Executive Summary — Bounded Kubernetes (k3s on NVIDIA DGX Spark)
This assessment scores a Kubernetes control plane assembled from open-source components on a single node and bounded by one production workload, which supplies the product boundary that makes each function testable. k3s provides the orchestration kernel; the data plane (CloudNativePG with pgvector, MinIO), model serving (vLLM), local embeddings, identity (Keycloak), and ingress (Traefik) are assembled and operated by the enterprise. The gap portfolio is dominated by Closeable gaps at the catalog and integration layers: application catalog, developer self-service, event fabric, workflow orchestration, and API management are absent and must be acquired and operated as additional open-source components. The context fabric is provided at retrieval, where the vector store and local inference are self-hosted and drilled, while the estate-scale data functions — gravity awareness, governance metadata, lineage — are absent. FC-0 substrate is Ceded to the hardware vendor. FC-2C reasoning is Structural and absent, consistent with on-prem. Identity continuity is partial: the self-hosted Keycloak plane reaches the workload runtime but not the remaining layers, and the enterprise owns extending it. The buyer's trade is authority for operational responsibility. Under DAPM the assembly is Retained above the substrate: every capability is open-source and swappable without rebuilding, so no vendor holds the enterprise's accumulated opinions. The cost is that the enterprise operates every layer it retains. Each provided function carries a lifecycle the enterprise owns, and each absent function is a component it must acquire, deploy, and maintain. The substrate is the single Ceded exception, bound to the hardware vendor.
Identity plane continuity: partial, score 2. A federated identity plane is present as a self-hosted Keycloak instance running on the platform's own Postgres, issuing OIDC tokens with RS256 signing. It reaches the workload runtime: the application validates realm tokens and authenticates against them, rejecting unauthenticated requests. It does not yet span orchestration, catalog, or integration, so continuity is partial. The enterprise owns the identity provider and must extend it — additional clients and single sign-on — to reach the remaining layers.
FC-0 — Physical & Virtual Substrate
Hardware lifecycle management · score 1, gap closeable, DAPM Ceded Provided: none. k3s runs on the host operating system but does not lifecycle node hardware, firmware, or the OS. The substrate is a single vendor appliance whose accelerator and driver are vendor-maintained. The enterprise provisions and updates the node manually; a managed model requires fleet tooling (Cluster API, Metal3) the platform does not include.
Substrate heterogeneity · score 1, gap structural, DAPM Ceded Provided: none. The substrate is one aarch64 node, so there is no heterogeneity to manage until additional or dissimilar nodes exist. Adding nodes is a separate deployment, not a capability the platform closes here.
Substrate portability · score 2, gap structural, DAPM Retained Provided: the assembled workload is portable — containers, a served model, and an embedder that move to any conformant Kubernetes. The accelerator path is bound to the vendor appliance and its driver. The enterprise keeps the software's portability; the GPU binding is a constraint of the chosen hardware.
FC-1 — Distributed Data & Context Fabric
Data location and gravity awareness · score 1, gap closeable, DAPM Retained Provided: none. The platform has no data-location or gravity awareness; all data is local to the single node. The enterprise owns any multi-location placement, and closing this at estate scale requires a data-fabric layer the platform does not include.
Governance and compliance metadata · score 1, gap closeable, DAPM Retained Provided: none. No governance or compliance metadata layer is present. The enterprise must acquire and operate a data catalog and policy tooling (for example OpenMetadata) to close it.
Retrieval and context services · score 3, gap closeable, DAPM Retained Provided: a self-hosted document and vector store on the CloudNativePG operator with pgvector, serving grounded retrieval to the workload and surviving a force-kill restart with full vector recovery. The enterprise owns the operator lifecycle, the index build, and the recovery-point policy. No managed vector service is included; the capability is assembled from open-source components the enterprise runs itself.
Data pipeline and lineage · score 2, gap closeable, DAPM Retained Provided: an ingest path that chunks, embeds, and loads the corpus. No lineage or provenance tracking is present. The enterprise owns pipeline orchestration and must acquire lineage tooling to close the gap.
FC-2A — Infrastructure Orchestration
Workload universality · score 3, gap structural, DAPM Retained Provided: the Kubernetes API surface schedules containers of any shape across the node. VM and bare-metal workload types are not addressed by this assembly, so coverage is container-scoped. The enterprise holds full control of workload placement.
