On-Prem Kubernetes Ledger 2026
Ledger
On-Prem Kubernetes Ledger 2026
Amazon EKS Anywhere: On-Prem Kubernetes Ledger
EKS Anywhere is a free, self-hosted Cluster API toolkit that AWS supports for a flat per-cluster fee.
Edition October 13, 20266 min read
Part of the On-Prem Kubernetes Ledger (edition 2026-10-13). How the scores work: methodology.
1. Snapshot
- Tier: Hyperscaler on-prem
- Owner: Amazon Web Services (Amazon.com, Inc.), public company
- Licence model: Apache-2.0 software; Enterprise Subscription $24,000 per cluster per year (1-year) or $18,000 (3-year), needs an AWS Enterprise Support or On-Ramp plan
- Products scored: EKS Anywhere v0.26 on vSphere, bare metal (Tinkerbell), Nutanix and AWS Snow; CloudStack removed in v0.26.0; Curated Packages and extended support are subscription items
- Latest release: v0.26.2, 2026-09-10 (Kubernetes 1.30 to 1.36); v0.25.4 patch 2026-09-24
- Next signal: No v0.27 yet (docs state a 4-month minor cadence); Snow provider removal announced for v0.26 but not done; secret management labelled Q4 2025 still open
- Archetype: Open-source Cluster API toolkit
- Evidence grade: B. GitHub releases, issues, docs, pricing and AWS announcements read directly; no written roadmap, so the say-do record rests on six issue quarter labels, design docs and removal notices.
2. Scorecard
| Dimension | Score | Direction |
|---|---|---|
| Capability today | 53.2 / 100 | higher is better |
| Momentum since end of 2022 | +10.4 points | higher is better |
| Credibility | 18.0 / 25 | higher is better |
| Commercial risk | 10.5 / 25 | lower is better |
| Technical lock-in | 7.0 / 25 | lower is better |
| Integrator fit | 11.0 / 20 | higher is better |
| AI leverage | 3.0 / 20 | higher is better |
| Ledger Index | 55.6 / 100 | balanced weights |
3. Capability by domain
Scores 0 to 5 against fixed anchors; total is weighted to 100.
| Domain (weight) | 2016 | 2019 | 2022 | Today |
|---|---|---|---|---|
| Install, upgrade and lifecycle (12) | n/a | n/a | 3 | 4 |
| Bare metal, edge and on-prem infrastructure (10) | n/a | n/a | 3.5 | 4 |
| Multi-cluster and fleet management (10) | n/a | n/a | 2.5 | 3 |
| Networking (10) | n/a | n/a | 3 | 3.5 |
| Storage and data protection (10) | n/a | n/a | 2 | 1.5 |
| Security and compliance (12) | n/a | n/a | 3 | 3.5 |
| Developer platform (8) | n/a | n/a | 2 | 2 |
| Observability and day-2 operations (8) | n/a | n/a | 2 | 2.5 |
| VMs on Kubernetes (VMware exit) (10) | n/a | n/a | 0 | 0 |
| GPU and accelerator workloads (10) | n/a | n/a | 0 | 2 |
| Total / 100 | not released | not released | 42.8 | 53.2 |
Year by year: 2021: 32.8 · 2022: 42.8 · 2023: 44.8 · 2024: 50.0 · 2025: 53.2 · 2026: 53.2
What moved the score
