Kubernetes Steering Committee, 28 Feb 2018

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Steering Committee 20180228

Description

Chat log (times may be off):
00:05:45 Sig Auth-Lead: brb
00:06:17 Timothy St. Clair: There are many different types of users.
00:06:42 Michelle Noorali: Do you have the link to the doc Sarah?
00:08:04 Sarah Novotny: Values doc - https://docs.google.com/document/d/12J0YLKBOfBTMd8ZdPpFMIAhMmGIfapMg-nkYPJYY7FY/edit
00:25:43 briangrant: SIG Scalability charter draft: https://zoom.us/j/702272177
00:27:02 Michelle Noorali: idk bout y’all but this is feeling like some serious progress
00:27:40 Sig Auth-Lead: we are a huge amount of cats
00:38:52 Sarah Novotny: Progress… always slower than we want, but much easier now that more of us are driving.
00:45:17 Sarah Novotny: BRB
00:50:39 Brandon Philips: https://github.com/kubernetes/sig-release/blob/master/security-release-process-documentation/security-release-process.md
00:51:47 Michelle Noorali: https://github.com/kubernetes/sig-release/blob/master/security-release-process-documentation/security-release-process.md
00:51:57 Timothy St. Clair: We’re T-Minus 10 Minutes, did we want to identify next sprint items?
00:52:35 Sarah Novotny: #1 Finish these sprint items?
00:54:20 Michelle Noorali: I’m more terrified than anything
00:59:35 Sig Auth-Lead: hahaha
00:59:39 Sig Auth-Lead: sarah, the look on your face
00:59:42 Sig Auth-Lead: was priceless
01:00:33 Sarah Novotny: :D
01:00:57 Sig Auth-Lead: +1

A

All right so I'll just do that. It's the 28th of February the last day- and this is the steering committee meeting and Sarah- was talking and I rudely interrupted her to start the recording. It's.

B

All good I was admitting my failures. I still owe a PR for the values document into the sku burn it earring repo. However I did get one comment back from Ken Goldberg that we do not have a value that says anything about a user voice or a customer voice or thinking in terms of building building this for people who might want to use it and I thought that was a big enough gap. We might want to talk about it.

C

Yeah make sense no.

A

It's interesting is of the hey I'm. Sorry I was.

B

Meeting one of the earlier versions had a comment about, but you know: building a best tool for users and use cases, but I think that got stripped out at some point. But I can't remember where which version it was in I. Think that digging through comments it.

D

Seems like a great thing to add to the next iteration I.

A

Like your thinking Brian- and it really begs the question in my mind- and this is something like I- don't know- Brian I work we're talking in one of these. You know face-to-face dinners at one point and I brought up the situation of like well, who are the different users of kubernetes, and one of the examples I brought up was like this idea of embedding kubernetes of kubernetes actually being in validation, detail of, say, a box or something like that. Right is that a user, and so there's these questions around.

A

Who exactly are our users and who do we target? How broadly do we hire I? Think it's actually a pretty deep topic for us to actually say who those users are. Okay,.

B

I, like they put it up and mark a comment in the PR and maybe.

D

An excuse for for postponing, as well as like, defining the different personas of users and the different use cases, because.

E

D

Is gonna, they're gonna have to be priorities, and this has come up in the conformance effort as well like initially some people who are embedding kubernetes in a pass but didn't expose it wanted it to be conformant. What, and the answer is? No, if you don't expose the cupboard API, there's no possible way. You can be conformant whether it's performance matters to you or not, is a whole different thing right, like I.

B

D

Argue it shouldn't matter to those people, because there's no they're, not exposing you kubernetes people and be compartment with eye.

A

I think multi-tenant is another example is like you know how far down the multi-tenant rathole do we actually chase and I there's arguments on all sides then.

C

Okay, next friend thing interested governance.

D

Saying there's the department stock got merged, I've, updated it and sent another PR that just incorporates the sub projects into a little more, and he calls out sub projects having to create the technical items instead of six okay.

B

D

There's the short template, that's out for review. One item that needs to be determined before that's merged is what to call the say, Glee. What is currently in the text estate lead, but the non-technical lead and there there's a pull.

B

D

Nine votes in.

B

Wise has been using coordinator across his and that might be I, don't know if that's in your list or not it that's.

D

The current Santa.

F

You're not supposed to mention that until everyone's vertical.

A

I thought it was fascinating that all like, almost all of my top choices, were like on the bottom. So that says something about me.

G

H

Think I voted admin, so maybe I'm the outlier there was my number two I was just curious. What is the I actually pulled that one from the list? But yes, there was. There was something.

