Kubermatic Kubernetes Platform: On-Prem Kubernetes Ledger

Part of the On-Prem Kubernetes Ledger (edition 2026-10-13). How the scores work: methodology.

1. Snapshot

Tier: Challenger
Owner: Kubermatic GmbH, Hamburg, independent; seed funding of $8.3M (Nauta Capital, btov Partners) in 2021-2022
Licence model: Open core: Apache 2.0 for the Community Edition, Kubermatic Enterprise Read-Only License v1.0 for enterprise files; subscription for Enterprise Edition and support
Products scored: KKP 2.31 master/seed platform with KubeVirt provider; Kubermatic Virtualization 1.2, KDP 1.2 and Kubermatic AI counted as separate add-ons
Latest release: KKP 2.31.0, 2026-08-20 (Kubernetes 1.36); patch 2.31.2, 2026-10-09 (Kubernetes 1.37)
Next signal: No dated roadmap; the stated rhythm of triannual minors points to the next KKP minor around the turn of 2026-27
Archetype: Open-core hosted control planes
Evidence grade: B. Changelogs, release API, docs source and dated blog posts read directly; KKP 2.12 to 2.19 detail, pricing and the partner programme were not found.

2. Scorecard

Dimension	Score	Direction
Capability today	69.2 / 100	higher is better
Momentum since end of 2022	+19.8 points	higher is better
Credibility	17.0 / 25	higher is better
Commercial risk	8.5 / 25	lower is better
Technical lock-in	7.0 / 25	lower is better
Integrator fit	12.5 / 20	higher is better
AI leverage	10.0 / 20	higher is better
Ledger Index	67.8 / 100	balanced weights

3. Capability by domain

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2016	2019	2022	Today
Install, upgrade and lifecycle (12)	n/a	2.5	3	3.5
Bare metal, edge and on-prem infrastructure (10)	n/a	3	3.5	3.5
Multi-cluster and fleet management (10)	n/a	3	3.5	4
Networking (10)	n/a	2.5	3	4
Storage and data protection (10)	n/a	2	2.5	3
Security and compliance (12)	n/a	2.5	3	3.5
Developer platform (8)	n/a	1	2	3
Observability and day-2 operations (8)	n/a	1.5	3	3.5
VMs on Kubernetes (VMware exit) (10)	n/a	0	1	3
GPU and accelerator workloads (10)	n/a	0	0	3.5
Total / 100	not released	37.0	49.4	69.2

Year by year: 2017: 20.6 · 2018: 20.6 · 2019: 37.0 · 2020: 37.0 · 2021: 37.0 · 2022: 49.4 · 2023: 50.6 · 2024: 58.6 · 2025: 64.8 · 2026: 69.2

