13.2 Cloud Native Community, Collaboration & Contribution
Key Takeaways
- Kubernetes development is organised into Special Interest Groups (SIGs) with defined scopes, plus cross-cutting Working Groups and per-SIG subprojects.
- CNCF-wide technical guidance comes from Technical Advisory Groups (TAGs) that advise the Technical Oversight Committee across projects.
- The Kubernetes contributor ladder runs from contributor to member, then reviewer, then approver, with OWNERS files recording who holds each role for a directory.
- Every CNCF project operates under the Linux Foundation Code of Conduct and requires a Developer Certificate of Origin sign-off on commits.
- KubeCon + CloudNativeCon is the flagship event, and mentorship programmes such as LFX Mentorship and Google Summer of Code are the standard on-ramps for new contributors.
13.2 Cloud Native Community, Collaboration & Contribution
Quick Answer: The official curriculum names Cloud Native Community and Collaboration as a competency in its own right. Kubernetes development is organised into SIGs (Special Interest Groups) with clear ownership, plus cross-cutting Working Groups. CNCF-wide technical guidance comes from TAGs (Technical Advisory Groups) advising the TOC. Contributors advance a defined ladder — contributor → member → reviewer → approver — recorded in
OWNERSfiles. Participation is governed by the Linux Foundation Code of Conduct and the Developer Certificate of Origin.
Section 13.1 covered the CNCF's institutional structure: TOC, Governing Board, and the project maturity lifecycle. This section covers how humans actually work inside it — which is what the competency is asking about.
1. Special Interest Groups
Kubernetes is far too large for one group of maintainers, so the project is divided into SIGs, each with a defined scope, its own chairs and technical leads, a public meeting on a fixed schedule, a Slack channel, a mailing list, and a charter.
| SIG | Scope |
|---|---|
| SIG Architecture | Cross-cutting design integrity and API conventions |
| SIG API Machinery | The API server, CRDs, admission, and client libraries |
| SIG Network | Services, Ingress, the Gateway API, DNS, and network policy |
| SIG Storage | Volumes, CSI, and storage capacity |
| SIG Node | kubelet, container runtimes, and node lifecycle |
| SIG Scheduling | kube-scheduler, priority, preemption, and descheduling |
| SIG Auth | Authentication, authorization, RBAC, and policy |
| SIG Security | Security posture, audits, and vulnerability response |
| SIG Release | Release cadence, branch management, and the release team |
| SIG Docs | Documentation and kubernetes.io |
| SIG Contributor Experience | Onboarding, community health, and contributor tooling |
| SIG Testing | CI infrastructure, test frameworks, and flake reduction |
Smaller units sit inside this structure:
- Subprojects — a specific deliverable owned by a SIG (
kubeadmunder SIG Cluster Lifecycle,kubectlunder SIG CLI). - Working Groups — time-bounded, cross-SIG efforts on a single topic. A WG has no code ownership, does not own APIs, and dissolves when its goal is met — the crisp exam distinction from a permanent SIG.
- User Groups — communities of practice organised around a use case rather than a component.
All of this is public. Meeting agendas, recordings, and notes are published, and anyone may attend. There is no private channel where the real decisions get made — that transparency is a deliberate governance property.
2. Technical Advisory Groups
SIGs belong to Kubernetes. TAGs belong to the CNCF and reason across projects on behalf of the TOC: TAG Security and Compliance, TAG Network, TAG Storage, TAG App Delivery, TAG Observability, TAG Runtime, TAG Contributor Strategy, and others. TAGs publish whitepapers (the widely cited Cloud Native Security Whitepaper is a TAG Security output), run project due diligence for maturity-level applications, and produce landscape guidance.
