On-Prem Kubernetes Ledger 2026
Ledger
On-Prem Kubernetes Ledger 2026
Deckhouse Kubernetes Platform: On-Prem Kubernetes Ledger
Deckhouse is a modular in-cluster platform that bundles its own virtualization, GPU, observability and fleet products and ships a new minor every two to…
Edition October 13, 20266 min read
Part of the On-Prem Kubernetes Ledger (edition 2026-10-13). How the scores work: methodology.
1. Snapshot
- Tier: Regional
- Owner: Flant (JSC Flant), Moscow, privately held; founded 2008
- Licence model: Community Edition Apache 2.0 on GitHub; Basic, Standard, Standard+, Enterprise, Flant and Certified Security editions sold by quote
- Products scored: Deckhouse Kubernetes Platform 1.42 to 1.77 with the virtualization module (DVP), gpu, Commander and Enterprise modules
- Latest release: v1.77.0 (Alpha channel, 2026-09-01; Stable channel 1.76.16 on 2026-10-13)
- Next signal: No roadmap published; RBACv2 label change announced for 1.78, containerd v2 required from Kubernetes 1.36
- Archetype: Russian modular platform
- Evidence grade: B. Release notes, module pages and the CNCF repository were opened; edition pricing, Stable-channel dates, per-minor support windows and Commander's first GA date were not found.
Not ranked: Fails inclusion test 4: CNCF certification stops at Kubernetes 1.31 (Deckhouse 1.65.0, merged 2024-10-16); none for 1.32 to 1.37 in cncf/k8s-conformance. Flant left CNCF in 2025 (its post of 2025-03-14) and CNCF staff closed the 1.32 submissions on 2025-03-28. Scores are shown for information.
2. Scorecard
| Dimension | Score | Direction |
|---|---|---|
| Capability today | 71.0 / 100 | higher is better |
| Momentum since end of 2022 | +27.2 points | higher is better |
| Credibility | 16.5 / 25 | higher is better |
| Commercial risk | 15.0 / 25 | lower is better |
| Technical lock-in | 11.0 / 25 | lower is better |
| Integrator fit | 11.5 / 20 | higher is better |
| AI leverage | 2.0 / 20 | higher is better |
| Ledger Index | 59.4 / 100 | balanced weights |
3. Capability by domain
Scores 0 to 5 against fixed anchors; total is weighted to 100.
| Domain (weight) | 2016 | 2019 | 2022 | Today |
|---|---|---|---|---|
| Install, upgrade and lifecycle (12) | n/a | n/a | 3 | 3.5 |
| Bare metal, edge and on-prem infrastructure (10) | n/a | n/a | 3 | 3.5 |
| Multi-cluster and fleet management (10) | n/a | n/a | 0.5 | 3 |
| Networking (10) | n/a | n/a | 3.5 | 4 |
| Storage and data protection (10) | n/a | n/a | 2.5 | 3 |
| Security and compliance (12) | n/a | n/a | 3 | 4 |
| Developer platform (8) | n/a | n/a | 3 | 3.5 |
| Observability and day-2 operations (8) | n/a | n/a | 3.5 | 4 |
| VMs on Kubernetes (VMware exit) (10) | n/a | n/a | 0 | 3.5 |
| GPU and accelerator workloads (10) | n/a | n/a | 0 | 3.5 |
| Total / 100 | not released | not released | 43.8 | 71.0 |
Year by year: 2022: 43.8 · 2023: 45.0 · 2024: 48.4 · 2025: 62.4 · 2026: 71.0
What moved the score
| Year | Domain | Change | Points | Trigger |
|---|---|---|---|---|
| 2023 | Security and compliance | 3 → 3.5 | +1.2 | v1.46 CIS dashboard (2023-05); v1.55 default pod security standards (2023-11) |
| 2024 | Developer platform | 3 → 2.5 | -0.8 | v1.65.0 (2024-10-29): delivery module removed |
| 2024 | Install, upgrade and lifecycle | 3 → 3.5 | +1.2 | v1.65.0 (2024-10): daily etcd backups and update modes; release channels; median lag 97 days, no rollback found |
| 2024 | Networking | 3.5 → 4 | +1.0 | v1.61 (2024-06) fault-tolerant Egress Gateway; Istio in Community since 1.47; Gateway API via alb in 1.76; no multus or SR-IOV |
| 2024 | VMs on Kubernetes (VMware exit) | 0 → 1 | +2.0 | Redesigned virtualization module pre-1.0 releases from 2024-02; first module blocked by v1.54 and discontinued in v1.56 |
| 2025 | GPU and accelerator workloads | 0 → 3.5 | +7.0 | v1.71.0 (2025-07): gpu nodes with Exclusive, TimeSlicing and MIG; per-GPU MIG in 1.75; NVIDIA only; no DRA driver |
| 2025 | Observability and day-2 operations | 3.5 → 4 | +0.8 | v1.71.0 (2025-07): Prom++; Observability Platform GA in Enterprise; Loki still Preview; no cost reporting |
| 2025 | Security and compliance | 3.5 → 4 | +1.2 | v1.71.0 (2025-07): image signature verification; runtime-audit-engine, Trivy operator; FSTEC-certified edition for Russia; no FIPS or SBOM |
| 2025 | VMs on Kubernetes (VMware exit) | 1 → 3.5 | +5.0 | DVP v1.0.0 (2025-09-11): KubeVirt-based VMs, snapshots, restore, live migration; no vSphere migration toolkit found |
