CNCF Project Maturity & Graduation

Every project underneath this course's nine tracks — Argo, Backstage, Cilium, Istio, Kyverno, OpenTelemetry, Prometheus — sits somewhere on a three-rung ladder the CNCF maintains for exactly this reason: Sandbox, Incubating, Graduated. Each cert's own blueprint page tells you what's on the exam. None of them tell you why the CNCF bothers ranking the projects underneath those exams at all, what actually gets checked at each rung, or why a project climbing — or conspicuously not climbing — is a signal worth reading on its own, independent of whatever this quarter's blueprint says. This page covers the ladder itself: what each tier actually certifies about a project's governance and adoption (not its code quality), how the Technical Oversight Committee reviews and votes on a promotion, and — the part with the most direct payoff for someone working this course's certification ladder — how maturity does and doesn't decide which projects get their own exam in the first place.

Three rungs, one ladder: Sandbox, Incubating, Graduated

☺ Like you're 10: Garage startup, funded startup with real customers, public company with auditors — three tiers, nothing fancier underneath.

The CNCF has organized every project it hosts into exactly three maturity tiers since its early years under the Linux Foundation, borrowing the general shape — a lightweight entry stage that graduates into progressively stricter ones — from the older Apache Software Foundation incubator model. Sandbox is the entry tier: a project that's cloud-native in scope, has adopted the CNCF's Code of Conduct, and carries an OSI-approved open-source license can apply, with no requirement yet that it be vendor-neutral, widely adopted, or even particularly stable. Incubating is the middle tier, reserved for projects that have started proving themselves: real production adoption, and — critically — committers drawn from more than one organization, so the project's continued existence doesn't depend on a single company's goodwill. Graduated is the top tier, reserved for projects that have cleared a strict, published bar on governance, security, and breadth of adoption. Kubernetes was the first project to reach Graduated, in 2018; Prometheus and Envoy followed the same year as the second and third. Every project this course's nine certifications sit on top of has climbed this same ladder, at its own pace, on its own schedule.

What actually gets checked at each gate

☺ Like you're 10: None of these questions are "is the code good?" — they're all "who else is depending on this, and who's watching the books?"

It's worth naming plainly what the criteria are not asking, because it's easy to assume otherwise: nothing in the CNCF's published graduation criteria scores test coverage, API stability, documentation quality, or how clever the architecture is. Every criterion is either an adoption question — is anyone besides the maintainers actually running this in production, and can they say so publicly — or a governance question — is any one company able to unilaterally kill or capture this project, and has anyone independent checked its security posture. Moving from Sandbox to Incubating is mostly the first adoption checkpoint: committers from at least two organizations (so the project survives one company losing interest), a documented pace of releases, and at least a handful of production adopters willing to be named. Moving from Incubating to Graduated raises both bars sharply: a maintained OpenSSF Best Practices Badge, an explicit and public governance document spelling out how decisions and committer promotions actually happen, a completed and published independent security audit, and a public adopter list broad and diverse enough to show the project isn't one company's internal tool wearing an open-source license.

## Graduation criteria checklist — condensed shape of a real
## CNCF TOC graduation review issue (per-project details vary)

- [x] Committers from at least 2 organizations
- [x] Achieved and actively maintains an OpenSSF Best Practices Badge
- [x] Publicly documented, formal project governance
- [x] Publicly documented, formal committer process
- [x] Completed an independent, published security audit
- [x] Public adopters list — diverse use cases, named production users
- [ ] TOC sponsor confirmed
- [ ] Public comment period closed, no unresolved objections
- [ ] 2/3 supermajority TOC vote scheduled

The TOC, a sponsor, and a vote — how a promotion actually happens

☺ Like you're 10: A project can't just declare itself grown-up — someone already on the inside has to vouch for it, in public, where anyone can object.

