13.1 The CNCF Landscape, Governance & Project Lifecycle
Key Takeaways
- The Cloud Native Computing Foundation (CNCF) was formed under the Linux Foundation in 2015 to promote vendor-neutral open-source cloud-native software ecosystems.
- The CNCF Landscape organizes cloud-native projects into structured categories including Provisioning, Runtime, Orchestration & Management, App Definition & Development, Observability & Analysis, and Serverless/Security.
- CNCF projects progress through three official maturity stages—Sandbox, Incubating, and Graduated—based on criteria like adoption depth, community diversity, open governance, and security audits.
- Flagship Graduated projects include Kubernetes (orchestration), Prometheus (monitoring), Envoy (service proxy), Helm (package management), containerd (runtime), CoreDNS (DNS discovery), and Jaeger (tracing).
- CNCF governance operates through a dual structure: the Technical Oversight Committee (TOC) directs technical vision and project lifecycle transitions, while the Governing Board oversees business and vendor-neutral budget management.
13.1 The CNCF Landscape, Governance & Project Lifecycle
Quick Answer: The Cloud Native Computing Foundation (CNCF) hosts open-source projects critical to cloud-native infrastructure. Projects progress through three maturity tiers: Sandbox (experimental/entry level), Incubating (production-proven with active adoption), and Graduated (gold standard, highly mature, strict governance and security audits). The CNCF Interactive Landscape categorizes hundreds of tools across App Definition, Runtime, Orchestration, Observability, and Provisioning. Technical direction is led by the Technical Oversight Committee (TOC), while business strategy is managed by the Governing Board under the Linux Foundation.
As cloud-native computing expanded, the need for vendor-neutral governance, technical standard-setting, and open collaboration led to the creation of the Cloud Native Computing Foundation (CNCF). Established in 2015 under the non-profit Linux Foundation, the CNCF serves as the vendor-neutral home for foundational open-source cloud projects including Kubernetes, Prometheus, Envoy, and Helm.
The CNCF Interactive Landscape
To help organizations navigate the rapidly growing cloud-native ecosystem, the CNCF maintains the CNCF Interactive Landscape (landscape.cncf.io). The landscape categorizes open-source projects, commercial products, and cloud services into structured functional layers:
| Landscape Category | Primary Operational Focus | Representative CNCF Projects & Technologies |
|---|---|---|
| App Definition & Development | Databases, streaming, application definitions, image registries, and CI/CD automation pipelines | Helm, Argo CD, Harbor, Vitess, NATS, Artifact Hub, SchemaHero |
| Orchestration & Management | Container orchestration, service mesh proxies, API gateways, service discovery, and RPC frameworks | Kubernetes, Envoy, Istio, Linkerd, CoreDNS, gRPC, Kube-Router |
| Runtime | Cloud-native container runtimes, persistent storage interfaces, and CNI networking plugins | containerd, CRI-O, Rook, OpenEBS, CNI, Cilium, Longhorn |
| Provisioning | Infrastructure automation, cloud-native security, compliance engines, key management, and virtual machine isolation | Open Policy Agent (OPA), Kyverno, Falco, KubeVirt, Keylime, Tinkerbell |
| Observability & Analysis | Telemetry metrics collection, log aggregation, end-to-end distributed tracing, and chaos engineering | Prometheus, Jaeger, OpenTelemetry, Fluentd, Thanos, Cortex, Chaos Mesh |
| Serverless & Platforms | Function-as-a-Service (FaaS) frameworks, event brokers, and cloud-native application control planes | Knative, KEDA, Dapr, Crossplane, OpenFunction |
CNCF Project Maturity Stages
The CNCF uses a formal three-tier project maturity lifecycle to indicate project stability, adoption readiness, and community governance quality. Projects enter at Sandbox or Incubating and earn progression through transparent technical reviews.
┌─────────────────────────────────────────────────────────────────────────────┐
│ CNCF Project Maturity Pipeline │
├─────────────────────────────────────────────────────────────────────────────┤
│ 1. SANDBOX (Experimental / Early Adoption) │
│ • Goal: Encourage innovation, experiment with cloud-native concepts │
│ • Requirements: aligns with CNCF scope; a public application is filed │
│ in the cncf/sandbox repo and reviewed in batches by the TOC. TOC │
│ sponsorship is NOT a prerequisite for applying. │
├─────────────────────────────────────────────────────────────────────────────┤
│ 2. INCUBATING (Production-Proven / Growing Community) │
│ • Goal: Demonstrate sustained growth and real-world production usage │
│ • Requirements: Successful production deployments, healthy committer │
│ diversity, clear governance document, TOC vote approval │
├─────────────────────────────────────────────────────────────────────────────┤
│ 3. GRADUATED (Gold Standard / Enterprise Production Ready) │
│ • Goal: Maximum maturity, long-term sustainability, vendor neutrality │
│ • Requirements: Widespread production adoption, committers from multiple │
│ organizations, independent third-party security audit, OpenSSF │
│ Best Practices badge, two-thirds supermajority TOC vote │
└─────────────────────────────────────────────────────────────────────────────┘
Detailed Maturity Tier Breakdown
| Tier | Purpose & Description | Entry & Graduation Requirements | Flagship Project Examples |
|---|---|---|---|
| Sandbox | Entry point for experimental or early-stage open-source tools seeking a neutral foundation home. | Alignment with the CNCF charter. Applications are filed publicly in the cncf/sandbox repository and reviewed in batches by the TOC; the old "two TOC sponsors" prerequisite has been removed. | Kuma, OpenFunction, Headlamp, Kepler |
| Incubating | Projects with proven production adoption, growing committer bases, and active community governance. | Documented production deployments, published governance, maintainer diversity across organizations, and a formal TOC vote. | Backstage, KubeVirt, Kyverno, Longhorn |
| Graduated | Production-hardened gold standard projects demonstrating long-term viability and strict governance. | Widespread enterprise adoption, multi-organization maintainer diversity, a completed independent third-party security audit, an OpenSSF Best Practices badge (formerly the CII badge), and a two-thirds supermajority TOC vote. | Kubernetes, Prometheus, Envoy, Helm, containerd, CRI-O, CoreDNS, Jaeger, OpenTelemetry, Fluentd, Falco, Flux, Argo, KEDA, Dapr, Crossplane, Vitess, Rook, Open Policy Agent (OPA), Cilium |
Maturity levels move. Several projects that older study material still lists as Sandbox or Incubating have since graduated — Dapr, Crossplane, KEDA, Falco, CRI-O, Flux, Cilium and OpenTelemetry among them. Check
cncf.io/projectsrather than trusting a printed list; the exam tests that you understand the three tiers and their criteria, not that you have memorised today's roster.
