Add Artifact Hub incubation proposal

[tegioz]

Hi! 👋

This is a proposal to consider Artifact Hub as a CNCF incubation project.

Please let us know if there is anything missing and we'll gladly provide more details.

Thanks!

Signed-off-by: Sergio Castaño Arteaga [email protected]

[scottrigby]

+1 nb. I've seen incredible success with the artifact of project since its inception. The maintainers are dedicated, focused, and I believe have fulfilled Dan's vision for AH before he passed, and even more than that. Also, with the expanding relevance of OCI artifacts as storage for all of these project configuration formats, Artifact Hub also seems well positioned to serve a much bigger role for the cloud native community. Great work team 💯

[dmueller2001]

-1 nb There are still only the same 3 initial maintainers from the prior sandbox proposal , two of whom are employed by CNCF. This is less of an Cloud Native Open Source project and more of an infrastructure effort supporting the CNCF ecosystem (a very worthy cause). Is there a list (if any) of any other deployments of artifacthub's codebase by any other foundations or technology initiatives or enterprises available? Although the CNCF deployment of the codebase as ArtifactHub.io has a healthy growth of new participants and users, it is still a website and is still substantially a single vendor maintained initiative. It may just be semantics, but this for me doesn't meet the minimal requirements for incubation of a cloud native open source project set out by CNCF. While the maintainers have indeed done a great job, and CNCF has done alot to market and grow engagement with the site - it is not Cloud Native technology any more than the CNCF's website/portal itself.

[rochaporto]

As a counter-argument i would say artifacthub is part of the infrastructure and the cloud native stack for many end users, even if not deployed locally. Using CERN as an example we rely on artifacthub for a very large number of replication rules for our local Harbor instance, using the central artifacthub as the main source to discover and replicate upstream helm charts and container images.

It's not the typical project where people maintain their own instances, which makes it hard to match the usual criteria. But it's part of our stack and an important piece of our production infrastructure. The description in this submission focuses mostly on the number of organizations publishing to artifacthub, but there are many more relying on it as consumers and that should be taken into account.

[tegioz]

Hi @dmueller2001 👋

Is there a list (if any) of any other deployments of artifacthub's codebase by any other foundations or technology initiatives or enterprises available?

Unfortunately we don't have a list yet, as it hasn't been easy to have them list themselves as adopters 😅 But every now and then, users running their own AH instance in their organizations stop by the Slack channel to ask some questions, or request new features.

Although it's not a very scientific way of measuring adoption, the Artifact Hub Helm chart on artifacthub.io receives quite a few visits every day (screenshot attached below). And that chart is only relevant to deploy your own AH instance. In addition to that, as of today, 17 users are subscribed to receive notifications for new releases for that chart, and there are 5 webhooks attached to receive notifications as well. As a reference to compare, the Consul Helm chart shows similar numbers both in terms of visits and subscriptions.

it is not Cloud Native technology any more than the CNCF's website/portal itself

Maybe we are not doing a good job describing what it can do for organizations, and that could help 🙂

"Artifact Hub provides a centralized Cloud Native artifacts catalog for your organization. It is able to index and process 20 different artifacts kinds (and growing!), including Helm charts and OLM operators, providing a unified interface to share, discover and easily inspect all sorts of Kubernetes packages available across the organization."

We were hoping that a catalog for Cloud Native artifacts would be Cloud Native technology 😇 And we think it can bring a lot of value to organizations (unlike deploying their own copy of the CNCF's website), as many of the problems that artifacthub.io solves for users consuming the public content available, also need to be solved for private content in other organizations, specially large ones.

[mattfarina]

@dmueller2001 Thank you for bringing up these concerns. To be transparent, I've wondered about some of the same things. While trying to answer some of my own questions I learned some things.

Is there a list (if any) of any other deployments of artifacthub's codebase by any other foundations or technology initiatives or enterprises available?

I am aware of others but they have been in a non-production capacity. But, this is where Artifact Hub shows up a little differently from most other projects in the CNCF. Instead of each type of thing being listed in their own Hub, Artifact Hub lists many different types of artifacts.

This tracked to work that was done last year on who adopters are. This was refined by the TOC. You can see it here. The TOC recently (this calendar quarter) had a conversation on the adopters and how it applied to Artifact Hub. As one of those 3 people on Artifact Hub, I wanted to know if Artifact Hub fit the current Adopter definition without giving an opinion myself. The TOC ultimately said that Artifact Hub fits the current Adopter definition and that will be explained in the Due Diligence.

This is less of an Cloud Native Open Source project and more of an infrastructure effort supporting the CNCF ecosystem (a very worthy cause).

I have spent a significant amount of time on this topic alone. We put it to the staff and TOC to tell us if this is a project or something like DevStats. We've been directed that we should continue it as a project.

If you have a case for something different, I would suggest reading over the definition of adopters and making a case to the TOC. Due to conflict of interest because of my association with Artifact Hub, I am letting others handle the aspects of this.

Although the CNCF deployment of the codebase as ArtifactHub.io has a healthy growth of new participants and users, it is still a website and is still substantially a single vendor maintained initiative.

Multi-vendor is not a requirement until graduation. Many incubating projects have been single vendor. So, whether Artifact Hub is single vendor or multi-vendor doesn't impact the evaluation at this phase per the current criteria.

it is not Cloud Native technology any more than the CNCF's website/portal itself.

