On-Prem Kubernetes Ledger 2026
Ledger
On-Prem Kubernetes Ledger 2026
Red Hat OpenShift Container Platform: On-Prem Kubernetes Ledger
Red Hat is turning OpenShift into one subscription platform for containers, VMs and AI, with its own OS, fleet manager and security add-ons.
Edition October 13, 20266 min read
Part of the On-Prem Kubernetes Ledger (edition 2026-10-13). How the scores work: methodology.
1. Snapshot
- Tier: Leader incumbent
- Owner: Red Hat, Inc., IBM subsidiary since 2019-07-09
- Licence model: Annual subscription per core-pair or per bare-metal node; open-source upstream OKD under Apache 2.0
- Products scored: Self-managed OpenShift 3.3 to 4.22 and the first-party add-ons sold with it (ACM, ACS, ODF, OADP, OpenShift Virtualization, OpenShift AI, Lightspeed)
- Latest release: OpenShift 4.22 (EUS), GA 2026-06-09 on Kubernetes 1.35
- Next signal: OpenShift 5.0 on Kubernetes 1.36: not GA on 2026-10-13; 5.0.0-ec.5 certified for v1.36 on 2026-08-04; OKD 5.0 shipped 2026-09-17
- Archetype: Full-stack enterprise platform
- Evidence grade: A. GA dates, Kubernetes minors, features and preview-to-GA moves come from Red Hat release notes, errata and the life-cycle API; partner programme, certifications and some pre-2020 capability states are B.
2. Scorecard
| Dimension | Score | Direction |
|---|---|---|
| Capability today | 93.8 / 100 | higher is better |
| Momentum since end of 2022 | +10.8 points | higher is better |
| Credibility | 21.5 / 25 | higher is better |
| Commercial risk | 8.5 / 25 | lower is better |
| Technical lock-in | 10.5 / 25 | lower is better |
| Integrator fit | 17.5 / 20 | higher is better |
| AI leverage | 14.0 / 20 | higher is better |
| Ledger Index | 80.9 / 100 | balanced weights |
3. Capability by domain
Scores 0 to 5 against fixed anchors; total is weighted to 100.
| Domain (weight) | 2016 | 2019 | 2022 | Today |
|---|---|---|---|---|
| Install, upgrade and lifecycle (12) | 3 | 4 | 4 | 4.5 |
| Bare metal, edge and on-prem infrastructure (10) | 2.5 | 3 | 4.5 | 5 |
| Multi-cluster and fleet management (10) | 0 | 0 | 4 | 4.5 |
| Networking (10) | 2.5 | 3.5 | 4.5 | 5 |
| Storage and data protection (10) | 2.5 | 3 | 4 | 4.5 |
| Security and compliance (12) | 3.5 | 3.5 | 4.5 | 4.5 |
| Developer platform (8) | 3.5 | 3.5 | 4.5 | 5 |
| Observability and day-2 operations (8) | 3 | 3.5 | 4 | 4.5 |
| VMs on Kubernetes (VMware exit) (10) | 0 | 1 | 4 | 5 |
| GPU and accelerator workloads (10) | 0 | 2 | 3.5 | 4.5 |
| Total / 100 | 41.0 | 54.2 | 83.0 | 93.8 |
Year by year: 2016: 41.0 · 2017: 43.0 · 2018: 47.0 · 2019: 54.2 · 2020: 70.4 · 2021: 79.2 · 2022: 83.0 · 2023: 84.2 · 2024: 85.0 · 2025: 90.8 · 2026: 93.8
What moved the score
| Year | Domain | Change | Points | Trigger |
|---|---|---|---|---|
| 2017 | Networking | 2.5 → 3 | +1.0 | OCP 3.7: network policy GA |
| 2017 | Storage and data protection | 2.5 → 3 | +1.0 | OCP 3.4: dynamic provisioning GA; Gluster container-native storage |
| 2018 | GPU and accelerator workloads | 0 → 2 | +4.0 | OCP 3.10: device plug-ins GA; GPUs only on RHEL nodes |
| 2019 | Bare metal, edge and on-prem infrastructure | 2.5 → 3 | +1.0 | OCP 4.2: installs in restricted networks, bare metal and vSphere by user-provisioned install |
| 2019 | Install, upgrade and lifecycle | 3 → 4 | +2.4 | OCP 4.1 and 4.2: operator-managed full-stack install and over-the-air upgrades on immutable RHCOS |
| 2019 | Networking | 3 → 3.5 | +1.0 | OCP 4.1 and 4.2: Multus, SR-IOV, Service Mesh 1.0 |
| 2019 | Observability and day-2 operations | 3 → 3.5 | +0.8 | Prometheus cluster monitoring and Telemeter in OCP 4.1 and 4.2 |
