Upstream Kubernetes: On-Prem Kubernetes Ledger 2026

Part of the On-Prem Kubernetes Ledger (edition 2026-10-13). How the scores work: methodology.

1. Snapshot

Tier: Open-source engine
Owner: Cloud Native Computing Foundation / Linux Foundation (Graduated project, open governance by SIGs)
Licence model: Apache-2.0; nobody sells it; no commercial terms
Products scored: Kubernetes 1.37, kubeadm, Cluster API v1.14 with the kubeadm bootstrap and control-plane providers
Latest release: Kubernetes 1.37.0 on 2026-08-26 (patch 1.37.1 on 2026-09-15); Cluster API v1.14.0 on 2026-08-11
Next signal: Kubernetes 1.38.0 proposed for 2026-12-16 (SIG Release schedule)
Archetype: Reference engine
Evidence grade: A. Dates come from the GitHub releases API, the release announcements, the release history page and git history of the enhancements repository; only a few 2016 and 2019 cells rest on release announcements that give less detail.

2. Scorecard

Dimension	Score	Direction
Capability today	54.6 / 100	higher is better
Momentum since end of 2022	+2.6 points	higher is better
Credibility	21.5 / 25	higher is better
Commercial risk	not scored (engine: nothing to buy)
Technical lock-in	1.5 / 25	lower is better
Integrator fit	16.5 / 20	higher is better
AI leverage	4.5 / 20	higher is better
Ledger Index	66.3 / 100	balanced weights

3. Capability by domain

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2016	2019	2022	Today
Install, upgrade and lifecycle (12)	1	3	3.5	3.5
Bare metal, edge and on-prem infrastructure (10)	1.5	2.5	3	3
Multi-cluster and fleet management (10)	1	1.5	2	2
Networking (10)	1.5	2.5	3	3
Storage and data protection (10)	2	2.5	3	3
Security and compliance (12)	1.5	2.5	3	3.25
Developer platform (8)	1	1.5	2	1.5
Observability and day-2 operations (8)	1	2	2	2.5
VMs on Kubernetes (VMware exit) (10)	0	0.5	1.5	2
GPU and accelerator workloads (10)	0	2	2.5	3
Total / 100	21.2	41.8	52.0	54.6

Year by year: 2016: 21.2 · 2017: 21.2 · 2018: 21.2 · 2019: 41.8 · 2020: 42.8 · 2021: 42.8 · 2022: 52.0 · 2023: 52.0 · 2024: 54.0 · 2025: 55.0 · 2026: 54.6

What moved the score

Year	Domain	Change	Points	Trigger
2019	Bare metal, edge and on-prem infrastructure	1.5 → 2.5	+2.0	kubeadm on any Linux host with HA topologies; in-tree cloud providers; Cluster API still pre-0.3
2019	Developer platform	1 → 1.5	+0.8	custom resources GA in 1.16; Dashboard
2019	GPU and accelerator workloads	0 → 2	+4.0	hardware accelerator support alpha in 1.9; device plugin framework beta since 1.12
2019	Install, upgrade and lifecycle	1 → 3	+4.8	kubeadm GA in 1.13 (2018-12-03) with kubeadm upgrade; 9-month support window documented
2019	Multi-cluster and fleet management	1 → 1.5	+1.0	federation only in the 1.5 release notes; Cluster API pre-0.3
2019	Networking	1.5 → 2.5	+2.0	Network Policy API stable in 1.7; CoreDNS default in 1.13; IPVS kube-proxy GA in 1.11; implementation left to CNI plugins
2019	Observability and day-2 operations	1 → 2	+1.6	overhauled metrics in 1.16
2019	Security and compliance	1.5 → 2.5	+2.4	RBAC stable in 1.8, node authorizer 1.7, Network Policy stable
2019	Storage and data protection	2 → 2.5	+1.0	CSI GA in 1.13 (2018-12-03); local persistent volumes GA in 1.14
2019	VMs on Kubernetes (VMware exit)	0 → 0.5	+1.0	KubeVirt accepted to CNCF 2019-09-06 (community add-on, counted half)
2020	Storage and data protection	2.5 → 3	+1.0	volume snapshots stable in 1.20 (2020-12-08)
2022	Bare metal, edge and on-prem infrastructure	2.5 → 3	+1.0	Cluster API v1.3 (2022-12-01) with vSphere, OpenStack, Metal3 and cloud providers (listed by the providers' own teams)
2022	Developer platform	1.5 → 2	+0.8	server-side apply GA (1.22), ephemeral containers stable (1.25); Dashboard
2022	GPU and accelerator workloads	2 → 2.5	+1.0	device plugin framework stable in 1.26; Dynamic Resource Allocation alpha (2022-12-09)
2022	Install, upgrade and lifecycle	3 → 3.5	+1.2	Cluster API v1.0 (2021-10-06, v1beta1) and v1.3 (2022-12-01); one-year support since 1.19; three releases a year since 2021
2022	Multi-cluster and fleet management	1.5 → 2	+1.0	Cluster API v1.3 management clusters; Karmada and Open Cluster Management Sandbox projects [calibrated: capped at 2, upstream ships no add-ons]
2022	Networking	2.5 → 3	+1.0	Ingress GA (1.19), dual-stack GA (1.23), EndpointSlices; Gateway API v0.5.0 (2022-07-13)
2022	Security and compliance	2.5 → 3	+1.2	Pod Security admission stable and PodSecurityPolicy removed in 1.25 (2022-08-23); release artifacts signed (beta, 1.26)
2022	VMs on Kubernetes (VMware exit)	0.5 → 1.5	+2.0	KubeVirt CNCF Incubating 2022-04-19 (community add-on)
2024	Observability and day-2 operations	2 → 2.5	+0.8	structured logging, API server tracing stable in 1.30 (2024-04-17); no bundled metrics store, dashboards or alerting
2024	Security and compliance	3 → 3.5	+1.2	KMS v2 GA (1.29), ValidatingAdmissionPolicy stable (1.30), structured authorization stable (1.32), SPDX SBOMs; no FIPS, STIG, scanner or runtime detection
2025	GPU and accelerator workloads	2.5 → 3	+1.0	core of Dynamic Resource Allocation GA in 1.34 (2025-08-27), more DRA features stable in 1.37; drivers and GPU operators come from vendors [calibrated: capped at 3, upstream ships no add-ons]
2026	Developer platform	2 → 1.5	-0.8	Kubernetes Dashboard archived (post of 2026-06-01); Headlamp is the successor but not installed by kubeadm
2026	Security and compliance	3.5 → 3.25	-0.6	3.5 earned (structured authentication 1.34, user namespaces 1.36) less 0.25 for CVE-2024-9486, critical in Image Builder for Cluster API images (fixed 2024-10-14)
2026	VMs on Kubernetes (VMware exit)	1.5 → 2	+1.0	KubeVirt (still Incubating, v1.9.1 2026-10-12) with live migration and snapshots, counted half; nothing in kubeadm or Cluster API releases

4. Direction, 2023 to 2026

Each item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2023-08	Kubelet skew widened to n-3 (1.28)	D1 Install and lifecycle	C
2023-12	KMS v2 encryption at rest GA (1.29)	D9 Security	U
2024-04	ValidatingAdmissionPolicy and API server tracing stable (1.30)	D9 Security	U
2025-04	Sidecar containers and nftables kube-proxy stable (1.33)	D4 Networking	U
2025-08	Dynamic Resource Allocation core GA (1.34)	D13 Accelerators	M
2025-12	In-place pod resize stable (1.35)	D1 Install and lifecycle	C
2026-03	AI Gateway Working Group formed	D13 Accelerators	M
2026-03	ingress-nginx retired; Gateway API is the path forward	D4 Networking	P
2026-04	User namespaces and mutating admission policies stable (1.36)	D9 Security	U
2026-06	Kubernetes Dashboard archived; Headlamp named successor	D6 Developer platform	P
2026-08	Pod certificates and more DRA features stable (1.37)	D9 Security	U

Centre of gravity: Security (4), Install and lifecycle (2), Networking (2)
Driver mix: Vision 0%, Customer need 18%, Market window 18%, Upstream 45%, Portfolio 18%

5. Credibility: 21.5 / 25

Criterion	Score	Basis
Cadence	5	three minors a year on a published calendar, every minor from 1.26 to 1.37 on schedule; 1.38.0 proposed for 2026-12-16
Roadmap transparency	5	public enhancement proposals with milestones, open issue tracker, release schedule and release history with end-of-life dates
Say-do	3	8 of 13 tracked KEPs delivered within 12 months of the stated release (62%); 4 later, 1 dropped
Velocity	5	17 enhancements to stable in 1.30, 23 in 1.34; several substantive capabilities every release
Lifecycle stability	3.5	patch support about 14 months with clean in-place upgrades and n-3 skew, but no long-term version and forced removals (dockershim 1.24, PodSecurityPolicy 1.25, ingress-nginx 2026, Dashboard 2026)

Say-do record, 2023 to 2026: 13 KEPs tracked from kep.yaml history: 6 shipped in the promised release, 2 within 12 months (KMS v2 +120 days, user namespaces +126), 4 later (sidecar containers +371, structured authentication +379, node swap +743, in-place resize +609), 1 dropped (classic DRA, withdrawn 2024-10-04).

6. Commercial risk: not scored

This is an open-source engine: nobody sells it, so there are no commercial terms to score. Its project health is described below.

Security record of the product itself: No CISA KEV entry for Kubernetes or its sub-projects (file dated 2026-10-08). One critical flaw in an own component (CVE-2024-9486, Image Builder, 9.8, fixed v0.1.38 3 days after the advisory) subtracts 0.25; CVE-2025-1974 (ingress-nginx, 9.8) is not part of kubeadm or Cluster API and is not counted.

7. Technical lock-in: 1.5 / 25 (lower is better)

Criterion	Score	Basis
Formats	0	reference APIs; every conformant distribution uses the same objects
Export path	0	this is the standard other platforms export to; Velero and standard tools apply
Stack coupling	0.5	kubeadm needs a CRI, CNI and CSI choice made by the operator
Hardware / cloud coupling	0	any Linux or Windows host, fully self-hosted
Skills and tooling coupling	1	kubectl and Cluster API skills; assembly is left to the operator

8. Integrator fit: 16.5 / 20

Criterion	Score	Basis
Partner programme openness	4	open Certified Kubernetes programme and training partners; no vendor partner tiers
Multi-tenancy and self-service	3	namespaces, RBAC, quotas and network policy; hosted control planes only through third-party Cluster API providers
API and infrastructure-as-code	4.5	Cluster API and kubeadm are the standard infrastructure-as-code path; Terraform and Helm are third-party
Skills and certification	5	CKA, CKAD and CKS certifications from CNCF and the Linux Foundation

9. AI leverage: 4.5 / 20

Strand	Today	Latest step
AI workload support	2.5	2026: image volumes stable in 1.36, Inference Extension v1.0.0, AI Gateway Working Group (2026-03-09), gang scheduling beta in 1.37
AI platform stack	0	none
AI-assisted operations	1	2025: Headlamp AI Assistant plugin (2025-08-07), a community plugin for the SIG UI project, counted half
Agent openness	1	2016: documented Kubernetes REST API with OpenAPI; no official Kubernetes MCP server exists

AI say-do: 3 announced, 1 shipped on time, 1 shipped 364 days late, 0 preview, 0 pending, 1 dropped. Upstream ships GPU scheduling (scored under accelerators) and a few AI-adjacent pieces, but no AI platform, assistant or MCP server.

10. Reading

Upstream Kubernetes is the reference line for every other entry: three releases a year on schedule, public enhancement proposals, and nothing to buy. What it ships is an engine and a lifecycle tool, not a platform, so storage, networking, observability, developer tooling and virtualization are left to community add-ons or to the distributions built on it. The record is strong on cadence and openness and mixed on say-do, where six of thirteen tracked proposals reached stable later than stated and one was dropped.

11. Open questions and evidence caveats

Scored as kubeadm plus Cluster API only; a team that adds Cilium, Velero, KubeVirt and an observability stack gets more than the scores show, and pays for the assembly in skills.
Support is about 14 months per minor with no long-term version; Kubernetes 1.34 reaches end of life on 2026-10-27.
Say-do is measured from enhancement-proposal milestone changes, not from announced dates; delays of one to six minors are common.
Community add-ons (KubeVirt Incubating, Karmada Graduated, Metal3 Incubating) are counted at half; Gateway API and Cluster API providers are maintained by separate teams.