Tinkerbell: Infrastructure Automation Ledger 2026 Scorecard

Part of the Infrastructure Automation Ledger (edition 2026-10-16). How the scores work: methodology.

Snapshot

Type: community project (CNCF Sandbox)
Owner: CNCF Sandbox project (accepted 2020-11-10) governed by its maintainers; origin sponsor Equinix Metal ended service on 2026-06-30; maintainer employers not found
Licence: Apache-2.0; free; no paid support or commercial edition found
Latest release: 0.25.0 (2026-07-31)
Support lifecycle: None published; the latest release is the one maintained; all releases are 0.x
Next milestone: none published (a roadmap repository exists, not read)
Targets: Bare metal only, through network and ISO boot with BMC control over Redfish, IPMI and Intel AMT (Raspberry Pi netboot since 0.25); Cluster API provider 0.7.0 (2026-04-27); no VM, cloud, vSphere, Proxmox VE or Nutanix integration
Tier: Host and bare-metal provisioning
Archetype: Slow follower
Evidence grade: B. Release feeds, the governance document, the CNCF project page and the two 2026 security advisories were read from primary sources. Feature descriptions come from the repository README because the documentation site returned no content. Releases from 2021 to 2024 were not researched, so capability before 2026 is held flat on inferred values.

Scope of the scores: Tinkerbell has no plan or dry-run mode and no drift detection of installed hosts. Desired state lives in Hardware, Template and Workflow objects that controllers reconcile, which is the reading of inclusion test 4 applied to the bare-metal family. It needs Kubernetes. Scored with those limits.

Scorecard

Dimension	Score	Direction
Capability today	29.7 / 100	higher is better
Momentum since end of 2022	+3.6 points (2020 to 2022: +0.0)	higher is better
Credibility	12.0 / 25	higher is better
Sustainability risk	11.0 / 25	lower is better
Technical lock-in	9.5 / 25	lower is better
Integrator fit	6.5 / 20	higher is better
AI leverage	2.0 / 20	higher is better
Ledger Index	36.9 / 100	balanced weights; see the methodology

Capability by domain, 2015 to today

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2015	2019	2022	Today
Provisioning breadth (15)	n/a	n/a	0.5	0.5
Configuration management depth (12)	n/a	n/a	1	1
State, planning and safety (12)	n/a	n/a	1.5	1.5
Language and authoring (10)	n/a	n/a	1.5	2
Orchestration and self-service (10)	n/a	n/a	1.5	2
Scale and control plane (8)	n/a	n/a	1	1.5
Security and compliance (10)	n/a	n/a	1.5	1.5
Bare metal and day-2 operations (8)	n/a	n/a	3	3.5
Ecosystem and integrations (8)	n/a	n/a	2	2
AI assistance (7)	n/a	n/a	0	0
Total / 100	n/a	n/a	26.1	29.7

Year by year: 2020: 26.1 · 2021: 26.1 · 2022: 26.1 · 2023: 26.1 · 2024: 26.1 · 2025: 26.1 · 2026: 29.7

What moved the score

Year	Domain	Change	Points	Trigger
2026	Bare metal and day-2 operations	3 → 3.5	+0.8	0.24.0 and 0.25.0: HomeAssistant power provider, PXELinux and Raspberry Pi boot routes, Kubernetes executor for the agent
2026	Language and authoring	1.5 → 2	+1.0	0.23.0: toYaml and fromYaml template functions; Hardware attributes
2026	Orchestration and self-service	1.5 → 2	+1.0	0.23.0: Tinkerbell UI; single HTTP server for Smee and Tootles
2026	Scale and control plane	1 → 1.5	+0.8	0.23.0: configurable MaxConcurrentReconciles for Rufio controllers

Direction, 2023 to 2026

Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2024-11	Equinix tells Metal customers the service ends on 2026-06-30 (Tinkerbell's origin sponsor)	Ecosystem	P
2025-06	CNCF community bare-metal cluster on Equinix Metal to be decommissioned by 2025-12-31	Ecosystem	P
2025-12	0.20.0 to 0.22.0: three minor releases between August and December 2025 (contents not read)	Packaging	C
2026-03	0.23.0: single HTTP server for Smee, Tootles and the new Tinkerbell UI (breaking change)	Orchestration	C
2026-03	0.23.0: configurable MaxConcurrentReconciles for Rufio; Hardware attributes; toYaml and fromYaml template functions	Scale	C
2026-04	cluster-api-provider-tinkerbell 0.7.0	Ecosystem	U
2026-06	Equinix Metal service ends; resources removed 2026-07-01	Ecosystem	P
2026-07	0.24.0: fix for a critical unauthenticated SSRF in the Smee ISO handler (GHSA-f2j9-ffq8-pg75)	Security	C
2026-07	0.24.0: bmclib HomeAssistant power provider	Bare metal	V
2026-07	0.25.0: fix for workflow template env exposure (GHSA-p37j-ccmf-67x4); hermetic template functions	Security	C
2026-07	0.25.0: TFTP route abstraction with PXELinux and Raspberry Pi netboot; Tink Agent per-action namespaces and Kubernetes executor	Bare metal	C

