diff --git a/projects/kubevirt/governance-review/2026-08-03.md b/projects/kubevirt/governance-review/2026-08-03.md new file mode 100644 index 000000000..8167478b9 --- /dev/null +++ b/projects/kubevirt/governance-review/2026-08-03.md @@ -0,0 +1,249 @@ +# Governance Review for Kubevirt's Graduation +What follows is a governance review and assessment for the Kubevirt project. The review was executed as part of due diligence when Kubevirt submitted to move to the Graduation level in CNCF in . + +* Project: https://github.com/kubevirt/kubevirt +* Site: https://kubevirt.io/ +* Matriculation issue: https://github.com/cncf/toc/issues/1822 +* Governance review issue: https://github.com/cncf/toc/issues/2207 +* LFX Insights: + +This review is based on the template [here](https://github.com/cncf/toc/blob/main/toc_subprojects/project-reviews-subproject/governance-review-template.md) and integrates information provided by project maintainers in the matriculation issue. + + +## Summary and Assessment + + +**Status:** Satisfactory + + +### Executing the Assessment +Rasheedat Atinuke Jamiu (@rashraj) conducted this review in August 2026. The review follows CNCF TOC's [governance review template](https://github.com/cncf/toc/blob/main/toc_subprojects/project-reviews-subproject/governance-review-template.md) and [accompanying guidelines](https://github.com/cncf/toc/tree/main/toc_subprojects/project-reviews-subproject). + + +### Points of Excellence + +**The following aspects of governance are exemplary and can be referenced as +examples for other projects to copy:** + + +- [sigs.yaml](https://github.com/kubevirt/community/blob/main/sigs.yaml) holds all group and subproject structure in machine-readable form, generates the public [SIG list](https://github.com/kubevirt/community/blob/main/sig-list.md), and references the specific OWNERS files enforcing each subproject. +- The maintainer removal process has been exercised in practice, with the required vote visible in [#366](https://github.com/kubevirt/community/pull/366). +- An [AI contribution policy](https://github.com/kubevirt/community/blob/main/ai-contribution-policy.md) has been adopted. + +### Areas for Improvement + +**Over the next year, the project should work on the following issues to improve +its governance; these are considered non-blocking:** + +- Assign chairs and publish charters for sig-documentation, sig-testing, and wg-code-quality. +- Link governance from the [website community page](https://kubevirt.io) and the contributor guide, neither of which reaches it today. +- Develop and onboard maintainers from organizations already represented in SIG and WG leadership. + +--- + +## Review + +**The following review primarily consists of an audit of the project's self-assessment in their Graduation application.** + + +### Governance Summary + +KubeVirt extends Kubernetes to run virtual machines alongside containers, and maintains an associated set of operators, CSI and networking components, tooling, and CI infrastructure across the [github.com/kubevirt](https://github.com/kubevirt) organization. + +The project is governed by 8 maintainers and organized into 10 SIGs, 4 Working Groups, and 20 subprojects, as documented at [github.com/kubevirt/community](https://github.com/kubevirt/community). + +### Governance Evolution + +**Governance has continuously been iterated upon by the project as a result of +their experience applying it, with the governance history demonstrating +evolution of maturity alongside the project's maturity evolution.** +**Incubating:** Suggested | **Graduated:** Suggested + + +The KubeVirt community began collecting governance material in [github.com/kubevirt/community](https://github.com/kubevirt/community) with a [membership policy](https://github.com/kubevirt/community/commits/main/membership_policy.md) in January 2021 and a [maintainer-led governance document](https://github.com/kubevirt/community/commits/main/GOVERNANCE.md) in September 2021, and has iterated on both across the 5 years since. The most recent amendments, in August 2025, predate the graduation application. + +Notably, an [AI contribution policy](https://github.com/kubevirt/community/pull/415) was added in February 2026, and maintainer offboarding was exercised three times during 2025, including for a founding maintainer. + +The project also keeps track of SIGs, Working Groups, and subprojects in machine-readable form (list [here](https://github.com/kubevirt/community/blob/main/sig-list.md)) and establishes rules for their governance and maintenance in [GOVERNANCE.md](https://github.com/kubevirt/community/blob/main/GOVERNANCE.md#sigs). Emeritus status is tracked at four levels: MAINTAINERS.md, repository OWNERS files, SIG-level `emeritus_approvers`, and `emeritus_lead` entries in sigs.yaml. + +### Discoverability + +**Clear and discoverable project governance documentation.** +