Resource lifecycle automation · score 3, gap closeable, DAPM Retained Provided: operator-driven resource lifecycle for the data tenant — the CloudNativePG operator handles provisioning, failover, backup, and replica creation without operator action, demonstrated by an automatic standby provision on scale-out. The enterprise owns operator selection and upgrades; lifecycle automation for other tenants requires deploying their operators.
Policy and quota enforcement · score 1, gap closeable, DAPM Retained Provided: Kubernetes-native RBAC and resource limits. No admission-control policy engine and no GPU quota are present. The enterprise must acquire and operate a policy engine (Kyverno, OPA Gatekeeper) and, for GPU quota, extend the open-source device plugin.
Substrate lifecycle integration · score 1, gap closeable, DAPM Retained Provided: none. The control plane does not integrate substrate lifecycle. The gap is high-effort to close on a single node with limited return, and the enterprise owns it.
Accelerator and GPU management · score 2, gap closeable, DAPM Retained Provided: GPU access to scheduled pods through runtime-class injection. GPU accounting and quota are not provided: the driver cannot report unified memory, so the standard device plugin schedules no GPU capacity. The enterprise can close accounting by extending the open-source device plugin; the platform ships no supported path.
FC-2B — Execution & Runtime
Runtime universality · score 3, gap structural, DAPM Retained Provided: a container runtime for any workload the enterprise packages, over the Kubernetes API. Non-container runtimes are out of scope for this assembly. The enterprise holds runtime control.
Persona abstraction at execution · score 1, gap closeable, DAPM Retained Provided: none. There is no persona or tenant abstraction at the execution layer. The enterprise must build or acquire it.
Execution lifecycle and observability · score 2, gap mixed, DAPM Retained Provided: pod lifecycle and self-healing — a force-killed pod is recreated without operator action. Observability is not included: no metrics, logging, or tracing stack is deployed. The enterprise must acquire and operate an observability stack (Prometheus, Grafana, Loki) to close the second half of the function.
AI inference and agent execution · score 3, gap closeable, DAPM Retained Provided: model serving on the cluster via vLLM, delivering the workload's grounded, cited generation end to end over the ingress with no external dependency. The enterprise owns the model, the memory budget, and serving uptime. No managed inference is included; the capability is self-hosted.
FC-2C — The Reasoning Plane
Autonomous placement reasoning · score 0, gap structural, DAPM Retained Provided: none. No policy-driven placement reasoning derives from live metadata, and no such reasoning plane exists in this assembly. Placement decisions rest with the enterprise and its operators. The gap is structural: the reasoning plane is unavailable on-prem.
FC-3 — Application Distribution and Governance
Application catalog and distribution · score 1, gap closeable, DAPM Retained Provided: none. Deployments are applied as manifests directly. The enterprise must acquire and operate a GitOps or catalog layer (Argo CD, a Helm-based catalog) to close it.
Application lifecycle governance · score 2, gap closeable, DAPM Retained Provided: operator-level day-2 governance for the data tenant (backup, restore, and replica lifecycle). No application-wide governance layer spans the estate. The enterprise owns broader lifecycle governance and must assemble it.
Developer experience and self-service · score 1, gap closeable, DAPM Retained Provided: none. There is no self-service portal or golden-path tooling. The enterprise must acquire and operate a developer portal (Backstage) to close it.
AI application and agent distribution · score 1, gap closeable, DAPM Retained Provided: none. There is no packaging or distribution mechanism for AI applications or agents. The enterprise owns it.
FC-4 — Integration Fabric
Event fabric and messaging · score 1, gap closeable, DAPM Retained Provided: none. There is no managed event or messaging fabric. The enterprise must acquire and operate a broker (NATS, Kafka) if the workload requires one.
API management and gateway · score 2, gap closeable, DAPM Retained Provided: ingress and TLS termination via Traefik, routing external traffic to the workload over HTTPS. API management is not included: no rate limiting, authentication, or lifecycle at the edge. The enterprise must acquire an API management layer (Kong, an equivalent gateway) to close it.
Workflow and process orchestration · score 1, gap closeable, DAPM Retained Provided: none. There is no workflow or process orchestration. The enterprise must acquire and operate a workflow engine (Argo Workflows, Temporal).
SaaS and enterprise system integration · score 1, gap opinion, DAPM Retained Provided: none, by design. The deployment carries no external SaaS or enterprise-system connectors; external integration was deliberately excluded. The runtime can host connectors the enterprise applies if integration is later required.
