Upstream Kubernetes: Cloud Kubernetes Ledger

Part of the Managed Cloud Kubernetes Ledger (edition 2026-10-13). How the scores work: methodology.

1. Snapshot

Tier: Open-source engine
Owner: Cloud Native Computing Foundation (Linux Foundation); open-source project, no single vendor
Licence model: Apache-2.0; free, self-operated, no support contract
Products scored: Kubernetes releases 1.35 to 1.37 as shipped by the project (API, kubelet, kubeadm, reference controllers); SIG projects named in the notes
Latest release: v1.37.0, 2026-08-26 (v1.37.1 on 2026-09-15)
Next signal: v1.38.0 planned 2026-12-16
Archetype: Reference engine, DIY
Evidence grade: A. Dates come from git tags, KEP files and the release schedules read in this run; ops and accel cells for 2016 are not confirmed and carry little weight.

2. Scorecard

Dimension	Score	Direction
Capability today	46.4 / 100	higher is better
Momentum since end of 2022	+8.0 points	higher is better
Credibility	21.5 / 25	higher is better
Commercial risk	not scored (engine: nothing to buy)
Technical lock-in	0.5 / 25	lower is better
Integrator fit	16.0 / 20	higher is better
AI leverage	5.0 / 20	higher is better
Ledger Index	65.5 / 100	balanced weights

3. Capability by domain

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2016	2019	2022	Today
Versions, upgrades and support (12)	2	2.5	2.5	2.5
Nodes, autoscaling and compute choice (12)	1	1.5	1.5	2
Networking (10)	1.5	2	2.5	3
Storage and data protection (8)	1	2	2.5	3
Security and compliance (12)	1.5	2.5	3	3.5
Observability and day-2 operations (8)	1	1	1.5	2
Multi-cluster, hybrid and fleet (10)	0.5	1	1.5	1.5
Developer and app platform (8)	1	1.5	2	2
GPU and AI workloads (10)	0.5	1.5	2	3.5
Regions, sovereignty and SLA (10)	0	0	0	0
Total / 100	20.6	31.8	38.4	46.4

Year by year: 2016: 20.6 · 2017: 20.6 · 2018: 20.6 · 2019: 31.8 · 2020: 31.8 · 2021: 31.8 · 2022: 38.4 · 2023: 38.4 · 2024: 38.4 · 2025: 38.4 · 2026: 46.4

What moved the score

Year	Domain	Change	Points	Trigger
2019	Developer and app platform	1 → 1.5	+0.8	CRDs GA in 1.16 (2019-09-18)
2019	GPU and AI workloads	0.5 → 1.5	+2.0	Device plugin API beta since 1.10
2019	Multi-cluster, hybrid and fleet	0.5 → 1	+1.0	Cluster API repository since 2018; not part of the release
2019	Networking	1.5 → 2	+1.0	NetworkPolicy stable since 1.7; EndpointSlice alpha in 1.16
2019	Nodes, autoscaling and compute choice	1 → 1.5	+1.2	Windows node support production-level in 1.14 (2019-03-25)
2019	Security and compliance	1.5 → 2.5	+2.4	RBAC stable in 1.8; Secret encryption alpha since 1.7
2019	Storage and data protection	1 → 2	+1.6	CSI GA in 1.13, local persistent volumes GA in 1.14
2019	Versions, upgrades and support	2 → 2.5	+1.2	kubeadm GA in 1.13 gave a documented upgrade path; still no automatic patching or long support
2022	Developer and app platform	1.5 → 2	+0.8	Ephemeral containers and kubectl debug stable in 1.25
2022	GPU and AI workloads	1.5 → 2	+1.0	Device plugin API stable and DRA alpha, both in 1.26
2022	Multi-cluster, hybrid and fleet	1 → 1.5	+1.0	Cluster API v1.0.0 on 2021-10-06 as a SIG project
2022	Networking	2 → 2.5	+1.0	EndpointSlice stable 1.21, dual-stack GA 1.23, NetworkPolicy endPort stable 1.25
2022	Observability and day-2 operations	1 → 1.5	+0.8	Ephemeral containers stable 1.25 for debugging; structured logging beta since 1.23
2022	Security and compliance	2.5 → 3	+1.2	Bound service account tokens stable 1.22; Pod Security Admission stable and PodSecurityPolicy removed in 1.25
2022	Storage and data protection	2 → 2.5	+0.8	Volume snapshots GA 1.20, volume expansion stable 1.24, generic ephemeral volumes GA 1.23
2026	GPU and AI workloads	2 → 3.5	+3.0	DRA core GA 1.34, CDI in device plugins stable 1.31, DRA device taints and extended resources stable 1.37
2026	Networking	2.5 → 3	+1.0	nftables kube-proxy, traffic distribution and multiple service CIDRs stable in 1.33; no CNI or Gateway API in the release
2026	Nodes, autoscaling and compute choice	1.5 → 2	+1.2	Sidecars stable 1.33, swap stable 1.34, in-place resize stable 1.35, user namespaces 1.36; still no node autoscaling
2026	Observability and day-2 operations	1.5 → 2	+0.8	API server and kubelet tracing stable in 1.34; no managed metrics, cost allocation or upgrade insights
2026	Security and compliance	3 → 3.5	+1.2	KMS v2 1.29, ValidatingAdmissionPolicy 1.30, MutatingAdmissionPolicy and user namespaces 1.36; no image signing or threat detection
2026	Storage and data protection	2.5 → 3	+0.8	VolumeGroupSnapshot and OCI volume source GA in 1.36; no drivers or backup tool shipped

