GKE 1.37 Now Available, Deprecates Identity Service for GKE

Removed in 1.37 Identity Service for GKE is no longer supported starting in GKE 1.37: Creating new clusters or upgrading existing clusters to GKE version 1.37 or later with Identity Service for GKE enabled is blocked. For external OIDC authentication, please migrate to Workforce Identity Federation . For more information, refer to Authenticate with third-party identity providers .

New features in 1.37 The PodCertificateRequest and ClusterTrustBundle APIs are generally available and promoted to certificates.k8s.io/v1. DRA device metadata publishing is enabled with beta support (for use with DRA drivers which include this feature). HorizontalPodAutoscaler enables beta support for scaling to zero . StatefulSet maxUnavailable support is now enabled.

Other changes in 1.37 Starting with GKE version 1.37.0-gke.2100000, newly created clusters default to using control plane node creation, which improves cluster security by having the control plane manage node registration instead of kubelet self-registration. Existing clusters are not affected. If your workloads require legacy kubelet self-registration, you can opt out during cluster creation by specifying --node-creation-mode=KUBELET . For more information, see Disable control plane node creation . In version 1.37 and later, newly created node pools use an improved formula to calculate the de

Kubernetes 1.37 is available Kubernetes 1.37 is now available in the Rapid channel. For more information about the content of Kubernetes 1.37, read the Kubernetes 1.37 Release Notes and Kubernetes 1.37 Release Blog .