 So this is kind of tradition for us where we basically, you know have been doing these kind of TOC meetings at KubeCon It's just a way to you know introduce kind of how the TOC works, you know These aren't these people that are just magically hiding and all this wonderful stuff It's an open open process and so on so generally we'll go through kind of like a brief intro of you know How the TOC works then open up for questions and kind of see where things go from there So, you know, you know saw this a little bit, you know today You know CNCF's all about kind of making cloud-native computing Epiquitous and the TOC is basically there to kind of guide the technical side of the organization ensuring that projects are you know You know essentially cultivated, you know accepted and kind of guiding them that through that wonderful, you know process we have 11 lovely, you know individuals Unfortunately, just two of us were able to join today and you know I'll have them kind of maybe introduce them and introduce himself and talk a little bit about kind of your background and What you work on and then we'll kind of go through our journey of how the TOC operates For about 10 minutes and then maybe open it up for for questions for folks and if we end early and go to the party even better, so Do you want to maybe Cornelia you start? Sure, so Cornelia Davis, I have spent the last 10 years Working in developer platforms initially with cloud foundry and then about five or six years ago Started getting involved in Kubernetes still working at Pivotal at the time partnering with VMware and And then Heptio came into VMware and so got had a chance to partner with people like Joe Bita and Craig Mclucky as well So I've been doing Kubernetes for about five or six years and then I spent about 18 months at we've works Which is the company that coined the term get ops, which is really kind of an extension of dev ops for a platform like like Kubernetes and Very recently just in the last two or three months. I have joined Amazon All right, should we remove the yeah, yeah, I'm okay with it. I'm cool with it too. Yeah, okay So I'm Ricardo. I'm competing engineer at CERN in Geneva. I work on Our cloud deployments, we run a large private cloud on premises and we also use public clouds I'm Mostly focusing on Kubernetes and containerized environments but I do also a lot of networking and Software-defined networks and more recently some machine learning To support our scientists. So a lot of accelerators and integrating all of this in Kubernetes before that I did a Different of the things in at CERN as well. I was a developer for what we call our Worldwide LHC computing grid, which is a kind of large distributed environment that is a pre-cloud Something that would be very different if it would be redesigned today But that puts a lot of resources at the disposal of our scientists Yeah, and more recently I started working on the CNCF research and user group Which kind of tries to get to gather all the members of End users of the CNCF that has have similar requirements regarding batch like workloads and accelerators and Yeah, and since February this year. I'm in the TOC As a end user representative. So I help out in this area And I guess Chris Anizic I have the fun job of serving as CTO of the Oregon My team basically supports the TOC and kind of our technical side of the house and ensure our projects are healthy and in stable So governance structure, you know, we'll kind of go through and talk a little bit of how we're governed because a lot of people kind of get This kind of you know confused I think it's a little bit of you know inside baseball But I think it's kind of important to understand how the organization actually runs So we have kind of three main, you know parts of CNCF You know, we have the governing board who basically these are your essentially funders, right? You know, these are the people that are members of the organization They pay in that money is basically pulled together to go sustain the project these people who are on the governing board generally have no Say in how the technical projects work They're just there to come together and decide how the budget is spent So we could basically put on wonderful wonderful events like this like kube con or fun security audits and so on so You know, it's it's mostly vendors, but there are a mix of end-users like you know apple and Spotify part of the governing board the TOC You know, which is here. This is the technical body. It's a completely separate, you know organization, you know from the governing board It handles all the technical decisions which projects get accepted which projects, you know Get archived and we purposely separate, you know, the governing board the funding structure from the technical decisions So, you know the way we think about it is it is not a kind of it is it's not like a pay-to-play model It's a pay-to-sustain so all technical decisions are not influenced from the funders of the organization They may employ some of these individuals But you know it is the maintainers at the end of day and the TOC who make the you know technical decisions You know overall and then we have a third kind of structure the end user community Which essentially is end user organizations people who don't sell cloud native, you know Services or products, right? These are the actual consumers of the technology like a like an Apple or a CERN where Ricardo Works for AWS as a vendor. We give a special space for the end user community to basically work together collaborate share practices and essentially Safe space