From Kubernetes Blog · 27 stories
Strategic Frameworks and Systems Vital for Successful AI Integration in Enterprises
AI's integration in enterprises is moving beyond model development to focus on creating robust systems for execution and governance. This shift highlights the importance of developing adaptable frameworks to support AI's role across various functions such as finance, HR, and operations. It reflects a broader industry trend where the focus is on building the necessary infrastructure to ensure AI's ongoing, safe, and productive incorporation into real-world workflows, addressing the current challenges and limitations.
Kubernetes v1.37 Promotes KubeletInUserNamespace (Rootless Mode) to Beta
Kubernetes v1.37 has promoted the KubeletInUserNamespace feature gate to beta, allowing all node components to run as a non-root user within a Linux user namespace. This advancement significantly enhances security by confining potential damage from container-breakout vulnerabilities to a non-root user's account, reducing the risk of full host compromise.
Kubernetes v1.37 Releases Dynamic Resource Allocation (DRA) Updates
Kubernetes v1.37 introduces several updates to Dynamic Resource Allocation (DRA), including the graduation of DRA Extended Resource support to General Availability. These changes allow for more flexible and gradual adoption of DRA by cluster operators and provide enhanced device management capabilities.
Kubernetes v1.37 Enables Workload Scaling to Zero with HorizontalPodAutoscaler
Kubernetes v1.37 introduces Beta API support for HorizontalPodAutoscaler (HPA) to scale workloads down to zero replicas, a feature now enabled by default. This allows for cost savings by removing idle Pods, particularly for queue consumers and batch processors, but introduces a cold-start delay when scaling back up.
Kubernetes v1.37 Introduces etcd RangeStream to Reduce Memory for Large List Reads
Kubernetes v1.37 graduates etcd RangeStream to beta, which, when paired with etcd v3.7, reduces and stabilizes memory consumption in the API server and etcd during large list reads. This improvement addresses out-of-memory issues that could occur when processing numerous or large objects, such as Pods, by streaming data in chunks rather than assembling full pages in memory.
Kubernetes v1.37 Enables Storage Version Migration by Default
Kubernetes v1.37 has promoted Storage Version Migration (SVM) to General Availability, enabling it by default in all clusters. This feature automates the process of updating stored API resources to their latest storage versions, addressing issues with CRD version deprecation and encryption key rotation. The built-in StorageVersionMigration API and controller eliminate the need for manual scripts or external tools for these operations.
Kubernetes v1.37 Introduces Pod Certificates and Cluster Trust Bundles for Identity
Kubernetes v1.37 has reached General Availability (GA) for Pod Certificates and Cluster Trust Bundles, integrating X.509 certificate issuance for TLS and mTLS directly into the core system. This new identity mechanism addresses the security limitations of service account JWTs, which are bearer tokens vulnerable to compromise if stolen.
Kubernetes v1.37 Promotes Metrics API to Stable (v1)
Kubernetes v1.37 has promoted the metrics.k8s.io API to stable (v1), providing CPU and memory usage for nodes and Pods. This graduation ensures stability guarantees for the API, which is used by tools like kubectl top and resource-metrics-based autoscaling.
Kubernetes v1.37 "Garhwal" Released with 67 Enhancements, Including 16 Stable Features
Kubernetes v1.37, codenamed "Garhwal," has been released, introducing 67 enhancements, with 16 graduating to stable, 23 to beta, and 27 entering alpha. This update signifies continued development and refinement of the Kubernetes orchestration platform, impacting users and developers relying on its features for container management.
Gateway API v1.6.0 Graduates TCPRoute and UDPRoute to Standard, Expands Layer 4 Routing
Kubernetes Gateway API v1.6.0 has been released, promoting TCPRoute and UDPRoute to standard stability for raw Layer 4 TCP and UDP traffic routing. This update expands the API's capabilities beyond HTTP and TLS, providing a portable way to manage non-HTTP/TLS workloads like databases and IoT telemetry within Kubernetes.
Kubernetes v1.37 Deprecates kubectl run --filename, Fixes Static Pod API References, and Phases Out kube-proxy IPVS Mode
Kubernetes v1.37 will deprecate the `--filename` flag for `kubectl run`, fix a bug allowing static pods to reference API resources, and begin phasing out `kube-proxy` IPVS mode. These changes aim to improve consistency, security, and align with modern Linux cgroup standards.
Headlamp Plugin Updates Enhance Kubernetes Workload Management
The Headlamp software has released new plugins for Knative, Cluster API, and Kubeflow. These plugins improve management of serverless, cluster lifecycle, and AI/ML workloads on Kubernetes. This development simplifies workload monitoring and debugging within a unified interface, benefiting developers and operators.
etcd v3.7.0 Released with RangeStream and Performance Enhancements
The etcd project released version 3.7.0, featuring the new RangeStream for better handling large result sets. This release eliminates the legacy v2 store dependency and includes various performance improvements. It matters as etcd is crucial for Kubernetes and other applications, enhancing their efficiency.
