Kubernetes Release Notes

Kubernetes v1.37.0 has been built and pushed using Golang version 1.26.5.

The release notes have been updated in CHANGELOG-1.37.md, with a pointer to them on GitHub:

v1.37.0

Documentation

• Downloads for v1.37.0
• Source Code
• Client Binaries
• Server Binaries
• Node Binaries
• Container Images

All container images are available as manifest lists and support the described architectures. It is also possible to pull a specific architecture directly by adding the "-$ARCH" suffix to the container image name.

Changelog since v1.36.0

Urgent Upgrade Notes

(No, really, you MUST read this before you upgrade)

• ACTION REQUIRED: Graduated the SELinuxMount feature gate to GA. The feature is enabled by default in v1.37, which may break existing workloads in clusters with SELinux enabled. Please see the Kubernetes blog post to identify potentially problematic workloads in a v1.36 cluster and how to fix them or opt out of SELinuxMount changes before upgrading to v1.37. Admins of clusters without SELinux enabled can ignore this release note. (#139956, @jsafrane) [SIG API Machinery, Apps and Node]
• ACTION REQUIRED: Converted the DisruptionMode enum field to a struct to support future extensibility. Promoted the scheduling.k8s.io API group from v1alpha2 to v1alpha3 and dropped v1alpha2 entirely. Remove all v1alpha2 objects from the kube-apiserver before performing the cluster update. (#138572, @dom4ha) [SIG API Machinery, Apps, CLI, Etcd, Node, Scheduling and Testing]
• ACTION REQUIRED: Fixed eventRecordQPS handling in kubelet configuration to treat 0 as unlimited (no rate limit), aligning behavior with the documentation. Users relying on the previous default behavior should explicitly set a non-zero value (for example, 50). (#117119, @HirazawaUi) [SIG API Machinery, Auth and Node]
• ACTION REQUIRED: Updated the kubelet to log its effective configuration at startup. Because these logs can expose configuration details, cluster administrators should restrict the nodes/logs ClusterRole to trusted users. This is largely a reminder of an existing best practice, since most effective configuration values can already be inferred from other log messages or kubelet behavior. (#139837, @SergeyKanzhelev) [SIG Node]

Changes by Kind

Dependency

• Updated google.golang.org/grpc to v1.82.1, which adds a server-side limit on HTTP/2 control frame flooding. It also removes the GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING environment variable, so strict path checking is always on. (#140740, @dims) [SIG API Machinery, Architecture, Auth, CLI, Cloud Provider, Network, Node and Scheduling]
• Updated the kubelet's embedded cAdvisor to use the leaner github.com/google/cadvisor/lib module, which removes three long-deprecated or legacy surfaces:
  • Deprecated cAdvisor flags are no longer accepted and the kubelet will fail to start if any are set (only --housekeeping-interval is kept): --application-metrics-count-limit, --boot-id-file, --container-hints, --containerd, --containerd-namespace, --enable-load-reader, --event-storage-age-limit, --event-storage-event-limit, --global-housekeeping-interval, --log-cadvisor-usage, --machine-id-file, --storage-driver-user, --storage-driver-password, --storage-driver-host, --storage-driver-db, --storage-driver-table, --storage-driver-secure, --storage-driver-buffer-duration. Remove these from your kubelet configuration.
  • cAdvisor application/custom metrics are no longer collected: the userDefinedMetrics field in /stats/summary and the custom container_application_* families in /metrics/cadvisor.
  • The /metrics/cadvisor series container_cpu_load_average_10s, container_cpu_load_d_average_10s, and container_tasks_state are no longer exported. (#139870, @dims) [SIG API Machinery, Auth, Instrumentation, Network, Node and Testing]
• Updated the default etcd version to v3.7.0-rc.0. (#139427, @Jefftree) [SIG API Machinery, Cloud Provider, Cluster Lifecycle, Etcd and Testing]
• Updated the default etcd version to v3.7.0. (#140333, @Jefftree) [SIG API Machinery, Auth, Cloud Provider, Cluster Lifecycle, Etcd, Node, Scheduling and Testing]
• Updated the etcd client library to v3.6.10. (#138393, @humblec) [SIG API Machinery, Architecture, Auth, CLI, Cloud Provider, Cluster Lifecycle, Etcd, Instrumentation, Network, Node, Scheduling and Storage]

Deprecation

• Changed kubeadm to explicitly set KubeProxyConfiguration.mode to iptables when KubeProxyConfiguration is not provided or when the mode field is empty. In v1.37, kube-proxy will warn if the field is not explicitly set as part of the planned transition to nftables as the default mode in a future release. (#139777, @neolit123) [SIG Cluster Lifecycle]
• Deprecated the ignored --filename / -f flag on kubectl run. (#138671, @Suknna) [SIG CLI]
• Locked the deprecated DeclarativeValidationTakeover feature gate to its default value; it can no longer be set. (#139212, @yongruilin) [SIG API Machinery]
• kubeadm: Added a (delayed) warning that kube-proxy's ipvs mode is deprecated since v1.35 and users on newer Linux kernels should be using the nftables mode instead, which became GA in v1.33. For older kernel versions, users can use iptables, which is still the default. (#139067, @neolit123) [SIG Cluster Lifecycle]

