NooBaa: Object Storage Ledger 2026 Scorecard

Part of the Object Storage Ledger (edition 2026-10-16). How the scores work: methodology.

Snapshot

Type: engine (open source; inside the Multicloud Object Gateway of Red Hat OpenShift Data Foundation and in IBM products)
Owner: Open-source project stewarded by Red Hat and IBM; Red Hat bought the NooBaa company (2018, not verified from a primary source) and the project moved with the Red Hat storage teams to IBM (target 2023-01-01)
Licence: Apache 2.0; no editions; commercial support only inside OpenShift Data Foundation or IBM products
Latest release: 5.22.0 (2026-07-15)
Support lifecycle: None published upstream; feature releases every three to four months (5.18.0 2025-03-11 to 5.22.0 2026-07-15) with backport patch releases
Next milestone: none published
Object lock: Object lock first appears in the 5.22.0 release headline (2026-07-15, release list); lock modes, legal hold and default retention are not documented in sources read; no backup vendor validation found
Tier: Open-source engine
Archetype: Dependable builder, inside ODF
Evidence grade: B. The GitHub repository metadata, the release list for 5.18.0 to 5.22.0 and the MCG sections of the ODF 4.20 and 4.22 release notes were read (grade B for 2025 and 2026). Releases before 5.18.0 were not fetched, so every step before 2025 is inferred from the product's role in OpenShift Container Storage and ODF (grade C). The Red Hat purchase of the NooBaa company is background knowledge.

Scope of the scores: NooBaa is a gateway: data buckets sit on backing stores (cloud object services, Ceph RGW, PVs or POSIX file systems through NSFS), so durability and capacity come largely from those stores. Scored as the upstream project; ODF's support and lifecycle are scored under Red Hat OpenShift Data Foundation.

Scorecard

Dimension	Score	Direction
Capability today	58.2 / 100	higher is better
Momentum since end of 2022	+17.0 points (2015 to 2022: +15.2)	higher is better
Credibility	16.0 / 25	higher is better
Commercial risk	not scored (engine: nothing to buy)
Technical lock-in	6.5 / 25	lower is better
Integrator fit	9.5 / 20	higher is better
AI leverage	3.0 / 20	higher is better
Ledger Index	58.5 / 100	balanced weights; see the methodology

Capability by domain, 2015 to today

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2015	2019	2022	Today
S3 API fidelity (15)	1.5	2.5	2.5	3.5
Immutability and compliance (12)	0	0	0	2
Durability and resilience (12)	1.5	2	2	2.5
Performance and scale (12)	1.5	2	2	2.5
Deployment freedom (10)	1.5	3	3	3.5
Security and multi-tenancy (10)	1	2	2	3
Operations (10)	1.5	2.5	2.5	3
Protocols beyond S3 (7)	1	2	2	2.5
Lifecycle and tiering (7)	1	2	2	3.5
Ecosystem and openness (5)	3.5	3.5	3.5	3.5
Total / 100	26.0	41.2	41.2	58.2

Year by year: 2015: 26.0 · 2016: 26.0 · 2017: 26.0 · 2018: 26.0 · 2019: 41.2 · 2020: 41.2 · 2021: 41.2 · 2022: 41.2 · 2023: 41.2 · 2024: 41.2 · 2025: 49.0 · 2026: 58.2