may not be the right word, but it's basically it's an area for them to Essentially not have vendors involved, but they have a formal role in governance So end users get to elect people on the TOC and they have representation there So these are kind of the three main tier structure of CNCF, you know for us that kind of work in the organization It's very obvious But a lot of people sometimes get confused that like oh do people like pay to get a TOC seat or how does this work and if It's like it's completely separate, you know on purpose We kind of separate technical governance from funding governance, which people get a little bit confused by and we also give end users a special voice and in the organization So one of the things that TOC puts together is something we call the TOC, you know principles These are essentially things that the TOC kind of abides by and kind of you know their decision You know how they think about making you know decisions So this was put together, you know a while ago by some of the early TOC members But generally we consider the CNCF as a kind of project-centric organization If you notice that you know if you're older KubeCon, there's project logos all over the place projects are for you know first and foremost You know, you know at the center less so of the organization Projects are self-governing, you know one thing a lot of people you know coming from different foundations and organizations get a little bit Confused is each project gets to kind of build their own governance model of how they run You know Kubernetes is very different from an envoy than a container D than a linker D And so on and we just find that as a Convenient way where each project is going to be different. They should be governed a little bit different It just has to be documented in public The TOC looks for very high quality high velocity generally projects, you know That's kind of what they generally look for sometimes they make bets We have this kind of no kingmakers rule we allow for competing and overlapping projects If you notice we have things like container D and Creo linker D and envoy all these things kind of overlap It could be in some way. We don't mean to like pick a project and have that one be like the only one true way To do things we do allow for competition We're not a traditional standards body. We don't basically deal with Old-school standards sometimes we have specifications, but the idea is we only promote technology or your specifications That actually have real-world Usage and so on so there's some other things, you know here that we kind of talk about but overall the whole Mission and organization put projects first project centrics and above all just like help projects become, you know better You know maturity models we have three main levels of you know projects at the TOC kind of works within the kind of decides where to guide projects through Sandbox incubating graduated three main levels. We kind of use that crossing the chasm analogy. I'm Talked about this a little bit, but essentially, you know sandbox projects. These are like early-stage projects We kind of expect them potentially to either be successful or die There's no guarantees Incubating things are a little bit more mature and we you know make a little bit more guarantees there and then graduated our projects that like your Company should be able to bet on with no concerns or worries and there's a whole kind of process that guide these projects through this potential You know maturity set of levels a lot of time when we do these meetings people are asking like How do I get a project and like, you know how this work? It's a fairly simple, you know process that you know I'll give a lot of credit to the TOC that they spend a lot of time kind of iterating and optimizing this sometimes That's two peoples like maybe like some people get a little upset because you know Sometimes it takes a while to evolve process when you have all these different organizations and members kind of working together But there's a fairly simple process Sandbox is very easy generally to kind of get into there's certain kind of Qualifications that you have to meet as part of the sandbox application and they're generally reviewed on a one to two months Basis, but it's meant to be kind of very lightweight We don't do a lot of marketing support for sandbox projects But the goal is to kind of make it easy to kind of get in and get cultivated within the organization Incubation and graduation the bar is significantly higher You know our TOC members basically Interview and users they do due diligence reviews It's a very kind of in-depth process if you ever kind of seen it publicly and the best part about this It's all documented publicly on get up none of this is done in private, you know at all You know I'm not going to go into this in detail because I think really did a fantastic job of not talking about the tags If you attended keynotes, but essentially what we've done is as the CNCF has grown into over a hundred projects It's just very hard to potentially have just a TOC focus and support all of them So we broke up into different kind of focus areas based on what people were interested in so we have things that cover security storage Runtime observability and so on. It's all broken apart, you know based on what people You know care about and focus on these tags basically serve as kind of an advisory function They help the TOC with potentially reviews and provide input based on their kind of specialties Because not everyone the TOC may be an expert on say observability and this has kind