STACKIT Kubernetes Engine: Cloud Kubernetes Ledger

Part of the Managed Cloud Kubernetes Ledger (edition 2026-10-13). How the scores work: methodology.

1. Snapshot

Tier: European cloud
Owner: Schwarz Group (Schwarz Digits), privately held German retail group
Licence model: Pay as you go; cluster management fee EUR 0.0996 per cluster-hour plus worker VMs, volumes and load balancers
Products scored: SKE clusters (Gardener based) in regions EU01 and EU02, with Flatcar and Ubuntu node pools
Latest release: Kubernetes 1.36 on 2026-08-27
Next signal: Ubuntu 22.04 to 26.04 migration 2026-12-09; Docker and OpenSSH removal from nodes 2026-11; private clusters, audit logs, Cilium in Private Preview
Archetype: Sovereign German managed K8s
Evidence grade: B. Docs, release notes, lifecycle page, status incidents, price table, service certificate and CNCF folder were opened; launch date, price history, SLA percentage and several version dates were not found.

2. Scorecard

Dimension	Score	Direction
Capability today	56.6 / 100	higher is better
Momentum since end of 2022	+19.2 points	higher is better
Credibility	15.0 / 25	higher is better
Commercial risk	9.0 / 25	lower is better
Technical lock-in	9.0 / 25	lower is better
Integrator fit	13.0 / 20	higher is better
AI leverage	2.5 / 20	higher is better
Ledger Index	57.2 / 100	balanced weights

3. Capability by domain

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2016	2019	2022	Today
Versions, upgrades and support (12)	n/a	n/a	2	3
Nodes, autoscaling and compute choice (12)	n/a	n/a	2.5	3
Networking (10)	n/a	n/a	2.5	2.5
Storage and data protection (8)	n/a	n/a	2	2.5
Security and compliance (12)	n/a	n/a	2	3.5
Observability and day-2 operations (8)	n/a	n/a	2.5	3
Multi-cluster, hybrid and fleet (10)	n/a	n/a	1.5	2
Developer and app platform (8)	n/a	n/a	1	2.5
GPU and AI workloads (10)	n/a	n/a	0	2
Regions, sovereignty and SLA (10)	n/a	n/a	2.5	4
Total / 100	not released	not released	37.4	56.6

Year by year: 2020: 25.0 · 2021: 25.0 · 2022: 37.4 · 2023: 38.2 · 2024: 44.2 · 2025: 44.2 · 2026: 56.6

What moved the score

Year	Domain	Change	Points	Trigger
2022	Networking	1.5 → 2.5	+2.0	Calico, yawol load balancer and ACL extension repositories created 2022-08 and 2022-09
2022	Nodes, autoscaling and compute choice	1.5 → 2.5	+2.4	Node pools with autoscaler and hibernation (documented 2026; start not dated)
2022	Observability and day-2 operations	1 → 2.5	+2.4	Argus monitoring component appears in SKE maintenance notices 2022-08
2022	Security and compliance	1 → 2	+2.4	ACL extension for the API server created 2022-09-28
2022	Storage and data protection	1.5 → 2	+0.8	Cinder CSI block classes with expansion; dates not confirmed
2022	Versions, upgrades and support	1 → 2	+2.4	Kubernetes 1.24 certified 2022-09-30; documented upgrade paths not confirmed for this date
2023	Developer and app platform	1 → 1.5	+0.8	Flux extension repository created 2023-07; DNS extension
2024	Nodes, autoscaling and compute choice	2.5 → 3	+1.2	Several flavors per cluster, three AZs plus metro AZ, up to 1,000 nodes, system-component control 2024-07-08; no Arm, spot, Windows or bare metal
2024	Security and compliance	2 → 3	+2.4	Short-lived kubeconfigs 2024-03, CLI login 2024-05, C5 Type 2 scope includes SKE
2024	Versions, upgrades and support	2 → 3	+2.4	Preview, supported, deprecated, expired states, auto patch updates, monthly patch days from 2024-04-08, surge settings; lag 98 to 336 days
2026	Developer and app platform	1.5 → 2.5	+1.6	Managed DNS extension with Gateway API option 2026-05-18, kubara GitOps bootstrap documented 2026-09; no managed CI/CD
2026	GPU and AI workloads	0 → 2	+4.0	GPU flavors in Ubuntu pools with a customer-installed NVIDIA operator; Ubuntu 26.04 GPU support 2026-10-06; sharing and DRA not found
2026	Multi-cluster, hybrid and fleet	1.5 → 2	+1.0	Cluster API provider repository created 2026-07-15; no fleet tooling
2026	Observability and day-2 operations	2.5 → 3	+0.8	Observability extension, automatic node repair, patch days, expiry dates in the API from 2026-04; no cost allocation
2026	Regions, sovereignty and SLA	2.5 → 4	+3.0	SKE in C5 Type 2 scope, ISO 27001 data centres in Germany and Austria, metro AZ, two priced regions; SLA percentage not found
2026	Security and compliance	3 → 3.5	+1.2	IdP single sign-on with RBAC and managed Workload Identity 2026-06-12; audit logs and private clusters still Private Preview
2026	Storage and data protection	2 → 2.5	+0.8	File Storage RWX documented 2026-08; control plane backups but customer data backup is Velero; no managed Kubernetes backup

