Linkerd no longer shipping open source, stable releases(buoyant.io)
buoyant.io
Linkerd no longer shipping open source, stable releases
https://buoyant.io/blog/announcing-linkerd-2-15-vm-workloads-spiffe-identities
42 コメント
This has already been addressed in the threads.
I don't understand - can you explain?
It's already been discussed. The title of the article hides the real conversation that is being highlighted. The conversation being highlighted is like a footnote... and that is Bouyant discontinuing OSS stable releases... an instance where the guidelines are guidance rather than hard and fast rules.
HN submission title says "no longer shipping open source, stable releases", but it seems the source is still all available under Apache-2.0, including the stable release branches. They're just not shipping a stable release binary separately, only as part of their container image and under a different license. Users would still be able to compile it themselves without any loss of functionality. Seems acceptable to me?
Edit: For people speculating they will not publish stable release branches or git tags either, TFA does say:
>And to be clear, Linkerd continues to be, and always will be, open source. This change is about the release artifacts, not about code, governance, community, or anything else.
... and all their mentions of "stable releases" can be charitably read to only apply to the binaries provided by them, not the source. But I suppose we'll find out for sure in 90 days.
Edit 2: crb's link is more definitive that the source code will also not be published.
Edit: For people speculating they will not publish stable release branches or git tags either, TFA does say:
>And to be clear, Linkerd continues to be, and always will be, open source. This change is about the release artifacts, not about code, governance, community, or anything else.
... and all their mentions of "stable releases" can be charitably read to only apply to the binaries provided by them, not the source. But I suppose we'll find out for sure in 90 days.
Edit 2: crb's link is more definitive that the source code will also not be published.
They're still shipping stable releases, but now under a restrictive license so they cannot be redistributed.
You can compile the current unstable development branch, but they'll be keeping the stable release branches secret.
You can compile the current unstable development branch, but they'll be keeping the stable release branches secret.
The thing that's frustrating for me, particularly, isn't having to build/package these container images, it's knowing which versions of the software are considered "good to run in production".
I take the announcement today to mean, every edge release might fuck your shit up in ways that are unpredictable. The canonical authority (linkerd maintainers) are now gating that information behind a paywall.
I take the announcement today to mean, every edge release might fuck your shit up in ways that are unpredictable. The canonical authority (linkerd maintainers) are now gating that information behind a paywall.
[deleted]
The stable version is not paywalled for individuals, nor for businesses with fewer than 50 employees.
So the only groups that need to worry about your concern are larger companies that rely on Linkerd for stability. This seems like a reasonable group to attempt to target for revenue.
So the only groups that need to worry about your concern are larger companies that rely on Linkerd for stability. This seems like a reasonable group to attempt to target for revenue.
> we will no longer be producing open source stable releases
That's a quote from their blog post. They don't mention stable release branches anywhere. It's safe to assume (I'd love to be wrong) that what's stable and what isn't is behind the paywall, otherwise this change makes no sense, as compiling the project on your own is not hard.
That's a quote from their blog post. They don't mention stable release branches anywhere. It's safe to assume (I'd love to be wrong) that what's stable and what isn't is behind the paywall, otherwise this change makes no sense, as compiling the project on your own is not hard.
[deleted]
https://www.techtarget.com/searchitoperations/news/366570820...
"[The] additional work done by Buoyant developers to backport minimal changes so that they're compatible with existing versions of Linkerd and to fix bugs, with reliability guarantees, to create stable releases will only be available behind a paywall, Morgan said."
"[The] additional work done by Buoyant developers to backport minimal changes so that they're compatible with existing versions of Linkerd and to fix bugs, with reliability guarantees, to create stable releases will only be available behind a paywall, Morgan said."
Just ran into this while trying to do some patching:
*******************************************
* This script is deprecated and no longer *
* installs stable releases. *
* *
* The latest edge release has been *
* installed. In the future, please use *
* run.linkerd.io/install-edge *
* for this behavior. *
* *
* For stable releases, please see *
* https://linkerd.io/releases/ *
*******************************************
Wow that just upgraded a portion of your cluster to development software with no prior warning? Glad I haven't had time to mess with this service mesh I suppose, how absolutely user hostile.
That message is from updating the linkerd CLI, so not quite that bad. My script updates the CLI and then the cluster, though, so if I hadn't interrupted then it would have.
