-duration. Remove these from your kubelet configuration.
  • cAdvisor application/custom metrics are no longer collected: the userDefinedMetrics field in /stats/summary and the custom container_application_* families in /metrics/cadvisor.
  • The /metrics/cadvisor series container_cpu_load_average_10s, container_cpu_load_d_average_10s, and container_tasks_state are no longer exported. (#139870, @dims) [SIG API Machinery, Auth, Instrumentation, Network, Node and Testing]

API Change

• Add PreemptionPolicy field to PodGroup to define policy for workload-aware preemption (#139240, @ania-borowiec) [SIG API Machinery, Apps, Architecture, Auth, Autoscaling, CLI, Cloud Provider, Cluster Lifecycle, Etcd, Instrumentation, Network, Node, Scheduling, Storage, Testing and Windows]
• Graduated the SELinuxMount feature gate to GA. SELinuxMount is now enabled by default in Kubernetes 1.37, which may break existing workloads in Kubernetes clusters with SELinux enabled. Please see our blog to identify potentially problematic workloads in your 1.36 cluster and how to fix them or opt out of SELinuxMount changes before upgrading to 1.37. Admins of clusters without SELinux enabled can ignore this release note, as nothing changes for them. (#139956, @jsafrane) [SIG API Machinery, Apps and Node]
• Implementation of core Conditional Authorization machinery (#137513, @luxas) [SIG API Machinery, Auth, Node and Testing]
• Promoted node declared features to GA. (#139763, @pravk03) [SIG Apps, Autoscaling, Node, Scheduling and Testing]
• StorageVersionMigration is now enabled by default and GA with the StorageMigration/v1 API (#138560, @michaelasp) [SIG API Machinery, Apps, Architecture, Auth, Etcd and Testing]
• The DRA Device Taints and Toleration feature is now generally available via the resource.k8s.io/v1 API. (#138676, @pohly) [SIG API Machinery, Apps, Architecture, Auth, Etcd, Node, Scheduling, Storage and Testing]
• The NodeRestriction admission plugin now adds a defense-in-depth check for PodCertificateRequests. A node may only create a PodCertificateRequest referring to a particular signer name if the pod actually mounts a podCertificate projected volume source that refers to that signer name, or if an authorization check for the user (verb=request-podcertificate-signer resource=) succeeds. (#140006, @ahmedtd) [SIG Auth and Testing]
• Update to PodGroup API that converts the PodGroupTemplateRef to a simpler and more direct WorkloadRef that is aligned with the CompositePodGroup planned future changes. (#140080, @dom4ha) [SIG API Machinery, Apps, Etcd, Node, Scheduling and Testing]

Feature

• A FailedScheduling event and PodScheduled PodCondition for a pod for which the default preemption found a potential node will now contain "preemption: found a potential placement for pod on node , preempting victims" mesage. (#140180, @Argh4k) [SIG Scheduling]
• Add progress to SVM conditions, allowing users to see the amount of objects a StorageVersionMigration has migrated. (#138875, @michaelasp) [SIG API Machinery and Apps]
• Added Beta support for compressed responses to WatchList requests. When a client sends Accept-Encoding: gzip, the API server returns a gzip compressed response. This behavior is enabled by default and can be disabled using the WatchListCompression feature gate. Regular Watch requests are unaffected. (#140140, @p0lyn0mial) [SIG API Machinery]
• Added PodGroup methods to PodGroupManager and SharedLister, allowing scheduler plugins to obtain a consistent PodGroup state. (#140077, @macsko) [SIG Node, Scheduling and Testing]
• Added the PodGroup field to the PodGroupInfo object in kube-scheduler to enable plugins to obtain a consistent state throughout the scheduling cycle. (#140075, @macsko) [SIG Scheduling]
• Added the incompletePodGroupPods data structure to the scheduling queue to store pods waiting for their PodGroup object to be observed by kube-scheduler. (#139952, @macsko) [SIG Node, Scheduling and Testing]
• Added validation to PodGroup scheduling which ensures priorities of the evaluated pods match the priority of the PodGroup. (#139920, @brejman) [SIG Scheduling and Testing]
• After successful scheduling of a podgroup, its remaining unscheduled pods are requeued directly to active queue rather than backoff queue. These pods preserve their old timestamp so they have precedence in scheduling unless a higher priority entity comes in between. (#139613, @iomarsayed) [SIG Scheduling and Testing]
• Client-go now has context-aware APIs for REST mapping and discovery. This addresses a long-standing problem that the implementations under the hood made blocking API calls with context.TODO. Consumers of client-go are encouraged to switch to the new APIs and therefore they get marked as Deprecated. However, there is no plan to ever remove the old APIs. (#129109, @pohly) [SIG API Machinery, Apps, Auth, Instrumentation, Node and Testing]
• Kube-proxy now warns you if you start it without explicitly specifying the proxy mode that you want (iptables, ipvs, or nftables), because the default on Linux will be switching from 'iptables' to 'nftables' in a future release. (#139957, @danwinship) [SIG Network]
• Support for kubectl get -o kyaml is promoted to stable. (#140076, @soltysh) [SIG CLI]
• Volume mount host path type mismatches log the actual path type along with the expected path type. (#121873, @skitt) [SIG Storage]