of helped us scale As an organization has been super. I think useful from my perspective, so I'm going to kind of you know go through I'm going to kind of skip and gloss over the you know tags if people have any particular questions on each of these things We're happy to kind of go through them But I think currently did a good job kind of covering some of these in the keynote, which is also online You know, I think really, you know, we kind of want to treat this as more kind of an interactive You know discussion. I have a couple questions for the TOC mostly around You know what they kind of see for the future of of you know CnCF in terms of which projects that we may be potentially interested in doing and kind of what we want to support in the future But I truly kind of want to open it up to folks that may have questions, you know out there, but you know So let's basically I'll start with a question kind of regarding, you know You know kind of the future and what people think about that and then maybe we kind of open it up to the audience to see if there's any kind of questions or you know Process concerns and so on but you know, the whole idea is to make this kind of an open and Discussion to get input from the community and help us evolve and become a better organization. So, you know question to our Probably to two TOC members So, you know, we've grown from, you know, one project from Kubernetes to kind of, you know That was kind of our kernel and we've expanded to, you know, nearly 120 projects that cover all kind of aspects You know, do you, you know Like what do you think is potentially, you know, missing, you know in that like landscape of projects that, you know We need to kind of, you know potentially Seek or go after or, you know, maybe you have from your end the experience working with, you know Customers or end users or from actually, you know usage within your organization. What do you think kind of holes are missing currently? You know in kind of the large landscape that we've built out in this organization over the last six years anyone want to Take that one? Yeah, I think we talked about this recently And I'm trying to remember what we talked about then, but I certainly have, you know, some thoughts along those lines I think that one of the areas if I recall correctly that we talked about was Be it really tracks against what's happening in the industry as a whole and one of those things, of course is more more More and more distribution and I'm talking about the edge And yeah, we have just the beginnings of some of those things So we have some Kubernetes projects that are Small footprint that are designed to go into these small devices and things like that But I think that there's still an awful lot that's missing to bring all of that together So there was certainly room for for projects that address the integration problem The the the distributed protocols and things like that. I think that's one of the areas for sure Yeah, so maybe maybe also because of my background I think one area that is also kind of interesting is all the ML machine learning things It's a lot of projects around but it's it's not really clear Where they fit even if we go to the tags when we start reviewing machine learning projects It's it's it's like do we go runtime or which which advisory group fits the best because it kind of covers a lot of things I think that area will also be quite important and the other the other part is this trend to to manage things that are not necessarily related to containers within this kind of cloud native world Integrating resources like projects like cross-plane what they are trying to do all this kind of bringing to to the second system things that are Were not traditionally seen as being part of it. I think this will be also be a trend So, I don't know how this will follow up, but I think it's something we should focus on Is there anything else like particularly from you know, you work basically at a research lab, right? You know, I remember back in the university work like working on things like slurm and using that like it's a whole like if you ever attend You know in HPC conference like super computer It seems like a whole weird parallel universe of folks that are doing Distributed computing at scale and have been doing it for a while and then you come to kubecon It's like there's all these folks in industry kind of doing similar things and I feel like these people just aren't Talking to each other. Yeah This is something that we we also deal internally because as the trend goes to to running things on Kubernetes Then why not do all the rest as well if we have all the experience and knowledge on it? There are some barriers that are more technical things like there's a lot of efforts with things like ruthless containers to run like in HPC environments which are kind of more I Am more tight in comparison to what we do elsewhere and other things like fair share More advanced scheduling in these tools. These are all things that are ongoing. I saw a couple of talks actually here at kubecon related to advanced scheduling adding things like Fairness and better priority definitions on scheduling. So this this is coming I don't know. I don't know how much will be like in the core of something like Kubernetes or Other projects that will will be plugged in but there's a place Ruthless is very interesting because it touches the whole stack the people working on it go from the kernel all the way to the end user tools So it's very interesting which scares me too But I think what you're talking about what I think is really