API Change

• Added Alpha support for DRA device compatibility groups, guarded by the DRADeviceCompatibilityGroups feature gate (disabled by default). DRA drivers can declare opaque compatibilityGroups on each device.consumesCounters[] entry of a ResourceSlice, and the scheduler only co-allocates devices drawing from the same counter set when their declared groups intersect. This moves detection of incompatible co-allocation from preparation-time failure to scheduling-time rejection. (#139795, @omeryahud) [SIG API Machinery, Node, Scheduling and Testing]
• Added Alpha support for binding service account tokens to webhook configurations with attestations, behind the APIServerWebhookAuthenticationToken feature gate. This enables API servers to authenticate to admission webhooks with scoped tokens. (#140113, @pmengelbert) [SIG API Machinery, Apps, Auth and Testing]
• Added Alpha support for defining the file owner of atomically written volume files, behind the AtomicWriteVolumeUserFields feature gate (disabled by default). (#139764, @gavinkflam) [SIG API Machinery, Apps, Auth, Storage and Testing]
• Added CompositePodGroup support to the building block APIs and the workloadbuilder library. (#140717, @helayoty) [SIG API Machinery, Apps, Auth, Scheduling and Testing]
• Added Workload-aware scheduling (WAS) support to the Job controller by integrating it with the workloadbuilder library and the Workload building block APIs. (#140188, @helayoty) [SIG API Machinery, Apps, Auth, Network, Node, Scheduling, Storage and Testing]
• Added CheckpointPod and RestorePod RPCs to the CRI v1 RuntimeService API for Pod-level checkpoint and restore. (#140366, @rst0git) [SIG Node, Testing and Windows]
• Added a PreemptionPolicy field to PodGroup, allowing users to control how kube-scheduler preempts Pods that belong to a PodGroup during workload-aware preemption. (#139240, @ania-borowiec) [SIG Scheduling]
• Added a protocol field to httpGet probes so that liveness, readiness, and startup probes can run over HTTP/2 cleartext (H2C). (#139429, @amritansh1502) [SIG API Machinery, Apps, Node and Testing]
• Added a defense-in-depth check to the NodeRestriction admission plugin for PodCertificateRequests. A node can only create a PodCertificateRequest referring to a particular signer name if the Pod actually mounts a podCertificate projected volume source that refers to that signer name, or if an authorization check for the user (with verb=request-podcertificate-signer and resource=) succeeds. (#140006, @ahmedtd) [SIG Auth and Testing]
• Added a second Alpha of DRA resource availability visibility (KEP-5677), behind the DRAResourcePoolStatus feature gate (disabled by default). The ResourcePoolStatusRequest controller counts partitionable and consumable devices correctly, counting each device once, ignoring AdminAccess, and treating taints as unavailable. Optional fields describe partition and shareable availability. These accounting fixes change the numbers reported in v1.36. (#140170, @nmn3m) [SIG API Machinery, Apps, Auth, Node and Testing]
• Added an opt-in userspace TCP proxy to the nftables kube-proxy backend to serve localhost NodePort Services on IPv4 and IPv6. (#138427, @AustinAbro321) [SIG Instrumentation, Network and Testing]
• Added dry-run support to unsafe corrupt object deletion, letting administrators test deletion operations safely before running them. (#134037, @ibihim) [SIG API Machinery and Testing]
• Added generated declarative validation functions for Go consumers of the DRA device metadata v1alpha1 API. (#140687, @alaypatel07) [SIG Node]
• Added scheduler support for preempting lower-priority Pods to make room for Deferred in-place Pod resizes of higher-priority Pods when the InPlacePodVerticalScalingSchedulerPreemption Alpha feature gate is enabled. (#140000, @natasha41575) [SIG API Machinery, Apps, Node, Scheduling, Storage and Testing]
• Added support for derived attributes in DRA, allowing claims to define virtual attributes using CEL expressions and use them in device constraints. This enables co-allocation of devices across different domains, for example GPUs and NICs on the same NUMA node, even if their drivers publish physical attributes differently. (#140029, @gauravkghildiyal) [SIG API Machinery, Node, Scheduling and Testing]
• Added support for dynamically resizing memory-backed volumes behind the Alpha InPlacePodVerticalScalingMemoryBackedVolumes feature gate. (#139425, @natasha41575) [SIG API Machinery, Apps, Autoscaling, CLI, Node, Scheduling, Storage and Testing]
• Added support for selecting ResourceSlices by pool name with the field selector spec.pool.name. (#138456, @yaroslavborbat) [SIG API Machinery, Node and Testing]
• Added support for setting Unix permission bits (0000-01777) through the mode field on emptyDir volume directories at creation time. (#140244, @nispriha) [SIG API Machinery, Apps, Node, Storage and Testing]
• Added support for specifying bind mount options (noexec, nodev, nosuid) per container volume mount. (#140013, @nispriha) [SIG API Machinery, Apps, Autoscaling, Node, Scheduling and Testing]
• Added the API changes required for reporting volume health. (#140194, @gnufied) [SIG API Machinery, Apps, Architecture, Auth, Etcd, Instrumentation, Node, Storage and Testing]
• Added the CompositePodGroup API to scheduling.k8s.io/v1alpha3. (#139596, @jdzikowski) [SIG API Machinery, Apps, Auth, Etcd, Node, Scheduling and Testing]
• Added the Recreate update strategy for StatefulSet, mirroring the Deployment Recreate strategy by deleting all Pods, waiting for them to terminate completely, and then creating Pods according to the podManagementPolicy field. (#137187, @galal-hussein) [SIG Apps and Testing]
• Added the --concurrent-disruption-syncs flag to kube-controller-manager to configure the number of concurrent disruption controller workers. (#140014, @xigang) [SIG API Machinery, Apps, Auth and Testing]
• Added the .spec.evictionResponders Pod field, along with the EvictionRequest and Eviction resources. A set of requesters and responders can use these to coordinate graceful eviction of Pods. (#137050, @atiratree) [SIG API Machinery, Apps, Architecture, Auth, CLI, Etcd and Testing]
• Added the DefaultPodSysctls kubelet configuration field for default Pod sysctls on Linux nodes, behind the Alpha DefaultPodSysctls feature gate (disabled by default). (#140052, @VeraQin) [SIG Node and Testing]
• Added the DisruptionMode and PreemptionPolicy fields to the Workload and CompositePodGroup APIs to support workload-aware preemption for CompositePodGroups. (#140634, @tosi3k) [SIG API Machinery, Auth, Etcd, Node, Scheduling and Testing]
