August 2026 briefing: Kubernetes 1.37, the new MCP roadmap and AI transparency rules go live

The month in one paragraph

Kubernetes v1.37, codenamed Garhwal, shipped on 26 August with 67 enhancements: 16 to Stable, 23 to Beta and 27 new Alpha features¹. The headline for me is that the foundations of Pod Certificates went GA². The MCP maintainers published a new roadmap built around agent identity, transport and messaging⁶. OpenTelemetry pushed further into inventory and cost control with entity events and a practical guide to cardinality limits⁷⁸. And on 2 August the EU AI Act's Article 50 transparency obligations began to apply¹⁰.

Kubernetes v1.37: identity becomes a built-in

Until now the main identity mechanism inside Kubernetes has been service account JWTs. They work well, but they are bearer tokens: whoever holds the token is the identity. Pod Certificates change that by building X.509 certificate issuance for TLS and mTLS into the platform, so a workload proves it holds a private key that never leaves it².

One detail matters for planning: the project does not yet ship Pod Certificate signers in core, so you install a signer yourself². That makes this a platform-team decision, not a switch you flip.

Three other v1.37 changes are quieter but useful. The metrics.k8s.io API reached v1 after years in beta, with no change to the data it returns³. Storage version migration is now built in and enabled by default, which removes the scripts many teams used to re-write stored objects after a CRD version change or an encryption key rotation⁴. And the release notes push clients to handle HTTP 429 responses properly, because the API server now rejects some expensive requests during watch cache initialisation rather than letting them overload etcd¹.

Gateway API v1.6: layer 4 goes standard

Gateway API v1.6 graduated TCPRoute and UDPRoute to the Standard channel and moved experimental resources into their own API group⁵. Until now, raw TCP and UDP workloads such as databases, DNS or telemetry ingestion had no portable way to sit behind a Gateway.

For platforms that host data services next to web traffic, this means one routing model for both. It also means the v1alpha2 versions are deprecated, so anyone who adopted them early has a migration to plan.

MCP's new roadmap puts agent identity first

The roadmap starts by looking back: the 2026-07-28 specification removed protocol-level sessions so servers can scale horizontally, and the last cycle delivered issuer validation, Client ID Metadata Documents and Enterprise-Managed Authorization⁶. The forward-looking part is more interesting. The maintainers point out that MCP authorisation is built around a person approving access in a browser, while more and more callers are agents running as cloud workloads. Their plan covers DPoP, workload identity federation and standard token exchange⁶.

I covered the current MCP security controls in my MCP security checklist. Nothing in the roadmap changes that advice; it makes the direction clearer.

OpenTelemetry: inventory and honest metrics

Two OpenTelemetry posts stood out. The first explains entity events, which describe what exists in your estate (hosts, services, volumes) and how that changes over time, carried as OTLP log records⁷. The project is clear that the entity data model is still in development, so treat attribute names as provisional.

The second is a practical guide to cardinality limits. The metrics SDK caps unique attribute combinations, 2000 per metric stream by default, and folds the excess into a single overflow data point. Totals stay correct, but queries that filter or group by attributes can undercount, which can quietly break dashboards and SLO alerts⁸. Separately, the Go Logs API and SDK reached release candidate on 31 August⁹.

AI transparency obligations are now live

While the high-risk deadlines in the EU AI Act moved, the Article 50 transparency obligations did not. The European Commission states they apply from 2 August 2026, and that its code of practice on marking and labelling AI-generated content is voluntary while the obligations themselves are legal duties¹⁰. I wrote about the wider timetable in the EU AI Act after the Digital Omnibus.

What I'd do with this

1. Audit your clients for 429 handling before upgrading to v1.37. Custom controllers and operators should respect Retry-After and back off.
2. Pilot Pod Certificates on one internal service with mTLS, and choose a signer deliberately. Keep service account tokens for cloud federation for now.
3. Treat agents as workloads with their own identity. Design MCP access around token exchange and short-lived credentials, not shared API keys.
4. Check for metric overflow by looking for otel.metric.overflow=true before you trust per-tenant dashboards.
5. Ship content marking and AI disclosure in any public-facing generative feature if you have EU users.

How I can help

I help teams turn months like this into a short, prioritised platform plan: identity, observability, agent security and compliance. See my AI architecture work, or if you need a senior technical lead to own these decisions, my fractional CTO engagements. You can also analyse your challenge first and bring the result to a call.