UNCLASSIFIED

Commit a8a4efbf authored by andrew.greene's avatar andrew.greene
Browse files

Merge branch '41-suggested-overhaul-of-toc' into 'master'

Draft: Suggested updates

Closes #41

See merge request !36
parents 318e0ade f8e0d487
......@@ -2,3 +2,6 @@
CODEOWNERS @abryan562 @phillip.record @matthew.huston @andrew.greene @blakeburkhart @celkins @joshwolf @barakstout1 @tim.gast @anthony.butt @idunbarh @zayd.ma
**/* @root
# Meetings, Agenda, Minutes are owned by the current TOC Chair
meetings/** @andrew.greene
\ No newline at end of file
# Current Contributors of the P1TOC content and solutions
# Platform One Technical Oversight Committee (P1TOC)
# Big Bang Technical Oversight Committee (BBTOC)
#### _This is a mirror of a government repo hosted on [Repo1](https://repo1.dso.mil/) by [DoD Platform One](http://p1.dso.mil/). Please direct all changes, issues and comments to https://repo1.dso.mil/platform-one/p1toc_
BBTOC is the open governance body of the Big Bang ecosystem and maintainers of community engagements and contributions. We are inspired heavily by the [CNCF TOC](https://github.com/cncf/toc); anything you see there is consistent with the outcome we'd like to see here.
*NOTICE the P1TOC is in alpha and is not yet ready for widespread contributions. In the meantime you are welcome to submit an [issue](https://repo1.dso.mil/platform-one/p1toc/-/issues/new)*
\~The BBTOC scale contributions by the DoD technical and user community, while retaining integrity and increasing quality in support of our mission. ([source](https://github.com/cncf/toc/blob/master/sigs/README.md))
P1TOC is the technical governing body of Platform One and maintainers of community engagements and contributions. While it doesn't map one to one, we are inspired heavily by the [CNCF TOC](https://github.com/cncf/toc); anything you see there is consistent with the outcome we'd like to see here.
\~The P1TOC scale contributions by the DoD technical and user community, while retaining integrity and increasing quality in support of our mission. ([source](https://github.com/cncf/toc/blob/master/sigs/README.md))
As we begin and evolve:
- We desire to enable community partnerships across organizations
- We desire to Enable colalborative developer of solutions, solving problems for the majority
- We are not here to gatekeep, instead to connect and collaborate
- We are not a standards body
- We are not an avenue to get funding, nor influence funding
Chief Objectivs:
- Enable community collaboration across organizations and use cases
- Enabled collaborative development of solutions, solving problems for the majority
- We exist to connect and collaborate, not gatekeep and control
- We are not a standards body, nor do we influence funding of various efforts.
# Members
......@@ -35,10 +30,9 @@ Community [Appointed](/policy/governance.md#community-appointed)
- Open Seat
** Current P1TOC Chair, appointed July 2021
## Meeting Time
## Meetups
The P1TOC meets and is open to all:
- Every first and third Tuesday each month at 1200 MST
Join Us! The TOC meets the first and third Tuesday each month at 1200 MST
[Zoomlink](https://us02web.zoom.us/j/89870537922?pwd=c2V5a1hLbGlYaWt0R1RHKzEzOTdEQT09)
Meeting ID: 898 7053 7922
......@@ -49,12 +43,14 @@ The P1TOC meets and is open to all:
Find your local number: https://us02web.zoom.us/u/kEiAxsWyZ
- Project presentations (completed projects) will be scheduled as needed.
# Contribute
Getting involved
- the P1TOC is open to all, join us for meetups and project presentations
- Look for the contributors guide in any of the [Active](/projects) projects
- start [here](projects/getting-started/README.md) for new project ideas or submissions
- When in doubt submit an [issue](https://repo1.dso.mil/platform-one/p1toc/-/issues/new), using one of the available templates
We readily welcome any and all community engagement!
