Kubernetes vs Semgrep

Kubernetes v1.37 (Garhwal) delivered 67 enhancements — 16 stable, 23 beta, 27 alpha — in one of the more architecturally significant releases in recent cycles. Dynamic Resource Allocation for GPU-class devices reaches GA, HPA scale-to-zero is enabled by default, and X.509 certificate issuance is now a first-class control plane feature. The release also closes long-open gaps: KYAML config format reaches stable, storage version migration hits GA, and the etcd memory problem on large list reads gets a streaming solution.

Kubernetes is building the native runtime for GPU and AI batch workloads, a segment it previously ceded to managed services and workaround tooling. DRA GA removes the device plugin indirection that was the only practical path for GPU scheduling. Pod Certificates GA replaces the JWT-only identity model with proof-of-possession credentials. The pattern across v1.35–v1.37 is consistent: promote the alpha experiments that the AI workload community has been waiting on, and lock in the security foundations that enterprise operators need before they'll run sensitive workloads on self-managed clusters.

DRA Consumable Capacity (fractional GPU slices, currently alpha) and the PreQueueingHint O(1) requeue fix will accelerate toward GA in v1.38, pushed by demand from AI batch workload operators running large GPU fleets. A SPIFFE Pod Certificate provider is the obvious next concrete step after the GA framework lands.