interesting in this HPC space is that that there's all sorts of protocols in place for being able to Treat this highly distributed system, which we have to have because we need it for scale as a single system and and Most of what we do when we still talk about Kubernetes as we talk about Scheduling things on a cluster But what happens now when we need to schedule our HPC workloads across clusters and maintain state across those it's a It's a significant distributed systems problem. There was a big push towards Federation and now kind of Because some efforts were not so successful. We start looking more at multicluster and maybe doing things differently. So yeah, it's an interesting Change Definitely like if you ever have attended kind of both events, it's just so strange It's like literally parallel where worlds that just don't talk to each other as as much So what kind of one more question before we kind of turn over the audience So when one theme that has kind of come up in this conference at least that I've been you know talking to a lot of you know Users and and even vendors this whole notion of like security seems to be top of mind for for everyone Right, you know securing the supply chain definitely seems to be a theme, you know from your perspective on the TOC Do you see, you know, what are your thoughts of how we can enable? Projects, you know within our review system to be potentially more successful You know at this what can we kind of do to kind of improve the situation because we do have some Practices in place we do some security audits, but it just feels you know We have our own set of projects in CNCF the hundred twenty or so But then all those hundred twenty or so projects depend on you know, tens of thousand dependencies that have different You know levels of security and something you know I think about now on probably like a daily basis and definitely it's kind of permeated a portion You know of this conference Yeah, I mean what the first thing I would say is of course there's the security of security audits of the projects that that we have within the CNCF, but I just actually attended the pancake breakfast this morning and the topic was security there and what what is so interesting Is that I think that the whole security space In general the way that enterprises are still thinking about it is they have built these really rigorous models around the old architectures and And they're not quite they haven't quite come along for the ride yet And so I think that we need to do a whole heck of a lot more to go back and Not express the requirements Via the solutions that we've had in place for the last ten or twenty years But go back and revisit those requirements and look at the new architecture because most of the solutions are based on those old Architectures and so now we have these new surface areas. How do you inject? Security into a convergent system. How do you make security something that's convergent? How do you audit when things are constantly changing? Security used to have this notion of well We're going to get everything super stable and then we're not going to change it And that's how we're going to ensure security, but now what does security mean in a constantly changing world? And so I think I think that's one area where we can certainly do an awful lot I had posed the question this morning of Kubernetes be and again convergence is one of my favorite words in cloud native because in distributed systems That is the pattern that works and that's why Kubernetes one of the reasons why Kubernetes got so Ubiquitous is because it changed the fundamental model to this model of convergence And it has a language for the decline declared the desired state What is the language for various elements of security and what are those? convergence mechanisms and not all of those convergence mechanisms are going to be in a platform like Kubernetes What happens when you start doing security as a part of your build pipeline? How do you do that from a convergence? Perspective so I think there's an awful lot that we need to do in the security space that is a good call out So, you know, I'm happy now and I think to kind of turn over maybe the audience for some questions There's basically a few kind of wrap-up things in terms of you know I just want to make sure people aware of the TOC generally is very open for people coming in I know sometimes people new to the community get a little bit You know, they get a little bit worried sometimes. Oh, I don't know if I can approach him I guarantee you if you kind of reach out the folks everyone is very well They'd be maybe a little bit busy But overall everyone's kind of open and you know willing to kind of help out as as time a lots One important thing to note is I do want to kind of encourage folks that we do have elections basically Coming up in 2022 that should say 2022 instead of 2020 on but you know, we're going through this whole process where you know We're looking for people that are more senior engineers. You only have some cloud native experience Could work in end user communities, you know, it doesn't have to work for any user But just generally has some experience and we just we want to encourage more folks to run from all different backgrounds different Representations because I think one of the the best things that we've done with the TOC over time is we've expanded it to include more in user Representation more people from different backgrounds. I think that's just very healthy, you know to have so With that said, you know our love love to take any questions from the audience