• Added the GracefulNodeShutdownInProgress, DrainInProgress, Drained, MaintenancePlanned, and MaintenanceInProgress Node lifecycle conditions. (#139993, @rthallisey) [SIG Apps and Node]
• Added the PodGroupPostFilter extension point to the scheduling framework, replacing the internal hardcoding for WorkloadAwarePreemption with a configurable extension point for PodGroups. (#139674, @GFilipek) [SIG Scheduling and Testing]
• Added the client-go informer metrics informer_store_resource_version, informer_queued_items, and informer_processing_latency_seconds to kube-scheduler, labelled name="kube-scheduler". (#140511, @Jefftree) [SIG Scheduling and Testing]
• Added the incompletePodGroupPods data structure to the scheduling queue to store Pods waiting for their PodGroup object to be observed by kube-scheduler. (#139952, @macsko) [SIG Node, Scheduling and Testing]
• Added the owner_api_group and owner_api_kind labels to the dynamic_resource_allocation_resourceclaim_creates_total metric to distinguish ResourceClaims created for Pods from those created for PodGroups under the DRAWorkloadResourceClaims feature gate. (#140422, @nojnhuh) [SIG API Machinery, Apps, Instrumentation, Node, Scheduling and Testing]
• Added the queued_entities and queue_incoming_entities_total scheduler metrics. queued_entities reports the current number of scheduling entities (Pods or PodGroups) in scheduler queues, and queue_incoming_entities_total reports the total number of scheduling entities added to scheduler queues. (#139840, @iomarsayed) [SIG Instrumentation, Network and Scheduling]
• Added the storage_to_cache stage to the Alpha apiserver_watch_events_dispatch_duration_seconds metric to track the latency from backend decode to watch cache ingestion. (#140860, @richabanker) [SIG API Machinery and Instrumentation]
• Added the trigger (periodic or node_change) and outcome (changed or noop) labels to the Alpha route controller metric route_controller_route_sync_total. This lets operators observe how often periodic reconciliation corrects route drift versus running as a no-op. (#140147, @lukasmetzner) [SIG Cloud Provider and Instrumentation]
• Added the scheduler extension point PlacementFeasible to allow early termination of the PodGroup scheduling cycle. This extension point is used by the GangScheduling plugin to stop evaluating pods once minCount becomes unsatisfiable. (#138643, @brejman) [SIG Scheduling and Testing]
• Added the standard device attribute resource.kubernetes.io/numaNode and sysfs-based helper functions for DRA drivers. (#139929, @johnahull) [SIG Node]
• Added validation to PodGroup scheduling that, when the PodGroupPreemptionPolicy feature gate is enabled, ensures that the preemption policies of Pods being evaluated for scheduling match the priority of the PodGroup. (#140359, @ania-borowiec) [SIG Scheduling and Testing]
• Added validation to PodGroup scheduling which ensures priorities of the evaluated pods match the priority of the PodGroup. (#139920, @brejman) [SIG Scheduling and Testing]
• Added workload preemption metrics in Alpha behind the WorkloadAwarePreemption feature gate. (#139373, @brejman) [SIG Instrumentation and Scheduling]
• Applied --field-selector to pod metrics when invoking kubectl top pod. (#139107, @Mujib-Ahasan) [SIG CLI]
• Changed PodGroup preemption to run after a failed PodGroup scheduling attempt for PodGroups with scheduling constraints. (#140683, @Argh4k) [SIG API Machinery, Scheduling and Testing]
• Changed kube-apiserver with --enable-aggregator-routing=true to evenly load-balance requests across admission webhook endpoints, preventing connection caching from routing all concurrent requests to a single backend endpoint. Cluster administrators can temporarily opt out of this behavior using the WebhookRoundTripLoadBalancing feature gate (Beta, default true). (#139237, @aojea) [SIG API Machinery and Testing]
• Changed the PatchPodStatus API in the scheduler framework to accept a slice of Pod conditions ([]*v1.PodCondition) instead of a single condition (*v1.PodCondition). This allows scheduler plugins to update multiple Pod conditions in a single API call, preventing newer calls from overwriting older ones when multiple conditions need to be updated concurrently. (#135160, @KunWuLuan) [SIG Scheduling]
• Demoted the SchedulerPreQueueingHints feature gate from Beta to Alpha, disabled by default, because of issues found shortly before release. (#140959, @sanposhiho) [SIG Scheduling]
• Enabled scaling to and from zero by default for the HorizontalPodAutoscaler (HPA). (#139648, @johanneswuerbach) [SIG Apps, Autoscaling and Testing]
• Enabled the EtcdRangeStream feature gate by default and promoted it to Beta. (#140085, @Jefftree) [SIG API Machinery]
• Enhanced Pod-by-Pod preemption to support PodGroups as preemption victims. (#137981, @vshkrabkov) [SIG Scheduling and Testing]
• Updated pod group preemption errors to be prefixed with pod group preemption: message. (#139218, @Argh4k) [SIG Scheduling]
• Functions and structs that take in authorizer.Authorizer might choose to accept only a smaller interface, authorizer.UnconditionalAuthorizer, in case only the receiver only needs to perform unconditional authorization requests and wants to signal this in the code for clarity. Any authorizer implementation must still implement the full authorizer.Authorizer interface. (#138801, @luxas) [SIG API Machinery, Auth, Node, Scheduling and Testing]
• Graduated WatchCacheInitializationPostStartHook to GA. (#139452, @serathius) [SIG API Machinery]
• Graduated the ConcurrentWatchObjectDecode feature gate to Beta, enabled by default. (#139679, @Jefftree) [SIG API Machinery and Etcd]
• Graduated the ManifestBasedAdmissionControlConfig feature gate to Beta and enabled it by default. (#140559, @BenTheElder) [SIG API Machinery]
• Graduated the NativeHistograms feature gate to Beta. (#140124, @richabanker) [SIG Architecture and Instrumentation]
• Graduated the RelaxedServiceNameValidation feature gate to GA. (#139282, @adrianmoisey) [SIG Apps and Network]
• Graduated the scheduler_plugin_execution_duration_seconds and scheduler_scheduling_algorithm_duration_seconds metrics from Alpha to Beta. (#138176, @abhay1999) [SIG Instrumentation, Scheduling and Testing]
• Improved node health checks by verifying lease staleness with a live GET before marking nodes unhealthy, avoiding false positives from stale cache. (#138698, @michaelasp) [SIG Apps, Auth and Node]