Documentation

• Client-go and apimachinery now track Go API changes in a Go-API/CHANGELOG.md file. (#138351, @pohly) [SIG API Machinery]

Bug or Regression

• Changed to only emit FailedToRetrieveImagePullSecret events if an image pull has failed. (#138432, @Jamstah) [SIG Node]
• Config file migration changed to use source file's permissions when creating destination file. (#138142, @brianpursley) [SIG API Machinery]
• Fix a regression in server side apply where patching a container type (list or map) could result in 422 required errors for apply requests that previously succeeded. (#140294, @jpbetz) [SIG API Machinery, Architecture, Auth, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation, Network, Node, Scheduling, Storage and Testing]
• Fix audit request logging of malformed patch request bodies (#139419, @hoskeri) [SIG API Machinery, Auth and Testing]
• Fixed a bug in kube-apiserver where a request matching multiple ValidatingAdmissionPolicy bindings with audit actions only recorded the first validation failure in the audit annotation; all audit failures are now published in a single annotation. (#140001, @lalitc375) [SIG API Machinery]
• Fixed a bug in the DRA kubelet plugin helper where drivers with names longer than ~30 characters could not enable rolling updates because the plugin registration socket path exceeded the AF_UNIX path length limit. Rolling-update registration sockets now pick the shortest basename that fits under the configured registry directory, preferring --reg.sock, then --reg.sock, then dra-<hashed driver+UID>-reg.sock. (#139623, @vishalanarase) [SIG Node and Testing]
• Fixed a bug that caused Pods in a PodGroup sharing a ResourceClaim to get stuck scheduling. (#140269, @nojnhuh) [SIG Node, Scheduling and Testing]
• Fixed a bug where Pods in a PodGroup sharing a ResourceClaim could be scheduled to Nodes where the ResourceClaim is not available. (#140089, @nojnhuh) [SIG Node, Scheduling and Testing]
• Fixed a bug where ValidatingAdmissionPolicy and MutatingAdmissionPolicy evaluation could observe subtle differences (particularly around quantity fields and type meta fields) in object representation. The bug could occur when a parameter object was loaded via an alternative path, due to a cache miss. CEL expressions now behave deterministically against params. (#140201, @jpbetz) [SIG API Machinery]
• Fixed a bug where successfully scheduled Pods could be stuck with the PodScheduled=False condition. (#139602, @nojnhuh) [SIG Node and Scheduling]
• Fixed a kubelet memory leak regression in 1.36 caused by leaked contexts on every Pod sync. (#139850, @compumike) [SIG Node]
• Fixed a panic in ResourceSlice validation that could occur when the DRAConsumableCapacity feature was enabled and a capacity request policy set validRange.step to zero. (#139698, @wilmerdooley)
• KEP-5491: the list-type attributes, .includes function, and macros can now be evaluated even when the ListTypeAttributes feature gate is disabled in the scheduler to avoid users from facing errors during rolling-upgrade or flipping the feature gate scenario. (#139395, @everpeace) [SIG Node]
• Kube-scheduler: fixed inter-pod (anti-)affinity and volume restriction evaluation during PodGroup scheduling cycles. The scheduler snapshot's AssumePod and ForgetPod now correctly maintain affinity node lists and PVC usage tracking. (#139054, @net0pyr) [SIG Scheduling and Testing]
• Kubeadm: improved the logic around warnings when the user sets a non-default bindAddress in KubeProxyConfiguration. (#139989, @vinayakray19) [SIG Cluster Lifecycle]
• Kubelet no longer emits V(4) "Label not found" logs for missing optional container annotations. (#140163, @HirazawaUi) [SIG Node]
• On nodes with hugepages, memory.available used by Kubelet eviction manager now correctly excludes hugepage-reserved RAM from AvailableBytes. This fixes delayed eviction and OOM kills caused by inflated available memory reporting. The HugepageAwareEviction feature gate (default: enabled) can be disabled to restore the previous behavior. (#138127, @jingczhang) [SIG Node and Testing]
• PodGroup.Status.Conditions now reflects the failure reason when scheduling is rejected due to mismatched .spec.schedulerName across pods in a group. (#140183, @Argh4k) [SIG Scheduling]
• The pods/binding endpoint now validates the specified node name consistently. (#136776, @yakir-shriker) [SIG Apps and Scheduling]

