Third party dependencies in kubernetes

[caniszczyk]

Hey @kubernetes/steering-committee, in CNCF we review all of our project dependencies to ensure they comply with the CNCF IP Policy:

There have been a handful of dependencies that have been flagged as potential issues, usually a weak copyleft issue:

• heketi
• ratelimit
• yaml.v2
• hcl
• golang-lru
• dhcp4client
• influxdb (needs upgrade to switch out WTFPL subcomponent)

What would be the feasibility of switching these dependencies out or updating them to be compliant with the IP Policy? It would be great to put this on the SC agenda to discuss.

[ghost]

Thanks. I've added it to the agenda. http://bit.ly/k8s-steering-wd

[bgrant0607]

Re. ratelimit:

Noted here:
kubernetes/client-go#357

was re-added by:
kubernetes/kubernetes#38294

cc @liggitt

[liggitt]

Can be replaced with a golang ratelimiter (kubernetes/kubernetes#38320) if we drop one of the metrics we are pulling from the current ratelimiter (which is of questionable value)

[thockin]

At some point I looked at all of the LGPL libs and they were all LGPL + static linking, which Go satisfies

[thockin]

heketi: I don't know this one

The REST API client code (in go and python) is released
under a dual license of Apache 2.0 or LGPLv3+.

The other parts of heketi (server, cli, tests, ...) are released
under a dual license of LGPLv3+ or GPLv2.

ratelimit:

This software is licensed under the LGPLv3, included below.

As a special exception to the GNU Lesser General Public License version 3
("LGPL3"), the copyright holders of this Library give you permission to
convey to a third party a Combined Work that links statically or dynamically
to this Library without providing any Minimal Corresponding Source or
Minimal Application Code as set out in 4d or providing the installation
information set out in section 4e, provided that you comply with the other
provisions of LGPL3 and provided that you meet, for the Application the
terms and conditions of the license(s) which apply to the Application.

yaml.v2:

This software is licensed under the LGPLv3, included below.

As a special exception to the GNU Lesser General Public License version 3
("LGPL3"), the copyright holders of this Library give you permission to
convey to a third party a Combined Work that links statically or dynamically
to this Library without providing any Minimal Corresponding Source or
Minimal Application Code as set out in 4d or providing the installation
information set out in section 4e, provided that you comply with the other
provisions of LGPL3 and provided that you meet, for the Application the
terms and conditions of the license(s) which apply to the Application.

hcl: MPL - how do we feel about that?

golang-lru: MPL

dhcp4client: MPL

influxdb (needs upgrade to switch out WTFPL subcomponent): MIT. We do not reference the 'github.com/BurntSushi/toml' component which is WTFPL so it is not actually part of our codebase.

[bgrant0607]

Needs automated enforcement: https://github.com/kubernetes/kubernetes/issues/44505

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[cblecker]

/remove-lifecycle stale

[msohn]

What is the plan going forward ?
Do you plan to remove or replace these flagged dependencies ?
Or is there another mitigation ?

The gardener project [1] is on the way to fork kubernetes/autoscaler since we need to adapt it to machine-controller-manager [2] until machine and cluster APIs discussed in the cluster-API working group have settled and the community has agreed on common implementations.
We’d like to avoid such IP debt when forking the repository.

[1] https://github.com/gardener
[2] https://github.com/gardener/machine-controller-manager

[bgrant0607]

For ongoing enforcement, I think FOSSA is the plan.

cc @kubernetes/sig-contributor-experience-feature-requests @kubernetes/sig-testing-feature-requests

[dims]

@justaugustus can you please run a quick scan using the FOSSA to see if we still have the issues listed above? (or if any new ones show up)

[justaugustus]

@dims -- I'm on a plane at the moment and towards the end of the week on my coast. I can make sure the bits are in place and kick something off first thing next week though! :)

Also, let's tie the threads together:

• Kubernetes license scanning #57 is a more up-to-date k/steering issue that supercedes some of the things listed here
• k/sig-release umbrella tracking issue: [Umbrella] License Auditing & Remediation sig-release#223 (which I'll bring up to date next week)

/close

[k8s-ci-robot]

@justaugustus: Closing this issue.

In response to this:

@dims -- I'm on a plane at the moment and towards the end of the week on my coast. I can make sure the bits are in place and kick something off first thing next week though! :)

Also, let's tie the threads together:

• Kubernetes license scanning #57 is a more up-to-date k/steering issue that supercedes some of the things listed here
• k/sig-release umbrella tracking issue: [Umbrella] License Auditing & Remediation sig-release#223 (which I'll bring up to date next week)

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.