Cloud Native Computing Foundation Contributor Strategy Special Interest Group, 8 Jun 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: CNCF SIG Contributor Strategy Governance Working Group 2020-06-08

Description

CNCF SIG Contributor Strategy Governance Working Group 2020-06-08

A

A

Do hey Terrence, okay, I guess we will go ahead.

A

So far, just us, it's been very quiet in the channel today. If you noticed.

B

I've noticed most slack SiC channels aren't super super active yeah.

A

Well, I mean a lot of men.

B

A

The land of cloud native are involved with the protests in some way.

B

Yeah that and like I think mailing lists tend to be the primary form of communication. Yeah.

A

Anyway, well, really, why honestly have to admit.

A

A

Don't pay a lot of attention to the mailing list, I just.

B

Know a lot of those things you have communication. That seems to happen to the my own list, so I think I know with like at least the other thing. That involved is the a deliberate sakes. That's one no power yeah.

A

We just used the mailing list for announcements, though there's no real discussion. The.

A

So, given that, if, in the event that April does not show up we'll just end up taking up the whole meeting for the whole and user requirement discussion, so in the meantime, because it's being recorded, let me do the obligatory stuff, howdy I. This is officially a meeting of the CN CF governance working group. This is being recorded for CN CF documentation purposes.

A

We are also subject to the CN CF code of conduct, and so everybody on this call promises to be a nice responsible, human being at least while they're on this call the I and so that out of the way we can discuss stuff just wait. Did you used to work at Heroku I still.

B

Work at orakau, please don't work at Heroku, yeah.

A

Cool we were you there when Craig and Peter were there? Yes, because they're.

B

Both friends of mine, so your name does sound familiar but I can't yeah place. Why I showed.

A

Up in the office of number times, I used to be a Postgres committer, so gotcha.

A

A

There is the notes, feel free to add anything you want to that.

A

We will focus pretty much entirely on the end-user stuff because it's you and me and punt on the other issues until next meeting or some other time.

A

So now, one of the things that our preface this with is I, actually kind of don't feel like the end user requirements is really a governance issue, but looking at it there's no other good place for it to be, you know, and since we are dealing with a bunch of the other titular requirements, it seems it's not really governance, but it's not really anything else either.

A

So it might as well be us, but later on, somebody might decide that they actually are going to lay claim to the requirement I.

B

Mean, if not you, then the TOC I guess is the ya.

A

Know you never want stuff to originate in the COC. You know yet, honestly what you'll get is you will get an updated requirement that is a wholly confusing.

B

So I guess I was just for context. I think you weren't at the last to see meeting last week or something I.

A

B

So that Harry, actually from the app delivered sig brought this up, because it's like blocking their what recommendation on bill packs of like what they want to say with regard to it for incubation and yeah I came up in the meeting. I think the thing that was kinda sided was like case by like basically very unsatisfactory, like case by case basis. Shrug question mark like I. Can.

A

See when it comes in I mean that does are terrible, because what that means is projects that have a project contributor who's on the TOC, get okay, then, and projects that don't don't, which is not how we should be deciding things. But.

B

Yeah, maybe maybe were three watching that, like five minutes segment or whatever from okay see but I I, believe that was like kind of conclusion like it was brought up, and there was some examples like I know, even for Apple. Every saying like this is a thing that cloud events, which is an incubation project, brought this up because it's you know an even more stringent requirement going into graduation right of like what our end users. What what does that mean?

B

It's like mostly a spec tools, projects, and that regards like how do you consider what the end user should be? Yeah.

A

When I guess so, I guess two questions that I have there. It is I mean number one.

A

One of the problems I'm going through with the TOC in general is that we have this list of requirements for incubating and graduated, but not one of those would know a couple of them do, but most of them have no rationale behind them as to why those things are requirements and without the rationale, it's really hard to figure out how to judge these right because, like you, have two possible definitions of end-user right, an end user could be specifically how this is sort of put on the CN CF website.

A

But that's really for the end user counsel, which is companies that are not vendors as a company right. But then you also, we have this other definition, which could be your an end user if your company is not in a position to ever have a product based on the project. If you follow me.

B

A

Would be a second potential definition and not one we'd want to use for the end user counsel, but potentially one we'd want to use for an individual project and without the toc telling us what the rationale for the end user requirement is. Then I don't know if that's completely reasonable.

A

So like, if we were to actually make the requirement of the end, users just have to be companies that do not and are not likely to have a product that is in some way based on the project. Then that would solve the problem for build packs and in cloud events.

B

Yeah I mean I guess my question is like: why is it problematic to have like I get in certain cases where that's true but like like I, you think specific for bill packs to for me?