Linkerd is a CNCF graduated project. It's unclear whether CNCF projects are owned by the CNCF or not, but in any case, it is clear that being a CNCF project you have to abide by certain rules. An organization unilaterally making decisions outside of the CNCF governance model seems to be completely against the rules.
I suspect this won't end well for buoyant.
I suspect this won't end well for buoyant.
You bring up a great point. There's already a wide range for what it means to be a "CNCF graduated project" in my opinion, but this further dilutes that meaning.
There's already a wide range for what it means to be a "CNCF graduated project", not it's a list of projects https://www.cncf.io/projects/ that met certain conditions. You could argue about the conditions but being a CNCF graduate project is literary you are on this list.
Looks like CNCF waved them through Graduation anyway, let's look at policies from July 28, 2021 when they were deemed "Graduated"
All maintainers of the LinkerD project had @boyant.io email addresses. [0] They do list 4 other members of a "Steering Committee", but LinkerD's GOVERNANCE.md gives all of the power to maintainers: [1]
> Ideally, all project decisions are resolved by maintainer consensus. If this is not possible, maintainers may call a vote. The voting process is a simple majority in which each maintainer receives one vote.
And CNCF Graduation policy says a project must "Have committers from at least two organizations" [2]. So it appears that the CNCF accepted the "Steering Committee" as an acceptable 2nd committer, even though the Governance policy still gave the maintainers all of the power.
I would like to know if the Steering Committee voted to remove stable releases from an un-biased position acting in the best interest of the project, or if they were simply ignored or not even advised on the decision.
I'm all for Boyant doing what they need to do to make money and survive as a Company. But at that point my opinion is that they should withdraw the project from the CNCF and stop pretending like the foundation has any influence on the project's governance.
[0] https://github.com/linkerd/linkerd2/blob/489ca1e3189b6a5289d... [1] https://github.com/linkerd/linkerd2/blob/489ca1e3189b6a5289d... [2] https://github.com/cncf/toc/blob/f01a4fab58ee26280f93a40bb39...
All maintainers of the LinkerD project had @boyant.io email addresses. [0] They do list 4 other members of a "Steering Committee", but LinkerD's GOVERNANCE.md gives all of the power to maintainers: [1]
> Ideally, all project decisions are resolved by maintainer consensus. If this is not possible, maintainers may call a vote. The voting process is a simple majority in which each maintainer receives one vote.
And CNCF Graduation policy says a project must "Have committers from at least two organizations" [2]. So it appears that the CNCF accepted the "Steering Committee" as an acceptable 2nd committer, even though the Governance policy still gave the maintainers all of the power.
I would like to know if the Steering Committee voted to remove stable releases from an un-biased position acting in the best interest of the project, or if they were simply ignored or not even advised on the decision.
I'm all for Boyant doing what they need to do to make money and survive as a Company. But at that point my opinion is that they should withdraw the project from the CNCF and stop pretending like the foundation has any influence on the project's governance.
[0] https://github.com/linkerd/linkerd2/blob/489ca1e3189b6a5289d... [1] https://github.com/linkerd/linkerd2/blob/489ca1e3189b6a5289d... [2] https://github.com/cncf/toc/blob/f01a4fab58ee26280f93a40bb39...
The Linkerd steering committee only met three times, most recently in May 2021. [1]
(Its charter [2] requires it to meet quarterly.)
Three of its four members have since left the companies that they were working at, so at this point it seems there are zero to one members.
There is no precedent for removing a project from the CNCF. They could, of course, fork it under a new name.
[1] https://docs.google.com/document/d/1GDNM5eosiyjVDo6YHXBMsvlp... [2] https://github.com/linkerd/linkerd2/blob/main/STEERING.md
(Its charter [2] requires it to meet quarterly.)
Three of its four members have since left the companies that they were working at, so at this point it seems there are zero to one members.
There is no precedent for removing a project from the CNCF. They could, of course, fork it under a new name.
[1] https://docs.google.com/document/d/1GDNM5eosiyjVDo6YHXBMsvlp... [2] https://github.com/linkerd/linkerd2/blob/main/STEERING.md
Once a project is donated to CNCF, it is donated in full. You cannot withdraw. They would need to withdraw from the project, but they cannot withdraw the project itself.
