Maintainer Summit

When Crossplane graduated within the CNCF late last year, and Kyverno followed shortly after, the votes marked the culmination of years of work to mature each project and meet the expectations of the TOC. While both projects ultimately reached the same milestone, their journeys looked quite different. In this session, maintainers from Crossplane and Kyverno walk through what it really took to get there.

Crossplane’s first graduation application wasn't quite ready: the TOC raised concerns about vendor neutrality, long-term survivability, and the health of our extension ecosystem. We'll share how the project put this feedback into action by launching a vendor-neutral community registry, migrating release infrastructure to CNCF-owned accounts, and instituting new governance and lifecycle policies for our ecosystem.

Kyverno's first graduation push wasn’t ready either, however their path presented a different set of challenges. We'll discuss how the project addressed questions around maintainer diversity and long-term project sustainability, strengthened the contributor community across organizations, worked through technical, governance, and security due diligence, and partnered closely with the TOC throughout the process.

Together, these experiences highlight that graduation is not about following a single checklist. It's about demonstrating that a project has the technical maturity, governance, and community needed to thrive for years to come.

We'll also cover the follow-up commitments both projects made to the TOC after graduation, because the work of maturing a project never really ends.

Wherever your project sits on the maturity curve, come hear what we went through, the lessons we learned, and how you can make the CNCF maturity process work for your project and community.

Congratulations: you're officially an open source maintainer! But once the excitement fades, reality hits. You aren’t just writing code anymore; you’re triaging issues, managing community expectations, and protecting project stability. It’s an entirely different job.

This talk is a survival guide for making the leap from "PR author" to "project steward" without losing your mind along the way.

You'll learn how to navigate the psychological leap from writing code to reviewing, steering, and mentoring, how to graciously reject out-of-scope features while keeping contributors engaged, and practical tactics to protect your limited time.

Whether you just got maintainer rights or are aiming for them, you'll leave with actionable strategies to sustain your project and your sanity.

Envoy sits in the request path of much of the internet. A bug that slips through review can become a CVE with a coordinated disclosure, an embargo, and patch releases across supported versions. That math changed when AI-generated pull requests arrived. They look polished, they compile, they pass CI, and they are wrong in ways human contributions rarely are.

This talk shares the review playbook Envoy maintainers built in response. We cover the failure patterns we see in AI-written changes, how we adjusted reviewer expectations without banning AI outright, the signals that separate a careful contributor using AI from drive-by slop, and how our security team treats these changes in sensitive code paths like parsers and filters.

Attendees leave with a review checklist, contributor policy language they can copy, and real numbers on what this costs maintainer time. Every lesson applies to any project where a bad merge has consequences beyond a revert.

After 10 years of Kubernetes, maintainers across the ecosystem still independently answer the same question: is this resource healthy? Every CRD defines status, conditions, and readiness differently, so every tool – Argo CD, Flux, kubectl plugins, dashboards, CI/CD systems – ends up reimplementing health interpretation for the same resources, causing duplicated work, inconsistent behavior, and operational drift.

This session is a working discussion. Together, we'll explore what a shared specification for CRD health and readiness could look like, building on efforts such as kstatus. We'll discuss how conformance should be achieved: through a shared library, independent implementations against a common specification and conformance suite, or another approach. The goal is to reach consensus on whether this is worth pursuing formally, for example through a CNCF Sandbox project or working group, and who's willing to help drive it.

TAGs are where cross-project initiatives, shared practices, and maturity guidance get built, and that work is a collaboration with maintainers rather than something separate from them.
This panel brings one representative from each of the five TAGs onto one stage to show what each group is working on right now and, concretely, how a maintainer plugs in. This session treats the relationship as a two-way street: how maintainers join initiatives that shape industry-wide practices in their domain, how TAG output such as guidance, assessments, landscape analyses, and best practices helps a project mature as it moves from sandbox to incubating to graduated, and how a problem that several projects share can become a new initiative. Instead of five status updates, we want to share five real collaboration paths.
Attendees leave knowing which initiatives are relevant to their project, how to join or start one, and how TAG expertise feeds the project journey across maturity levels.

The AI boom created a distinct operational challenge for open source security. Instead of uncovering hidden zero day exploits, automated scanners frequently flood maintainers with perfectly formatted, technically accurate reports that completely ignore the project threat model.

This talk provides a realistic look at how the Kubernetes Security Response Committee (SRC) handles the modern vulnerability gold rush. We will explore the heavy triage tax caused by AI submissions and how we counter it using radical pragmatism. Attendees will learn how we partner with HackerOne to enforce strict threat model rubrics, managing waves of duplicate reports without burning out maintainers. We will also detail our internal OPSEC practices, specifically why the SRC relies on simple, local, air gapped LLMs to safely process embargoed vulnerability data.

CNCF has a well-established model for source-code stewardship. But once a release is cut, many projects hand critical parts of their relationship with users to infrastructure they do not control.

Images, charts, and other artifacts are published through a patchwork of vendor-operated registries. Once registry addresses appear in manifests, policies, mirrors, and downstream products, changing them becomes an ecosystem-wide operation.

This talk examines distribution as an overlooked part of open source governance. The distribution channel defines an artifact’s canonical identity, availability, retention, and trust metadata. It also determines whether a project can change providers without disrupting users.

Drawing on our experience as Harbor maintainers, we will give maintainers a framework for deciding which parts of the distribution path must remain under project or foundation control, which can be delegated, and where CNCF may need a shared strategy.

