As CNCF celebrated its fourth birthday in 2019, it achieved greater engagement through membership growth, event attendance growth, increased end user participation, and broad industry commentary. All of this underscored the growing role of Kubernetes in the cloud computing ecosystem.

For example, Barron’s declared Kubernetes as the “future” of computing and the “next big thing in cloud computing.” Barron’s explained, “Kubernetes is accelerating the transition away from legacy client-server technology by making cloud native software development easier, better, and faster.”

CNCF is at the forefront of that revolutionary transition.

The CNCF ecosystem has grown rapidly across vendor and end user memberships, making CNCF one of the most successful open source foundations ever. We started the year with 345 members. Over the course of 2019, we added 173 new members, an increase of more than 50%. Our 20 Platinum members include some of the world’s largest public cloud and enterprise software companies and end users. Apple, ARM, NetApp and Palo Alto Networks all joined or upgraded to Platinum in 2019. Ant Financial, Fidelity, Equinix, and Kingsoft joined as new Gold members in 2019.

End users are defined as companies that use cloud native technologies internally, but do not sell any cloud native services externally. Companies that meet this definition are eligible to join the End User Community .

Our End User Community grew by 89% in 2019, signaling clear and intense interest in cloud native technologies. We finished 2019 with 131 companies and startups. At present, CNCF enjoys the largest end user community of any open source foundation.

In the 2019 survey respondents described the End User Community as a “healthy community that facilitates sharing of real-world experience” and a “great way to learn and share info with other end users.”

Another respondent description stated: “Being part of a community that are actually using these technologies in production at large scale is very useful, often meetups/conferences have a much broader set of people, many of which are only just starting out looking at these technologies.”

Among respondents, 97% would recommend CNCF to other companies, and the average satisfaction rating was 4.16 out of 5. Of respondents, 94% also reported participating in End User-specific programs, such as the industry-specific End User Groups in Telecoms, Financial Services and Research.

In 2019, CNCF projects Fluentd, CoreDNS, containerd, Jaeger, and Vitess advanced to “graduated” status. This increased the total of graduated projects from two to six. During 2019, CloudEvents, Falco, and OPA joined our 14 incubating projects.

CNCF projects are classified by maturity level, ranging from sandbox to incubating to graduated. CNCF uses these maturity levels to indicate to enterprises the degree of project readiness for enterprise adoption. Graduated projects are suitable for the vast majority of enterprises. Incubating projects are suitable for early adopters, and sandbox projects are suitable for innovators. Projects increase their maturity level by demonstrating to the TOC that they have attained end user and vendor adoption, established a healthy rate of code commits and codebase changes, and attracted committers from multiple organizations. All projects must adopt the CNCF Code of Conduct and commit to earning the Core Infrastructure Initiative Best Practices Badge in order to become an accepted CNCF project. Full details are listed in Graduation Criteria v1.1 .

Cloud Native Ambassadors (CNAs) are individuals who are passionate about Cloud Native Computing Foundation technology and projects, recognized for their expertise, and willing to help others learn about the framework and community. These individuals are bloggers, influencers, and evangelists. CNCF has 95 CNCF Ambassadors around the globe educating the world on cloud native technologies and best practices.

We accepted 28 new CNCF ambassadors and provided financial support for ambassador-run meetups in 2019. We are excited to have this worldwide group of people with diverse interests, experiences, and technical backgrounds help drive local and global cloud native communities. Please check out the video interviews with several of our CNCF ambassadors or read about them.

The CNCF Cloud Native Landscape has become the standard way of charting the myriad options in the cloud native ecosystem. The landscape started in November 2016 as a static image of fewer than 100 projects and products. It has grown through the power of collaborative editing to track more than 1,200 projects, products, and companies and now includes a serverless landscape and the CNCF member landscape. The project has more than 6,000 stars on GitHub.