• Improved scheduling performance for required Pod affinity and anti-affinity with topologyKey: kubernetes.io/hostname, behind the InterPodAffinityHostnameFastPath feature gate. (#138198, @tetianakh) [SIG Apps, Node, Scheduling and Testing]
• Made it possible for authorizers to return conditional decisions in addition to unconditional (Allow/Deny/NoOpinion). (#137204, @luxas) [SIG API Machinery, Auth, Node, Scheduling and Testing]
• Optimized CEL admission policy evaluation by adopting a lazy zero-allocation reflection-based utility for object traversal, significantly reducing CPU usage and garbage collection overhead during request processing. (#138771, @lalitc375) [SIG API Machinery, Architecture, Auth, CLI, Cloud Provider, Cluster Lifecycle, Network, Node, Scheduling and Storage]
• Optimized kube-scheduler performance for Pods with PersistentVolumeClaim mounts by processing only delta counts between scheduling cycles. (#139238, @yue9944882) [SIG Scheduling and Testing]
• Preserved data in the DRA-related Pod status fields resourceClaimStatuses, extendedResourceClaimStatus, and nodeAllocatableResourceClaimStatuses when handling Pod status updates that omit those fields. This prevents updates from older clients from unsetting these DRA fields, which could leave Pods permanently stuck in Terminating. (#139876, @ashishpatel26) [SIG API Machinery, Auth, Node, Scheduling and Testing]
• Promoted serviceaccount_legacy_tokens_total, serviceaccount_stale_tokens_total, and serviceaccount_valid_tokens_total to Beta. (#137072, @tico88612) [SIG Auth, Instrumentation and Testing]
• Promoted support for kubectl get -o kyaml to Stable. (#140076, @soltysh) [SIG CLI]
• Promoted the AllowUnsafeMalformedObjectDeletion feature gate to Beta, enabled by default. List errors for objects that cannot be read from storage include the first underlying cause in the error message. (#140785, @ibihim) [SIG API Machinery and Etcd]
• Promoted the DRAResourceClaimDeviceStatus feature gate to GA. (#137546, @LionelJouin) [SIG Node and Testing]
• Promoted the InPlacePodVerticalScalingInitContainers feature gate to GA. (#140728, @natasha41575) [SIG Apps and Node]
• Promoted the PLEGOnDemandRelist feature gate to GA. (#140805, @tallclair) [SIG Node]
• Promoted the PodAndContainerStatsFromCRI feature gate to Beta, disabled by default. (#140081, @dgrisonnet) [SIG Node]
• Promoted the PodLevelResourceManagers feature gate to Beta, enabled by default. (#140573, @KevinTMtz) [SIG Node and Testing]
• Promoted the PodReadyToStartContainers condition to GA. (#140488, @Priyankasaggu11929) [SIG Node and Testing]
• Promoted the kube-apiserver webhook metrics apiserver_webhooks_x509_missing_san_total and apiserver_webhooks_x509_insecure_sha1_total to Beta and updated their documentation. (#136894, @LoginovIlia) [SIG API Machinery, Instrumentation and Testing]
• Promoted the kubelet PodsAPI gRPC service to Beta. (#140286, @briansonnenberg) [SIG Instrumentation, Node and Testing]
• Reduced the scope of EventedPLEG to only accelerate detection of unexpected container terminations. (#139262, @HirazawaUi) [SIG Node]
• Retried binding API calls in kube-scheduler when a transient error occurs. (#138855, @antekjb) [SIG Scheduling]
• Set the KUBECTL_PATH environment variable to the path of the kubectl binary when it executes a plugin. (#138694, @brianpursley) [SIG CLI and Testing]
• Set the nominatedNodeName field on pods from a PodGroup after a successful PodGroup preemption, consistent with single-pod preemption. (#138967, @antekjb) [SIG Scheduling and Testing]
• The MaxUnavailableStatefulSet feature is enabled by default. (#139466, @soltysh) [SIG Apps]
• Updated the apiserver_storage_list_* metrics to include storage and index labels to distinguish the storage backend and lookup path used to serve LIST requests. (#139125, @yedou37) [SIG API Machinery, Etcd and Instrumentation]
• Updated the scheduler to avoid redundant preemption attempts during PodGroup scheduling when terminating victim pods are already present on the nominated nodes. (#138710, @mm4tt) [SIG Scheduling]
• Added three different subtypes of the cluster event resource "Pod": "AssignedPod", "UnscheduledPod", "TargetPod". Plugins can and are expected to register to specific pod events for better performance. (#135905, @iomarsayed) [SIG Node, Scheduling, Storage and Testing]
• Updated CoreDNS to v1.14.3. (#138536, @yashsingh74) [SIG Cloud Provider and Cluster Lifecycle]
• Updated CoreDNS to v1.14.4. (#139735, @yashsingh74) [SIG Cloud Provider and Cluster Lifecycle]
• Updated CoreDNS to v1.14.6. (#140497, @yashsingh74) [SIG Cloud Provider and Cluster Lifecycle]
• Updated PodGroup scheduling to requeue remaining unscheduled Pods directly to the active queue (rather than backoff queue) after successful PodGroup scheduling, preserving their original timestamps so they retain scheduling precedence unless a higher priority entity is added. (#139613, @iomarsayed) [SIG Scheduling and Testing]
• Updated PodGroup scheduling to skip PostFilter plugins for Pods in a PodGroup cycle. Instead, PodGroupPostFilter runs only when the entire PodGroup is unschedulable. (#140412, @Argh4k) [SIG Scheduling and Testing]
• Updated PodGroup status to include the pod group preemption found a placement for podgroup, preempting victims message when workload-aware preemption finds a placement. (#140311, @Argh4k) [SIG Scheduling and Testing]
• Updated admission webhooks to skip auth/authz virtual resources, such as tokenreviews and subjectaccessreviews, that ValidatingAdmissionPolicy and MutatingAdmissionPolicy already exclude. Added the ExcludeAdmissionWebhookVirtualResources feature gate in Beta, enabled by default, with an opt-out option to restore the previous behavior. (#140019, @BenTheElder) [SIG API Machinery and Testing]
• Updated cri-tools to v1.36.0. (#138613, @saschagrunert) [SIG Cloud Provider and Node]
• Updated default preemption to include the message preemption: found a potential placement for pod on node , preempting victims in the FailedScheduling event and PodScheduled condition when it finds a potential Node for a Pod. (#140180, @Argh4k) [SIG Scheduling]
• Updated the Go version used to build Kubernetes to v1.26.3. (#138864, @BenTheElder) [SIG Release]
• Updated the Go version used to build Kubernetes to v1.26.4. (#139479, @BenTheElder) [SIG Release]
• Updated the Go version used to build Kubernetes to v1.26.4. (#139584, @cpanato) [SIG Release]
• Updated the Go version used to build Kubernetes to v1.26.5. (#140576, @palnabarun) [SIG Release]
• Updated the Go version used to build Kubernetes to v1.26.6. (#141363, @BenTheElder) [SIG Release]

