Kubernetes 1.37: the hardening you did not ask for is the part you have to test

The mechanism behind the SELinux change decides whether it can hurt you. Kubernetes used to walk a PersistentVolume and relabel files recursively; with the `context` mount option, the security context is applied to the whole volume at mount time instead ^[5]. That is faster, and it also means a mount carries one label. Which is exactly the failure Sysdig names: Pods with different SELinux labels, or different privilege levels, sharing the same volume ^[7]. At stable, there is no gate to sit behind while you think about it, and the optimisation applies to all eligible volumes ^[6].

Look at which items in this release arrive switched on. The three net-new features detailed in the roundup are alpha with gates defaulting to false: TLS for gRPC probes ^[14], a permission `mode` for emptyDir volumes between 0000 and 01777 ^[3], and Pod-level checkpoint and restore ^[15]. All three cost nothing until somebody enables them ^[16]. The changes that need pre-upgrade testing are the ones without a switch: SELinuxMount at stable ^[6], and the static Pod fix whose `PreventStaticPodAPIReferences` gate has been deleted along with the bug ^[11].

Sysdig's 19 out of 67 enhancements works out to a little over a quarter of the release touching security in some way ^[17], though that count is generous by construction. It includes a block of enhancements whose only security property is that they publish more data: resource health status, DRA claim status, the metrics.k8s.io definition and Node Declared Features all land at stable, and Sysdig's own note is that the extra detail helps attackers understand your infrastructure too, so review who can read the API ^[12][13].

On how settled the alpha end of this is: the emptyDir stickyBit entry is listed with a feature gate named `FOO` ^[3]. Placeholder naming is a reasonable guide to how much of your attention that one has earned this cycle.

kube-proxy is the item with a real calendar. The nftables backend has been stable since 1.33, becomes the default in 1.40, and 1.37 starts warning anyone still defaulting to iptables ^[8] - three minor releases of notice ^[18]. The migration work is not the flag; it is that anything parsing iptables rules or config, detection tooling included, has to read nftables instead ^[10]. Anyone on ipvs has less room, since that mode has begun deprecation ^[9].

One gap worth flagging: authentication by default on webhooks is named in Sysdig's opening summary of the 19 changes ^[2], but it is not among the itemised entries in the published material ^[19]. Planning for that one means reading the KEP, not the roundup.