--- title: Kubernetes 1.37: what's new across autoscaling, storage... description: Kubernetes 1.37 ("Garhwal") ships 67 enhancements. The Metrics API, which powers kubectl top, HPA, and VPA, reaches general availability. Rootless Kubelet... canonical: https://daily.dev/posts/kubernetes-1-37-what-s-new-across-autoscaling-storage-security-and-resource-management-qytxzk99k twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Kubernetes 1.37: what's new across autoscaling, storage security, and resource management | daily.dev og:description: Kubernetes 1.37 ("Garhwal") ships 67 enhancements. The Metrics API, which powers kubectl top, HPA, and VPA, reaches general availability. Rootless Kubelet... og:url: https://daily.dev/posts/kubernetes-1-37-what-s-new-across-autoscaling-storage-security-and-resource-management-qytxzk99k og:image: https://api.daily.dev/og/posts/qYTXzK99K.png og:image:alt: Kubernetes 1.37: what's new across autoscaling, storage security, and resource management og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Kubernetes 1.37: what's new across autoscaling, storage security, and resource management **[Collections](https://daily.dev/sources/collections)** · 4 min read · 8 upvotes · 1 comments ## Summary Kubernetes 1.37 ("Garhwal") ships 67 enhancements. The Metrics API, which powers kubectl top, HPA, and VPA, reaches general availability. Rootless Kubelet moves to beta, letting kubelet run as a non-root user via Linux user namespaces to limit container escape blast radius. Pod-level Topology, CPU, and Memory Managers graduate to beta, enabling hybrid allocation where primary containers get exclusive NUMA-aligned cores while sidecars share an isolated pool; PodResources gRPC API gains cpu_ids and memory fields. Alpha storage security features add bindMountOptions (noexec, nosuid, nodev flags on volumes) and configurable emptyDir permission modes including the sticky bit, both requiring new feature gates and Linux nodes. Other alpha work includes workload-aware scheduler preemption, pod-level checkpoint/restore, and a Recreate rollout strategy for StatefulSets. Kubernetes 1.38 is expected in December 2026. ## Content Kubernetes 1.37, codenamed "Garhwal," ships 67 enhancements spanning security hardening, storage improvements, autoscaling, and resource management. Here's a rundown of the notable changes. ## Metrics API reaches general availability The Metrics API is now stable, which means `kubectl top`, the Horizontal Pod Autoscaler, and the Vertical Pod Autoscaler all have a formally supported foundation. This has been in progress for a while, so GA is mostly a formality at this point - but it matters for anyone running production autoscaling. ## Rootless Kubelet hits beta Kubelet can now run as a non-root user via Linux user namespaces. This reduces the blast radius of a container escape: if something breaks out of a container, it's no longer running as root on the node. It's still beta, so not on by default, but worth testing if node security is a concern. Also reaching stable in this release: resilient watchcache initialization and pod certificates for mTLS. ## Pod-level resource managers, now in beta The Topology Manager, CPU Manager, and Memory Manager can now use pod-level resource declarations directly when making hardware placement decisions. Previously, each container was handled independently, which made it awkward to run a latency-sensitive primary container alongside lightweight sidecars - the sidecars would consume dedicated physical cores even if they didn't need them. With this feature, you can set up hybrid allocation: primary containers get exclusive NUMA-aligned cores, while sidecars share a pod-isolated pool. The feature is beta but still disabled by default, so you'll need to opt in. The PodResources gRPC API also gets new top-level `cpu_ids` and `memory` fields, so monitoring tools and device plugins can query pod-level exclusive assignments without double-counting across containers. ## PVC idle tracking, enabled by default The `PersistentVolumeClaimUnusedSinceTime` feature gate graduates to beta and is now on by default. The PVC protection controller adds an `Unused` condition to every PersistentVolumeClaim, recording exactly when it stopped being referenced by any non-terminated pod. This makes it straightforward to find storage you're paying for but not using - something that previously required custom scripts or external monitoring. A query for PVCs unused for more than 30 days is now a