What moved the score

Year	Domain	Change	Points	Trigger
2019	Deployment freedom	1.5 → 3	+3.0	noobaa-operator on Kubernetes and OpenShift (grade C)
2019	Durability and resilience	1.5 → 2	+1.2	Bucket classes mirror or spread data across local and cloud backing stores (grade C)
2019	Lifecycle and tiering	1 → 2	+1.4	Bucket classes tier and mirror data between local and cloud backing stores (grade C)
2019	Operations	1.5 → 2.5	+2.0	Operator lifecycle and the noobaa CLI on OpenShift; metrics through the platform (grade C)
2019	Performance and scale	1.5 → 2	+1.2	Endpoint pods scale horizontally on Kubernetes (grade C)
2019	Protocols beyond S3	1 → 2	+1.4	Namespace buckets over Azure Blob, GCS and S3 backends (grade C); the front end stays S3
2019	S3 API fidelity	1.5 → 2.5	+3.0	Shipped as the Multicloud Object Gateway in OpenShift Container Storage 4 (year approximate): S3 buckets with versioning over local and cloud backing stores (grade C)
2019	Security and multi-tenancy	1 → 2	+2.0	Accounts, bucket policies and encryption of data written to backing stores (grade C)
2025	Deployment freedom	3 → 3.5	+1.0	5.18.0 (2025-03-11): NSFS account configuration for the non-containerised mode on Linux hosts over POSIX file systems (first GA date of that mode not found)
2025	Durability and resilience	2 → 2.5	+1.2	Bucket replication with bucket-level replication metrics (ODF 4.20, 2025-11-18); no erasure coding or healing of its own beyond the backing store
2025	Lifecycle and tiering	2 → 3	+1.4	5.19.0 (2025-07-28): lifecycle features; 5.20.0 (2025-11-19): noncurrent-version rules
2025	Operations	2.5 → 3	+1.0	5.19.0 (2025-07-28): online upgrade features; ODF 4.20 folds mcg-cli into odf-cli; no support or lifecycle outside ODF
2025	Protocols beyond S3	2 → 2.5	+0.7	NSFS stores objects as files on POSIX and GPFS file systems, so the same data is reachable through the file system (5.18.0 to 5.20.0)
2025	S3 API fidelity	2.5 → 3	+1.5	5.18.0 (2025-03-11): bucket tagging and versioning updates; 5.19.0 (2025-07-28): bucket notifications and lifecycle
2025	Security and multi-tenancy	2 → 2.5	+1.0	5.18.0 (2025-03-11): NSFS IAM account configuration
2026	Immutability and compliance	0 → 2	+4.8	5.22.0 (2026-07-15): object lock added; modes, legal hold and backup vendor validation not found
2026	Lifecycle and tiering	3 → 3.5	+0.7	5.21.0 (2026-03-11): Glacier parallel recall for archive restore; quotas through ODF object bucket claims
2026	Performance and scale	2 → 2.5	+1.2	5.22.0 (2026-07-15): RDMA updates with maturity not stated, counted as half a step; metadata in PostgreSQL only since 5.20.0; no sizing for billions of objects and no independent benchmark found
2026	S3 API fidelity	3 → 3.5	+1.5	5.21.0 (2026-03-11): IAM user inline policies; 5.22.0 (2026-07-15): Vectors API and Azure STS; S3 Select not seen and no compatibility matrix found
2026	Security and multi-tenancy	2.5 → 3	+1.0	5.21.0 (2026-03-11): IAM user inline policies, LDAP as a proof of concept; 5.22.0 (2026-07-15): Azure STS support and dependency CVE updates; external KMS comes from ODF

Direction, 2023 to 2026

Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2023-01	Stewardship of NooBaa moves with the Red Hat storage teams to IBM	Packaging	P
2025-03	5.18.0: NSFS IAM account configuration, bucket tagging, versioning updates	S3 API	C
2025-07	5.19.0: lifecycle and online upgrade features, bucket notifications, early IAM groundwork	Lifecycle	C
2025-11	5.20.0: noncurrent-version lifecycle rules and GPFS work	Lifecycle	C
2025-11	5.20.0: MongoDB code removed, AWS SDK v3 tests	Operations	C
2025-11	ODF 4.20: bucket-level replication metrics and object browser public access limit for MCG	Durability	C
2026-03	5.21.0: IAM user inline policies, LDAP proof of concept	Security	C
2026-03	5.21.0: Glacier parallel recall, AWS SDK v3 for namespace stores	Lifecycle	C
2026-07	5.22.0: object lock	Immutability	C
2026-07	5.22.0: Vectors API	AI	V
2026-07	5.22.0: RDMA updates	Performance	V
2026-07	5.22.0: Azure STS support and dependency CVE updates	Security	C
2026-07	ODF 4.22: OBC quotas and a replication target alert for MCG	Operations	C

Centre of gravity: Lifecycle (3), Operations (2), Security (2)
Blind spots (no items): Deployment, Protocols, Ecosystem, Licensing
Driver mix: Vision 15%, Customer need 77%, Market window 0%, Upstream 0%, Portfolio 8%
Idea-to-need index: 0.17 (0 = demand-pulled, 1 = thesis-pushed)

