Add governance review for Kubevirt graduation

projects/kubevirt/governance-review/2026-08-03.md

@@ -0,0 +1,249 @@
+# Governance Review for Kubevirt's Graduation
+What follows is a governance review and assessment for the Kubevirt project. The review was executed as part of due diligence when Kubevirt submitted to move to the Graduation level in CNCF in <https://github.com/cncf/toc/issues/2207>.
+
+* Project: https://github.com/kubevirt/kubevirt
+* Site: https://kubevirt.io/
+* Matriculation issue: https://github.com/cncf/toc/issues/1822
+* Governance review issue: https://github.com/cncf/toc/issues/2207
+* LFX Insights: <https://insights.linuxfoundation.org/project/kubevirt/contributors?widget=active-contributors>
+
+This review is based on the template [here](https://github.com/cncf/toc/blob/main/toc_subprojects/project-reviews-subproject/governance-review-template.md) and integrates information provided by project maintainers in the matriculation issue.
+
+
+## Summary and Assessment
+
+
+**Status:**  Satisfactory 
+
+
+### Executing the Assessment
+Rasheedat Atinuke Jamiu (@rashraj) conducted this review in August 2026. The review follows CNCF TOC's [governance review template](https://github.com/cncf/toc/blob/main/toc_subprojects/project-reviews-subproject/governance-review-template.md) and [accompanying guidelines](https://github.com/cncf/toc/tree/main/toc_subprojects/project-reviews-subproject).
+
+
+### Points of Excellence
+
+**The following aspects of governance are exemplary and can be referenced as
+examples for other projects to copy:**
+
+
+- [sigs.yaml](https://github.com/kubevirt/community/blob/main/sigs.yaml) holds all group and subproject structure in machine-readable form, generates the public [SIG list](https://github.com/kubevirt/community/blob/main/sig-list.md), and references the specific OWNERS files enforcing each subproject.
+- The maintainer removal process has been exercised in practice, with the required vote visible in [#366](https://github.com/kubevirt/community/pull/366).
+- An [AI contribution policy](https://github.com/kubevirt/community/blob/main/ai-contribution-policy.md) has been adopted.
+
+### Areas for Improvement
+
+**Over the next year, the project should work on the following issues to improve
+its governance; these are considered non-blocking:**
+
+- Assign chairs and publish charters for sig-documentation, sig-testing, and wg-code-quality.
+- Link governance from the [website community page](https://kubevirt.io) and the contributor guide, neither of which reaches it today.
+- Develop and onboard maintainers from organizations already represented in SIG and WG leadership.
+
+---
+
+## Review
+
+**The following review primarily consists of an audit of the project's self-assessment in their Graduation application.**
+
+
+### Governance Summary
+
+KubeVirt extends Kubernetes to run virtual machines alongside containers, and maintains an associated set of operators, CSI and networking components, tooling, and CI infrastructure across the [github.com/kubevirt](https://github.com/kubevirt) organization.
+
+The project is governed by 8 maintainers and organized into 10 SIGs, 4 Working Groups, and 20 subprojects, as documented at [github.com/kubevirt/community](https://github.com/kubevirt/community).
+
+### Governance Evolution
+
+**Governance has continuously been iterated upon by the project as a result of
+their experience applying it, with the governance history demonstrating
+evolution of maturity alongside the project's maturity evolution.**
+**Incubating:** Suggested | **Graduated:** Suggested
+
+
+The KubeVirt community began collecting governance material in [github.com/kubevirt/community](https://github.com/kubevirt/community) with a [membership policy](https://github.com/kubevirt/community/commits/main/membership_policy.md) in January 2021 and a [maintainer-led governance document](https://github.com/kubevirt/community/commits/main/GOVERNANCE.md) in September 2021, and has iterated on both across the 5 years since. The most recent amendments, in August 2025, predate the graduation application.
+
+Notably, an [AI contribution policy](https://github.com/kubevirt/community/pull/415) was added in February 2026, and maintainer offboarding was exercised three times during 2025, including for a founding maintainer.
+
+The project also keeps track of SIGs, Working Groups, and subprojects in machine-readable form (list [here](https://github.com/kubevirt/community/blob/main/sig-list.md)) and establishes rules for their governance and maintenance in [GOVERNANCE.md](https://github.com/kubevirt/community/blob/main/GOVERNANCE.md#sigs). Emeritus status is tracked at four levels: MAINTAINERS.md, repository OWNERS files, SIG-level `emeritus_approvers`, and `emeritus_lead` entries in sigs.yaml.