Contributors, the CHANGELOG-1.37.md has been bootstrapped with v1.37.0 release notes and you may edit now as needed.

Published by your Kubernetes Release Managers.

Original source

Kubernetes Community

Kubernetes v1.36.4 has been built and pushed using Golang version 1.26.5.

The release notes have been updated in CHANGELOG-1.36.md, with a pointer to them on GitHub :

v1.36.4

Downloads for v1.36.4

Source Code

filename sha512 hash

kubernetes.tar.gz 12b83d1d64b12436b22504746fdb736652670741ac1569c6bd909e81c3346ff66ab4299f9d599f52fa6e2eb8d5a324a31acafd5901426eb37839afeccd96a7ad

kubernetes-src.tar.gz 90eaf6cc534a5ea29400d53fa5b6008eb8a116263e6f078f62ce945a883a5416c2f2e8775f880bd4d58d61ee9ced5b11282fa89329eda34a29abe0e0c2d08f63

Client Binaries

filename sha512 hash

kubernetes-client-darwin-amd64.tar.gz dd8a95ecb2ed96c735d7bb25ff3b4427e9911e58c5b75b789e3299d6404e7ac21aa8c3839f91b4ddf076390fe28a6431b30aacc16e9dfc3f79a5897a0461ae32

kubernetes-client-darwin-arm64.tar.gz 119a982dcf18a17e1622427add79b8daf9d6985f98fc4d5cb726f02a7afb67f434a5255d6900840520085e655ee99ad157f067b1085cfcc54d159152c765f063

kubernetes-client-linux-386.tar.gz 0e7e8e1189fec5a81af0cc414258736ad6239e21afeb822b8d8fe98977d24ca7ffbebe68fa68ba96dabd0fd57720e88615b25f46e8222426c42d3e2396a5dc16

kubernetes-client-linux-amd64.tar.gz 611ab5bb43640f4eb37302faddde2dbb900e0b79d3e96286acd86a6935b55ad766b7083aa1dcf0e7806da43de5055b1f7056454aaff33d6fabf11cf5c7b41f7d

kubernetes-client-linux-arm.tar.gz 9d2ac3765b8efa99551633e107995ed5aa23685adccfb5fe3c33ce71fe2d63403dc7b6e919ac9d1e0c8c1ec218552ba35c9915a79ba7462d853dfadde18d0b3c

kubernetes-client-linux-arm64.tar.gz 583f43c85ab8fb884dad26c1650085b073148c390f618dbe89f9d0780a0cf503374c42a8281d377fb13c1b9c9ad677ede6e4e924b09cea2b5482ecf3af300467

kubernetes-client-linux-ppc64le.tar.gz e63eb42789bb8f4ac896b795f60fb1b9c43637d350aa07693ef58dad16323a192b72a25049760c6b89b2f3013f99af0763ea8c301f9dc849a047da3eaf7d45cd

kubernetes-client-linux-s390x.tar.gz ccb6b5b2960e8c4ed1f84566546b1b5777892e793191a9c815a157e247e44971ac06b63668bad2b2d145b7d99756e28f2f3022f56747fe80f8e080051cc7208f

kubernetes-client-windows-386.tar.gz 006f858ba1dd10b92ec4ee427977b730c27b195ebe8264a7189036886e3ae79af247fc655fee93894e77bcd0aabd5fd9f1a6e8cdf3a9ec2f9a9231e9b28539d2

kubernetes-client-windows-amd64.tar.gz aa91b5f34e724ea51214911e1001566126e9982334d60a9365abbc83e29413f97c115d374df2c9b781ff94975ba03ea2a3a837ea8e40c48c9374355d8c59e155

kubernetes-client-windows-arm64.tar.gz 784da35c222144693400b17fa72b4250319fb2d3764e5c32f2125954e337d62b0c916c5f04bc195d9a1bfde2683d820a0bc8b6fb9710236129b2e08bc13e46ab

