diff --git a/README.md b/README.md index 62fcaff..b7bd4c0 100644 --- a/README.md +++ b/README.md @@ -1,418 +1,7 @@ # CNCF Service Desk -The CNCF offers a [strong backbone of services to open source projects](https://www.cncf.io/services-for-projects/), built around the goal of sustaining most project needs outside of just code management and technical decisions. We offer an enhanced set of services via professional staff that cultivates the maturity and increased adoption of cloud native, open source projects. We take a data-driven approach to working with our project and maintainer community; we actively survey to improve our services and community satisfaction while featuring services in our community spotlights. +The CNCF offers a [strong backbone of services to open source projects](https://contribute.cncf.io/resources/project-services/) built around the goal of supporting most project needs outside of just code management and technical decisions. -These services are offered as part of community stability but do not replace developers on the projects themselves and are never meant to be in the critical path of a project release or a full-time resource. Our goal in providing these shared services is to cultivate CNCF's graduating and incubating projects, and offer sandbox projects the space to grow into incubating projects. +We offer additional services via professional staff that cultivates the maturity and increased adoption of cloud native, open source projects. Details on the types of services that projects use are now provided on the [CNCF Contributors site](https://contribute.cncf.io/resources/project-services/). -The CNCF hosts graduated, incubating, and sandbox projects. While we offer a shared set of services for all of our projects, we don't provide substantial marketing services for sandbox projects as they are meant to be early-stage projects that need a lightweight neutral home to grow naturally. Sandbox projects are prioritized lower for project services versus their incubating and graduated project peers. - -To improve access to CNCF services, we have implemented a [Service Desk](http://servicedesk.cncf.io/) as a single point of access for all CNCF services. We're modeling this on the 3-1-1 service that Mayor Bloomberg [rolled out](https://web.archive.org/web/20200819233226/https://www1.nyc.gov/office-of-the-mayor/news/203-10/mayor-bloomberg-answers-100-millionth-call-311) in New York City to provide a single access point to all municipal services. Project maintainers that are used to interacting with CNCF staff members directly by email or Slack are welcome to continue to do so, and it will be that staff member's responsibility to log the request in the CNCF Service Desk. - -Finally, this list isn't meant to be an exhaustive list of services offered by the Foundation. There may be things your project needs help with that aren't listed here and it's completely OK to reach out to staff via the CNCF [Service Desk](http://servicedesk.cncf.io/) and ask for help. - -We offer CNCF projects and maintainers help in these areas: - -- [Foundation](#foundation) -- [Design and Aesthetics](#design-and-aesthetics) -- [Program Management](#program-management) -- [Legal Services](#legal-services) -- [Tools](#tools) -- [Technical Documentation](#technical-documentation) -- [Continuous Integration](#continuous-integration) -- [Certification and Training Services](#certification-and-training-services) -- [End User Community](#end-user-community) -- [Internationalization](#internationalization) -- [Marketing](#marketing) -- [Event Management](#event-management) -- [Marketing Services and Programs](#marketing-services-and-programs) -- [Marketing Communications](#marketing-communications) -- [Surveys](#surveys) -- [Marketing announcements for projects](#marketing-announcements-for-projects) -- [Project entering and moving through the maturity levels](#project-entering-and-moving-through-the-maturity-levels) - - [Graduation](#graduation) -- [Incubating](#incubating) -- [Sandbox](#sandbox) -- [Project launches and new release support](#project-launches-and-new-release-support) - - [Graduated projects: major and minor release](#graduated-projects-major-and-minor-release) - - [Incubating projects: major release](#incubating-projects-major-release) -- [Code analysis and fuzzing](#code-analysis-and-fuzzing) -- [Other Services](#other-services) - -[FAQ](#faq) - -- [How do I file a ticket with the Service Desk?](#how-do-i-file-a-ticket-with-the-service-desk) -- [What happens if I want to use a tool or service not listed here?](#what-happens-if-i-want-to-use-a-tool-or-service-not-listed-here) -- [Is there an SLA for Service Desk issues?](#is-there-an-sla-for-service-desk-issues) -- [How much budget is available for projects?](#how-much-budget-is-available-for-projects) -- [How do I file a security CVE as a project?](#how-do-i-file-a-security-cve-as-a-project) -- [How do I share credentials, passwords or