| 2026 | Bare metal, edge and on-prem infrastructure | 3 → 3.5 | +1.0 | v1.75.0 (2026-03): DVP, VCD, Huawei, zVirt providers GA; registry Proxy and Local modes; no PXE, Redfish or ARM found |
| 2026 | Developer platform | 2.5 → 3.5 | +1.6 | Enterprise Code (GitLab-based) and Development Portal GA, operator-argo; first GA dates not found |
| 2026 | Multi-cluster and fleet management | 0.5 → 3 | +5.0 | Commander module GA (v1.20.4 on Stable): templates, attach clusters, audit; Deckhouse clusters only; first GA date not found |
| 2026 | Storage and data protection | 2.5 → 3 | +1.0 | v1.76.0 (2026-06): CSI snapshotter on; csi-ceph GA, array drivers in Enterprise; sds-replicated-volume still Preview |
4. Direction, 2023 to 2026
Each item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).
| Date | Item | Theme | Driver |
|---|---|---|---|
| 2023-01 | 1.43: first virtualization module to run VMs on bare metal | D10 VMs on Kubernetes | V |
| 2023-06 | 1.47: Istio module available in Community Edition | D4 Networking | M |
| 2023-11 | 1.54: old virtualization module blocked pending a redesign | D10 VMs on Kubernetes | V |
| 2024-02 | 1.58: VMware Cloud Director provider (Enterprise) | D2 Bare metal, edge and infrastructure | M |
| 2024-10 | 1.65: delivery module removed, daily etcd backups; last CNCF-certified minor (1.31) | D6 Developer platform | P |
| 2025-03 | Flant does not renew CNCF membership; Deckhouse leaves the certified list; 1.32 submissions closed | D11 Ecosystem openness | P |
| 2025-07 | 1.71: GPU nodes with TimeSlicing and MIG, Prom++ replaces Prometheus, image signature verification | D13 Accelerators | M |
| 2025-09 | Virtualization platform 1.0.0 | D10 VMs on Kubernetes | M |
| 2026-03 | 1.75: DVP, VCD, Huawei Cloud and zVirt providers GA; registry Proxy and Local modes | D2 Bare metal, edge and infrastructure | C |
| 2026-06 | 1.76: renamed Deckhouse Platform, edition list changed | D12 Packaging and licensing | P |
| 2026-09 | 1.77: Kubernetes 1.36, control-plane rewrite, providers moved to OpenTofu | D1 Install and lifecycle | U |
- Centre of gravity: VMs on Kubernetes (3), Bare metal, edge and infrastructure (2), Networking (1)
- Driver mix: Vision 18%, Customer need 9%, Market window 36%, Upstream 9%, Portfolio 27%
5. Credibility: 16.5 / 25
| Criterion | Score | Basis |
|---|---|---|
| Cadence | 4 | A minor every 2 to 3 months (1.68 Feb 2025 to 1.77 Sep 2026) with published channel matrix |
| Roadmap transparency | 3 | Detailed public changelogs and milestones; roadmap and work-board links removed from README (2023, 2025) |
| Say-do | 3 | 2 of 4 counted items within 12 months; virtualization redesign took about 22 months |
| Velocity | 4 | Each minor adds several items: DVP, GPU modes, Prom++, signature verification, provider GA |
| Lifecycle stability | 2.5 | Delivery module removed 2024; first virtualization module discontinued 2023; rename 2026; no extended support found |
Say-do record, 2023 to 2026: 4 counted items: virtualization redesign (2023-11 to 2025-09, ~22 months), default Kubernetes switch (promised next release, 2 releases late), zVirt provider (2024-04 to 2026-03), Kubernetes minor removals (5 of 5 done).
6. Commercial risk: 15.0 / 25 (lower is better)
| Criterion | Score | Basis |
|---|---|---|
| Price and licence volatility | 3 | Rename to Deckhouse Platform and edition list changed in 1.76 (2026-06); product line merged (event 2026-09-17); licence of Community Edition unchanged |
| Purchase constraints | 2.5 | Free Community Edition; paid editions by quote; trial and callback forms; Western purchase terms not found |
| Channel and access | 3 | Docs and GitHub open; Russian-first site; partner programme by request; availability to buyers under sanctions regimes not established |
| Owner stability | 3.5 | Privately held Russian vendor; Flant said in 2025 that paying a foreign nonprofit created legal risks and left CNCF |
| Cost of staying supported | 3 | Each release supports about five minors, old ones dropped one per release; no extended support found; some modules Enterprise only |
Security record of the product itself: No KEV entry and no CVE in NVD or GitHub advisories for Deckhouse components. Bundled ingress-nginx fixes backported 2025-03-26 (v1.67.14, v1.68.7), 1 to 2 days after the upstream fix; treated as an upstream flaw, no deduction. From security-record corrections.
