Kubernetes v1.37: The Deprecations Platform Teams Need Now

If any node in your cluster is still running cgroup v1, Kubernetes v1.37 is the release where that finally becomes your problem, not a future one.

What Happened

The Kubernetes project’s pre-release post for v1.37 lays out three concrete changes platform teams should plan around now, not at release day.

cgroup v1 phase-out reaches its sharpest point yet. This deprecation has been running since v1.35, but as of v1.37 the kubelet fails to initialize on cgroup v1 nodes by default — it now takes an explicit override (failCgroupV1: false in the KubeletConfiguration) just to boot on a node that hasn’t migrated. That override is explicitly framed as temporary; features like In-Place Pod Resizing and Tiered Memory Protection require cgroup v2 outright and simply won’t work on the old cgroup hierarchy.

kube-proxy IPVS mode is now formally deprecated under KEP-5495, with a published sunset path: logging warnings now, disabled by default in v1.40, removed entirely by v1.43.

Static Pods lose the ability to reference Secrets or ConfigMaps. The PreventStaticPodAPIReferences feature gate is being removed, which means configMapRef and secretRef no longer work in Static Pod manifests at all — not deprecated, gone. kubectl run --filename/-f is also being deprecated, since a pod generated by kubectl run is meant to come purely from CLI arguments.

Why It Matters

The cgroup v1 change is the one with real operational teeth. Kubernetes has been signaling this migration for two release cycles, and v1.37 is where “signaling” becomes “your kubelet won’t start.” Any cluster still carrying cgroup v1 nodes — often older base images or unmanaged edge nodes that don’t get touched during routine upgrades — needs an inventory pass before this lands, not a scramble after an upgrade fails in production.

The Static Pod change is smaller in blast radius but sharper for the teams it hits: anyone using Static Pods as a bootstrapping mechanism for control-plane components and referencing a Secret or ConfigMap from one will find that pattern simply doesn’t work anymore. That’s a design pattern that needs to change, not a warning that can be ignored for a release or two.

Source: Kubernetes Blog

Content created with AI assistance and reviewed for accuracy.