[Epic] Prepare for CNCF Incubation application

[viccuad]

Acceptance criteria

We need to fill the following template for incubation application (2024-07-04 v1.5 as time of writing).
This issue contains a copy of that template so we can iterate and piecemeal the tasks.

To work on this epic, pick one of the required tasks, convert it into an issue and move it to the relevant repo (normally kubewarden/community).
Once the required tasks are done, we will format this issue into a submission.

Suggestion for scheduling work: "complete X number of tasks from the list", as there are still some low hanging fruits.

---

Kubewarden Incubation Application

v1.5

Project Repo(s): https://github.com/kubewarden/community
Project Site: https://kubewarden.io
Sub-Projects: $LIST
Communication: #kubewarden on Kubernetes Slack, #kubewarden-dev on Kubernetes Slack, cncf-kubewarden-maintainers as mail username at lists.cncf.io.

Project points of contacts: https://github.com/orgs/kubewarden/teams/maintainers

Incubation Criteria Summary for Kubewarden

Adoption Assertion

The project has been adopted by the following organizations in a testing and integration or production capacity:
(list adopters in ADOPTERS.md)

Application Process Principles

Suggested

N/A

Required

• Give a presentation and engage with the domain specific TAG(s) to increase awareness
  • This was completed and occurred on DD-MMM-YYYY, and can be discovered at $LINK.

• TAG provides insight/recommendation of the project in the context of the landscape

• All project metadata and resources are vendor-neutral.

• Review and acknowledgement of expectations for Sandbox projects and requirements for moving forward through the CNCF Maturity levels.
• Met during Project's application on 27-04-2024.

• Due Diligence Review.

Completion of this due diligence document, resolution of concerns raised, and presented for public comment satisifies the Due Diligence Review criteria.

• Additional documentation as appropriate for project type, e.g.: installation documentation, end user documentation, reference implementation and/or code samples.
  https://kubewarden.io
  https://docs.kubewarden.io

Governance and Maintainers

Note: this section may be augmented by the completion of a Governance Review from TAG Contributor Strategy.

Suggested

• Clear and discoverable project governance documentation.
  https://github.com/kubewarden/community/blob/main/GOVERNANCE.md

• Governance has continuously been iterated upon by the project as a result of their experience applying it, with the governance history demonstrating evolution of maturity alongside the project's maturity evolution.

• Governance is up to date with actual project activities, including any meetings, elections, leadership, or approval processes.

• Governance clearly documents vendor-neutrality of project direction.

• Document how the project makes decisions on leadership, contribution acceptance, requests to the CNCF, and changes to governance or project goals.

• Document how role, function-based members, or sub-teams are assigned, onboarded, and removed for specific teams (example: Security Response Committee).

• Document a complete maintainer lifecycle process (including roles, onboarding, offboarding, and emeritus status).

• Demonstrate usage of the maintainer lifecycle with outcomes, either through the addition or replacement of maintainers as project events have required.

• If the project has subprojects: subproject leadership, contribution, maturity status documented, including add/remove process.

Required

• Document complete list of current maintainers, including names, contact information, domain of responsibility, and affiliation.

• A number of active maintainers which is appropriate to the size and scope of the project.

• Code and Doc ownership in Github and elsewhere matches documented governance roles.

• Document agreement that project will adopt CNCF Code of Conduct.
  https://github.com/kubewarden/community/blob/main/CODE_OF_CONDUCT.md

• CNCF Code of Conduct is cross-linked from other governance documents.

• All subprojects, if any, are listed.
  https://github.com/kubewarden/community/blob/main/README.md#repositories

Contributors and Community

Note: this section may be augmented by the completion of a Governance Review from TAG Contributor Strategy.

• (Optional) Submit a Governance Review from TAG Contributor Strategy.

Suggested

• Contributor ladder with multiple roles for contributors.

Required

• Clearly defined and discoverable process to submit issues or changes.
  We use GitHub for submitting issues and changes via PRs. Contributors can get in contact with us at #kubewarden-dev on the Kubernetes Slack server, as well as [email protected].

• Project must have, and document, at least one public communications channel for users and/or contributors.
  We use #kubewarden-dev, #kubewarden on the Kubernetes Slack server, as well as [email protected]. These are linked in https://kubewarden.io.

• List and document all project communication channels, including subprojects (mail list/slack/etc.). List any non-public communications channels and what their special purpose is.
  • #kubewarden on the Kubernetes Slack server. Main public channel, for user questions, announcements and general talk.
  • #kubewarden-dev on the Kubernetes Slack server. Development channel for development questions, PR reviews, etc.
  • [email protected]. Mailing list. For private Security disclosures.

• Up-to-date public meeting schedulers and/or integration with CNCF calendar.
  • TODO add Kubewarden monthly community meetings to https://www.cncf.io/calendar/.

• Documentation of how to contribute, with increasing detail as the project matures.
  https://github.com/kubewarden/community/blob/main/CONTRIBUTING.md

• Demonstrate contributor activity and recruitment.

Engineering Principles

Suggested

• Roadmap change process is documented.

• History of regular, quality releases.
  We release somewhat monthly, with release candidates. For more information on each release, besides GitHub Releases and their changelogs, see https://www.kubewarden.io/blog/.

Required

• Document project goals and objectives that illustrate the project’s differentiation in the Cloud Native landscape as well as outlines how this project fulfills an outstanding need and/or solves a problem differently.

• Document what the project does, and why it does it - including viable cloud native use cases.

• Document and maintain a public roadmap or other forward looking planning document or tracking mechanism.

• Document overview of project architecture and software design that demonstrates viable cloud native use cases, as part of the project's documentation.

• Document the project's release process.

Security

Note: this section may be augmented by a joint-assessment performed by TAG Security.

• (optional) Submit for an assessment by TAG Security

Suggested

N/A

Required

• Clearly defined and discoverable process to report security issues.
  https://docs.kubewarden.io/disclosure. Also, https://github.com/kubewarden/community/blob/main/SECURITY.md.

• Enforcing Access Control Rules to secure the code base against attacks (Example: two factor authentication enforcement, and/or use of ACL tools.)

• Document assignment of security response roles and how reports are handled.

• Document Security Self-Assessment.

• Achieve the Open Source Security Foundation (OpenSSF) Best Practices passing badge.
  All the MUST and SHOULD must be achieved. See criteria in https://www.bestpractices.dev/en/criteria/0.
  Current progress in https://www.bestpractices.dev/en/users/23101.
  • Feature: automatically create docs for policy-server commands and flags policy-server#810
  • Feature: automatically create docs for kwctl commands and flags kwctl#851

Ecosystem

Suggested

N/A

Required

• Publicly documented list of adopters, which may indicate their adoption level (dev/trialing, prod, etc.)
  https://github.com/kubewarden/community/blob/main/ADOPTERS.md

• Used in appropriate capacity by at least 3 independent + indirect/direct adopters, (these are not required to be in the publicly documented list of adopters)

  The project provided the TOC with a list of adopters for verification of use of the project at the level expected, i.e. production use for graduation, dev/test for incubation: https://github.com/kubewarden/community/blob/main/ADOPTERS.md

• TOC verification of adopters.

Refer to the Adoption portion of this document.

• Clearly documented integrations and/or compatibility with other CNCF projects as well as non-CNCF projects.
  Docs page listing the dependencies used: https://docs.kubewarden.io/reference/dependency-matrix

Additional Information

[flavio]

@OrlinVasilev: could you help with that when you've some spare time, please? 🙏