cncf-toc@lists.cncf.io

Re: OPA to graduation

Liz Rice

#5544

I really like OPA, and the project is doing tons of things really well, but I am struggling to add a +1 on the voting thread for it. When we move something to graduation, the TOC is sending a strong message that we think it's ready for end users to run in production - but to me it's not exactly clear what we're recommending. Anecdotally it seems to me that for a lot of folks in our community, OPA is synonymous with Gatekeeper. And that's a really useful component, and I don't want to do a disservice to the great work being done on it, but I don't think it's necessarily true that webhook + Gatekeeper is a robust, scalable solution that end users can assume they can deploy today with little-to-no risk.

I am very open to hearing why my concern is misplaced - for example am I missing messaging about other situations where OPA is being widely used, or how Gatekeeper is positioned?

Re: [VOTE] Open Policy Agent from incubating to graduated

Klaus Ma

#5543

+1 nb :)

Show quoted text

On Wed, Dec 9, 2020 at 6:27 AM Jakub Scholz <jakub@...> wrote:

+1 (non-binding)

On Wed, Sep 30, 2020 at 6:06 PM Amye Scavarda Perrin <ascavarda@...> wrote:
The Open Policy Agent project has applied for graduation from incubation to graduated. (https://github.com/cncf/toc/pull/520)

The due diligence document can be found here: https://docs.google.com/document/d/19M5fTpe57rQIMNxawRl5wSWvJUapuzY-CkV4O5pvieU/edit

Brendan Burns has called for public comment: https://lists.cncf.io/g/cncf-toc/message/5281

Please vote (+1/0/-1) by replying to this thread.

Remember that the TOC has binding votes only, but we do appreciate non-binding votes from the community as a sign of support!

--
Amye Scavarda Perrin | Program Manager | amye@...

Re: [VOTE] Open Policy Agent from incubating to graduated

Jakub Scholz <jakub@...>

#5542

+1 (non-binding)

Show quoted text

On Wed, Sep 30, 2020 at 6:06 PM Amye Scavarda Perrin <ascavarda@...> wrote:

The Open Policy Agent project has applied for graduation from incubation to graduated. (https://github.com/cncf/toc/pull/520)

The due diligence document can be found here: https://docs.google.com/document/d/19M5fTpe57rQIMNxawRl5wSWvJUapuzY-CkV4O5pvieU/edit

Brendan Burns has called for public comment: https://lists.cncf.io/g/cncf-toc/message/5281

Please vote (+1/0/-1) by replying to this thread.

Remember that the TOC has binding votes only, but we do appreciate non-binding votes from the community as a sign of support!

--
Amye Scavarda Perrin | Program Manager | amye@...

Re: [VOTE] Open Policy Agent from incubating to graduated

Emily Fox

#5541

+1 NB

~Emily Fox

@TheMoxieFox

Show quoted text

On Tue, Dec 8, 2020 at 12:58 PM kensipe <kensipe@...> wrote:

+1 NB

On Dec 8, 2020, at 11:10 AM, Isaac Mosquera via lists.cncf.io <isaac=armory.io@...> wrote:

+1 NB

On Tue, Dec 8, 2020 5:08 PM, Brandon Lum lumjjb@... wrote:
+1 NB

On Tue, Dec 8, 2020 at 12:05 PM Ricardo Aravena <raravena80@...> wrote:
+1 nb

On Wed, Sep 30, 2020 at 9:01 AM Amye Scavarda Perrin <ascavarda@...> wrote:
The Open Policy Agent project has applied for graduation from incubation to graduated. (https://github.com/cncf/toc/pull/520)

The due diligence document can be found here: https://docs.google.com/document/d/19M5fTpe57rQIMNxawRl5wSWvJUapuzY-CkV4O5pvieU/edit

Brendan Burns has called for public comment: https://lists.cncf.io/g/cncf-toc/message/5281

Please vote (+1/0/-1) by replying to this thread.

Remember that the TOC has binding votes only, but we do appreciate non-binding votes from the community as a sign of support!

--
Amye Scavarda Perrin | Program Manager | amye@...