| SIG | TAG | |
|---|---|---|
| Belongs to | The Kubernetes project | The CNCF |
| Scope | One component or function of Kubernetes | A technical domain across all CNCF projects |
| Owns code? | Yes | No |
| Reports to | Kubernetes Steering Committee | The TOC |
3. The Contributor Ladder
Kubernetes defines an explicit progression, and the roles are recorded in machine-readable OWNERS files in each directory:
# OWNERS
approvers:
- alice # may /approve — final sign-off on merges here
- bob
reviewers:
- carol # may /lgtm — technical review
- dave
labels:
- sig/network
| Role | How you get there | What it lets you do |
|---|---|---|
| Contributor | Open a PR or an issue | Anyone, immediately |
| Member | Multiple merged contributions plus two sponsors from existing members | Org membership; CI runs automatically on your PRs; you can be assigned issues |
| Reviewer | Sustained quality review in a subproject; nominated by approvers | Listed in OWNERS; can apply /lgtm |
| Approver | Deep, sustained ownership; nominated by existing approvers | Can apply /approve, which is what actually merges |
| Subproject owner / SIG chair or lead | Elected or appointed | Sets direction, runs meetings, resolves disputes |
Merging requires both /lgtm (from a reviewer) and /approve (from an approver in the relevant OWNERS file), and the Prow bot enforces it. The design intent is that authority is earned and localised: you become an approver for the directory you have demonstrably maintained, not for the project as a whole.
Above all of it sits the Kubernetes Steering Committee, elected by the contributor community, which handles project-wide governance rather than technical direction.
4. Rules of Participation
| Rule | What it means |
|---|---|
| Code of Conduct | Every CNCF project adopts the Linux Foundation Code of Conduct. Violations are handled by a dedicated committee, and enforcement is real. |
| Developer Certificate of Origin (DCO) | Every commit carries Signed-off-by: (add it with git commit -s), certifying you have the right to submit that code under the project's licence. A bot blocks PRs without it. |
| Contributor License Agreement (CLA) | Some projects use a formal CLA instead of, or in addition to, the DCO. |
| Licensing | CNCF projects use OSI-approved licences; Kubernetes itself is Apache 2.0. |
| Public by default | Design discussion happens in KEPs, issues, and recorded meetings — not in private. |
Kubernetes Enhancement Proposals
A substantial change to Kubernetes goes through a KEP: a structured document covering motivation, design, alternatives considered, test plan, and graduation criteria from alpha to beta to GA. Owning SIGs review and approve KEPs, and each release's feature set is essentially the set of KEPs that met their criteria in time. This is the process behind the API maturity levels in section 2.4.
5. Events and On-Ramps
| Programme | What it is |
|---|---|
| KubeCon + CloudNativeCon | The CNCF flagship conference, held in North America, Europe, and Asia, with co-located events including ArgoCon, IstioCon, and Cloud Native Security Con |
| Kubernetes Community Days / Cloud Native Days | Community-run regional events |
| Kubernetes Contributor Summit | Co-located with KubeCon; onboarding and SIG working sessions for contributors |
| LFX Mentorship | Paid, structured mentorship terms on CNCF projects |
| Google Summer of Code / Outreachy | Additional funded pathways into open source contribution |
| CNCF Ambassadors | Recognised community advocates who run meetups, write, and speak |
good first issue / help wanted | Standard labels used across CNCF repositories to mark issues suitable for newcomers |
6. Contribution Is Not Only Code
A point the community makes repeatedly, and one KCNA is happy to test: valuable contribution includes documentation, translation (kubernetes.io is localised into many languages), triaging and reproducing issues, reviewing pull requests, improving test coverage and reducing flakes, answering questions in Slack and on forums, running a local meetup, speaking, publishing adoption case studies, and reporting security vulnerabilities responsibly through a project's disclosure process.
SIG Docs and SIG Contributor Experience exist precisely because the project treats these as first-class work.
7. Where to Find Things
| Need | Where |
|---|---|
| SIG list, charters, meeting times | kubernetes/community on GitHub |
| The contributor ladder and onboarding | The Kubernetes Contributor Guide |
| CNCF project maturity and TOC process | cncf/toc on GitHub |
| Real-time discussion | Kubernetes Slack and CNCF Slack |
| Ecosystem map | landscape.cncf.io |
| Certification and training | The Linux Foundation training portal |
What distinguishes a Kubernetes Working Group from a Special Interest Group?
In the Kubernetes contributor ladder, what does an approver do that a reviewer cannot?
What does the Developer Certificate of Origin require of a contributor to a CNCF project?
You've completed this section
Continue exploring other exams