Loading story…
The Cloud Native Computing Foundation released Kubernetes 1.37, codenamed Garhwal, with 67 enhancements focused on platform stability, security, and AI/ML workloads. The release promotes the Metrics API, resilient watch-cache initialization, and pod certificates to stable availability, while moving rootless Kubelet operation to beta, reducing the privilege requirements of node-level Kubernetes components.
Kubernetes 1.37 also introduces alpha support for pod checkpoint and restore, an effort supported by the Kubernetes Checkpoint/Restore Working Group, alongside workload-aware scheduler preemption and StatefulSet Recreate rollouts. The release includes 27 alpha features, 23 beta graduations, 16 stable graduations, and one deprecation or removal.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
Kubernetes 1.37 introduces alpha support for workload-aware scheduler preemption during in-place pod resizing, pod-level checkpoint and restore, and a StatefulSet Recreate rollout strategy. The checkpoint feature allows kubelet to save and restore pods, including running-container memory and process trees for debugging or security analysis.
The Cloud Native Computing Foundation announced Kubernetes 1.37, codenamed “Garhwal,” emphasizing stability, security, and AI/ML workload optimization. The release includes 67 enhancements, with the Metrics API, resilient watchcache initialization, and pod certificates reaching general availability or stable status, while rootless Kubelet advances to beta.
Kubernetes announced the formation of a Checkpoint/Restore Working Group.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kubernetes 1.37 advances several platform-security controls, including rootless kubelet operation, short-lived service-account credentials for image pulls, authenticated API-server-to-webhook communication, and hardened volume-mount controls. The release also prohibits static Pods from referencing Secrets or ConfigMaps, while exposing additional API-visible operational and resource-health data that could aid reconnaissance where API permissions are overly broad. The release stabilizes SELinux mount labeling for eligible volumes, completing work initiated under KEP 1710 to mount volumes with the correct SELinux label rather than recursively relabeling every file at container startup. Administrators should test shared-volume labeling scenarios, adopt short-lived credentials, restrict API access, and verify that security tooling supports nftables as kube-proxy warns iptables users ahead of nftables becoming the default in Kubernetes 1.40.
Aug 29, 2026
Kubernetes v1.37 promotes **Memory QoS** to beta and enables the `MemoryQoS` feature gate by default on kubelets. On Linux nodes using cgroup v2, the capability uses cgroup memory controls to influence kernel memory management for workloads, including controls such as `memory.high` and memory reservation mechanisms. The default `memoryThrottlingFactor` has changed from `0.9` to `null`, preventing upgrades from automatically applying `memory.high` throttling to existing workloads. Operators can explicitly enable throttling, configure node-wide tiered-memory reservations, or disable Memory QoS; Kubernetes cautions that TieredReservation applies to every pod on a node and that hard reservations may account for reclaimable page-cache memory.
Sep 14, 2026
Kubernetes v1.37 promotes **etcd RangeStream** to beta and enables the `EtcdRangeStream` feature gate by default. With etcd v3.7 or later, the kube-apiserver can consume large collection reads incrementally instead of requiring both etcd and the API server to retain an entire paginated response in memory. The streamed-read path reduces and stabilizes memory usage during large list operations, lowering the risk of out-of-memory failures in control planes managing extensive resource collections. Clusters using older etcd releases remain supported through the existing paginated Range request path; administrators can confirm RangeStream activity through the `listStream` etcd operation metric or disable it explicitly through the feature gate.
Sep 2, 2026