Create Tetragon Community Tracing Policies

[paularah]

Repository Name

tetragon-policies

Type

New

Repository URL

No response

Proposed Scope

Ecosystem

Motivation for Request

To get the community actively involved in using and adopting Tetragon, the need for a community of hub of Tetragon tracing policies is needed. The main Tetragon repository is not the ideal place to have this as this places the burden of review, validating and testing on the Tetragon team. Having a community hub of policies is a great way to introduce new contributors to writing good tracing policies.

README

https://docs.google.com/document/d/1cf1LLGdfpu89x7agAjdvY_nwE0HwBU6dBVb0FzE_w9s/edit?usp=sharing

License

0BSD

Code of Conduct

• I agree to follow Cilium's Code of Conduct

To be filled by a Cilium committer

• README describes the intent of the repository and has usage examples
• Adheres to Apache 2.0 or one of the other approved licenses
• Approved new repository is added into the appropriate list in REPOSITORIES.md

[joestringer]

Hi @paularah , @cilium/tetragon-maintainers , do we have a set of people in mind who will maintain this proposed repo?

[paularah]

We're still figuring out how the exact governance process around this. The initial discussion was to rely on the tetragon contribution ladder.

[xmulligan]

Is there a reason you are looking at the 0BSD license? We would probably need to get an exception for that which would significantly delay this

[paularah]

@joestringer We've concluded that Dan Finneran and I will be responsible for maintaining this least at the initial stage until it has gained momentum within the community.

[paularah]

@xmulligan I didn't give too much thought to this. I've changed it to Apache License. Is that the ideal License?

[xmulligan]

For CNCF yes, that is the license we should use. It would probably make sense to have someone from @cilium/tetragon-committers as a maintainer

[paularah]

@joestringer Just pinging you here. We do intend to intend to get folks from the tetragon team to be maintainers when we begin receiving external contributions and the project has gained some visibility within the community, but at the moment, this shouldn't be a blocker.

[joestringer]

I'd like to be helpful here as a de facto organizer across the Cilium organization, but let me summarize how I see the discussion on this thread going and lay out a couple of concerns:

• Disclaimer: I don't actively work on the Tetragon subproject. This isn't my decision to take, we have pinged the teams who should own this decision.
• Broadly I can see the value in having such a repository. Assuming this gains traction, there are good challenges around moderation, quality, and more generally how you build a community around that repo, but these are all solvable with the right people involved.
• I see an assertion that a private conclusion was made ("We've concluded (...)") about maintaining this repository. I would generally expect someone with standing in the relevant team to make public comment on that decision in addition to your post.
• I see an assertion that you will "get folks (...) to be maintainers". Unless you have directly heard feedback from someone that they're interested in this, I would caution you against making such assumptions. We should be willing to maintain this repository with the current set of people, then consider any growth in maintainers and community as extra benefits. If you do not have longer term plans to oversee this repository, do not assume someone else will. On the other hand, if you heard specifically from maintainers that "if there is traction, we will maintain it", then that is reasonable.
• Strictly speaking I do not see this necessarily as a blocker, but I want to make sure that we're not operating under false expectations.