On-Prem Kubernetes Ledger Methodology: How Every Score Is Built

Part of the On-Prem Kubernetes Ledger (edition 2026-10-13). The results are in the overview and the distribution reports. The Ledger uses the same method as the VM Platform Ledger and its sister, the Managed Cloud Kubernetes Ledger; this page covers what is specific to running Kubernetes on your own infrastructure.

Who this is for

Platform teams, infrastructure architects and system integrators choosing a Kubernetes distribution for their own data centre, the edge or an air-gapped site, including VMware leavers who want to run virtual machines and containers on one platform. No vendor was briefed on, paid for or reviewed any score.

What is in scope

A distribution is included when it shipped a release in the last 12 months, has public documentation or release notes, runs its clusters on infrastructure the customer controls (bare metal, the customer's own hypervisor, edge sites or private cloud), and is CNCF Certified Kubernetes for a recent minor version. Where the management plane is a SaaS service, the report says whether a self-hosted or air-gapped option exists. Public-cloud managed Kubernetes is covered by the Managed Cloud Kubernetes Ledger.

The 20 entries

Tier	Entries
Leader incumbents	Red Hat OpenShift, SUSE Rancher Prime with RKE2 and K3s, VMware vSphere Kubernetes Service (Tanzu)
Challengers	Nutanix Kubernetes Platform, Canonical Kubernetes, Mirantis, Sidero Labs Talos and Omni, Spectro Cloud Palette, Kubermatic KKP
Hyperscalers on-premises	Google Distributed Cloud, Amazon EKS Anywhere, Microsoft AKS on Azure Local
Niche	Oracle Cloud Native Environment, Platform9, Giant Swarm
Regional	KubeSphere, Deckhouse, DaoCloud Enterprise
Community distribution	OKD
Open-source engine	Upstream Kubernetes with kubeadm and Cluster API, the reference line for version lag

Capability: ten domains, scored since 2016

Domain	Weight	What a 3 (solid) means	What a 5 (reference) means
Install, upgrade and lifecycle	12	Supported installer, in-place upgrades, documented support window	Declarative full-stack upgrades, long term support, small lag behind upstream Kubernetes, automated OS and node lifecycle
Bare metal, edge and on-prem infrastructure	10	Bare metal and at least one on-prem hypervisor, documented air-gapped install	Bare-metal provisioning, many infrastructure providers, single-node edge, ARM, disconnected operation at scale
Multi-cluster and fleet management	10	Central console for several clusters	Fleet GitOps, cluster templates, policy across clusters, thousands of clusters, edge fleets
Networking	10	Supported network plug-in, network policies, ingress, on-prem load balancer	Choice of plug-ins, Gateway API, multus and SR-IOV, IPv6 dual stack, eBPF, service mesh, telco networking
Storage and data protection	10	Storage drivers for major arrays, snapshots	Bundled software-defined storage, replication, built-in backup and DR
Security and compliance	12	Role-based access with single sign-on, pod security standards, CIS guidance	FIPS-validated builds, DISA STIG, signed images and SBOM, admission policy, runtime security, hardened OS, audit
Developer platform	8	Registry and developer console	CI/CD and GitOps built in, serverless, developer portal, app templates
Observability and day-2 operations	8	Bundled metrics, logging and alerting	Full observability stack, cost and capacity reporting, health insights, remote support
VMs on Kubernetes (VMware exit)	10	Runs virtual machines next to containers as a supported product	Live migration, VM templates, snapshots and backup, a migration toolkit from vSphere, documented scale, Windows guests
GPU and accelerator workloads	10	Supported NVIDIA GPU operator	GPU sharing, Dynamic Resource Allocation, several accelerator vendors, GPU scheduling and quotas

Each domain is scored 0 to 5 at the end of 2016, 2019 and 2022 and today, against the same anchors every year, so a score only rises when something ships. Only generally available capability counts; tech previews count half a step at most. Where a product line changed (Tanzu to vSphere Kubernetes Service, D2iQ to Nutanix, Anthos to Google Distributed Cloud), each year scores what a customer could buy then. Buyer lenses on the interactive page re-weight the domains for a VMware leaver, platform engineering, a regulated or air-gapped site, edge fleets, AI and GPU workloads, telco network functions, and an open-source-first team.

Version lag and the security record

Version lag: for every distribution, the date each upstream Kubernetes minor version first shipped as generally available, compared with the upstream release date. Open-source release dates come from the projects' own repositories; where a vendor publishes no date, the CNCF certification date is used as a proxy and labelled as such. A short median lag in 2023 to 2026 is part of a 5 in the lifecycle domain.
Security record: each flaw in a distribution's own components (installer, management console, cluster agents) on the CISA Known Exploited Vulnerabilities catalogue in 2023 to 2026 lowers today's security score by 0.5, up to 1.5; a critical flaw in those components lowers it by 0.25, up to 0.5. Upstream Kubernetes vulnerabilities that every distribution patched do not count.

The other dimensions

Credibility (out of 25): release cadence, roadmap transparency, the say-do record (what was announced in 2023 to 2026 and whether it shipped), velocity and lifecycle stability.
Commercial risk (out of 25, lower is better): price and licence changes (per-core metrics, suite bundling, open source becoming closed), purchase constraints, channel access, owner stability and the cost of staying supported.
Sustainability risk (out of 25, lower is better): used instead for OKD, which no company sells: maintainer concentration, backer health, licence-change risk, abandonment signs and security response.
Upstream Kubernetes is the engine: it has no commercial-risk score, and its buyer safety uses lock-in only.
Technical lock-in (out of 25, lower is better): dependence on proprietary resources and operators, migration paths off the platform, coupling to the vendor's operating system, networking and storage, hardware or cloud coupling, and skills.
Integrator fit (out of 20): partner programme, multi-tenancy and self-service, infrastructure-as-code, skills and certification.
AI leverage (out of 20): AI workload features, bundled AI platforms, AI assistants for operators, and official agent interfaces such as MCP servers. GPU support scores in capability, not here.

The Ledger Index

A single number out of 100: capability 35, credibility 20, buyer safety 20, AI leverage 10, integrator fit 10 and momentum 5 (capability gained since the end of 2022). Buyer safety is one minus the sum of commercial (or sustainability) risk and lock-in, divided by 50. The Index is shown only from 2023.

Evidence and calibration

Every fact behind a score comes from public sources opened during the research: release notes, documentation, lifecycle pages and their archived versions, GitHub release and tag dates, KEPs and milestones, vendor announcements, the CNCF conformance repository and the CISA catalogue. A first research pass contained facts written from memory; every row was re-verified against its source, wrong rows were corrected and unconfirmed ones downgraded or removed, and open-source release dates were checked automatically against their repositories. Scores were drafted against the anchors and calibrated side by side across all 20 entries. Each report carries an evidence grade (A for primary sources, B where sources conflict or rely on vendor statements, C for inference) and lists its open questions.

Limits

The Ledger measures what was shipped and documented, not how well a distribution runs in a particular environment. Vendor statements about scale are labelled as such. List prices are rarely public, so commercial risk relies on licence models and dated changes. Market share and popularity are deliberately not scored.