I

Else submitted it and just one question that came up in my mind, while I was filling in that poll of yours was how are we planning to communicate this, this technical lead? So, as Joe pointed out, we've now identified this coordinator thing and we're gonna list it as the coordinator for that sig. But, but it seems like there's a recognition that we also have a technical lead, which presumably we're also going to vote on some title for this person and and how are we?

I

Gonna represent the Singh with respect to its coordinate, a lead and its technical lead. What's the thinking there so far,.

D

Actually sure yeah so I think the way that would integrate with sub-projects is you either have technical, leads and sub projects, and then that's where most of the technical discussion happens and if there's a technical lead at the sig level. That would be mainly just to determine what sub projects exists, create destroy as well as address like cross state air across sub project decisions. So that's one option and field escalations and yeah field escalations and essentially anything that doesn't fall scoped directly within only one step project.

D

The other option would be that, instead of having a group of say, tech leads, you have the project leads or technical leads from the sub projects, collectively be the the group of individuals with those responsibilities through some sort of federated approach. We.

J

Have particular SIG's identified now where that split would actually be split, or, if that we think the majority of SIG's would have the same. People hold both roles, I.

D

Think there are a fair number of SIG's where people would hold both roles, one counterexample that I came up with, and one can argue whether it's a good thing or not, but think closer life cycle has a ton of sub projects and there's no real overall lead.

D

So if we're going to incremental, we roll this out without being too disruptive or dealing with power grabs or like that I think we first deal with the cases that are obvious where everybody agrees: who's in charge and I think there are a bunch of sakes and sub projects where that's actually the case and we're just formalizing how things work and for other cases we at least get some amount of decision-making officially put into place, at least up to the sub project level, and we say well this this sake until there's an appointed or elected or chosen or whatever overall lead.

D

They have to rely on lazy, consists of seeking, with voting or whatever, to break ties among the sub project leads.

G

Do we have any sense of whether there will be any SIG's where the existing leads will have a problem being effectively demoted like I want to make sure that we don't perceive this as a demotion for people, but our I.

D

Mean these would be cases where they're these are people who technically are called cig leads today, but they're not known as files for the for the code is actually owned by that SiC they might be owner Styles, but they're, maybe not the ultimate owner I. Think.

E

Having the explicit role actually helps, people find their way into the community too, because, like there are people who would be, there are people who are doing cat wrangling who don't want to do cat wrangling right and like if you want to manage and update and curate the issues and the prioritization for the release. You know any are really good at that and you enjoy that I want it. Well those people to find a happy home in a cig, yeah, no I, don't I, don't disagree.

G

With that I think the structure is actually really good. I'm just worried about the the social implication of this I. Just don't want it to be perceived I, don't think it is a demotion I, just don't want it to be perceived as well.

A

That's why we need a unique and different name right, because if we, if we come up with a new name and we're saying signally, doesn't exist anymore and we're taking what you know, oftentimes is sickly or splitting it. In these two different functions or these separate functions and hats, then people can map themselves into those things.

D

And we can also do the exercise of going through some number of six to see how well we think that the model holds up and how much change there will be I. Think that's valuable.

B

D

B

It and make sure that we frame it as valuing these characteristics is a huge part because, there's you know, there's a lot of people who can bring contributions to the community in this way that can't bring it. You know in a stick architecture, level, lead position or tech lead position or whatever we'll call that one another.

D

Thing we're adding to the proposal. I think is the idea of creating more roles for each cig more like the release team, so that we can actually have job postings across the project. So more people can be in owner's files and we have more ways clear ways for people to contribute and I. Think this effectively can replace the concepts of cig membership that we discussed before.

D

But you get a vote if you are signed up to do to fill some role and you're and you're filling that role you're in and others filed, and you have this you're a stakeholder. If you just randomly show up and comment, sorry, that's not enough to actually actually get a bill on anything all.

B

Right, it's certainly helpful and it's important to your perspectives, but it's not it's not enough to have a voting. It would be a non-binding vote versus a binding vote kind of thing. Yes,.

D

But I really think that's gonna be much more effective at getting people to do stuff than having a pile of 4,000 gap issues.

K

Email, the sig leads group in line 9.

K

Community meeting and then, instead of saying, I, think what we also should mention is instead of saying: hey like this is how things are right now, just make it more of an informative. This is what we're thinking. This is what we have so far. Don't worry about things right now like see if your group, this stuff, makes sense for your group and, in the meantime, we're going to start doing some canary testing of what we have with the blue, select SIG's and kind of wolong's limits view, as we as we can go.

K

Is that can I understanding that correctly? You.

