[SANDBOX ONBOARDING] KusionStack

[mrbobbytables]

Welcome to CNCF Project Onboarding

ref: #83

This is an issue created to help onboard your project into the CNCF after the TOC has voted to accept your project.

We would like your project to complete onboarding within one month of acceptance.

Please track your progress by using "Quote reply" to create your own copy of this checklist in an issue, so that you can update the status as you finish items.

Review and understand

• The Technical Leadership Principles that outlines the expected behavior for any maintainer in a leadership role.
• The project proposal process and requirements.
• The services available for your project at the CNCF.
• The CNCF IP Policy.
• The trademark guidelines.
• The license allowlist.
• The online program guidelines.
• Book time with CNCF staff to understand project benefits and event resources.

Contribute and transfer

• Move your project to its own separate neutral GitHub organization. This will make it transferable to the CNCF's GitHub Enterprise account. If it's already in a GHE account, you will need to remove it from that first.
• Accept the invite to join the CNCF GitHub Enterprise account. We'll then add thelinuxfoundation as an organization owner to ensure neutral hosting of your project.
• Migrate your Slack channels (if any) to the Kubernetes or CNCF Slack workspace. CNCF staff can help.
• Submit a pull request to add your project as a Sandbox project to the Cloud Native Landscape by updating landscape.yml following these instructions.
• Transfer your domain to the CNCF. The "LF Stakeholder email" is [email protected].
• Transfer any trademark and logo assets to the Linux Foundation.
• Submit a pull request with your artwork.
• Transfer website analytics to [email protected]. CNCF staff can help.

Update and document

• Ensure that DCO (preferred) or CLA are enabled for all GitHub repositories of the project.
• Ensure that that the CNCF Code of Conduct (or your adopted version of it) are explicitly referenced at the project's README on GitHub.
• Ensure LF footer is on your website and guidelines are followed (if your project doesn't have a dedicated website, please adopt those guidelines for the README file).
• Create a maintainer list and add it to the aggregated CNCF maintainer list via pull request.
• Provide emails for the maintainers to get access to the maintainers mailing list and Service Desk. Email them to [email protected].
• Start working on written, open governance.
• Start on an OpenSSF Best Practices Badge.

CNCF staff tasks

• Add the project to DevStats.
• Add the project to CLOmonitor.
• Add the project to LFX Insights. This is done by adding a read-only app to your GitHub organization once it's in CNCF GHE.
• Add the project to LFX Project Control Center.
• Add a license scanning tool, like FOSSA or Snyk.
• Invite developers to the #maintainers-circle Slack channel.
• Send a welcome email to confirm maintainer list access.

[mrbobbytables]

@Cmierly this should be good to go to begin onboarding :)

@SparkYuan tagging you here as an FYI, please tag any others from the project who should follow this issue.

[ffforest]

Thanks @mrbobbytables! We will follow up on the items in this issue.

[ffforest]

I am working on the following items:

• Move your project to its own separate neutral GitHub organization. This will make it transferable to the CNCF's GitHub Enterprise account. If it's already in a GHE account, you will need to remove it from that first.

Question about this one: Does "neutral" here represent "not in a GHE account currently"? We are planning to transfer all repositories currently under the KusionStack organization. I take it as we don't need to create a new org for that?

There are 3 private repos and 2 public-archived repos at the moment. Can they be transferred while staying private/archived, or do we need to get rid of them first?

We are also cleaning up the outdated repos and then everything else should be good to transfer.

These can be expected by the end of the week:

• Ensure that DCO (preferred) or CLA are enabled for all GitHub repositories of the project.
• Ensure that that the CNCF Code of Conduct (or your adopted version of it) are explicitly referenced at the project's README on GitHub.
• Ensure LF footer is on your website and guidelines are followed (if your project doesn't have a dedicated website, please adopt those guidelines for the README file).
• Create a maintainer list and add it to the aggregated CNCF maintainer list via pull request.
• Provide emails for the maintainers to get access to the maintainers mailing list and Service Desk. Email them to [email protected].
• Start working on written, open governance.
• Start on an OpenSSF Best Practices Badge.

