Unveiling K3s v1.37

Kubernetes v1.37 has officially arrived! This quarter, the K3s developer community and maintainers have focused heavily on making edge Kubernetes deployments even more seamless, reliable, and secure. We are thrilled to share some major milestones, from direct support for modern gateway standards to substantial under-the-hood optimization. 🥳

Key Features and Improvements ✨

First-Class Gateway API Integration 🌐

With the v1.37 release, K3s officially bundles the Kubernetes Gateway API CRDs out of the box. Instead of requiring administrators to manually apply upstream CRDs, Gateway API CRDs are now deployed as a pre-packaged system chart (gateway-api-crd). This means K3s users can immediately start designing expressive, role-oriented, and robust routing structures (like HTTPRoutes and Gateways) natively, without any additional bootstrapping overhead.

Upgraded Embedded Datastore: etcd 3.7 💾

For High Availability (HA) configurations, we have bumped our embedded datastore to the brand-new etcd v3.7 series (specifically targeting v3.7.1). This represents a major milestone, bringing a long-awaited RangeStream RPC feature that streams large query responses in chunks to drastically reduce peak memory usage. It also completes the removal of all legacy v2 store bootstrap code, optimizes concurrent watch operations on keys, and delivers critical built-in security patches against TLS handshake resource exhaustion and RBAC watch leaks.

Storage Expansion: New Kine Backends & improved SQL Performance 🚀

This release introduces support for Kine's brand-new T4 storage driver (t4://), an open-source key-value database built directly on S3-compatible object storage (like MinIO, Ceph, or GCS). Pointing Kine at an S3 bucket gives you a highly available, clustered control plane with zero Raft quorum complexity.

Kine also now supports the Memory storage driver (memory://), a stateless store that is perfect for CI or other ephemeral environments where there is no value in persisting the datastore to disk. This driver does not support HA servers.

Core SQL query performance has been optimized by up to 20% by reducing subqueries and making better use of indexes. Queries now use native range lookups (column >= x AND column < y or column = x) instead of LIKE expressions, and the number of hot-path object allocations has been reduced. The default connection pool settings have been tuned to prevent connection thrashing, and a client-side resolver cache has been added to reduce the overhead of repeated DNS lookups when dialing new connections.

ServiceLB Multi-Pools (Load Balancer Node Pools) 🏗️

ServiceLB, our built-in lightweight load balancer controller, now supports multiple isolated load-balancer pools. Utilizing node affinity, K3s can now restrict its ServiceLB DaemonSets to target specific subsets of nodes labeled with lbpool.svccontroller.k3s.cattle.io/<pool-name>=true or svccontroller.k3s.cattle.io/lbpool=<pool-name>. This is highly beneficial for edge deployments and multi-tenant clusters where you only want specific external-facing nodes to route incoming traffic.

Dynamic Helm Controller & Failure Policy Upgrades ⚙️

To give operators finer control over embedded deployments, we have added the --helm-controller-arg flag, letting you pass custom flags directly to the embedded helm-controller process (replacing the deprecated --helm-job-image flag). Additionally, we have updated our packaged Traefik charts to default to a retry failure policy instead of a full reinstall during upgrades. This provides a vastly safer upgrade path by attempting to reconcile failures incrementally, preventing destructive resource deletion and recreation cycles on minor upgrade conflicts. This builds on top of our upgrade to Helm V4, which now uses Server-Side Apply to track changes to managed resources.

Custom Client Kubeconfig Naming 📁

Managing multiple clusters locally just got much cleaner. Through the new --write-kubeconfig-name CLI flag (and corresponding K3S_KUBECONFIG_NAME environment variable), you can now configure the exact name of the contexts in the admin kubeconfig (/etc/rancher/k3s/k3s.yaml). This is a small but highly requested quality-of-life feature that makes multi-cluster orchestration, local development, and CI pipelines far simpler to organize.

Note that it is NOT recommended to copy or share the admin kubeconfig. Revoking the credentials baked into the admin kubeconfig requires a complete rotation of the cluster Certificate Authority.

Automated Repository Workflows 🤖

In a step toward collaborative automation, we have introduced a standard contract for Agentic Workflows (stored in .agents/AGENTS.md). This architecture defines structured, success-constrained guidelines for AI agents to assist with repetitive repo maintenance tasks—such as backporting Dependabot SHA pin updates—directly within our workflows.

---

Bug Fixes and Notable Changes 🛠️

Alongside new features, we have ironed out numerous bugs and applied several performance and security hardening updates:

• Security Enhancements: We have locked down file permissions to 0600 on all compressed etcd snapshot files to better observe defense-in-depth protection of access to cluster data via filesystem permissions; note that the default snapshot directory itself has always defaulted to 0700. Additionally, K3s now more consistently redacts confidential flags inside the node-args annotation to prevent leaking sensitive information in cluster metadata.

• Test Suite Modernization & Quality: Our entire testing framework was converted to run via the native Ginkgo CLI (ginkgo run). This replaces the older compiled test binary artifact storage and enables native test parallelization, quicker feedback loops, and highly accurate code coverage reporting. Over 2,000 lines of robust unit tests were also added, covering the loadbalancer utilities, flannel network setups, cri-dockerd, cluster encryption helpers, and client token utilities.

• Reliable Airgap Image Handling: We resolved a common frustration in airgap-managed clusters: the airgap registry will now reliably re-import pre-packaged container images whenever their file modification timestamp changes, even if the file size remains exactly identical.

• E2E Flake Reductions: Several improvements were introduced to E2E workflows, including a K3sCleanup helper to cleanly reset environment state between test server restarts, retrying Multus CRD registration until ready, and protecting rootless VM setups against transient apt cache issues.

For a full list of upstream changes in Kubernetes v1.37, check out the official Kubernetes v1.37 Release Notes.

Version bumps for key components 🚀

Apart from Kubernetes v1.37.x, we bumped versions for several key components. Here is the list with the latest versions:

Component	New Version
Kine	v0.17.0
Etcd	v3.7.1
Containerd	v2.3.4-k3s1
Flannel	v0.28.4
Metrics-server	v0.9.0
Traefik	v3.7.13
CoreDNS	v1.14.7
Helm-controller	v0.17.7
Local-path-provisioner	v0.0.37

Special Thanks to Our Contributors 🙏

We want to give a special shout-out to the incredible community contributors who are not part of our core maintainers list. Your work is invaluable to the project's success. Thank you to: @gear54rus, @kasefuchs, @rafaelbreno, @neal-turett, @AlexDemicev, @amaanulhaq-s, @chazapis, @dkarakasilis, @EranMarkus, @Eshaan-Lumba, @jorge-castro, @stephenfin, @tom-risse, @yurytsarev

We look forward to an even more productive future with all of you!

Join our Adopters list 💎

If K3s is making your life easier, the best way to say "thanks" is to add your company to our official Adopters list. It’s a tiny gesture that carries a lot of weight for the project's health and visibility within the CNCF ecosystem. We are currently working hard to get our 'status' inside the CNCF to progress and showing a large list of Adopters would help tremendously.

The task is easy: create a PR that adds your name in https://github.com/k3s-io/k3s/blob/main/ADOPTERS.md.

Thanks a lot!