DevOps & SRE Weekly Digest — 2026-09-02

Table of Contents

The Week in One Paragraph

The headline this week is Kubernetes v1.37 “Garhwal” reaching GA on August 26 — 67 enhancements, HPA scale-to-zero now Beta and on by default, the metrics.k8s.io API finally Stable after ~9 years in Beta, and a formal deprecation timeline for kube-proxy IPVS mode. In the IaC layer, Terraform v1.16.0 went GA the same day (module-level import blocks, terraform_data store block) with v1.16.1 following on September 2 to fix early import and create_before_destroy bugs. On the security side, Grafana 13.2.1 patches CVE-2026-12704 and CVE-2026-14199, and Flux v2.9.5 hardens kubeconfig Secret handling across its controllers. OpenTelemetry Collector v0.160.0 shipped with HTTP keepalive config deprecations and a fix for an O(n²) batching hot path.

All items below were published between August 26 and September 2, 2026, and every claim links to a primary source.

🚨 Top Stories

1. Kubernetes v1.37 “Garhwal” GA — scale-to-zero Beta, metrics API Stable, IPVS deprecation

What happened: Kubernetes v1.37 was released on August 26, 2026, with 67 enhancements (16 Stable, 23 Beta, 27 Alpha, 1 deprecation/removal). Highlights from the official announcement:

• HPA scale to zero graduates to Beta and is enabled by default — for object/external metrics, HPAs can now scale workloads to spec.minReplicas: 0 and back up when demand returns.
• metrics.k8s.io API is Stable after nearly nine years in Beta; v1beta1 remains usable during the transition per the deprecation policy.
• Resilient watch cache initialization completed — the last gate (WatchCacheInitializationPostStartHook) is Stable and locked on; the API server now rejects excess requests with HTTP 429 instead of letting list/watch storms overload etcd during cache warmup.
• kube-proxy IPVS mode is formally deprecated — deprecation warning at startup in v1.37, disabled by default targeted for v1.40, removal targeted for v1.43 (KEP #5495).
• Static Pods can no longer reference Secrets or ConfigMaps — a long-standing bug is fixed and the PreventStaticPodAPIReferences opt-out gate is removed.
• Storage version migrator, Pod certificates + ClusterTrustBundles, KYAML (kubectl get -o kyaml), and several DRA features all graduated to Stable; gang scheduling graduates to Beta.

Why it matters: This is a heavy operational release. The watch-cache work directly reduces control-plane outage risk in large clusters — but it also means clients that don’t handle HTTP 429 + Retry-After will now see failures where they previously saw slowness. The IPVS deprecation sets a hard clock for anyone still running mode: ipvs. And the static-Pod restriction will break any node bootstrap flow that (incorrectly) relied on secretRef/configMapRef in static manifests.

Who is affected: Every cluster operator planning 1.37 upgrades; platform teams with custom controllers/operators that talk to the API server; anyone running kube-proxy in IPVS mode.

Recommended action: Check your kube-proxy mode now (kubectl -n kube-system get configmap kube-proxy -o jsonpath='{.data.config\.conf}' | grep 'mode:'), audit static Pod manifests for API references, verify your controllers handle 429s gracefully, and start validating 1.37 in non-prod. Managed-provider preview channels will follow in the coming weeks.

2. Terraform v1.16.0 GA — module-level import blocks land

What happened: Terraform v1.16.0 shipped August 26, 2026, promoting last week’s rc2 content to GA: import blocks are now supported inside modules (#38352), the terraform_data resource gains a store block that holds ephemeral and sensitive values across plan/apply, providers can use nested blocks as computed values, and planned private provider data is now preserved across plan and apply. Also notable: lifecycle blocks support destroy = false, terraform console accepts -scope=<module address>, and terraform graph can output Mermaid diagrams.

Why it matters: Module-level import blocks close a long-standing gap for platform teams codifying brownfield adoption — import logic can now ship inside shared modules instead of living only at the root. destroy = false gives a first-class guardrail against accidental resource deletion without prevent_destroy workarounds tied to module reusability limits.

Who is affected: All Terraform users; platform engineering teams maintaining wrapper modules most of all.

Recommended action: Read the upgrade note — bastion_host_key is now correctly applied by provisioners, so verify provisioner configs before upgrading. Then see Top Story #3: you probably want to skip straight to v1.16.1.

3. Terraform v1.16.1 — fast-follow fixes for import and lifecycle bugs

What happened: Terraform v1.16.1 shipped September 2, 2026, one week after 1.16.0, fixing early-adopter bugs: import blocks were ignored when multiple imports targeted different instances of a resource using for_each or count (#39068), a panic when import identity references sensitive values (#39013), incorrect create_before_destroy ordering in some change combinations (#39091), a state show panic, a Stacks lock-file validation fix, and a CLI hang after run-task failure with pending policy evaluations on HCP Terraform.