These two might take a bit longer:

• Transfer your domain to the CNCF. The "LF Stakeholder email" is [email protected].
• Transfer any trademark and logo assets to the Linux Foundation.

Could you please also tag the CNCF staff that can help with the following?

• Migrate your Slack channels (if any) to the Kubernetes or CNCF Slack workspace.
• Transfer website analytics to [email protected].

cc @mrbobbytables @Cmierly @idvoretskyi @krook @jeefy

[ffforest]

This artwork PR is ready for review. Since our logo is basically just words, I'm using Helm as a reference which uses the same set images for horizontal, stacked and logo.

[ ] Submit a pull request with your artwork.

[mrbobbytables]

We are planning to transfer all repositories currently under the KusionStack organization. I take it as we don't need to create a new org for that?

Correct. 👍
If the entire org is going to be donated you don't have to worry about moving it to a separate one.

As a followup we can update the wording in the template to make that a bit more clear.

[idvoretskyi]

@ffforest with the Slack migration either myself of @RobertKielty are happy to assist!

The same with:

Add a license scanning tool, like FOSSA or Snyk.

[mrbobbytables]

Migrate your Slack channels (if any) to the Kubernetes or CNCF Slack workspace.

myself, @krook or @jeefy can help here. How many channels do you have? If its a small number the easiest method might be to manually recreate them in cncf or kubernetes slack.

[RobertKielty]

Hi @ffforest, for FOSSA and/or Snyk we will need one or more email addresses to invite you to join the CNCF service instances that are provided to CNCF Projects.

You send us the email addresses by emailing them to [email protected]

For FOSSA and Snyk - The email addresses you send us need to be associated with GitHub user accounts that have access to the code repos that will be scanned.

[RobertKielty]

@ffforest, I have made a KusionStack Team on CNCF FOSSA and a KusionStack Organziation on CNCF Snyk for the project.

@Cmierlym, I've added KusionStack to our internal records.

[ffforest]

We are planning to transfer all repositories currently under the KusionStack organization. I take it as we don't need to create a new org for that?

Correct. 👍 If the entire org is going to be donated you don't have to worry about moving it to a separate one.

As a followup we can update the wording in the template to make that a bit more clear.

Thanks @mrbobbytables!
For the private repos, can they be donated as-is, or do we have to make them public first?

[ffforest]

Migrate your Slack channels (if any) to the Kubernetes or CNCF Slack workspace.

myself, @krook or @jeefy can help here. How many channels do you have? If its a small number the easiest method might be to manually recreate them in cncf or kubernetes slack.

We have 2 channels with about 70 people in them. What would you recommend? Create a new one and redirect people to it from the existing one?

[mrbobbytables]

as-is is fine - a good chunk of projects use private repos for things like security patch testing before pushing to public etc

[ffforest]

Hi @ffforest, for FOSSA and/or Snyk we will need one or more email addresses to invite you to join the CNCF service instances that are provided to CNCF Projects.

You send us the email addresses by emailing them to [email protected]

For FOSSA and Snyk - The email addresses you send us need to be associated with GitHub user accounts that have access to the code repos that will be scanned.

Thanks @RobertKielty!
I have just sent the email over.
Is there anything else you need on the FOSSA/Snyk front?

[RobertKielty]

For FOSSA and Snyk - The email addresses you send us need to be associated with GitHub user accounts that have access to the code repos that will be scanned.

Thanks @RobertKielty!
I have just sent the email over.
Is there anything else you need on the FOSSA/Snyk front?

That's perfect thank you. I have received the emails you have sent over. cc @Cmierly

Next step would be to state a preference for the project to use either FOSSA or Snyk.