D

Even as the next steps yeah.

K

E

Thinking too, as well like spelling out the Charter template and actually having SIG's formalized their charter. Template helps to drive the whole process and it's part of the comment I made on one of the one of the email chains that have gone by.

D

So so sorry, what did you think? The actionable item was from that for us was it to merge the Charter templates before we send for at least one of them before we send out this announcement, provided.

E

That the Charter template doesn't have any of the contentious items on it. I think there's a couple items that we found. We'd have a little bit of contention on with regards to cig roles and responsibilities.

E

That makes sense to have the template in place for people to is, you know for them to actually define the roles.

D

Correct I mean it might make sense to start out with this shorter template that doesn't spell out quite as many processes for handling pieces, and would there also probably have less contentious stuff in it. I.

J

Had to go get a power kit, but really quick, I'm sorry, so we would roll out the template, but was there a timeline that we had for when we wanted six to get their charters in place by.

D

No necessarily want to set that up until we've done a couple successfully. Yeah.

J

The only reason I asked is I've had a couple awkward experiences recently in a couple: six, where absent having that Charter would make figuring out if people wanted to sponsor or get their repo into the project difficult and so in some ways like the earlier, the better I think and so like. If we want to do this early in the 111 cycle, I was like a goal that might be probably good, but I didn't know what everyone else thought we.

A

Can also gain certain things like like I know, we have limited controls, but we could do something like you can't create new repos until you have a charter in place. That's.

J

Exactly what I was thinking like you can't sponsor a new news, shake sponsored project until you have the Charter that says the process by which you chose to do that, and so like some some gatekeeping like that might be you.

A

Know so I want to echo I mean some of the stuff that Michelle was saying. I think you know having sort of like a. How do we introduce this into the the rest of the community in a way where, where folks have a chance to have input, but we don't spend forever sort of you know navel-gazing about this stuff and make progress and so I? You know it's gonna be a delicate thing.

A

We definitely want to want folks to buy in and understand it and explain it, but we also don't want this to drag out forever, because it's taking us long enough as it is to decide amongst ourselves even I.

A

Think that's kind of what Michelle was getting out. Hopefully I'm not putting words in your mouth Michelle, okay,.

K

Now I just wanted to take away some some action item sort of all we were talking about so though I don't mean you've been reading this. So what do you think in terms of action items I think.

D

Get the agree upon the the name finish that vote: okay, update the short template. Let's take a look and make sure that if there's there's nothing contentious in here and it matches the thought process, we all had behind it. Let's merge that and send out a thing if it seems like there's a bunch of pieces that we aren't sure about still, let's figure out if we went up a lot I'm getting us merged or not connected I would.

A

Suggest that as we send it out, we call the thing we call it sort of a beta or something like that, you know or draft, and they Don it like any feedback between this. We want to close and make this final by XYZ date. What's.

J

One thing I'm wondering is like the practical human challenge of writing that first charter I would imagine that that would probably done with the existing sigelei it's identified and I. Don't know. If that's like it to me, it seems like those are the ones who are gonna be motivated to try to write that charter. I, don't know if that's gonna produce the best charter necessarily or if that could cause contention. So I don't know if there's a particular guinea-pig sig that we want to try this out on first to just see how it goes.

J

According to those beta mindset, sig.

B

Contributor experience sent a sent a charter to us last week with based off of the existing template as it was so it might be worth offering feedback on that. Oh.

J

Yeah and I, or how they found the experience of writing that, like just like the the couple of sig, leads that did that today, who did it or others doing like that were left out like I, don't know what what the process was. I'm, sorry yeah.

B

We can we can ask Parris I, don't know the specifics, I think she and George and Garrett got together and throughout it draft and then sent it across to the the rest of the sig to review a.

I

Bit curious, the the big SIG's in my mind are sig storage, signaled and sig network and I'm sure there are others that are slipping my mind, but those are ones with you know multiple big sub projects, etc.

I

I'd be curious to see how they find implementing this, whether it works well for those big old things that have been around forever and have lots of code API.

D

Machine cluster lifecycle- perhaps yes,.

I

Yeah there's other abyss ones.

D

A

And then you know we could use this to complete the sort of sea cloud provider or not or get our act together. With respect to that, oh yeah.

D

Speaking of which the issue is brought up, the AWS leadership changed never officially happened in the file like the PR was closed and okay.

A

Bob on that, maybe.

D

Yeah we good so there are at least two or three people who should be removed, and everybody in the second reason, should you got it? You got it.

A

Yeah we okay, oh I'll, put those folks but.