Other (Cleanup or Flake)

• Changed kubelet to log a warning if static pods are defined with an invalid priority or priorityClassName. (#136705, @sreeram-venkitesh) [SIG Node]
• Kubelet/DRA: fixed a bug where deleting a pod could un-prepare resources still in use by another pod. (#140212, @bart0sh) [SIG Node]
• PreventStaticPodAPIReferences feature gate has been removed and cannot be disabled anymore to allow static pods to reference API resources (#140226, @sreeram-venkitesh) [SIG Node]

Dependencies

Added

• github.com/google/cadvisor/lib: v0.60.3

Changed

• github.com/containerd/typeurl/v2: v2.3.0 → v2.2.3
• k8s.io/utils: b8788ab → be93311
• sigs.k8s.io/structured-merge-diff/v6: v6.4.0 → v6.4.2

Removed

• github.com/aws/aws-sdk-go-v2: v1.36.3
• github.com/aws/aws-sdk-go-v2/config: v1.29.14
• github.com/aws/aws-sdk-go-v2/credentials: v1.17.67
• github.com/aws/aws-sdk-go-v2/feature/ec2/imds: v1.16.30
• github.com/aws/aws-sdk-go-v2/internal/configsources: v1.3.34
• github.com/aws/aws-sdk-go-v2/internal/endpoints/v2: v2.6.34
• github.com/aws/aws-sdk-go-v2/internal/ini: v1.8.3
• github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding: v1.12.3
• github.com/aws/aws-sdk-go-v2/service/internal/presigned-url: v1.12.15
• github.com/aws/aws-sdk-go-v2/service/sso: v1.25.3
• github.com/aws/aws-sdk-go-v2/service/ssooidc: v1.30.1
• github.com/aws/aws-sdk-go-v2/service/sts: v1.33.19
• github.com/aws/smithy-go: v1.22.3
• github.com/containerd/errdefs: v1.0.0
• github.com/containerd/errdefs/pkg: v0.3.0
• github.com/docker/go-connections: v0.6.0
• github.com/euank/go-kmsg-parser: v2.0.0
• github.com/google/cadvisor: v0.57.0
• github.com/mistifyio/go-zfs: f784269
• github.com/moby/docker-image-spec: v1.3.1
• github.com/moby/moby/api: v1.54.1
• github.com/moby/moby/client: v0.4.0
• github.com/opencontainers/runc: v1.4.0

Contributors, the CHANGELOG-1.37.md has been bootstrapped with v1.37.0-alpha.3 release notes and you may edit now as needed.

Published by your Kubernetes Release Managers.

Original source

Kubernetes Community,
Kubernetes v1.37.0-alpha.2 has been built and pushed using Golang version 1.26.4.
The release notes have been updated in CHANGELOG-1.37.md, with a pointer to them on GitHub:

v1.37.0-alpha.2
Downloads for v1.37.0-alpha.2
Source Code
filename sha512 hash
kubernetes.tar.gz 834ebfaf9f6e895d3a74d31e0c046a19a9c499a0ce0f7dcbb4695fc85f8e5ab63fe8afff2639c152f4aace8d4ec72b9e849f926300a8a0f11548298a394e175d
kubernetes-src.tar.gz 2d6fc271a71bc6105428fa29837163fe5089f9dad28add0393c43d8d693be36cdbc179919f5cec21758e260edf85601420228e6105b0906a29b86567a2a3d61d
Client Binaries
filename sha512 hash
kubernetes-client-darwin-amd64.tar.gz 86d617eca510a1de567120eadb2f6a45a38506abb495325b213766c25168f8dfb108a04c7a24d74b7252d110e02770f68e681f61c27cdcd2a53e849cdf472398
kubernetes-client-darwin-arm64.tar.gz 16fd148c6bb335f5507a329ece30762cd624ff8e4cf776ff84110ced1be2a478e4cc412b66624a982ca1e701271eaa2cfc11674b6c56b95124dd6fc21868e157
kubernetes-client-linux-386.tar.gz 1a734b4e839c25bc2b50cd764af075aabbabdf054855ed2762ca2eb1648f11fe047382ea888817cb27854d9cfed320896bb2251e16a68d1ea6d2add6c85c239e
kubernetes-client-linux-amd64.tar.gz f619cb6ae2b2907134f9624521169996f8501c20f2d430bd2909e422e4501442d4840714673954902f11ef51867ab688ce79979e62c74542d19e377d7835e21a
kubernetes-client-linux-arm.tar.gz 70b83e9e72c4f75ac1e0925229e1bb55e358a7e14833a2c9878d09228a3b94ced4eed62b90ac6a257fb1e93ae3019da4a86219a4489b9a937c023b04bf1bc092
kubernetes-client-linux-arm64.tar.gz a60bd2e8ff138b9be87054fce9ba43a5ae721d2c7922bad97a34ba2610e157746c376bc267ee62fb2fefed9e446dcc517c601efa5231eb965865c55f7e5fba5a
kubernetes-client-linux-ppc64le.tar.gz ca201806431e2ffc7bddb355c4f194d738222f53288ead2a008d16c44ef494d5ee58da529f578b921ee13ca239527454b8556ab28b9dce1511dd852801a5e2d9
kubernetes-client-linux-s390x.tar.gz a87ac2544a04c9cd7de5d80e4e9e0f933dcb05deee6fa0734999a6befacbf01e58eb060c249528e9ab08c6e45ddf8dbf637d1f293670c6ff33366f5255e6ca46
kubernetes-client-windows-386.tar.gz f2d124c66d95496e55829b314ba29eba6fa494e44004a05272c7b6138dd98082695557d666d9466501390c6895b8eb374bcacffe71449e908a30efbc69a3816c
kubernetes-client-windows-amd64.tar.gz 1d6d31f249a283f576d4a75b95b802069b0d338b9e54a6d983eb7a595a5f6b110f38bcdb60ef90a030e96ab06e6d8666632f9cd720ed22bb07208d9041682310
kubernetes-client-windows-arm64.tar.gz f4231567a6f99f94de243b42386c76cc577ae465de6550fc4f0889c9c1c8c195dfabd2c88351875bb8e90146df9958776ba86eeed0a3650efb46e343991f90a5
Server Binaries
filename sha512 hash
kubernetes-server-linux-amd64.tar.gz d13945b5e4fbcba87abbde01649f0f75bbd5121e1eadfd74a2f8f03c370ba68accd2d46694b9a94077e07e1655562b53025d43d33aa11e9e3714759fd8b80e65
kubernetes-server-linux-arm64.tar.gz 210ecd08861ad00a5c712128ca03eda5d23bf7570d026f65cabd5161f296006b47f3c56eb8ce703d0064f27c7e6be4fe2749d87011c9ce5d15c5071de714eabc
kubernetes-server-linux-ppc64le.tar.gz c71e9f31155b4c16e63c5d90dbd75b48e80a3960b25cede95ff4aaedf1abfbd707f8b9a7cf39925b1134a4958887362b1147886a3690aae577521edd9ef06ecf
kubernetes-server-linux-s390x.tar.gz 55e5661fdb982c7922534d39e79c5cf6d15fe158fd97009ec1a9fd7c320eb2f513e3071464bc22731a87b6d6023becda47887370233dd9ec5fa259f5c8b2c82e
Node Binaries
filename sha512 hash
kubernetes-node-linux-amd64.tar.gz 36327dca5cfcbcd934cff975066e98d4a503da63f8889028f367a12519dad0a3cd8d5268fb7d07ba2ccc4a6e55ccc822d04fe2059bcc6117d2872441f822ce5b
kubernetes-node-linux-arm64.tar.gz dda000d9f40e21f48d3d52c728e26eb9b7677dccaf6c596869e2ddbdc436ce98429e37676fe7792e7b6246d725210d8fe79307bc159e40d42763c25ec533fb99
kubernetes-node-linux-ppc64le.tar.gz 2a4f6e5f2e90f4bc99f39f7bac1d8ebcd52e3a606e614c6ebf44c1306c30a0fd1076be8b3ab7852dba2e227c3b18288c843265110cd8728058151277cee5086b
kubernetes-node-linux-s390x.tar.gz f82fd679ce1a80dfec4b91856fdac268dd8cc135e4bb7eb9734c5a437d856721314c3c2b6d4bf4e3a419eff6c3e8ddccf65d209fd60d1b96bf45c9162c8924d1
kubernetes-node-windows-amd64.tar.gz 439bf15f4e0bc4fbea622747a83ed6ecb02d931b84b4ab4abe729334038237db0029d4a9cc262494945c869533b5b1afeae14a324a0be6cc49423859646d2165
Container Images
All container images are available as manifest lists and support the described architectures. It is also possible to pull a specific architecture directly by adding the "-$ARCH" suffix to the container image name.
name architectures
registry.k8s.io/conformance:v1.37.0-alpha.2 amd64, arm64, ppc64le, s390x
registry.k8s.io/kube-apiserver:v1.37.0-alpha.2 amd64, arm64, ppc64le, s390x
registry.k8s.io/kube-controller-manager:v1.37.0-alpha.2 amd64, arm64, ppc64le, s390x