1. Join us for our [meetups](#meetups)
2. Submit an [issue](https://repo1.dso.mil/platform-one/p1toc/-/issues/new) for ideas, questions, feedback, etc...
---
#### _This is a mirror of a government repo hosted on [Repo1](https://repo1.dso.mil/) by [DoD Platform One](http://p1.dso.mil/). Please direct all changes, issues and comments to https://repo1.dso.mil/platform-one/p1toc_
\ No newline at end of file
......@@ -8,12 +8,12 @@ What is expected of everyone:
- To always question a solution, in the interest of improvement
What is expected of you (a contributor):
- Respect the time of contributors and members of the P1TOC
- Respect the time of contributors and members of the TOC
- Present and develop quality solutions that provide unique, added benefit
- Develop solutions that are reusable and solve common problems
- don't expect 24/7 support from the P1TOC nor the community
What is expected of the P1TOC:
- Available during pre-defined meeting times
What is expected of the TOC:
- Active participation
- Available for meetups and engagements
- Work towards finding a solution
- bringing professional and technical excellence to projects (in an advisory manner)
This diff is collapsed.
# Minutes for General Agenda and Project Proposals
# Minutes and Agenda
## 17 August 2021
- Preamble on TOC state and future
- P1TOC renaming [issue](https://repo1.dso.mil/platform-one/p1toc/-/issues/35)
- Pioneer Project - Gitlab [issue](https://repo1.dso.mil/platform-one/p1toc/-/issues/37)
- Pioneer Project - Monitoring [issue](https://repo1.dso.mil/platform-one/p1toc/-/issues/38)
- Pioneer Project - OPA Gatekeeper [issue](https://repo1.dso.mil/platform-one/p1toc/-/issues/39)
## 3 August 2021
- Cancelled
## 17 August 2021
- Preamble on TOC state and future
......
# Minutes and Agenda
Each meeting, it's agenda and recording is owned by the current chair.
*Everything reviewed will be based on time order (i.e. earliest submission to latest submission)*
## Quarterly Review
Once a quarter the P1TOC will pause new activity to review and discuss activities for the last quarter.
## Annual Review
Once a year the P1TOC will review projects and activity to ensure active engagement. Inactive projects will be marked for deprecation and fully deprecated at the next quarterly review.
# Members
The P1TOC will have up to 13 members at any given time.
- 3 Platform One default members
- 4 Platform One appointed members
- 6 community appointed members
### Roles
- Chair: one appointed member will be nominated and designated chair for a 6 month duration. The chair is responsible for keeping the ship afloat, hosting meetings, keeping minutes, timeboxing, agenda, backlog management, etc...
- Shepherd: for each proposed project a shepherd will be assigned. The shepherd is responsible for supporting projects engagement and interaction with the TOC, to include ensuring consistent and correct submissions, answering questions, and bringing topics before the TOC when appropriate; but is not responsible for the success of the project.
## Platform One Appointed
Three positions, called chiefs, will be held by the current staff member in the position, are only restricted by their term in the position, and hold overriding authority on all issue with a majority vote (2/3).
- The Director of Platform One
- The Chief Technologist of Platform One
- The Chief Security Officer of Platform One
Four additional positions will be held by engineers from within Platform One and are determined by a majority vote of the chiefs. These positions can retain their position while on Platform One "payroll" and serve up to one year terms. These members should be diverse, representing different companies/primes and components of Platform One.
## Community Appointed
Up to six positions can be held by community appointed members.
- Any member of the community may nominate a prospective member by submitting a ticket [here](https://repo1.dso.mil/platform-one/p1toc/-/issues/new), using the nomination template.
- Nominee's will be announced if a seat is vacant and
- voted upon in the following meetup of the P1TOC.
- Voting is done by the community live during the meetup
- community apointed members will hold their seat for up to one year and then must be re-nominated and voted upon.
- No two community members can be employed by the same entity, nor work the same program.
TOC membership exists formally and organically to add value to the ecosystem, its collaboration, and success. Members are noted in the [TOC Readme](../README.md). In addition to membership, certain roles are established to ensure progress. Finally, the entire TOC is a living organism, including governance and policy on membership; changes and suggestions should be brought up immediately via a new issue and discussed at the earliest opportunity.