[mrbobbytables]

We have 2 channels with about 70 people in them. What would you recommend? Create a new one and redirect people to it from the existing one?

For that amount of users, I'd probably lean towards import. @RobertKielty @idvoretskyi would either of you be able to help?

[ffforest]

For FOSSA and Snyk - The email addresses you send us need to be associated with GitHub user accounts that have access to the code repos that will be scanned.
Thanks @RobertKielty!
I have just sent the email over.
Is there anything else you need on the FOSSA/Snyk front?

That's perfect thank you. I have received the emails you have sent over. cc @Cmierly

Next step would be to state a preference for the project to use either FOSSA or Snyk.

Absolutely. FOSSA would do.
Appreciate the help!

[RobertKielty]

@ffforest thank you!

I have emailed out FOSSA invites to the maintainer team: @SparkYuan @liu-hm19 @zuomo @wu8685 @elliotxx @Eikykun @adohe @ruquanzhao @Yangyang96 @ColdsteelRail @shaofan-hs

Please note the following:

1. For registration with the CNCF FOSSA Organizaion, the email addresses we use to invite the team members MUST NOT be associated with any other FOSSA Organization.
2. Once an invite is accepted I need to manually add the first team member to the Team in FOSSA. We grant Team Members the role of FOSSA Team Admin. Remaining members who sucessfully accept the their invitations to join CNCF FOSSA can be added to the new Team by the first KusionStack Team Admin or a CNCF Organziation Admin.
3. The email addresses MUST be associated with GitHub user accounts that have read/write access to the code repos that will be imported for license scanning.

For the initial license scans of the code repos we only need one maintainer to sucessfully register and import the repos so that we can see reports on the 3rd party licenses used in the project code repos.

Feel free to have one of the maintainers reach out to me on CNCF Slack if support is required on getting setup.

If there is work to be done to bring the code repos into compliance with the 3rd Party License policy then we can focus on getting all of the maintainers on-boarded onto FOSSA.

I have sent out all of the invites, (one of the maintainers email addresses already had a FOSSA a/c associated with their email address) I will let you know who that was in my next comment.

[RobertKielty]

Hi @SparkYuan,

The email address that @ffforest passed on to us for you was already registered on FOSSA.

From a KusionStack on-boarding point of view, this is fine; as long as one of the other maintainers accepts their invite and imports the project's code repos into FOSSA then that will do for now.

If however you want to register with CNCF FOSSA now there are two options to choose from:

either

• we can ask FOSSA Support to transfer your existing FOSSA Account over to the CNCF FOSSA Organziation.
  or
• if you want to keep your existing FOSSA setup you can send me an alternative email address to use for CNCF FOSSA

Typically, we use the FOSSA support transfer option for accounts where a maintainer just used their email address to setup FOSSA for learning purposes and are happy to delete that account, and we use an alternate address for people who are already using FOSSA for work and need to keep using their existing FOSSA setup.

[ffforest]

Can you please submit a ServiceDesk ticket, we'll proceed from there.

@idvoretskyi I'm assuming you mean https://cncfservicedesk.atlassian.net/servicedesk/customer/portal/1 but I'm not able to log in there. I did send an email (titled KusionStack Sandbox Onboarding - Maintainers Emails) to [email protected] last week but perhaps it wasn't processed yet.

I am able to submit a ticket via the LF service though but there are no Slack-related service there.

[ffforest]

Regarding this one

Transfer any trademark and logo assets to the Linux Foundation.

The agreement also mentions the transfer of social media accounts and such. We have a KusionStack account for X and Medium. Are they expected to transferred during onboarding? If so, how is that done (do we provide the username and password)? I'm assuming we are still in charge of producing contents for each.