The CNCF's Technical Oversight Committee (TOC) — an elected body that oversees the technical direction of the entire CNCF project portfolio, landscape, and maturity process — is who actually moves a project between tiers, and it does not do it quietly. A project moving from Incubating to Graduated needs a sitting TOC member willing to sponsor it: put their own standing behind a public review issue vouching that the project meets the criteria. That review issue sits open for a public comment period — genuinely public, on GitHub, where any maintainer, end user, or competitor can raise an objection on the record before a vote happens. Only after that window closes does the TOC actually vote, and the bar rises with the tier: Sandbox admission today is largely a staff-and-community screening process against the published entry criteria, while Incubating and Graduated moves require the TOC itself to vote, with Graduated specifically requiring a two-thirds supermajority — not a simple majority — reflecting how much more is being vouched for. Sandbox isn't a permanent parking spot, either: the TOC conducts an annual health review of Sandbox projects, and ones that show no meaningful activity get archived and dropped from the CNCF landscape rather than left to linger indefinitely.

Reading graduation as a signal, not a rubric

☺ Like you're 10: "Graduated" tells you the company survived an audit. It doesn't tell you their product is the one you should buy.

The honest read of this ladder is narrower than it sounds. Graduated status is strong evidence that a project is vendor-neutral, well-governed, and adopted widely enough that betting a career or a production stack on it carries low political risk — no single company can quietly kill it, and an outside auditor has looked at its security posture. It is not evidence that the project is technically superior to an Incubating or Sandbox alternative, that its roadmap is more ambitious, or that it fits your specific use case better. Plenty of heavily used, actively developed, genuinely excellent projects sit in Incubating for years — not because they're unstable, but because the adoption-breadth and audit bar for Graduated is genuinely expensive to clear, and clearing it takes calendar time even for a project with no technical gaps at all. Treating "Incubating" as a synonym for "early access" or "not ready" is the single most common misreading of this ladder, and it's worth actively unlearning.

Where this course's nine certifications sit on the ladder

☺ Like you're 10: Nine exams, nine projects — and they are deliberately not all standing on the same rung.

Read against the ladder, this course's own certification lineup turns out to be a genuine mix of rungs, not a curated list of only-Graduated projects — which is itself informative about how the CNCF and the wider Linux Foundation actually decide to build a certification, covered in the next section. The CGOA and LFCS rows below are the two genuine exceptions to "one exam, one project," and are worth reading closely rather than skimming past.

Does maturity decide which projects get their own exam?

☺ Like you're 10: Getting your own exam is more like getting popular enough that people start asking for one — not a prize handed out for reaching the top rung.

The table above already answers this in practice: no, not directly. Kyverno and OpenTelemetry both got dedicated certifications while sitting in Incubating, and Backstage's exam exists at the same tier today. If Graduated status were a prerequisite for a certification to exist, none of those three would have one yet. What actually drives the decision to build an exam around a project is closer to a demand signal than a maturity gate: a large enough End User community asking for a hiring credential, a training and certification ecosystem (the Linux Foundation's own training arm, third-party bootcamps, employers) willing to invest in building and maintaining exam content, and — this part does connect back to the ladder — a project whose surface area is stable enough that a certification built around it this year is still accurate two years from now. That last condition is where maturity quietly matters after all: the same criteria that earn a project Graduated status — multiple independent committer organizations, a documented governance process, real production adoption — are also a decent proxy for "this project's API and CLI aren't about to be rewritten out from under an exam blueprint." It's not that graduation unlocks a certification; it's that the qualities graduation measures are close cousins of the qualities that make a certification worth building and safe to maintain.

This is also the cleanest way to understand why CGOA and LFCS don't fit the "one exam, one project" pattern at all. CGOA exists because GitOps as a practice had enough cross-project demand — Argo CD and Flux users alike wanted a vendor-neutral way to signal the underlying skill — that the CNCF built a practice-level exam sitting above both projects rather than picking one. LFCS predates the CNCF's maturity ladder entirely: it's a Linux Foundation professional certification about operating a Linux system, with no CNCF project, no TOC review, and no landscape entry behind it at all — a useful reminder that not everything in a "cloud native" study plan is CNCF-governed just because it shares a jacket and a badge wall with things that are. Multi-Project Platform Thinking picks up this same "compose, don't assume one governance model" instinct at the platform-architecture level rather than the certification level.