AI-native integration · score 1, gap closeable, DAPM Retained Provided: the workload integrates its own retrieval and model internally. No platform-level AI-native integration fabric is present. The enterprise owns cross-application AI integration.
Bounded Kubernetes (k3s on NVIDIA DGX Spark)
CompleteFourth Cloud Control Plane Assessment - Kubernetes, bounded by a workload
How to read these scores
The Fourth Cloud instrument scores functions within layers, not layers as aggregates. Each function gets a 0–4 score, a gap ownership classification, and a DAPM authority classification. The layer is a grouping; the function score is the finding.
Score gradient (0–4)
- 4 — Hyperscaler. AWS/hyperscaler equivalent — fully managed, fully automated.
- 3 — Strong. Meaningful automation and integration. Narrow, well-understood gaps.
- 2 — Moderate. Partial coverage within constraints the vendor does not control.
- 1 — Weak. Addressed for some workload types but not others; manual-assisted.
- 0 — Absent. Vendor provides nothing. Enterprise owns the function entirely.
Gap ownership (every score < 4)
- Closeable. Enterprise must acquire new capability — new software, vendor, or contract.
- Opinion. Primitives exist; enterprise applies configuration without new acquisition.
- Vendor roadmap. Vendor has announced product intent with a timeline.
- Structural. Consequence of the on-prem operating model — no near-term close.
DAPM authority
- Retained. Enterprise can swap providers without rebuilding. Default when vendor provides nothing.
- Delegated. Substitutable partner provides this capability — alternatives exist.
- Ceded. Vendor's opinions are proprietary with no open exit; lift-to-leave requires rebuild.
- Absent. No capability exists at this layer.
Full Authority, Fully Assembled
This assessment scores a Kubernetes control plane assembled from open-source components on a single node and bounded by one production workload, which supplies the product boundary that makes each function testable. k3s provides the orchestration kernel; the data plane (CloudNativePG with pgvector, MinIO), model serving (vLLM), local embeddings, identity (Keycloak), and ingress (Traefik) are assembled and operated by the enterprise.
The gap portfolio is dominated by Closeable gaps at the catalog and integration layers: application catalog, developer self-service, event fabric, workflow orchestration, and API management are absent and must be acquired and operated as additional open-source components. The context fabric is provided at retrieval, where the vector store and local inference are self-hosted and drilled, while the estate-scale data functions — gravity awareness, governance metadata, lineage — are absent. FC-0 substrate is Ceded to the hardware vendor. FC-2C reasoning is Structural and absent, consistent with on-prem.
Identity continuity is partial: the self-hosted Keycloak plane reaches the workload runtime but not the remaining layers, and the enterprise owns extending it.
The buyer's trade is authority for operational responsibility. Under DAPM the assembly is Retained above the substrate: every capability is open-source and swappable without rebuilding, so no vendor holds the enterprise's accumulated opinions. The cost is that the enterprise operates every layer it retains. Each provided function carries a lifecycle the enterprise owns, and each absent function is a component it must acquire, deploy, and maintain. The substrate is the single Ceded exception, bound to the hardware vendor.
Source:Scored on the Fourth Cloud methodology (v2.4) against the assembled stack a single production workload requires. Each score was earned by a validator that executed during a live, cloud-free deployment on the node. Fixed function taxonomy; gap ownership on every score below 4; DAPM per function.
This row scores a Kubernetes control plane bounded by a single production workload. Kubernetes has no product boundary to assess in the abstract because it is an assembly; the workload supplies that boundary, and each function is scored against what the assembled, deployed stack provides, earned by a validator that executed during the deployment. The assessed assembly is k3s with CloudNativePG and pgvector, MinIO, Keycloak, vLLM, a local embedding model, and Traefik, on a single NVIDIA DGX Spark. Every open gap names the component the enterprise would acquire, deploy, and operate to close it.
Partial federation identity plane
A federated identity plane is present as a self-hosted Keycloak instance running on the platform's own Postgres, issuing OIDC tokens with RS256 signing. It reaches the workload runtime: the application validates realm tokens and authenticates against them, rejecting unauthenticated requests. It does not yet span orchestration, catalog, or integration, so continuity is partial. The enterprise owns the identity provider and must extend it — additional clients and single sign-on — to reach the remaining layers.
Methodology v2.3 · Grounded in Townsend (2025), Fourth Cloud Readiness Assessment and Evaluation Framework v0.9. See how to read these scores.