Procedure-wise, I understand that we are expected to send a signed copy to [email protected], after which we will receive a mutually signed copy back.

cc @mrbobbytables @RobertKielty @idvoretskyi

[ffforest]

@RobertKielty
Regarding FOSSA license scan results:

What is the expected response for (and time window to address) the issues exposed in the license scan? I noticed some of them are common issues among CNCF projects (dual licenses in vendor projects, etc). Do we need to provide a detailed comment in FOSSA with explanation for each of the issue (I've seen people done that for other projects but I don't have the permission to create a comment yet) and proceed to click ignore on the issue?

[RobertKielty]

@ffforest - on timelines for working through the reported license issues I think that is something the KusionStack project team should work on while the project is in the Sandbox.

For 3rd party dependancies that are dual licensed they must be wholly licenseable under a permitted license as described in https://github.com/cncf/foundation/blob/main/allowed-third-party-license-policy.md#approved-licenses-for-allowlist

For onboarding, getting repos scanned by FOSSA is the necessary task to complete. If you have contributors who can look at the reported issues now that is perfect.

One piece of feedback that I have is that the CNCF 3rd Pary License policy is for code repositories belonging to a project that releases artifacts to end-users. So I think it it OK to not scan the .github repo or the website repos. I will run this by @jeefy @krook @mrbobbytables to confirm this.
EDIT:
All of the repositories need to be scanned! I checked this with my colleagues on the CNCF Projects team after writing this last paragraph.

Also on that call I learned that documentation repos need to be licensed under the Creative Commons Attribution 4.0 International License as described in https://github.com/cncf/foundation/blob/main/charter.md#11-ip-policy

Thank you @jeefy and @mrbobbytables!

[mrbobbytables]

EDIT: NM - thought of .github, not website - both need licenses.^^;;;

[ffforest]

@ffforest - on timelines for working through the reported license issues I think that is something the KusionStack project team should work on while the project is in the Sandbox.

For 3rd party dependancies that are dual licensed they must be wholly licenseable under a permitted license as described in https://github.com/cncf/foundation/blob/main/allowed-third-party-license-policy.md#approved-licenses-for-allowlist

For onboarding, getting repos scanned by FOSSA is the necessary task to complete. If you have contributors who can look at the reported issues now that is perfect.

One piece of feedback that I have is that the CNCF 3rd Pary License policy is for code repositories belonging to a project that releases artifacts to end-users. So I think it it OK to not scan the .github repo or the website repos. I will run this by @jeefy @krook @mrbobbytables to confirm this. EDIT: All of the repositories need to be scanned! I checked this with my colleagues on the CNCF Projects team after writing this last paragraph.

Also on that call I learned that documentation repos need to be licensed under the Creative Commons Attribution 4.0 International License as described in https://github.com/cncf/foundation/blob/main/charter.md#11-ip-policy

Thank you @jeefy and @mrbobbytables!

Thanks @RobertKielty and @mrbobbytables for the quick response!

For 3rd party dependancies that are dual licensed they must be wholly licenseable under a permitted license as described in https://github.com/cncf/foundation/blob/main/allowed-third-party-license-policy.md#approved-licenses-for-allowlist

Yes I'm aware of this list. I went through the full list of issues identified and most of them are accounted for (all of the licenses linked below are using the proper versions for dependencies in the KusionStack projects):

• node-forge and throttle-debounce seemed to be widely affecting 49 and 41 other CNCF projects as well. The first one is a dual license between BSD or GPLv2. Second one is MIT license on top of a GPLv2. In the latest version the GPL text was removed though.
• alibaba-cloud-sdk-go was identified as "no license found" but an Apache 2.0 license can be found here.
• crypto was identified as "no license found" but a BSD-3-CLAUSE license can be found here.
• docker was flagged due a vendor package (vendor/github.com/spdx/tools-golang) but the vendor package is dual-licensed between Apache 2.0 or GPLv2.
• kubernetes 1.22.2 was flagged due a vendor package (vendor/github.com/heketi/heketi) but the vendor package is dual-licensed between Apache 2.0 or LGPLv3.