D

Anyway, the reason I thought of that is because you know become a sub-project if we had to cloud and put them all under saccade.

K

So when I have four action, items are agree on name, updated, shorts, template and merge if nothing's contentious and then there was also point about getting feedback from signature back in term X. On experience on the experience of writing, calm, the Charter I, so I'm thinking like a negative from the idea, is absolutely on the sig leads mailing list.

K

We could send a note out, or we could actually work on framing that message about the upcoming change and, along with that message about the upcoming change, we could also extend like a hand offering some help and feedback in case people are trying to create a charter based on get alerts from their bags. Maybe.

D

If we're gonna send a message, do we want that, just as like a separate PR, so like here's, the process for adopting this thing? Is it that level of complexity or is it just like issue, work, email.

L

I was thinking short email, but whatever whatever we all think is messy.

D

Okay, I'll start with that, but I'll send it to the steering committee before I. Send it out century.

K

If you can make that a doc and make it comment that might be good, okay, I'm happy to help. If you need anything I'll.

D

Probably ask you for your help.

E

If we have do, we have a date that we want to have a forcing function on by, because, if we're using that us as a carrot, slash stick for people to create new repos. The the requests have been inbound, pretty heavily lately to create new repos. So is there? Is there a drop-dead date that we want to try to meet.

D

Well, fire the cigs to do the whole Charter, and previously we talked about the six have to identify all their code. So I just asked the gaps just now to go. Do that because you asked for a repo if we are gonna, ask them to do the Charter than yeah. It needs to be the templates and everything needs to be done really soon.

D

When soon would be this week next week, this week, okay.

D

Okay, so if this isn't merged by Friday, then we're not gonna walk on it perfectly. That's something! That's a good position to take I! Think.

C

All right sounds like we have a pretty reasonable plan moving forward there, any other things on that.

D

Vote, if you care polls closed today on.

I

The state way other way, Phil that was lots of cat herding and fantastic to see it almost.

M

Done there's been net that we cast vote? That's just us.

C

Okay, the repository proposal.

C

K

D

Yeah so I'm Britain ins had proposal, I urged and Aaron finished, setting up all the automation so effective. We as far as you know, we're ready to go on the repos and the only thing that we're blocked on right now is asking the SIG's to identify all their sub projects and all their owners files on a case-by-case basis, but effectively it's open for business in lighting, okay,.

C

Sounds good and then formalize the concept of some projects that.

D

Is moving right along as well and this sub projects are. He took a first stab at enumerated all the repos other than communities, communities, categorizing them into two sub projects and identifying all their owners files. In some cases, maybe even homeowners files where they didn't exist, Phil added some language about sub projects to one of the existing documents. It also has PR out to merge owners and maintain errs, simplify the contributor ladder and get the get out rolls out up there and introduce some sub-project terminology to contributor ladder. So I think it's moving right along.

D

We actually I think need to actually just explain what it is better somewhere and announce as I think you have talked about it at the community meeting, but it's not well documented, but we're yeah we're continuing to make progress on flushing of concepts and we're.

K

Where do we have any documentation on the sub projects so.

K

D

Would that live.

K

D

Ideally, it would be any deaf community panel.

B

D

Those specific document- probably the thing that talks about a few places the community groups, is probably one place. The contributor ladder is where Phil has a PR open data to the contributor ladder and then description of owners files most likely it will go somewhere there. So I think it'll get sprinkled around in a few places, but.

D

The readme for the community communities community may deserve something about it as well, because it mentions SIG's right now. It says humanizes a set of projects each shepherded by C. So we should change that to just say sub project and and say something about the you can find the sub projects by looking at the big sig table.

I

So, in very brief summary: do we have a single github org that that houses all of these projects, sub projects are evil repos, which are in turn shepherded by a specific sink? Is that the structure that we have adopted, the.

D

Structure we adopted is we effectively have two kinds of or in the project we have the kubernetes org, which for lack of a better term, is being called core, but things logically things that roll into the kubernetes release and seek repose under the community, cigs org and right now there are no repos there yet, but things from incubator might move there or they might move into the kubernetes org. Okay,.

I

But in practice this would probably each Reaper would be presumably a sub project, and each sub project would be n by Sigma yeah.

D

I mean there are some sub projects that are multiple repos like.

D

I

One repurposing: it's it's multiple repos per sig and they're all in one flat. Oh.

D

It's one or more sub projects per se in one or more repos per sub projects, yeah.

I

It makes sense onin one organization well.

D

So are two organizations right? Yes, the one and the other one yeah. That was what we.

G

Ultimately settled on those communities: SIG's, yes,.

D

G

We have the community SIG's or it all set up. Yeah.