Why it matters: The two import fixes sit exactly on the feature that made 1.16.0 attractive to platform teams — adopting 1.16.0 for module-level imports without the patch risks silently skipped imports. The create_before_destroy ordering bug is a correctness issue in the core apply engine; that’s the kind of thing you want patched before it touches production state.

Recommended action: Treat v1.16.1 as the entry point for the 1.16 line. If you already deployed 1.16.0, prioritize the upgrade and re-run plans for any config that used multi-instance imports.

4. Grafana 13.2.1 — security fixes for CVE-2026-12704 and CVE-2026-14199

What happened: Grafana released 13.2.1 on September 2, 2026. The release notes list two security fixes — CVE-2026-12704 and CVE-2026-14199 — alongside bug fixes for dashboard adhoc/groupby variables on UI import, bundled plugin packaging, and a panel-editor resize regression. Same-day patches shipped for older supported minors: 13.1.5, 13.0.8, and 12.4.10.

Why it matters: Grafana instances are typically internet-adjacent (or at least broadly reachable inside an org) and hold credentials for every datasource you monitor. Two CVEs in one patch release warrants a prompt, scheduled upgrade rather than waiting for the next routine maintenance window.

Who is affected: Self-hosted Grafana on 13.2.0, 13.1.x ≤ 13.1.4, 13.0.x ≤ 13.0.7, or 12.4.x ≤ 12.4.9. (Grafana Cloud instances are patched by the vendor.)

Recommended action: Patch to the fixed release for your minor line (13.2.1 / 13.1.5 / 13.0.8 / 12.4.10). As of this writing Grafana had not yet published the detailed advisories describing the CVE scope — review them at the Grafana security advisories page when they go live, and treat internet-exposed instances as highest priority.

5. Flux v2.9.5 — kubeconfig Secret hardening across controllers

What happened: Flux v2.9.5 shipped August 31, 2026. Key changes:

• helm-controller and kustomize-controller now validate kubeconfigs supplied via .spec.kubeConfig Secrets, rejecting references to files on the local filesystem (certificate-authority, tokenFile, client-certificate, client-key) — credentials and certificates must be embedded inline.
• Controllers moved back to upstream Helm v4.2.4, dropping the temporary Flux fork.
• kustomize-controller now purges temporary directories left by a previous process that exited without cleanup, and a panic on negative-length substring expressions (e.g. ${VAR:2:-1}) in post-build substitution is fixed.
• fluxcd/pkg dependencies updated, bringing Kubernetes client libraries to 1.36.4.

Why it matters: The kubeconfig validation closes a path where a crafted Secret could point controllers at arbitrary files on the controller’s filesystem — a meaningful hardening step for multi-tenant clusters where Secret writers aren’t fully trusted. The post-build substitution panic was a crash vector reachable from Git-controlled ConfigMaps/values.

Recommended action: Upgrade to v2.9.5 following the standard Flux upgrade procedure. After upgrading, audit any kubeconfig Secrets you feed to Flux — file-based references that previously worked will now be rejected.

☸️ Kubernetes & Cloud Native

• Kubernetes v1.37.0 (August 26) — see Top Story #1. Patch releases v1.36.4 / v1.35.8 / v1.34.11 shipped August 20 for supported older minors. Release · Announcement · Full changelog.
• Argo CD v3.5.2 (August 27, alongside v3.4.8) — patch release. Notable fixes: auto-sync being skipped when a newer commit arrives during sync (#29224), ignoreApplicationDifferences restored after normalization (#29195), Cluster API Cluster health no longer degraded while Ready is False during provisioning (#29273), and two notification-controller fixes for shared-cache mutation and informer reads. Release notes.
• Flux v2.9.5 (August 31) — kubeconfig hardening, back to upstream Helm; see Top Story #5. Release notes.
• Helm v4.3.0-rc.1 and v3.22.0-rc.1 (August 31) — release candidates on both lines for staging feedback; official changelogs land with GA. v4.3.0-rc.1 / v3.22.0-rc.1.

☁️ Cloud Platforms

Cloud provider news feeds (AWS What’s New, Azure Updates, Google Cloud release notes, Cloudflare blog) were not reachable for verification from this environment this week, so this digest sticks to what could be confirmed against primary sources rather than relaying unverified items. With Kubernetes 1.37 now GA, expect GKE/EKS/AKS preview or rapid-channel builds within the coming weeks — plan upgrade windows against the deprecations in Top Story #1 (IPVS mode, static Pod API references) before your provider’s preview opens.