What moved the score

Year	Domain	Change	Points	Trigger
2019	Bare metal, edge and on-prem infrastructure	1.5 → 3	+3.0	2.11: AWS, Azure, GCP, OpenStack, vSphere, Packet, OpenShift 3.11
2019	Developer platform	0.5 → 1	+0.8	2.11: no developer features
2019	Install, upgrade and lifecycle	1.5 → 2.5	+2.4	2.11 (2019-07-10): lists supported Kubernetes 1.11 to 1.15; machine-controller node lifecycle
2019	Multi-cluster and fleet management	1.5 → 3	+3.0	2.11: master and seed clusters with projects and RBAC
2019	Networking	1.5 → 2.5	+2.0	2.11: Canal-class CNI default; not itemised
2019	Observability and day-2 operations	1 → 1.5	+0.8	2.11: not itemised
2019	Security and compliance	1.5 → 2.5	+2.4	2.11: RBAC and OIDC through Dex
2019	Storage and data protection	1 → 2	+2.0	2.11: provider storage classes such as AWS WaitForFirstConsumer
2022	Bare metal, edge and on-prem infrastructure	3 → 3.5	+1.0	2.20/2.21: full Nutanix, VMware Cloud Director, KubeVirt preview, air-gap mirror tooling, ARM64; bare metal and Edge providers only Experimental later
2022	Developer platform	1 → 2	+1.6	2.21: application catalogue and web terminal
2022	Install, upgrade and lifecycle	2.5 → 3	+1.2	2.21 (2022-08-30): KKP Operator updates seed CRDs, Operating System Manager on by default; three KKP minors supported
2022	Multi-cluster and fleet management	3 → 3.5	+1.0	2.21: resource quotas (EE), metering 1.0, presets, KubeOne import in 2.22
2022	Networking	2.5 → 3	+1.0	2.20/2.21: Canal default, Cilium option compatible with Multus, dual-stack, MetalLB
2022	Observability and day-2 operations	1.5 → 3	+2.4	2.21: MLA stack (monitoring, logging, alerting) and metering 1.0
2022	Security and compliance	2.5 → 3	+1.2	2.21: OPA Gatekeeper 3.6, audit logging presets, encryption at rest experimental
2022	Storage and data protection	2 → 2.5	+1.0	2.21: etcd backup configs and Velero 1.9 chart
2022	VMs on Kubernetes (VMware exit)	0 → 1	+2.0	2.21 (2022-08-30): KubeVirt provider in technical preview
2023	Install, upgrade and lifecycle	3 → 3.5	+1.2	2.23 (2023-06-28): enforced auto-upgrade option; median lag 78 days to a new Kubernetes minor; no LTS
2024	GPU and accelerator workloads	0 → 3	+6.0	2.25 (2024-03-15): NVIDIA GPU Operator in the Enterprise application catalogue
2024	Networking	3 → 3.5	+1.0	2.24/2.26: KubeLB multi-tenant load balancer and Kube-OVN provider networks
2024	Storage and data protection	2.5 → 3	+1.0	2.25 (2024-03-15): namespace backup, restore and schedules in the dashboard
2025	Multi-cluster and fleet management	3.5 → 4	+1.0	2.28 (2025-06-23): Kyverno policy bindings across clusters; seed GitOps still early testing
2025	Security and compliance	3 → 3.5	+1.2	2.28 Kyverno policies, 2.29 editable encryption at rest, 2.31 SBOMs and CIS benchmark workflow; no FIPS or STIG
2025	VMs on Kubernetes (VMware exit)	1 → 3	+4.0	Kubermatic Virtualization 1.0 (2025-11-27), 1.2 with IAM and networking; scale and Windows guests not documented
2026	Developer platform	2 → 3	+1.6	KDP kcp-based developer platform, 1.0.0 on 2026-07-23 (vendor says GA since January 2026)
2026	GPU and accelerator workloads	3 → 3.5	+1.0	2.29 DRA gates, 2.31 KubeVirt GPU project quotas as alpha; no sharing docs
2026	Networking	3.5 → 4	+1.0	2.31 (2026-08-20): Gateway API enforced for ingress, nftables proxy mode; no service mesh or SR-IOV found
2026	Observability and day-2 operations	3 → 3.5	+0.8	2.30 Grafana Alloy, 2.31 per-node and per-cluster alerts, K8sGPT diagnostics; no support portal tooling

4. Direction, 2023 to 2026

Each item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2023-02	KKP 2.22: KubeVirt provider reaches GA	D10 VMs on Kubernetes	M
2023-11	KKP 2.24: KubeLB integration and tarball image mirroring for air-gap	D4 Networking	V
2024-03	KKP 2.25: Edge provider added and K8sGPT in the web terminal	D2 Bare metal, edge and infrastructure	V
2024-10	KKP 2.26: Baremetal provider with Tinkerbell and Kube-OVN networks	D2 Bare metal, edge and infrastructure	C
2025-06	KKP 2.28: Kyverno policy integration; Equinix Metal deprecated	D9 Security	U
2025-10	KKP 2.29: DRA gates, Kueue and GPU visibility	D13 Accelerators	M
2025-11	Kubermatic Virtualization 1.0 for VMware leavers	D10 VMs on Kubernetes	M
2026-03	KKP 2.30: Gateway API opt-in and Kubernetes MCP server application	D4 Networking	U
2026-03	Kubermatic SecureGuard secrets platform released	D9 Security	V
2026-07	Kubermatic Developer Platform 1.0.0 and 1.1.0	D6 Developer platform	V
2026-08	KKP 2.31: Gateway API enforced and GPU project quotas as alpha	D4 Networking	U
2026-09	Kubermatic AI launched	D13 Accelerators	M

Centre of gravity: Networking (3), VMs on Kubernetes (2), Bare metal, edge and infrastructure (2)
Driver mix: Vision 33%, Customer need 8%, Market window 33%, Upstream 25%, Portfolio 0%