other confidential information?](#how-do-i-share-credentials-passwords-or-other-confidential-information) -- [How can I use the computing infrastructure provided by the CNCF](#how-can-i-use-the-computing-infrastructure-provided-by-the-cncf) -- [My project is affected by the Docker Hub rate limits policy changes, what can I do?](#my-project-is-affected-by-the-docker-hub-rate-limits-policy-changes-what-can-i-do) -- [My builds are slow, I would like to have expanded capacity for GitHub Actions, what can I do?](#my-builds-are-slow-i-would-like-to-have-expanded-capacity-for-github-actions-what-can-i-do) -- [I don't have a Service Desk account](#i-dont-have-a-service-desk-account) - - [I am a Kubernetes SIG chair and I don't have a Service Desk account](#i-am-a-kubernetes-sig-chair-and-i-dont-have-a-service-desk-account) -- [I changed my email and lost my Service Desk access, what can I do to get it back?](#i-changed-my-email-and-lost-my-service-desk-access-what-can-i-do-to-get-it-back) -- [I am not happy with the level of service from CNCF staff, what can I do to escalate?](#i-am-not-happy-with-the-level-of-service-from-cncf-staff-what-can-i-do-to-escalate) - -## Foundation - -A neutral home for an open source project increases the willingness of developers from enterprise software companies, start-ups, and independent developers to collaborate, contribute, and become committers. The CNCF's [Technical Oversight Committee (TOC)](https://www.cncf.io/people/technical-oversight-committee/) is the [technical governing body](https://github.com/cncf/toc#cncf-technical-oversight-committee-toc), guided by [documented principles](https://github.com/cncf/toc/blob/master/PRINCIPLES.md), and admits and oversees all projects. Being accepted into the CNCF by the TOC is an independent signal of the quality of your project. - -For projects accepted into the CNCF, the existing maintainers (or committers) still control the project. We help projects create a well-documented, neutral governance process. Any project that is added to CNCF must have ownership of its trademark and logo assets transferred to The Linux Foundation. For the full list of requirements, see [IP Policy](https://github.com/cncf/foundation/blob/master/charter.md#11-ip-policy). - -## Design and Aesthetics - -CNCF offers graphic design resources for all projects, provided primarily by our in-house design team. When new projects enter the foundation, they receive a new logo, a website refresh if they wish, or an enhancement of their existing aesthetic. For example, see the [CloudEvents](https://cloudevents.io) or CNCF [SIG Security](https://github.com/cncf/sig-security) logo. If there is something creative you desire, please don't hesitate to reach out! - -All project logos and color schemes are readily available via the [CNCF artwork repo](https://github.com/cncf/artwork). - -## Program Management - -CNCF, our parent organization [The Linux Foundation](https://www.linuxfoundation.org/), and our [sibling projects](https://www.linuxfoundation.org/projects/) combined have years of experience in providing program management services for open source projects. We collaborate on best practices that we bring to CNCF-hosted projects. - -CNCF staff is available to assist and guide your project. Below are some of the activities: - -- Collaboration between maintainers and [LF Fellows](https://www.linuxfoundation.org/about/linux-foundation-fellows/) and CNCF sister projects in the LF to support knowledge sharing -- Project governance creation and advice -- Facilitating community meetings with support for online participation -- Administrative support for communication and project processes -- [Security audits](https://github.com/cncf/toc/blob/main/docs/projects.md#project-security-audits) by independent third parties (e.g., Kubernetes security audit) -- Distributed systems safety research via independent third parties (e.g. ) -- Biweekly or monthly check in meetings with CNCF Staff as requested -- Project activity tracking and contribution reporting via [DevStats](https://devstats.cncf.io) - -## Legal Services - -Legal services keep a project healthy and in compliance with licensing requirements, intellectual property regimes, and industry norms. Specific legal services include: - -- Providing a [neutral home for project assets and trademarks](https://github.com/cncf/artwork) -- Registering trademarks for your projects across geographies as needed -- Support and responses to threatened litigation. For example, we worked with the Kubespray maintainers to change their name back from Kargo after receiving a C&D -- Contributor License Agreement (CLA) system that integrates with GitHub -- Developer Certificate of Origin (DCO) system that integrates with GitHub -- Protect trademarks, such as a Uniform Domain-Name Dispute-Resolution Policy (UDRP) action to take over kubernetes.cn -- Assistance with open source licensing review and strategy as needed -- Access to legal