## Requirements
All members must adhere and agree to the following requirements:
- Actively engage with the best interests of the entire community, regardless of employment
- The member is high quality and highly driven to propel the DoD into the future
- The member has sound engineering experience
- With the exception of the chiefs, no member can serve more than two years on the P1TOC
## Unique Scenarios
Unknown scenarios will always pop up, acquisitions, contracts, employment changes, etc...
- Membership should first and foremost provide dynamic representation across the community, without vendor bias.
- Second, the P1TOC should alwasy avoid interruption, even if this means breaking the 'rules' for a short period of time.
All members must adhere and agree to the following:
- The TOC [Working Agreement](../WORKINGAGREEMENT)
- No two members can be from the same company
- An organization should only have a single member on the TOC at any given time
- Members must represent the best interests of the community without unchecked vendor bias.
Resolution of such unique scenarios should be addressed above all other agenda
- The chair will be responsible for bringing this up at the next gathering
- The P1TOC must agree upon a path forward
- The path forward, must resolve the unique scenarios within 90 days
### Roles
- Chair: one appointed member will be nominated and designated chair for a 6 month duration. The chair is responsible for keeping the ship afloat, hosting meetings, keeping minutes, timeboxing, agenda, backlog management, etc...
- Shepherd: for each proposed project a shepherd will be assigned. The shepherd is responsible for supporting projects engagement and interaction with the TOC, to include ensuring consistent and correct submissions, answering questions, and bringing topics before the TOC when appropriate; but is not responsible for the success of the project.
# I. Overview
# Overview
**Disclaimer: This is a work in progress and has not yet been finalized. Your ideas and feedback are welcome, just submit an issue or join our next meetup.**
The Technical Oversight Committee serves as the conduit to support collaboration and evangelize community contributions to the Big Bang opensource ecosystem.
* The Technical Oversight Committee ensures __Users__ of have access to high quality projects.
* The Technical Oversight Committee ensures __Contributors__ have support to build a security focused project, and build an active user base to ensure longevity and ability to be used in production setting.
> ***note*** this process is intended to loosely mirror the CNCF Sandbox process. More details can be found [here](https://github.com/cncf/toc/blob/main/process/README.md)
This policy describes the TOC project lifecycle, from sandbox to archival. It describes the requirements a project must meet in order to be classified and matured.
The Platform One Technical Oversight Committee serves as the conduit to evaluate, support, and evangelize community contributions to the DoD opensource ecosystem.
* The Technical Oversight Committee ensures __Users__ of Platform One have access to high quality DevSecOps Community Contributed projects.
* The Technical Oversight Committee ensures __Contributors__ have support to build a security focused Community Contributed project, and build an active user base to ensure longevity and ability to be used in production setting.
## Maturity Levels
This policy describes the Platform One Community Contributed project life cycle process, from sandbox to archival and more. It describes the stages a project may be admitted under and what the criteria and expectations are for a given stage, as well as the acceptance criteria for a project to move from one stage to another. It also describes the Annual Review Process through which those changes will be evaluated and made.
Project progression, movement from one stage to another, allows projects to participate at the level that is most appropriate for them given where they are in their lifecycle.
# II. Stages - Definitions & Expectations
P1 Community Contributed projects have a maturity level of sandbox, incubating, or graduated. Archived is for projects no longer in active development. The maturity level is a signal by P1 Community Contributed as to what sorts of enterprises should be adopting different projects. Projects increase their maturity by demonstrating their sustainability to P1’s Technical Oversight Committee: that they have adoption, a healthy rate of changes, and committers from multiple organizations.
Projects have three maturity level's: andbox, incubating, or graduated. Archived is for projects no longer in active development. The maturity level is a classification on the health, value, and activity for a project.
```mermaid
graph LR
A>project submitted] -->|Low barrier| B
B(Sandbox) -->|Significant barrier<br>-This is where<br>majority of DD happens| C
C(Incubating) -->|Obvious path<br>from incubating to graduated| D
B(Sandbox) -->|Significant barrier| C
C(Incubating) -->|Final barrier| D
D(Graduated)
```
## Sandbox:
### Sandbox:
`Sandbox` projects are the entry point for early stage projects and have four goals:
`Sandbox` projects are the entry point for early stage projects.