I

G

The uptake on repos there, you know well.

D

We haven't blessed any new repos there, yet because we need this to charge. Yeah I.

G

Was just curious: I saw the first one from cannons week. Yeah.

D

There's a lot there's a ton of demand like Tim said, but we haven't really started the ball rolling it with.

A

Respect to the community repo I'm, making some slow progress, I think then the contributes folks have, you know, come around to let's build a site around that stuff and so continuing to concentrate where we're putting all this stuff and organizing because of the contributors or the TDD repo paves the way for us to actually have it in a more discoverable way. So that's proclaiming along.

K

So the action item is, let's put something and the community read. Those read me about the different types of projects, correct.

D

Yes and they're, probably gonna be a few documents that will get sprinkled around but read me: I just saw that governance, dot talks about SIG's and working lease and Katie's, and so on. Okay, the owners descriptions like that so I.

B

D

D

K

C

D

Or is it already assigned someone, someone needs to do it yeah.

C

We haven't assigned action items yet would you like to take it they'll.

D

Probably do it but Ryan.

K

I feel you like to have eight thousand things to do so. I can.

D

K

Okay, yeah, so I I can take that if you want oh yeah I.

B

K

Just poke people if there are holes I, would.

E

Happy to be a guinea pig for six scheduling, because we have a demand from from Huawei I, see Quentin there to try and get some repos created. So I'd be happy to reach harder and recast roles and and.

E

Just just to get the ball rolling to get feedback on it.

I

Okay I know when you talk yeah.

D

And you can also just go identify all the code in the kubernetes repo and get that into the 60ml they'll. Be awesome so.

I

He was been dismissed to me. Somebody.

D

Involved in six scheduling Oh, especially since Tim, was saying, he's happy to be a good thing. You can't get new repos until you do that.

A

We have very few levers to really twist people's on new repos is.

D

Something that most 6/1.

C

Okay, so nice agenda item is seems you have learning board issues for Michelle and Brandon, the first one that I son email from Dan Consing approval of up to six hundred K for improving kubernetes performance tests.

C

So are we all in agreement first, like anyone understand why it's up to shouldn't? We be approving actual budget items like 600 K.

I

D

Because not all of the work items are fully fleshed out. Okay,.

C

So I mean we're gonna put up in front of the governing board saying we approve that stompers something yeah.

D

So this is the amount that is it.

C

D

Is the amount that Dan has proposed get approved, but in my knowledge it's bent.

C

K

Know it's under the impression that it would be a purchase order of six hundred thousand and that we could use as much of that as we need throughout the year. Okay,.

C

D

You may know more about the mechanics than I do, but I.

B

D

Do know that not all of the work items and milestones have been worked out and I've been told that you know, as ideas come up I'm going to review them and make sure they actually provide value. But it's not. There is one specific thing that has been proposed and it didn't sound to me like that was going to use up that much of the 600k worth applying, but I was assured. You know people would come up with other work items as well. The.

B

D

That we were asked to do which I have done is a requirement for component tests to our GA API criteria, though so it's not as if CN CF will be digging us out of a hole in terms of coverage forever and that was deemed to be sufficient assurance.

D

Just you know, despite all the details not having to be worked out. Okay,.

C

So essentially, what we're doing is we're approving 6-cup didn't sooner k and then it's Brian grant and anyone else who shows up who's actually has the description over that budget. Everyone comfortable with that yeah.

D

I mean stick, testing and other folks are gonna, come up with specific proposals, but you know cigar architecture needs to say whether they're sufficient to get. You know whether they're appropriate and meaningful for conformance testing, and things like that. So.

B

It's gonna be a partnership.

D

Amongst multiple people, but yes, people in the community will be making sure that the money is well spent. Yeah.

E

We just have to make sure the logistics are in place, so we can like have a clearinghouse, for you know, reviews and everything else. We don't want people to get stuck and have to rebase PRS on stuff like this. Yes, just.

I

Out of curiosity, what is that? 600 K represent as a percentage of the annual CN CF budget.

D

I

D

Less than 2 pi, the members yeah.

I

But that's like we only have 20 Platinum members, so that's like 10% of the budget, full price, Platinum members, you should say cuz, not all for full price yeah, that's exactly what I'm trying to figure out like do. We think this is worth to the CNCs budget. I, don't know so.

B

This is also overage that was earmarked to us from a much successful coop con. So would they were able to sell more sponsorship in or tickets to cube con last year than they had budgeted and intended? So this is overage, but yes, it is a non-trivial amount of the CNC up budget yeah.

