Cloud Kubernetes Ledger Methodology: How Every Score Is Built

Part of the Managed Cloud Kubernetes Ledger (edition 2026-10-13). The results are in the overview and the service reports. The Ledger uses the same method as the VM Platform Ledger and its sister, the On-Prem Kubernetes Ledger; this page covers what is specific to managed Kubernetes in public cloud.

Who this is for

Platform and DevOps teams, CTOs and integrators choosing where to run Kubernetes in public cloud, including European teams that need sovereignty and AI teams that need GPUs. No provider was briefed on, paid for or reviewed any score.

What is in scope

A service is included when the provider runs the Kubernetes control plane in its own cloud, it is generally available with an update in the last 12 months, it has public documentation, release notes and a pricing page, it is CNCF Certified Kubernetes for a recent minor version, and customers can sign up on their own. On-premises distributions are covered by the On-Prem Kubernetes Ledger; a provider's own hybrid extension (such as EKS Hybrid Nodes or Azure Arc) counts in the fleet domain here. Container services without Kubernetes, and fleet tools that run no clusters, are out of scope.

The 20 entries

Capability: ten domains, scored since 2016

Each domain is scored 0 to 5 at the end of 2016, 2019 and 2022 and today, against the same anchors every year, so a score only rises when something ships. Only generally available capability counts; previews count half a step at most. A capability counts only if the provider runs it as part of the service or a first-party managed add-on. The ten weighted scores add up to capability out of 100. Buyer lenses on the interactive page re-weight the domains for an enterprise on a hyperscaler, a start-up, an EU sovereign or regulated buyer, AI and GPU workloads, hybrid and multi-cloud teams, and the China market.

Version lag, pricing and reliability

Three records are specific to this Ledger:

• Version lag: for every service, the date each upstream Kubernetes minor version became generally available, compared with the upstream release date. Where a provider does not publish its own dates, the CNCF certification date is used as a proxy and labelled as such. A short median lag in 2023 to 2026 is part of a 5 in the versions domain.
• Pricing history: control-plane fees, extended-support fees, free tiers and pricing-model changes since 2018, dated from the providers' announcements and archived pricing pages. Fee changes since 2023 count under commercial risk.
• Reliability: major incidents affecting the managed control plane and the history of each SLA. They are reported in each service's report but not deducted, because providers that publish detailed incident reports would otherwise be penalised for their transparency.

Security: a cross-tenant or managed-control-plane vulnerability in the provider's own service, disclosed in 2023 to 2026 with a provider fix, lowers today's security score by 0.5 (at most 1.0). Upstream Kubernetes vulnerabilities that every provider patched do not count.

The other dimensions

• Credibility (out of 25): release cadence, roadmap transparency (AWS and Azure run public roadmap boards), the say-do record (what was announced in 2023 to 2026 and whether it shipped), velocity and lifecycle stability.
• Commercial risk (out of 25, lower is better): fee changes, purchase constraints, self-service access, owner stability and the cost of staying supported (support windows and extended-support prices).
• Technical lock-in (out of 25, lower is better): dependence on provider-specific APIs and add-ons, export and migration paths, coupling to the provider's IAM, load balancers and storage, whether the stack can run anywhere else, and skills.
• Integrator fit (out of 20): partner programme, multi-tenancy and self-service, official infrastructure-as-code, skills and certification.
• AI leverage (out of 20): AI workload features, AI services integrated with the Kubernetes service, AI assistants for operators, and official agent interfaces such as MCP servers. GPU node types score in capability, not here.
• Upstream Kubernetes is the engine: it has no commercial-risk score, and its buyer safety uses lock-in only.

The Ledger Index

A single number out of 100: capability 35, credibility 20, buyer safety 20, AI leverage 10, integrator fit 10 and momentum 5 (capability gained since the end of 2022). Buyer safety is one minus the sum of commercial risk and lock-in, divided by 50. The Index is shown only from 2023, because credibility, risk and fit are scored for 2023 to 2026.

Evidence and calibration

Every fact behind a score comes from public sources opened during the research: release notes, documentation, pricing pages and their archived versions, public roadmap boards, provider announcements, incident reports, the CNCF conformance repository and the Kubernetes release history. A first research pass contained facts written from memory; every row was re-verified against its source, wrong rows were corrected and unconfirmed ones downgraded or removed. Scores were drafted against the anchors and then calibrated side by side across all 20 entries, so the same evidence earns the same score whichever provider it belongs to. Each report carries an evidence grade (A for primary sources, B where sources conflict or rely on provider statements, C for inference) and lists its open questions.

Limits

The Ledger measures what was shipped and documented, not how well a service runs for a particular workload. Provider statements about scale are labelled as such. List prices change often; the pricing history records dated changes, not a price comparison. Market share and popularity are deliberately not scored.