If I could before we take the question I just want to add a little something to the that you said there I'm gonna make it very personal So I I also joined the TOC earlier this year And I wanted to share with you a little bit about how that process went for me Because I think it might just help encourage some of you to step forward So Liz Rice our our chair TOC chair pinged me one day and said hey Have you ever thought about running for the TOC and I said oh I totally want to run for the TOC someday when I'm ready And she said You're the CTO of Weaverx you wrote a book on cloud native patterns You're ready, and I was like really and she said yeah You're ready, and that's how I came to do it So for all of you who are thinking I would love to do that someday. I'm not ready there's a really good chance that you are ready and Step forward or work with somebody to step forward, and if it doesn't work the first time that's okay, too But I just really want to encourage all of you because most of you probably think that you're not ready, but you are That's a fantastic story. Liz are fearless We miss her she so wants to be here So any questions in the audience before we kind of wrap things so we got two hands at least I've got questions from online first. So we'll answer those and then we'll go to in person So first we've got what quite criteria I used by the technical oversight committee to select the tag chairs Good question. I can certainly answer that so the TOC itself does not choose the tag chairs We approve them and I Can't think of a single instance where we haven't it's the tag chairs are nominated and and selected by the tags themselves and In virtually every case it's they make the decision be based on somebody who's been already Contributing to the tag and has been involved in the tag And it shows the passion for the charter that the tag has and they bring them forward and just as a point of Governance in case there is some kind of conflict That's the really the role that the TOC would play but as Chris said Even when it comes to governance that whole process that by design there's it's a whole bunch of autonomy is built into those So we are the TOC that approve things, but yeah things work pretty well Just like our projects are self-governing the tags are essentially self-governing and kind of go through things and you know There's pros and cons of that approach or some days I regret it But I do think it makes us a little bit stronger and resilient as an organization for that particular flexibility Cool. What about being on the on the TOC has surprised you has most surprised you Do you have a favorite part of your job on the TOC? And by the way, the previous question was from Kathy and This question is from Amy. Amy Amy from Amy Oh our Amy yeah, oh is also by the way Insanely fabulous. We could not do any of what we do without Amy. So Yeah, well, I I can try it. Yeah. Yeah, so I think what surprised me the most is How open it is actually like even even the meetings we have between us Everyone comes from like very different backgrounds and companies and everything but like when we need in the meetings The you don't see it. It's it's really a nice team of people with very different backgrounds and the my favorite thing is really how much I learn because We we cover issues that touch areas that I don't deal with daily or even yearly And I learn a lot and I try to bring this back also to to my colleagues and try to I don't know expand a Bit the knowledge and the usage within Community as well. I bring it back to the end users as well so I think really the The fact that like we have all these tags and we try to cover so many different areas It's it's really a good opportunity like anyone joining the TOC this will definitely be a big plus Yeah, the thing that I'll say is that I think I was quite surprised that every single TOC member is human I had this like perception that like everybody on the TOC was just this like wizard that knew every element of everything there was across the entire cloud native landscape that we showed and no collectively we have pretty good coverage of it, but Not a single individual Understands all of that and so that that I think was a little surprising to me and delightfully surprising Cool, we can now open it up to the floor for a question from the audience So, oh, that's a that's quite a lot of hands, so I'll just I'll pass it over to you first Hi, thank you When I joined the mailing news I was kind of beginning overwhelmed by all the voting and and bees and bees like how do you keep track of those? I mean, I had to look up what they mean that because I was a plus one be plus one and be there you can Yeah, culturally we so that the answer is Amy, but we have staff that you know Essentially facilitates all kind of the process stuff We're all about, you know public voting and public responses You know, there's been times where I would say by the time something gets to a vote There's a lot of consensus built, but we do allow community members to essentially also vote But to see members or the ones that have binding You know votes at the end they now that I think about it is from an external perspective If you just join that list and you're seeing like plus one and bees fly by or you know Like maybe we need to kind of document that and make that a little bit more Transparent of what these things mean because that's kind of this this language that we've kind of codified You know on our own obviously inspired from the Apache Foundation and so on You know how they vote and I would encourage everybody to if you're interested