Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Technical Initiative Funding Request]: RSTUF Cloud/k8s deployment costs for tests, demo and validations #315

Open
1 task done
kairoaraujo opened this issue Apr 12, 2024 · 36 comments
Assignees
Labels
administration gitvote TI Funding Request Quarterly TI requests for funding. Needs 5 approvals, 7d review.

Comments

@kairoaraujo
Copy link
Contributor

Problem Statement

RSTUF deployment on Cloud/K8s for demos and tests

Who does this affect?

Financial expense of RSTUF author/maintainer

Have there been previous attempts to resolve the problem?

No

Why should it be tackled now and by this TI?

RSTUF is part of the OpenSSF sandbox

Give an idea of what is required to make the funding initiative happen

Currently, RSTUF Author/Maintainer Kairo de Araujo (@kairoaraujo) spends over 1000€ a year supporting a live deployment of RSTUF that servers for tests, demos, and verification of no breaking release updates.
The deployment now lives in https://api.rstuf.kairo.dev
Kairo de Araujo is looking for funding to support it and move to https://rstuf.org (domain also maintained by @kairoaraujo)

What is going to be needed to deliver this funding initiative?

An account or credits to use deploy the RSTUF in a cloud service on Kubernetes

Are there tools or tech that still need to be produced to facilitate the funding initiative?

No

Give a summary of the requirements that contextualize the costs of the funding initiative

The entire cost here is to deploy one or two Kubernetes clusters for RSTUF.

Who is responsible for doing the work of this funding initiative?

Kairo de Araujo (@kairoaraujo)

Who is accountable for doing the work of this funding initiative?

Kairo de Araujo (@kairoaraujo)

If the responsible or accountable parties are no longer available, what is the backup contact or plan?

Martin Vrachev (@MVrachev)

Which technical initiative will this funding initiative be associated with, and will it report to which WG or project?

Securing Software Repositories WG

What license is this funding initiative being used under?

MIT

Code of Conduct

  • I agree to follow the OpenSSF's Code of Conduct

List the major milestones by date and identify the overall timeline within which the technical initiative plans to accomplish their goals. Any payments for services, sponsorships, etc., will require LF Legal and Financial review.

Kairo hopes to have this approved and deploy the cluster as soon as possible, as he pays the costs monthly.

If this is a request for funding to issue a contract, then OpenSSF will issue that contract. Please provide a Statement of Work (SOW) that we may review. Any contracting action will take 4-6 weeks to issue.

N/A

@kairoaraujo kairoaraujo added administration For Review TI Funding Request Quarterly TI requests for funding. Needs 5 approvals, 7d review. labels Apr 12, 2024
@mlieberman85
Copy link
Contributor

I am in favor of this proposal, but be aware that at least for this year there's no interest to run public services so can you also include information on who would have access both from and Admin perspective and who the intended users on those tests might be?

@kairoaraujo
Copy link
Contributor Author

@mlieberman85, RSTUF maintainers are the users.
It is not intended to run a public service. If you see the current API (https://api.rstuf.kairo.dev), it requires API Key authentication.

The intended users are the RSTUF Maintainers, who will run different tests, such as updating the version to verify the consistency of the TUF metadata and releases and running processes such as key rotation, key revocation, etc.

@mlieberman85
Copy link
Contributor

Thanks, that clarifies!

@steiza
Copy link
Member

steiza commented Apr 30, 2024

I am also in favor of this proposal! There are some promising early results on using RSTUF to secure RubyGems and Warehouse (Python) package indexes.

@simi
Copy link

simi commented Apr 30, 2024

I do support this. Current RSTUF infra is really useful for adopters (like RubyGems.org). I'm happy to help as well if needed.

@steiza
Copy link
Member

steiza commented Apr 30, 2024

We discussed this on the TAC call, but it's a good idea to document here as well. Note that this is not a request to fund a long-running service (like the Sigstore Public Good Instance). Rather, this is to fund the RSTUF development instance, while the codebase is developed. The RSTUF instances that will run after development is complete will be the operational responsibility of the package managers (like RubyGems or Warehouse), not the OpenSSF.

