CNCF said in its Nov. 10 announcement that its Kubernetes AI Conformance Program has reached 40 certified platforms. The program's public repositories show what that badge records: mostly self-assessed checklists, a test suite recognizing only NVIDIA accelerators, and certificates that expire after one year. Anyone choosing a Kubernetes platform for GPU workloads should read "certified" as a baseline portability check, not a verdict on speed, security or hardware choice.

The announcement came during KubeCon + CloudNativeCon North America, which opened Nov. 9 in Salt Lake City and runs through Nov. 12. The "40" is also a cumulative count, since the repository sorts certified platforms by Kubernetes version, so it does not mean 40 platforms certified today against the current release.

What Does Kubernetes AI Certification Verify Beyond Basic Kubernetes Conformance?

The Certified Kubernetes AI Platform badge builds on base Kubernetes Conformance and adds a checklist for AI workloads. The v1.35 checklist has 12 items, nine marked MUST and three SHOULD, covering areas such as dynamic resource allocation, gang scheduling, accelerator metrics, cluster autoscaling and secure accelerator access. The v1.37 checklist has 15 items, eight MUST and seven SHOULD, and no longer lists dynamic resource allocation support as a separate item.

Vendors mostly document compliance themselves. A submission is a YAML checklist with public evidence, and vendors can mark an item N/A only with a justification. Starting with v1.37, the program recommends automated tests where they exist and allows manual attestation for the rest. In standards language, that is mostly first-party self-assessment, as opposed to independent third-party testing. CNCF's own March 2026 update described a roadmap toward automated verification beyond self-assessment.

Platform Listings Span Five Kubernetes Versions, and Only Four Reach v1.37

In a repository snapshot dated Oct. 29, 2026, TechTimes counted submissions for Kubernetes v1.33 through v1.37: 12 for v1.33, 23 for v1.34, 24 for v1.35, 15 for v1.36 and just four for v1.37. The four v1.37 listings are Google Kubernetes Engine (GKE), Kubermatic, RKE2 and Talos. Listings merged after that snapshot would not appear in this count.

The repository shows 41 distinct platform names once OKE (Oracle Container Engine for Kubernetes) and oke are treated as one, against CNCF's figure of 40, so the headline number cannot be reproduced exactly from public folders. Four platforms, Alauda, China Unicom Cloud, JD Cloud and JDOS, have a newest listing at v1.33. Even in v1.37, automated test output covers two requirement tests for RKE2 and three for GKE and Talos, while Kubermatic's covers seven. GKE's run reported 136 cases and no failures.

Upstream Test Suite Maps Accelerators to One Vendor: NVIDIA

The open-source test suite behind the badge contains a single accelerator configuration, keyed "nvidia," that names the gpu.nvidia.com device class, the nvidia.com/gpu resource and the /dev/nvidia device path, with a code comment reading "Add other vendors here". The command-line help says the default is NVIDIA and that support for other types is being added. If a platform names an unrecognized accelerator, the driver and runtime test logs an unknown status and skips, and the README expects manual evidence instead.

CNCF's pitch, in a statement from Jonathan Bryce, the foundation's executive director, in the Nov. 10 release, is that the work lets developers "retain choice across models, hardware and providers." The checklist itself is written around vendor-neutral Kubernetes mechanisms. The automated evidence, however, is currently NVIDIA-shaped, and analysts raised that concentration when the program launched in 2025. CUDA is NVIDIA's proprietary parallel computing platform, with AMD's ROCm, Intel-originated oneAPI and ZLUDA among the alternatives.

HAMi Shares GPUs by Intercepting CUDA Calls, and Software Limits Can Be Bypassed

HAMi, a CNCF project that became Incubating on July 2, 2026, splits one GPU among several containers. It combines a mutating webhook, a scheduler extender, device plugins and a library called HAMi-Core that intercepts CUDA calls and enforces memory and compute limits in software. A CNCF blog post from Aug. 7, 2026, says those limits can be bypassed through static linking, an environment variable that disables control, or containers started inside containers, so clusters with untrusted tenants need hardware partitioning such as NVIDIA's Multi-Instance GPU (MIG).

That limit matters because the badge does not measure isolation strength. Dynamic Resource Allocation (DRA), generally available in Kubernetes 1.34, is described in the same post as a promise tracker for allocation, so enforcing those promises is a separate matter. The suite's secure accelerator access test is a MUST requirement that checks that a pod can reach its device, cannot reach others' devices and that containers in one pod are isolated from each other. It is a device-mediation check, not a vulnerability scan.