| 2019 | VMs on Kubernetes (VMware exit) | 0 → 1 | +2.0 | Container-native virtualization as Technology Preview only |
| 2020 | Bare metal, edge and on-prem infrastructure | 3 → 3.5 | +1.0 | OCP 4.5 and 4.6: vSphere and bare-metal installer-provisioned installs, three-node clusters |
| 2020 | GPU and accelerator workloads | 2 → 3 | +2.0 | NVIDIA GPU Operator and NFD supported on RHCOS by OCP 4.6 |
| 2020 | Multi-cluster and fleet management | 0 → 3.5 | +7.0 | Advanced Cluster Management 2.0 GA July 2020 |
| 2020 | Security and compliance | 3.5 → 4 | +1.2 | OCP 4.3 FIPS mode and etcd encryption; Compliance Operator in 4.6 |
| 2020 | Storage and data protection | 3 → 3.5 | +1.0 | OpenShift Container Storage 4.2 on Ceph and CSI support |
| 2020 | VMs on Kubernetes (VMware exit) | 1 → 3 | +4.0 | OpenShift Virtualization 2.4 GA July 2020 |
| 2021 | Bare metal, edge and on-prem infrastructure | 3.5 → 4 | +1.0 | OCP 4.9: single-node OpenShift supported for edge sites |
| 2021 | Developer platform | 3.5 → 4.5 | +1.6 | OpenShift Pipelines 1.4 and GitOps 1.1 GA April 2021, Serverless |
| 2021 | Multi-cluster and fleet management | 3.5 → 4 | +1.0 | OpenShift Platform Plus bundles ACM policy and governance with OCP |
| 2021 | Networking | 3.5 → 4.5 | +2.0 | OCP 4.6 to 4.9: OVN-Kubernetes GA, IPsec, dual stack, MetalLB |
| 2021 | Security and compliance | 4 → 4.5 | +1.2 | Advanced Cluster Security after the StackRox acquisition; CIS profile in Compliance Operator |
| 2021 | VMs on Kubernetes (VMware exit) | 3 → 4 | +2.0 | Migration Toolkit for Virtualization 2.2 GA December 2021, live migration |
| 2022 | Bare metal, edge and on-prem infrastructure | 4 → 4.5 | +1.0 | OCP 4.10 and 4.11: ARM support, Nutanix installer, oc-mirror GA |
| 2022 | GPU and accelerator workloads | 3 → 3.5 | +1.0 | GPU Operator with MIG and time slicing on OpenShift; GPU support on GCP in 4.10 |
| 2022 | Observability and day-2 operations | 3.5 → 4 | +0.8 | User workload monitoring, Log Forwarding API, Network Observability Operator |
| 2022 | Storage and data protection | 3.5 → 4 | +1.0 | OADP 1.0 Velero-based backup GA February 2022; ODF in Platform Plus from August 2022 |
| 2023 | Install, upgrade and lifecycle | 4 → 4.5 | +1.2 | OCP 4.14: EUS extended to 24 months with paid terms to 48; hosted control planes GA; median upstream lag still 188 days |
| 2024 | Developer platform | 4.5 → 5 | +0.8 | Red Hat Developer Hub (Backstage) GA January 2024 |
| 2025 | Bare metal, edge and on-prem infrastructure | 4.5 → 5 | +1.0 | OCP 4.20: arbiter-node clusters GA; 4.22 adds two-node fencing and Bare Metal as a Service GA |
| 2025 | Multi-cluster and fleet management | 4 → 4.5 | +1.0 | ACM 2.13 to 2.15, GitOps zero touch provisioning with PolicyGenerator GA in OCP 4.19, hosted control planes |
| 2025 | Networking | 4.5 → 5 | +1.0 | OCP 4.19: Gateway API GA and BGP routing; user-defined networks GA in 4.18 |
| 2025 | Observability and day-2 operations | 4 → 4.5 | +0.8 | OCP 4.19 Prometheus v3, Insights runtime extractor GA; 4.20 kdump GA |
| 2025 | VMs on Kubernetes (VMware exit) | 4 → 5 | +2.0 | OpenShift Virtualization Engine edition GA January 2025, MTV 2.x, hosted control planes on VMs |
| 2026 | GPU and accelerator workloads | 3.5 → 4.5 | +2.0 | OCP 4.21 DRA GPU allocation GA; Kueue GA; partitionable DRA devices preview in 4.22 |
| 2026 | Storage and data protection | 4 → 4.5 | +1.0 | OADP 1.6 and ODF 4.22; multi-volume VM snapshots with volume groups in OCP 4.22 |
4. Direction, 2023 to 2026
Each item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).