| Year | Domain | Change | Points | Trigger |
|---|---|---|---|---|
| 2022 | Bare metal, edge and on-prem infrastructure | 2 → 3.5 | +3.0 | v0.10 Bare Metal via Tinkerbell, v0.12 CloudStack, v0.13 Nutanix and single-node clusters; air-gap with registry mirror |
| 2022 | Developer platform | 1.5 → 2 | +0.8 | v0.11.0 (2022-08-19): Curated Packages GA (Harbor, Emissary, cert-manager); packages need a subscription |
| 2022 | Install, upgrade and lifecycle | 2.5 → 3 | +1.2 | v0.12/v0.13 (2022): Bare Metal upgrades, workload clusters, rolling-upgrade controls; five Kubernetes minors per release |
| 2022 | Multi-cluster and fleet management | 1 → 2.5 | +3.0 | v0.9 to v0.13: generic git provider, workload clusters on Bare Metal and vSphere |
| 2022 | Observability and day-2 operations | 1.5 → 2 | +0.8 | v0.12/v0.13: ADOT and Prometheus curated packages |
| 2022 | Security and compliance | 2.5 → 3 | +1.2 | v0.7 to v0.13: IRSA, OIDC, Bottlerocket, kube-bench CIS guide |
| 2023 | Install, upgrade and lifecycle | 3 → 3.5 | +1.2 | v0.18.0 (2023-10-30): KinD-less and modular upgrades; 4-month cadence, median lag 76 days |
| 2023 | Multi-cluster and fleet management | 2.5 → 3 | +1.0 | v0.15.0 (2023-03-30): lifecycle controller driven by kubectl, GitOps or Terraform; EKS Connector console view; no templates or fleet policy |
| 2023 | Observability and day-2 operations | 2 → 2.5 | +0.8 | v0.17.0 (2023-08-16) cluster status conditions; EKS Connector console view; CloudWatch and Managed Prometheus forwarding |
| 2023 | Storage and data protection | 2 → 1.5 | -1.0 | v0.17.0 (2023-08-16) removed the built-in vSphere CSI driver; own CSI plus etcd backup and CAPI backup before upgrades |
| 2024 | GPU and accelerator workloads | 0 → 2 | +4.0 | v0.21.0 (2024-10-30) GPU support for Nutanix; NVIDIA GPU Operator guide for Bare Metal; no sharing, MIG or DRA found |
| 2024 | Security and compliance | 3 → 3.5 | +1.2 | v0.18 etcd encryption (2023-10); v0.19.0 (2024-02-29) all images signed with AWS Signer; no FIPS, STIG or SBOM found |
| 2025 | Bare metal, edge and on-prem infrastructure | 3.5 → 4 | +1.0 | v0.22.0 (2025-02-28) ISO-boot provisioning without DHCP; Snow and Nutanix kept; CloudStack removed 2026-07-17; no ARM or OpenStack |
| 2025 | Install, upgrade and lifecycle | 3.5 → 4 | +1.2 | v0.19 in-place Bare Metal upgrades (2024-02); v0.22.0 (2025-02-28) extended support to 26 months per Kubernetes minor; no rollback |
| 2025 | Networking | 3 → 3.5 | +1.0 | v0.24.0 (2025-11-06): AWS build of Cilium 1.19 with all open-source features, Multus on Bare Metal, second NIC; no Gateway API or IPv6 found |
4. Direction, 2023 to 2026
Each item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).
| Date | Item | Theme | Driver |
|---|---|---|---|
| 2023-08 | v0.17.0: cluster status conditions and separate control-plane upgrades | D8 Observability and operations | C |
| 2023-10 | v0.18.0: KinD-less upgrades and modular Kubernetes upgrades on bare metal | D1 Install and lifecycle | C |
| 2023-11 | Enterprise Subscriptions sold through the EKS console | D12 Packaging and licensing | P |
| 2024-02 | v0.19.0: all images signed with AWS Signer and Notation | D9 Security | V |
| 2024-02 | v0.19.0: in-place upgrades on bare metal | D1 Install and lifecycle | C |
| 2024-10 | v0.21.0: GPU support for the Nutanix provider | D13 Accelerators | C |
| 2024-12 | EKS Hybrid Nodes GA: AWS-managed control plane for on-premises nodes | D12 Packaging and licensing | P |
| 2025-02 | v0.22.0: extended Kubernetes support to 26 months per version | D1 Install and lifecycle | C |
| 2025-06 | v0.23.0: vSphere failure domains GA | D2 Bare metal, edge and infrastructure | C |
| 2025-11 | v0.24.0: AWS build of Cilium with full features and Ubuntu 24.04 | D4 Networking | U |
| 2026-03 | v0.25.0: end of CloudStack and Snow providers announced | D2 Bare metal, edge and infrastructure | P |
| 2026-07 | v0.26.0: CloudStack provider removed, Kubernetes 1.36 | D2 Bare metal, edge and infrastructure | P |
- Centre of gravity: Install and lifecycle (3), Bare metal, edge and infrastructure (3), Packaging and licensing (2)
- Driver mix: Vision 8%, Customer need 50%, Market window 0%, Upstream 8%, Portfolio 33%
5. Credibility: 18.0 / 25
| Criterion | Score | Basis |
|---|---|---|
| Cadence | 4.5 | A minor every four months since v0.19 (2024-02-29, 06-28, 10-30, 2025-02-28, 06-28, 11-06, 2026-03-02, 07-17); docs publish the rhythm and the patch policy |
| Roadmap transparency | 3.5 | Open repository with issues, design docs and detailed release notes; roadmap only as quarter labels on six issues |
| Say-do | 3.5 | 8 of 10 capability items shipped (of 5 labelled items: 1 on time, 2 late by 2 to 3 months, 2 still open); 2 of 3 announced removals done on time |
| Velocity | 3 | One or two substantive items per minor (in-place upgrades, extended support, failure domains, Cilium build); many releases are dependency refreshes |
| Lifecycle stability | 3.5 | 14 months plus 12 months extended per Kubernetes minor and no forced upgrades, but CloudStack, Bottlerocket on bare metal and the bundled CSI driver were removed and Snow is slated |
Say-do record, 2023 to 2026: 14 items 2023-2026 from issue quarter labels, design docs and removal notices: 8 of 10 capability items shipped (extended support 59 days after its Q4 2024 label, vSphere credential update 85 days after), 2 pending (etcd certificate renewal 21 months past Q4 2024, secret management 9 months past Q4 2025); removals: CloudStack and Ubuntu 20.04 images done on time, Snow not removed, Bottlerocket on bare metal dropped.
6. Commercial risk: 10.5 / 25 (lower is better)
| Criterion | Score | Basis |
|---|---|---|
| Price and licence volatility | 1.5 | Subscription price unchanged at $24,000 and $18,000 since self-service purchase in 2023-11; extended support added at no extra charge 2025-02 |
| Purchase constraints | 3.5 | Per-cluster flat price, but a subscription requires an AWS Enterprise Support or Enterprise On-Ramp plan; not sold in some regions |
| Channel and access | 1.5 | Apache-2.0 code, docs and patches public; Curated Packages and extended support need a subscription and licence token |
| Owner stability | 1.5 | Amazon is stable, but EKS Hybrid Nodes (2024-12-01) is the cloud-connected path and providers keep being removed |
| Cost of staying supported | 2.5 | CVE patches only in the latest and previous minor; 14 months standard, further 12 only with a paid licence |
Security record of the product itself: No CISA KEV entry, no GitHub security advisory and no AWS bulletin naming EKS Anywhere; runc CVE-2025-31133 fixed in v0.24.0 on its NVD publication day and the 2026 containerd criticals are upstream, so no deduction.