Credibility: 16.0 / 25

Criterion	Score	Basis
Cadence	4	Feature releases every three to four months with backport patch releases: 5.18.0 (2025-03-11), 5.19.0 (2025-07-28), 5.20.0 (2025-11-19), 5.21.0 (2026-03-11), 5.22.0 (2026-07-15)
Roadmap transparency	2.5	Open repository and release notes; no roadmap
Say-do	3	Nothing is announced ahead of release, so there is little to check
Velocity	3.5	Lifecycle rules, IAM policies, object lock and the Vectors API within 18 months
Lifecycle stability	3	Backports to older lines; no upstream support window; the MongoDB removal in 5.20.0 changed the metadata layer

Commercial risk: not scored

This is an engine: nobody sells it, so there are no commercial terms to score.

Technical lock-in: 6.5 / 25 (lower is better)

Criterion	Score	Basis
Formats	1.5	NSFS and namespace buckets keep data as plain files or native objects in the backend; the layout of data buckets on backing stores was not verified
Export path	1	S3 reads; NSFS files can be read directly from the file system
Stack coupling	2	PostgreSQL for metadata; Kubernetes operator or the non-containerised mode on Linux
Hardware / cloud coupling	0	Any Kubernetes cluster or Linux host; any S3, Azure or GCS backend
Skills and tooling coupling	2	S3 and Kubernetes skills; documentation and tooling centre on OpenShift

Integrator fit: 9.5 / 20

Criterion	Score	Basis
Partner programme openness	2	No programme of its own; commercial route only through Red Hat and IBM
Multi-tenancy and self-service	2.5	Accounts, IAM users with inline policies, object bucket claims and quotas through ODF; LDAP still a proof of concept
API and infrastructure-as-code	3	Operator and CRDs, noobaa CLI; no Terraform provider found
Skills and certification	2	Covered only by Red Hat courses on OpenShift Data Foundation

AI leverage: 3.0 / 20

How the product uses AI, scored per year like capability. Only GA counts.

Criterion	2019	2022	Today	Latest step
AI workload support	1	1	1.5	2026: 5.22.0 (2026-07-15): Vectors API, and RDMA updates with maturity not stated (half step)
AI platform stack	0	0	0	2015: None
AI-assisted operations	0	0	0	2015: None
Agent openness	1.5	1.5	1.5	2015: S3 API and Kubernetes CRDs; management API documentation is thin; no MCP server found

Year by year: 2015: 2.5 · 2016: 2.5 · 2017: 2.5 · 2018: 2.5 · 2019: 2.5 · 2020: 2.5 · 2021: 2.5 · 2022: 2.5 · 2023: 2.5 · 2024: 2.5 · 2025: 2.5 · 2026: 3

AI say-do, 2023 to 2026: 2 AI items announced; 1 GA, 0 still preview, 1 pending, 0 dropped. The Vectors API shipped in 5.22.0; the RDMA updates in the same release carry no maturity statement.

NooBaa's AI items arrived together in 5.22.0: a Vectors API and RDMA work whose maturity is not stated. There is no AI in its operation and no agent interface beyond the S3 API and CRDs.

Reading

NooBaa scores as a gateway: S3 buckets that span cloud, object and file backends, with lifecycle and IAM features that matured mostly in 2025 and 2026. Durability and performance stay low because protection comes from the backing stores and no scale evidence was found. Immutability is 2 because object lock arrived only in 5.22.0 in July 2026, without documented modes or any backup vendor validation, so earlier ODF gateway deployments could not rely on it. A buyer should confirm which ODF release ships 5.22.0 and which lock modes it enforces before pointing backup software at a Multicloud Object Gateway bucket.

Open questions and items to re-score

Object lock modes, legal hold and default retention in 5.22.0.
Whether MCG is supported by any backup vendor as a production immutable target.
Releases before 5.18.0 were not fetched; the 2015 to 2024 steps and the absence of 2023 and 2024 direction items reflect that gap.
Maturity of the RDMA updates in 5.22.0.
The relationship between NooBaa NSFS and IBM Storage Scale object access was not researched.
The year of the Red Hat purchase of the NooBaa company (2018) is background knowledge.

	’19	’25	’26
S3 API fidelity	2	2	2
Immutability and compliance			1
Durability and resilience		3
Performance and scale			3
Deployment freedom	1
Security and multi-tenancy	3
Operations
Protocols beyond S3
Lifecycle and tiering		1
Ecosystem and openness