+
+### Discoverability
+
+**Clear and discoverable project governance documentation.**
+<br>
+**Incubating:** Suggested | **Graduated:** Required
+
+The [kubevirt/community](https://github.com/kubevirt/community) README links [GOVERNANCE.md](https://github.com/kubevirt/community/blob/main/GOVERNANCE.md) and [membership_policy.md](https://github.com/kubevirt/community/blob/main/membership_policy.md) in its opening paragraph, and [CONTRIBUTING.md](https://github.com/kubevirt/kubevirt/blob/main/CONTRIBUTING.md) links the membership policy.
+
+
+### Accuracy and Clarity
+
+**Governance is up to date with actual project activities, including any
+meetings, elections, leadership, or approval processes.**
+**Incubating:** Suggested | **Graduated:** Required
+
+The [public calendar](https://calendar.google.com/calendar/embed?src=kubevirt@cncf.io) matches [community_meeting.md](https://github.com/kubevirt/community/blob/main/community_meeting.md) and the meeting entries in sigs.yaml, meeting notes are publicly available, and the documented maintainer removal vote is visible in [#366](https://github.com/kubevirt/community/pull/366).
+
+Policy and recorded state diverge in several places. membership_policy.md requires a chair for each SIG, but sig-documentation and sig-testing have none; chairs are responsible for meetings, but sig-network and sig-buildsystem record none
+
+**Governance clearly documents [vendor-neutrality] of project direction.**
+**Incubating:** Suggested | **Graduated:** Required
+
+[membership_policy.md](https://github.com/kubevirt/community/blob/main/membership_policy.md) opens with a commitment to vendor-neutral decision making and states that all SIG, WG, and community meetings are open to anyone. GOVERNANCE.md assigns maintainers responsibility for ensuring vendor neutrality.
+
+### Decisions and Role Assignments
+
+**Document how the project makes decisions on leadership roles, contribution
+acceptance, requests to the CNCF, and changes to governance or project goals.**
+**Incubating:** Suggested | **Graduated:** Required
+
+[GOVERNANCE.md](https://github.com/kubevirt/community/blob/main/GOVERNANCE.md) documents lazy consensus as the default, with votes available on the mailing list, on GitHub, or at the community meeting. 
+
+Maintainer applications and CNCF resource requests require a simple majority; maintainer removal and governance changes require a 2/3 majority. 
+
+Contribution acceptance is governed by [CONTRIBUTING.md](https://github.com/kubevirt/kubevirt/blob/main/CONTRIBUTING.md) and enforced through OWNERS files and Prow.
+
+**Document how role, function-based members, or sub-teams are assigned,
+onboarded, and removed for specific teams (example: Security Response
+Committee).**
+**Incubating:** Suggested | **Graduated:** Required
+
+[membership_policy.md](https://github.com/kubevirt/community/blob/main/membership_policy.md) defines requirements, responsibilities, and inactivity handling for every rung of the ladder, including SIG Chair, Subproject Lead, and WG Chair.
+
+[SECURITY.md](https://github.com/kubevirt/kubevirt/blob/main/SECURITY.md) establishes a security team, disclosure address, alternate reporting mechanism, and advisories page. 
+
+### Maintainers and Maintainer Lifecycle
+
+**Document a complete maintainer lifecycle process (including roles, onboarding,
+offboarding, and emeritus status).**
+**Incubating:** Suggested | **Graduated:** Required
+
+[GOVERNANCE.md](https://github.com/kubevirt/community/blob/main/GOVERNANCE.md) documents application, approval, offboarding by 2/3 vote, emeritus status, and reinstatement. [membership_policy.md](https://github.com/kubevirt/community/blob/main/membership_policy.md) defines inactivity thresholds and how inactivity is measured.
+
+**Demonstrate usage of the maintainer lifecycle with outcomes, either through
+the addition or replacement of maintainers as project events have required.**
+**Incubating:** Suggested | **Graduated:** Required
+
+[MAINTAINERS.md](https://github.com/kubevirt/community/blob/main/MAINTAINERS.md) records 5 emeritus maintainers, 3 of whom retired during 2025, including a founding maintainer. Offboarding that year included both voluntary retirement ([#406](https://github.com/kubevirt/community/pull/406)) and removal initiated by other maintainers ([#366](https://github.com/kubevirt/community/pull/366)), with the required vote visible in each.