#velocity,

I S A A C M O S Q U E R A
Chief Technology Officer
e: isaac@...
p: 703.795.5322
t: imosquera

Re: [VOTE] Open Policy Agent from incubating to graduated

kensipe

#5540

+1 NB

Show quoted text

On Dec 8, 2020, at 11:10 AM, Isaac Mosquera via lists.cncf.io <isaac=armory.io@...> wrote:

+1 NB

On Tue, Dec 8, 2020 5:08 PM, Brandon Lum lumjjb@... wrote:
+1 NB

On Tue, Dec 8, 2020 at 12:05 PM Ricardo Aravena <raravena80@...> wrote:
+1 nb

On Wed, Sep 30, 2020 at 9:01 AM Amye Scavarda Perrin <ascavarda@...> wrote:
The Open Policy Agent project has applied for graduation from incubation to graduated. (https://github.com/cncf/toc/pull/520)

The due diligence document can be found here: https://docs.google.com/document/d/19M5fTpe57rQIMNxawRl5wSWvJUapuzY-CkV4O5pvieU/edit

Brendan Burns has called for public comment: https://lists.cncf.io/g/cncf-toc/message/5281

Please vote (+1/0/-1) by replying to this thread.

Remember that the TOC has binding votes only, but we do appreciate non-binding votes from the community as a sign of support!

--
Amye Scavarda Perrin | Program Manager | amye@...

#velocity,

I S A A C M O S Q U E R A
Chief Technology Officer
e: isaac@...
p: 703.795.5322
t: imosquera

Re: [VOTE] Open Policy Agent from incubating to graduated

Jon Mittelhauser

#5539

+1 nb

From: <cncf-toc@...> on behalf of "Isaac Mosquera via lists.cncf.io" <isaac=armory.io@...>
Reply-To: <isaac@...>
Date: Tuesday, December 8, 2020 at 9:10 AM
To: Brandon Lum <lumjjb@...>
Cc: Ricardo Aravena <raravena80@...>, Amye Scavarda Perrin <ascavarda@...>, CNCF TOC <cncf-toc@...>
Subject: Re: [cncf-toc] [VOTE] Open Policy Agent from incubating to graduated

+1 NB

On Tue, Dec 8, 2020 5:08 PM, Brandon Lum lumjjb@... wrote:

+1 NB

On Tue, Dec 8, 2020 at 12:05 PM Ricardo Aravena <raravena80@...> wrote:
+1 nb

On Wed, Sep 30, 2020 at 9:01 AM Amye Scavarda Perrin <ascavarda@...> wrote:
The Open Policy Agent project has applied for graduation from incubation to graduated. (https://github.com/cncf/toc/pull/520)

The due diligence document can be found here: https://docs.google.com/document/d/19M5fTpe57rQIMNxawRl5wSWvJUapuzY-CkV4O5pvieU/edit

Brendan Burns has called for public comment: https://lists.cncf.io/g/cncf-toc/message/5281

Please vote (+1/0/-1) by replying to this thread.

Remember that the TOC has binding votes only, but we do appreciate non-binding votes from the community as a sign of support!

--
Amye Scavarda Perrin | Program Manager | amye@...

#velocity,

I S A A C M O S Q U E R A

Chief Technology Officer

e: isaac@...

p: 703.795.5322

t: imosquera

Re: [VOTE] Open Policy Agent from incubating to graduated

Isaac Mosquera

#5538

+1 NB

On Tue, Dec 8, 2020 5:08 PM, Brandon Lum lumjjb@... wrote:

+1 NB

On Tue, Dec 8, 2020 at 12:05 PM Ricardo Aravena <raravena80@...> wrote:
+1 nb

On Wed, Sep 30, 2020 at 9:01 AM Amye Scavarda Perrin <ascavarda@...> wrote:
The Open Policy Agent project has applied for graduation from incubation to graduated. (https://github.com/cncf/toc/pull/520)

The due diligence document can be found here: https://docs.google.com/document/d/19M5fTpe57rQIMNxawRl5wSWvJUapuzY-CkV4O5pvieU/edit

Brendan Burns has called for public comment: https://lists.cncf.io/g/cncf-toc/message/5281

Please vote (+1/0/-1) by replying to this thread.

Remember that the TOC has binding votes only, but we do appreciate non-binding votes from the community as a sign of support!

--
Amye Scavarda Perrin | Program Manager | amye@...

#velocity,

I S A A C M O S Q U E R A

Chief Technology Officer

e: isaac@...

p: 703.795.5322

t: imosquera

Re: [VOTE] Open Policy Agent from incubating to graduated

Brandon Lum

#5537

+1 NB

Show quoted text

On Tue, Dec 8, 2020 at 12:05 PM Ricardo Aravena <raravena80@...> wrote:

+1 nb

On Wed, Sep 30, 2020 at 9:01 AM Amye Scavarda Perrin <ascavarda@...> wrote:
The Open Policy Agent project has applied for graduation from incubation to graduated. (https://github.com/cncf/toc/pull/520)

The due diligence document can be found here: https://docs.google.com/document/d/19M5fTpe57rQIMNxawRl5wSWvJUapuzY-CkV4O5pvieU/edit

Brendan Burns has called for public comment: https://lists.cncf.io/g/cncf-toc/message/5281

Please vote (+1/0/-1) by replying to this thread.

Remember that the TOC has binding votes only, but we do appreciate non-binding votes from the community as a sign of support!

--
Amye Scavarda Perrin | Program Manager | amye@...

Re: [VOTE] Open Policy Agent from incubating to graduated

Ricardo Aravena

#5536

+1 nb

Show quoted text

On Wed, Sep 30, 2020 at 9:01 AM Amye Scavarda Perrin <ascavarda@...> wrote:

The Open Policy Agent project has applied for graduation from incubation to graduated. (https://github.com/cncf/toc/pull/520)

The due diligence document can be found here: https://docs.google.com/document/d/19M5fTpe57rQIMNxawRl5wSWvJUapuzY-CkV4O5pvieU/edit

Brendan Burns has called for public comment: https://lists.cncf.io/g/cncf-toc/message/5281

Please vote (+1/0/-1) by replying to this thread.

Remember that the TOC has binding votes only, but we do appreciate non-binding votes from the community as a sign of support!

--
Amye Scavarda Perrin | Program Manager | amye@...

Re: [EXTERNAL] [cncf-toc] [VOTE] Open Policy Agent from incubating to graduated

Tim St. Clair

#5535

+1 Non-binding

Show quoted text

From: cncf-toc@... <cncf-toc@...> on behalf of Davanum Srinivas via lists.cncf.io <davanum=gmail.com@...>
Sent: Tuesday, December 8, 2020 10:48 AM
To: bburns@... <bburns@...>
Cc: CNCF TOC <cncf-toc@...>; ascavarda@... <ascavarda@...>
Subject: Re: [EXTERNAL] [cncf-toc] [VOTE] Open Policy Agent from incubating to graduated

+1 Non-binding

On Tue, Dec 8, 2020 at 11:45 AM Brendan Burns via lists.cncf.io <bburns=microsoft.com@...> wrote:

+1, Binding

From: cncf-toc@... <cncf-toc@...> on behalf of Amye Scavarda Perrin via lists.cncf.io <ascavarda=linuxfoundation.org@...>
Sent: Wednesday, September 30, 2020 9:00 AM
To: CNCF TOC <cncf-toc@...>
Subject: [EXTERNAL] [cncf-toc] [VOTE] Open Policy Agent from incubating to graduated

The Open Policy Agent project has applied for graduation from incubation to graduated. (https://github.com/cncf/toc/pull/520)

The due diligence document can be found here: https://docs.google.com/document/d/19M5fTpe57rQIMNxawRl5wSWvJUapuzY-CkV4O5pvieU/edit

Brendan Burns has called for public comment: https://lists.cncf.io/g/cncf-toc/message/5281

Please vote (+1/0/-1) by replying to this thread.

Remember that the TOC has binding votes only, but we do appreciate non-binding votes from the community as a sign of support!

--

Amye Scavarda Perrin | Program Manager | amye@...

--

Davanum Srinivas :: https://twitter.com/dims

Re: [EXTERNAL] [cncf-toc] [VOTE] Open Policy Agent from incubating to graduated

Davanum Srinivas

#5534

+1 Non-binding

Show quoted text

On Tue, Dec 8, 2020 at 11:45 AM Brendan Burns via lists.cncf.io <bburns=microsoft.com@...> wrote:

+1, Binding

From: cncf-toc@... <cncf-toc@...> on behalf of Amye Scavarda Perrin via lists.cncf.io <ascavarda=linuxfoundation.org@...>
Sent: Wednesday, September 30, 2020 9:00 AM
To: CNCF TOC <cncf-toc@...>
Subject: [EXTERNAL] [cncf-toc] [VOTE] Open Policy Agent from incubating to graduated

The Open Policy Agent project has applied for graduation from incubation to graduated. (https://github.com/cncf/toc/pull/520)

The due diligence document can be found here: https://docs.google.com/document/d/19M5fTpe57rQIMNxawRl5wSWvJUapuzY-CkV4O5pvieU/edit

Brendan Burns has called for public comment: https://lists.cncf.io/g/cncf-toc/message/5281

Please vote (+1/0/-1) by replying to this thread.

Remember that the TOC has binding votes only, but we do appreciate non-binding votes from the community as a sign of support!

--

Amye Scavarda Perrin | Program Manager | amye@...

--

Davanum Srinivas :: https://twitter.com/dims

Re: [EXTERNAL] [cncf-toc] [VOTE] Open Policy Agent from incubating to graduated

Brendan Burns

#5533

+1, Binding

Show quoted text

From: cncf-toc@... <cncf-toc@...> on behalf of Amye Scavarda Perrin via lists.cncf.io <ascavarda=linuxfoundation.org@...>
Sent: Wednesday, September 30, 2020 9:00 AM
To: CNCF TOC <cncf-toc@...>
Subject: [EXTERNAL] [cncf-toc] [VOTE] Open Policy Agent from incubating to graduated

The Open Policy Agent project has applied for graduation from incubation to graduated. (https://github.com/cncf/toc/pull/520)

The due diligence document can be found here: https://docs.google.com/document/d/19M5fTpe57rQIMNxawRl5wSWvJUapuzY-CkV4O5pvieU/edit

Brendan Burns has called for public comment: https://lists.cncf.io/g/cncf-toc/message/5281

Please vote (+1/0/-1) by replying to this thread.

Remember that the TOC has binding votes only, but we do appreciate non-binding votes from the community as a sign of support!

--

Amye Scavarda Perrin | Program Manager | amye@...

[RFC] Refining the way we communicate deprecations/wide-reaching changes to the project

Stephen Augustus

#5532

Forwarding here as well, if anyone is interested in leaving feedback.

-- Stephen

---------- Forwarded message ---------
From: Stephen Augustus <stephen.k8s@...>
Date: Wed, Dec 2, 2020, 22:56
Subject: [k8s-steering] [RFC] Refining the way we communicate deprecations/wide-reaching changes to the project
To: Kubernetes developer/contributor discussion <kubernetes-dev@...>
Cc: steering <steering@...>

Hey Kubernetes Community,

tl;dr -- words are hard sometimes and we should take some time and care to assess the way we wield them.

Looking for feedback on https://github.com/kubernetes/community/issues/5344.

---

As we go through deprecations and infrastructure changes in the project, it might be a worthwhile exercise to assess and refine the way we communicate them.

I can think of a few recent examples that caused some panic and required additional lift from contributors to reframe or contort/extend support to accommodate:

dockershim
the k8s.gcr.io migration
hyperkube

We should consider what it means to turn down a service, piece of functionality, or kubernetes/kubernetes-adjacent system and type of impact it may have for consumers.

Without policing contributors, as maintainers of the project, we also have a responsibility to users to be careful and deliberate with our communications outside of the project, whether it be Twitter, Hacker News, etc., etc.

So how can we improve?

I think depending on the scope of a change, the following SIGs should be involved in crafting comms:

SIG Architecture
SIG Release
SIG Docs

With SIG ContribEx to assist with consistent delivery across our properties.

I'm curious to hear everyone's thoughts here.

-- Stephen

--
You received this message because you are subscribed to the Google Groups "steering" group.
To unsubscribe from this group and stop receiving emails from it, send an email to steering+unsubscribe@....
To view this discussion on the web visit https://groups.google.com/a/kubernetes.io/d/msgid/steering/CAOqU-DRtVQRC79v1xM5zVpQ11hWoyqdhgrhOamkVQ3%2B5kJw44A%40mail.gmail.com.

Agenda for 12/1

Amye Scavarda Perrin

#5530

Hi all,

We'll be meeting tomorrow:

Agenda:

Optional SIG Updates
New Training Course on Diversity in Open Source

Moved: Security Scanning for projects to December 15th when Liz is able to make the meeting

Presentation

Thanks!

--

Amye Scavarda Perrin | Program Manager | amye@...

Re: [VOTE] Buildpacks to move to incubation

Isaac Mosquera

#5529

+1 NB

On Wed, Nov 18, 2020 12:49 PM, Archy k ayrat.khayretdinov@... wrote:

+1 NB

On Wed, Oct 7, 2020 at 5:21 PM Amye Scavarda Perrin <ascavarda@...> wrote:
Cloud Native Buildpacks has applied to move from sandbox to incubation. (https://github.com/cncf/toc/pull/338)

Justin Cormack is the TOC sponsor for this project, he has performed Due Diligence (https://docs.google.com/document/d/1tb3mK5cJmaQLO8xR__9NaH2GMrdn3WPjAZFBJYsXrxY/edit) and called for public comment. (https://lists.cncf.io/g/cncf-toc/message/5317)

Please vote (+1/0/-1) by replying to this thread.

Remember that the TOC has binding votes only, but we do appreciate non-binding votes from the community as a sign of support!

--
Amye Scavarda Perrin | Program Manager | amye@...

#velocity,

I S A A C M O S Q U E R A

Chief Technology Officer

e: isaac@...

p: 703.795.5322

t: imosquera

Apologies

Liz Rice

#5528

I'm sorry folks, I have a conflict coming up on Tuesday 1st, and I am going to have to skip the TOC meeting

Liz

[RESULT] etcd for graduation

Amye Scavarda Perrin

#5527

The etcd project has been approved for graduation. (https://lists.cncf.io/g/cncf-toc/message/5452)
+1 Binding

--

Amye Scavarda Perrin | Program Manager | amye@...

Re: [cncf-sig-security] [cncf-toc] Vulnerability scanning for CNCF projects

Vinay Venkataraghavan <vvenkatara@...>

#5526

Hello everyone,

Just catching up on the thread and a little late to the discussion. I'm in total agreement with other points already brought up that we should:

Have some policies and guidance around visibility into the vulnerabilities in container images.
Broad guard rails which call out certain gates that have to pass (within reason).
Sticking to process of visibility and continuous improvement to ensure that over time the incubating and graduated projects are improving their security posture.

I love the dashboard of the LFX security tool / project. Would be great to see how we could either incorporate or expand that for other security usecases for projects going through graduation.

Thanks,

- Vinay

Show quoted text

On Thu, Nov 19, 2020 at 10:01 AM Emily Fox <themoxiefoxatwork@...> wrote:

Same! We would love a presentation! Shubhra please add itself to the agenda for an upcoming meeting in December.

The Security SIG group meets every Wednesday at 10:00am PT (USA Pacific)

Meeting minutes and agenda:https://docs.google.com/document/d/170y5biX9k95hYRwprITprG6Mc9xD5glVn-4mB2Jmi2g/

- Emily Fox

@TheMoxieFox (personal handle)

On Thu, 19 Nov 2020, 12:26 Justin Cormack via lists.cncf.io, <justin.cormack=docker.com@...> wrote:
I would be interested in that.

Justin

On Thu, 19 Nov 2020 at 17:23, Shubhra Kar <skar@...> wrote:
If this group is interested, my team would love to present the capabilities and limitations alike of the LFX security tool project. We are working on items like creating a SBOM policy management, adding support for scanning build systems and container images next. Secrets management and static analysis are longer term roadmap items.