This is an interesting angle that I have not really thought about until reading your comment. So, please forgive me if my response is not fully formed.

What makes something cloud native technology? What parts of the "cloud native" stack should be in the CNCF? Is Helm, a package manager cloud native? It's a CLI and SDK that interact with Kubernetes and other APIs to install/upgrade/look at/delete apps in Kubernetes. But, it's not built in some special cloud native way. Yet, it's a package manager for a cloud native stack. Is in-toto cloud native? Could I use it with a more traditional setup? Sure.

The CNCFs mission reads:

The Foundation’s mission is to make cloud native computing ubiquitous.

Artifact Hub lists cloud native artifacts making things that are distributed easily discoverable. It provides a website and API service that applications can use (e.g., The Helm CLI makes calls to it for searching). It's packaged up and operated in a cloud native manner using other projects in the CNCF. It's built and run as a cloud native app in a similar manner to something like Harbor.

If it's not cloud native technology, I would like to know the definition being used to evaluate it. The definitions I'm used to working with would accept it.

I hope this adds some clarity as to why the incubation route is being pursued.

[dmueller2001]

Thanks for the feedback, doesn't change my -1 NB vote or opinion. Having worked with other hubs and packaging initiatives over the years, a strong community of maintainers and contributors is key to their stability and maturity. As an example, https://github.com/pypi/warehouse/graphs/contributors has a long history of community engagement in the development of the infrastructure that supports PyPi.

I concur with at @rochaporto's statement that many enterprises are using Artifacthub.io as the main source to discover and replicate upstream helm charts, container images, There is a clear dependency on the hosted codebase as ArtifactHub.io as a resource that should be well maintained and managed infrastructure.

There is little external or community resources working on the codebase at this time, and a large number of dependent consumers of the service. As such, I'd rather see this initiative considered critical infrastructure and have the CNCF/LF continue to fund and manage it as such.

[dzolotusky]

I want to be clear that I agree with most of these questions being the heart of the debate with Artifact Hub, and as its sponsor have gone back and forth a few times on my view of exactly how to classify Artifact Hub. I've also seen two different TOCs make two very different decisions on that question. So, I don't think that there's a clear or obvious answer here.

There is little external or community resources working on the codebase at this time, and a large number of dependent consumers of the service. As such, I'd rather see this initiative considered critical infrastructure and have the CNCF/LF continue to fund and manage it as such.

One thing that I've been struggling a bit with if why we can't have both "this initiative considered critical infrastructure and have the CNCF/LF continue to fund and manage it as such" and this being an incubating project. Today we have this sort of arrangement with Artifact Hub as a sandbox project, so why does moving to incubation threaten the CNCF/LF funding or management?

[dmueller2001]

@dzolotusky As far as I have heard, there is no 'threat' to the continued funding of the CNCF-funded developers on and managing the deployment of ArtifactHub.io. Additional investment would always be welcome to insure service levels and uptime to continue to serve the consumers of this service.

Incubation status recognizes certain maturity levels of community contribution & engagement in the development and maintainance of project's code base as well as adoption & deployment of the codebase of a project by other organizations.

As artifacthub "the project" has not achieved these required levels of maturity for incubation (yet). It should not be granted to until those levels are reached. If we continue to insist on treating artifacthub as a CNCF project - it clearly has not achieved those levels of community engagement and remains a single vendor funded initiative with little external contribution growth.

It is unfair to elevate it to incubation status when the TOC continues to require other CNCF sandbox projects to meet these requirements. This said, I do agree with the requirements currently set out for incubation status by the TOC for incubation status and would personally have a high bar on some of the requirements.

[dzolotusky]

Thanks for the clarification, @dmueller2001

As artifacthub "the project" has not achieved these required levels of maturity for incubation (yet). It should not be granted to until those levels are reached.

The most recent decision of the TOC has been to allow the Artifact Hub DD process to continue. I believe that we should allow the DD process to play out and only based on that DD can we decide whether or not Artifact Hub has achieved the maturity required of the Incubation level.

[TheFoxAtWork]

@dzolotusky is there a status update for this?

[dzolotusky]

@dzolotusky is there a status update for this?

I'm currently waiting for the last adopter that I interviewed to approve my notes and then we should be ready for public comment.

[TheFoxAtWork]

Fabulous - i've moved this to the "adopter interview" area of the board. Be sure to start the thread in the TOC channel for internal review with any additional notes/comments gotchas so we can discuss/resolve (if needed) before opening public comment.

[TheFoxAtWork]

@dzolotusky tomorrow this can move to public comment

[TheFoxAtWork]

Public Comment is out: https://lists.cncf.io/g/cncf-toc/message/8623. Closing on THURSDAY. MAY 16th 2024

[dzolotusky]

It's now been 2 weeks. Let's move this to a vote.

[dzolotusky]

/vote

[git-vote[bot]]

Vote created

@dzolotusky has called for a vote on Add Artifact Hub incubation proposal (#728).

The members of the following teams have binding votes:

Team
@cncf/cncf-toc

Non-binding votes are also appreciated as a sign of support!

How to vote

You can cast your vote by reacting to this comment. The following reactions are supported:

In favor	Against	Abstain
👍	👎	👀

Please note that voting for multiple options is not allowed and those votes won't be counted.

The vote will be open for 5months 29days 19h 12m. It will pass if at least 66% of the users with binding votes vote In favor 👍. Once it's closed, results will be published here as a new comment.