Centre of gravity: Ecosystem (4), Security (2), Bare metal (2)
Blind spots (no items): Provisioning breadth, Configuration management, State and planning, Language, AI, Licensing
Driver mix: Vision 9%, Customer need 55%, Market window 0%, Upstream 9%, Portfolio 27%
Idea-to-need index: 0.14 (0 = demand-pulled, 1 = thesis-pushed)

Credibility: 12.0 / 25

Criterion	Score	Basis
Cadence	2.5	Irregular: four months between 0.23.0 and 0.24.0, then 0.25.0 two days later; no schedule
Roadmap transparency	3	Public roadmap repository, governance document and published advisories; no dated roadmap
Say-do	2.5	Not enough announcements to measure
Velocity	2.5	Consolidation into one binary and a UI in 2026; otherwise fixes
Lifecycle stability	1.5	0.x versions, breaking changes between minors, no support windows published

Sustainability risk: 11.0 / 25 (lower is better)

Criterion	Score	Basis
Maintainer concentration	3.5	Origin sponsor Equinix Metal ended service on 2026-06-30; maintainer employers after that were not found
Backer health	3.5	No vendor, no paid support; CNCF Sandbox since 2020 without incubation
Licence-change risk	0.5	Apache-2.0 under the CNCF
Abandonment signs	2	Three releases in 2026 show activity, but all are 0.x on an irregular rhythm
Security response	1.5	A critical SSRF and a high template exposure were fixed in July 2026 within days of each other, with published GHSA advisories

Technical lock-in: 9.5 / 25 (lower is better)

Criterion	Score	Basis
Formats	1.5	Kubernetes YAML with Tinkerbell-specific workflow templates
Export path	2.5	No export to other tools
Stack coupling	2.5	Requires Kubernetes
Hardware / cloud coupling	0.5	Any BMC with Redfish, IPMI or Intel AMT; offline capable
Skills and tooling coupling	2.5	Kubernetes plus project concepts and Go templating; small community

Integrator fit: 6.5 / 20

Criterion	Score	Basis
Partner programme openness	1	None
Multi-tenancy and self-service	1.5	Kubernetes namespaces and RBAC only
API and infrastructure-as-code	3	Kubernetes API and Cluster API provider 0.7.0
Skills and certification	1	None found

AI leverage: 2.0 / 20

How the product uses AI, scored per year like capability. Only GA counts.

Criterion	2019	2022	Today	Latest step
AI code and plan generation	n/a	0	0	2020: None
AI platform stack	n/a	0	0	2020: None
AI-assisted operations	n/a	0	0	2020: None
Agent openness	n/a	2	2	2020: Kubernetes API and custom resources; no MCP server found

Year by year: 2020: 2 · 2021: 2 · 2022: 2 · 2023: 2 · 2024: 2 · 2025: 2 · 2026: 2

AI say-do, 2023 to 2026: 0 AI items announced; 0 GA, 0 still preview, 0 pending, 0 dropped. No AI items announced.

Tinkerbell has no AI features and no official agent interface beyond the Kubernetes API. Nothing on the record points to AI work.

Reading

Tinkerbell is the lightest tool in this group: a bare-metal workflow engine with network boot, BMC control and a metadata service, and little else the Ledger measures. Sustainability matters more than capability here: its origin sponsor Equinix Metal shut down on 2026-06-30, the project is still 0.x with no support windows, and the CNCF has not moved it past Sandbox in six years. On the positive side, two serious 2026 advisories were fixed within days and three releases shipped this year. Before adopting it, find out who the current maintainers work for, because the public record does not say.

Open questions and items to re-score

Maintainer employers after the Equinix Metal shutdown were not found.
Whether the project will reach CNCF incubation; no date or application found.
Documentation content was not read (the docs site returned only a title); features come from the README.
Releases 0.20.0 to 0.22.1 (2025 to January 2026) were not read.
A non-Kubernetes (Docker) deployment mode was not confirmed.
No MCP server search was run beyond the repository.