Kubernetes v1.37 has been released with 67 enhancements, 16 marked as stable and 23 moved to beta. The most notable change: HorizontalPodAutoscalers can now scale workloads down to zero pods by default. The kube-apiserver is also better protected against overload during startup.
The WatchCacheInitializationPostStartHook feature gate is stable and now enabled by default. This resolves a known issue in large clusters: during API server startup or recovery, all list and watch requests were fired off to etcd simultaneously. This could deplete the API’s Priority and Fairness capacity and, in the worst case, bring down the control plane.
The kube-apiserver now delegates a limited number of requests and rejects the rest with an HTTP 429. For administrators, this does mean some work: custom controllers and operators must properly handle that 429 response, respecting the Retry-After header and exponential backoff. This work falls under KEP #4568 from SIG API Machinery.
Scaling to zero is finally the default
HPAScaleToZero is entering Beta and is enabled by default for the first time. The feature gate has been in place since v1.16. By setting `spec.minReplicas` to 0, a Horizontal Pod Autoscaler scales an idle workload back down completely and restarts it as soon as demand returns.
This works only with object and external metrics. CPU and memory metrics are not supported, simply because they require active pods. Event-driven applications, such as queue-based workers, batch jobs, and GPU workloads, benefit from this.
To avoid confusion, Kubernetes introduces a new status condition. If the HPA sets a workload to zero, it is assigned the condition `ScaledToZero` with a value of `True`. When scaling up, this changes to `False` with the reason `NotScaledToZero`. This distinguishes automatically scaled-out workloads from manually scaled-out workloads.
Admission control from disk
Manifest-based admission control configuration has also reached Beta. Admission webhooks and CEL policies can be loaded from disk via the `staticManifestsDir` field in `AdmissionConfiguration`, rather than residing exclusively in the Kubernetes API. These policies take effect immediately upon API server startup and continue to function even if etcd is unreachable.
Finally, Alpha support is coming for pod-level checkpointing and restoration via the new CRI-RPCs CheckpointPod and RestorePod.