Google Distributed Cloud, software only: On-Prem Kubernetes Ledger

Part of the On-Prem Kubernetes Ledger (edition 2026-10-13). How the scores work: methodology.

1. Snapshot

Tier: Hyperscaler on-prem
Owner: Alphabet Inc. (Google Cloud), public company
Licence model: Commercial software billed per vCPU in user clusters through a Google Cloud billing account; list price $0.03288 per vCPU hour on bare metal and VMware; VM Runtime included
Products scored: GDC software only for bare metal (ex Anthos on bare metal) and for VMware (ex GKE On-Prem); the GDC connected and air-gapped hardware products are not scored
Latest release: Bare metal and VMware 1.36.0-gke.532 (Kubernetes 1.36), 2026-08-25; patch 1.36.100-gke.144 on 2026-10-07
Next signal: No dated roadmap; 1.37 not yet released (upstream Kubernetes 1.37 shipped 2026-08-26)
Archetype: Cloud-tethered hybrid kubernetes
Evidence grade: B. Release notes, version history, support policy, pricing page and Wayback snapshots read directly; no public roadmap, support policy before 2023 and partner facts not confirmed, and no CNCF conformance listing exists to cross-check.

Not ranked: Inclusion test 4 not met on the evidence: cncf/k8s-conformance has no Anthos or Google Distributed Cloud folder for Kubernetes 1.24 to 1.37 (only the hosted GKE service is listed). Test 3 is met only in part: the management plane is Google Cloud with no self-hosted option, and creating or upgrading clusters needs a connection to it.

2. Scorecard

Dimension	Score	Direction
Capability today	64.8 / 100	higher is better
Momentum since end of 2022	+6.0 points	higher is better
Credibility	16.0 / 25	higher is better
Commercial risk	9.0 / 25	lower is better
Technical lock-in	13.0 / 25	lower is better
Integrator fit	12.0 / 20	higher is better
AI leverage	4.0 / 20	higher is better
Ledger Index	56.2 / 100	balanced weights

3. Capability by domain

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2016	2019	2022	Today
Install, upgrade and lifecycle (12)	n/a	2	3	3.5
Bare metal, edge and on-prem infrastructure (10)	n/a	1.5	3	3
Multi-cluster and fleet management (10)	n/a	1.5	3	3.5
Networking (10)	n/a	2	4	4
Storage and data protection (10)	n/a	2	3	3
Security and compliance (12)	n/a	2	3	3.5
Developer platform (8)	n/a	1	1	1.5
Observability and day-2 operations (8)	n/a	2	3	3.5
VMs on Kubernetes (VMware exit) (10)	n/a	0	3	3
GPU and accelerator workloads (10)	n/a	0	3	3.5
Total / 100	not released	28.4	58.8	64.8

Year by year: 2019: 28.4 · 2020: 32.4 · 2021: 37.4 · 2022: 58.8 · 2023: 61.2 · 2024: 63.0 · 2025: 64.0 · 2026: 64.8