4. Direction, 2023 to 2026

Each item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2023-12	KMS v2 stable, in-tree cloud providers off by default	D9 Security	C
2024-04	ValidatingAdmissionPolicy stable; DRA structured parameters alpha	D9 Security	V
2024-08	In-tree cloud provider code removed; nftables kube-proxy beta	D11 Ecosystem openness	V
2024-12	DRA structured parameters beta; MutatingAdmissionPolicy alpha	D13 Accelerators	V
2025-04	Sidecar containers and nftables kube-proxy stable	D2 Compute and autoscaling	C
2025-08	DRA core GA; API server and kubelet tracing stable; node swap stable	D13 Accelerators	M
2025-11	Ingress NGINX retirement announced	D4 Networking	C
2025-12	In-place pod resize stable	D2 Compute and autoscaling	C
2026-04	Volume group snapshots, user namespaces, OCI volumes and MutatingAdmissionPolicy stable	D9 Security	C
2026-08	DRA device taints and extended resources stable	D13 Accelerators	M

Centre of gravity: Security (3), Accelerators (3), Compute and autoscaling (2)
Driver mix: Vision 30%, Customer need 50%, Market window 20%, Upstream 0%, Portfolio 0%

5. Credibility: 21.5 / 25

Criterion	Score	Basis
Cadence	5	Three minors a year; 10 of 11 releases from 1.27 to 1.37 shipped on the date published at cycle start
Roadmap transparency	5	Public KEP repository with commit history, sig-release schedules and an official CVE feed
Say-do	4	20 of 24 stated targets met within 12 months; 16 of 24 on the stated date; sidecars, resize, swap and group snapshots slipped over a year
Velocity	5	11 to 23 features reach stable in every release; 44 to 70 enhancements per release since 1.27
Lifecycle stability	2.5	About 14 months per minor, no long-term support release; upgrade every minor, APIs get removed

Say-do record, 2023 to 2026: Releases: 10 of 11 on date, 1.29 slipped 8 days. KEPs: 13 tracked, 6 on target, 7 slipped (sidecars 3 minors, in-place resize 5, node swap 4, volume group snapshot 5, OCI volume 2, user namespaces 1, KMS v2 1).

6. Commercial risk: not scored

This is an open-source engine: nobody sells it, so there are no commercial terms to score. Its project health is described below.

Security record of the product itself: None: upstream is not a managed service. Official CVE feed lists 94 items, none in CISA KEV (catalogue 2026.10.08). Latest: CVE-2026-76654 on 2026-09-14.

7. Technical lock-in: 0.5 / 25 (lower is better)

Criterion	Score	Basis
Formats	0	The reference API; workloads use standard Kubernetes objects
Export path	0	Nothing to export: runs anywhere, no egress fee, no vendor service
Stack coupling	0	No provider IAM, load balancer or storage class required
Hardware / cloud coupling	0	Runs on any cloud, bare metal or laptop
Skills and tooling coupling	0.5	Standard kubectl; operating etcd and kubeadm yourself needs scarcer skills

8. Integrator fit: 16.0 / 20

Criterion	Score	Basis
Partner programme openness	4.5	Vendor-neutral CNCF conformance programme with 131 listed products for 1.34 and 1.35
Multi-tenancy and self-service	2.5	Namespaces, RBAC and quotas only; no organisations, projects or fleet isolation
API and infrastructure-as-code	4	Cluster API v1.14 and client libraries; no official Terraform provider
Skills and certification	5	CKA exam offered by the Linux Foundation and the largest public documentation and community

9. AI leverage: 5.0 / 20

Strand	Today	Latest step
AI workload support	3.5	2026: DRA extended resources and device taints stable 1.37; agent-sandbox 1.0.0 on 2026-08-28
AI platform stack	0	none
AI-assisted operations	0	2023: The project ships no assistant; k8sgpt and kubectl-ai are third-party
Agent openness	1.5	2016: Documented REST API; no official MCP server (the draft's kubernetes-sigs repository does not exist)

AI say-do: 3 tracked, 2 GA, 1 pending (DRA consumable capacity slipped from 1.36 to 1.38). The project supplies scheduling primitives for GPUs; it has no assistant and no official MCP server.

10. Reading

Upstream Kubernetes is building toward a standard scheduling and admission layer for accelerators and policy, with a release train that holds its dates. The record shows reliable releases and features that often take two to five extra minors to reach stable. A buyer gets full portability and no fee, and pays with operations: no hosted control plane, no node provisioning, 14 months of support.

11. Open questions and evidence caveats

Ops 2016 and accel 2016 cells are not confirmed in the research; both carry low scores with little effect.
Cluster API, Kueue, JobSet and Gateway API are SIG projects outside the release; Cluster API is credited in fleet, the others only in AI infra.
No official MCP server was found; community servers do not count under the rubric.
CVE severity is missing for many feed items; the feed gives CVSS only for some entries.