[Incubation] Cozystack Incubation Application

# Review Project Moving Level Evaluation
- [x] I have reviewed the TOC's [moving level readiness triage guide](https://github.com/cncf/toc/blob/main/operations/dd-toc-guide.md#initial-triageevaluation-prior-to-assignment), ensured the criteria for my project are met before opening this issue, and understand that unmet criteria will result in the project's application being closed.

Cozystack Incubation Application
v1.6
This template provides the project with a framework to inform the TOC of their conformance to the Incubation Level Criteria.

Project Repo(s): [cozystack/cozystack](https://github.com/cozystack/cozystack)
Project Site: [cozystack.io](https://cozystack.io/)
Sub-Projects:
- [talm](https://github.com/cozystack/talm)
- [boot-to-talos](https://github.com/cozystack/boot-to-talos)
- [cozypkg](https://github.com/cozystack/cozypkg)
- [cozy-proxy](https://github.com/cozystack/cozy-proxy)
- [cozystack-telemetry-server](https://github.com/cozystack/cozystack-telemetry-server)
- [talos-bootstrap](https://github.com/cozystack/talos-bootstrap)
- [cozystack-ui](https://github.com/cozystack/cozystack-ui)
- [blockstor](https://github.com/cozystack/blockstor)
- [etcd-operator](https://github.com/aenix-io/etcd-operator)

Communication: [CNCF Slack](https://cloud-native.slack.com/archives/C08BQJD95J7), [Kubernetes Slack](https://kubernetes.slack.com/archives/C06L3CPRVN1), [Telegram](https://t.me/cozystack), [GitHub Discussions](https://github.com/cozystack/cozystack/discussions)

Project points of contacts:

# The Cozystack Maintainers

## Active Maintainers

| Maintainer | GitHub Username | Company | Responsibility | Contact |
| ---------- | --------------- | ------- | -------------- | ------- |
| Andrei Kvapil | [@kvaps](https://github.com/kvaps) | Ænix | Core Maintainer | andrei.kvapil@aenix.io |
| George Gaál | [@gecube](https://github.com/gecube) | Independent | DevOps Practices, Developer Advocate | — |
| Timofei Larkin | [@lllamnyp](https://github.com/lllamnyp) | Ænix | Core Maintainer | — |
| Timur Tukaev | [@tym83](https://github.com/tym83) | Ænix | Website, Marketing, Community Management | timur.tukaev@aenix.io |
| Kingdon Barrett | [@kingdonb](https://github.com/kingdonb) | Urmanac | FluxCD and flux-operator | kingdon@navteca.com |
| Nikita Bykov | [@nbykov0](https://github.com/nbykov0) | Independent | ARM support, platform tooling | — |
| Matthieu Robin | [@matthieu-robin](https://github.com/matthieu-robin) | HIDORA | Managed Applications, Platform Quality & Benchmarking | — |
| Mattia Eleuteri | [@mattia-eleuteri](https://github.com/mattia-eleuteri) | HIDORA | CSI, Storage, Networking & Security | — |

## Emeritus Maintainers

The project thanks the following former maintainers for their contributions; their move to Emeritus status was documented in [PR #2717](https://github.com/cozystack/cozystack/pull/2717) following the [Stepping Down / Emeritus Process](https://github.com/cozystack/cozystack/blob/main/CONTRIBUTOR_LADDER.md#stepping-downemeritus-process).

| Maintainer | GitHub Username |
| ---------- | --------------- |
| Artem Bortnikov | [@aobort](https://github.com/aobort) |
| Kirill Klinchenkov | [@klinch0](https://github.com/klinch0) |

- [ ] (Post Incubation only) [Book a meeting with CNCF staff](http://project-meetings.cncf.io) to understand project benefits and event resources.

## Incubation Criteria Summary for Cozystack

### Application Level Assertion

- [x] This project is currently Sandbox, accepted on 2025/03/02, and applying to Incubation.
- [x] This project is applying to join the CNCF at the Incubation level.

### Adoption Assertion

_The project has been adopted by the following organizations in a testing and integration or production capacity:_
* [Ænix](https://aenix.io)
* [Mediatech](https://mediatech.dev/)
* [Gohost](https://gohost.kz)
* [Urmanac](https://urmanac.com/)
* [HIDORA](https://hikube.cloud)
* [QOSI](https://qosi.kz)
* [Cloupard](https://cloupard.kz/)
* [BeBy Cloud](https://beby.cloud)
* [Protofire](https://protofire.io)
* [Cloudsy](https://cloudsy.partners/)

A further 10–15 organizations use Cozystack in production but cannot be listed publicly. Contact details for verified adopters have been shared privately with the TOC.

## Application Process Principles

### Suggested

N/A

### Required

- [x] **Engage with the domain specific TAG(s) to increase awareness through a presentation or completing a General Technical Review.**
- Presented at TAG Infrastructure meeting on 05-Nov-2025: https://youtu.be/gJ4GYeLB-V0?si=S8Wrv1H7aLtBkZ9R&t=2066
- Slides: https://github.com/user-attachments/files/23371109/Cozystack.pdf
- General Technical Review questionnaire (in progress): https://github.com/cozystack/cozystack/pull/3572

- [x] **All project metadata and resources are [vendor-neutral](https://contribute.cncf.io/maintainers/community/vendor-neutrality/).**

Yes. Cozystack uses CNCF-provided vendor-neutral resources for communication, testing, hosting, and governance.