4. Direction, 2023 to 2026

Each item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2024-03	Short-lived kubeconfigs replace static tokens (1.27)	D9 Security	C
2024-04	Monthly OS patch days	D1 Versions and lifecycle	C
2024-06	STACKIT Load Balancer replaces yawol	D4 Networking	P
2025-07	New node resource reservations	D2 Compute and autoscaling	P
2025-12	Kubernetes 1.34 and containerd 2 Flatcar images	D1 Versions and lifecycle	U
2026-04	STACKIT IdP users and expiry dates in the API	D9 Security	C
2026-05	Gateway API support in the DNS integration	D4 Networking	U
2026-06	Workload Identity and IdP single sign-on	D9 Security	V
2026-08	Kubernetes 1.36	D1 Versions and lifecycle	U
2026-10	Ubuntu 26.04 nodes with GPU support	D13 Accelerators	M

Centre of gravity: Security (3), Versions and lifecycle (3), Networking (2)
Driver mix: Vision 10%, Customer need 30%, Market window 10%, Upstream 30%, Portfolio 20%

5. Credibility: 15.0 / 25

Criterion	Score	Basis
Cadence	2.5	Patch days and version states published, but minors arrive 98 to 336 days after upstream against a stated 'shortly'
Roadmap transparency	3	Dated release notes, lifecycle page, status incidents; no roadmap; promised RCA not found
Say-do	3	Preview-to-supported windows kept; 'shortly after upstream' claim missed; audit logs, private clusters still in private preview
Velocity	3.5	Workload Identity, IdP SSO, Gateway DNS, Ubuntu 26.04 and containerd 2 shipped 2025 to 2026
Lifecycle stability	3	Clear deprecation notices and expiry dates, but about 8 to 11 months per minor and forced updates; no extended support

Say-do record, 2023 to 2026: 8 items 2024 to 2026: 2 policy or date promises held (preview to supported 7 to 15 days), 2 shipped (Ubuntu 26.04 in 40 days, containerd 2), 1 slipped (version availability claim, median at least 143 days), 3 pending (audit logs, private preview group, hardening removals). No public roadmap.

6. Commercial risk: 9.0 / 25 (lower is better)

Criterion	Score	Basis
Price and licence volatility	2	Cluster fee unchanged since at least 2025-12-12 but earlier prices not found; SKU split for Confidential Kubernetes 2025-12-01; larger node reservations 2025-07
Purchase constraints	1.5	Pay as you go by the hour with hibernation; contract-based portal onboarding not confirmed
Channel and access	2	Public docs and price table; two regions; self-service sign-up terms not confirmed
Owner stability	0.5	Schwarz Group, a large privately held retailer
Cost of staying supported	3	Minors expire about 8 to 11 months after release and are force-updated; no extended support

Security record of the product itself: none found: STACKIT disclosed no cross-tenant or control-plane flaw of SKE in 2023 to 2026; the runc CVE-2024-21626 fix (OS 3760.2.0) was announced 2024-02-07. The 2026-06-17 API server outage was an availability incident.

7. Technical lock-in: 9.0 / 25 (lower is better)

Criterion	Score	Basis
Formats	1	Certified Kubernetes (folder stackit-kubernetes-engine, v1.24 to v1.36) built on open-source Gardener; STACKIT IdP, ACL and Workload Identity extensions
Export path	1.5	Service certificate lists exportable data; Velero how-to; no migration service found; egress price not read
Stack coupling	2.5	STACKIT block storage classes, network load balancers, project IAM and IdP, SNA networks
Hardware / cloud coupling	3	Runs only on STACKIT, though providers and extensions are open source
Skills and tooling coupling	1	kubectl, Terraform and the STACKIT CLI

8. Integrator fit: 13.0 / 20

Criterion	Score	Basis
Partner programme openness	3	Marketplace partner programme; tiers not read
Multi-tenancy and self-service	3.5	Projects, Network Areas and a Landing Zone Accelerator for organisations
API and infrastructure-as-code	4.5	Terraform provider 19.2 million downloads, Pulumi, CLI, SDKs for Go, Python and Java, Cluster API provider
Skills and certification	2	No Kubernetes certification found

9. AI leverage: 2.5 / 20

Strand	Today	Latest step
AI workload support	1	2026: GPU flavors with a customer-installed operator; Ubuntu 26.04 GPU support 2026-10-06
AI platform stack	0	none
AI-assisted operations	0	none
Agent openness	1.5	2020: REST API, CLI and Terraform; no official MCP server

AI say-do: 0 dated AI promises found. SKE offers GPU flavors but no inference add-on or assistant; AI Model Serving is a separate product.

10. Reading

STACKIT is building a sovereign German managed Kubernetes on open-source Gardener, adding identity, Gateway API and Ubuntu support while private clusters, audit logs and Cilium stay in private preview. The record shows strong compliance scope (C5 Type 2, ISO 27001, TISAX) and clear lifecycle rules, but new Kubernetes minors arrive after a median of at least 143 days, minors expire after 8 to 11 months and the control plane is charged per cluster. A buyer gets German hosting and certification at the cost of slow version uptake and few GPU or fleet features.

11. Open questions and evidence caveats

SKE launch date, earlier price levels and the SLA percentage were not found; scores start in 2020 from status-page evidence only.
Version dates for 1.29, 1.30, 1.32 and 1.35 come from CNCF certification dates, which for STACKIT precede the official supported date, so the median lag of 143 days is a lower bound.
Docs conflict: the FAQ says only Flatcar is supported while release notes and the policy page list Ubuntu; the lifecycle page and a release note give different 1.33 expiry dates.
Private clusters, audit logging, Cilium and Application Load Balancer are Private Preview and not counted.
Status incidents rarely give root causes; the 2026-06-17 SKE API outage promised an RCA that was not found.
Sign-up terms (self-service versus contract onboarding) were not confirmed; purchase and channel scores are provisional.