Kubernetes 1.38 enters beta this week with 86 enhancements and fifteen removed feature gates
The first Kubernetes 1.38 beta ships on November 4, 2026, ahead of code freeze on November 17 and general availability on December 16. Fifteen feature gates are removed and five are locked on: audit your flags and manifests now, because a component handed an unknown gate refuses to start.
November 4, 2026. Kubernetes 1.38 ships its first beta, v1.38.0-beta.0. November 17, 2026. Code freeze locks the feature list. December 16, 2026. The stable 1.38.0 release is expected, with 86 enhancements tracked. Why it matters: this cycle is first and foremost a cleanup release — fifteen feature gates disappear and five are locked on — and the first beta is the moment teams should verify their flags, not the day the stable release lands.
Fifteen feature gates removed, five locked on
The classic upgrade trap fires before the cluster even restarts. A Kubernetes component handed a gate name it no longer recognizes through --feature-gates refuses to start. In other words: the first thing to do is not to read about the new features — it is to review your own flags.
The fifteen gates removed in 1.38 cover features that graduated to stable or were abandoned. They include DynamicResourceAllocation, NFTablesProxyMode, PodSchedulingReadiness, SeparateTaintEvictionController, MatchLabelKeysInPodAffinity, CustomResourceFieldSelectors, MultiCIDRServiceAllocator, KubeletTracing, ServiceAccountTokenPodNodeInfo, and WindowsHostNetwork. The changelog names nine of them; the other six surface when you diff the versioned_feature_list.yaml reference on master against v1.37.0.
On the other side, five gates are locked on: StrictIPCIDRValidation, DRADeviceTaints, DRADeviceTaintRules, EnvFiles, and HPAGeneration. The penalty is just as binary — setting a locked gate to false is a startup error. Both lists are handled the same way, with a simple grep over your config files and kubeadm manifests.
# Inventory of feature gates still used in the configuration
# (run BEFORE upgrading to 1.38):
grep -R "feature-gates" /etc/kubernetes/ 2>/dev/null
grep -R "featureGates" --include="*.yaml" --include="*.yml" .
# Any removed or locked gate must be dropped, or set to true.What graduates to beta
The most useful features are already visible in alpha in 1.37 and move to beta: they stay behind a gate, but the release is close.
A Recreate strategy for StatefulSets. A rollout that hits a pod stuck in ImagePullBackOff stops until a human deletes the pod by hand. With updateStrategy.type: Recreate, the controller deletes all the old pods, waits for termination, then creates the new revision — at the cost of downtime, but the PVCs are kept. It is the answer to the classic case where the template is fixed but the rollout cannot unblock.
Gang scheduling for Jobs. A Job will be able to carry spec.scheduling to request that all its pods be placed together — or none. The Job controller creates the Workload and PodGroup objects itself. Useful for distributed-training workloads, where placing three pods out of four is pointless. Test on a dedicated cluster, because the gate applies the behavior to every Job without an owner.
Stop signals in the pod spec. lifecycle.stopSignal lets you send SIGUSR1 or SIGQUIT at shutdown without rebuilding the image or writing a preStop hook. The API rejects the field unless spec.os.name is set, and an older runtime will accept it and then ignore it.
HTTP/2 and TLS gRPC probes. Two fields save you from opening a second port for health checks: protocol: HTTP2 on an httpGet probe sends cleartext HTTP/2, and mode: TLS on a grpc probe connects over TLS — without verifying the certificate. Reserved for cases where the health port is already encrypted.
Volume modes and file owners. emptyDir.mode gives you a proper /tmp with the right permissions without an init container running chmod, and defaultUser on Secret, ConfigMap, downward API, and projected volumes writes the files under the UID you choose — handy for software that insists on owning its key file. Finally, defaultPodSysctls in the kubelet config applies namespaced sysctls to every new pod on the node, instead of copying them into every spec.
One caveat applies across the whole beta list: beta does not always mean on by default. The gRPC-TLS and Job KEPs both allow a beta that stays off, and as of early October most of these gates were still off by default on master. When 1.38 ships, check the actual default for each gate before assuming it is active — and for pod and Job fields, confirm your values survived the kubectl apply, because with the API server gate off they are silently dropped without an error.
The alphas worth watching from a distance
None of this was merged by early October, and the gates named below do not exist in any published build yet: do not add them to --feature-gates prematurely, an unknown gate stops the component.
Two entries deserve attention: pids in spec.resources to cap processes per pod without touching the node’s podPidsLimit, and pod-level ephemeral-storage to size local disk once for the whole pod. Next to them, a configurable syncPeriodSeconds per HPA — from 3 to 3,600 seconds — to reconcile one autoscaler faster than another, instead of the global 15-second flag. The rest is more exotic: seccomp profiles pulled from an OCI registry, per-container ulimits, or pods with no network at all (defaultNetwork: None).
What to check before the upgrade
Beyond the gates, three behavior changes break configurations quietly.
Strict IP and CIDR validation becomes mandatory. StrictIPCIDRValidation is locked on and goes GA under KEP-4858: IPv4 addresses with leading zeros (010.0.0.1) and IPv4-mapped IPv6 addresses (::ffff:1.2.3.4) are rejected. Existing objects keep working through ratcheting validation, but templates that create new resources in those forms will fail.
LimitRanger now compares quantities exactly. A request of 0.9999 against a minimum of 1 used to round onto the bound and pass; it is now rejected. This applies to pod and PVC creation, and to their updates and resizes.
Finally, kube-apiserver now returns a JSON Status object for unknown paths under /apis/, instead of the plain-text 404 page not found body — any client matching on that string needs a look. And on dependencies: Go 1.27.1, default etcd 3.7.1, CoreDNS 1.14.7, and a kubelet now built without CGO by default.
The timing is not accidental: KubeCon + CloudNativeCon North America runs in Salt Lake City from November 9 to 12, and code freeze follows on November 17. If you are attending, that is the week to ask a SIG lead directly whether a given KEP will actually make the release.
Verdict
If you run a production cluster, change nothing dramatic this week: the November 4 beta is the signal to audit — grep for feature-gates, check templates that create leading-zero IP addresses, review quantities passed to LimitRanger. If you maintain extensions or plugins, read the list of fifteen removed and five locked gates before any test: that is where startups fail first. If you are curious about the new features, stand up a test cluster for Job gang scheduling and the StatefulSet Recreate strategy — those are the two features that change daily life most for teams running distributed training or stateful rollouts. The November 17 code freeze is coming fast: anything not merged that day slips to 1.39.