5. Credibility: 17.0 / 25

Criterion	Score	Basis
Cadence	4	Published rhythm of monthly patches and triannual minors; observed 4 to 7 months between minors
Roadmap transparency	3.5	Per-PR changelogs and docs source in public repositories; proposals folder; no dated roadmap
Say-do	3	Edge provider experimental for 31 months, Baremetal for 24, seed GitOps still early; KubeVirt GA and Gateway API shipped in about six months
Velocity	3.5	Steady minors with new providers and applications; new products KubeV, KDP and Kubermatic AI
Lifecycle stability	3	Latest three KKP minors supported, no LTS; Equinix Metal provider removed in four months

Say-do record, 2023 to 2026: 8 items 2023-2026: 2 shipped (KubeVirt GA 5.8 months, Gateway API 5.4), 2 partial (application catalog manager opt-in, DRA to alpha GPU quotas), 3 still experimental or early (Edge 31 months, Baremetal 24, GitOps 20), 1 dropped (Equinix Metal); no vendor dates exist.

6. Commercial risk: 8.5 / 25 (lower is better)

Criterion	Score	Basis
Price and licence volatility	1.5	No price or licence change found since 2023; open core with a read-only enterprise licence
Purchase constraints	2	Community Edition free; Enterprise Edition by subscription, aimed at over 50 clusters
Channel and access	1.5	Docs and source open; Enterprise downloads by subscription; partners page returns 404
Owner stability	1.5	Independent small company with seed funding; no acquisition
Cost of staying supported	2	Support window of three KKP minors; Kubernetes minors dropped at upstream end of life

Security record of the product itself: No KEV entry, no published GitHub advisory in five Kubermatic repositories and no NVD hit for 'kubermatic'; the only item is Kyverno CVE-2026-22039 fixed in the bundled Enterprise application in 2.29.5 (2026-03-03), an upstream component (the security record).

7. Technical lock-in: 7 / 25 (lower is better)

Criterion	Score	Basis
Formats	1	User clusters run upstream Kubernetes through kubeadm; KKP CRDs live on the master and seed
Export path	2	KubeOne clusters can be imported; exit documentation for KKP-built clusters not found
Stack coupling	1	Choice of operating system through Operating System Manager and of CNI and CSI
Hardware / cloud coupling	1	Self-hosted master and seed; no SaaS requirement; air-gapped mirror tooling
Skills and tooling coupling	2	KKP, seed and machine-controller concepts; kubectl and Helm otherwise

8. Integrator fit: 12.5 / 20

Criterion	Score	Basis
Partner programme openness	2.5	CNCF Certified Service Provider and Training Partner (vendor claim); partners page returns 404
Multi-tenancy and self-service	4.5	Projects, quotas, per-tenant identity providers and hosted control planes in seed clusters
API and infrastructure-as-code	3	CRDs, REST API, Go SDK; Terraform provider has only 7.6K downloads and no release since 2022
Skills and certification	2.5	Kubermatic Academy and training services; no certification found

9. AI leverage: 10 / 20

Strand	Today	Latest step
AI workload support	3	2025: 2.29 DRA gates, Kueue, GPU labels; AIKit and LocalAI applications
AI platform stack	3	2026: Kubermatic AI launched 2026-09-01 as a shared GPU and model platform; maturity not labelled
AI-assisted operations	2	2024: 2.25 K8sGPT in the web terminal and as an operator application; third-party tool
Agent openness	2	2026: 2.30 ships a third-party Kubernetes MCP server as an application; KDP 1.2 has its own MCP server (separate product)

AI say-do: 8 items, 6 shipped, 1 alpha (GPU quotas), 1 enablement only (DRA), 0 dropped; the AI work is GPU enablement, K8sGPT diagnostics and a month-old AI platform.

10. Reading

Kubermatic is widening KKP from multi-cloud cluster management into a family of products for virtualization, a developer platform, load balancing, secrets and AI, while keeping KKP itself an open-core master and seed design. The record is on-time minors about 78 days behind Kubernetes, solid vSphere, Nutanix, OpenStack and KubeVirt support, and bare metal and Edge providers that have stayed experimental for two years or more. A buyer gets strong multi-tenancy and sovereignty positioning, but no FIPS build, no extended support and no first-class bare-metal path.

11. Open questions and evidence caveats

Edge and Baremetal providers are Experimental in the docs; infra score assumes they stay so.
CNCF certification for Kubernetes 1.30 (2024-05-15) predates KKP 2.26.0 (2024-10-15), so 1.30 lag of 181 days may be overstated.
Kubermatic Virtualization, KDP and Kubermatic AI are separate products; virt, devplat and AI scores count them as first-party add-ons.
Pricing, partner programme and exit path were not found.