Key Flagship Graduated Projects Every KCNA Candidate Must Know
- Kubernetes: Automated container orchestration and cluster management platform.
- Prometheus: Systems monitoring and time-series metrics alerting toolkit.
- Envoy: High-performance L7 service proxy and communication bus for service meshes.
- Helm: Standardized package manager for defining and deploying Kubernetes applications via charts.
- containerd: OCI-compliant core container runtime engine.
- CoreDNS: Flexible, extensible DNS server for internal Kubernetes service discovery.
- Jaeger: Open-source end-to-end distributed tracing system.
- Open Policy Agent (OPA): Unified policy enforcement engine for cloud-native stacks.
- Cilium: eBPF-based networking, security microsegmentation, and observability layer.
CNCF Governance Structure
The CNCF governance model guarantees vendor neutrality, preventing any single corporation or cloud provider from controlling project intellectual property or technical direction.
┌─────────────────────────────────────────────────────────────────────────────┐
│ CNCF Governance Hierarchy │
├─────────────────────────────────────────────────────────────────────────────┤
│ Linux Foundation Board of Directors │
│ │ Legal & IP Neutral Umbrella │
│ ┌────────────────────────────────────┴────────────────────────────────────┐ │
│ │ CNCF Governing Board (Business / Budget) │ │
│ │ • Sets membership tiers, budget allocation, trademark marketing │ │
│ └────────────────────────────────────┬────────────────────────────────────┘ │
│ │ Technical Autonomy │
│ ┌────────────────────────────────────▼────────────────────────────────────┐ │
│ │ Technical Oversight Committee (TOC) (Technical) │ │
│ │ • 11 Elected Technical Leaders │ │
│ │ • Evaluates project proposals, approves Sandbox/Incubating/Graduation │ │
│ └────────────────────────────────────┬────────────────────────────────────┘ │
│ │ Guidance & Review │
│ ┌────────────────────────────────────▼────────────────────────────────────┐ │
│ │ Technical Advisory Groups (TAGs) / Special Interest Groups (SIGs) │ │
│ │ • Security, App Delivery, Runtime, Observability, Storage, Network │ │
│ └────────────────────────────────────┬────────────────────────────────────┘ │
│ │ Project Management │
│ ┌────────────────────────────────────▼────────────────────────────────────┐ │
│ │ Project Maintainers & Open Source Contributor Communities │ │
│ └─────────────────────────────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────────────────────────┘
1. Technical Oversight Committee (TOC)
The TOC is the highest technical decision-making body in the CNCF. Composed of 11 elected technical experts, the TOC:
- Defines and updates the overarching technical vision for the CNCF ecosystem.
- Evaluates new project proposals and votes on project stage transitions (Sandbox, Incubating, Graduated).
- Establishes Technical Advisory Groups (TAGs) to oversee domain-specific technical areas (such as TAG Security, TAG Storage, TAG Network, and TAG App Delivery).
- Operates with strict technical autonomy, independent of commercial vendor interests.
2. Governing Board (GB)
The Governing Board oversees business strategy, budget allocation, membership tiers, trademark marketing, legal compliance, and flagship event operations (such as KubeCon + CloudNativeCon). Crucially, the Governing Board does not make technical decisions or dictate code architecture, ensuring a strict separation between business and technical leadership.
3. Maintainers & Technical Advisory Groups (TAGs)
- Maintainers: Individual open-source developers responsible for reviewing code contributions, merging pull requests, issuing releases, and maintaining repository security standards.
- TAGs / SIGs: Domain-focused community bodies that conduct deep technical evaluations, author whitepapers, and provide domain guidance to the TOC.
Linux Foundation Ecosystem & Open Source Contribution Model
The CNCF operates under the non-profit umbrella of the Linux Foundation (LF).
Intellectual Property & Neutrality
When an open-source project joins the CNCF, project trademarks, domain names, and copyright assets are transferred directly to the Linux Foundation. This legal framework guarantees that no single vendor can re-license the software under restrictive proprietary terms or block competitors from contributing.
Contribution Compliance Models
To ensure code contributions remain legally compliant and open-source clean, CNCF projects utilize contribution verification mechanisms:
- Developer Certificate of Origin (DCO): Contributors sign off on their commits (
git commit -s) certifying they hold the legal right to submit the code under the project's open-source license. - Contributor License Agreement (CLA): Contributors sign a formal legal agreement granting the foundation permissions to distribute and manage their contributions.
Which set of requirements must a CNCF project fulfill to achieve Graduated maturity status?
What is the primary operational division of responsibility between the CNCF Technical Oversight Committee (TOC) and the Governing Board?
Which flagship CNCF projects operate in the Graduated maturity tier for container runtime and package management, respectively?