The Cloud Native Computing Foundation (CNCF) landscape is famously overwhelming. The interactive landscape map contains over 1,000 projects and products spanning every aspect of cloud-native infrastructure. For engineers trying to build or modernize their platform, navigating this landscape can feel like drinking from a fire hose.
This guide cuts through the noise. It explains how the CNCF organizes projects, highlights the most important tools in each category, and provides a framework for evaluating which projects deserve your attention.
Understanding CNCF Project Maturity
The CNCF categorizes hosted projects into three maturity levels, each with different implications for production readiness.
Graduated Projects
Graduated projects have demonstrated thriving adoption, a documented governance process, and a commitment to community sustainability. These are the projects you can bet your production infrastructure on. As of 2026, graduated projects include Kubernetes, Prometheus, Envoy, CoreDNS, containerd, Fluentd, Jaeger, Vitess, TUF, Helm, Harbor, Rook, etcd, OPA, Flux, Argo, Cilium, Istio, and several others.
Incubating Projects
Incubating projects have been adopted by a meaningful number of organizations and are being actively developed, but have not yet met all the criteria for graduation. These projects are generally production-ready but may have evolving APIs or governance structures. Examples include OpenTelemetry, Backstage, Dapr, KEDA, Crossplane, and Knative.
Sandbox Projects
Sandbox projects are early-stage efforts that the CNCF believes have potential but are not yet widely adopted. They receive minimal CNCF support and should be evaluated carefully before production use. Many sandbox projects never progress beyond this stage.
Container Orchestration
Kubernetes is the undisputed leader and the project around which the entire CNCF ecosystem revolves. It provides declarative container orchestration, automatic scaling, self-healing, and a powerful API that other tools extend.
For teams that find Kubernetes too complex, lighter alternatives exist. K3s (by Rancher/SUSE) is a certified Kubernetes distribution that runs in a single binary, suitable for edge deployments and resource-constrained environments. Nomad (by HashiCorp, not a CNCF project) provides simpler orchestration for teams that do not need the full Kubernetes API.
Service Mesh
A service mesh handles service-to-service communication, providing observability, traffic management, and security without requiring application code changes.
- Istio (Graduated): The most feature-rich service mesh, built on the Envoy proxy. Provides traffic management, mutual TLS, and observability. Complex to operate but extremely powerful.
- Linkerd (Graduated): A lighter-weight alternative to Istio, focused on simplicity and operational ease. Uses its own micro-proxy instead of Envoy.
- Cilium (Graduated): Uses eBPF for networking, observability, and security at the kernel level. Increasingly used as both a CNI plugin and a service mesh alternative, with lower overhead than sidecar-based approaches.
Networking
Kubernetes networking requires a Container Network Interface (CNI) plugin to provide pod-to-pod communication.
- Cilium: eBPF-based networking with built-in observability and security policies. Rapidly becoming the default CNI for new clusters.
- Calico: Mature CNI supporting both eBPF and iptables modes, with strong network policy support.
- CoreDNS (Graduated): The default DNS server for Kubernetes, providing service discovery for all pods and services in the cluster.
Observability
Observability is one of the richest categories in the CNCF landscape.
- Prometheus (Graduated): Metrics collection and alerting. The standard for Kubernetes monitoring.
- OpenTelemetry (Incubating): Vendor-neutral instrumentation for metrics, traces, and logs. Rapidly becoming the universal instrumentation standard.
- Jaeger (Graduated): Distributed tracing backend for visualizing request flows across microservices.
- Fluentd (Graduated): Log collection and forwarding. Routes logs from containers to storage backends like Elasticsearch or Loki.
- Grafana (not a CNCF project but deeply integrated): Visualization and dashboarding for metrics, logs, and traces.
Storage
Persistent storage in Kubernetes is provided through the Container Storage Interface (CSI).
- Rook (Graduated): Orchestrates Ceph storage within Kubernetes, providing block, file, and object storage.
- Longhorn (Incubating): Lightweight distributed block storage designed specifically for Kubernetes. Simpler to operate than Rook/Ceph.
Security
- Open Policy Agent (OPA) (Graduated): General-purpose policy engine that can enforce policies on Kubernetes admissions, API authorization, and more. Gatekeeper is the Kubernetes-specific integration.
- Falco (Incubating): Runtime security monitoring that detects anomalous behavior in containers and Kubernetes using eBPF.
- cert-manager (Incubating): Automates TLS certificate management in Kubernetes, integrating with Let's Encrypt and other certificate authorities.
- SPIFFE/SPIRE (Graduated): Provides cryptographic identities to workloads, enabling zero-trust networking without relying on network-level controls.
CI/CD and GitOps
- Argo (Graduated): Includes Argo CD (GitOps continuous delivery), Argo Workflows (workflow automation), Argo Rollouts (progressive delivery), and Argo Events (event-driven automation).
- Flux (Graduated): GitOps toolkit that synchronizes Kubernetes cluster state with Git repositories. Lighter-weight than Argo CD.
- Tekton (Incubating): Kubernetes-native CI/CD building blocks for creating pipelines as Kubernetes custom resources.
How to Evaluate CNCF Projects
With over a thousand projects in the landscape, you need a framework for deciding which ones deserve your attention.
Practical Evaluation Criteria
- Maturity level: Graduated projects are the safest bet. Be cautious with sandbox projects in production.
- Adoption signals: Check GitHub stars, contributor count, and most importantly, whether the project is used by organizations similar to yours. Conference talks and blog posts from production users are strong signals.
- Maintenance health: Look at recent commit frequency, issue response time, and whether maintainers are from diverse organizations (not just one company).
- Integration fit: Does the project integrate well with tools you already use? A technically superior tool that does not fit your existing stack creates friction.
- Operational cost: Every new tool adds operational overhead. Evaluate not just what the tool does but how much effort it takes to run, upgrade, and troubleshoot in production.
The CNCF landscape will continue to grow, but the core categories and graduated projects represent a stable foundation for building cloud-native infrastructure. Start with the graduated projects, adopt incubating projects when they solve a specific need, and evaluate sandbox projects with healthy skepticism.