+
+**Document complete list of current maintainers, including names, contact
+information, domain of responsibility, and affiliation.** **Incubating:** Required | **Graduated:** Required
+
+[MAINTAINERS.md](https://github.com/kubevirt/community/blob/main/MAINTAINERS.md) lists 8 maintainers with name, GitHub profile, employer, and an explicit domain of responsibility.
+
+**A number of active maintainers which is appropriate to the size and scope of
+the project.** **Incubating:** Required | **Graduated:** Required
+There are 8 current active maintainers from 3 different employers.
+
+**Project maintainers from at least 2 organizations that demonstrates
+survivability.** **Incubating:** N/A | **Graduated:** Required
+
+Maintainers span three organizations; Red Hat (6), Google (1), and Nvidia (1) 
+
+### Ownership
+
+**Code and Doc ownership in Github and elsewhere matches documented governance
+roles.** **Incubating:** Required | **Graduated:** Required
+
+* OWNERS files throughout the org grant appropriate permissions to contributors, and [sigs.yaml](https://github.com/kubevirt/community/blob/main/sigs.yaml) references the specific file governing each subproject, including at directory level. For example:
+  * https://github.com/kubevirt/kubevirt/blob/main/pkg/instancetype/OWNERS
+  * https://github.com/kubevirt/kubevirt/blob/main/tests/performance/OWNERS
+  * https://github.com/kubevirt/containerized-data-importer/blob/main/OWNERS
+
+### Code of Conduct
+
+**Document adoption and adherence to the CNCF Code of Conduct or the project's
+CoC, which is based off the CNCF CoC and not in conflict with it.** **Incubating:** Required | **Graduated:** Required
+
+
+Kubevirt's own [code-of-conduct.md](https://github.com/kubevirt/community/blob/main/code-of-conduct.md). references the CNCF's code of conduct. Other repositories reference this primary code of conduct.
+
+**CNCF Code of Conduct is cross-linked from other governance documents.** **Incubating:** Required | **Graduated:** Required
+
+The Code of Conduct is linked from GOVERNANCE.md and twice from [membership_policy.md](https://github.com/kubevirt/community/blob/main/membership_policy.md), and the CNCF Code of Conduct is referenced in KubeVirt's own [code-of-conduct.md](https://github.com/kubevirt/community/blob/main/code-of-conduct.md).
+
+### Subprojects
+
+**All subprojects, if any, are listed.** **Incubating:** Required | **Graduated:** Required
+
+Subprojects are listed in [sigs.yaml](https://github.com/kubevirt/community/blob/main/sigs.yaml), which declares twenty subprojects across ten SIGs and four Working Groups, and is rendered as the [SIG list](https://github.com/kubevirt/community/blob/main/sig-list.md). Each entry references the OWNERS files that govern it.
+
+Where subproject documentation is incomplete:
+
+
+| Area | Ownership and Operation | Communications | Project Alignment | Notes |
+|:-----|:-----------------------:|:---------------:|:------------------|:---|
+| sig-documentation | Missing | Missing | Partial | No chairs, no `dir`, no charter; owns the website and user guide |
+| sig-testing | Missing | Missing | Partial | No chairs, no `dir`, no charter; owns kubevirtci and project-infra |
+| sig-network | Complete | Missing | Complete | No meetings or contacts; holds the most subprojects (6) |
+| sig-buildsystem | Complete | Missing | Complete | No meetings or contacts |
+| sig-storage | Complete | Partial | Complete | Meetings listed, no contacts |
+| wg-arch-s390x | Complete | Missing | Complete | No meetings or contacts |
+| wg-arch-arm | Complete | Missing | Complete | Single chair; no meetings or contacts |
+| wg-aie | Complete | Partial | Complete | Meetings listed, no contacts |
+| wg-code-quality | Complete | Complete | Partial | No charter |
+| sig-control-plane | Partial | Complete | Partial | Chairs and charter, but declares no subprojects |
+| sig-release | Partial | Other | Partial | OWNERS present; not associated with any subproject in sigs.yaml |
+| enhancements | Partial | Other | Partial | OWNERS present; not associated with any subproject in sigs.yaml |
+
+
+
+**If the project has subprojects: subproject leadership, contribution, maturity
+status documented, including add/remove process.**
+<br>
+**Incubating:** Suggested | **Graduated:** Required
+
+Chairs and leads are identified in sigs.yaml, [membership_policy.md](https://github.com/kubevirt/community/blob/main/membership_policy.md) documents requirements and inactivity handling for SIG Chair, Subproject Lead, and WG Chair. Leads are added and moved to emeritus via PRs against sigs.yaml and OWNERS files.