1. Encourages visibility of early work that might add value to the DoD DevSecOps community
#### Sandbox Project Goals
1. Encourages visibility of early work that might add value to the community as a Big Bang package
2. Nurture projects on their path to adoption.
3. Facilitate alignment with existing projects, as desired.
4. Reduce the barrier to entry by providing a community of support for legal, governance, seucrity, and policy requirements
## Incubating:
`Incubating` projects have adoption and show value added to Platform One, but have not reach maturity to commit to long term support to end users. Such projects, should have support of a significant customer and show promise to solve problems across the DoD.
## Graduated:
`Graduated` projects signal the highest level of maturity for a P1TOC project. Graduated projects should have support, in both development and production operations, from multiple organizations.
## Archived:
Archived projects are no longer in active development and are only archived after a P1TOC vote.
# III. Project Proposal Process
Introduction:
This governance policy sets forth the proposal process for projects to be accepted into Platform One.
The process is the same for both existing projects which seek to move into Platform One, and new projects
to be formed within Platform One.
## Sandbox Projects:
Projects being submitted to the P1 TOC at the `Sandbox` level are intended to be the entry point for early stage projects and are not required to undergo due diligence.
3. Facilitate alignment with existing projects, as appropriate.
4. Reduce the barrier to maturity by providing a community of support for engagement, governance, security, and policy recommendations
#### Sandbox Project Requirements
* Project are proposed following the [process outlined here](https://repo1.dso.mil/platform-one/p1toc/-/blob/master/projects/getting-started/README.md)
* Sandbox projects must meet the following criteria:
1. Code repository is in an unclassified, accessible repository (repo1 is desireable)
......@@ -63,92 +36,51 @@ Projects being submitted to the P1 TOC at the `Sandbox` level are intended to be
4. Code repository must contain a `CODEOWNERS` file
5. The project must have a clearly defined purpose
6. The project must have a demonstratable prototype (intent is to prevent immature projects with minimal code in place)
* The P1TOC will review submissions for the requirements and this additional criteria:
1. Is the project a fit for DoD DevSecOps, in the P1TOC’s opinion?
* Consistent with Sandbox project goals the TOC looks for:
1. Is the project a fit for Big Bang and the [DoD DevSecOps reference Design](https://dodcio.defense.gov/Portals/0/Documents/Library/DevSecOpsReferenceDesign.pdf)
2. Does the project appear to be on a good path to becoming well-governed and vendor-neutral?
* During this submission review, the TOC votes on each submission, and projects will be accepted by a simple majority vote of the TOC.
* The TOC, or individual members may engage with project to ask further questions
* In the event of rejection, we will indicate which of these criteria the TOC did not believe were met. Projects are welcome to address feedback and submit again in the future.
* Sandbox projects are tracked as [gitlab issues](https://repo1.dso.mil/platform-one/p1toc/-/issues?scope=all&utf8=%E2%9C%93&state=opened&label_name[]=sandbox) with the `sandbox` label.
Sandbox projects are tracked as [gitlab issues](https://repo1.dso.mil/platform-one/p1toc/-/issues?scope=all&utf8=%E2%9C%93&state=opened&label_name[]=sandbox) with the `sandbox` label.
### Incubating:
`Incubating` projects have adoption and show value added, but have not reach maturity to commit to long term support to end users.
## Project Graduation Process: Sandbox to Incubating
#### Incubating Project Goals
1. Further advance collaboration and validation of project objectives
Incubating projects are required to undergo due diligence as a part of the process to move from Sandbox to Incubation. Due Diligence is driven by a TOC sponsor, with two weeks for public comment before a vote is called.