Can the above be properly ignored with a comment stating the same?

This is the only one I'm currently not very clear on:

• kubernetes 1.22.6 was identified but no further details were given.

[ffforest]

EDIT: NM - thought of .github, not website - both need licenses.^^;;;

@mrbobbytables Just to clarify, do you mean both .github and website repos need licenses or do they both need Creative Commons Attribution 4.0 International License?

[ffforest]

Currently Open PRs:

• Add KusionStack artwork
• Add KusionStack maintainers

[lukaszgryglicki]

DevStats instance created.

[lukaszgryglicki]

Added to All CNCF (also here) and regenerated all its data (including past).

[ffforest]

Following up on these items:

Migrate your Slack channels (if any) to the Kubernetes or CNCF Slack workspace. CNCF staff can help.

I still don't have access to CNCF Service Desk to create a ticket for this. An email (titled KusionStack Sandbox Onboarding - Maintainers Emails) was send to [email protected] couple days ago. Can you please check if it has been processed?

Transfer website analytics to [email protected]. CNCF staff can help.

Not clear on how to proceed on this one. Are we expected to transfer the Google Analytics account?

These are also pending:

Add the project to CLOmonitor. @cynthia-sg
Add the project to LFX Insights. This is done by adding a read-only app to your GitHub organization once it's in CNCF GHE.
Add the project to LFX Project Control Center.
Invite developers to the #maintainers-circle Slack channel.
Send a welcome email to confirm maintainer list access.

I'm working on these two:

Transfer your domain to the CNCF. The "LF Stakeholder email" is [email protected].
Transfer any trademark and logo assets to the Linux Foundation.

cc @RobertKielty @jeefy @krook @Cmierly @mrbobbytables
Thank you for your patient support!

[Cmierly]

@ffforest I have sent out invites to add your maintainers to service desk. Let me know if you have any issues accepting the invite or need it resent

[ffforest]

@ffforest I have sent out invites to add your maintainers to service desk. Let me know if you have any issues accepting the invite or need it resent

Thanks @Cmierly !
I have created a ticket for migrating our Slack channels. The ticket ID is CNCFSD-2523. The exported file is attached in the ticket. cc @idvoretskyi
Please let me know if you need anything else.

[idvoretskyi]

I have created a ticket for migrating our Slack channels. The ticket ID is CNCFSD-2523. The exported file is attached in the ticket. cc @idvoretskyi

Done! Please check.

[cynthia-sg]

Project has been added to CLOMonitor

[ffforest]

Thank you @idvoretskyi and @cynthia-sg !
The slack channel looks good.

[ffforest]

Transfer any trademark and logo assets to the Linux Foundation.

Regarding this agreement, our legal team has made some modifications. To highlight the key changes for your review:

1. Omission of exhibit B due to its inapplicability in practice. We need different documentation for the transfer of KusionStack's trademarks to LF, which can be prepared by LF's attorneys or by Ant.
2. Addition of 5) governing law, which is imperative to us.
3. Designation of Advanced New Technologies, the holder of Ant's trademarks, as the assignor.

KusionStack Trademark and Account Assignment Agreement - Ant Edits.pdf

Please review the revised document and let me know if you have any questions or require further clarifications.

cc @caniszczyk @mrbobbytables @RobertKielty @jeefy @krook @Cmierly

Edit: Relevant question: The agreement also mentions the transfer of social media accounts and such. We have a KusionStack account for X and Medium. Are they expected to transferred during onboarding? If so, how is that done (do we provide the username and password)?

[Cmierly]

Thank you @ffforest !
I'll have our legal team review the changes and let you know if anything comes up

[ffforest]

Thank you @ffforest ! I'll have our legal team review the changes and let you know if anything comes up

Hi @Cmierly, following up on this one. Is there any update?

[ffforest]

Thank you @ffforest ! I'll have our legal team review the changes and let you know if anything comes up

Hi @Cmierly, following up on this one. Is there any update?