Kubernetes v1.36 Enhances Resource Management with New Features
Kubernetes v1.36 introduces several advancements, including beta in-place vertical scaling for pod-level resources, alpha pod-level resource managers, and GA Pressure Stall Information metrics. These updates aim to improve resource efficiency and management for complex and performance-sensitive workloads, providing more flexibility and insights into system operations.
SIG Storage Advances Kubernetes Storage Capabilities
SIG Storage, a Kubernetes Special Interest Group, focuses on persistent data and volume management. Recent discussions highlight its efforts to enhance storage solutions for AI workloads and the ongoing development of the Container Storage Interface (CSI).
Kubernetes to Correct CVE Records for Unfixed Vulnerabilities in 2026
The Kubernetes project will correct inaccuracies in CVE records for older unfixed vulnerabilities on June 1, 2026. This change aims to improve transparency and ensure that vulnerability scanners can better identify risks that currently go undetected due to erroneous fixed version tags.
Kubernetes v1.36 Introduces New Metric for Route Sync in Cloud Controller Manager
Kubernetes v1.36 adds the alpha metric route_controller_route_sync_total to the Cloud Controller Manager. This enables operators to track route synchronization activities, particularly under the new watch-based reconciliation feature introduced in v1.35, enhancing efficiency by reducing unnecessary API calls.
Kubernetes v1.36 Moves Mixed Version Proxy to Beta with Default Enablement
Kubernetes v1.36 has promoted the Mixed Version Proxy (MVP) to Beta, enabling it by default. The MVP enhances cluster upgrades by routing requests for unsupported resources to capable API servers, mitigating errors like 404 Not Found during API version changes.
Kubernetes v1.36 Deprecates Service ExternalIPs Field
Kubernetes v1.36 officially deprecates the .spec.externalIPs field for Services due to security vulnerabilities, particularly CVE-2020-8554. The Kubernetes project has provided alternative approaches for load balancing in non-cloud environments, encouraging users to adopt these safer practices.
Kubernetes v1.36 Features General Availability for Volume Group Snapshots
Kubernetes v1.36 has moved volume group snapshots to General Availability, enhancing snapshot management for multiple volumes. This allows users to create crash-consistent snapshots from a set of volumes, improving data recovery processes for complex applications.
Kubernetes v1.36 Introduces Server-Side Sharded List and Watch Feature
Kubernetes v1.36 has introduced an alpha feature called server-side sharded list and watch, which aims to improve scalability for controllers managing high-cardinality resources. This feature allows the API server to filter events before they reach each controller replica, significantly reducing resource overhead by ensuring that replicas only receive data relevant to them.
Kubernetes v1.36: Declarative Validation Achieves General Availability
Kubernetes v1.36 has moved Declarative Validation for native types to General Availability, enhancing API reliability and predictability. This transition replaces extensive handwritten validation code with a maintainable framework, addressing past technical debt and consistency issues.
Kubernetes v1.36 Introduces Immutable Admission Policies Feature
Kubernetes v1.36 introduces an alpha feature for manifest-based admission control that allows admission policies to load from disk at startup, preventing deletion during critical phases. This update addresses the limitations of existing admission control practices, particularly during cluster bootstrap and recovery scenarios.
Kubernetes Dashboard Archived in Favor of New Interface Headlamp
The Kubernetes Dashboard project has been archived to make way for Headlamp, a new interface offering enhanced functionalities including multi-cluster visibility and plugins. This replaces the traditional in-cluster Dashboard with an adaptable client application suitable for modern Kubernetes environments.
Guide on Building a Custom Metrics Exporter for Kubernetes
A guide details the steps to create a custom metrics exporter for Kubernetes, allowing for the collection of external application metrics beyond CPU and memory. This approach enables better scaling decisions and integration with Prometheus and HorizontalPodAutoscaler.
KYAML: A Stricter YAML Dialect for Kubernetes Manifests
SIG CLI introduced KYAML, a stricter dialect of YAML, to standardize Kubernetes manifests by narrowing the acceptable YAML features. This approach aims to prevent common parsing issues and improve consistency without requiring new parsers.
Understanding controller-runtime Cache Mechanics in Kubernetes
This article explains how controller-runtime in Kubernetes uses a local in-memory cache for object reads, rather than directly querying the kube-apiserver. This design choice impacts read consistency, memory usage, and network traffic for Kubernetes controllers written in Go.