Kubernetes 1.37: Breaking Changes and Upgrade Checklist

Kubernetes 1.37 releases on August 26 — eight days from now. Three changes in this release will break production clusters that skip the pre-upgrade audit. Static pods can no longer reference Secrets or ConfigMaps, the escape hatch is gone, and SELinuxMount defaults on with a silent failure mode that will catch shared-volume setups off guard. Here is what to check before you upgrade.

The Three Breaking Changes

Static Pods Can No Longer Reference Secrets or ConfigMaps

Static pods were never designed to read API resources. They bypass the API server entirely, so referencing a configMapRef or secretRef inside a static pod manifest was always a bug — just one that worked. As of 1.37, the bug is fixed and the behavior is gone. More importantly, the PreventStaticPodAPIReferences feature gate that let you opt out of the restriction has been removed. There is no escape hatch anymore.

If you run control-plane components as static pods on bare-metal, or manage edge nodes with static pod configurations that pull from Secrets, audit now. The check is one command:

grep -r "configMapRef\|secretRef" /etc/kubernetes/manifests/

Any result means you have work to do before August 26. Embed the values directly in the manifest or use an init container with a host-path mounted credential file.

SELinuxMount Is Now On by Default — and Shared Volumes May Fail

The SELinuxMount feature gate reaches GA in 1.37 and is enabled by default. The upside: instead of recursively relabeling every file on a volume (slow, sometimes very slow on large filesystems), Kubernetes now mounts volumes with -o context=<label> via the CSI driver. The downside is a constraint that already existed in Linux but was previously hidden by the relabeling approach: a single mount point can only hold one SELinux context.

If two pods with different SELinux labels share a volume on the same node, one or both will fail to start after the upgrade. The CSI driver has to opt in by setting .spec.seLinuxMount: true in the CSIDriver object, so not every cluster is affected. But if you run OpenShift — where SELinux enforcing is the default and most CSI drivers already opt in — this is the change to audit first. The official SELinux volume label guide has the full migration details.

IPVS: Start Planning Your Exit Now

IPVS mode in kube-proxy is not going away in 1.37. What is new is that clusters running mode: ipvs will now see a deprecation warning on every kube-proxy startup. The removal timeline is v1.43, with a default-off change coming in v1.40 — roughly six release cycles, or about two years. The migration target is nftables, which has been stable in Kubernetes since 1.35. Check your current mode before the warning shows up as noise in your logs:

kubectl get configmap kube-proxy -n kube-system -o yaml | grep mode

What Is Finally Stable

After nine years in beta — longer than some production Kubernetes clusters have been running — the Metrics API (metrics.k8s.io) graduates to GA in 1.37. No behavior changes. What changes is the stability guarantee: the API is now versioned and will not change without a formal deprecation process. HPA and VPA behavior stays the same; you just now have a formal SLA backing the API they depend on.

Two more notable graduations: KYAML output (--output=kyaml) is now stable across all kubectl commands that accept --output. KYAML is a stricter YAML subset that eliminates silent type coercions — no more NO parsing as boolean false. And pod-level resources are stable, letting you set a total CPU and memory budget at the pod level that containers share. This matters for batch workloads and sidecar-heavy pods where per-container sizing is guesswork.

DRA device taints and tolerations also reach GA. The taint model that Kubernetes applies to nodes is now available for individual devices. A faulty GPU can be tainted NoSchedule or NoExecute without taking down the entire node — a significant operational improvement for teams running GPU inference at scale.

The Alpha to Watch: Partitionable GPUs

DRA partitionable devices (KEP-4815) continues its alpha progression in 1.37. The feature lets a single physical GPU be partitioned into smaller logical slices — think NVIDIA Multi-Instance GPU (MIG) — and allocated independently to multiple pods. An A100 that previously required one dedicated pod can now be split into three MIG instances serving three pods simultaneously. This is alpha and not production-ready, but watch for beta in the 1.38–1.39 window. If you run AI inference workloads, the Red Hat DRA guide is worth reading now to understand what is coming.

Your Pre-Upgrade Checklist for August 26

• Run grep -r "configMapRef\|secretRef" /etc/kubernetes/manifests/ and fix any hits before upgrading
• Check whether your CSI drivers have seLinuxMount: true in their CSIDriver objects
• If yes: audit pods sharing PVCs for different SELinux labels on the same node and separate them
• Run kubectl get configmap kube-proxy -n kube-system -o yaml | grep mode and note your kube-proxy mode
• If using IPVS: add nftables migration to your next quarterly roadmap
• Review the official v1.37 sneak peek for the full enhancement list
• If you run etcd 3.7+, consider enabling EtcdRangeStream on the API server for lower memory pressure during Watch Cache initialization

The stable GA features require no action — they are backward-compatible upgrades. The breaking changes are narrowly scoped but will catch clusters that skip the audit. Eight days is enough time to check and fix. Use them.