🏗️ Infrastructure as Code & Platform Engineering

• Terraform v1.16.0 (August 26) — module-level import blocks, terraform_data store block, destroy = false; see Top Story #2. Release notes.
• Terraform v1.16.1 (September 2) — import/lifecycle fixes; see Top Story #3. Release notes.
• OpenTofu v1.13.0-beta1 (August 27) — first beta of the 1.13 line, supported until August 2027. Breaking changes to note: the WinRM provisioner connection type is removed (migrate to SSH), base64gzip output changes form due to a new DEFLATE implementation (may cause diffs on existing resources), macOS 13+ is now required, and v1.13 is the final series with official 32-bit builds. New experiments: Symbol Libraries (reusable HCL functions/types) and tofu -lint basic linting support. Windows ARM64 is now an officially supported platform. Release notes.
• Ansible v2.21.4rc1 / v2.20.9rc1 / v2.19.13rc1 (August 31) — release candidates across supported lines; stable releases to follow. ansible/ansible releases.

📊 Observability & SRE

• Grafana 13.2.1 (September 2) — CVE fixes; see Top Story #4. Release notes.
• OpenTelemetry Collector v0.160.0 (stable components v1.66.0, September 1–2) — notable items:
  • Deprecation: flat HTTP keepalive fields in confighttp client/server config (idle_conn_timeout, max_idle_conns, disable_keep_alives, etc.) are deprecated in favor of a new keepalive section. Old fields keep working with a warning; mixing old and new is an error (#14020).
  • Performance: the exporter helper’s batcher now caches request size per sizer type, fixing an O(n²) recompute of serialized proto size on every consumed request when sizer: bytes is used (#12636) — relevant if you run byte-sized batching at high throughput.
  • Reliability: bounds checks in the profiles pipeline fix a collector panic reachable via a crafted OTLP payload with negative location indices (#15697).
  • Go 1.26 is now required; Go 1.25 support dropped. Release notes.

SRE angle: Kubernetes 1.37’s watch-cache hardening changes how the API server behaves under pressure — from “slow but eventually serving” to “fast 429 with Retry-After”. If your alerting includes API-latency SLOs or client error budgets, expect the error mix to shift after upgrade; verify your client libraries and operators actually retry on 429 before rolling out.

🔐 DevSecOps & Infrastructure Security

Sources: Grafana v13.2.1, Flux v2.9.5, OTel Collector v0.160.0. Where no CVE is published, none is claimed here.

🛠️ Tools & Releases Worth Watching

• Kubernetes v1.37 — beyond the headline features, the Stable storage version migrator is directly useful for platform teams: declarative StorageVersionMigration objects replace hand-rolled kubectl replace scripts when CRD storage versions change. Release
• Terraform v1.16.1 — the usable entry point for module-level import blocks; strongest platform-engineering feature set in recent releases. GitHub
• OpenTofu v1.13.0-beta1 — test the -lint experiment and Symbol Libraries now if you want to shape them before they stabilize; note the WinRM removal and 32-bit deprecation for planning. GitHub
• OpenTelemetry Collector v0.160.0 — the byte-sized-batching O(n²) fix alone can be significant on high-throughput pipelines; profile-ingesting collectors should upgrade for the panic fix. GitHub
• Argo CD v3.5.2 — the auto-sync race fix (newer commit arriving mid-sync) resolves a real GitOps correctness issue; cheap patch upgrade. GitHub

💡 SRE Takeaways of the Week

1. Start your Kubernetes 1.37 upgrade plan today. Check kube-proxy mode (IPVS deprecated, removal targeted v1.43), audit static Pods for Secret/ConfigMap references, and verify controllers handle HTTP 429 + Retry-After before the API server starts rejecting them.
2. Skip Terraform 1.16.0, go straight to 1.16.1. The import-block fixes in the patch release sit directly on the new headline feature. Review provisioner bastion_host_key configs per the upgrade notes.
3. Patch Grafana this week. 13.2.1 / 13.1.5 / 13.0.8 / 12.4.10 fix two CVEs; internet-exposed instances first.
4. Upgrade Flux to v2.9.5 and audit kubeconfig Secrets. File-based credential references are now rejected — catch broken Secrets in staging, not during a reconciliation storm.
5. Adopt HPA scale-to-zero where it fits. Now Beta and on by default in 1.37, it’s a straightforward cost win for queue consumers and batch workloads driven by external metrics — but remember CPU/memory-based scaling to zero is explicitly not supported.

Sources

• Kubernetes v1.37 release announcement — kubernetes.io
• Kubernetes v1.37.0 — kubernetes/kubernetes
• Kubernetes CHANGELOG-1.37 — kubernetes/kubernetes
• Terraform v1.16.0 — hashicorp/terraform
• Terraform v1.16.1 — hashicorp/terraform
• OpenTofu v1.13.0-beta1 — opentofu/opentofu
• Grafana v13.2.1 — grafana/grafana
• Grafana security advisories — grafana/grafana
• Flux v2.9.5 — fluxcd/flux2
• OpenTelemetry Collector v0.160.0 — open-telemetry/opentelemetry-collector
• Argo CD v3.5.2 — argoproj/argo-cd
• Helm v4.3.0-rc.1 — helm/helm
• Ansible releases — ansible/ansible