+**Incubating:** Suggested | **Graduated:** Required + +The [kubevirt/community](https://github.com/kubevirt/community) README links [GOVERNANCE.md](https://github.com/kubevirt/community/blob/main/GOVERNANCE.md) and [membership_policy.md](https://github.com/kubevirt/community/blob/main/membership_policy.md) in its opening paragraph, and [CONTRIBUTING.md](https://github.com/kubevirt/kubevirt/blob/main/CONTRIBUTING.md) links the membership policy. + + +### Accuracy and Clarity + +**Governance is up to date with actual project activities, including any +meetings, elections, leadership, or approval processes.** +**Incubating:** Suggested | **Graduated:** Required + +The [public calendar](https://calendar.google.com/calendar/embed?src=kubevirt@cncf.io) matches [community_meeting.md](https://github.com/kubevirt/community/blob/main/community_meeting.md) and the meeting entries in sigs.yaml, meeting notes are publicly available, and the documented maintainer removal vote is visible in [#366](https://github.com/kubevirt/community/pull/366). + +Policy and recorded state diverge in several places. membership_policy.md requires a chair for each SIG, but sig-documentation and sig-testing have none; chairs are responsible for meetings, but sig-network and sig-buildsystem record none + +**Governance clearly documents [vendor-neutrality] of project direction.** +**Incubating:** Suggested | **Graduated:** Required + +[membership_policy.md](https://github.com/kubevirt/community/blob/main/membership_policy.md) opens with a commitment to vendor-neutral decision making and states that all SIG, WG, and community meetings are open to anyone. GOVERNANCE.md assigns maintainers responsibility for ensuring vendor neutrality. + +### Decisions and Role Assignments + +**Document how the project makes decisions on leadership roles, contribution +acceptance, requests to the CNCF, and changes to governance or project goals.** +**Incubating:** Suggested | **Graduated:** Required + +[GOVERNANCE.md](https://github.com/kubevirt/community/blob/main/GOVERNANCE.md) documents lazy consensus as the default, with votes available on the mailing list, on GitHub, or at the community meeting. + +Maintainer applications and CNCF resource requests require a simple majority; maintainer removal and governance changes require a 2/3 majority. + +Contribution acceptance is governed by [CONTRIBUTING.md](https://github.com/kubevirt/kubevirt/blob/main/CONTRIBUTING.md) and enforced through OWNERS files and Prow. + +**Document how role, function-based members, or sub-teams are assigned, +onboarded, and removed for specific teams (example: Security Response +Committee).** +**Incubating:** Suggested | **Graduated:** Required + +[membership_policy.md](https://github.com/kubevirt/community/blob/main/membership_policy.md) defines requirements, responsibilities, and inactivity handling for every rung of the ladder, including SIG Chair, Subproject Lead, and WG Chair. + +[SECURITY.md](https://github.com/kubevirt/kubevirt/blob/main/SECURITY.md) establishes a security team, disclosure address, alternate reporting mechanism, and advisories page. + +### Maintainers and Maintainer Lifecycle + +**Document a complete maintainer lifecycle process (including roles, onboarding, +offboarding, and emeritus status).** +**Incubating:** Suggested | **Graduated:** Required + +[GOVERNANCE.md](https://github.com/kubevirt/community/blob/main/GOVERNANCE.md) documents application, approval, offboarding by 2/3 vote, emeritus status, and reinstatement. [membership_policy.md](https://github.com/kubevirt/community/blob/main/membership_policy.md) defines inactivity thresholds and how inactivity is measured. + +**Demonstrate usage of the maintainer lifecycle with outcomes, either through +the addition or replacement of maintainers as project events have required.