← Back to Latest

Kubernetes v1.37 'Garhwal' Ships Rootless Beta, etcd Streaming, and 67 Enhancements

Kubernetes v1.37, code-named Garhwal, shipped on August 26, 2026, with 67 enhancements across the control plane, node components, and storage — including the promotion of rootless mode to Beta, a new server-streaming etcd RPC, and the graduation of native histogram metrics to Beta. The release caps a 15-week cycle that drew contributions from 212 companies and 1,754 individuals.

The headline feature for many operators is KubeletInUserNamespace — the long-running experiment that lets all node components run as a non-root user on the host, using Linux user namespaces. The feature gate is now enabled by default, though enabling the gate alone does not put the kubelet into a user namespace. Nothing changes for existing rootful clusters. What changes is the path to running a fully unprivileged node stack.

Rootless Mode Hits Beta

The work started as an experiment in 2018 and was merged into Kubernetes v1.22 in 2021 as an alpha feature (KEP-2033). Five years later, it has reached Beta in v1.37 — a timeline that reflects both the complexity of making rootless nodes production-ready and the care the community has taken with the design.

With KubeletInUserNamespace enabled, all node components — kubelet, CRI and OCI runtimes, CNI plugins, and kube-proxy — can run as a non-root user on the host. The feature relies on Linux user namespaces, which have been steadily improving in the kernel. Linux v6.3 (2023) added support for idmapped tmpfs. Kubernetes v1.33 (2025) enabled the UserNamespacesSupport feature gate by default, allowing user-namespaced pods to be created without extra configuration. containerd v2.1 (2025) added support for writable cgroups — a prerequisite for running unprivileged containers that need to manage their own resource limits.

A cluster administrator can use the runningInUserNamespace property to set node labels or taints — for example, to avoid scheduling workloads that need real root privileges, such as some CNI plugin installers, onto rootless nodes. The feature is not yet GA; depending on feedback and adoption, the Kubernetes project plans to graduate it to General Availability in a future release.

Rootless Kubernetes has been a goal of the community since 2018. Getting it to Beta in v1.37 is a milestone — but the work is not finished. The path from Beta to GA will depend on real-world adoption, operational feedback, and the continued maturation of the underlying kernel primitives.

etcd RangeStream and the Streaming Control Plane

v1.37 introduces EtcdRangeStream support at Beta, behind the EtcdRangeStream feature gate on kube-apiserver only, on by default. The new feature adds a server-streaming RangeStream RPC that reuses the existing RangeRequest but returns chunks instead of one buffered blob.

The server paginates internally with adaptive chunk sizing — each chunk's target size adjusts based on MaxRequestBytes and the value sizes observed so far. It pins a single MVCC revision so the merged stream stays snapshot-consistent, and derives the total key count from a running tally it builds while streaming, rather than a separate index walk.

kube-apiserver is the primary consumer. It now decodes each chunk into synthetic created events inline as they arrive, instead of assembling the full list in memory first — the same treatment applied to direct GetList calls when WatchList is disabled. For large-scale clusters where the control plane's memory footprint under load has been a constraint, streaming range responses are a meaningful change.

Native Histogram Metrics Graduate to Beta

The NativeHistograms feature graduates to Beta in v1.37. The feature exposes metric data in both the classic and native formats when scraping, allowing existing users to migrate at their own pace. For teams that have been waiting on the sidelines while the histogram format evolved, Beta is the point where it becomes safe to evaluate in production.

Storage, Deprecations, and the Full Enhancement Count

The 67 enhancements in v1.37 break down as 16 Stable graduations, 23 Beta graduations, 27 Alpha entries, and 1 deprecation or removal. The full list of Stable graduations is available in the release notes; the highlights above cover the features the release team chose to call out.

Among the Alpha entries is support for writable cgroups for unprivileged containers (KEP-5714), which builds on containerd's v2.1 writable cgroup support and is a prerequisite for more workloads to run on rootless nodes. Another Alpha entry allows specifying whether to unshare cgroup namespaces — a finer-grained control that matters for node-level isolation.

The 2026 Kubernetes Contribution Landscape

The v1.37 release cycle ran for 15 weeks, from May 18 to August 26, 2026. Contributions reached a maximum of 212 different companies and 1,754 individuals — numbers that have been climbing with each release and reflect the project's continued growth as the de facto standard for container orchestration.

The community events calendar is dense through the fall. KubeCon + CloudNativeCon China takes place September 7–9 in Shanghai. KubeCon + CloudNativeCon North America follows November 9–12 in Salt Lake City. Kubernetes Community Days (KCD) events span Seoul (September 1), Mountain View (September 1), Washington DC (September 15), Ahmedabad (September 19), São Paulo (September 26), and Sofia (September 29).

A release team deep-dive on v1.37 highlights is scheduled for Wednesday, September 23 at 4:00 PM UTC, hosted through the CNCF Online Programs site.

What to Watch

Rootless Beta is the change most likely to affect operators planning their next cluster upgrade. The feature is enabled by default but inert until a node is explicitly placed into a user namespace — which means v1.37 is a safe upgrade for existing rootful clusters, and a starting point for teams that want to test rootless in staging. The GA graduation timeline is not set, but the Beta label means the feature is stable enough for evaluation.

For teams running large etcd-backed clusters, the EtcdRangeStream Beta is worth understanding even if you do not enable it directly. The streaming RPC changes how the apiserver consumes range responses from etcd, and the memory profile of the control plane under heavy list load may shift as a result.

And for anyone tracking the rootless journey from its 2018 origins to today: v1.37 is not the finish line. It is the point where rootless Kubernetes moves from experimental to evaluable, with a clear path toward GA that depends on the community's willingness to run it in production.

Related Articles