@sevansdell
Copy link
Contributor

In support.

@bobcallaway
Copy link
Contributor

SGTM

@SecurityCRob
Copy link
Contributor

I do not see a specific amount being requested nor a time-boundary for the duration of the funding. I see "The entire cost here is to deploy one or two Kubernetes clusters for RSTUF.", but nothing defining what the actual request is.

@sevansdell
Copy link
Contributor

I do not see a specific amount being requested nor a time-boundary for the duration of the funding. I see "The entire cost here is to deploy one or two Kubernetes clusters for RSTUF.", but nothing defining what the actual request is.

Good call. Is there an estimate, or a cap "up to" desired?

@kairoaraujo
Copy link
Contributor Author

Hi @SecurityCRob and @sevansdell.
To make it more specific, I'm requesting 1000 EUR of cloud credit.
It is enough to run the project for one year.

@SecurityCRob
Copy link
Contributor

Perfect, tyvm. The TAC will discuss this in our next call (11June)

@sevansdell
Copy link
Contributor

I am supportive. I will miss the June 11 TAC meeting and am trying to be proactive. :)

@SecurityCRob
Copy link
Contributor

+1 for me

@bobcallaway
Copy link
Contributor

LGTM as well

@lehors
Copy link
Contributor

lehors commented Jun 13, 2024

+1

@lehors
Copy link
Contributor

lehors commented Jun 14, 2024

Per the 11 June 2024 TAC call, this has been approved:
"recording 7 yes votes and 0 no votes and sarah said yes offline** - passes"
https://docs.google.com/document/d/1-zrtagRnPd75TDT1zRxrtxE9SpMIBJdPmaolaw4woQA/edit

@lehors lehors removed the For Review label Jun 14, 2024
@lehors
Copy link
Contributor

lehors commented Jun 14, 2024

This is reflected on the dashboard: https://github.com/orgs/ossf/projects/25

@lehors lehors closed this as completed Jun 14, 2024
@lehors lehors reopened this Jun 14, 2024
@hythloda
Copy link
Member

Thanks for the TAC recommendation.

As documented in the TI Funding Process
For this level of funding the next step is the OpenSSF General Manager, @omkhar, or his delegate will review this proposal.

@omkhar
Copy link
Contributor

omkhar commented Jul 22, 2024

Mea culpa. I approve. @hythloda please move this forward for execution through the proposed funding process.

@hythloda
Copy link
Member

Mea culpa. I approve. @hythloda please move this forward for execution through the proposed funding process.

Thanks @omkhar. The next step is to ensure that the execution can be done. Considering this is cloud credits the hope is that what @bbpursell1 establishes with GUAC cloud credits can be duplicated for these.
@bbpursell1 do we have an execution plan to have the cloud credits a hard cap we can apply to this?

@bbpursell1
Copy link

Yes, we have a proposed process agreed with Kusari and the GUAC team on this. Simply, Kusari volunteered to cover overages by running the cloud account themselves, and submitting requests for re-imbursement for the costs up to the $1k/month limit.

There is an SOW for this in process with finance.

The proposed process is located here: https://docs.google.com/document/d/1N6lNqY7wBs33Afy-D8qMWU5VM5GUetWzgOed-oEG5oU/edit (once we get this through implementation, we will finalize this process document).

@hythloda
Copy link
Member

Yes, we have a proposed process agreed with Kusari and the GUAC team on this. Simply, Kusari volunteered to cover overages by running the cloud account themselves, and submitting requests for re-imbursement for the costs up to the $1k/month limit.

There is an SOW for this in process with finance.

The proposed process is located here: https://docs.google.com/document/d/1N6lNqY7wBs33Afy-D8qMWU5VM5GUetWzgOed-oEG5oU/edit (once we get this through implementation, we will finalize this process document).

Wonderful! I have requested access to the process doc. Let me know if you need any PMO support!

