Spinnaker – Community

Docs: Contributing

Mon, 01 Jan 0001 00:00:00 +0000

Filing issues

Please file issues through the Spinnaker GitHub issue tracker .

How to Become a Contributor

This is normally the place where we’d tell you about Contributor License Agreements and how you need to identify the right one and sign it before you are able to contribute code to Spinnaker.

We’ll probably end up doing something like this, but at the moment we’re exploring options that might make it easier for most of you to contribute. Please stay tuned…

In the meantime, if you’re really excited about contributing and don’t want to wait until we have all of this worked out, please reach out to us on Slack . We love accepting community patches!

For more details about the patch submission process, look at How to submit a patch .

How to run Spinnaker locally for development

Running Spinnaker locally on your machine is a great option for testing changes before submitting a pull request.

Follow the guide to setting up a dev environment to get up and running.

Docs: Get Help

Mon, 01 Jan 0001 00:00:00 +0000

Docs: Usage Statistics

Mon, 01 Jan 0001 00:00:00 +0000

If enabled , Spinnaker collects data about how the tool is being used. This data is anonymized (before being sent across the internet) and aggregated.

Why is data being collected?

The project maintainers have few signals about how the product is actually being used in the real world.

Is new feature X having any traction with users? Can we remove feature Y because it’s hard to maintain?

Questions like these are difficult to answer without at least some automated data collection, and ultimately that leads to a product that becomes slow, bloated, and littered with failed experimental code that nobody is confident about deleting.

What data is being collected?

Spinnaker’s telemetry module collects the following bits of data:

Spinnaker top-level version
A unique instance ID (a randomly generated ULID), SHA-256 hashed when sent over the wire
Application name, SHA-256 hashed and salted with the instance ID
Each execution’s:
- ID, SHA-256 hashed
- Final status
- Type
- Trigger
- Each stage’s:
  - Final status
  - Type
  - Cloud Provider

Spinnaker’s telemetry project has been reviewed and approved as compliant with the Linux Foundation’s Telemetry Data Collection and Usage Policy .

How is the data collected?

The above payload is sent to https://stats.spinnaker.io/log upon the completion of any pipeline or ad-hoc UI operation. Telemetry is enabled by default. Spinnaker administrators can turn off data collection by adding the following config to echo

stats:
  enabled: false

and redeploying.

What are we doing with this data?

We’re crunching the numbers and giving them back to the community in the form of dashboards (below) and access to the raw data by requesting access here (a Google Account is required in order to access the data via Big Query).

Dashboards

Docs: Security

Mon, 01 Jan 0001 00:00:00 +0000

Responsible Disclosure Policy

We know that security is very important to the Spinnaker community. We welcome (and encourage) any reviews and testing of Spinnaker’s open source code to ensure the quality and security of Spinnaker for users around the world.

Where should I report security issues?

If you would like to report a vulnerability in the Spinnaker open source code, please email us at security@spinnaker.io right away, and a member of the Security Special Interest Group (SIG) will get back to you as soon as we are able. We deeply appreciate your support in discovering and disclosing security issues in a responsible way.

What should I include in a security report?

Please share any information we need to understand and reproduce the security issue you’ve discovered, including:

A complete description of the security issue
Steps to detect or reproduce the security bug
Versions and configurations affected by the issue
Whether you would like credit for finding the bug

Note: As an independent open source community, we do not provide bug bounties for security reports at this time.

What kind of bugs should I report?

To help us prioritize bugs affecting the Spinnaker community, please only report security issues affecting the Spinnaker open source code or common configurations for deployed Spinnaker services. Please keep in mind that security issues with higher severity will receive priority over less impactful bugs.

Note: Do not conduct testing or security research against systems or data that you do not own.

Can I include code for fixing a security issue?

Absolutely! We love code contributions too, especially for security improvements. Please follow the contributing guidelines for any changes you would like to share. If you have any questions, feel free to contact the Security SIG by saying hello in the Spinnaker Slack #security-sig channel.

How are security bugs handled?

We’ve created a 4-step process to review and mitigate any reported security issues in Spinnaker open source code. These steps are further described in the Vulnerability Handling Process document.

Step 1: A Front Door

As part of the Spinnaker community, members of the Security SIG have volunteered to review and triage security vulnerabilities detected in Spinnaker open source code. All security issues that have been responsibly disclosed to security@spinnaker.io will be acknowledged and reviewed within one week of receiving the report.