staff should any legal questions arise - -## Tools - -CNCF Projects may freely select their own tools, produce their own documentation, and build their own websites. CNCF staff can support a project's activities in this area and can provide recommendations and/or access to these tools for your project. We also have special relationships with many vendors that offer enterprise-level support. - -- [Zoom](https://zoom.us/) video conferencing Pro accounts for video meetings, recordings, and scheduling -- [OpsGenie](https://www.atlassian.com/software/opsgenie) account for on-call rotations for production services, security disclosure lists, or other needs -- [LastPass](https://www.lastpass.com/), [1Password](https://github.com/1Password/1password-teams-open-source), and [Keybase](https://keybase.io) to manage access to shared secrets -- [Netlify](https://netlify.com) for website hosting, DNS management, and improved workflow/automation around documentation and websites -- [Discourse](https://www.discourse.org/) for community discussion (e.g., ) -- [Slack](https://slack.com) for communication for all projects in the Cloud Native Computing Foundation Slack -- [FOSSA](https://fossa.io) for license and security scanning -- [Snyk](https://snyk.io) for container image scanning -- [Lift](https://www.sonatype.com/products/sonatype-lift/) for cloud-native and collaborative code analysis platform built for developers -- [HackerOne](https://www.hackerone.com) for bug bounties -- [Zapier](https://zapier.com) for task and workflow automation -- [Docker Hub](https://hub.docker.com/) for storing and managing container images -- [LFX Security](https://lfx.linuxfoundation.org/tools/security/) for source code security scanning and license compliance (white-labeled Snyk) -- [Credly](https://info.credly.com) Custom badges powered by Credly (for example [Linkerd Hero](https://www.youracclaim.com/badges/538d249f-ec6d-4c5c-93f4-44d7c5596b36/twitter) program) -- [Scarf](https://scarf.sh) for advanced analytics for container & artifact distribution, package installation, and web traffic to source documentation. [Get started](https://docs.scarf.sh/quick-start/). -- [Dosu](https://dosu.dev/) is a new AI teammate that lives in your GitHub repo, helping you respond to issues, triage bugs, and build better documentation (early access for CNCF projects). -- [Peritus.ai](https://peritus.ai/) for Machine Learning analytics and self-service for developer communities -- [Curiefense](https://curiefense.io) for application layer protection (web/API) - WAF, DDoS, Rate limiting, and more -- [CLOMonitor](https://clomonitor.io) scans repositories daily, checking for adherence to a wide range of actions that are taken to ensure best practise providing a way for end users to assess the health of open source projects from multiple points of view -- [CLOWarden](https://clowarden.io) an extensible, Git Ops-based access control service that controls and audits access to GitHub repositories for individuals and teams -- [CLOTributor](https://clotributor.dev/) search engine for people looking for opportunites to become Cloud Native contributors -- [GitVote](https://github.com/cncf/gitvote) a GitHub application that allows voting in issues and pull requests -- [Gitpod](https://www.gitpod.io/) cloud development environments are on-demand and pre-configured with all tools, libraries and dependencies required to be ready-to-code. - -CNCF staff is familiar with and can help projects with, hosting on AWS, GCP, Oracle, and Azure clouds. In some cases, we have free credits ([AWS](https://www.cncf.io/announcement/2019/11/19/cloud-native-computing-foundation-receives-200000-in-credits-from-amazon-web-services-aws/), [GCP](https://www.cncf.io/google-cloud-recommits-3m-to-kubernetes/), [Oracle](https://www.cncf.io/blog/2024/02/02/oracle-oci-credits-are-now-available-to-cncf-projects-here-is-what-you-need-to-know/)) for free hosting. We also have our own [Community Infrastructure Lab](https://www.cncf.io/community/infrastructure-lab/). - -## Technical Documentation - -CNCF significant investments per year to improve project documentation. This includes the following services: - -- Documentation assessments to help projects understand where to make improvements -- Website hosting and setup -- [Office hours](https://github.com/cncf/techdocs#office-hours) for face-to-face time with writers -- Technical writers and contractors for specific projects - -See [documentation services for projects](https://github.com/cncf/techdocs/blob/main/docs/services.md) for a full description of what the technical documentation team offers. - -Documentation examples include: - -- [Kubernetes](https://kubernetes.io) (i18n support and case studies) -- [Harbor](https://goharbor.io/) (full redesign) -- [gRPC](https://grpc.io) (full redesign and contracted tech writing support) -- [Helm](https://helm.sh) (build pipeline overhaul and i18n support) - -## Continuous Integration - -In