KubeSphere: On-Prem Kubernetes Ledger

Part of the On-Prem Kubernetes Ledger (edition 2026-10-13). How the scores work: methodology.

1. Snapshot

• Tier: Regional
• Owner: Beijing QingCloud Technologies Co., Ltd., listed on the Shanghai STAR Market (688316) since 2021-03-16
• Licence model: Source under the KubeSphere Open Source License (Apache 2.0 plus commercial-use limits, 4.x); every edition needs a licence key; Community Edition free to 128 vCPU and one cluster; Enterprise by quote
• Products scored: KubeSphere 2.1 to 3.4 open source, then v4 LuBan: Enterprise 4.1 to 4.3 and Community Edition 4.2 and later, with extensions
• Latest release: v4.3.0 (docs stamped 2026-08-27; CNCF certified for 1.35 to 1.37 on 2026-09-14); last GitHub release is v4.1.3, 2025-03-24
• Next signal: No roadmap published; EdgeWize 3.2 announced as coming soon on 2025-07-16, no release found
• Archetype: Licence-gated China platform
• Evidence grade: B. Release notes, docs and GitHub were opened and most capability scores rest on them; v4.3.0 has no dated announcement, there is no public roadmap, and absent features are 'not found' rather than disproved.

2. Scorecard

3. Capability by domain

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Year by year: 2019: 33.2 · 2020: 41.4 · 2021: 46.4 · 2022: 49.2 · 2023: 49.2 · 2024: 52.4 · 2025: 56.2 · 2026: 58.2

What moved the score

4. Direction, 2023 to 2026

Each item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

• Centre of gravity: Packaging and licensing (3), Ecosystem openness (2), AI-assisted operations (2)
• Driver mix: Vision 20%, Customer need 10%, Market window 30%, Upstream 10%, Portfolio 30%

5. Credibility: 14.5 / 25

Say-do record, 2023 to 2026: 4 counted promises 2023 to 2025: 3 GA within 12 months, 1 slipped (v3 to v4 upgrade, 2023-08 to 2025-04-19); CVE fix 2 months later than the January 2025 date; EdgeWize 3.2 not confirmed.

6. Commercial risk: 18.0 / 25 (lower is better)

Security record of the product itself: No KEV entry. CVE-2024-46528 (CVSS 4.3, advisory 2024-10-17, fixed v4.1.3 on 2025-03-24). Critical upstream ingress-nginx CVE-2025-1974 in the bundled Gateway extension, advisory 2025-04-03, admission controller off by default; treated as an upstream flaw, no deduction. Two 2026 SSRF CVEs (6.5, 7.7) without a fix date found. From security-record corrections.

7. Technical lock-in: 10.5 / 25 (lower is better)

8. Integrator fit: 12 / 20

9. AI leverage: 8.5 / 20

AI say-do: 1 announced with a promise, 0 confirmed; 5 items delivered without a prior promise (GPU Operator, device manager, MCP server 0.1.1, Skills, Copilot 1.0.0); Copilot recommends only and the MCP server has had no release since 2025-04-30.

10. Reading

KubeSphere is moving from a free open-source console to a licence-keyed product line: a source-available repository, an Enterprise edition and a capped free Community Edition. The record shows steady extension work (observability, DevOps, GPU management, an AI assistant) but no VM support, no public roadmap and a 2025 distribution cut that left open-source users without official downloads. A buyer gets a capable multi-tenant console on conformant Kubernetes, and pays for it in licence terms that have changed twice since 2024.

11. Open questions and evidence caveats

• v4.3.0 has no dated announcement; the date is the documentation build stamp (2026-08-27) and the CNCF certification (2026-09-14).
• Whether the ingress-nginx critical CVE counts as a flaw in a KubeSphere component is a scoring judgement; the Gateway admission controller is off by default.
• Enterprise pricing and the behaviour of member clusters when the host cluster is down were not found.
• Absent features (VMs, DRA, FIPS) are 'not found in the docs and release notes', not proven absent in sold Enterprise extensions.