To be accepted to `Incubating` stage, a project must meet the `Sandbox` stage requirements plus:
Criteria:
* Production use by at least two Platform One customers
* Project is publicly accessible on [repo1.dso.mil](https://repo1.dso.mil/)
* Active community participation
- A minimum of one dedicated maintainer from a Platform One or Customer team
- A substantial ongoing flow of commits and merged contributions from two or more active contributors
* Documentation to support widespread contribution and implementation
- An up-to-date contributors guide
- A minimum of one public reference implementation
- Clearly documented processes explaining how and where to report security issues to the project
#### Incubating Project Requirements
To mature to `Incubating` stage, a project must meet the `Sandbox` stage requirements plus:
* Active use by at least two customers and/or organizations
* Demonstrated support, through contribution and feature release consistent with [Big Bang guidelines](https://repo1.dso.mil/platform-one/big-bang/bigbang)
* Have begun or completed a cATO approval
Projects moving from sandbox to incubation are tracked as [gitlab issues](https://repo1.dso.mil/platform-one/p1toc/-/issues?scope=all&utf8=%E2%9C%93&state=opened&label_name[]=graduated) with the `incubation` label.
## Project Graduation Process: Incubating to Graduated
Graduated projects are required to undergo due diligence as a part of the process to move from Incubation to Graduated. Due Diligence is driven by a TOC sponsor, with two weeks for public comment before a vote is called.
Criteria:
* Meet criteria for `Sandbox` and `Incubating` status
* Production use by at least three Platform One customers with active teams larger than 50 individuals
who endorse transition to `Graduated Status`
* Active community participation
- A minimum of two dedicated maintainers from a Platform One or Customer team
- Dedicated mattermost channel on [chat.il2.dso.mil](https://chat.il2.dso.mil/) for development and support
* Documentation to support widespread contribution and implementation
- A defined support process
- A defined release process
* Receive a supermajority vote from the TOC to move to `Graduated` stage
Projects moving from incubation to graduation are tracked as [gitlab issues](https://repo1.dso.mil/platform-one/p1toc/-/issues?scope=all&utf8=%E2%9C%93&state=opened&label_name[]=graduated) with the `graduated` label.
## Archiving Projects
Open source projects have a lifecycle and there are times that projects become inactive due to a variety of reasons. There are also cases where a project may no longer want to be supported by the TOC, or the TOC may no longer wish to recommend the use of a project.
When voting on a proposal to archive a project, TOC members may wish to consider whether the project continues to meet the criteria for P1 TOC acceptance. The P1 TOC may also look at activity levels in the project, although it is important to note that there is a difference between a mature project that doesn't get much attention any more but is stable, versus a project that is inactive.
### Voting Process
To archive a project:
* A proposal must be put forth to the TOC repo
* The TOC will inform the project maintainers, P1 TOC end user community and wider community of all archiving proposals
* The proposal must remain open for at least 2 weeks of discussion after the maintainers are informed.
* A vote must be finalized with 2/3 approval from the P1 TOC
### Archiving Process
## Graduated:
What does archiving for a Platform One Community Contribution project mean?
* P1 TOC will no longer provide support for the project via service desk
* P1 TOC will list archived projects online
* P1 TOC can provide services such as documentation updates to help transition users.
* Other P1 TOC marketing activities will no longer be provided for the project
!! OPEN CALL for Feedback on this section !!
# IV. Semi-annual Review Process
`Graduated` projects are the highest level of maturity for a TOC project.
Sandbox projects are subject to an semi-annual review by the TOC. This is intended to be a lightweight process to ensure that projects are on track, and getting the support they need.
#### Graduated Project Goals
#### Graduated Project Requirements
* Meet requirements for `Incubating` status
* Active production use by multiple organizations
* Base images approved in [Iron Bank](https://p1.dso.mil/#/products/iron-bank/)
Your annual review should answer the following questions:
Projects moving from incubation to graduation are tracked as [gitlab issues](https://repo1.dso.mil/platform-one/p1toc/-/issues?scope=all&utf8=%E2%9C%93&state=opened&label_name[]=graduated) with the `graduated` label.
## Archived:
Archived projects are no longer in active development and are archived at a TOC meetup.