B

It's just when I think about end user, like the people we were most interested in initially of like targeting are people that very much are producing products on top of the software that we're building, not because we're making money off of that, but because, like it, has the largest breadth of and rank or like of, why kind of reach so like if, for instance, like Heroku, for instance, right like has a past that uses build packs as the way to build stuff for it like, and they may like for.

A

Sure, like probably makes money off of that right.

B

A

Like I would personally count that as an end user, if you follow me, you're not selling build pack they're using build pack to build something and then selling that thing right, yeah, it's just like if I'm General Motors I'm, not a Linux vendor I'm using Linux to put it on the onboard system to sell a car so.

B

Yeah I guess that distinction is definitely not clear to me. Well.

A

So so I think part of the error. From my perspective, part of the problem here is the CNC F is trying to use the same definition for the end user Council and for the end user requirement for projects and I. Think personally, I think those two should be different, because the purpose the end user Council is to have involvement in the CNC F by companies where the entire company is not a vendor. I can come up with a couple of possible rationales for the end-user requirement.

A

So I'm trying to take notes at the same time, I speak.

A

So rational number one is obviously potentially to push all of the individual projects to help build the end user council right. That's a possible goal of the CNC F right. Obviously, end-user involvement in the CNC F helps the entire CNC F and therefore individually, all of its projects and therefore the CNC F maybe wants a requirement to push projects to actively participate in this.

A

But another possible reason for that requirement is what I call avoiding the C++ problem. Like I, don't know if you ever did any C++ very limited, mostly in school, but not in a professional context. So back during the peak era of C++ there was this International Committee called the object. Man judgment group, also colloquially known as oh, my god, for lots of very good reasons um and the object management groups.

A

Job was to meet twice a year somewhere in the world and pass a bunch of C++ specs and the way the specs work is a vendor would write us back. They would get a couple of their partners to support it. They would shove it through and no one in the world would ever use that spec to ever write any actual code.

A

And that's the other possible rationale for the end user requirement. If you follow me because the companies that are most heavily involved in the CNC F our vendors in because the vendors often partner with each other, there is the possibility of creating basically shell projects.

A

That is, projects that are good for each company's marketing, even though nobody actually uses them and the CNC F is an organization doesn't want to get in a position where they are promoting a bunch of shell projects, because that harms the scene saves brand and harms the brand of the individual of the actual projects that do have users do.

B

Those companies also not use that project that they are putting in oh yeah,.

A

I I can't go into specifics because I work for a vendor. But let me.

B

A

Name quite a number of projects, greeted in the cloud native space that are used by nobody, including a company that originated them.

B

So I guess like as a more concrete example like I, know in our case right for build packs like I put down both of the two companies involved, as example, and users, because we are using it in a context, were like we we are. Actually we want to use the thing. The reason working on this, because we want to use the thing we're building right, but we also wanted to work kind of outside of just the scope of the two things. The two guys.

A

B

Right for those like good examples of end users or do not want to and users that are basically family members of that project. Well,.

A

I mean the problem with say: the originating company having internal end-users is that anytime you're talking about a single company. We have this issue with the maintainer diversity thing also that company can have a company-wide policy change and then erase support for the project.

A

A

The reason why I was going over those two possible rationales and why I really want the TOC to pick one of the two, as the primary rationale is because which one is the primary rationale, really makes a huge difference right.

A

If the primary rationale is to get more end users for the UC, then we have to stick to the definition for the end user council right and you have to find companies that are not software vendors. Who will say yes we're interested in this.

A

But if the goal is to avoid publishing empty specifications that it's very different right, then VMware could be an in not VMware. But then RedHat could be an end user for cloud native, build packs because we don't have anybody contributing to it, but we could use it. If you follow me right, and so you know what the rationale is kind of makes a huge difference in how this is supposed to be implemented.

A

Now, in the case of cloud native bill, packs I don't see why you wouldn't have si slash, I, see companies using it and because, theoretically, anybody who develops containerized applications should be able to use it right. There's.

B

A

Requirement that it be a big company, you know you could have a mement I'll tell you from some of the existing projects. They've made use of end users that are really three-person consulting companies, but that's still considered legit. As far as you know, any of this is concerned, so.

B

A

B

One company that an RFC that I think is like in that, where they are like three or four people, maybe, and they are using it internally as well, but there's also I, guess like because there's distinction between like like Harry from the app site, they see, made us differentiate between end users by I, guess, like the end user, council definition and like cloud vendors.

B

So there's that me, like a lot of interest from the majority of stuff, tends to be like cloud vendors that are interested in adopting that so like yeah, for instance, like gitlab right, like they want to use bill packs as a mechanism for people dealing to run, get containerized stuff for CI. Right, like that example, and that's why they're involved the project like right technically like they're a cloud vendor so Google is also cloud vendor microsoft's, also cloud vendor right, ooh, salesforce cloud vendor right like building a platform on top of it.