| Date | Item | Theme | Driver |
|---|---|---|---|
| 2023-10 | 4.14: hosted control planes GA on bare metal and OpenShift Virtualization | D1 Install and lifecycle | C |
| 2024-06 | 4.16: AdminNetworkPolicy GA, hosted control planes GA on AWS | D4 Networking | U |
| 2024-11 | OpenShift Lightspeed technology preview with 4.17 | D7 AI-assisted operations | M |
| 2025-01 | OpenShift Virtualization Engine, a VM-only edition | D12 Packaging and licensing | M |
| 2025-02 | 4.18: user-defined network segmentation GA, oc-mirror v2 GA | D4 Networking | C |
| 2025-05 | OpenShift Lightspeed GA | D7 AI-assisted operations | V |
| 2025-06 | 4.19: image mode for OpenShift and Gateway API GA | D1 Install and lifecycle | U |
| 2025-10 | 4.20: arbiter-node clusters GA, sigstore and user namespaces GA, post-quantum control-plane mTLS | D9 Security | C |
| 2026-01 | Zero trust workload identity manager GA (SPIRE based) | D9 Security | C |
| 2026-02 | 4.21: DRA attribute-based GPU allocation GA | D13 Accelerators | U |
| 2026-06 | 4.22: MCP server for OpenShift technology preview | D7 AI-assisted operations | V |
| 2026-06 | 4.22: two-node OpenShift with fencing GA for edge | D2 Bare metal, edge and infrastructure | C |
- Centre of gravity: AI-assisted operations (3), Install and lifecycle (2), Networking (2)
- Driver mix: Vision 17%, Customer need 42%, Market window 17%, Upstream 25%, Portfolio 0%
5. Credibility: 21.5 / 25
| Criterion | Score | Basis |
|---|---|---|
| Cadence | 4.5 | About three minors a year, each with dated GA errata and published life-cycle dates; 4.20 to 4.22 kept the rhythm |
| Roadmap transparency | 4 | Public release notes with preview trackers, public life-cycle API and enhancement repo; roadmap sessions mostly event-only |
| Say-do | 3.5 | 13 of 19 due previews or dated promises GA within 12 months (68%); Lightspeed missed its late-2024 date |
| Velocity | 5 | Several substantive features per minor, for example 4.20 arbiter clusters, sigstore GA and user namespaces GA |
| Lifecycle stability | 4.5 | EUS minors supported 24 months, paid terms to 36 and 48; forced reinstall only at the 3.x to 4.x move |
Say-do record, 2023 to 2026: 20 items 2023-2026 from preview trackers and press releases: 19 due, 13 GA within 12 months, 4 GA late (sigstore, user namespaces, OLM v1 sigstore, Lightspeed), 2 not GA (hosted control planes on OpenStack, MetalLB VRF in BGPPeer); MCP server not yet due. Both dated press promises slipped.
6. Commercial risk: 8.5 / 25 (lower is better)
| Criterion | Score | Basis |
|---|---|---|
| Price and licence volatility | 2 | Bare-metal metric changed twice: socket pair widened from 64 to 128 cores in 2025, replaced by per-node in 2026; new VM-only edition 2025 |
| Purchase constraints | 1.5 | Four editions from VM-only to Platform Plus, per core-pair or per node; no free supported edition |
| Channel and access | 1.5 | Docs and trials open, broad partner channel; updates and support need a subscription |
| Owner stability | 1.5 | IBM subsidiary since 2019, run as a separate unit; no product line sold or wound down |
| Cost of staying supported | 2 | Each minor needs upgrading within 18 to 24 months unless EUS terms are bought; ACM, ACS and ODF cost extra outside Platform Plus |
Security record of the product itself: No KEV entry in OpenShift components (KEV 2026.10.08). CVSS 9+ flaws 2025-2026: ACM CVE-2026-10090, -70398, -72508, -66786, -66788 (fixed 2026-08-26 and 2026-09-03), OpenShift Virtualization CVE-2026-7374 (same-day fix), OpenShift AI CVE-2025-10725 (same-day fix): Security reduced by the 0.5 cap.