- [x] **Review and acknowledgement of expectations for [Sandbox](https://sandbox.cncf.io) projects and requirements for moving forward through the CNCF Maturity levels.**
- Met during [project's application](https://github.com/cncf/sandbox/issues/322) on 09-Jan-2025.

- [ ] **Due Diligence Review.**

Completion of this due diligence document, resolution of concerns raised, and presented for public comment satisfies the Due Diligence Review criteria.

- [x] **Additional documentation as appropriate for project type, e.g.: installation documentation, end user documentation, reference implementation and/or code samples.**

- [End user documentation](https://cozystack.io/docs/)
- [Installation documentation](https://cozystack.io/docs/getting-started/)
- [Use cases / guides](https://cozystack.io/docs/guides/use-cases/)
- [Ænix blog posts](https://blog.aenix.io/)

## Governance and Maintainers

### Suggested

- [x] **Governance has continuously been iterated upon by the project as a result of their experience applying it, with the governance history demonstrating evolution of maturity alongside the project's maturity evolution.**

Cozystack governance is based on CNCF best practices and continues to evolve with community growth. The project currently has 8 active maintainers across 4 organizations (Ænix, Urmanac, HIDORA, Independent), plus 2 maintainers in documented Emeritus status, and has received contributions from 40+ contributors across 15+ companies. Single-vendor concentration in the active maintainer group is 37.5% (Ænix), with the remaining 62.5% spread across Urmanac, HIDORA, and Independent affiliations.

- [x] **Clear and discoverable project governance documentation.**
- [MAINTAINERS.md](https://github.com/cozystack/cozystack/blob/main/MAINTAINERS.md)
- [GOVERNANCE.md](https://github.com/cozystack/cozystack/blob/main/GOVERNANCE.md)
- [CONTRIBUTOR_LADDER.md](https://github.com/cozystack/cozystack/blob/main/CONTRIBUTOR_LADDER.md)
- [CONTRIBUTING.md](https://github.com/cozystack/cozystack/blob/main/CONTRIBUTING.md)
- [Cozystack Community Meetings Calendar](https://calendar.google.com/calendar?cid=ZTQzZDIxZTVjOWI0NWE5NWYyOGM1ZDY0OWMyY2IxZTFmNDMzZTJlNjUzYjU2ZGJiZGE3NGNhMzA2ZjBkMGY2OEBncm91cC5jYWxlbmRhci5nb29nbGUuY29t)
- [Cozystack Community Meetings Recordings](https://www.youtube.com/playlist?list=PLEIgpkcPkMHaXqndo8iMMLS64p4sBkHPg)
- [Cozystack Meetings Notes](https://docs.google.com/document/d/1YObSKsQ3Gzi1gSLPlUp-PbSYEeVkoyzY20M_hXKVhq4/edit)

- [x] **Governance is up to date with actual project activities, including any meetings, elections, leadership, or approval processes.**

Yes.

- [x] **Governance clearly documents [vendor-neutrality](https://contribute.cncf.io/maintainers/community/vendor-neutrality/) of project direction.**

Included in [Code of Conduct](https://github.com/cozystack/cozystack/blob/main/CODE_OF_CONDUCT.md) and demonstrated by the multi-vendor maintainer composition.

- [x] **Document how the project makes decisions on leadership, contribution acceptance, requests to the CNCF, and changes to governance or project goals.**

- [GOVERNANCE.md](https://github.com/cozystack/cozystack/blob/main/GOVERNANCE.md)
- [CONTRIBUTOR_LADDER.md](https://github.com/cozystack/cozystack/blob/main/CONTRIBUTOR_LADDER.md)
- [CONTRIBUTING.md](https://github.com/cozystack/cozystack/blob/main/CONTRIBUTING.md)

- [x] **Document how role, function-based members, or sub-teams are assigned, onboarded, and removed for specific teams.**

- [GOVERNANCE.md](https://github.com/cozystack/cozystack/blob/main/GOVERNANCE.md)
- [CONTRIBUTOR_LADDER.md](https://github.com/cozystack/cozystack/blob/main/CONTRIBUTOR_LADDER.md)

- [x] **Document a complete maintainer lifecycle process (including roles, onboarding, offboarding, and emeritus status).**

- [GOVERNANCE.md](https://github.com/cozystack/cozystack/blob/main/GOVERNANCE.md)
- [CONTRIBUTOR_LADDER.md](https://github.com/cozystack/cozystack/blob/main/CONTRIBUTOR_LADDER.md) — including the [Stepping Down / Emeritus Process](https://github.com/cozystack/cozystack/blob/main/CONTRIBUTOR_LADDER.md#stepping-downemeritus-process)
- [CONTRIBUTING.md](https://github.com/cozystack/cozystack/blob/main/CONTRIBUTING.md)

