Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Hosting azure/kubernetes-policy-controller under the OPA organization #1093

Closed
3 tasks done
tsandall opened this issue Nov 30, 2018 · 27 comments
Closed
3 tasks done

Hosting azure/kubernetes-policy-controller under the OPA organization #1093

tsandall opened this issue Nov 30, 2018 · 27 comments

Comments

@tsandall
Copy link
Member

tsandall commented Nov 30, 2018

The recent Azure/kubernetes-policy-controller project was started to improve the state of policy control in Kubernetes. The project uses OPA as the underlying policy language and engine that evaluates Kubernetes objects to detect violations, enforce invariants, and generate audit reports. After the project was announced the community expressed interest in having the project hosted by a vendor-neutral organization. The initial contributors to the project concluded that it should be hosted under the OPA organization on GitHub.

Styra (the primary maintainer of OPA today) is in favor of hosting the new project under the OPA organization.

To move forward, we need to:

  1. Create new repository under OPA.
  2. Change the license from MIT to ALv2.
  3. Set up CLA for the new repository. This requirement is being driven by Microsoft and Google.

/cc @rite2nikhil @caniszczyk - feel free to tag others that should be notified. Since you're both members of the OPA organization on GitHub you should have permission to create the repository and set up the CLA automation. @rite2nikhil I assume you will take care of updating the license to ALv2.

@rite2nikhil
Copy link
Contributor

rite2nikhil commented Dec 1, 2018

@tsandall yes I would do that

adding @marccampbell who was also interested in this project

rite2nikhil added a commit to open-policy-agent/gatekeeper that referenced this issue Dec 13, 2018
Updating the LICENSE to Apache v2
For more details refer to open-policy-agent/opa#1093
@lachie83
Copy link

@tsandall - Regarding number 3 - do you have a CNCF CLA bot on the OPA Github org already? cc @caniszczyk

@lachie83
Copy link

@tsandall - regarding number 1 - can we simply complete an org transfer for the repo from Azure to the OPA Github org?

@tsandall
Copy link
Member Author

@lachie83 I'm not familiar with org transfers, but happy to help out if needed. We don't have a CLA bot installed in the OPA org (my understanding is that CNCF makes it unnecessary but I'm not a lawyer...)

@caniszczyk
Copy link
Contributor

email Linux Foundation Helpdesk helpdesk@rt.linuxfoundation.org and cc me to get the CLA bot installed in the OPA org (make sure 'thelinuxfoundation' is an owner of the org).

The LF IT team is a bit barebones at the moment due to the holidays so it may take some time.

@tsandall
Copy link
Member Author

Email sent. @lachie83 I don't have your email so I just copied Nikhil and Chris.

@tsandall tsandall added this to In progress in Open Policy Agent Dec 19, 2018
@lachie83
Copy link

Thanks @tsandall. I contacted @caniszczyk and he mentioned that we can go DCO for OPA and that there is no requirement to have CLA.

@lachie83
Copy link

I've confirmed that we do indeed need CLA on this repository. Let me work with the CNCF to understand the process of adding the CNCF CLA bot to this repo.

@tsandall
Copy link
Member Author

@lachie83 OK -- to be clear, do you mean this repo (i.e., open-policy-agent/opa) or the new repo that this issue is about (e.g., open-policy-agent/kubernetes-policy-controller)?

@caniszczyk
Copy link
Contributor

caniszczyk commented Dec 19, 2018 via email

@idvoretskyi
Copy link

/cc

@lachie83
Copy link

lachie83 commented Jan 3, 2019

@tsandall - Ihor has provided me with the details to add the CNCF CLA bot to the new repository. How would you like to proceed?

@tsandall
Copy link
Member Author

tsandall commented Jan 3, 2019

@lachie83 I'm not familiar with the org transfer process. Is there something you need from me to make it happen? I can add you as an owner in the OPA organization if necessary.

@lachie83
Copy link

lachie83 commented Jan 3, 2019

If we want to do an org transfer the repository name would remain the same. Is that okay? I would need repo admin access to setup the CLA before we accept any contributions. Pros for this approach is that all issues and PRs would remain intact.

@tsandall
Copy link
Member Author

tsandall commented Jan 3, 2019

Ooph. Naming is hard. I hadn't thought about changing the name. I assume we could do that later?

I think it would be good to keep the issues/PRs intact.

I've sent you an invite to the OPA organization. Let me know if you need elevated privileges.

@lachie83
Copy link

lachie83 commented Jan 3, 2019

Received. I'm just making sure everything is in order then I will initiate the transfer. We will probably need a team of admins created in GH for that specific repo once transferred.

@tsandall
Copy link
Member Author

tsandall commented Jan 3, 2019

Great. I'll set up the admin team once the repo has been transferred.

@tsandall
Copy link
Member Author

tsandall commented Jan 8, 2019

@lachie83 just a quick heads up, I've given you "owner" permission in the OPA org. You should be able to do the transfer any time now. Let me know if there's anything preventing you.

@lachie83
Copy link

lachie83 commented Jan 8, 2019

Thanks @tsandall. I'm going to action the transfer tomorrow.

lachie83 pushed a commit to open-policy-agent/gatekeeper that referenced this issue Jan 8, 2019
Updating the LICENSE to Apache v2
For more details refer to open-policy-agent/opa#1093
@lachie83
Copy link

lachie83 commented Jan 8, 2019

@tsandall I've transferred the repo. Currently working on the CLA bot. I've also create a new maintainers team but haven't yet granted admin privs for maintainers on that repo. I'll leave that to you if you choose to do so.

@lachie83
Copy link

lachie83 commented Jan 8, 2019

Hey @tsandall. The repo has been transferred here - https://github.com/open-policy-agent/kubernetes-policy-controller. The following two items are still outstanding:

  1. Fix CLA bot - It's triggering but we aren't getting a respond in the check on the PR. We cannot merge ANY contributions until this happens. See [test] Test commit for CLA bot gatekeeper#36
  2. We need to DISABLE the DCO bot for all repos in the OPA org and selectively add it for everything but THIS repo (I know it's a pain - I wish you could do an exclusion). Would you like to do that, otherwise I'm happy to BUT it means that all subsequent repos that are added to this org will need to be manually activated to enable the DCO bot to function.

@caniszczyk
Copy link
Contributor

caniszczyk commented Jan 8, 2019 via email

@tsandall
Copy link
Member Author

tsandall commented Jan 8, 2019

hey all, thanks for driving this to completion.

@caniszczyk just to clarify, you're saying DCO should be enabled on all repos including the new one?

@caniszczyk
Copy link
Contributor

caniszczyk commented Jan 8, 2019 via email

@lachie83
Copy link

lachie83 commented Jan 8, 2019

@caniszczyk has fixed the CLA bot so we are done here.

Confirming that we will leave both DCO and CLA bots enabled on this repo.

@lachie83
Copy link

lachie83 commented Jan 8, 2019

@tsandall Please close if you feel we have me the requirements of this issue.

@tsandall
Copy link
Member Author

tsandall commented Jan 8, 2019

LGTM!

@tsandall tsandall closed this as completed Jan 8, 2019
@tsandall tsandall moved this from In progress to Done in Open Policy Agent Jan 9, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
No open projects
Development

No branches or pull requests

5 participants