In 2018, CNCF released the Cloud Native Landscape 2.0, an interactive version that allows viewers to filter, obtain detailed information on a specific project or technology, and easily share via stateful URLs. The landscape also captures funding and financing information for companies that are fostering and building businesses around cloud native technologies. The code used to generate the interactive landscape is open source with the data stored in a yaml file . Every night, a server downloads updated GitHub data, financing information from Crunchbase, market cap data from Yahoo Finance, and CII Best Practices Badge information.

The Cloud Native Trailmap continues to show a path for organizations to adopt the graduated and incubating projects hosted by CNCF.

In 2018, the CNCF began performing and open sourcing security audits for its projects to improve the security of our ecosystem. The goal was to audit several projects and gather feedback from the CNCF community as to whether the pilot program was useful. The first projects to undergo this process were Kubernetes , CoreDNS , and Envoy . In 2019, CNCF invested in security audits for Vitess, Jaeger, Fluentd, Linkerd, Falco, Harbor, gRPC, Helm, and Kubernetes, totaling approximately half a million dollars. These first public audits identified a variety of security issues, ranging from general weaknesses to critical vulnerabilities. Project maintainers for CoreDNS, Envoy, and Prometheus have addressed the identified vulnerabilities and added documentation to help users, thus improving the security of these projects.

With funds provided by the CNCF community to conduct the Kubernetes security audit, the Security Audit Working Group was formed to lead the process of finding a reputable third-party vendor. The group created an open request for proposals. The group took responsibility for evaluating the proposals and recommending the vendor best suited to complete a security assessment against Kubernetes, bearing in mind the project’s high complexity and broad scope.

This audit process was partially inspired by the Core Infrastructure Initiative (CII) Best Practices Badge program that all CNCF projects are required to complete. Provided by the Linux Foundation, this badge offers a clear and easy-to-understand way for open source projects to show that they follow security best practices. Adopters of open source software can use the badge to quickly assess which open source projects are following best practices, and as a result, are more likely to produce higher-quality, secure software.

Findings from the Kubernetes audit conducted over a few months revealed:

1. Key security policies may not be applied, leading to a false sense of security.
2. Insecure TLS is in use by default.
3. Credentials are exposed in environment variables and command-line arguments.
4. Names of secrets are leaked in logs.
5. Kubernetes lacked certificate revocation.
6. seccomp is not enabled by default.

By open sourcing security audits and processes, the working group hopes to inspire other projects to undertake similar efforts in their respective open source communities. Full findings and recommendations from the audits are listed here .

CNCF remains the fastest-growing foundation in the history of open source. The success of CNCF is directly attributable to our projects, the contributions of the community, our end users, and support from our member companies. Thank you!

As we look to 2020 and beyond, we remain committed to fostering and sustaining an ecosystem of open source, vendor-neutral projects and to making technology accessible for everyone. To thrive, we believe CNCF must continue to provide a neutral home for projects, encourage diversity, and continue to cultivate community. All three are crucial elements for growth.

By continuing a wide array of initiatives, such as security audits, project journey reports, and documentation improvements, we are investing in the community to strengthen the cloud native ecosystem. We will continue with our core strategy of focusing on the developer community, helping developers progress into contributor and maintainer roles, and offering educational opportunities for those looking to grow and learn.

Previously, in-person learning opportunities were offered at our flagship KubeCon + CloudNativeCon events. We are now aggressively expanding these learning opportunities. In 2019, we held our first Kubernetes Forums and launched Kubernetes Community Days to make these learning opportunities available to more people. We plan to expand both initiatives in 2020 to continue supporting community learning.

Our sincere hope is that the CNCF community will continue to evolve as more and more new people join the ecosystem, thus furthering diversity and collaboration. We see signs of this as first-time attendees made up 65% of KubeCon + CloudNativeCon North America in San Diego.

We also will continue to emphasize the growth of our end user community. We plan to continue our work to bring end users together to discuss best practices in the Telco, Research, and Financial Services sectors, and will next create an Automotive user group.

In summary, 2019 was an exceptional year for CNCF. We are well-positioned financially and organizationally to continue our mission to make cloud native computing ubiquitous and the de facto standard for software development and usage. We look forward to having you join us on this journey as we look to 2020 and beyond. Learn more at www.cncf.io .