Kubernetes 1.37, known as Garhwal, was released as version 1.37.0 on August 26, 2026. The release is listed as actively supported, with maintenance mode scheduled to begin on August 28, 2027, and end of life listed for October 28, 2027, according to the official Kubernetes 1.37 release page.
Among the documented changes are three Beta capabilities that are enabled by default in the relevant components: Horizontal Pod Autoscaler (HPA) support for scaling workloads to zero, manifest-based admission control, and the etcd RangeStream read path. Each addresses a different operational concern, but each also has requirements that platform teams should review before using it in production.
What changed in Kubernetes 1.37
The capabilities covered by the official documentation are not a complete list of every Kubernetes 1.37 enhancement. However, they represent practical changes for teams managing autoscaling, admission policies, and clusters with large API-server collection reads.
HPA can scale workloads to zero
HPA scale-to-zero is Beta in Kubernetes 1.37 and is enabled by default on the kube-apiserver and kube-controller-manager. An autoscaling/v2 HPA can set minReplicas: 0 when it uses a suitable object or external metric.
CPU, memory, and other resource-only metrics cannot provide the signal needed to scale a workload from zero, so they are not sufficient for this configuration. The documented example uses an external metric, with a queue-style signal and a maximum of 10 replicas.
The feature also adds a ScaledToZero status condition. This allows Kubernetes to distinguish an HPA-controlled zero-replica state from a workload that was manually paused.
For developers and operators, the main benefit is the ability to remove the last idle Pod when demand disappears. That can reduce resource consumption for workloads driven by intermittent activity. It also introduces cold-start latency, and Kubernetes Services do not buffer requests while no Pods are ready. The external or object-metric pipeline must remain available while the workload has zero replicas.
Admission policies can be loaded from manifests
Manifest-based admission control is also Beta and enabled by default in Kubernetes 1.37. It allows admission webhooks and CEL-based admission policies to be loaded from static files on disk instead of being read from the Kubernetes API.
The feature is configured through staticManifestsDir fields in an AdmissionConfiguration file. The kube-apiserver receives that configuration through --admission-control-config-file. Supported manifest resources include ValidatingWebhookConfiguration, MutatingWebhookConfiguration, ValidatingAdmissionPolicy with its binding, and MutatingAdmissionPolicy with its binding, using the admissionregistration.k8s.io/v1 API version. The documented manifest names must end in .static.k8s.io.
Because these policies are available from local files, they can be active as the API server becomes ready and do not depend on the policies being retrieved from etcd. The configuration is not visible or changeable through the Kubernetes API. That can be useful for bootstrap and self-protection scenarios, but it creates a file-distribution responsibility for administrators.
In a highly available cluster, every kube-apiserver loads its own files. Operators must configure each API server consistently and distribute updates externally. The documentation describes a configuration-hash metric that can help detect drift between API-server instances.
etcd RangeStream reaches Beta
etcd RangeStream is Beta in Kubernetes 1.37 and is enabled by default through the EtcdRangeStream feature gate. It is intended to reduce peak memory use during large collection reads by streaming results in chunks rather than requiring the entire response to be buffered at once.
Streamed reads require Kubernetes 1.37 or later and etcd 3.7 or later. The API server checks for RangeStream support when it starts. If the etcd version is older or returns Unimplemented, the API server falls back to the older paginated Range path. Administrators can disable the feature with --feature-gates=EtcdRangeStream=false.
Teams can check whether streamed reads are being used through the etcd_request_duration_seconds_count metric with operation="listStream". This gives operators a way to verify behavior instead of assuming that the feature is active solely because the cluster runs Kubernetes 1.37.
Upgrade and rollback considerations
The new features have different compatibility boundaries, so enabling or using them should be coordinated with control-plane and data-store upgrades.
For HPA scale-to-zero, the official guidance says to wait during a version-skewed control-plane upgrade until both the kube-apiserver and kube-controller-manager support and enable the feature before creating HPAs with minReplicas: 0. Before disabling the feature or downgrading, affected HPAs should be changed to minReplicas: 1 or higher, and workloads currently at zero replicas should be scaled up.
Manifest-based admission control also requires downgrade preparation. Before moving to a version without the feature, administrators should remove the staticManifestsDir entries, recreate the manifest-based policies as API objects where possible, and restart the kube-apiserver. Leaving those fields configured can prevent an older API server from starting.
RangeStream has a less disruptive fallback path: when the API server cannot use the etcd capability, it uses the paginated Range implementation instead. Nevertheless, teams should verify the etcd version and inspect the documented metric when validating a rollout.
What developers and administrators should do
- Evaluate HPA signals before setting zero replicas. Use an object or external metric, not only CPU or memory. Confirm that the metric source remains available when the target workload has no Pods, and plan for cold-start behavior.
- Coordinate control-plane changes. During upgrades, wait until both the kube-apiserver and kube-controller-manager support HPA scale-to-zero before creating new HPAs with
minReplicas: 0. - Plan admission-manifest distribution. Configure every kube-apiserver in a highly available deployment, keep the files consistent, and monitor the configuration-hash metric for drift.
- Document downgrade steps. Remove manifest admission directories before downgrading to an unsupported version, and convert policies to API objects where possible.
- Check etcd compatibility. Use etcd 3.7 or later for RangeStream, then inspect
etcd_request_duration_seconds_count{operation="listStream"}to confirm streamed reads.
Availability and scope
Kubernetes 1.37.0 is available and the release series is actively supported. HPA scale-to-zero, manifest-based admission control, and etcd RangeStream are documented as Beta features enabled by default, subject to their component, version, and configuration requirements.
The documented capabilities above should not be treated as a complete accounting of Kubernetes 1.37. The available release materials used here do not establish a full list of all reported enhancements, a complete release-wide maturity matrix, or a comprehensive security assessment. Teams should consult the official changelog and release documentation when planning a broader upgrade review.