** +**Incubating:** Suggested | **Graduated:** Required + +[MAINTAINERS.md](https://github.com/kubevirt/community/blob/main/MAINTAINERS.md) records 5 emeritus maintainers, 3 of whom retired during 2025, including a founding maintainer. Offboarding that year included both voluntary retirement ([#406](https://github.com/kubevirt/community/pull/406)) and removal initiated by other maintainers ([#366](https://github.com/kubevirt/community/pull/366)), with the required vote visible in each. + +**Document complete list of current maintainers, including names, contact +information, domain of responsibility, and affiliation.** **Incubating:** Required | **Graduated:** Required + +[MAINTAINERS.md](https://github.com/kubevirt/community/blob/main/MAINTAINERS.md) lists 8 maintainers with name, GitHub profile, employer, and an explicit domain of responsibility. + +**A number of active maintainers which is appropriate to the size and scope of +the project.** **Incubating:** Required | **Graduated:** Required +There are 8 current active maintainers from 3 different employers. + +**Project maintainers from at least 2 organizations that demonstrates +survivability.** **Incubating:** N/A | **Graduated:** Required + +Maintainers span three organizations; Red Hat (6), Google (1), and Nvidia (1) + +### Ownership + +**Code and Doc ownership in Github and elsewhere matches documented governance +roles.** **Incubating:** Required | **Graduated:** Required + +* OWNERS files throughout the org grant appropriate permissions to contributors, and [sigs.yaml](https://github.com/kubevirt/community/blob/main/sigs.yaml) references the specific file governing each subproject, including at directory level. For example: + * https://github.com/kubevirt/kubevirt/blob/main/pkg/instancetype/OWNERS + * https://github.com/kubevirt/kubevirt/blob/main/tests/performance/OWNERS + * https://github.com/kubevirt/containerized-data-importer/blob/main/OWNERS + +### Code of Conduct + +**Document adoption and adherence to the CNCF Code of Conduct or the project's +CoC, which is based off the CNCF CoC and not in conflict with it.** **Incubating:** Required | **Graduated:** Required + + +Kubevirt's own [code-of-conduct.md](https://github.com/kubevirt/community/blob/main/code-of-conduct.md). references the CNCF's code of conduct. Other repositories reference this primary code of conduct. + +**CNCF Code of Conduct is cross-linked from other governance documents.** **Incubating:** Required | **Graduated:** Required + +The Code of Conduct is linked from GOVERNANCE.md and twice from [membership_policy.md](https://github.com/kubevirt/community/blob/main/membership_policy.md), and the CNCF Code of Conduct is referenced in KubeVirt's own [code-of-conduct.md](https://github.com/kubevirt/community/blob/main/code-of-conduct.md). + +### Subprojects + +**All subprojects, if any, are listed.** **Incubating:** Required | **Graduated:** Required + +Subprojects are listed in [sigs.yaml](https://github.com/kubevirt/community/blob/main/sigs.yaml), which declares twenty subprojects across ten SIGs and four Working Groups, and is rendered as the [SIG list](https://github.com/kubevirt/community/blob/main/sig-list.md). Each entry references the OWNERS files that govern it. + +Where subproject documentation is incomplete: + + +| Area | Ownership and Operation | Communications | Project Alignment | Notes | +|:-----|:-----------------------:|:---------------:|:------------------|:---| +| sig-documentation | Missing | Missing | Partial | No chairs, no `dir`, no charter; owns the website and user guide | +| sig-testing | Missing | Missing | Partial | No chairs, no `dir`, no charter; owns kubevirtci and project-infra | +| sig-network | Complete | Missing | Complete | No meetings or contacts; holds the most subprojects (6) | +| sig-buildsystem | Complete | Missing | Complete | No meetings or contacts | +| sig-storage | Complete | Partial | Complete | Meetings listed, no contacts | +| wg-arch-s390x | Complete | Missing | Complete | No meetings or contacts | +| wg-arch-arm | Complete | Missing | Complete | Single chair; no meetings or contacts | +| wg-aie | Complete | Partial | Complete | Meetings listed, no contacts | +| wg-code-quality | Complete | Complete | Partial | No charter | +| sig-control-plane | Partial | Complete | Partial | Chairs and charter, but declares no subprojects | +| sig-release | Partial | Other | Partial | OWNERS present; not associated with any subproject in sigs.yaml | +| enhancements | Partial | Other | Partial | OWNERS present; not associated with any subproject in sigs.yaml | + + + +**If the project has subprojects: subproject leadership, contribution, maturity +status documented, including add/remove process.** +