registry.k8s.io/kube-proxy:v1.37.0-alpha.2 amd64, arm64, ppc64le, s390x
registry.k8s.io/kube-scheduler:v1.37.0-alpha.2 amd64, arm64, ppc64le, s390x
registry.k8s.io/kubectl:v1.37.0-alpha.2 amd64, arm64, ppc64le, s390x
Changelog since v1.37.0-alpha.1
Changes by Kind
Deprecation
• Kubeadm: if the user is providing a KubeProxyConfiguration with an empty value for the 'mode' field or if KubeProxyConfiguration is not provided, explicitly set the mode to 'iptables'. In 1.37 kube-proxy will start throwing a warning if the user has not explicitly set the field. This is part of the plan to switch the default mode to 'nftables' in a future release. (#139777, @neolit123) [SIG Cluster Lifecycle]
API Change
• Cloud-provider: the NodeSyncPeriod field was moved from KubeCloudSharedConfiguration to CloudControllerManagerConfiguration.NodeLifecycleController.NodeMonitorPeriod (#137964, @niewysoki) [SIG API Machinery, Apps, Cloud Provider, Instrumentation and Node]
• Fix CEL estimated cost of metadata.name and metadata.generateName for CRDs to match what the 253 limit that is validated by default unless the CRD author adds sets validations on the metadata fields. (#139573, @jpbetz) [SIG API Machinery]
• MinCount can be modify after setting in PodGroup and PodGroupTemplate, modifying template is not influencing already existing podgroups. (#139279, @antekjb) [SIG API Machinery, Scheduling and Testing]
• Rename podGroup condition from PodGroupScheduled to PodGroupInitiallyScheduled, to express clearly that this condition is set after the PodGroup first becomes scheduled successfully, and may not reflect the latest state of the PodGroup. (#139743, @antekjb) [SIG API Machinery, Scheduling and Testing]
• The GangScheduling and WorkloadAwarePreemption feature gates were removed, and GenericWorkload is used instead to enable all core workload-aware scheduling functionalities altogether. (#139520, @macsko) [SIG API Machinery, Node, Scheduling and Testing]
Feature
• Add informer metrics to apiserver (#139968, @michaelasp) [SIG API Machinery and Testing]
• Added CBOR as a supported encoding for discovery endpoints and structured errors when the CBORServingAndStorage feature gate is enabled. (#139632, @benluddy) [SIG API Machinery and Testing]
• Added a feature gate for Composite Pod Group. (#139407, @jdzikowski) [SIG Scheduling]
• Bump coredns to 1.14.4 (#139735, @yashsingh74) [SIG Cloud Provider and Cluster Lifecycle]
• Client-go: allow passing a custom GenerateKey field in the Config structure of the certificate manager. (#138999, @neolit123) [SIG API Machinery and Auth]
• HPA: Enable scaling to and from zero by default. (#139648, @johanneswuerbach) [SIG Apps, Autoscaling and Testing]
• Kube-apiserver, when using --enable-aggregator-routing=true, now load-balances requests evenly across all admission webhook endpoints. This ensures connection caching does not route all concurrent requests to a single backend endpoint. Cluster administrators can temporarily opt out of this new behavior using the WebhookRoundTripLoadBalancing feature gate (Beta, default true). (#139237, @aojea) [SIG API Machinery and Testing]
• Optimized kube-scheduler performance for Pods with PersistentVolumeClaim mounts by processing only delta counts between scheduling cycles. (#139238, @yue9944882) [SIG Scheduling and Testing]
• Relaxed DNS names for Services is now GA. (#139282, @adrianmoisey) [SIG Apps and Network]
• This PR introduces the WatchListCompression feature gate (Beta, enabled by default). When enabled WatchList responses are compressed with gzip for clients that include Accept-Encoding: gzip. Regular Watch requests are unaffected. (#139308, @p0lyn0mial) [SIG API Machinery]
Failing Test
• Fixed a bug when the DRADeviceTaintRules feature is enabled that caused kube-scheduler to panic when DeviceTaintRules exist and ResourceSlices are changed or to ignore new changes to DeviceTaintRules. (#139651, @nojnhuh) [SIG Node and Testing]
Bug or Regression
• Add a way to wait on run finishing when closing an event handler. (#139755, @michaelasp) [SIG API Machinery]
• An assumed pod is correctly removed from podGroupStates in cache, when it gets updated with deletion timestamp. (#138445, @iomarsayed) [SIG Scheduling]