* Include a link to your project’s devstats page. We will be looking for signs of consistent or increasing contribution activity. Please feel free to add commentary to add colour to the numbers and graphs we will see on devstats.
* How many maintainers do you have, and which organization are they from? (Feel free to link to an existing MAINTAINERS file if appropriate.)
* What do you know about adoption, and how has this changed since your last review / since you joined Sandbox? If you can list companies that are end users of your project, please do so. (Feel free to link to an existing ADOPTERS file if appropriate.)
* How has the project performed against its goals since the last review? (We won't penalize you if your goals changed for good reasons.)
* What are the current goals of the project? For example, are you working on major new features? Or are you concentrating on adoption or documentation?
* How can the P1 TOC help you achieve your upcoming goals?
* Do you think that your project meets the criteria for incubation?
----
Based on this review the P1 TOC will vote on whether to continue to sponsor the project in Sandbox. If the vote does not reach a simple majority, we will discuss archiving or other next steps with you.
## Semi-annual Review Process
Additionally, the P1 TOC might recommend that you apply for Incubation stage. This requires extra work and due diligence so it’s not a possible outcome to move directly to Incubation from this lightweight annual review.
Projects are subject to an semi-annual review. This is intended to be a lightweight process to ensure that projects are active and effectively collaborated upon. The Projects Shepherd will engage the project on the review process.
It is fine for a project to stay in the Sandbox indefinitely while it is still active, but if a project has genuinely stalled we can save everyone’s effort by archiving it.
The review should clearly address the following:
* Signs of active contributions and maturation~
* Project still meets the requirements of its maturity level.
* How can the TOC help you achieve your upcoming goals?
# New Projects
Have an idea or improvement, you're in the right place. Before proceeding please:
- Review the P1TOC [Working Agreement](/WORKINGAGREEMENT.md)
- Review Active [projects](/projects/) in `sandbox`, `incubating`, and `graduated` to ensure you're idea isn't related.
- Review [archived projects](/projects/archived) and ensure your idea has matured beyond the initial reasoning for archival.
- If you have an idea and aren't quite ready for a formal proposal, start by creating a [new idea issue](TODO)
- Review and meet the requirements of [Sandbox Projects](../../../process/README.md#Sandbox-Projects)
Have a new package to be added to the TOC? You're in the right place.
## New proposals
## Quick Start
1. Submit a new [issue](https://repo1.dso.mil/platform-one/p1toc/-/issues/new), using the new project proposal template.
1. The P1TOC will grant permissions so that you can proceed to step 2.
2. the P1TOC will assign a Shepherd to your project. [Shepherd Role](../../../policy/governance.md)
2. Create a branch tied to the issue and complete the [proposal template](proposal_template.yaml)
3. When ready submit a pull request. The request will be reviewed at the next P1TOC meetup (time permitting, reviewed in order of submission).
1. Make sure to copy the proposal template and rename it to \<your-project-name\>.yaml
2. Title the merge request `Your-Project-Name proposal (#X)` where X is the issue number from step 1.
\ No newline at end of file
1. Submit a `new project proposal` [issue](https://repo1.dso.mil/platform-one/p1toc/-/issues/new)
2. Submit a Merge Request with your completed [proposal template](proposal_template.yaml)
### The Details
1. When you submit a `new project proposal` issue...
1. The TOC will assign you a Shepherd. The shepherd is your helper for any and all things you to get engaged with the TOC. [Shepherd Role](../../../policy/governance.md)
2. Populate the [proposal template](proposal_template.yaml) on a new branch (ask your shepherd if you need help). The template helps guide us and get you started efficiently.
3. Once a Merge request is created, that is a signal to the TOC Chair to add to the agenda for the next meetup.
The TOC is not here to gatekeep projects, instead...
We want to advocate and help maximize collaboration.
We want to guide projects through the process of classification, sandbox to incubating to graduated.
......@@ -11,9 +11,4 @@ project:
- name:
repo1user: ''
- name:
repo1user: ''
similarProjects:
- name:
url:
comparison:
\ No newline at end of file
repo1user: ''
\ No newline at end of file
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment