CNCF SANDBOX PROJECT ONBOARDING

[microwavables]

This is an issue to keep track of the tasks we need to take care of regarding onboarding as a sandbox project into CNCF (see here for the related issue within CNCF/TOC repo).

Whole team needs to read and understand, and just be generally aware of, (please put your name under each item when you've read each one, and put comments in here with any questions):

• Understand the project proposal process and reqs: https://github.com/cncf/toc/blob/main/process/project_proposals.md#introduction
  Read by: @neil-hickey, @pivotaljohn, @joaopapereira, @jbrunton, @cppforlife, @aaronshurley, @praveenrewar, @vmunishwar , @100mik, @kumaritanushree @sethiyash, @renuy, @rohitagg2020, @navdeep-pama

  Questions:

  • @neil-hickey: Who is the TOC?
    • Answer: https://github.com/cncf/toc
  • @kumaritanushree : what is DD?
    • Answer: Due Diligence

• Understand the services available for your project at CNCF https://www.cncf.io/services-for-projects/
  Read by: @neil-hickey, @joaopapereira, @pivotaljohn, @jbrunton, @cppforlife, @aaronshurley, @praveenrewar, @vmunishwar, @100mik, @kumaritanushree , @renuy, @sethiyash, @rohitagg2020, @navdeep-pama

  Questions:

  • @neil-hickey: "When new projects enter the foundation, they receive a new logo, website refresh if they wish, or an enhancement of their existing aesthetic." How do we sign up?!
  • @pivotaljohn: In terms of driving towards becoming vendor-neutral as a Sandbox project, how far can the CNCF ServiceDesk go? For example, would it be reasonable/feasible to migrate from the shared VMware Netlify account to a CNCF-owned account? Is this what "CNCF hosts graduated, incubating, and sandbox projects" means?
  • @100mik: Will we be switching to Zoom provided by CNCF for our meetings?
  • @100mik: About CNCF Slack, will we have another additional channel over there? (Looks like it can be Kubernetes slack as well according to bullets below)
  • @sethiyash How about publishing blog to CNCF blog and Kubernetes.io blog for sandbox projects?
  • @rohitagg2020: CNCF services helps to improve documentation. Are we planning to leverage that?

• Review the online programs guidelines: https://github.com/cncf/foundation/blob/master/online-programs-guidelines.md
  Read by: @neil-hickey, @joaopapereira, @pivotaljohn , @jbrunton, @cppforlife, @aaronshurley, @praveenrewar, @vmunishwar, @100mik, @kumaritanushree @sethiyash , @renuy, @rohitagg2020, @navdeep-pama

    Questions: 
     -  @kumaritanushree : Criteria to differentiate types of members to participate CNCF online programs? If any document is available for this can anyone add the link here?
  

• Ensure your project meets the CNCF IP Policy: https://github.com/cncf/foundation/blob/master/charter.md#11-ip-policy
  Read by: @neil-hickey, @joaopapereira, @pivotaljohn, @jbrunton, @cppforlife, @aaronshurley, @praveenrewar, @vmunishwar, @100mik, @kumaritanushree @sethiyash, @renuy , @rohitagg2020, @navdeep-pama

  Questions:

  • @pivotaljohn: I presume this means that all copyright headers need to be changed from VMware, Inc. to something like "The Carvel Authors"?
  • @praveenrewar: Are we going to switch to CNCF CLA? (I hope so)

• Understand the trademark guidelines: https://www.linuxfoundation.org/legal/trademark-usage
  Read by: @neil-hickey, @joaopapereira, @pivotaljohn, @jbrunton, @cppforlife, @aaronshurley, @praveenrewar, @vmunishwar, @100mik, @kumaritanushree, @sethiyash, @renuy , @rohitagg2020, @navdeep-pama

  Questions:

• Understand the license allowlist: https://github.com/cncf/foundation/blob/master/allowed-third-party-license-policy.md#approved-licenses-for-allowlist
  Read by: @neil-hickey, @joaopapereira, @pivotaljohn, @jbrunton, @cppforlife, @aaronshurley, @praveenrewar, @vmunishwar, @100mik, @kumaritanushree @sethiyash , @renuy, @navdeep-pama
  Questions:

  • @joaopapereira: Looks like we might have the change the headers of all our files to License the code to CNCF, correct?
  • @pivotaljohn: Does CNCF have any license scanning infrastructure to aide in automating this? (@100mik: Looks like they mention FOSSA by Snaky below)

• Is your project working on written, open governance? see https://contribute.cncf.io/maintainers/governance/
  Read by: @neil-hickey, @joaopapereira, @pivotaljohn, @jbrunton, @cppforlife, @aaronshurley, @praveenrewar, @vmunishwar, @100mik, @kumaritanushree @sethiyash, @renuy, @rohitagg2020, @navdeep-pama

  Questions:

  • @neil-hickey: It would be good to update our governance doc with our contributor model changes (if we haven't already)
  • @pivotaljohn: ☝🏻 and continue to mature our "governance" as an ongoing effort. 👍🏻 (@100mik +1)
  • @100mik: Do we have to define how permissions to the repositories are managed by role. To the best of my knowledge the framework Kubernetes uses to automate this can be adopted as it is pluggable. Something folks at sig-contribex might be able to provide some direction for.

Things that the CNCF will do or help the project to do:

• Marketing: update relevant intro + slide decks
• Events: update CFP + Registration + CFP Area forms
• ServiceDesk: confirm maintainers have read https://www.cncf.io/services-for-projects/
• CNCF Welcome Email Sent to confirm maintainer list access, welcome email has monthly project sync details
• Create space for meetings/events on https://community.cncf.io/, e.g., https://community.cncf.io/pravega-community/ - (https://github.com/cncf/communitygroups/blob/main/README.md#cncf-projects)
• Adopt a license scanning tool, like FOSSA or Snyk

Nanci working on:

• Ensure your project meets the CNCF IP Policy: https://github.com/cncf/foundation/blob/master/charter.md#11-ip-policy
• Provide emails for the maintainers added to https://maintainers.cncf.io/ in order to get access to the maintainers mailing list and ServiceDesk
• Trademarks: transfer any trademark and logo mark assets over to the LF - https://github.com/cncf/foundation/tree/master/agreements has agreements
• GitHub: ensure 'thelinuxfoundation' and 'caniszczyk' are added as initial org owners, this helps us make sure we have continuity of GH ownership
• Is your project in its own separate neutral github organization?
  - in progress, waiting on work to be completed before migrating
• Submitted a Pull request to add your project as a sandbox project to https://landscape.cncf.io/
  - already in the landscape, just need to update links once we are migrated to new org
  - Updated: updated carvel info in landscape cncf/landscape#3090
• Create maintainer list + add to aggregated https://maintainers.cncf.io/ list by submitting a PR to it
• Have added your project to https://github.com/cncf/contribute
• Artwork: Submit a pull request to https://github.com/cncf/artwork with your artwork
• Domain: transfer domain to the CNCF - https://jira.linuxfoundation.org/plugins/servlet/theme/portal/2/create/63
• Slack: Are your slack channels migrated to the Kubernetes or CNCF Slack? (see https://slack.com/help/articles/217872578-Import-data-from-one-Slack-workspace-to-another for more details)

Pending Things that CNCF will need from the project:

• GitHub: ensure DCO or CLA are enabled for all GitHub repositories of the project
  - @neil-hickey working on this
• GitHub: ensure that the CNCF Code of Conduct (or your adopted version of it) are explicitly referenced at the project's README on GitHub
  - @neil-hickey working on this ==> PR opened https://github.com/vmware-tanzu/carvel/pull/583
• Website: ensure LF footer is there and website guidelines followed (if your project doesn't have a dedicated website, please adopt those guidelines to the README file of your project on GitHub). (Nanci Updated this on 3/22/2023)
  - Will hold off until trademark is transferred over
• Website: Analytics transferred to projects@cncf.io
  - Need to look into this since we don't have analytics setup. And do we need to transfer our website outside of Netlify?
• CII: Start on a CII best practices badge https://bestpractices.coreinfrastructure.org/en
  - Will need to do this after we've migrated to our own neutral GitHub org.

Other thing that the CNCF will do or help the project to do:

• Devstats: add to devstats https://devstats.cncf.io/
  Question: this is marked as done. However it looks like only carvel is covered not other repos. Are we looking for devstats for all tools? Comment from Nanci on Feb 27: I've created an issue asking about this.