Step 2: Evaluating New Reports

New security vulnerabilities will be assessed against our predefined security taxonomy, which is explained in detail in our Vulnerability Handling Process . We will work with you (the security researcher) to determine the scope and impact of the security issue, assign a severity rating, and reserve a CVE ID for newly discovered bugs.

Step 3: Tracking Vulnerabilities

We track and monitor security vulnerabilities in Spinnaker open source code through non-public mechanisms available to all members of the Security SIG and will review new security reports during the Security SIG bi-weekly meeting (or more frequently, as needed).

Step 4: Mitigating Vulnerabilities

Once a security issue has been confirmed and evaluated, the Security SIG will work with other members of the Spinnaker community to identify individuals to develop a patch or fix for each bug. Code changes for security issues will be developed publicly unless otherwise accepted by majority vote of the Security SIG. We will then track released security patches in the changelog for each release and update the CVE record.

I have another question not answered here. Who should I talk to?

For general questions about Spinnaker security, feel free to join us in the Spinnaker Slack #security-sig channel. Questions or feedback regarding a security issue or vulnerability should be sent directly to security@spinnaker.io .

I’d like to participate in the Security SIG . How do I join?

We’re thrilled that you’re interested in supporting Spinnaker security! The Security SIG meets bi-weekly to address security issues and provide input on security capabilities within the Spinnaker project. You can get startetd by requesting an invite to the Spinnaker Slack team and joining the #security-sig channel.

Docs: Google Summer of Code

Mon, 01 Jan 0001 00:00:00 +0000

Google Summer of Code (GSoC) is an opportunity for students to get involved with open source projects! It’s a great opportunity to gain real life experience and hopefully be inspired by the many who are continuously contributing to projects every day. Getting involved in active communities are a great way to jump start your career!

This page is a list of accepted ideas prepared specifically for Spinnaker , an open-source multi-cloud continuous delivery platform. The following list is non-exclusive, therefore if you’re passionate about a different project, we’re happy to review it! It should meet the GSoC project guidelines and would require at least 1 mentor that we can try to help pair.

Project	Related Skillsets
Gamifying SpinnakerGamifying is more than just giving users a pat on the back. It can influence good behavior and set guidance towards learning new skills. Companies could also use this data to find experienced users within their organizations. While the sky is the limit, let’s find what mechanics inspire you and bring that to life in Spinnaker!Available Mentor(s): Dan Johnston, Fernando Freire	Javascript Java
Build-a-PluginMake a plugin to integrate Spinnaker with your favorite service / tool! Learn about Spinnaker and its Plugin Framework by creating a plugin for Spinnaker. Once the plugin is built, we will work together to add the plugin into the Spinnaker Plugin Repository.Available Mentor(s): Cameron Motevasselani, Dan Johnston	Java Javascript
Release ImprovementPossible projects could include showing code coverage for projects, “X days since last deploy failure” signs and more!Available Mentor(s): Cameron Motevasselani, Fernando Freire	Java Github Actions Testing frameworks
Mobile-first Spinnaker ExperienceBuild a mobile-first Spinnaker experience that gives users a quick and easy way to get at-a-glance intelligence about their cloud infrastructure, with easy hooks for taking the most common CD actions on the go.Available Mentor(s): Fernando Freire, Dan Johnston	All Optional Javascript/ReactNative Flutter Java/Kotlin ObjectiveC/Swift

Spinnaker – Community

Docs: Contributing

Filing issues

How to Become a Contributor

How to run Spinnaker locally for development

Docs: Get Help

Docs: Usage Statistics

Why is data being collected?

What data is being collected?

How is the data collected?

What are we doing with this data?

Dashboards

Docs: Security

Responsible Disclosure Policy

Where should I report security issues?

What should I include in a security report?

What kind of bugs should I report?

Can I include code for fixing a security issue?

How are security bugs handled?

Step 1: A Front Door

Step 2: Evaluating New Reports

Step 3: Tracking Vulnerabilities

Step 4: Mitigating Vulnerabilities

I have another question not answered here. Who should I talk to?

I’d like to participate in the Security SIG . How do I join?

Docs: Google Summer of Code

Past Projects

2021

2020