@riaankleinhans
Copy link
Contributor

/vote

Copy link

git-vote bot commented Sep 23, 2024

Vote created

@riaankleinhans has called for a vote on [Technical Initiative Funding Request]: RSTUF Cloud/k8s deployment costs for tests, demo and validations (#315).

The members of the following teams have binding votes:

Team
@ossf/tac

Non-binding votes are also appreciated as a sign of support!

How to vote

You can cast your vote by reacting to this comment. The following reactions are supported:

In favor Against Abstain
👍 👎 👀

Please note that voting for multiple options is not allowed and those votes won't be counted.

The vote will be open for 1month 11days 13h 26m 24s. It will pass if at least 70% of the users with binding votes vote In favor 👍. Once it's closed, results will be published here as a new comment.

@riaankleinhans
Copy link
Contributor

Gitvote was added as a tool to test for stream lining the TI Funding process.
The members of the GH group "TAC" can vote by commenting with an +1. -1 or eye on the Gitvote block in this issue.
Until the TAC is satisfied with the process the GitVote outcome would not be binding.

Community members can show their support by also voting, however only the "TAC" GH Group's votes will count.

The current passing threshold is 70% and the committee is the TAG GH group.
The vote say open fo 6 week and an announcement is sent on the GH/TAC/Discussion

All these parameters can by fine tuned or changed here
Please reach out if you have any questions.

@marcelamelara
Copy link
Contributor

This was already approved in a previous cycle. Should we close this issue?

@kairoaraujo
Copy link
Contributor Author

I would like to know how I can work with the funding.
I'm planning some tests/benchmarks with RSTUF for deployment before adding it to the RubyGems/PyPI backend.

@riaankleinhans riaankleinhans self-assigned this Sep 25, 2024
Copy link

git-vote bot commented Sep 30, 2024

Vote status

So far 0.00% of the users with binding vote are in favor (passing threshold: 70%).

Summary

In favor Against Abstain Not voted
0 0 0 9

Binding votes (0)

User Vote Timestamp
@steiza Pending
@torgo Pending
@mlieberman85 Pending
@bobcallaway Pending
@lehors Pending
@SecurityCRob Pending
@marcelamelara Pending
@camaleon2016 Pending
@sevansdell Pending

Copy link

git-vote bot commented Oct 7, 2024

Vote status

So far 0.00% of the users with binding vote are in favor (passing threshold: 70%).

Summary

In favor Against Abstain Not voted
0 0 0 9

Binding votes (0)

User Vote Timestamp
@steiza Pending
@torgo Pending
@mlieberman85 Pending
@bobcallaway Pending
@lehors Pending
@SecurityCRob Pending
@marcelamelara Pending
@camaleon2016 Pending
@sevansdell Pending

Non-binding votes (1)

User Vote Timestamp
simi In favor 2024-09-30 17:21:38.0 +00:00:00

@lehors
Copy link
Contributor

lehors commented Oct 7, 2024

/cancel-vote

Copy link

git-vote bot commented Oct 7, 2024

Vote cancelled

@lehors has cancelled the vote in progress in this issue.

@git-vote git-vote bot removed the vote open label Oct 7, 2024
@sevansdell
Copy link
Contributor

@afmarcum - what are next steps to getting this funding to the TI please? We also need to close this issue out based on a status update from you. Thanks!

@afmarcum
Copy link
Contributor

@sevansdell As discussed in yesterday's TAC meeting, @riaankleinhans the lead for TI funding and working directly with individual TIs on next steps.

@riaankleinhans can you provide an update on this initiative specifically?

@riaankleinhans
Copy link
Contributor

@sevansdell I am in discussion with @kairoaraujo , share all the steps for claiming expenses for the last 12 month / 1000 EUR as per the request.
As soon as I receive the claim I will arrange for it to be processed.

I will also look into cloud credits from CSPs to cover cost like this in the future.

@kairoaraujo can we close this issue?

@sevansdell
Copy link
Contributor

@kairoaraujo update please?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
administration gitvote TI Funding Request Quarterly TI requests for funding. Needs 5 approvals, 7d review.
Projects
Status: Funding in Execution
Development

No branches or pull requests