The project's governance says the maintainers can vote to make a decision. Why can't they vote to leave the CNCF?
I guess the answer may be that they can ask the CNCF to archive them, but the CNCF/Linux Foundation technically controls the domain and trademarks. So I guess they would need the CNCF to release those back to the project if they wanted to withdraw or move to another foundation. Interesting.
> Trademarks and domain names of archived projects are still hosted by the CNCF and the Linux Foundation
> The project is free continue development in its repositories, ideally with a goal to reactivate itself
https://github.com/cncf/toc/blob/main/process/archiving.md#a...
> Trademarks and domain names of archived projects are still hosted by the CNCF and the Linux Foundation
> The project is free continue development in its repositories, ideally with a goal to reactivate itself
https://github.com/cncf/toc/blob/main/process/archiving.md#a...
Correct, once the project is donated to CNCF, so is the trademark. Even if CNCF votes to archive the project, the trademark is still owned by them. I haven't seen an instance where CNCF released them.
[deleted]
As sibling said, I think the right move is they withdraw from linkerd, and start their own project. CNCF should appoint new stewards of the project or archive it.
This is hugely frustrating. I will start by saying that I really empathize with Buoyant here. It seems hugely difficult to create an OSS project AND profit from it - these things seem truly best when done by a consortium of companies.
But as a user of linkerd, this is really really grating. Their new offering (BEL) would be around $14k/mo for our org (though they say discounts are available), with 90 days notice. That's a rather large chunk of change I didn't request in our 2024 budget, for a cost-category that didn't exist before.
Having no stability guarantees is, in my opinion, ridiculous.
This statement right here is wild:
> Upgrading between edge releases may involve breaking changes, and may involve partial features that are later modified or backed out.
I'm open to seeing how this fares, but right now, colour me furious.
But as a user of linkerd, this is really really grating. Their new offering (BEL) would be around $14k/mo for our org (though they say discounts are available), with 90 days notice. That's a rather large chunk of change I didn't request in our 2024 budget, for a cost-category that didn't exist before.
Having no stability guarantees is, in my opinion, ridiculous.
This statement right here is wild:
> Upgrading between edge releases may involve breaking changes, and may involve partial features that are later modified or backed out.
I'm open to seeing how this fares, but right now, colour me furious.
Hi, Linkerd person here. I don't use HN much these days but I was pointed me to your comment. First, thank you for your empathy. The truth is that as much as I would prefer it otherwise, this change is required for Linkerd's survival and future growth. In turn I have empathy for you—we've put you in a tough situation with this, and while with 7 prod clusters it seems fair to ask your company to help fund the project (maybe you disagree), it doesn't seem fair that the onus to push this change through your company falls on you. I know this is a consequence of how we designed this transition but I wish there were a way we could make this part better. FWIW, we do have a team of folks who are very good at working the process, and at your scale we have flexibility on terms and pricing, so I think we can make it easy in your specific situation. Some of the new features are focused on cost reduction so there is an opportunity to appease the budgetary gods.
In terms of the stability guarantees you point out, that has always been the case for edge releases. They contain the latest changes on main, and while we try to keep that as stable as possible, things can break. Everything is well-documented and we try our best to at least have you able to make an informed decision.
Hope that helps, I'm always up for a deeper chat if you want to send me an email. (At the bottom of the blog post.)
In terms of the stability guarantees you point out, that has always been the case for edge releases. They contain the latest changes on main, and while we try to keep that as stable as possible, things can break. Everything is well-documented and we try our best to at least have you able to make an informed decision.
Hope that helps, I'm always up for a deeper chat if you want to send me an email. (At the bottom of the blog post.)
Looks more like an attempt to force people to pay for what should be an OSS project and goes against the spirit of CNCF. Guess that's another win for Istio, right? Have you guys consulted with CNCF to try offloading some costs of building and releasing "stable" OSS builds of LinkerD instead of forcing people into this weird arrangement? Something tells me CNCF wouldn't agree to this...
Yup.. CNCF seems to not like this change: https://github.com/cncf/toc/issues/1262
Your Pricing page says $2k monthly PER CLUSTER. It doesn't say PER PRODUCTION CLUSTER.