the contemporary software landscape, virtually all major projects require heavy investment in continuous integration (CI) systems, which provide those projects with automated testing, dependency checking, security vetting, and so on. The CNCF covers CI needs for our hosted projects and allows those projects to select their own platforms; many CI systems are currently in use amongst CNCF projects, including [Travis CI](https://travis-ci.org/), [GitHub Actions](https://github.com/features/actions), [GitLab CI](https://about.gitlab.com/blog/2019/05/21/fluentd-using-gitlab-ci-cd/), [Azure Pipelines](https://azure.microsoft.com/en-us/services/devops/pipelines/), and [Prow](https://github.com/kubernetes/test-infra/tree/master/prow), the Kubernetes-based (and thus CNCF-sponsored) CI system used for Kubernetes and even some non-CNCF projects. Some projects are perfectly well served with fairly basic CI setups, whereas projects like Kubernetes and Envoy require significant financial and human resources. - -CNCF projects can also participate in [cncf.ci](https://cncf.ci), the CNCF's cross-project, cross-cloud continuous integration program. - -## Certification and Training Services - -The CNCF, along with The Linux Foundation, has made a major investment in implementing [training](https://www.cncf.io/certification/training/), expert certification for Kubernetes [developers](https://www.cncf.io/certification/ckad/) and [administrators](https://www.cncf.io/certification/cka/), and provider certification programs for Kubernetes as well as training for CNCF projects Prometheus and Fluentd. We have also worked with The Linux Foundation training team to develop self-paced online courses that can scale up a project's reach beyond what's possible using instructor-led courses. Over time, we expect to expand the training options to cover other projects. - -Examples of training we've already developed include: - -- Free Introduction to [Kubernetes course on edX](https://www.edx.org/course/introduction-to-kubernetes) MOOC -- [Certified Kubernetes Administrator (CKA)](https://www.cncf.io/certification/cka/) exam -- [Certified Kubernetes Application Developer (CKAD)](https://www.cncf.io/certification/ckad/) -- [Monitoring Systems and Services with Prometheus](https://training.linuxfoundation.org/training/monitoring-systems-and-services-with-prometheus-lfs241/) -- [Kubernetes and Cloud Native Associate (KCNA)](https://www.cncf.io/certification/kcna/) - -## End User Community - -The CNCF's [End User Community](https://www.cncf.io/people/end-user-community/) includes over 140 top companies and startups that depend on cloud native technologies and are committed to collaborative infrastructure development. The End User Community is an active participant in key technology decisions by CNCF-hosted projects with leadership positions on the TOC and contributions to many CNCF projects. - -For the definition of an end user see the [TOC FAQ](https://github.com/cncf/toc/blob/main/FAQ.md#what-is-the-definition-of-an-adopter) on adopters. - -CNCF end users are telling their stories to help elevate the technical conversations to business objectives and challenges. CNCF projects are featured in these use cases and the impact cloud native projects are having on their business. You can explore [case studies by project](https://www.cncf.io/case-studies/), such as Prometheus or Envoy. - -## Internationalization - -The CNCF has professional staff located in Asia Pacific to assist projects with their activities in that region. We offer internationalization support including: - -- Assistance for projects presenting at meetups and events. -- Simultaneous live translations in both Chinese and English for our flagship KubeCon + CloudNativeCon China. -- Translation services for projects that wish to have blog posts translated into other languages, see [Falco](https://falco.org/ja/) as an example. - -## Marketing - -Marketing services for projects are designed to assist with the awareness of the project, increase project adoption, and increase contributors. CNCF has marketing resources to support the projects in the following areas: - -### Event Management - -Events are central to CNCF's strategic approach, fostering community growth through direct interactions and knowledge exchange. CNCF offers various participation avenues for projects: - -| Event Type | TAGs | Graduated | Incubating | SIGs | Sandbox | -|---| :---: | :---: | :---: | :---: | :---: | -| **CNCF-hosted Co-located Events
KubeCon + CloudNativeCon &
Open Source Summit Events** | :white_check_mark: | :white_check_mark: | :white_check_mark: | - | - | -| **Stand-Alone Events** | - | :white_check_mark: | - | - | - | -| **Virtual Only Events** | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | - -Learn more about eligibility and the parameters for [CNCF-Hosted Events here](https://events.linuxfoundation.org/wp-content/uploads/2023/08/8.29.23_CNCF-Project_Co-located-Event-Guidelines_2024.pdf). - -#### KubeCon + CloudNativeCon Project Opportunities - -| Project Opportunity Type | TAGs | Graduated | Incubating | SIGs | Sandbox | -|---| :---: | :---: | :---: | :---: | :---: | -| **In-Person Kiosk**