B

So a lot of our people that we interact with tend to be that type of lease at the stage of the project is now like. There definitely are this. Other group of people like you're saying, but they it's hard for us like I, guess like find that information out yeah. It has been so far, yeah.

A

Oh no, it's always it's always difficult. I'll tell you, as somebody who ran a BSD license project for 17 years figuring out who your users are, there's no yet figuring out who you, users are and then finding users who will let you publicly reference them right. Yeah I mean that was always a huge challenge because, like you know, cuz consultants talk to each other like we knew that say.

A

The Army in the Coast Guard were using Postgres, but that doesn't mean we were allowed to publish that information.

B

Right yeah I mean I know that even a Heroku right like we're not allowed to talk about our customers and what's there on the marketing page yep, you know if, like all these people that are using your product, but you can't say anything about it: VM.

A

So yeah, okay, so.

A

But you see so overall I mean, like I, think our next steps are to pressure the TOC to make a judgment call on what the primary goal of the end user requirement is because and you.

B

Wanted this for everything? Not because.

A

As I was saying so right now, we're argue about the whole maintainer diversity thing is and I have to say: look we need to stop making these stupidly simple rules. That makes the assumption that everything is black and white, because in every single open-source project is its own special snowflake and we actually need guidelines more than we need rules because like for example, if we say this is, if we say.

A

Like if we say the requirement is, the purpose of the CNCs requirement is that project should need users to participate in the end-user counsel. Then.

A

That's actually kind of a different requirement. If you follow me, yeah.

B

A

Which case you could even say, hey, the requirement is actually to recruit a certain number of users for the end-user counsel, not to publish them on your website, because that might actually be different right, particularly like, for example, say that one of my end users was a bank. I would actually have an easier time getting them to join the CNC F end-user counsel then admitting publicly, which software they actually used, because a lot of the banks have policies not to ever disclose what specific software they use right.

B

That's okay! That's just like yeah, yeah or.

A

If the requirement is hey, we want to avoid empty specs and show that projects have actual adoption before they advance. Then there should be substitutes right. It should be even hey. This project can be used entirely by cloud vendors, but if you have five or more cloud vendors who have adopted it, then it clearly has an industry-wide adoption and it's not gonna go away tomorrow.

A

B

Do you, since it is more likely the latter, based on the conversations from the meeting last week, but yeah you'll be good at clarity, yep.

A

So and you know, and then, if we get clarity, we can proceed because it is harder for some projects than others it most definitely is the I mean in the meantime, given that the TOC tends to take a long time to make decisions on anything, I would suggest trying to probe in your various community meetings and stuff to see if you can find some I Caesar s eyes, because those count and if you can find three of those than you've met the letter of the requirement and- and you know we stopped having to- we- don't- have to argue out the larger issue for coordinated buildpack specifically get past.

A

If you follow me, no, so the and it's interesting because there's also this distinction on cloud vendor because, like I, would honestly not have considered Heroku a cloud vendor by the CAF definition. Just because.

A

Well, I, don't know, did did cloud native, build packs, originator, oku, I thought originated, it VMware.

B

Climate was the fill packs rigid out of Heroku and climate bill packs is built as a joint effort between both Heroku and pit roll, basically pivot who's. Now BM wearin Heroku who's, now Salesforce through acquisitions of like taking the things we learned over running this thing in production for nine years from different angles and trying to we had tons of fragmented bill packed ecosystems. It was like we want one bill, pakiya system, that's built around basically kind of containers and tooling, and leveraging all that stuff versus our own.

B

Like proprietary, really proprietary, tarball slugs, instead used container images in like build the thing kind of with a new spec and a new thing kind of taking those ideas and bring them forward, and that was kind of premise of it. So we were both like Toph, equally co-founding this project and that's how we got into sandbox yeah I, don't know if they answered your question but yeah.

A

I, don't know it's just well. One of things I was thinking about is, is the sort of fuzzy line between cloud vendor and cloud service provider right right, because if your dig Salesforce the parent company, they're kind of not a cloud vendor, if you follow me, they use other people's cloud technology to supply a cloud service right, there's only view an example of one: that's all the way on the other end right.

A

That is, nevertheless in the cloud business automatic, with 1/t, not automatic, with two T's, which is a cloud consulting company and therefore on the border but automatic with 1t as a company that allows you to use the cloud in order to do things with your vehicle, that is, they basically connect the cloud to the vehicle computer readout in a whole variety of cars.

A

That's definitely an end user, though right they're, never gonna have their own kubernetes distribution or you know, and it's highly unlikely they would ever sponsor a project to the CNC F, and then you get into some of these fuzzy things right of well. Ok, what about a company? If you have a company that never has sponsored a CNC a project but potentially could someday in the future? Where do they fall on it or if you've, a company whose main business is something else entirely right?