What moved the score

Year	Domain	Change	Points	Trigger
2020	GPU and accelerator workloads	0 → 1	+2.0	Bare metal 1.6 lists NVIDIA GPU support; VMware GPU attach in beta 2020-08-20
2020	VMs on Kubernetes (VMware exit)	0 → 1	+2.0	Bare metal 1.6 (2020-11-30): KubeVirt VM management in preview
2021	Bare metal, edge and on-prem infrastructure	1.5 → 3	+3.0	Bare metal GA 2020-11-30 and 1.8 (2021-06-21): no hypervisor, OpenStack, edge profile; cloud connection mandatory since 1.7
2021	Networking	2 → 3	+2.0	Dataplane V2 GA on VMware 2021-03-25; multi-NIC GA in bare metal 1.9; BGP load balancer preview
2022	GPU and accelerator workloads	1 → 3	+4.0	1.13 and 1.14 (2022): NVIDIA device plugin with MIG manager, Tesla T4, GPUs in VMs preview
2022	Install, upgrade and lifecycle	2 → 3	+2.4	Bare metal 1.14 (2022-12-13): bmctl, automatic health checks, upgrades through a bootstrap cluster; each minor supported 12 months
2022	Multi-cluster and fleet management	1.5 → 3	+3.0	1.13 (2022-09-29): fleet registration, Connect gateway with Google Groups, admin cluster managing user clusters
2022	Networking	3 → 4	+2.0	Bare metal 1.11 (2022-03-31): bundled BGP and L2 load balancing, SR-IOV, dual-stack GA; 1.13 flat IP with BGP
2022	Observability and day-2 operations	2 → 3	+1.6	1.13 (2022-09-29): Managed Service for Prometheus GA, Cloud Logging, node problem detector, sample dashboards
2022	Security and compliance	2 → 3	+2.4	1.14 (2022-12-13): seccomp, SELinux on RHEL, Workload Identity, audit logs, LDAP identity, Azure AD groups
2022	Storage and data protection	2 → 3	+2.0	CSI v1.0 drivers from Ready storage partners, snapshots, bmctl control-plane backup GA in 1.10 (2021-12-10); no bundled storage or data backup
2022	VMs on Kubernetes (VMware exit)	1 → 3	+4.0	VM Runtime GA 2022-08-23 (1.12): Windows guests, VLAN and IP stickiness, VM HA, no extra charge; live migration and snapshots absent
2023	Install, upgrade and lifecycle	3 → 3.5	+1.2	1.15 (2023-04-27) in-place upgrade default; 1.16 (2023-08-25) parallel node-pool upgrades; GKE On-Prem API enrollment; lag 133 days
2023	Security and compliance	3 → 3.5	+1.2	1.16 (2023-08-25) Binary Authorization and VPC Service Controls GA; 1.29 Identity Service v2; no FIPS, STIG or SBOM found, no KEV in own components
2024	Multi-cluster and fleet management	3 → 3.5	+1.0	1.30 (2024-08-29): one admin cluster manages several user-cluster versions; 100 user clusters per admin cluster tested
2024	Observability and day-2 operations	3 → 3.5	+0.8	Alerting policies, periodic health checks, Managed Collector GA; no cost or capacity reporting found
2025	GPU and accelerator workloads	3 → 3.5	+1.0	1.33 (2025-09-02): bundled NVIDIA GPU Operator and Dynamic Resource Allocation in preview (half step); still preview in 1.36
2026	Developer platform	1 → 1.5	+0.8	No registry, CI or portal in the 173 bare-metal doc pages; Config Sync and console workload views are outside the product

4. Direction, 2023 to 2026

Each item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2023-04	1.15: in-place upgrade default and parallel node-pool upgrades in preview	D1 Install and lifecycle	C
2023-08	1.16: Binary Authorization and VPC Service Controls GA	D9 Security	C
2023-08	1.16: GKE On-Prem API enrollment from console, gcloud and Terraform GA	D3 Fleet management	P
2023-11	GKE Enterprise edition GA, combining GKE and Anthos	D12 Packaging and licensing	P
2023-12	1.28: version numbers aligned with GKE; pause and resume upgrades in preview	D1 Install and lifecycle	U
2024-04	1.29: GKE Identity Service v2 GA	D9 Security	C
2024-08	1.30: node-pool upgrade rollback GA	D1 Install and lifecycle	C
2025-05	1.32: separate control-plane and data-plane L2 load balancing	D4 Networking	C
2025-09	1.33: Node Agent, bundled NVIDIA GPU Operator and Dynamic Resource Allocation in preview	D13 Accelerators	M
2025-09	GKE consolidated into a single paid offering with standalone SKUs	D12 Packaging and licensing	P
2025-12	1.34: skip-minor cluster upgrades GA	D1 Install and lifecycle	C
2026-05	1.35: cgroup v2 required, containerd 2.1	D1 Install and lifecycle	U
2026-08	1.36: vertical Pod autoscaling GA, layer 4 gateway controller	D8 Observability and operations	C

Centre of gravity: Install and lifecycle (5), Security (2), Packaging and licensing (2)
Driver mix: Vision 0%, Customer need 54%, Market window 8%, Upstream 15%, Portfolio 23%

5. Credibility: 16.0 / 25

Criterion	Score	Basis
Cadence	4	A minor every four to five months since 1.28, 106 to 146 days after upstream; final patch dates and a written support policy
Roadmap transparency	2.5	Detailed dated release notes and version history; no public roadmap, tracker or direction beyond Next blog posts
Say-do	3.5	14 of 19 previews reached GA within 12 months (median 121 days); 5 stay in preview 13 to 30 months; mostly small features
Velocity	3	One or two substantive capabilities per release: parallel upgrades, Identity Service v2, Node Agent, skip-minor upgrades, VPA
Lifecycle stability	3	12-month minors with in-place upgrades, but renamed three times since 2019 and folded into GKE Enterprise in 2023; no extended support

Say-do record, 2023 to 2026: 19 items 2023-2026, built from preview-to-GA entries in the release notes plus the GKE Enterprise keynote promise: 14 shipped within 12 months (78 to 357 days), 5 pending beyond 12 months (Dynamic Resource Allocation, bundled GPU Operator, keyless mode, custom scheduler, intermediate CA), 0 dropped. No roadmap or keynote promises exist for the software-only line.