AI coding agents are changing how software gets built — but what does that mean for open source maintainers? This talk shares practical lessons from integrating agentic AI into real CNCF project workflows: due diligence evaluation, project health monitoring, adopter interviews, and governance reviews.

We'll cover three things every maintainer needs to understand: skills (structured, composable units of agent work), evals (how you know an agent's output is correct before it ships), and observability (how you monitor agent behavior the same way you monitor your services).

Maintainers are already dealing with AI-generated PRs, bot-authored commits, and agent-driven reviews. We'll share patterns for integrating agents into your own project workflows: CI/CD, issue triage, release management, documentation, and the eval and observability infrastructure that makes them trustworthy rather than risky.

Concrete examples from both TOC governance workflows and CNCF project adoption patterns.

CNCF project reviews are essential for helping open source projects improve quality, sustainability, security, and overall maturity. Yet many community members are interested in contributing to these reviews and do not know where to start.

In this interactive session, we will explore the CNCF project review assets and discuss how contributors can participate in evaluating and strengthening projects across the cloud native ecosystem. We will cover Governance Reviews, Technical Reviews, General Technical Reviews, and Security Reviews, explaining their purpose, structure, and role in supporting projects through Sandbox, Incubation, and Graduation.

The session will also gather community feedback on existing documentation and processes, identify opportunities for improvement, and discuss how to make participation more accessible for reviewers and maintainers. Attendees will gain practical insights into one of the key mechanisms that supports CNCF project maturity and ecosystem health.

Kubernetes is the second largest open source project in the world, and its future is driven by an elected committee of seven people serving two-year terms. Especially in a project of our size, it’s important to work publicly and in the open, so join us for an open-format interactive session with representatives of the Kubernetes Steering Committee. Bring your questions about project governance, the future of Kubernetes, how you can get involved (or more involved!), or anything else you can think of that we might be able to help you with. A form will be provided to ask questions anonymously.

Get your questions answered live by representatives from the Technical Oversight Committee in this open-format session. Come prepared for an engaging and interactive discussion!

Got an idea for a session? Submit your topic or upvote existing ones that catch your eye. The Summit co-chairs and CNCF Projects Team will make decisions about which sessions to add to the schedule midday during the Summit, based on community votes.

Topic submission and voting details will be shared closer to the event.

SIG-Network Gateway API subproject meeting

Join us to discuss the future of Gateway API, next needs, what is going on, how you can help.

The Karmada maintainers and contributors will gather for a focused project meeting to discuss upcoming features, roadmap priorities, and community collaboration initiatives.

Meeting Agenda:

• Release Planning: Discuss the next major release timeline, feature priorities, and breaking changes
• Architecture Discussions: Review proposed enhancements to multi-cluster scheduling and workload distribution
• Community Growth: Strategies for expanding contributor base and improving documentation
• Technical Challenges: Address current issues in cluster federation and resource propagation
• Cross-Project Collaboration: Explore integration opportunities with other CNCF projects

This face-to-face meeting provides a valuable opportunity for the Karmada community to align on technical direction, resolve blockers, and strengthen collaboration among distributed team members.

Got an idea for a session? Submit your topic or upvote existing ones that catch your eye. The Summit co-chairs and CNCF Projects Team will make decisions about which sessions to add to the schedule midday during the Summit, based on community votes.

Topic submission and voting details will be shared closer to the event.

Got an idea for a session? Submit your topic or upvote existing ones that catch your eye. The Summit co-chairs and CNCF Projects Team will make decisions about which sessions to add to the schedule midday during the Summit, based on community votes.

Topic submission and voting details will be shared closer to the event.

Got an idea for a session? Submit your topic or upvote existing ones that catch your eye. The Summit co-chairs and CNCF Projects Team will make decisions about which sessions to add to the schedule midday during the Summit, based on community votes.

Topic submission and voting details will be shared closer to the event.

Live SIG-etcd community meeting, at which we will work on etcd 3.8 planning and deliverables, as well as subprojects like benchmarking.

Got an idea for a session? Submit your topic or upvote existing ones that catch your eye. The Summit co-chairs and CNCF Projects Team will make decisions about which sessions to add to the schedule midday during the Summit, based on community votes.

Topic submission and voting details will be shared closer to the event.

Got an idea for a session? Submit your topic or upvote existing ones that catch your eye. The Summit co-chairs and CNCF Projects Team will make decisions about which sessions to add to the schedule midday during the Summit, based on community votes.

Topic submission and voting details will be shared closer to the event.

Got an idea for a session? Submit your topic or upvote existing ones that catch your eye. The Summit co-chairs and CNCF Projects Team will make decisions about which sessions to add to the schedule midday during the Summit, based on community votes.

Topic submission and voting details will be shared closer to the event.

This meeting is for OpenTelemetry Maintainers and the Governance and Technical Committees to attend, plan, and discuss OpenTelemetry initiatives, roadmap and community growth.

Got an idea for a session? Submit your topic or upvote existing ones that catch your eye. The Summit co-chairs and CNCF Projects Team will make decisions about which sessions to add to the schedule midday during the Summit, based on community votes.

Topic submission and voting details will be shared closer to the event.

Got an idea for a session? Submit your topic or upvote existing ones that catch your eye. The Summit co-chairs and CNCF Projects Team will make decisions about which sessions to add to the schedule midday during the Summit, based on community votes.

Topic submission and voting details will be shared closer to the event.

Got an idea for a session? Submit your topic or upvote existing ones that catch your eye. The Summit co-chairs and CNCF Projects Team will make decisions about which sessions to add to the schedule midday during the Summit, based on community votes.

Topic submission and voting details will be shared closer to the event.

KubeVirt Project Meetiing