Real-world flaws sit below that layer. Container-escape bugs in the NVIDIA Container Toolkit, CVE-2024-0132 and CVE-2025-23266, both scored 9.0 on the CVSS severity scale and are especially dangerous on shared GPU clusters. Gang scheduling, which runs related tasks together so a distributed job's workers are placed together or not at all, is also tested, with Kueue and Volcano exercised by the suite. The program's FAQ lets vendors substitute equivalents such as kai-scheduler for Volcano.

Certificates Lapse After One Year, and Eight Required Items Were Marked N/A

Certification is granted per product and per configuration and stays valid for one year from the date the checklist pull request is merged, with a 30-day window to cure non-conformance. Akamai's Linode Kubernetes Engine (LKE), whose only listing is v1.34, was merged on Nov. 5, 2025, so its one-year mark passed on Nov. 5, 2026, unless it renewed after the Oct. 29 snapshot. When a certificate expires, the license to use the mark ends.

Across all submissions, every MUST item is marked implemented except eight marked N/A: Talos for cluster autoscaling, accelerator metrics and AI-service metrics in both v1.33 and v1.34, DaoCloud for cluster autoscaling in v1.33, and a platform listed as nvke for cluster autoscaling in v1.36. Talos's notes say the platform does not provide integrated observability. The program's FAQ says an N/A justification cannot cite missing vendor support. In v1.36, 20 SHOULD items were marked not implemented and 58 implemented.

China's National Intelligence Law Article 7 Sits Outside What Certification Checks

Two platforms named by CNCF as newly certified in March 2026, JD Cloud and China Unicom Cloud, are operated by companies based in China. DaoCloud, also listed, has reported running HAMi across more than 10,000 GPUs in mainland China and Hong Kong. Customers weighing any such platform should know the legal condition that applies to companies there: National Intelligence Law Article 7, in force since June 28, 2017, requires organizations and citizens to support and cooperate with national intelligence work "in accordance with law."

Analysts differ on how far that reaches in practice. Jeremy Daum argues the provision lacks an enforcement mechanism but that direct requests from security forces would still be hard to resist. The Kubernetes AI conformance checklist does not test data-access obligations, and Bryce has said that extra security and regulatory needs fall outside the core standard. Nothing in the program materials reviewed for this article alleges that any certified platform has handed over data. The badge simply cannot answer the question either way, and no independent audit of that point appears in those materials.

CNCF Also Reported 231 Projects, 21.2 Million Developers and Eight New Platinum Members

The same Nov. 10 announcement said CNCF now hosts 231 projects and counts 21.2 million cloud native developers, up more than 5.5 million in 12 months. Eight companies joined at the Platinum level: Adyen, Broadcom, CoreWeave, CVS, HAProxy, NVIDIA, OVHcloud and Vultr. New Sandbox projects include OpenShell, led by NVIDIA, and Agent Substrate, and llm-d reached version 1.0. CNCF describes Sandbox projects as experimental, so those additions signal interest more than production readiness. CNCF also said it plans Kubernetes AI Associate (KAIA) and Certified Kubernetes Inference Engineer (CKIE) certifications for 2027.

Questions Buyers Should Ask Before Treating Certified as Verified

The decision framework is short. Ask which Kubernetes version the certificate covers and when it was merged. Ask whether the evidence came from automated test output or vendor attestation, and which accelerator vendor was tested. Ask for the N/A justifications. Then run your own performance and isolation tests, because the badge measures neither, and review jurisdiction and security separately, because it checks neither. Used that way, "certified" is a useful floor for portability across Kubernetes distributions. Read as proof of hardware choice, speed or safety, it promises more than its public record supports.

Frequently Asked Questions

What is Kubernetes AI Conformance?

It is a CNCF program that certifies Kubernetes platforms against a checklist for running AI workloads, built on top of base Kubernetes Conformance and awarded per product, per configuration, for one year.

Does certification mean a platform works equally well with AMD, Intel or Google accelerators?

Not on the evidence available. The upstream test suite currently defines only an NVIDIA accelerator type, and in the driver and runtime test unrecognized types are skipped with manual evidence expected instead, so the badge does not demonstrate hardware portability by itself.

Is the certification independently tested?

Mostly not. Submissions are vendor-completed checklists with evidence, and from v1.37 automated tests are recommended where they exist, with manual attestation for the rest.

Does the badge cover security or data-access risk?

No. The secure accelerator test checks device isolation, not vulnerabilities, and Bryce has said extra security and regulatory needs sit outside the core standard.