• Cri-api: Reverts to pre-1.34 JSON encoding of the KeyValue value field (#139964, @liggitt) [SIG Node]
• Fix duplicated configs reported in resourceclaim status (#139732, @LionelJouin) [SIG Node]
• Fix(kubelet): pods with subPath mounts stuck in error loop after FUSE/GlusterFS network filesystem disruption. (#139275, @yuehaii) [SIG Node, Storage and Testing]
• Fixed a Windows kube-proxy issue where transient HNS downtime during restart/recovery could cause incorrect LoadBalancer state reconciliation, resulting in duplicate LoadBalancer creation failures with "Cannot create a file when that file already exists. (0xb7)" errors. (#139503, @princepereira) [SIG Network and Windows]
• Fixed a bug where the kubelet node shutdown manager could leak dbus connections on repeated failures, eventually leading to thread exhaustion and crash. (#137141, @harche) [SIG Node]
• Fixed a regression where the Job controller could attempt to report status.active as 0 while replacement Pod creation was deferred due to pod-failure backoff, causing the Job status update to be rejected by the apiserver. This could delay flushing uncounted terminated Pods, finalizer removal, and Job status updates, leaving Pods stuck Terminating and the Job with stale status until the backoff elapsed. (#139457, @akhilsingh-git) [SIG Apps]
• Fixed a scheduler bug where clearing NominatedNodeName left pods tracked under an empty node key in the nominator. (#139904, @pacoxu) [SIG Scheduling]
• Fixed inconsistent ephemeral-storage format between capacity and allocatable in node status by using DecimalSI format for ephemeral-storage capacity. (#137652, @0xMH) [SIG Node]
• Kube-proxy now removes stale conntrack entries when a UDP service no longer has any serving endpoints (e.g. scaled down to zero), preventing previously established one-way UDP flows from being blackholed to deleted pod IPs indefinitely. (#139629, @Bafff) [SIG Network]
• Kubeadm: Improved resilience of kubeadm etcd learner promotion. kubeadm now correctly handles cases where learner promotion succeeds on the etcd side but a transient client-side error is returned, preventing unnecessary etcd-join failures. (#139842, @jihyun-huh) [SIG Cluster Lifecycle]
• Kubeadm: during "kubeadm join", use the KubernetesAPICall timeout (default 1 minute) when fetching the kubeadm-config ConfigMap, instead of the short 350ms retry used for optional component configs. A new shortConfigMapGet parameter is added to FetchInitConfigurationFromCluster so that callers like "kubeadm reset" can still use the short retry. (#139667, @damdo) [SIG Cluster Lifecycle]
• The PodReadyToStartContainers condition now includes a diagnostic message when Status is False, explaining why the pod sandbox is not ready (e.g., "pod sandbox has no IP address", "no pod sandbox exists"). This improves debuggability for pods stuck in ContainerCreating state without requiring access to node logs. (#135300, @harche) [SIG Node]
Other (Cleanup or Flake)
• Empty requests field in config status of resourceclaim when the config applies to all requests (#139731, @LionelJouin) [SIG Node]
• Kubelet: the Topology Manager now returns a clearer error when the prefer-closest-numa-nodes policy option is enabled on a windows node that does not expose NUMA distance information, explaining that the option is not supported there. (#139760, @zylxjtu) [SIG Node]
• The service/proxy subresource of the apiserver now uses the EndpointSlices of the service rather than the Endpoints. (This will have no effect unless you were previously using that API with a Service for which you constructed the Endpoints by hand and disabled EndpointSlice mirroring of them.) (#134860, @danwinship) [SIG API Machinery and Network]
Dependencies
Added
Nothing has changed.
Changed
• github.com/coredns/corefile-migration: v1.0.31 → v1.0.33
• go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful: v0.68.0 → v0.69.0
• go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp: v0.68.0 → v0.69.0
• go.opentelemetry.io/contrib/propagators/b3: v1.43.0 → v1.44.0
• go.opentelemetry.io/otel/exporters/stdout/stdouttrace: v1.43.0 → v1.44.0
• k8s.io/kube-openapi: bbf5c55 → bc653b6
• sigs.k8s.io/apiserver-network-proxy/konnectivity-client: v0.34.0 → v0.36.0
Removed
Nothing has changed.