How are users handling this change? With Buoyant cutting down on their investment, does Linkerd OSS have enough contributors to sustain it?
"As of Linkerd 2.15.0, the open source project no longer publishes stable releases. Instead, the vendor community around Linkerd is responsible for supported, stable releases."
ref: https://linkerd.io/releases/
"As of Linkerd 2.15.0, the open source project no longer publishes stable releases. Instead, the vendor community around Linkerd is responsible for supported, stable releases."
ref: https://linkerd.io/releases/
No stability guarantees or upgrade paths for non-paying users.
So they want $2k/month per cluster. It's the exact same open source product. No support is included.
Even the smallest shops have at least 2 clusters. They want almost 5k a month to download an image from their private container registry? That seems insane.
Also this felt really condescending and out of touch:
> I hate this / you are evil / you have destroyed the beauty of open source. Who can I yell at?
> Hi there, this is William Morgan, Buoyant's CEO. You can email me at [email protected] or you can come find me in person at Kubecon EU in Paris next month. I'm the one who made this decision. (I'm also, perhaps not coincidentally, the person who pays the Linkerd maintainers.) Come talk to me and I'm happy to explain exactly why I did it and all the alternatives and options we considered.
Even the smallest shops have at least 2 clusters. They want almost 5k a month to download an image from their private container registry? That seems insane.
Also this felt really condescending and out of touch:
> I hate this / you are evil / you have destroyed the beauty of open source. Who can I yell at?
> Hi there, this is William Morgan, Buoyant's CEO. You can email me at [email protected] or you can come find me in person at Kubecon EU in Paris next month. I'm the one who made this decision. (I'm also, perhaps not coincidentally, the person who pays the Linkerd maintainers.) Come talk to me and I'm happy to explain exactly why I did it and all the alternatives and options we considered.
Even the smallest shops have at least 2 clusters
> Who has to pay for BEL?
> Anyone can download and deploy BEL in non-production situations. Companies with fewer than 50 employees do not need to pay to use BEL in production.
> After May 21st, 2024, companies with 50 or more employees must pay to use BEL in production
Iow small shops don’t have to pay anything. And even the largest deployments eg. with a cluster for each developer only pay for the single production cluster.
> Who has to pay for BEL?
> Anyone can download and deploy BEL in non-production situations. Companies with fewer than 50 employees do not need to pay to use BEL in production.
> After May 21st, 2024, companies with 50 or more employees must pay to use BEL in production
Iow small shops don’t have to pay anything. And even the largest deployments eg. with a cluster for each developer only pay for the single production cluster.
Why not here, I also wonder how this is compatible with it being a cncf project.
All the maintainers for linkerd are employed by Buoyant, which means under current graduation criteria it wouldn't have been graduated in the first place. Will be interesting to see if the CNCF TOC does anything about it though.
We’ve seen more products with mostly single maintainers, e.g. Flux and Argo graduating at the same time.
Very interesting question. What happens if a product goes out of compliance?
Very interesting question. What happens if a product goes out of compliance?
To my knowledge the CNCF has archived projects [1] before for one reason or another (most commonly inactivity), but I'm not aware of a case where they have actively kicked a project out.
It's also interesting to think about what that would even look like since part of the project being added to CNCF in the first place were the trademarks etc. got handed over too [2] - not just the code.
[1] https://www.cncf.io/archived-projects/ [2] https://www.linuxfoundation.org/legal/trademarks
It's also interesting to think about what that would even look like since part of the project being added to CNCF in the first place were the trademarks etc. got handed over too [2] - not just the code.
[1] https://www.cncf.io/archived-projects/ [2] https://www.linuxfoundation.org/legal/trademarks
[deleted]
Title: "Support for VM workloads, native sidecars, SPIFFE, and a new way to get stable releases". Per guidelines[0] "lease use the original title, (...) don't editorialize."
[0]: https://news.ycombinator.com/newsguidelines.html
[0]: https://news.ycombinator.com/newsguidelines.html
With all due respect, I think this is a great example of where we should deviate from the guidelines.
The original title is burying the lede.
The original title is burying the lede.
If you want to say what you think is important about an article, that's fine, but do it by adding a comment to the thread. Then your view will be on a level playing field with everyone else's: https://hn.algolia.com/?dateRange=all&page=0&prefix=false&so...