C

Yeah, let me just like I, don't know it's in the tens or twenties of millions, the dollars yearly so I'm not concerned.

D

I also don't expect it to be a standing expense. It's a one-time expense also.

K

It didn't seem, like anybody really objected, pull anybody, but most people don't really object. They just wanted to know what that money would be for at the last meeting, and they just wanted to know that the steering committee approved usage emphasis. This element.

I

Sounds reasonable, which is.

K

I

K

Was a concern about how, like you know, this is kind of? Is this a bailout and are we are we going to prove? Is the CNC I'm going to provide a bailout like this to other projects, so those the only pushback we got on this item in case anyone's cool.

A

So this this is the second example of us. You know hiring folks to do work on behalf of kubernetes I. Think the other one is the the detect writer to do the workaround there's.

D

Also, the def stats dashboard well.

A

It's true: okay, the Deaf's dashboards too so I wasn't.

D

A thing that the crew- sorry, the kubernetes bootcamp but Google paid for that wait.

A

So one of the things that I think you know we should.

A

We should do a little bit of retrospective on this, to make sure that these things are hitting the mark and make sure that they're effective, because one of the things that I haven't been in the thick of it so I don't have all the ins and outs and details, but I've heard some surprise from folks that, like hey, there's, big changes happening in cig, docks that are being driven by this contractor and it's not necessarily felt like it's accountable to the project but to whoever is sort of like managing that person on the CN CF side.

A

So again, I don't have all the context, but it feels like there's some there's. Some sort of you know: communication, slash who's. Really, you know directing what's going on with respect to so those things specifically.

I

A

The site to be based on Hugo instead of Jack or whatever it's presumably.

I

If these are, if these are kubernetes things like, if these are you don't might given Eddie's ducks specifically they're, not like CN CF ducks yeah.

A

The kubernetes, the kubernetes dot io site, is getting a huge makeover and it's been a surprise to a lot of folks, so that should presumably go through a sink right. Ameena docks, yeah and again I I, don't have all the details so like this is all hearsay may be I mean I, see Sarah nodding. So maybe she has some some color on this too, but I just I. Think there's a larger lesson around like we need to make sure that this stuff works through through this SIGG's and that we we have some accountability and visibility.

A

A

K

Michelle, can you talk I'll talk since I've been interrupting. Everyone. Sorry, um so I know high-level. This is what I understand about how things are gonna go down and right, I'm, not sure like how much of this is like sudden stone from a high level. What I thought was the proposal is to go to each cig and stay. You know what conformance what conformance tests would you like for your pretty API?

K

Is that you're responsible for and then that goes back to sake, architecture for approval, which then goes to the conformance test contractors to execute on and then goes through those executed that that implementation, so those PRS also are reviewed by someone from six Husting as a final approval. This is a same twist, so I don't high-level. This is what I understand about the process.

K

Brian correct me. If I'm wrong.

D

And that sounds similar to what I I mean in terms of reviewers. People from the functionalist SIG's will need to decide whether it's a correct test of functional behavior.

D

There was intended SiC testings involvement would be for things like new test infrastructure to make sure it's a well-formed été test that it's not flaky, things of that nature and yeah SEC architecture needs to sign off on whether it is valid to add it to the conformance suite where's, all the word tract, and how we're doing this to know that, probably there will be a spreadsheet or something that will be put together as partners.

D

J

Do we do we need to have individual SIG's account for this times, L to say what they want to audit it for conformance like how its yeah, like.

D

So what I saw is that there was a dr. Jay go was starting to collect from the different SIG's with some information about test proposals, so it was still kind of in a high level when I saw it. But yes, I assume this Passaic.

D

Sub-Project area owners will need to sign off on those specific tests and then.

J

Like if I was to map this activity to the roles that we're talking about rolling out, would this have been an activity that we assumed the coordinator would be driving or the tech lead would be driving I would think it.

D

Would be the sub project owners, the technical side, okay and the coordinator would probably do wrangling for yeah chasing down some projects that weren't responding and things like that. Okay, this.

J

Feels like one of those things that mapping into the roles felt useful was.

K

Like a really good idea,.

K

Okay, so action is from this is Brian Brandon, confusing Brandon and I are going to just follow up on this next governing board meeting. Maybe we should grab that proposal from Jago and send it out to the steering company so we're all on the same page. Does that those outshine I'm sound saying? Is there anybody.

L

Did okay, I will sign.

K

C

And then the other thing that we have to discuss is the bug. Bounty thing came to our mailing list this week. Overall.

D

You targeted insecurity, right yeah,.

