Kubernetes 1.37 Deprecates IPVS in Favor of Nftables and Tightens Core Security

The Kubernetes project has unveiled key details for version 1.37, introducing 86 tracked enhancements alongside notable breaking changes and architectural deprecations. Upstream maintainers have formally deprecated IPVS mode within kube-proxy, beginning an official multi-release migration path toward nftables as the default packet-forwarding backend. Concurrently, static pods lose the capability to reference Secrets or ConfigMaps directly, and the kubelet now enforces cgroup v2 by refusing to initialize on legacy cgroup v1 host environments by default without explicit overrides. The release also stabilizes the core Metrics API (metrics.k8s.io) and enables SELinuxMount by default. This release represents a critical maintenance boundary for infrastructure and platform engineering teams. For years, organizations operating dense, high-throughput clusters relied on IPVS to curb CPU overhead compared to legacy iptables rules. With IPVS now placed on an official deprecation track toward eventual removal, operators running large-scale clusters must plan their network proxy migrations. Furthermore, eliminating Secret and ConfigMap resolution for static pods disrupts node-level bootstrapping scripts and custom host monitors that relied on direct API lookups, requiring teams to transition these auxiliary tools to standard DaemonSets or file-based secret delivery. These shifts reflect the continued maturation of cloud-native infrastructure. As Kubernetes cements its position as the baseline execution platform across enterprise container workloads, maintainers are actively shedding technical debt and aligning core components with contemporary Linux kernel standards. The dual transition toward nftables and universal cgroup v2 unifies cluster networking and resource management on modern OS capabilities. Rather than carrying the maintenance overhead of aging subsystems, the project is focusing its architectural core on stability and emerging workload demands, such as device-level Dynamic Resource Allocation. In practice, platform operators must execute thorough pre-upgrade audits across cluster configurations before adopting version 1.37. Infrastructure teams should inspect kube-proxy configuration maps across all clusters to identify IPVS flags and validate nftables performance in staging environments. Additionally, DevOps engineers must inventory all static pod manifests on worker nodes to remove references to API-driven ConfigMaps and Secrets before updating node kubelet binaries. Finally, node provisioning pipelines should be verified to guarantee that all base operating system images natively support cgroup v2.