A

General Motors could sponsor a CNC, a project I mean they haven't, but technically they could. You could imagine there being a future in which they did I don't know the whole end-user thing confuses me, because there are things that are obvious right. Red hat is obviously a vendor. Vmware is obviously a vendor right, but there's a whole bunch of companies in the Middle where it's like. Is this an end user or not? Yeah.

B

I mean I, guess to me, like most of this stuff comes from the app delivery sake of like telling me that these are vendors, and so that's kind of how I bucket it, but maybe part of even menus of things like what is the definition of vendor.

B

It probably also fits under her it's worth clarifying what that is like I, basically split it up into end-users, CLAB vendors, and then the third category was like open source software projects because, for instance, there are open source software projects that obscene they're, not a service or anything like it's open source software that uses climate bill packs as part of like they have support for climate bill packs. As part of that bright way,.

A

It's like, oh, actually hold on. Let me look at the requirements because I'm not sure that the end user requirement says company and if it doesn't say company, then an open source project would count and for that matter of the open source project has a foundation. It would also Kemp.

B

Yeah and in that section, I basically just listed those three categories and put a bunch of things in there and.

B

Basically, offered up to the TOC or whatever, to kind of make a decision on that.

A

Okay, the limitation. There, though, which would make it difficult with open source projects, is used in production right which actually believe it or not. It could coordinated bill packs could be used in production by an open source project if the open source project is distributing their software via cloud native, build packs, yeah and the project itself is not staffed by a vendor company, then I would list that.

A

So where it becomes sticky is if it's, if the cloud, if the open-source project is staffed, it's primarily staffed by a vendor company right because you could say hey fedora is you know, releasing cloud native, build packs for applications, not that they are, but if they were and then turn around and say, write fedoras, primarily step by Red, Hat and Red. Hat is a cloud vendor and therefore this doesn't count. Yeah.

B

We definitely have some of that stuff with VMware has a bunch of open-source products that use it, but they aren't the only ones yeah I guess. Is there a distinction between like a contributor who's, like not part of the core team, but like is an actual contribute product, so, for instance, like Google has open RFC's has made patches to the project and we're trying to get them to be a contributor because they are pretty active in it, but they have projects that use it kind of independent from the people.

B

I guess that are actually running, but actually contributing to climate bill packs right, like damn parts of Google, like so scaffold for instance, or KF from the Google side, o have cloud made bill packs as part of their documentation.

A

A

Okay- and you said you actually have to run now- yeah yeah.

B

A

B

Helpful I can link to be buildin stuff to you. I, don't know if.

B

A

Of the issues are bringing up our lack of clarity, issues that yeah.

B

A

Know already kind of readily apparent when you read the requirements, because yeah.

B

A

Know they give you listings of obvious examples of companies that fall, who usually on one side of the line or the other, but there's a whole bunch of entities in the middle.

A

The and again the rationale matters right, because if it's the empty spec thing then showing it had broad enough vendor support would also cover it.

A

B

Yeah I guess for next steps. Is that the say just talking to or the governance.

A

What's up with the TOC, because I'm already pushing for clarification on a bunch of the other requirements, because I'm like look I'm about to write detailed guidelines for you guys on how to implement these requirements. But I can't do that. If you won't explain why the requirements exist. Sure the.

A

But the problem is that the requirements were not necessarily created by the current TOC and they don't actually know why they exist, and so they have to hash out from scratch. Sure.

B

Make any sense, probably without the next you see if they have that information too yeah.

A

So so that's the next step for me is to take this to the TOC and start a discussion and ask hey. We need clarification here. The next step for.

A

The next step for you I, would say the thing I would advise doing, because again that discussion may take a while in the in the TOC is, you know, do don't just focus on the big companies? Look for smaller organizations that would qualify as.

B

A

Users, because if you can meet the letter of the requirement and you've met all of the other requirements, you'll probably get past.

A

So the and honestly it's not even the letter of the acquirement right if three completely independent s is found the software useful. It's useful. It doesn't matter whether we're talking a three guy, consulting shop or unisys.

A

Right because honestly, unisys may say we're using this, but they're only using it on one project, whereas the three-person IC might use it for 10 projects, so the it's still legit, it still counts and I might general. My personal experience is consultants. Are a lot more willing to talk about what they do. Then, then more established companies often are who have a PR process, etc. Right.

B

Make sense: ok, thanks for the advice, oh you're,.

A

B

A

Know how to communicate and I'll, you know what happens with the TOC or you can just follow the TOC mailing list and the issue that we opened on governance. Wg sounds good thanks.

B

A

And that's it for this meeting thanks all.