7. Technical lock-in: 7.0 / 25 (lower is better)
| Criterion | Score | Basis |
|---|---|---|
| Formats | 1 | CNCF-listed for Kubernetes 1.24 to 1.36; EKS Anywhere CRDs only drive cluster lifecycle on upstream Cluster API |
| Export path | 1.5 | Standard manifests and Cluster API objects; clusters keep running unsupported; no documented migration tool off the product |
| Stack coupling | 1.5 | Bring your own Ubuntu or RHEL image or use Bottlerocket on vSphere; Cilium default but replaceable; Tinkerbell for bare metal |
| Hardware / cloud coupling | 1.5 | Self-hosted management cluster, air-gapped install documented; subscription and licence tokens go through an AWS account |
| Skills and tooling coupling | 1.5 | eksctl anywhere, Cluster API, Flux and kubectl skills |
8. Integrator fit: 11.0 / 20
| Criterion | Score | Basis |
|---|---|---|
| Partner programme openness | 3 | Validated ISV partner list per provider and AWS partner network; programme terms not opened |
| Multi-tenancy and self-service | 2.5 | Namespaces and RBAC; management cluster drives workload clusters; no hosted control planes |
| API and infrastructure-as-code | 3.5 | Cluster API based, Kubernetes API, Flux and Helm; Terraform only through the Kubernetes provider, no official provider |
| Skills and certification | 2 | No EKS Anywhere certification found; AWS and CKA paths only |
9. AI leverage: 3.0 / 20
| Strand | Today | Latest step |
|---|---|---|
| AI workload support | 1.5 | 2024: v0.21.0 (2024-10-30) GPU support for Nutanix and an NVIDIA GPU Operator guide for Bare Metal |
| AI platform stack | 0 | none |
| AI-assisted operations | 0 | none |
| Agent openness | 1.5 | 2021: Kubernetes API, Cluster API and eksctl CLI; the AWS EKS MCP server targets Amazon EKS, not EKS Anywhere |
AI say-do: 0 announced, 0 GA, 0 preview, 0 pending, 0 dropped; the first-pass AI operator, DRA and assistant claims have no source, and the real AI content is GPU enablement only.
10. Reading
EKS Anywhere is a free, self-hosted Cluster API toolkit that AWS supports for a flat per-cluster fee. It is conformant and runs air-gapped, and the project delivers a minor every four months with dated, detailed notes, but it has no VM support, no FIPS or STIG material, no fleet console and a shrinking provider list. It suits isolated sites that want a thin, upstream-style distribution with AWS support, not a full platform.
11. Open questions and evidence caveats
- No written roadmap; the say-do record uses six issue quarter labels, design documents and removal notices.
- Subscription needs an AWS Enterprise Support or On-Ramp plan; Curated Packages and extended support are not available without it.
- AWS Snow removal was announced for v0.26 but v0.26.2 still ships it.
- FIPS, STIG, SBOM, Gateway API, KubeVirt and DRA were searched in 221 release notes and the docs index and not found.
More from On-Prem Kubernetes Ledger 2026
- Overview: all platforms side by side
- On-Prem Kubernetes Ledger Methodology: How Every Score Is Built
- Canonical Kubernetes: On-Prem Kubernetes Ledger
- DaoCloud Enterprise: On-Prem Kubernetes Ledger
- Deckhouse Kubernetes Platform: On-Prem Kubernetes Ledger
- Giant Swarm managed platform: On-Prem Kubernetes Ledger
- Google Distributed Cloud, software only: On-Prem Kubernetes Ledger
- Kubermatic Kubernetes Platform: On-Prem Kubernetes Ledger
- KubeSphere: On-Prem Kubernetes Ledger
- Microsoft AKS on Azure Local: On-Prem Kubernetes Ledger
- Mirantis Kubernetes Engine: On-Prem Kubernetes Ledger
- Nutanix Kubernetes Platform: On-Prem Kubernetes Ledger
- OKD: On-Prem Kubernetes Ledger 2026
- Oracle Cloud Native Environment: On-Prem Kubernetes Ledger
- Platform9 Managed Kubernetes: On-Prem Kubernetes Ledger
- Red Hat OpenShift Container Platform: On-Prem Kubernetes Ledger
- Sidero Labs Talos Linux and Omni: On-Prem Kubernetes Ledger
- Spectro Cloud Palette: On-Prem Kubernetes Ledger
- SUSE Rancher Prime: On-Prem Kubernetes Ledger
- Upstream Kubernetes: On-Prem Kubernetes Ledger 2026
- VMware vSphere Kubernetes Service: On-Prem Kubernetes Ledger