Server Binaries

filename sha512 hash

kubernetes-server-linux-amd64.tar.gz 8f6e609a6aa2d33e87f321ab7528c590749d7c190724dfcf4b0b754b4dba140b7dc503b83ec4658fe37b190f2bdda730db79d14af54a146e34cd428de38bff3c

kubernetes-server-linux-arm64.tar.gz 5551e99b78f049668215e2a3f48901cfa170313a03255d45bd801c8d3d00a19c89d6e17858d9f9bbbe4017772cb97b3abd00a10683e97959bda8f972fd8b3bde

kubernetes-server-linux-ppc64le.tar.gz 7f603bce736f389424cce01238293b182bc8edf2eefb48a9ec5430b56e110c2c63fa93ec95aa6b376b67d0f1cf6f3ef4cbdc54d5128aa8f4be6be0e3a8dd796d

kubernetes-server-linux-s390x.tar.gz 056f4336947cb0185deec761a28f2dabfde96f7264a2a277832b0320483c0ab8f83eebb39d92be8593ddfb87f640b343ccc167c1c96f8aa3eb1a592edd78565b

Node Binaries

filename sha512 hash

kubernetes-node-linux-amd64.tar.gz d23e03c1ff4ba88b3e09ab6761fdcfd100936f529a9c0493064090736bd6b1fa4c04a023b30fc196aea52ce5cd067dc9511016b128e3f121936b5c3ce2fb4163

kubernetes-node-linux-arm64.tar.gz 649ec8ab0cc28186f0fa8ef6cfc1bd31d66600ccba112d5d1c015ccd782a0ed317d3974bf695432ad1afc91ef138bfd110d490312cfefde7ba7ef9f82a17b36d

kubernetes-node-linux-ppc64le.tar.gz 4b052833857f4334f60728679c1aeba903020de5a5b70bd923ae246b31f5b2fa0dbe14fc04775ff149f859c1b398a25ad68bbe40d0e6268f1a964d228a41dc44

kubernetes-node-linux-s390x.tar.gz dc737a8298e29a579a9b06c2b0917d612baea72270163c5621e4d5411abb9b4ecaa1a03834c724b4a06abe08f78fd24cd62a513dba19b1244cb2bcd2fcb521b0

kubernetes-node-windows-amd64.tar.gz dd7bc39fb370f259bb27ad1de670dc9284220611d17678ce7b4f8f8faadc6047980be72b6466b52618b2808754c25bc74ca3dd4f889d6c49e88537b6816fbad9

Container Images

All container images are available as manifest lists and support the described architectures. It is also possible to pull a specific architecture directly by adding the "-$ARCH" suffix to the container image name.

name architectures

registry.k8s.io/conformance:v1.36.4 amd64, arm64, ppc64le, s390x

registry.k8s.io/kube-apiserver:v1.36.4 amd64, arm64, ppc64le, s390x

registry.k8s.io/kube-controller-manager:v1.36.4 amd64, arm64, ppc64le, s390x

registry.k8s.io/kube-proxy:v1.36.4 amd64, arm64, ppc64le, s390x

registry.k8s.io/kube-scheduler:v1.36.4 amd64, arm64, ppc64le, s390x

registry.k8s.io/kubectl:v1.36.4 amd64, arm64, ppc64le, s390x

Changelog since v1.36.3

Changes by Kind

Bug or Regression

• Client-go: FakeCustomStore implements the Bookmark and LastStoreSyncResourceVersion methods added to the cache.Store interface in v0.36, so it satisfies cache.Store again (#141001, @alancaldelas) [SIG API Machinery]

• Fixed a DRA scheduling bug where the structured allocator keyed its shared-counter caches by pool name alone, so two drivers publishing a pool with the same name on a node could use each other's counter definitions and incorrectly accept or reject device allocations in the second driver's pool. (#140504, @thc1006) [SIG Node]

• Fixed a race condition in preemption, where a preemptor pod could get stuck in unschedulable state. NONE NONE (#140685, @iomarsayed) [SIG Scheduling and Testing]

• Kubelet/DRA: fixed a bug where retrying a partially-failed PrepareResources caused duplicate CDI device IDs to be passed to the CRI runtime, which could cause container start to fail. (#140955, @bart0sh) [SIG Node]

• Update golang.org/x/text and golang.org/x/net dependencies to include security updates (#141226, @liggitt) [SIG API Machinery, Architecture, Auth, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation, Network, Node, Scheduling, Security and Storage]

Dependencies

Added

Nothing has changed.

Changed

• golang.org/x/crypto: v0.47.0 → v0.53.0

• golang.org/x/mod: v0.32.0 → v0.37.0

• golang.org/x/net: v0.49.0 → v0.56.0

• golang.org/x/sync: v0.19.0 → v0.21.0

• golang.org/x/sys: v0.40.0 → v0.46.0

• golang.org/x/telemetry: bd525da → 59b4966

• golang.org/x/term: v0.39.0 → v0.44.0

• golang.org/x/text: v0.33.0 → v0.39.0

• golang.org/x/tools: v0.41.0 → v0.47.0

Removed

Nothing has changed.

Contributors, the CHANGELOG-1.36.md has been bootstrapped with v1.36.4 release notes and you may edit now as needed.

Published by your Kubernetes Release Managers.