Hi @Cmierly, checking in again. Is there any update or anything we could do to move this forward?

[Cmierly]

hi @ffforest !
Unfortunately, we are held up as legal is devising a new method of accepting trademarks. We are pushing for info but it's going a bit slow. I'm terribly sorry for the delay!

[ffforest]

hi @ffforest ! Unfortunately, we are held up as legal is devising a new method of accepting trademarks. We are pushing for info but it's going a bit slow. I'm terribly sorry for the delay!

Thanks for the update @Cmierly. Is there an approximate ETA for this?
Also, does this mean we are modifying parts of the agreement or will there be a completely new agreement? Asking because there were some work on our end to transfer the domain that was previously waiting on the agreement to be signed.

[idvoretskyi]

hi @ffforest ! Unfortunately, we are held up as legal is devising a new method of accepting trademarks. We are pushing for info but it's going a bit slow. I'm terribly sorry for the delay!

Thanks for the update @Cmierly. Is there an approximate ETA for this? Also, does this mean we are modifying parts of the agreement or will there be a completely new agreement? Asking because there were some work on our end to transfer the domain that was previously waiting on the agreement to be signed.

cc @krook on this.

[krook]

hi @ffforest ! Unfortunately, we are held up as legal is devising a new method of accepting trademarks. We are pushing for info but it's going a bit slow. I'm terribly sorry for the delay!

Thanks for the update @Cmierly. Is there an approximate ETA for this? Also, does this mean we are modifying parts of the agreement or will there be a completely new agreement? Asking because there were some work on our end to transfer the domain that was previously waiting on the agreement to be signed.

cc @krook on this.

I will have this shortly.

[ffforest]

hi @ffforest ! Unfortunately, we are held up as legal is devising a new method of accepting trademarks. We are pushing for info but it's going a bit slow. I'm terribly sorry for the delay!

Thanks for the update @Cmierly. Is there an approximate ETA for this? Also, does this mean we are modifying parts of the agreement or will there be a completely new agreement? Asking because there were some work on our end to transfer the domain that was previously waiting on the agreement to be signed.

cc @krook on this.

I will have this shortly.

Hi @krook, checking in on this. Any updates?

[krook]

Sorry for the delay @ffforest. The new 2025 "Project Contribution Agreement" is now available.

This replaces the trademark agreements mentioned in the original checklist.

I'll be sending an email to the contacts listed in the Sandbox application issue to handle next steps.

Please review the instructions in the email, fill out the Google Doc, and then we can it them completed via Docusign.

Once done, that will unblock us from continuing the rest of these Sandbox onboarding tasks.

We can address any questions about the Agreement over email.

[ffforest]

Sorry for the delay @ffforest. The new 2025 "Project Contribution Agreement" is now available.

This replaces the trademark agreements mentioned in the original checklist.

I'll be sending an email to the contacts listed in the Sandbox application issue to handle next steps.

Please review the instructions in the email, fill out the Google Doc, and then we can it them completed via Docusign.

Once done, that will unblock us from continuing the rest of these Sandbox onboarding tasks.

We can address any questions about the Agreement over email.

Thanks for the update @krook.
I've forwarded this to our legal team for review. I will follow up with them and provide updates in this thread.

[kusionstack-bot]

Sorry for the delay @ffforest. The new 2025 "Project Contribution Agreement" is now available.

This replaces the trademark agreements mentioned in the original checklist.

I'll be sending an email to the contacts listed in the Sandbox application issue to handle next steps.

Please review the instructions in the email, fill out the Google Doc, and then we can it them completed via Docusign.

Once done, that will unblock us from continuing the rest of these Sandbox onboarding tasks.

We can address any questions about the Agreement over email.

Hi @krook, our legal team has just completed the review of the Project Contribution Agreement. I've emailed you the version with their very minor modifications. Please review it and let us know if we can proceed with that.