6. Commercial risk: 9.0 / 25 (lower is better)

Criterion	Score	Basis
Price and licence volatility	2	Renamed Anthos to GDC Virtual 2022-06-17 and into GKE Enterprise 2023-11-15 with no on-prem price change; GKE editions consolidated September 2025
Purchase constraints	1.5	Pay as you go per vCPU hour through a Google Cloud billing account; custom quotes for commitments; no minimum seen
Channel and access	1.5	Documentation and release notes open; partner programme exists; billing and fleet registration require a Google Cloud project
Owner stability	1.5	Alphabet is stable, but the Anthos brand and product line were restructured twice and the software-only line is a minor part of the portfolio
Cost of staying supported	2.5	Free updates but a 12-month window per minor, mandatory upgrades every year and new OS floors (cgroup v2, RHEL 8.10, Ansible 2.18)

Security record of the product itself: No CISA KEV entry and no critical flaw in GDC's own components (bmctl, Connect, Identity Service, VM Runtime) found in 171 Google bulletins read. Critical containerd CVE-2026-50195 (CVSS 9.9, GCP-2026-051, 2026-07-31) and runc breakouts are upstream runtimes patched by every distribution, so no deduction.

7. Technical lock-in: 13.0 / 25 (lower is better)

Criterion	Score	Basis
Formats	2	Workloads use upstream APIs; VMs and cluster lifecycle use vm.cluster.gke.io and baremetal.cluster.gke.io CRDs; no CNCF conformance listing found
Export path	2.5	Standard manifests move; bmctl backup restores control-plane state into GDC only; no documented migration path off the platform
Stack coupling	2	Bring your own OS and any CSI; Cilium-based Dataplane V2, MetalLB and Config Sync are the supported network and policy stack
Hardware / cloud coupling	4	Docs call a permanent Google Cloud connection the design; create and upgrade need it, fleet registration and metering are mandatory
Skills and tooling coupling	2.5	bmctl, gkectl, gcloud and Google Cloud console skills on top of kubectl

8. Integrator fit: 12.0 / 20

Criterion	Score	Basis
Partner programme openness	3	Google Cloud Partner Advantage and storage Ready partners; hybrid specialisation details not opened
Multi-tenancy and self-service	2.5	Admin and user clusters, namespaces, RBAC, fleet; no hosted control planes
API and infrastructure-as-code	4	GKE On-Prem API with gcloud and Terraform resources for bare metal and VMware clusters; Terraform provider has 2.6 billion downloads
Skills and certification	2.5	Google Cloud certifications exist; none specific to GDC found

9. AI leverage: 4.0 / 20

Strand	Today	Latest step
AI workload support	2.5	2025: 1.33 (2025-09-02): bundled GPU Operator and Dynamic Resource Allocation in preview; vLLM serving guides
AI platform stack	0	none
AI-assisted operations	0	none
Agent openness	1.5	2023: GKE On-Prem API (gcloud, Terraform, REST) enrollment GA in 1.16, 2023-08-25; no official MCP server for GDC

AI say-do: 2 announced, 0 GA, 2 preview, 2 pending, 0 dropped; GPU support is real but the AI platform, assistant and MCP work Google announced is for its connected and air-gapped hardware, not for software only.

10. Reading

Google sells the on-premises clusters as an extension of its cloud: fleet, billing, identity and the install and upgrade path all run through a Google Cloud project. The release notes show steady, dated delivery and a solid VM Runtime, but no public roadmap, GPU features stuck in preview and no CNCF conformance listing. It suits teams already on Google Cloud that accept a standing connection; it does not suit disconnected sites.

11. Open questions and evidence caveats

No Anthos or Google Distributed Cloud folder exists in cncf/k8s-conformance for 1.24 to 1.37: confirm certification with Google before ranking.
Create and upgrade need a live connection to Google Cloud; the docs say disconnected operation is not a nominal mode.
Support policy text before 2023 and partner programme details were not confirmed.
Scores rest on release notes; there is no public roadmap, so the say-do record covers small features only.