7. Technical lock-in: 11.0 / 25 (lower is better)
| Criterion | Score | Basis |
|---|---|---|
| Formats | 2 | Cluster and module state in Deckhouse CRDs; workloads standard; CNCF certification lapsed after 1.31 |
| Export path | 2.5 | No exit guide found; workloads move as standard manifests |
| Stack coupling | 2.5 | Cilium or Flannel CNI; node-manager controls node components; limited OS list; storage choice open |
| Hardware / cloud coupling | 1 | Any hardware; in-cluster operator; offline operation with the registry Local mode |
| Skills and tooling coupling | 3 | Deckhouse CLI, ModuleConfig and release-channel model; documentation Russian first |
8. Integrator fit: 11.5 / 20
| Criterion | Score | Basis |
|---|---|---|
| Partner programme openness | 2.5 | Partner programme by request form; partner terms not read |
| Multi-tenancy and self-service | 4 | Projects and project templates, user-authz rules, namespace lists filtered by access (1.75, 1.77) |
| API and infrastructure-as-code | 3 | dhctl, d8 CLI, OpenTofu for providers, Cluster API in node-manager, Commander API; CRD-driven configuration |
| Skills and certification | 2 | Training and consulting page exists; no certification programme found |
9. AI leverage: 2 / 20
| Strand | Today | Latest step |
|---|---|---|
| AI workload support | 1 | 2026: ai-models module 0.1.0 (Enterprise, Experimental): model catalog and node cache; ai-inference 0.0.55 Experimental |
| AI platform stack | 0 | none |
| AI-assisted operations | 0 | none |
| Agent openness | 1 | 2022: Kubernetes API and Deckhouse CRDs only |
AI say-do: 0 promises found; 2 Enterprise modules (ai-models, ai-inference) both Experimental; no operator assistant and no MCP server found.
10. Reading
Deckhouse is a modular in-cluster platform that bundles its own virtualization, GPU, observability and fleet products and ships a new minor every two to three months. The record is strong on delivery and weak on openness: no public roadmap, a CNCF certification that stopped at Kubernetes 1.31 after Flant left CNCF in 2025, and a 2026 rename and edition reshuffle. A buyer outside Russia gets a capable platform with unproven conformance and unclear purchase terms.
11. Open questions and evidence caveats
- Fails inclusion test 4 (no CNCF certification after Kubernetes 1.31); shown unranked.
- GitHub dates are Alpha-channel dates; Stable-channel lag is longer and was not measured.
- Whether buyers in sanctioning jurisdictions can purchase or download paid editions is not established; only dated CNCF and Flant statements are recorded.
- Enterprise-only module scores (gpu, Commander, Code, Development Portal) rest on module pages without dated GA announcements.
More from On-Prem Kubernetes Ledger 2026
- Overview: all platforms side by side
- On-Prem Kubernetes Ledger Methodology: How Every Score Is Built
- Amazon EKS Anywhere: On-Prem Kubernetes Ledger
- Canonical Kubernetes: On-Prem Kubernetes Ledger
- DaoCloud Enterprise: On-Prem Kubernetes Ledger
- Giant Swarm managed platform: On-Prem Kubernetes Ledger
- Google Distributed Cloud, software only: On-Prem Kubernetes Ledger
- Kubermatic Kubernetes Platform: On-Prem Kubernetes Ledger
- KubeSphere: On-Prem Kubernetes Ledger
- Microsoft AKS on Azure Local: On-Prem Kubernetes Ledger
- Mirantis Kubernetes Engine: On-Prem Kubernetes Ledger
- Nutanix Kubernetes Platform: On-Prem Kubernetes Ledger
- OKD: On-Prem Kubernetes Ledger 2026
- Oracle Cloud Native Environment: On-Prem Kubernetes Ledger
- Platform9 Managed Kubernetes: On-Prem Kubernetes Ledger
- Red Hat OpenShift Container Platform: On-Prem Kubernetes Ledger
- Sidero Labs Talos Linux and Omni: On-Prem Kubernetes Ledger
- Spectro Cloud Palette: On-Prem Kubernetes Ledger
- SUSE Rancher Prime: On-Prem Kubernetes Ledger
- Upstream Kubernetes: On-Prem Kubernetes Ledger 2026
- VMware vSphere Kubernetes Service: On-Prem Kubernetes Ledger