TSC Meeting (6 Apr 2021): Packagecloud, CMS Migration, v3.5 Release Progress, Partners

[blag]

April 2021 @StackStorm/tsc 1 hour meeting will take place on Tuesday, 6th Apr 2021, 09:30 AM US Pacific.
See #33 for more info about how to join.

Meeting Agenda

• Project updates - @armab
• Switching away from Packagecloud paid plan - @blag
  • Moving to Packagecloud OSS plan and complications
  • Moving to Cloudsmith for package hosting
  • Host a redirect server
  • Self hosting our own package repos
• Migrating from our current CMS to a static site generator - @blag
• Migrating forum.stackstorm.com
• v3.5 Release Progress - June 2021
• Partners Program
• AWS Credit Situation (@punkrokk)

Agenda Details

Project Updates

Moving to Packagecloud OSS plan and complications

• Their current OSS plan
  • 250 GB bandwidth/month
  • 25 GB storage
• In the last 12 months, we have used
  • Bandwidth: 446 GB/month (average), 1.2 TB (maximum)
  • Storage: 182 GB (average), 190 GB (maximum)
• Sweetheart OSS plan restrictions
  • 500 GB bandwidth/month
  • 200 GB storage (need to clean up old versions that we don't support anymore)
  • ❗ If we exceed those limits and the excess "severely impact [Packagecloud's] business finances" they would terminate our OSS plan within 30 days and force us back to an Enterprise License plan ❗
    • This means that we should absolutely have a backup plan in place, or even update our apt/yum repo config files to use something like packages.stackstorm.com, and point that to packagecloud.io in DNS so we can quickly redirect traffic away from them to minimize disruption
    • On the other hand, maybe this is a good way to force users and resellers to support the project monetarily
• Sweetheart OSS plan obligations
  • Add PackageCloud to the StackStorm Partners page
  • Add PackageCloud logo with backlink to PackageCloud as a "Sponsor" on the stackstorm.com website (~500 daily visits)
  • Add PackageCloud badges on GitHub with backlink to PackageCloud
  • Collaborate on a blog post and publish to Open Source community
    • Twitter (3K followers)
    • LinkedIn (1K users)
    • Email Newsletter (13K users)
    • Slack Community (6.5K users) about the PackageCloud partnership
    • Advertising the PackageCloud brand, its services and recognizing the support to our community
      • This is not well defined
  • Quarterly tweet/social media post linking to our quality and popular blog posts

Moving to Cloudsmith for package hosting

Cloudsmith has reached out regarding becoming a StackStorm partner via hosting StackStorm packages.

• Reasons to use Cloudsmith
  • Actively developed and maintained
  • Reactive to issues/requests
  • Support, as in, from real Humans, is world-class, fast, and frequently involved with users
  • Offers proper org/team role-based access controls, for better setting up secure pipelines
  • Has support for 22+ package formats, to cover any type of deployment or distribution need
  • Has a specific focus on security and securing the supply chain; influences features/roadmap
  • Performance is a top requirement
    • Powered by a worldwide CDN and multi-region infrastructure
  • Actively pursues annual pen-testing, provides a detailed security policy, targetting SOC2/ISO
  • Offers significant support to open-source companies, projects, and other partnerships
  • Some existing partners are already Cloudsmith customers
• Downside
  • Need to update the installation script to point to a different package repo
• Questions
  • Can we host old packages (eg: v3.4.1 and before) on Packagecloud and new packages (eg: v3.5 and later) on Cloudsmith?

Host a redirect server

• We should probably change this anyway
• Very little load and traffic (just requests+redirect responses)
• Uses AWS credits (shouldn't be a big deal; we have plenty and can get more)
• DNS redirection?
  • Relies on URL paths to be the same between different package hosts
    Example:
    pghost1 hosts at https://pghost1.com/packages/<repo_type>/<os>/<os_version>/<package_name>
    pghost2 hosts at https://pghost2.com/deb/<os>/<os_version>/<repo_type>/<package_name>
• HTTP redirection?
  • Can redirect to different URL paths
  • Can easily collect analytics for ourselves (nginx+greylog or something)
    • Can ignore traffic from our own CI tests
  • Easily secured (just nginx exposed to the internet)

Self hosting our own package repos

• Most flexible solution
• Uses AWS credits (shouldn't be a big deal; we have plenty and can get more)
• Operational overhead
• Ready made Docker image to host on AWS S3
• Ready made project to host packages

Migrating from our current CMS to a static site generator

• Use Hugo? (suggested by @nmaludy)
  • Migration tools
• Need a volunteer to lead the effort
• Where to host?
  • GitHub Pages?
    • Blog posts would become PRs to that repo
      • All draft blog posts would be public (eg: blog posts on security would need to be written privately)
    • Automatic deployment with GitHub Actions