+**Incubating:** Suggested | **Graduated:** Required + +Chairs and leads are identified in sigs.yaml, [membership_policy.md](https://github.com/kubevirt/community/blob/main/membership_policy.md) documents requirements and inactivity handling for SIG Chair, Subproject Lead, and WG Chair. Leads are added and moved to emeritus via PRs against sigs.yaml and OWNERS files. + +Maturity is indicated via semantic versioning of releases rather than in governance — virt-template released v0.2.2 and common-instancetypes v1.7.0 during the v1.9.0 cycle. GOVERNANCE.md documents no process for creating or retiring groups, deferring to the Kubernetes model. + + +### Contributors and Community + +**Contributor ladder with multiple roles for contributors.** **Incubating:** Suggested | **Graduated:** Suggested + +[membership_policy.md](https://github.com/kubevirt/community/blob/main/membership_policy.md) defines eight rungs from Contributor to Working Group Chair, each with requirements, responsibilities, and the file that defines it, supported by a [membership checklist](https://github.com/kubevirt/community/blob/main/membership_checklist.md). + +**Clearly defined and discoverable process to submit issues or changes.** + +**Incubating:** Required | **Graduated:** Required +[CONTRIBUTING.md]((https://github.com/kubevirt/kubevirt/blob/main/CONTRIBUTING.md)) describes how to open issues and pull requests. The process follows typical GitHub patterns. + +**Project must have, and document, at least one public communications channel +for users and/or contributors.** + +**Incubating:** Required | **Graduated:** Required + +The community README lists the `#virtualization` and `#kubevirt-dev` Slack channels, the [kubevirt-dev Google Group](https://groups.google.com/forum/#!forum/kubevirt-dev), a weekly [community meeting](https://github.com/kubevirt/community/blob/main/community_meeting.md), and a public calendar. + +**List and document all project communication channels, including subprojects +(mail list/slack/etc.). List any non-public communications channels and what +their special purpose is.** **Incubating:** Required | **Graduated:** Required + +The [community repository README](https://github.com/kubevirt/community) details Slack channels, the kubevirt-dev mailing list, the weekly community meeting, the public calendar, the blog, and the adopters list. + +Per-group channels are recorded in sigs.yaml using Slack, mailing list, GitHub team, and liaison fields; most SIGs share the common #kubevirt-dev channel and mailing list rather than maintaining dedicated ones. + +A disclosure process and private email address for security issues is documented in SECURITY.md. GOVERNANCE.md + +**Up-to-date public meeting schedulers and/or integration with CNCF calendar.** +
+**Incubating:** Required | **Graduated:** Required + +The project maintains a public [Kubevirt calendar](https://calendar.google.com/calendar/u/0/embed?src=kubevirt@cncf.io) under kubevirt@cncf.io, linked from the community [README](https://github.com/kubevirt/community#community) and [membership_policy.md](https://github.com/kubevirt/community/blob/main/membership_policy.md) Meeting entries link to agendas stored on Google Docs. + +**Documentation of how to contribute, with increasing detail as the project +matures.** +
+**Incubating:** Required | **Graduated:** Required + +Contribution guidelines, the contributor guide covering code and non-code contributions, the membership policy, the VEP process for design-level changes, and an AI contribution policy are published across the kubevirt/community repo and the project website. Good first issues and help wanted are labelled in the main repository. + +**Demonstrate contributor activity and recruitment.** +
+**Incubating:** Required | **Graduated:** Required +The [v1.9.0 release](https://github.com/kubevirt/kubevirt/releases/tag/v1.9.0) merged 1,653 changes from 108 contributors, up from 1,242 changes and 77 contributors in [v1.8.0](https://github.com/kubevirt/kubevirt/releases/tag/v1.8.0). Contributions came from Red Hat, NVIDIA, IBM, Microsoft, AMD, SUSE, Nebius, Civo, and Shalb, alongside a substantial number of unaffiliated contributors. + +The [LF Insights page for kubevirt](https://insights.linuxfoundation.org/project/kubevirt/contributors?widget=active-contributors) demonstrates many active contributors. + +[project milestone or other requirement]: https://github.com/cncf/toc/tree/main/process#how-to-apply-to-move-levels +[vendor-neutrality]: https://contribute.cncf.io/maintainers/community/vendor-neutrality/