[caniszczyk]

Do you have a new github org for carvel yet :)?

[microwavables]

@caniszczyk I'm trying to get ahold of @carvel to see if they can switch their handle so we can have /carvel https://github.com/carvel

Otherwise, if we don't hear back in the next week? we'll go with /carvel-dev which I already created as a just-in-case: https://github.com/carvel-dev

[neil-hickey]

Checklist for github migration:

• Validate that transfering one less "busy" project is correctly moved, redirection is working, and the relevant permissions remain intact. vmware-tanzu/carvel-docker-image might good a good candidate.
• https://docs.github.com/en/repositories/creating-and-managing-repositories/transferring-a-repository
• Move the following repositories to the new organization
  • vmware-tanzu/carvel
  • vmware-tanzu/asdf-carvel
  • vmware-tanzu/homebrew-carvel
  • vmware-tanzu/terraform-provider-carvel
  • vmware-tanzu/carvel-ytt-starter-for-kubernetes
  • vmware-tanzu/carvel-ytt-library-for-kubernetes-demo
  • vmware-tanzu/carvel-ytt-library-for-kubernetes
  • vmware-tanzu/carvel-ytt
  • vmware-tanzu/carvel-vendir
  • vmware-tanzu/carvel-simple-app-on-kubernetes
  • vmware-tanzu/carvel-setup-action
  • vmware-tanzu/carvel-secretgen-controller
  • vmware-tanzu/carvel-release-scripts
  • vmware-tanzu/carvel-kwt
  • vmware-tanzu/carvel-kbld
  • vmware-tanzu/carvel-kapp-controller
  • vmware-tanzu/carvel-kapp
  • vmware-tanzu/carvel-imgpkg
  • vmware-tanzu/carvel-guestbook-example-on-kubernetes
  • vmware-tanzu/carvel-docker-image
  • https://github.com/vmware-tanzu/vscode-ytt
  • https://github.com/vmware-tanzu/chocolatey-packages-for-carvel
  • https://github.com/vmware-tanzu/carvel-community <-- looks like archived? may be we can delete this entirely?
  • https://github.com/vmware-tanzu/ytt.vim
  • https://github.com/vmware-tanzu/difflib
  • https://github.com/vmware-tanzu/color
  • k14s/ytt.vim
  • k14s/ytt-test-gh-actions
  • k14s/ytt-schema-v1-preview
  • k14s/ytt-openapi-lib
  • k14s/yaml
  • k14s/vscode-ytt
  • k14s/test-go-migration-3-renamed
  • k14s/starlark-go
  • k14s/semver
  • k14s/pv-labeling-controller
  • k14s/others
  • k14s/meetups
  • k14s/lab-getting-started-with-k14s
  • k14s/kaap-deploy-oidc
  • k14s/k8s-resource-protection
  • k14s/k8s-rbac-proxy
  • k14s/json2k8s
  • k14s/homebrew-tap
  • k14s/difflib
  • k14s/design-docs
  • k14s/color
  • k14s/cncf-packaging-webinar
  • k14s/awesome-kubernetes
• Check the permissions associated with carvel-writers and investigate how to transfer this group to the new org, or create this group if needed.
• Setup CNCF (linuxfoundation) CLA: https://github.com/kubernetes/community/blob/master/github-management/setting-up-cla-check.md
• https://github.com/vmware-tanzu/carvel/issues/602 Double check these settings are migrated also

[joaopapereira]

k14s/homebrew-tap is deprecated so it should be ok to be removed

[jbrunton]

I've read the links above. I don't have permission to edit the issue and add my name to the "read by" sections, however.

[joaopapereira]

I just added your name on the "read by" :D

[microwavables]

Edit This has been merged!
Created this PR for artwork transfer: cncf/artwork#369

[microwavables]

Update: Waiting on repos to be migrated to new org in order to complete remaining items. Blocker: Team is bogged down with other tasks and cannot give proper attention to ensure a smooth transition/migration. cc: @aaronshurley

[microwavables]

Per Chris A on DCO/CLA:
It looks like Carvel already has DCO enabled so you're all set, you only need to choose DCO or CLA and most projects use DCO since it's easier.