(Project Pavilion) | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | -| **In-Person Project Meeting** | :white_check_mark: | :white_check_mark: | :white_check_mark: | - | - | -| **PR Support** | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | - | -| **Maintainer session** | - | :white_check_mark: | :white_check_mark: | - | - | -| **Project Video Updates**
(Keynote Stage Highlight) | :white_check_mark: | :white_check_mark: | :white_check_mark: | - | - | - -We provide: - -- Full event planning and logistical support. -- Integrated marketing and communication plan, including an event website, communications, and marketing of the event. -- Obtaining sponsors for the event. -- Media introductions. - -[Learn more about the guidelines here](https://events.linuxfoundation.org/wp-content/uploads/2023/08/8.29.23_CNCF-Project_Co-located-Event-Guidelines_2024.pdf). - -[Submit an Event Request: 2024 CNCF Project + Co-located Event Proposal Form](https://docs.google.com/forms/d/e/1FAIpQLSfbn0xSSsN4JBRrX80rqnfnAOigmX6yuRyPtLfzfGnLB4z7-g/viewform). - -Additional ways projects and project maintainers can participate in events: - -- Submissions for call-for-proposals at KubeCon + CloudNativeCon are encouraged to discuss their use of CNCF projects. -- CNCF sponsors industry and [Linux Foundation events](https://events.linuxfoundation.org/) each year, often with a booth. We encourage project maintainers to join CNCF in our participation to meet with the event attendees and talk about your project. - - Project contributors are welcome to use our booth as a "home base" for meeting colleagues. -- Connect to our worldwide network of [Cloud Native Community Groups](https://community.cncf.io/) and [Ambassadors](https://www.cncf.io/people/ambassadors/) to raise awareness of your project. -- Travel funding is available for your non-corporate-backed developers. Please visit our most recent events' need-based scholarship page to learn about eligibility. -- At events, we promote all CNCF projects and help connect users and developers to our projects. - -### Marketing Services and Programs - -CNCF provides a full portfolio of marketing services and programs to support community and ecosystem engagement for CNCF projects. This includes: - -- [CNCF Online Programs](https://github.com/cncf/foundation/blob/master/online-programs-guidelines.md): Graduated and incubating projects can participate in Online Programs like webinars, videos, and livestream. They can communicate release launch details or provide a project update. The exception is Kubernetes, which holds a webinar approximately 30 days after a release. -- [CNCF Blog](https://github.com/cncf/foundation/blob/master/blog-guidelines.md) and [Kubernetes.io Blog](https://kubernetes.io/docs/contribute/new-content/blogs-case-studies/): Graduated and incubating projects can submit blog posts. Share technical content and how-to's, stories about cloud native and project deployments, and use cases and success stories. Blog posts should not be vendor pitches. They must contain content that applies broadly to the Kubernetes and cloud native community. The Kubernetes blog receives over 1.5M visits a week. -- [Case Studies](https://github.com/cncf/foundation/blob/master/case-study-guidelines.md): End-user case studies help elevate the technical conversations to business objectives and challenges. This program features use cases and the impact CNCF project and cloud native technologies are having on end users' businesses. The case studies build narratives around specific metrics that reflect the positive as a resource for companies considering adopting cloud native technologies. -- [Newsletter](https://lists.cncf.io/g/newsletter/topic/cncf_newsletter_february/71376258?p=,,,20,0,0,0::recentpostdate%2Fsticky,,,20,2,0,71376258): The CNCF newsletter is published monthly. Project updates are a regular feature in the newsletter. -- CNCF manages the blog editorial calendar for balanced content shared with the community. We also provide writing, editing, and funding freelancers to develop content. -- Project media velocity reports: Monthly, CNCF pulls press mentions and share of voice data for all projects including mentions in social media and key messaging. -- [Fashion a Phippy](https://github.com/cncf/foundation/blob/main/phippy-guidelines.md): Graduated projects can donate a character to the [Phippy and Friends](https://www.cncf.io/phippy/) program, to help others better understand the concepts of cloud native computing, and increase the marketing and engagement opportunities for their project. - -### Marketing Communications - -The goal of marketing communications is to generate awareness for the project and project milestones, community growth, and developer