Migrating forum.stackstorm.com

• We're on 50% FOSS plan for forum.stackstorm.com for Discourse
  • Consider switching to self-hosted Discourse (free, maintenance burden)
  • Consiser switching to GH Discussions (free, zero maintenance, integrates with our GH community)
• Keep SEO in mind
• Owner + 1 needed to: research, propose a plan, execute the migration

v3.5 Release

• Still scheduled for June 2021 - 👍
• Release manager: @amanda11
• Still need a release assistant
• https://github.com/orgs/StackStorm/projects/20
• Major items:
  • Add Python v3.8 support to st2 (@nzlosh and @winem)
  • Add Ubuntu 20.4 LTS support
  • Drop Ubuntu 16.04 LTS
  • Core Performance Improvements - @Kami
  • Add Redis as a required coordination backend in st2 core - @m4dcoder
    • Bash Installer -
    • Ansible Deployment - @amanda11
    • Puppet Deployment - @nmaludy
    • Docker & K8s - Done
  • PIP & Virtualenv Maintenance upgrade - @amanda11
  • Discussion, Research, and Proposal about switching to Poetry for st2 core dependencies (@cognifloyd will research and create a GH Discussion, @nmaludy advising).
  • Switching the st2 Integration Tests from TravisCI to GH Actions (best) or at least CircleCI.

Partners Program

See #72 TSC Vote on the Partners Program.

[Kami]

1. What are the alternatives to packagecloud (OSS)?

Self hosted on AWS? That may be a good back up plan regardless. Based on my quick calculations in the past, even without OSS credits, it would be substantially cheaper than package cloud.

But would need to do some more research (+ better cost projection including things such as CDN if we would use that, etc.) and think how big of a time investment it would be (tooling and stuff).

In the past, I mostly did self grown package hosting solutions on S3 and similar services, but I believe there are multiple open source projects out there these days for making things like that easier.

EDIT: Here is a short list for further evaluation based on quick Googling:

• https://github.com/Ennexa/docker-deb-rpm-s3
• https://pulpproject.org/

2. I think that would be a nice to have in the future, but also not that important priority for the near term (I would imagine it would be quite a time consuming project and wouldn't get us tons in the near term - especially now that we locked down our WP setup a bit better).

If someone wanted to do it though, they are of course still very welcome to :)

[arm4b]

For Discourse (forum.stackstorm.com), we're on the OSS plan already which gives us a 50% discount (eg we pay $50 instead of previously $100).

An alternative is hosting the Discourse/Forum ourselves which will be free of cost. However, it feels to me that GH Discussions is something that would be a perfect match and integrate with the community and system we already have around GH.

With that, similar to the Blog migration I think we need to find the owner for Forum migration too (incl. SEO aspect): research, discuss, define the plan, execute. Both items not just would save us some costs, but also reduce the maintenance burden.

[lskillen]

1. What are the alternatives to packagecloud (OSS)?

Cloudsmith sent a potential offer to partners@stackstorm.com for this. We're fans of StackStorm, interested in co-marketing, and we're capable of supporting the OSS needs and beyond, serving as a (more than capable) substitute for services such as Packagecloud and Bintray (which is shutting down). A custom domain would put control back in the court of StackStorm (we believe in giving people the tools to avoid vendor lock). Happy to advise or help; no hard feelings if the interest is not there. 😁

[punkrokk]

I agree we need to expose the economic aspect here. I know we don't have a lot of cash, but in some cases, we may spend 100 hours of work to save $500/year. We also probably will have enough EC2 credits to possibly run a Sonatype Nexus server via those credits.

[blag]

Meeting Notes

• Partners Program Proposal
  • @raviorch will schedule a subcommittee meeting to discuss and finalize a partners program proposal for vote at the next TSC meeting
    • Subcommittee discussion page is TSC Subcommittee Meeting (15 Apr 2021): Partnership Program #73
• AWS OSS Credits
  • @punkrokk will re-apply for OSS credits from AWS
    • We will juggle the AWS infra when we have time and attention from @dzimine again, since he is currently dealing with a lot of stuff at his work

Further notes:

• There will be additional subcommittee meetings to discuss and appoint delegates to handle the topics that we did not get to today
  • TSC Subcommittee Meeting (20 Apr 2021): Package hosting solutions #74 - 20 April, 2021 - Package hosting solutions
  • TSC Subcommittee Meeting (22 Apr 2021): Migrate forum.stackstorm.com #75 - 22 April, 2021 - Migrate forum.stackstorm.com
  • Migrate StackStorm blog and CMS to GH Static Pages #76 - 27 April, 2021 - Migrate StackStorm blog and CMS

[arm4b]

Additional Meeting Minutes for the already documented above ^^

Updates

• New StackStorm Contributors and Maintainers:
  • @winem joined as a @StackStorm/maintainers Propose adding @winem as a Maintainer st2#5179
  • @cognifloyd joined as a @StackStorm/contributors Add @cognifloyd as a StackStorm Contributor st2#5178
• TSC Operation & Transparency
  • According to the StackStorm Technical Charter, all the discussions, decisions, processes should be documented, easily searchable, public and open.
  • We'll start recording TSC Meetings and publish them on the StackStorm Youtube (https://www.youtube.com/channel/UCColc5CuBJ8-1SnALnkDz8Q), beginning from the next meeting
  • We'll open private TSC Slack channels like #TSC and #partners to make them public. Create private #security channel for the project security sensitive topics.
  • Prefer GH Discussions (this repo) instead of Slack for the bigger topics, votes, plans, decisions, discussions

Partners

LF Representative has joined the meeting and the TSC spent this opportunity and time to discuss the Partners Program and other Q/A topics.
More above in @blag's #71 (comment)