C

This is essentially I mean, as kubernetes hits higher and higher profile. We're gonna get people searching for bugs, and so we want to ensure that there's a bounty program and also importantly, a first line of triage. Since we have a bunch of volunteers that are having to triage, please incoming folks, I'm having a third party that executes the bug, bounty program and then triage is the bug those they come in.

I

Is the proposal to issue the bounty on the basis of fixed, bugs or identified bugs I didn't.

C

I

I guess the one thing we need to be careful of is that we don't end up with a pile of identified bugs that we don't fix. These are security right security issues, yeah sure, but.

D

But yeah I had a similar concern and we'll have to prioritize fixing them and don't have to be I guess. Do you have any notion of severity level.

A

So this feels like we need is security committee right somebody who can actually evaluate the things you're.

C

A

What's that we have one I know.

I

C

A

A committee make it public, have it be like a you know, something that is, you know, Morgan make it public, no no make the membership and that exists and sort of like put it on the community page and have it have a do? What is on the community page is.

I

That a signal! What exactly is that it's it's.

C

It's part of the sing-off okay.

D

It's a security team and we could call it a renaming, a committee to align it with our current terminology. Yeah.

A

That's that's all I was thinking because I think it's.

D

Like that code of conduct committee, yeah.

A

It's something where it's like. There's a closed, there's, there's a closed set of people. There's private discussions.

C

Yeah sure? Okay! Sorry! No! That's fine!.

C

Okay, yeah I can take the action to rename it to committee. Well,.

A

I think it's again, it's it's it's it's something! That's not part of the goth. It's something! That's a project wide thing, but it is, we appear to just say, go on to some degree. Well,.

C

It's so far, it's been accountable like sig off, essentially is where security stuff is, and so a bad team, essentially as accountable, but stay off. That's how we structured it I, don't know whether it's correct or not, but it needs to be somewhere.

I

Yeah I mean it doesn't sound fundamentally different than than what we've been calling working groups or some projects up to now other than the fact that it is somewhat more private for understandable reasons. But but presumably its existence should be well publicized and maybe the people on it should be well publicized, yeah good thing right. No.

C

I mean if you slash security, it explains the membership.

C

B

We had reserved the name committee in our original charter, doc to be a group that might have private communications for one reason or another, so that would be a code of conduct committee that would be the Security Committee. That would be that kind of those types of places, as opposed to SIG's and even the steering committee, which fits the model as well, but SIG's. We expect to have all public conversations for nearly all public conversations and.

A

I think there's the idea that anybody can come and join us say it's open to all where's. The committee is Ares.

K

A

Think it's it's mostly a terminology type of thing, but then maybe there's a charter around not to in.

K

Favor of renaming to committee I, don't really see the necessity to like publicize its members. So what are the pros and well.

C

I mean so so it's currently called the product security team. Oh it's on kubernetes, IO, special security and it's all public along with membership. um The trouble is that similar to could conduct committee. We haven't really figured out a way of like rotating people off and that sort of thing, because you kind of want it to be a small team so contractor.

L

We need a committee charter.

C

Yeah yeah he's.

K

Super good at creating those.

C

Yeah he's pretty well-documented, it's just the rotation thing. It's.

I

B

The signification thing.

C

It's not like the city of yes locations been like super smooth.

A

Those folks on that, by the way so we'll see what.

C

Happens regardless, like is this something we want to approve budget for and then oversee or wait till the next governing board meeting, which isn't fur until coop Connie you, which is.

C

B

It's worth approving going forward. We have a good committee, it's just that it's lacking a way to rotate that which shouldn't hold up the bug, bounty program, yeah.

I

A little a little confused, sir I'm just reading the kubernetes, our security I mean it seems to be squarely focused around the public reporting vulnerabilities, as opposed to broadly being responsible for security of kubernetes. So who would like fix these vulnerabilities and.

C

The process that the security team follows is we triage the issues and then we pull in the developers who are in the owners files related to those issues and.

D

Say god, loans, security for King right now, like is that broad, like to the question of where do security problems go that are not.

G

Private, it is sick off yeah.

C

So the proposal here would be to approve money to essentially put like an l1 team in front of the security list. That triage is those issues and the reason we would need an l1 team is we're now incentivizing the filing of more issues by giving people money for filing legitimate.

B

C

And so we can't really, you can't.

B

Really increase.

C

Supply and not also decrease the demand on people who are volunteering to do the work yeah.

I

Sounds reasonable? Okay,.

C

Yeah and everyone cool with Michelle and I approving this budget I, don't yeah good.

F

C

Great Julian Simon in the room for the bug bounty program. All right last bit of business here seems you have graduation yeah. Eight minutes left you.