engagement. The communication activities provided by CNCF include: - -- Proactive media and analyst coverage for projects including arranging and assisting with interviews and information sessions -- Promote project news and milestones through other channels: journalists, analysts, and news releases/blogs -- Identify top publications/podcasts (Bloomberg, Changelog, eWeek, Fortune, Forbes, InfoWorld, The New Stack, etc.) and develop plans to earn coverage through contributed articles, quotes, interviews, and news pick-up -- Secure analyst briefings for inclusion in reports: Gartner, Forrester, IDC, RedMonk, 451 Research, and more -- Organize media/analyst luncheons,1:1 meetings at key events -- Develop thought leadership reports, surveys, success stories, and case studies (print and video) -- Actively manage project social media channels (Twitter, LinkedIn, YouTube, Github, Flickr) - -### Surveys - -The CNCF marketing team can help create surveys for your project to help ascertain adoption or other interests. A prominent example is our annual [Cloud Native Community Surveys](https://github.com/cncf/surveys). For smaller, more targeted surveys, we can assist. Submit a request via the [CNCF Service Desk](https://cncfservicedesk.atlassian.net/servicedesk/customer/portal/1). - -## Marketing announcements for projects - -As projects have major or minor releases or move through the [maturity levels](https://www.cncf.io/projects/), CNCF works with the projects on outbound communications. Below are the items we can do with you. - -### Project entering and moving through the maturity levels - -Every project has different needs and staff works with projects based on those needs. Below are the services offered as a project moves through the different graduation levels and the support for graduated and incubating project releases. - -#### Graduation - -Projects moving to Graduation level receive: - -- Press release announcement -- Presentation slot at the upcoming KubeCon + CloudNativeCon -- Embargoed pitch of the announcement and top features to the media. Requests for interviews go to the project team. -- Tweet on announcement day, including social card - -### Incubating - -Projects at the Incubation level receive: - -- Blog post announcement on cncf.io written by CNCF marketing with assistance from the project team. -- Embargoed pitch of the announcement and top features to the media. Requests for interviews go to the project team. -- Tweet on announcement day, including social card - -### Sandbox - -Projects coming in as Sandbox - -- An announcement to the TOC mailing list on the day they are included in the Sandbox. -- If the media contacts CNCF regarding the news, CNCF will make an introduction directly to the project. -- Correct terminology: "Cloud Native Sandbox" or "CNCF Sandbox projects" -- CNCF does not provide press outreach, a CNCF or TOC briefing, a blog, or a social card -- Exception: A member may share a blog about any open source project, including a Sandbox project. See the [CNCF blog guidelines](https://github.com/cncf/foundation/blob/master/blog-guidelines.md) - -### Project launches and new release support - -#### Graduated projects: major and minor release - -- Project webinar, up to a max of 2 per year -- Blog post announcement on cncf.io either written by CNCF PR with assistance by the project, re-posting of project's own blog post, or a blog post written exclusively for cncf.io by the project team -- Embargoed or day-of pitch of the release and top features to the media as relevant. Requests for interviews go to the project team for interviews. -- Tweet on announcement day - -#### Incubating projects: major release - -- Project webinar, up to a max of 2 per year -- Blog post announcement on cncf.io either written by CNCF PR with assistance by the project, re-posting of the project's own blog post, or a blog post written exclusively for cncf.io by the project team -- Embargoed or day-of pitch of the release and top features to the media as relevant. Requests for interviews go to the project team for interviews -- Tweet on announcement day - -## Code analysis and fuzzing - -Fuzzing is a technique for dynamically testing applications to find reliability and security bugs. Several CNCF projects use fuzz testing to analyse their code such as [Envoy](https://github.com/envoyproxy/envoy/blob/main/docs/security/audit_fuzzer_adalogics_2021.pdf), [Fluent-bit](https://github.com/fluent/fluent-bit/blob/master/doc-reports/cncf-fuzzing-audit.pdf), [Vitess](https://github.com/vitessio/vitess/blob/main/doc/VIT-02-report-fuzzing-audit.pdf), [Linkerd2-proxy](https://github.com/linkerd/linkerd2-proxy/blob/main/docs/reports/linkerd2-proxy-fuzzing-report.pdf), [Prometheus](https://github.com/prometheus/prometheus/blob/main/promql/fuzz.go), [Kubernetes](https://github.com/kubernetes/kubernetes/tree/master/test/fuzz), and more. The integration of fuzzing is often combined with [OSS-Fuzz](https://github.com/google/oss-fuzz) (all of the just-mentioned projects are integrated into OSS-Fuzz), which is a free online service that will run your fuzzer continuously. We highly recommend integrating fuzzing into your project, but the benefits of fuzzing varies from project to project. - -Fuzzing works best with projects that have high code complexity, e.g. parsers, decoders, etc. but can be used in many other projects. You can fuzz projects in many languages, including C/C++, Go, Rust, Python and Typescript (not yet supported by OSS-Fuzz), and the type of bug you will find depends on which language your project is written in. - -To give an understanding of the success fuzzing has achieved in various projects: - -- Envoy has invested significantly in fuzzing and OSS-Fuzz has reported more than [1000](https://bugs.chromium.org/p/oss-fuzz/issues/list?q=proj%3Denvoy%20Type%3DBug&can=1) bugs as well as [115](https://bugs.chromium.org/p/oss-fuzz/issues/list?q=proj%3Denvoy%20Type%3DBug-Security&can=1) security relevant bugs -- Fluent-bit has been fuzzed for slightly more than a year, and OSS-Fuzz has reported more than [200](https://bugs.chromium.org/p/oss-fuzz/issues/list?q=proj%3Dfluent-bit%20Type%3DBug&can=1) reliability issues and more than [100](https://bugs.chromium.org/p/oss-fuzz/issues/list?q=proj%3Dfluent-bit%20Type%3DBug-Security&can=1) security issues. - -For an example where fuzzing was determined to have limited effects consider [Cloud Custodian](https://github.com/cloud-custodian/cloud-custodian). Cloud Custodian is a project written in Python and is very horizontal in its architecture in that it does not have deep code complexities. This is an example where fuzzing will have limited results as discussed in detail in a [PR](https://github.com/cloud-custodian/cloud-custodian/pull/6832) on the Cloud Custodian repository. However, Cloud Custodian still benefited from fuzzing finding a bug in the code of Cloud Custodian where fuzzing could be applied, but, in comparison to the other projects mentioned above Cloud Custodian is not integrated into OSS-Fuzz. - -The following list indicates some common software properties that means your code is likely to benefit from fuzzing - -- High code complexity -- Deep code paths -- Accepts untrusted input -- If a reliability or reliability issue occur then it can have significant consequences for systems -- Is used as a library by other applications -- Projects in memory unsafe languages should have a high priority for being fuzzed (but fuzzing is not exclusive to memory unsafe languages) - -## Other Services - -This list isn't a comprehensive list of all services covered. Projects can, and do, request additional services through [CNCF Service Desk](https://cncfservicedesk.atlassian.net/servicedesk/customer/portal/1) and we work to get them the help they need. - -To contribute your project to CNCF or discuss how CNCF can help your project, email and read the [TOC repo](https://github.com/cncf/toc#projects). - -## FAQ - -### How do I file a ticket with the Service Desk? - -If you're a CNCF project committer/maintainer, all you have to do is visit [the web portal](https://servicedesk.cncf.io/) to request support. - -All CNCF maintainers are listed [here](http://maintainers.cncf.io/). - -### What happens if I want to use a tool or service not listed here? - -Projects are welcome to use their own tools in the CNCF, we are a strong supporter of choice and flexibility. If you're interested in using a new tool and want CNCF to officially support it, please file a ticket and we will see what we can do to help! - -### Is there an SLA for Service Desk issues? - -Yes, you should receive a response within 48 hours. - -### How much budget is available for projects? - -The CNCF doesn't set a fixed amount of budget for each project and will work with you best on your needs. - -### How do I file a security CVE as a project? - -GitHub has also recently improved the ability to do security disclosures and generate CVEs, we recommend projects use this: - As a backup, you can submit a CVE using the MITRE CVE submission form: (The CNCF is currently not a CNA). - -### How do I create a security disclosure process, e.g., SECURITY.MD file? - -It is recommended that CNCF projects create a security disclosure process to make it easier for adopters to report issues. - -There is no one set way, you can look at other CNCF projects for examples: - - - -Google has also put together a set of templates that may be useful: - - -### How do I share credentials, passwords, or other confidential information? - -The CNCF doesn't enforce the projects to use any specific tool for sharing credentials, passwords or other confidential information, however we recommend using [Keybase](https://keybase.io/) or applying for 1Password's [free open source plan](https://github.com/1Password/1password-teams-open-source). - -### How can I use the computing infrastructure provided by the CNCF? - -The CNCF prefers