one-liner. One nuance: pending pods (even unschedulable ones) count as usage, but terminated pods don't. The project plans to push this to GA in a future release. ## Storage security hardening (alpha) Two new alpha features address gaps that have been on the security radar for a while. **Bind mount options** let you apply `noexec`, `nosuid`, and `nodev` flags to any volume type via a new `bindMountOptions` field. Without this, a compromised process with write access to a volume could drop and execute arbitrary binaries. Both the API server and kubelet need the `VolumeBindMountOptions` feature gate enabled. **EmptyDir permission modes** let you set exact directory permissions on emptyDir volumes, including the sticky bit (`01777`). The previous hardcoded default of `0777` meant any container sharing an emptyDir could delete files created by other containers. Requires the `EmptyDirVolumeMode` feature gate. Both features default to prior behavior when unset and only apply on Linux nodes. ## Alpha additions worth watching - **Workload-aware scheduler preemption** - the scheduler can make smarter decisions about which pods to evict when resources are tight - **Pod-level checkpoint/restore** - early support for saving and restoring pod state - **Recreate strategy for StatefulSet rollouts** - an alternative to the rolling update approach ## GKE 1.37: native scale-to-zero On the managed side, Google Kubernetes Engine 1.37 adds native scale-to-zero built on the HPA with `minReplicas: 0`. This removes the need for KEDA or third-party metric adapters - the HPA can now read external signals directly from Cloud Monitoring, Pub/Sub, Managed Service for Prometheus, or load balancer metrics via a new `AutoscalingMetric` CRD. The practical problem with scale-to-zero has always been cold start latency: spinning up a new node takes 60-90 seconds, which is often unacceptable. GKE addresses this with capacity buffers - pooled warm compute (active and standby) that lets pods scale from zero without waiting for node provisioning. The result is near-instant startup while the workload costs nothing when idle. Google also plans to add scheduled, recurring scale-to-zero windows, which would let development environments spin down overnight automatically. --- Kubernetes 1.38 is expected in December 2026. ## Questions this post answers ### What does Rootless Kubelet do in Kubernetes 1.37? Rootless Kubelet, moving to beta in Kubernetes 1.37, lets kubelet run as a non-root user via Linux user namespaces. If a container escape occurs, the attacker lands as an unprivileged user on the host instead of root, reducing the impact of the escape. It remains disabled by default at beta and requires explicit testing before production use. _Teams hardening cluster security can track kubelet feature maturity like this via daily.dev._ ### How do I prevent one container from deleting another container's files in a shared emptyDir volume? Kubernetes 1.37 adds an alpha EmptyDirVolumeMode feature gate that lets you set exact directory permissions on emptyDir volumes, including the sticky bit (01777). Previously, emptyDir defaulted to hardcoded 0777 permissions, meaning any container sharing the volume could delete files created by another container in the same pod; the sticky bit closes that gap. _Developers securing shared volumes can follow storage hardening changes like this on daily.dev._ ### What is the bindMountOptions field in Kubernetes 1.37 used for? The bindMountOptions field, added as an alpha feature in Kubernetes 1.37, lets you apply noexec, nosuid, and nodev flags to any volume type. Without it, a compromised process with write access to a volume could drop and execute arbitrary binaries; setting noexec closes that attack path. It requires enabling the VolumeBindMountOptions feature gate on the API server and kubelet, and only applies on Linux nodes. _Platform teams evaluating volume security options can follow releases like this on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@pdfopsdev** · 0 upvotes > Pod-level topology manager splitting primaries onto exclusive NUMA cores while sidecars share a pool is the actual fix here. before this, sidecars were eating into a primary's exclusive cpuset and defeating the point of static CPU manager policy. ## Similar posts on daily.dev - [Kubernetes v1.36 Promotes Stability, Compatibility & Reproducibility](https://daily.dev/posts/kubernetes-v1-36-promotes-stability-compatibility-reproducibility-q5x4goaqb) · Cloud Native Now · 14 upvotes · 0 comments - [New Features We Find Exciting in the Kubernetes 1.36 Release](https://daily.dev/posts/new-features-we-find-exciting-in-the-kubernetes-1-36-release-1b2qr04hy) · MetalBear · 10 upvotes · 2 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#containers](https://daily.dev/tags/containers) [View this post on daily.dev](https://daily.dev/posts/kubernetes-1-37-what-s-new-across-autoscaling-storage-security-and-resource-management-qytxzk99k) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Kubernetes 1.37: what's new across autoscaling, storage security, and resource management","url":"https://daily.dev/posts/kubernetes-1-37-what-s-new-across-autoscaling-storage-security-and-resource-management-qytxzk99k","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/kubernetes-1-37-what-s-new-across-autoscaling-storage-security-and-resource-management-qytxzk99k"},"datePublished":"2026-09-21T01:08:21.096Z","dateModified":"2026-09-23T16:14:45.491Z","description":"Kubernetes 1.37 (\"Garhwal\") ships 67 enhancements. The Metrics API, which powers kubectl top, HPA, and VPA, reaches general availability. Rootless Kubelet...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6daf55c35469bc805e0b4a67c8ead15d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6daf55c35469bc805e0b4a67c8ead15d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/kubernetes-1-37-what-s-new-across-autoscaling-storage-security-and-resource-management-qytxzk99k","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":8},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"kubernetes,containers","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Kubernetes 1.37: what's new across autoscaling, storage security, and resource management"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/kubernetes-1-37-what-s-new-across-autoscaling-storage-security-and-resource-management-qytxzk99k","comment":[{"@type":"Comment","text":"Pod-level topology manager splitting primaries onto exclusive NUMA cores while sidecars share a pool is the actual fix here. before this, sidecars were eating into a primary’s exclusive cpuset and defeating the point of static CPU manager policy.","datePublished":"2026-09-22T18:17:44.974Z","url":"https://daily.dev/posts/qYTXzK99K#c-rdSesVX07","author":{"@type":"Person","name":"PDFops","url":"https://daily.dev/pdfopsdev","image":"https://media.daily.dev/image/upload/s---8isRBKc--/f_auto/v1782922291/avatars/avatar_orjMeK8QKaaVZwGq7ScPz?_a=BAMAMicg0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/kubernetes-1-37-what-s-new-across-autoscaling-storage-security-and-resource-management-qytxzk99k#faq","mainEntity":[{"@type":"Question","name":"What does Rootless Kubelet do in Kubernetes 1.37?","acceptedAnswer":{"@type":"Answer","text":"Rootless Kubelet, moving to beta in Kubernetes 1.37, lets kubelet run as a non-root user via Linux user namespaces. If a container escape occurs, the attacker lands as an unprivileged user on the host instead of root, reducing the impact of the escape. It remains disabled by default at beta and requires explicit testing before production use. Teams hardening cluster security can track kubelet feature maturity like this via daily.dev."}},{"@type":"Question","name":"How do I prevent one container from deleting another container's files in a shared emptyDir volume?","acceptedAnswer":{"@type":"Answer","text":"Kubernetes 1.37 adds an alpha EmptyDirVolumeMode feature gate that lets you set exact directory permissions on emptyDir volumes, including the sticky bit (01777). Previously, emptyDir defaulted to hardcoded 0777 permissions, meaning any container sharing the volume could delete files created by another container in the same pod; the sticky bit closes that gap. Developers securing shared volumes can follow storage hardening changes like this on daily.dev."}},{"@type":"Question","name":"What is the bindMountOptions field in Kubernetes 1.37 used for?","acceptedAnswer":{"@type":"Answer","text":"The bindMountOptions field, added as an alpha feature in Kubernetes 1.37, lets you apply noexec, nosuid, and nodev flags to any volume type. Without it, a compromised process with write access to a volume could drop and execute arbitrary binaries; setting noexec closes that attack path. It requires enabling the VolumeBindMountOptions feature gate on the API server and kubelet, and only applies on Linux nodes. Platform teams evaluating volume security options can follow releases like this on daily.dev."}}]} ```