Ironic: Infrastructure Automation Ledger 2026 Scorecard

Part of the Infrastructure Automation Ledger (edition 2026-10-16). How the scores work: methodology.

Snapshot

Type: community project (OpenStack project under the OpenInfra Foundation, now part of the Linux Foundation)
Owner: OpenStack Technical Committee; the OpenInfra Foundation agreed to join the Linux Foundation in March 2025 and closed the move in June 2025 (blog titles only)
Licence: Apache-2.0; free; sold only inside vendor OpenStack products (Red Hat, Canonical, Mirantis)
Latest release: Ironic 39.0.0 and Bifrost 21.1.0 (OpenStack 2026.2 Hibiscus, 2026-09-30)
Support lifecycle: Six-month series maintained about 18 months; SLURP series allow skip-level upgrades; 2026.2 end of life estimated 2028-04
Next milestone: OpenStack 2027.1 Indri (SLURP), estimated 2027-03-24
Targets: Bare metal only, through Redfish and IPMI (SNMP, iRMC and iLO hardware types retired in 2026.2); switch ports through networking-generic-switch; no VM, cloud, vSphere, Proxmox VE or Nutanix provider; Bifrost drives standalone Ironic with Ansible
Tier: Host and bare-metal provisioning
Archetype: Dependable builder
Evidence grade: B. Series dates, the 2025.2, 2026.1 and 2026.2 release notes and the licence were read from releases.openstack.org, docs.openstack.org and opendev. Foundation facts come from blog titles. Feature history for 2015 to 2024 was not collected, so those years are inferred and held flat except where a dated trigger exists.

Scope of the scores: Ironic has no plan or dry-run mode. It holds desired state as node records in a state machine, validates driver settings before actions, inspects hardware and reports provision, power and health state; the declarative layer comes from Bifrost, Metal3 or a Terraform provider. Scored with that limit.

Scorecard

Dimension	Score	Direction
Capability today	43.6 / 100	higher is better
Momentum since end of 2022	+5.8 points (2015 to 2022: +0.8)	higher is better
Credibility	20.5 / 25	higher is better
Sustainability risk	6.0 / 25	lower is better
Technical lock-in	7.5 / 25	lower is better
Integrator fit	14.0 / 20	higher is better
AI leverage	2.0 / 20	higher is better
Ledger Index	55.7 / 100	balanced weights; see the methodology

Capability by domain, 2015 to today

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2015	2019	2022	Today
Provisioning breadth (15)	1	1	1	1
Configuration management depth (12)	1	1	1	1
State, planning and safety (12)	1.5	1.5	1.5	2
Language and authoring (10)	2	2	2	2
Orchestration and self-service (10)	2	2	2	2.5
Scale and control plane (8)	3	3	3	3.5
Security and compliance (10)	2	2	2	3
Bare metal and day-2 operations (8)	4	4	4	4.5
Ecosystem and integrations (8)	3	3	3.5	3.5
AI assistance (7)	0	0	0	0
Total / 100	37.0	37.0	37.8	43.6

Year by year: 2015: 37.0 · 2016: 37.0 · 2017: 37.0 · 2018: 37.0 · 2019: 37.0 · 2020: 37.8 · 2021: 37.8 · 2022: 37.8 · 2023: 37.8 · 2024: 37.8 · 2025: 39.6 · 2026: 43.6

What moved the score

Year	Domain	Change	Points	Trigger
2020	Ecosystem and integrations	3 → 3.5	+0.8	Metal3 enters CNCF Sandbox (2020-09) with Ironic as its engine
2025	Scale and control plane	3 → 3.5	+0.8	2025.2 (32.0): Eventlet removed; the API can run without database access through RPC
2025	Security and compliance	2 → 2.5	+1.0	2025.2 (32.1): JSON body size and depth limits in the API
2026	Bare metal and day-2 operations	4 → 4.5	+0.8	2026.1: Redfish firmware update without an agent boot, bootc deploy interface, virtual media over NFS and CIFS
2026	Orchestration and self-service	2 → 2.5	+1.0	2026.1 and 2026.2: deploy abort, runbook traits, per-step policy
2026	Security and compliance	2.5 → 3	+1.0	2026.2 (39.0): per-step RBAC through policy.yaml, TLS 1.3 default
2026	State, planning and safety	1.5 → 2	+1.2	2026.1 and 2026.2: node health field, BIOS settings skipped when already matching, node history API

Direction, 2023 to 2026

Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2025-03	OpenInfra Foundation board votes to join the Linux Foundation	Ecosystem	P
2025-06	OpenInfra Foundation becomes part of the Linux Foundation (blog title)	Ecosystem	P
2025-10	2025.2 (32.0): Eventlet removed; the API can run without database access	Scale	U
2025-10	2025.2: Redfish inspection through inspection rules and hooks	Bare metal	C
2025-10	2025.2 (32.1): JSON body size and depth limits in the API	Security	C
2026-04	2026.1 (35.0): Redfish firmware update without an agent boot; virtual media over NFS and CIFS; bootc deploy interface with autodetection	Bare metal	C
2026-04	2026.1: native VXLAN configuration; experimental ironic-networking standalone service	Provisioning breadth	C
2026-04	2026.1: node health field; BIOS settings skipped when already matching; deploy abort	State and planning	C
2026-04	pxe_template driver_info deprecated, removal planned for 2027.2	Security	C
2026-09	2026.2 (39.0): per-step RBAC through policy.yaml; TLS 1.3 default	Security	C
2026-09	2026.2: SNMP, iRMC and iLO hardware types retired; Redfish is the main path	Bare metal	P
2026-09	2026.2: node history API 1.115, firmware identity API 1.114, runbook traits	State and planning	C
2026-09	Bifrost 21.1.0 with the 2026.2 series	Packaging	U

