User research: Find out who are the users and downstream consumers of K8s releases

[LappleApple]

Objective

• Collect user data to validate assumptions and inform decision-making
• Find out who is using our tools

Related user stories

• As a downstream consumer of K8s releases, I would like to be able to check the integrity of binaries, container images, documents, and other files that form a K8s release, so that I can trust that the release is secure.
• As a downstream consumer of K8s releases, I would like my releases to comply with SLSA 3, so that I can be maximally confident that my release hasn’t been tampered with. (See also KEP #3027)
• Hyperscalers, products on top of K8s. The notion of trust doesn't apply to them? They don't need K8s to be SLSA 3-compliant. They pull the source code to build something themselves. People trusting us build custom installers (KubeSpray, for example), end users building K8s envs because they don't have a choice, sovereign cloud.
• How people use the images
• What they expect to have in the images

Tasks

• Ask CNCF users tag for ideas on data collection/surveys
• Seek data on who is using our tools
• Develop mechanism to collect regular feedback
• Ask Cluster Lifecycle for their data
• Involve SIG Contribex Comms/K8s mailing list
• Maybe Brandon Mitchell should be involved. He led the OCI initiatives including standard, security, artifacts https://github.com/sudo-bmitch

[LappleApple]

Notes from survey session:

• keeping detailed questions about packages out of survey for now as they're out of scope (per group)
• need @puerco to weigh in on this question (attached image) to ensure that we're offering the best and most meaningful list of options

[xmudrii]

/assign

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[xmudrii]

The survey has been conducted and @LappleApple did the initial data processing, but we still need to draw the conclusion /remove-lifecycle stale