Original source

Kubernetes Community,
Kubernetes v1.35.8 has been built and pushed using Golang version 1.26.5.
The release notes have been updated in CHANGELOG-1.35.md, with a pointer to them on GitHub:

v1.35.8
Downloads for v1.35.8
Source Code

Client Binaries

Server Binaries

Node Binaries

Container Images
All container images are available as manifest lists and support the described architectures. It is also possible to pull a specific architecture directly by adding the "-$ARCH" suffix to the container image name.

Changelog since v1.35.7
Changes by Kind
Dependency
• Kubernetes 1.35 is now built with Go 1.26 (#140920, @kmala) [SIG Release and Testing]
Bug or Regression
• Fixed a race condition in preemption, where a preemptor pod could get stuck in unschedulable state. (#140637, @iomarsayed) [SIG Scheduling and Testing]
• Update golang.org/x/text and golang.org/x/net dependencies to include security updates (#141225, @liggitt) [SIG API Machinery, Architecture, Auth, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation, Network, Node, Scheduling, Security and Storage]
Dependencies
Added
Nothing has changed.
Changed
• golang.org/x/crypto: v0.45.0 → v0.53.0
• golang.org/x/mod: v0.29.0 → v0.37.0
• golang.org/x/net: v0.47.0 → v0.56.0
• golang.org/x/sync: v0.18.0 → v0.21.0
• golang.org/x/sys: v0.38.0 → v0.46.0
• golang.org/x/telemetry: 078029d → 59b4966
• golang.org/x/term: v0.37.0 → v0.44.0
• golang.org/x/text: v0.31.0 → v0.39.0
• golang.org/x/tools: v0.38.0 → v0.47.0
Removed
Nothing has changed.

Contributors, the CHANGELOG-1.35.md has been bootstrapped with v1.35.8 release notes and you may edit now as needed.

Published by your Kubernetes Release Managers.

Original source

Kubernetes Community,

Kubernetes v1.34.11 has been built and pushed using Golang version 1.26.5.

The release notes have been updated in CHANGELOG-1.34.md, with a pointer to them on GitHub:

v1.34.11

Downloads for v1.34.11

Source Code

Client Binaries

Server Binaries

Node Binaries

Container Images

All container images are available as manifest lists and support the described architectures. It is also possible to pull a specific architecture directly by adding the "-$ARCH" suffix to the container image name.

Changelog since v1.34.10

Changes by Kind

Dependency

• Kubernetes 1.34 is now built with Go 1.26 (#140919, @kmala) [SIG API Machinery, Node, Release and Testing]

Bug or Regression

• Update golang.org/x/text and golang.org/x/net dependencies to include security updates (#141224, @liggitt) [SIG API Machinery, Architecture, Auth, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation, Network, Node, Scheduling, Security and Storage]

Dependencies

Added

• golang.org/x/tools/go/expect: v0.1.1-deprecated
• golang.org/x/tools/go/packages/packagestest: v0.1.1-deprecated

Changed

• golang.org/x/crypto: v0.36.0 → v0.53.0
• golang.org/x/mod: v0.21.0 → v0.37.0
• golang.org/x/net: v0.38.0 → v0.56.0
• golang.org/x/sync: v0.12.0 → v0.21.0
• golang.org/x/sys: v0.31.0 → v0.46.0
• golang.org/x/telemetry: bda5523 → 59b4966
• golang.org/x/term: v0.30.0 → v0.44.0
• golang.org/x/text: v0.23.0 → v0.39.0
• golang.org/x/tools: v0.26.0 → v0.47.0

Removed

Nothing has changed.

Contributors, the CHANGELOG-1.34.md has been bootstrapped with v1.34.11 release notes and you may edit now as needed.

Published by your Kubernetes Release Managers.

Original source

Kubernetes Community,

Kubernetes v1.37.0-rc.1 has been built and pushed using Golang version 1.26.5.

The release notes have been updated in CHANGELOG-1.37.md, with a pointer to them on GitHub:

v1.37.0-rc.1

Downloads for v1.37.0-rc.1

Source Code filename sha512 hash kubernetes.tar.gz f8837cef9d21d5ab3260cfb0f8ec3b2d856bcebcbbcde2de45547ef4f34ad999371a13cd4f1356c8154f01ccee644c762f25286690cab64b9ca099c2fd055ccf kubernetes-src.tar.gz 31ed9c00dd56f4e3d11a8a6ad8eb09c7224eef594d9bca4d5a7e8efde612cafeaeb185734f92d0278e5cb39cc16ecef3b1811857c4d23f0bd10d1fa0e25850a6 Client Binaries filename sha512 hash kubernetes-client-darwin-amd64.tar.gz d48f90d0c20cddd70627939a74cf0d68e6abb6a77186a1d754ec18c46224859d3213f3e1a89ecece4d5854df2102307d04a4e47694c79e7f63a223982949933b kubernetes-client-darwin-arm64.tar.gz 97d6ce20c2210c19645eb5757f9ce98d02be82eb4bb9148d6595baaf912cef68ac4610b0478d0feeaa373fc954ab41a39e8e096cf597282c026ac24a2cc3d7d0 kubernetes-client-linux-386.tar.gz b5db728a32e4c8033b078b4aadf407b674c5be71dac2d600f58c756d6cfb872c08933dafbeab80559304c757b36447d12c33311a589c4ab9d62e69ad3f665641 kubernetes-client-linux-amd64.tar.gz c8049c73c840dd4c4c1be9df5b7e6cb2ad44c83fbf196f14138f0a33729fa75bf045d072b2a1d6ab4a942515b1a51cdda75e4d1e6842f5675d70253479607aec kubernetes-client-linux-arm.tar.gz 52fd26bd88d43fc6b2db8369acdc4ee05222189a820015bfa3c134e00df742e1d38880f074b9b3b6a7e63cf44d77987376dbbbfaf37e3535ae649014806c04bf kubernetes-client-linux-arm64.tar.gz 17cad3988014cdfee6ded133d7ed8e67b7b9ee04abd765f49d7252355d55916a11502be1c179d2826e120ff4881633c62e22074564047d1965ae3e969ab373c9 kubernetes-client-linux-ppc64le.tar.gz 0103bbe685d395caff22ab01bac99fd3576d412bc902a30bbbe88211a5d932d1b499da9be5d2fc9f307e9140bf768a4b791cd880340003839df7cd85026f58a2 kubernetes-client-linux-s390x.tar.gz a12541887ae73ef59fcb0ea389d0ee48d8ff227d38ed86cc74f187ccabf2316eb5cf75bbbd32f2f996766b116b45289695340a0ec0566b533e187bb47bd9426c kubernetes-client-windows-386.tar.gz 0d1a09003128788d2a3903aed400a572037f54c749ead805ab8539a84b9f7d7c694009ec7a79d5438bbe809ab67e183880b2a1477c88d8b02cc244bad0c1edea kubernetes-client-windows-amd64.tar.gz 534fbed232ac50f08e7db88478160f9395f1c563b64b2627edf13e8ce3d771140cac66de65b1405a7f5b08a414f8d8dbb0a40d2873174e70b3ae3b99bf212528 kubernetes-client-windows-arm64.tar.gz a5be672a45d7f9d8f32f81d23ee1a62e637b8f7f4942d3ca655b5fa6ae0c6a079f3bc883b7354e4765469a196575b0cbb447e71a0898b8c3f43f3f7e0cb2baf4 Server Binaries filename sha512 hash kubernetes-server-linux-amd64.tar.gz 5ad130a94876651560e47d2788e0b0bc5920c6cd33136398548537bad822a69801217141e2258058ce254a3eeaea5c62d3b013c85d651619871dda0efa1f592b kubernetes-server-linux-arm64.tar.gz 25b0cd3910e38e441053766a1f1cbbfcc8703e676bc59dcff2511f67f3610e2ccfe3518efe34c59413159c15d4afef42e464f552e358a4601e751478eb8f9da2 kubernetes-server-linux-ppc64le.tar.gz b1ce2ec1a116dc4afeea421ddb432a7d3110b71f799011ac71f8755ed637bb79c77362b3cc96890a08a212dcb20a002fed22c7507d4c5fc2a4a01efd63e8b729 kubernetes-server-linux-s390x.tar.gz 45380c00def80c29c95bfa71812671779ca2d5961a2c88cd1c1f3c0479749e2c413ed52e45a67422ab420ef3c6f623eab906c83c7d0b8d4355c6d36b7e1609ca Node Binaries filename sha512 hash kubernetes-node-linux-amd64.tar.gz c00d86a7f17a2ba98387f807c99659839a36a0f1423f4daeadde3793ee898502018270782c3d9378c858af365ed850ba294643faf79faffe48785d6148e02369 kubernetes-node-linux-arm64.tar.gz 66c6e2a2ec6a33fae491e90985969cecdc22bf9ea8e12fe1cf268e02badbdda2544b59c6436c88cd2ceff0964983cd81828c39805cb5a988a9f51735d45fe559 kubernetes-node-linux-ppc64le.tar.gz 5af32217dd92c641cb9995de8c617b6799f12c0f0dc8e1d4429ec7e03d71a213ee862803c777abb7a97fbb25506377859b91c2ab07e12c601bd07aae6369f34f kubernetes-node-linux-s390x.tar.gz 8c01507e7bda46538729013dc1878d18e2f77706067eab2dfb8300be50142a8b8b1bb6ce5dee66104e4987946a17d5d4e00f1d2351d891612c0ebb80d0554649 kubernetes-node-windows-amd64.tar.gz 9145c2b746b052e452b4c685bb6f736c5386f8edcc5f1366073e71d21b0d5cf29e7ddc51e018567ce51ad6a3348a2c4d52abcdef7654b2ce862735bfc071e5c6 Container Images

All container images are available as manifest lists and support the described architectures. It is also possible to pull a specific architecture directly by adding the "-$ARCH" suffix to the container image name.

name architectures registry.k8s.io/conformance:v1.37.0-rc.1 amd64, arm64, ppc64le, s390x registry.k8s.io/kube-apiserver:v1.37.0-rc.1 amd64, arm64, ppc64le, s390x registry.k8s.io/kube-controller-manager:v1.37.0-rc.1 amd64, arm64, ppc64le, s390x registry.k8s.io/kube-proxy:v1.37.0-rc.1 amd64, arm64, ppc64le, s390x registry.k8s.io/kube-scheduler:v1.37.0-rc.1 amd64, arm64, ppc64le, s390x registry.k8s.io/kubectl:v1.37.0-rc.1 amd64, arm64, ppc64le, s390x

Changelog since v1.37.0-rc.0

Dependencies

Added

Nothing has changed.

Changed

Nothing has changed.

Removed

Nothing has changed.

Contributors, the CHANGELOG-1.37.md has been bootstrapped with v1.37.0-rc.1 release notes and you may edit now as needed.

Published by your Kubernetes Release Managers.

Original source

Dear Kubernetes community,

The August Kubernetes patch releases are being delayed to Wednesday, August 19. We allowed additional time to work with the code-owners of important cherry-picks that met the time and scope criteria, but that were unfortunately impacted by recent GitHub disruptions and related automation failures.

Separately, we are aware of the Go updates released a few days ago. Rather than further delaying this week's releases, we will follow up with an additional patch release containing only the corresponding Go version updates.

Thank you for your understanding.

Kind regards,
Verónica López
on behalf of Kubernetes Release Managers

Original source