Contributors, the CHANGELOG-1.37.md has been bootstrapped with v1.37.0-alpha.2 release notes and you may edit now as needed.

Published by your Kubernetes Release Managers.

Original source

Kubernetes Community,

Kubernetes v1.36.2 has been built and pushed using Golang version 1.26.4.

The release notes have been updated in CHANGELOG-1.36.md, with a pointer to them on GitHub :

v1.36.2

Downloads for v1.36.2

Source Code

Client Binaries

Server Binaries

Node Binaries

Container Images

All container images are available as manifest lists and support the described architectures. It is also possible to pull a specific architecture directly by adding the "-$ARCH" suffix to the container image name.

Changelog since v1.36.1

Changes by Kind

Feature

• Kubernetes is now built using Go 1.26.4 (#139585, @cpanato) [SIG Release and Testing]
• Kubernetes is now built with Go 1.26.4 (#138871, @BenTheElder) [SIG Release]

Bug or Regression

• Avoid costly comparisons during selinux metric emission. (#139136, @gnufied) [SIG Apps and Storage]
• Fixed a Dynamic Resource Allocation scheduler bug that could assign mutually exclusive device partitions to multiple Pods. This affected DRA drivers using SharedCounters (DRAPartitionableDevices) together with multi-allocatable devices (DRAConsumableCapacity). Depending on the device and driver, the incorrect double-allocation could cause workload failures, device conflicts, crashes, or data loss. (#139211, @ashvindeodhar) [SIG Node]
• Fixed a bug where Pods that share multi-node claims and also have per-node claims can get stuck in Pending. (#139363, @nojnhuh) [SIG Node and Scheduling]
• Fixed a kube-scheduler panic when a DRA ResourceClaim using allocationMode: All selects a device that consumes shared counters. (#138988, @pohly) [SIG Node]
• Fixed a panic in the endpoint controller when processing services with empty IPFamilies field (pre-dual-stack services that were never spec-updated). (#139233, @rahulbabu95) [SIG Apps and Network]
• Fixed a regression in 1.36 where modifications to scheduling directives (nodeSelector, tolerations, node affinity) on suspended Jobs were rejected if the JobSuspended condition had not yet been set by the job controller. (#139329, @kannon92) [SIG Apps and Testing]
• Fixed an issue where kubelet would delete the CSI mount directory when a periodic NodePublishVolume call (triggered by CSIDriver.spec.requiresRepublish=true) returned an error, leaving the pod with stale volume contents that subsequent successful republishes could not repair. (#139228, @aramase) [SIG Storage]
• Fixes a 1.34+ regression handling containers with environment values set from Secret API objects containing binary non-utf8 data. (#139192, @liggitt) [SIG Node]
• Kubeadm: fixed kubeadm init phase certs --dry-run to correctly copy existing CA files. (#139445, @HirazawaUi) [SIG Cluster Lifecycle]

Dependencies

Added

Nothing has changed.

Changed

Nothing has changed.

Removed

Nothing has changed.

Contributors, the CHANGELOG-1.36.md has been bootstrapped with v1.36.2 release notes and you may edit now as needed.

Published by your Kubernetes Release Managers.

Original source