projects evaluate using our [Community Cluster](https://github.com/cncf/cluster) first. We have partnered with various providers that offer discounted or free services for CNCF projects. For example, CNCF projects may use the credits offered by [Amazon Web Services](https://www.cncf.io/announcement/2019/11/19/cloud-native-computing-foundation-receives-200000-in-credits-from-amazon-web-services-aws/) or [Oracle](https://www.cncf.io/blog/2024/02/02/oracle-oci-credits-are-now-available-to-cncf-projects-here-is-what-you-need-to-know/) for their upstream testing, CI/CD, and other purposes. See the [Tools](#tools) sections on this page for more details. - -To benefit from one of these offers, please submit the Service Desk ticket with a detailed description of the request, including the purpose, a list of the desired services, and a rough cost. - -Code being run must be 100 percent open source and must not include any sensitive data. - -Please note that available computing resources are limited so we may ask you to reduce your usage when there is high demand for the available credits. Specifically, please consider shutting down the unused computing resources, use automation to terminate the bare metal/virtual machines if they are not intended to be used 24/7, use spot instances if applicable etc. Please estimate your budget to use no more than $3000/month USD in AWS or Oracle credits. If you expect higher resource usage on a regular basis, please consider using the [CNCF Cluster](https://github.com/CNCF/cluster) instead. - -The CNCF expects fair usage of the allocated resources and credits, and reserves the right to terminate any allocated infrastructure resources and revoke the access to them in the case of violation of these rules. - -### My project is affected by the [Docker Hub rate limits policy changes](https://www.docker.com/increase-rate-limits), what can I do? - -In 2020, Docker announced the changes to [image retention](https://www.docker.com/blog/scaling-dockers-business-to-serve-millions-more-developers-storage/) and [data pull rates](https://www.docker.com/blog/scaling-docker-to-serve-millions-more-developers-network-egress/). - -The CNCF has reached an agreement with Docker that these limits can be eliminated for CNCF projects - if your project is affected by these changes, please consider applying to the [Docker Expanded Support for Open Source Software Projects](https://www.docker.com/blog/expanded-support-for-open-source-software-projects/) program via the [form](https://www.docker.com/community/open-source/application/). - -NOTE: To have your application processed correctly by Docker, please explicitly mention that your project is hosted by CNCF. Also, please note that the approval process may take a few weeks. - -### How do I get GitHub project and team management for my project? - -Each CNCF project can decide on its own how to manage GitHub invites and teams. Some are small enough and just do it manually, others use automated systems like these: - - - - - - -### My builds are slow, I would like to have expanded capacity for GitHub Actions, what can I do? - -The CNCF has a special partnership with GitHub, please file a [Service Desk](https://cncfservicedesk.atlassian.net/servicedesk/customer/portal/1/user/login) ticket and we can expand the amount of hosted runner minutes. Note, some projects have also expanded their build capacity by using the CNCF Cluster via [GHA External Runners](https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners) - -### I don't have a Service Desk account - -Head to the [Service Desk](https://cncfservicedesk.atlassian.net/servicedesk/customer/portal/1/user/login) website and try to log in, if you can't find an account, email and one will be created for you. - -#### I am a Kubernetes SIG chair and I don't have a Service Desk account - -The CNCF Service Desk policy for the Kubernetes community is defined at [Kubernetes Steering repo](https://github.com/kubernetes/steering/blob/main/operations/service-desk.md). - -### I changed my email and lost my Service Desk access. What can I do to get it back? - -Email and one will be created for you. - -### I am not happy with the level of service from CNCF staff, what can I do to escalate? - -If you aren't happy with the service provided by CNCF staff or with a resolution of an issue, you have a couple of options. If it's a technical matter, you can appeal to the [Technical Oversight Committee](https://github.com/cncf/toc). If it's a budget-related matter you can appeal to the CNCF [Developer Representatives](https://github.com/cncfdevreps/issues) on the Governing Board. +The [CNCF Service Desk](http://servicedesk.cncf.io/) provides a way for maintainers to request these services. If you are a project maintainer, head to the [Service Desk](https://cncfservicedesk.atlassian.net/servicedesk/customer/portal/1/user/login) and try to log in, if you can't find an account, email and one will be created for you.