in a topic and you want to cast a vote Please do Because we as that's something that we actually depend on as a technical oversight committee Is that is one of the ways that we get the pulse of what you all what the community as a whole because By the time it goes to vote we've we've had we we've had discussion internally within the TOC publicly We the the tags have done some due diligence the projects have done some due diligence There has been a an open call for comments on the incubation proposal for example So that's one ability one way for the the broader community to have input But then when it comes to that final vote We all I'm sure you do as well. We that's that's definitely a bit of a pulse Yeah, not only like even the number of votes you see there it kind of shows momentum Next question. Well, there's lots of I'll go to here So The landscape of course gets a lot of jokes and laughs, but I actually like it a lot and thank you. Yeah But when I look at it though, it's it's really just trying to define the projects around the operating system if you may right so sort of centralized So my question to you is have you ever looked at in the on the outside of this? So for instance one obvious one would be the verticals So different verticals like banking retail You know energy that about right. They're all using this thing So essentially trying to invite Projects from those verticals and then the other part which would be closer to I'm sure what you're doing and what I did in the past More like researchy stuff So that would get into your security, but specifically for instance crypto, right? Defining a cube coin or some kind of a crypto A project that people inside the landscape in the middle could start experimenting with and that could help with the future stuff The the way the kind of Linux foundation works is generally it is a foundation of foundations, right? So CNCF is one we have our own like little landscape, you know I don't know if many people know about this, but there's a website called Landscapes.dev right if you go there we actually have a lot of different other landscapes for different organizations So like the graph QL foundation has a landscape hyper ledger has a landscape finos Which is the fintech open source foundation of Lindsay has a landscape LFA I foundation has a lot of different landscapes There's actually ones that have been built by External folks that want to do this So if there was another community out there that wanted to go take advantage of the technology and so on that we built They could go build their their own landscape. I mean that whole project really came Out of you know the late day and con and I just tracking all this crap and spreadsheets and kind of got sick of it Making a joke one day like what happens if we open source doesn't make the community do it for us And it kind of worked out at the end of the at the end of the day But the code is all open source and available for anyone to take and take and play with A few more minutes Maybe also for the navigation of the landscape There are some efforts to try to guide and users through it this cartographer's Working group and this is some this there are efforts to try to help out Navigating Question We're actually we're actually a time right now. Okay. Can we take Executive decision we're gonna make time Okay, thank you for taking my question and We can still make the event. So I'm you and yeah from Apple. So my question was yeah I am a Kubernetes contributor and the mainly in the six scheduling six Scatability as we are now developing more advanced features It often require and collaboration coordination across the sea or different working groups Even sometimes like we all have some batch support for example sparking Kubernetes did talk to the spark community So I just wondering how do the seek the TLC and the working with the C group or working group Even cross the community can really coordinate and help the collaboration and across the different and yeah Interest group or group community collaboration because I think that's probably is very important I think it's it's like I think the the TLC going from like let's call it like a top-down perspective We're trying to force that time to force that collaboration It's hard generally it germinates from like a bottoms-up thing and like a concrete example I could give you is you know We have a project now called open telemetry right and in early days there was before the open telemetry days There was open census there is open tracing which person is there and there was just an incredible amount of like confusion and conflict And I think one day Brian Cantrell who is a you know older to a C member just got you know like live it and you know pissed about this thing And people were approaching us. Can you help us? Can you help bridge these two communities together? We held meetings with to see members kind of bridging and kind of help collaboration and open telemetry was born I think the world is is better for but generally these things kind of happen from enough people showing up and Making your quest of the TOC and they'll kind of got a guide and you know deal with that But it has to come from you know the communities You know themselves will bring people together and do our best to To resolve things, but yeah case by case basis is the best I couldn't So for you, I don't know if anyone else has any comments on Otherwise you want to enforce you and be the time I Just realized we don't have anything next time Okay, well, thank you everyone for coming today and can I get a big round of applause here