Kubernetes v1.37.1-1 Release Notes

Overview

Thalassa Cloud Kubernetes v1.37.1-1 ships Kubernetes v1.37.1 with containerd 2.3.5 and Cilium v1.20.2. This release updates the Thalassa Cloud Controller Manager to v0.15.1.

Security Fixes

• Kubernetes 1.37.1 includes the fix for CVE-2026-2270. A user with write access to StatefulSet and ControllerRevision objects could make the controller create a Pod in another namespace.
• containerd 2.3.5 includes CVE-2026-53495. The release also strips sensitive authentication headers when it fetches descriptor URLs. Read the containerd v2.3.5 release notes.

Kubernetes 1.37

v1.37.1-1 is the first v1.37.x release available on Thalassa Cloud. Read the Kubernetes v1.37 announcement for the full list of changes.

• The HorizontalPodAutoscaler can scale a workload to zero replicas when the workload uses object or external metrics. Set spec.minReplicas to 0. CPU and memory metrics do not support scale to zero.
• The metrics.k8s.io/v1 API is stable. v1beta1 remains available.
• kubectl get -o kyaml is stable.
• Memory QoS is beta and enabled. The default configuration does not set memory.high.
• Pod certificates and ClusterTrustBundles are stable.

Delete scheduling.k8s.io/v1alpha2 objects before you upgrade a cluster that stores them. Kubernetes 1.37 removes that API version.

SELinuxMount is stable and enabled. The change applies to nodes that enforce SELinux. Thalassa Cloud node images use Ubuntu.

Use v1.37.2-0 for the latest patch in this stream.

What’s New

Component updates

• Kubernetes 1.37.1
• containerd 2.3.5
• CNI Plugins 1.9.1
• crictl 1.37.0
• runc 1.5.1
• Cilium 1.20.2
• Thalassa Cloud Controller Manager 0.15.1
• Thalassa CSI Plugin 0.9.0
• Base OS Ubuntu 24.04

Thalassa Cloud Controller Manager 0.15.1

• Hardens egress rules on managed load balancer security groups
• Corrects a listener log message
• Allows ICMP on managed load balancer security groups (v0.15.0)
• Supports loadBalancerSourceRanges (v0.14.1)

See the v0.15.1 release notes.

Component Versions