Are You Feeling Safe Just Because You See the CNCF "Graduated" Badge?
Open the CNCF (Cloud Native Computing Foundation) project landscape page, and you'll see a "Graduated" badge sitting next to Prometheus, Envoy, and Kubernetes itself. Many infrastructure engineers see that badge and immediately conclude, "this is safe for production." But few people can actually explain what is being reviewed behind that CNCF Graduated label.
CNCF projects are managed through a three-tier maturity model: Sandbox → Incubating → Graduated. According to the official definitions, Sandbox is for "early-stage, experimental, or innovative projects," Incubating means "the rate of change has slowed and the API has stabilized," and Graduated represents "the highest tier, demonstrating high stability, functionality, and broad adoption." There is also a fourth status, "Archived," for projects whose activity has stalled.
The problem is that these three tiers tend to be treated like a static pass/fail certificate. In reality, graduation is never a one-time exam — it is the result of an ongoing deliberative process carried out by the TOC (Technical Oversight Committee).
Kubernetes itself became the first project ever to reach "Graduated" status, in March 2018. At the time, out of 16 projects under the CNCF umbrella, Kubernetes was the only one to graduate. According to Publickey's reporting, this was explained as proof that Kubernetes "has the resilience to manage containers at scale for organizations of any size." Around the same time, ITmedia @IT's analysis noted that the certification criteria included "project governance, community maturity, code quality, and contribution levels." This article uses the actual TOC public meeting record and official documentation to lay out the criteria you should really be looking at when choosing OSS in the Kubernetes / K3s ecosystem. In the latter half, we'll also touch on how much of this evaluation burden individual companies should realistically bear themselves, and where a managed K8s platform built on CNCF-certified K3s, like Kubo, fits into that picture.
What TOC Public Meetings Reveal About the Unglamorous Reality of the Review Process
CNCF's TOC holds regular public meetings and publishes portions of the minutes. What gets discussed there is far more mundane and hands-on than you might expect. The criteria used to evaluate a project are often "not strictly tied to a written spec," and TOC members are continuously revisiting and revising the evaluation criteria themselves.
For example, there have been discussions where the due-diligence methodology used for one project's graduation review was later reconsidered based on lessons learned during a different project's review. This shows that criteria are not fixed once decided — they are continuously updated through ongoing discussion among TOC members.
According to the official TOC Due Diligence Guide, the review process moves through the following phases:
- Triage and assignment: TOC members confirm the application meets basic requirements and a sponsor is assigned
- Kickoff: The project team and TOC members agree on expectations and a schedule
- Criteria evaluation: The implementation is assessed against the requirements for the relevant maturity level
- Adopter interviews: At least three interviews with real adopting organizations to verify actual production use
- Internal review: Roughly a week of peer review among TOC members
- Public comment: Feedback is solicited from the community
- Vote: TOC members vote to approve or reject
(Source: CNCF TOC Due Diligence Guide)
As this process shows, a graduation review is never just a "code quality check." Adopter interviews are a mandatory, distinctly human step, and if scheduling with interviewees slips, the entire review timeline slips with it. The TOC public meeting minutes candidly describe exactly this kind of practical friction — delayed coordination, waiting on responses from interview candidates.
When and How Sandbox, Incubating, and Graduated Are Actually Reviewed
To avoid over-trusting the "graduated" badge, it's essential to understand precisely when and what gets reviewed at each maturity level.
The review timing is asymmetric
The CNCF's official Due Diligence Guide makes clear that review timing differs completely across the three tiers.
- Sandbox: No due diligence is performed at entry. Review only happens when the project applies to move to Incubating.
- Incubating: Review happens at the point of applying for Graduation.
- Graduated: Once a project reaches this tier, no further due diligence is conducted.
In other words, the mere fact that a project "is in Sandbox" may mean it has never actually undergone substantive TOC review. Conversely, "Graduated" status doesn't guarantee a project's current health, since no further review takes place after reaching that tier (Source: CNCF TOC Due Diligence Guide).