B

Passed we passed.

C

B

Cnc F is sorting out publicity publicizing it. It may actually happen next week during the Leadership Summit cool.

K

You're, like every graduation caps.

D

Part of writing that application I ran a script to count the number of owners files. There are more than 4,000 owners files.

C

That's impressive.

D

Is that good, mostly automatically generated once we identify some projects? I think we might want to go through some of those back yeah.

A

I mean I'd like to see those things more like again like more line up with groups instead of people, because it makes it easier to find what meetings to go to he to talk to. It creates some cohesiveness. Oh yeah, yeah,.

D

Both sides, if we put the reviewers approvers and owners associated with some projects and then tag code with some projects that work.

D

In any case yeah and that's good, they don't that I look forward. Cool parties will probably graduate as well I'm guessing I'm.

B

Suggested a list of next sprint items. If we want to add any I said number one would be to finish the open sprint items. Do we have any that we want to add.

K

Brian I propose adding the code of conduct committee as a sprint item.

K

D

There were more issues that have come up recently that are kind of cross.

B

The line along.

D

The line so it'd be good to ass on the official policies in places. What else just like refresh the whole code of conduct, because I think we have found it to be wholly inadequate for the situations that come up in our community. So.

B

I can also offer the enforcement piece that Google has written for all Google lead projects and we can, from there decide if we want to adopt that piece as well. So having a code of conduct is great, it just says here's what we expect, but it doesn't say and if you fail here's what will happen and.

D

I think there are some simple triage kind of things that we need to get some process around as well like spam. In our mailing lists. You know it's easy I, just like banned those people right away and delete all their messages or hostile comments in you know, issues in pr's from people who aren't actually part of our community, usually so I just ban those people first and ask questions later.

D

But I think it would be good to make that official policy and then then we'll need rules for people who do have roles in our community. What do we do.

K

Know please know I've interrupted like six people today. That's.

A

Just video conferencing and I think you know it's probably worthwhile for us like if we do go down that sort of band first and ask questions later, to have a part process so that people can appeal and, like you know, different levels of being in jail. Sure.

D

But I figure, if there you have ideas, something snarky to begin with and they've never shown up on anything before then they provide.

J

I

Subjective brand.

D

When I get my DM thing, it was something like squeeze master or something like that. I.

I

Think we should just people have very strange reasons for choosing their get up, names and I'm not about to question them. But we think if the repeal comments were hostile, the combination, but just in general I think what what germ engine just having an appeal process where at least we can yeah given the second chance. You know most of the time we might say. No sorry, you know first chance but I.

K

Thought these were things that, like the committee, would decide or is it things we decide or people I think.

B

We should try to pull together a group, a committee and offer them some suggestions. Let them go away, build some things come back and talk with us. Yeah.

D

But I do think you know. Ultimately, enforcement is going to be needed, need to be across a broader set of people for like parts of transgressions right like if we have folks from a contributor experience who are curating mailing lists, slack github, whatever they should just be empowered to stop people in their tracks. First and then Appeals would go to the committee.

K

So I'm happy to help with forming the committee and then I think wine in a specific question is: do we want some set some subset of steering committee members to be on that committee or is it something that's generally independent of B would be an.

B

K

Her is anybody having thoughts and on that I think.

D

It can be independent and overlap can be accidental or intentional to get it bootstrapped, but it should does n't need to be explicit, primarily I. Don't think yeah mistake right, like people who are experienced doing that I would happy to have them just he didn't not and not have to worry about steering committee stuff and vice versa. Yeah.

I

K

Have experience warming and I code of conduct committee from our group? Okay,.

D

K

B

Happy to help- and in fact I was just texting you because I have a list of people who I've talked to about this. So we.

D

Actually had asked for volunteers after our meetings last year about a year ago, right now, I'm, not so I, don't know if I could still pick those up in my inbox or if someone else can I.

B

I have at least two of the names off top of my head, so, okay, so it sounds like we need an.

K

Initial document for a rough idea of like what a code of conduct committee is in our world. What how many people we want and just like a rough outline of what process would take place and then also in herre, will have a list of people to consider so yeah.

D

We also in the steering committee backlog I, have a list of issues we found with the existing code of conduct policy. There I think there are more that we've discovered since then, but we, you know at least have a list of issues that need to be addressed in the official policy to start with. Okay,.

C

I have to drop there's some action items that I put question marks in, while I was recording them so.

K

Yep, don't wanna know so sounds like we're good I just.

D

Want to say, I'm happy we're actually making progress on stuff. So anything it's not painful, but it's happening.

B

Always slower than you want, but it is moving forward.