7. Technical lock-in: 10.5 / 25 (lower is better)
| Criterion | Score | Basis |
|---|---|---|
| Formats | 2.5 | CNCF conformant every minor, but routes, SCCs, BuildConfigs and image streams are OpenShift APIs; Gateway API GA since 4.19 |
| Export path | 2 | OADP (Velero) backup and restore documented; no Red Hat guide for leaving OpenShift |
| Stack coupling | 3.5 | RHCOS required on every node; OVN-Kubernetes default since 4.12; CSI choice open |
| Hardware / cloud coupling | 0.5 | x86, ARM, Power and Z on bare metal, vSphere, Nutanix, OpenStack and clouds; installs fully disconnected |
| Skills and tooling coupling | 2 | oc, operators and MachineConfigs are OpenShift-specific but the skill pool is the largest in the category |
8. Integrator fit: 17.5 / 20
| Criterion | Score | Basis |
|---|---|---|
| Partner programme openness | 4.5 | Large open partner programme and certified operator ecosystem; programme tiers not re-checked in this pass |
| Multi-tenancy and self-service | 5 | Projects and RBAC, user-defined network isolation GA in 4.18, hosted control planes per tenant GA in 4.14 |
| API and infrastructure-as-code | 3.5 | Ansible collections, Helm, GitOps and Cluster API underneath; no official Terraform provider for self-managed clusters confirmed |
| Skills and certification | 4.5 | Red Hat certification exams for OpenShift administration and development; exam list not re-checked in this pass |
9. AI leverage: 14.0 / 20
| Strand | Today | Latest step |
|---|---|---|
| AI workload support | 3.5 | 2026: OCP 4.22: JobSet operator for distributed training |
| AI platform stack | 4.5 | 2025: OpenShift AI 3.0 GA November 2025 with distributed inference |
| AI-assisted operations | 3 | 2025: OpenShift Lightspeed GA May 2025, natural-language assistant in the console; cluster interaction still preview |
| Agent openness | 3 | 2026: OCP 4.22: MCP server for OpenShift and MCP gateway as Technology Preview with RBAC |
AI say-do: 4 tracked, 2 GA (Lightspeed about 5 to 6 months late, DRA GPU allocation on time), 1 pending (MCP server preview), 1 not confirmed (Lightspeed cluster interaction). Lightspeed answers questions and reads cluster context in preview; it does not act on the cluster.
10. Reading
Red Hat is turning OpenShift into one subscription platform for containers, VMs and AI, with its own OS, fleet manager and security add-ons. The record is dense and dated: three minors a year, most previews GA within a year, long EUS terms, but upstream Kubernetes lands about six months late. Buyers get the broadest capability in the category in exchange for RHCOS coupling, OpenShift-specific APIs and pricing that changed metric twice since 2025.
11. Open questions and evidence caveats
- Upstream lag: median 188 days for Kubernetes 1.27 to 1.35; 1.36 not shipped after 174 days.
- 2026 critical flaws cluster in ACM components; patch lag 14 to 21 days.
- Subscription metric for bare metal changed in 2025 and again in 2026; effect on price not public.
- Partner programme and certification facts not re-read in this pass (B).
- Per-node bare-metal metric: change falls between the 2025-12-25 snapshot and 2026-10-13, month unknown, so it is not in the dated items.
More from On-Prem Kubernetes Ledger 2026
- Overview: all platforms side by side
- On-Prem Kubernetes Ledger Methodology: How Every Score Is Built
- Amazon EKS Anywhere: On-Prem Kubernetes Ledger
- Canonical Kubernetes: On-Prem Kubernetes Ledger
- DaoCloud Enterprise: On-Prem Kubernetes Ledger
- Deckhouse Kubernetes Platform: On-Prem Kubernetes Ledger
- Giant Swarm managed platform: On-Prem Kubernetes Ledger
- Google Distributed Cloud, software only: On-Prem Kubernetes Ledger
- Kubermatic Kubernetes Platform: On-Prem Kubernetes Ledger
- KubeSphere: On-Prem Kubernetes Ledger
- Microsoft AKS on Azure Local: On-Prem Kubernetes Ledger
- Mirantis Kubernetes Engine: On-Prem Kubernetes Ledger
- Nutanix Kubernetes Platform: On-Prem Kubernetes Ledger
- OKD: On-Prem Kubernetes Ledger 2026
- Oracle Cloud Native Environment: On-Prem Kubernetes Ledger
- Platform9 Managed Kubernetes: On-Prem Kubernetes Ledger
- Sidero Labs Talos Linux and Omni: On-Prem Kubernetes Ledger
- Spectro Cloud Palette: On-Prem Kubernetes Ledger
- SUSE Rancher Prime: On-Prem Kubernetes Ledger
- Upstream Kubernetes: On-Prem Kubernetes Ledger 2026
- VMware vSphere Kubernetes Service: On-Prem Kubernetes Ledger