+
+Maturity is indicated via semantic versioning of releases rather than in governance — virt-template released v0.2.2 and common-instancetypes v1.7.0 during the v1.9.0 cycle. GOVERNANCE.md documents no process for creating or retiring groups, deferring to the Kubernetes model.
+
+
+### Contributors and Community
+
+**Contributor ladder with multiple roles for contributors.** **Incubating:** Suggested | **Graduated:** Suggested
+
+[membership_policy.md](https://github.com/kubevirt/community/blob/main/membership_policy.md) defines eight rungs from Contributor to Working Group Chair, each with requirements, responsibilities, and the file that defines it, supported by a [membership checklist](https://github.com/kubevirt/community/blob/main/membership_checklist.md).
+
+**Clearly defined and discoverable process to submit issues or changes.**
+
+**Incubating:** Required | **Graduated:** Required
+[CONTRIBUTING.md]((https://github.com/kubevirt/kubevirt/blob/main/CONTRIBUTING.md))  describes how to open issues and pull requests. The process follows typical GitHub patterns.
+
+**Project must have, and document, at least one public communications channel
+for users and/or contributors.**
+
+**Incubating:** Required | **Graduated:** Required
+
+The community README lists the `#virtualization` and `#kubevirt-dev` Slack channels, the [kubevirt-dev Google Group](https://groups.google.com/forum/#!forum/kubevirt-dev), a weekly [community meeting](https://github.com/kubevirt/community/blob/main/community_meeting.md), and a public calendar.
+
+**List and document all project communication channels, including subprojects
+(mail list/slack/etc.). List any non-public communications channels and what
+their special purpose is.** **Incubating:** Required | **Graduated:** Required
+
+The [community repository README](https://github.com/kubevirt/community) details Slack channels, the kubevirt-dev mailing list, the weekly community meeting, the public calendar, the blog, and the adopters list. 
+
+Per-group channels are recorded in sigs.yaml using Slack, mailing list, GitHub team, and liaison fields; most SIGs share the common #kubevirt-dev channel and mailing list rather than maintaining dedicated ones.
+
+A disclosure process and private email address for security issues is documented in SECURITY.md. GOVERNANCE.md
+
+**Up-to-date public meeting schedulers and/or integration with CNCF calendar.**
+<br>
+**Incubating:** Required | **Graduated:** Required
+
+The project maintains a public [Kubevirt calendar](https://calendar.google.com/calendar/u/0/embed?src=kubevirt@cncf.io) under kubevirt@cncf.io, linked from the community [README](https://github.com/kubevirt/community#community) and [membership_policy.md](https://github.com/kubevirt/community/blob/main/membership_policy.md) Meeting entries link to agendas stored on Google Docs.
+
+**Documentation of how to contribute, with increasing detail as the project
+matures.**
+<br>
+**Incubating:** Required | **Graduated:** Required
+
+Contribution guidelines, the contributor guide covering code and non-code contributions, the membership policy, the VEP process for design-level changes, and an AI contribution policy are published across the kubevirt/community repo and the project website. Good first issues and help wanted are labelled in the main repository.
+
+**Demonstrate contributor activity and recruitment.**
+<br>
+**Incubating:** Required | **Graduated:** Required
+The [v1.9.0 release](https://github.com/kubevirt/kubevirt/releases/tag/v1.9.0) merged 1,653 changes from 108 contributors, up from 1,242 changes and 77 contributors in [v1.8.0](https://github.com/kubevirt/kubevirt/releases/tag/v1.8.0). Contributions came from Red Hat, NVIDIA, IBM, Microsoft, AMD, SUSE, Nebius, Civo, and Shalb, alongside a substantial number of unaffiliated contributors.
+
+The [LF Insights page for kubevirt](https://insights.linuxfoundation.org/project/kubevirt/contributors?widget=active-contributors) demonstrates many active contributors.
+
+[project milestone or other requirement]: https://github.com/cncf/toc/tree/main/process#how-to-apply-to-move-levels
+[vendor-neutrality]: https://contribute.cncf.io/maintainers/community/vendor-neutrality/