What's required to advance to Incubating
The core requirement for moving from Sandbox to Incubating is that "at least three independent adopters are actually using the project in production." Applicants are asked to line up interviews with five to seven adopters (Source: cncf/toc Issue #1967, CNCF Project Lifecycle). This "independent adoption" requirement reflects CNCF's emphasis on real-world ecosystem uptake, not just technical completeness.
Graduation isn't forever
CNCF also has an "Archived" status, to which projects move once their activity has stalled. The official CNCF Archived Projects page currently lists 26 projects, including Brigade, OpenTracing, rkt, Open Service Mesh, Pravega, and Keptn (Source: CNCF Archived Projects). Interestingly, projects can return from Archived status through a proposal process. OpenEBS, for instance, was archived once and later returned as a Sandbox project. In other words, both "graduation" and "retirement" are not fixed labels — they're outcomes of an ongoing deliberative process.
Weighing the Cost of Evaluating OSS Maturity Yourself Before Production Adoption
Is it realistic for an internal infrastructure team to reproduce this entire process on its own? The CNCF landscape lists hundreds of projects, and maturity levels are updated constantly. Just like tracking K8s version releases and release notes, keeping tabs on CNCF project maturity requires regular, ongoing attention.
As an interesting case in point, consider K3s, the lightweight Kubernetes distribution that Kubo is built on. K3s has passed CNCF's Certified Kubernetes Conformance Program and is a "certified Kubernetes distribution," meaning workloads built for standard Kubernetes run on it without modification (Source: K3s official site). At the same time, when K3s was donated to CNCF, Forbes' coverage noted that it was "the first Kubernetes distribution ever submitted to CNCF as a Sandbox project," framing this as evidence that community-driven development and governance were preserved even after SUSE's acquisition of Rancher.
The key point here is that "CNCF Conformance certification" (a technical compatibility check) and "CNCF's maturity labels" (Sandbox/Incubating/Graduated — a governance and adoption-based classification) are two entirely different axes of evaluation. The former verifies whether standard APIs are properly implemented; the latter reflects adoption within the ecosystem and governance maturity. Conflating the two — assuming "it's CNCF-certified, so it must be safe" — is exactly the misconception this article opened with.
Understanding these distinctions accurately, and tracking them continuously, takes real expertise and time. According to the 2025 CNCF Annual Survey, 82% of container-using organizations now run Kubernetes in production, and 98% of surveyed organizations have adopted cloud-native technologies. As the ecosystem grows, the cost of tracking each individual project's maturity in-house only increases.
That's precisely why, when choosing a managed K8s platform, it makes sense to consider entrusting the "ecosystem judgment calls" — which OSS components are chosen and how they're combined — to the platform itself, rather than just checking whether "Kubernetes runs." Kubo is built on CNCF Conformance-certified K3s and comes standard with core CNCF ecosystem components: Prometheus + Grafana for monitoring, cert-manager for certificate management, and integration with ArgoCD/Flux. Instead of chasing every individual OSS component's maturity status yourself, you can start from a foundation whose component combination and operational track record are already established — which is also the core idea behind Kubo Cloud's Pure Kubernetes concept (standards-compliant, no vendor lock-in).
Use Sandbox, Incubating, and Graduated as an "Entry Point" for Selection, Not a Verdict
As the TOC's public meeting minutes make clear, graduation review is not a bureaucratic rubber stamp — it's an accumulation of unglamorous, human processes: debating criteria that aren't strictly tied to a spec, revisiting existing due-diligence methods, and coordinating adopter interview schedules. Sandbox may mean a project hasn't undergone review at all; Incubating means it has demonstrated at least three independent production adopters; Graduated means it passed a TOC vote based on that track record. Understanding this asymmetry helps you avoid the shortcut thinking of "Graduated means safe" or "Sandbox means unusable."
That said, CNCF's labels are only an entry-point signal. The final call — fit with your own workloads, operational track record, and support — still requires separate judgment. To reduce that judgment cost, it's worth considering multi-cluster visibility through a Rancher-based management layer, or a managed K3s platform that comes standard with a CNCF-compliant toolchain. Next time you spot a CNCF badge, take one step further and look into the review process behind that label.