Top challenges we need to solve collectively relatively quickly:

1. The tool provides capability to turn on/off dev dependencies, need the group to identify if we need to do that and which dev dependencies in particular. Project maintainers are probably the best equipped to determine this list.
2. A project is usually spread over multiple orgs and repo combinations. Some repos don't have a manifest file, which LFX needs in order to scan. A best practice would be to ensure there is consistent manifest creation.

Kind Regards,

Shubhra Kar
CTO and GM of Products and IT
tweet: @shubhrakar

On Wed, Nov 18, 2020 at 8:41 AM Liz Rice <liz@...> wrote:
Hi TOC and SIG Security folks

On Friday I got a nice preview from Shubhra Kar and his team at the LF about some tools they are building to provide insights and stats for LF (and therefore CNCF) projects. One that's of particular interest is an integration of scanning security issues.

We require graduated projects to have security reviews, and SIG Security are offering additional assessments, but we don't really have any standards around whether project artifacts shipping with vulnerabilities. Should we have something in place for requiring projects to have a process to fix vulnerability issues (at least the serious ones)?

This tooling is off to a great start. The current numbers for a lot of our projects look really quite bad, but this may be to do with scanning all the repos related to a project's org. I'd imagine there are also some false positives from things like dependencies only used in test that don't affect the security of the executables that end users run - we may want to look at just reporting vulnerabilities from a project's deployable artifacts.

As well as vulnerability scanning this is showing license dependencies, which could be very useful.

For discussion, how we want to use this kind of info, and whether we want to formalize requirements on projects (e.g. at graduation or incubation levels).

Copying Shubra in case he would like to comment further. .

Enjoy KubeCon!
Liz

--

Technical Director, Office of the CTO

Prisma Cloud | Palo Alto Networks

FYI: CNCF TOC Panel at KubeCon NA 2020

Chris Aniszczyk

#5525

Hey all, we are doing our traditional TOC panel at KubeCon today:

https://kccncna20.sched.com/event/f6Z1

Feel free to join us at the tail end of kubecon and if you have any questions, please let us know here on the list or on the #toc channel in Slack: https://docs.google.com/presentation/d/1Rsj1rLwTPDcltGEQLHTDDefeSyn6O9ZB4htruSZFHr8/edit?usp=sharing

The big thing to bring up on my end is that we will be having TOC elections in January 2021 for about a handful of seats.

--

Chris Aniszczyk (@cra)

Re: FYI: New Training Course on Diversity in Open Source

Chris Aniszczyk

#5524

Thanks, this is a discussion point for the TOC but I think the reality will be a roll out in 2021 at some level.

Also thank you Arun for pushing me to get this done in time for kubecon :)

Please continue taking the course and offer feedback, we plan on reserving budget every 1-2 years to do a refresh.

Show quoted text

On Fri, Nov 20, 2020 at 1:45 AM Luke Hinds <lhinds@...> wrote:

Should we make it mandatory (which I think is a good idea), it would be useful to cross reference kubernetes who took the same approach for all leaders (I did the course as part of product security). That way we won't be nagging people to do training they have already completed.

On Fri, Nov 20, 2020 at 1:55 AM Arun Gupta <arun.gupta@...> wrote:
Chris,

I just completed the course and it's extremely valuable. As already mentioned and noted for next TOC agenda, this should be a must for all leadership positions in CNCF.

It took me > 1 hour to listen all audio transcripts and taking the quiz, but a great use of time. Here is the direct link: https://trainingportal.linuxfoundation.org/learn/course/inclusive-open-source-community-orientation-lfc102/

Thanks,
Arun

On Nov 13, 2020, at 7:30 AM, Chris Aniszczyk <caniszczyk@...> wrote:

As a follow up from previous discussions on D&I training, we at The Linux Foundation in partnership with NCWIT are launching a new course on building inclusive open source communities that CNCF helped fund: https://training.linuxfoundation.org/announcements/linux-foundation-and-ncwit-release-free-training-course-on-diversity-in-open-source/

We should consider making this as a graduation requirement or even as part of project acceptance, food for thought as we ramp up for kubecon + cloudnativecon next week!

--
Chris Aniszczyk (@cra)

--

Chris Aniszczyk (@cra)