Centre of gravity: Bare metal (3), Security (3), Ecosystem (2)
Blind spots (no items): Configuration management, Language, Orchestration, AI, Licensing
Driver mix: Vision 0%, Customer need 62%, Market window 0%, Upstream 15%, Portfolio 23%
Idea-to-need index: 0.00 (0 = demand-pulled, 1 = thesis-pushed)

Credibility: 20.5 / 25

Criterion	Score	Basis
Cadence	5	Six-month OpenStack cycle with published dates; 2026.2 released 2026-09-30 as scheduled
Roadmap transparency	4.5	Public specs, release notes, deprecation notices and series schedules with end-of-life estimates
Say-do	3.5	Few announcements; experimental items stay marked experimental; deprecated items are removed on the stated series
Velocity	4	Several substantive items in each of 2025.2, 2026.1 and 2026.2
Lifecycle stability	3.5	About 18 months maintained per series with SLURP skip-level upgrades; vendor hardware types retired in 2026.2

Sustainability risk: 6.0 / 25 (lower is better)

Criterion	Score	Basis
Maintainer concentration	2	OpenStack project under a Technical Committee with many contributing companies; the split by employer was not collected
Backer health	1.5	OpenInfra Foundation is now part of the Linux Foundation; Red Hat, Canonical and Mirantis ship Ironic in paid products
Licence-change risk	0.5	Apache-2.0 under a foundation
Abandonment signs	0.5	Six-month releases kept through 39.0.0; Bifrost 21.1.0 in the same series
Security response	1.5	OpenStack vulnerability process; API hardening in 2025.2 and 2026.2; no advisory record was read

Technical lock-in: 7.5 / 25 (lower is better)

Criterion	Score	Basis
Formats	0.5	Standard images and a REST API
Export path	2	API and SDK export node records; no neutral exporter, though Metal3 re-enrolls the same nodes
Stack coupling	2	Message bus or JSON-RPC and a SQL database; Keystone optional
Hardware / cloud coupling	0.5	Any server with IPMI or Redfish; offline capable
Skills and tooling coupling	2.5	OpenStack-style skills; Ansible for Bifrost

Integrator fit: 14.0 / 20

Criterion	Score	Basis
Partner programme openness	4	Open source; vendors run their own programmes
Multi-tenancy and self-service	3	Keystone projects, owner and lessee fields, per-step policy
API and infrastructure-as-code	4	REST API with microversions, SDK, Bifrost Ansible playbooks, Metal3 operator
Skills and certification	3	OpenStack training; no Ironic-specific certification found

AI leverage: 2.0 / 20

How the product uses AI, scored per year like capability. Only GA counts.

Criterion	2019	2022	Today	Latest step
AI code and plan generation	0	0	0	2015: None
AI platform stack	0	0	0	2015: None
AI-assisted operations	0	0	0	2015: None
Agent openness	2	2	2	2015: REST API with microversions and token authentication; no MCP server found

Year by year: 2015: 2 · 2016: 2 · 2017: 2 · 2018: 2 · 2019: 2 · 2020: 2 · 2021: 2 · 2022: 2 · 2023: 2 · 2024: 2 · 2025: 2 · 2026: 2

AI say-do, 2023 to 2026: 0 AI items announced; 0 GA, 0 still preview, 0 pending, 0 dropped. No AI items announced.

Ironic has no AI features and no official agent interface beyond its REST API. OpenStack clouds run AI workloads on Ironic nodes, but nothing in Ironic itself targets AI.

Reading

Ironic has the highest credibility in this group: a six-month cycle with published dates, public specs and deprecations that land when promised. Its capability total is low because the Ledger measures the whole automation stack and Ironic is a bare-metal engine only, with no plan mode, no configuration engine and no VM or cloud targets; within the bare-metal domain it is the deepest tool scored. Sustainability risk is the lowest of the three community projects because a foundation owns it and three vendors sell it. Check the hardware list before upgrading: 2026.2 retired the SNMP, iRMC and iLO hardware types, leaving Redfish as the main path for older servers.

Open questions and items to re-score

Feature history for 2015 to 2024 was not collected; those scores are inferred.
Bifrost's check mode and release history were not read.
Contributor concentration by company was not collected.
The Linux Foundation move is known from blog titles only; the posts were not read.
Vendor product prices and lifecycles (Red Hat, Canonical, Mirantis) were not found; SUSE status unknown.
The ironic-networking standalone service is experimental; re-score when it is supported.

	’20	’25	’26
Provisioning breadth
Configuration management depth
State, planning and safety			1
Language and authoring
Orchestration and self-service			2
Scale and control plane		2
Security and compliance		1	3
Bare metal and day-2 operations
Ecosystem and integrations	1
AI assistance