[Governance Review]: Kyverno

[JimBugwadia]

Project Name

Kyverno

Project Website

https://kyverno.io/

Contact Details 1

@JimBugwadia

Contact Details 2

@realshuting

Links to communication channels

https://slack.k8s.io/#kyverno

Reason for governance review request

Application for moving levels from Incubation to Graduation

Are there any sub-projects, plugins, and related?

• Policy Reporter for managing policy reports
• Kyverno JSON for policies outside of K8s
• Chainsaw for declarative e2e testing

Governance model

We were not aware of these, but our model seems very similar to the Maintainer Council Governance template.

https://github.com/kyverno/community/blob/main/GOVERNANCE.md

Governance documents

• Project purpose
• Maintainer List (with employer information)
• How your project is making decisions: In the weekly maintainers meetings
• How and when contributors are moving through the contributor ladder (e.g. becoming a maintainer)

https://github.com/kyverno/community/blob/main/GOVERNANCE.md#summary-of-roles

• Maintainer life cycle with information about how and when maintainers are demoted

https://github.com/kyverno/community/blob/main/GOVERNANCE.md#project-roles

• Code of Conduct

https://github.com/kyverno/community/blob/main/GOVERNANCE.md#code-of-conduct

• Contributor Guide

https://github.com/kyverno/community/blob/main/CONTRIBUTING.md

• How your community conduct communication and meetings

https://main.kyverno.io/community/#community-meeting

• How your community handles security reporting and response

https://github.com/kyverno/community/blob/main/SECURITY.md

• Who owns what code and docs

The main project and sub-projects have code owners file:

• https://github.com/kyverno/kyverno/blob/main/CODEOWNERS
• https://github.com/kyverno/website/blob/main/OWNERS.md
• https://github.com/kyverno/chainsaw/blob/main/CODEOWNERS

(some are missing, we will add these)

Governance Execution Examples

• Voting

We have not held any public votes, but typically use the maintainer's meetings and slack channels to make and advertise decisions.

• Promoting a contributor / demoting a maintainer

  • chore: add myself to the maintainers list kyverno/kyverno#9130
  • move Marcel Müller to emeritus status kyverno/kyverno#10857

• Security response

  • Bypass of verifyImages rule possible with malicious proxy/registry
    

• Meeting recordings

• https://docs.google.com/document/d/1I_GWsz32gLw8sQyuu_Wv0-WQrtRLjn9FuX2KGNkvUY4/edit

Governance Evolution

No significant changes, but we did move all governance related docs to a central repository:

https://github.com/kyverno/community/tree/main

Any specific aspects of your governance structure are you seeking feedback on?

We are wondering how our roles and contributor ladder aligns with other projects, and if any areas should be adjusted.

Do you have any concerns or specific areas where you feel your governance could be improved?

We recently lost several maintainers due to inactivity, change of jobs, and other reasons. We would love for our end users to engage, but are wondering if the bar is too high. Any advice on that would be much appreciated.

Additional notes and resources

No response