- [x] **Demonstrate usage of the maintainer lifecycle with outcomes, either through the addition or replacement of maintainers as project events have required.**

The project has applied the maintainer lifecycle process in both directions since joining the Sandbox:
- [Maintainer roster update after joining CNCF](https://github.com/cozystack/cozystack/commit/b16d954dd31514c74d9b08eb98952a4dede8ae5f)
- Onboarded two additional maintainers from HIDORA (@matthieu-robin, @mattia-eleuteri) reflecting active multi-vendor contribution since Sandbox.
- First documented use of the Emeritus process for @aobort and @klinch0 in [PR #2717](https://github.com/cozystack/cozystack/pull/2717), with the `Active Maintainers` / `Emeritus Maintainers` separation added to MAINTAINERS.md at the same time. Two further maintainers (@gecube, @nbykov0) updated their public affiliations to Independent, and @lllamnyp's affiliation was updated to Ænix. As a result, Ænix's share of the active maintainer group decreased from 50% to 37.5%.

- [x] **If the project has subprojects: subproject leadership, contribution, maturity status documented, including add/remove process.**

Subprojects share the parent project's governance, contribution, and maintainer-lifecycle rules ([GOVERNANCE.md](https://github.com/cozystack/cozystack/blob/main/GOVERNANCE.md)). Sub-project leads are listed in their respective `MAINTAINERS.md` files.

### Required

- [x] **Document complete list of current maintainers, including names, contact information, domain of responsibility, and affiliation.**

[MAINTAINERS.md](https://github.com/cozystack/cozystack/blob/main/MAINTAINERS.md)

- [x] **A number of active maintainers which is appropriate to the size and scope of the project.**

8 active maintainers across 4 organizations (Ænix, Urmanac, HIDORA, Independent). 2 additional maintainers in documented Emeritus status.

- [x] **Code and Doc ownership in GitHub and elsewhere matches documented governance roles.**

[CONTRIBUTING.md](https://github.com/cozystack/cozystack/blob/main/CONTRIBUTING.md), [CODEOWNERS](https://github.com/cozystack/cozystack/blob/main/.github/CODEOWNERS).

- [x] **Document adoption and adherence to the CNCF Code of Conduct or the project's CoC which is based off the CNCF CoC and not in conflict with it.**

[Code of Conduct](https://github.com/cozystack/cozystack/blob/main/CODE_OF_CONDUCT.md)

- [x] **CNCF Code of Conduct is cross-linked from other governance documents.**

Yes. Linked from [GOVERNANCE.md](https://github.com/cozystack/cozystack/blob/main/GOVERNANCE.md), [CONTRIBUTING.md](https://github.com/cozystack/cozystack/blob/main/CONTRIBUTING.md), [CONTRIBUTOR_LADDER.md](https://github.com/cozystack/cozystack/blob/main/CONTRIBUTOR_LADDER.md).

- [x] **All subprojects, if any, are listed.**

- [talm](https://github.com/cozystack/talm)
- [boot-to-talos](https://github.com/cozystack/boot-to-talos)
- [cozypkg](https://github.com/cozystack/cozypkg)
- [cozy-proxy](https://github.com/cozystack/cozy-proxy)
- [cozystack-telemetry-server](https://github.com/cozystack/cozystack-telemetry-server)
- [talos-bootstrap](https://github.com/cozystack/talos-bootstrap)
- [cozystack-ui](https://github.com/cozystack/cozystack-ui)
- [blockstor](https://github.com/cozystack/blockstor)
- [etcd-operator](https://github.com/aenix-io/etcd-operator)

## Contributors and Community

### Suggested

- [x] **Contributor ladder with multiple roles for contributors.**

https://github.com/cozystack/cozystack/blob/main/CONTRIBUTOR_LADDER.md

### Required

- [x] **Clearly defined and discoverable process to submit issues or changes.**

https://github.com/cozystack/cozystack/blob/main/CONTRIBUTING.md

- [x] **Project must have, and document, at least one public communications channel for users and/or contributors.**

Documented in [README.md](https://github.com/cozystack/cozystack/blob/main/README.md).

- [x] **List and document all project communication channels, including subprojects (mail list/slack/etc.). List any non-public communications channels and what their special purpose is.**

[CNCF Slack](https://cloud-native.slack.com/archives/C08BQJD95J7), [Kubernetes Slack](https://kubernetes.slack.com/archives/C06L3CPRVN1), [Telegram](https://t.me/cozystack), [GitHub Discussions](https://github.com/cozystack/cozystack/discussions). No non-public channels are used for project work.

- [x] **Up-to-date public meeting schedulers and/or integration with CNCF calendar.**

- [Cozystack Community Meetings Calendar](https://calendar.google.com/calendar?cid=ZTQzZDIxZTVjOWI0NWE5NWYyOGM1ZDY0OWMyY2IxZTFmNDMzZTJlNjUzYjU2ZGJiZGE3NGNhMzA2ZjBkMGY2OEBncm91cC5jYWxlbmRhci5nb29nbGUuY29t)
- [Cozystack Community Meetings Recordings](https://www.youtube.com/playlist?list=PLEIgpkcPkMHaXqndo8iMMLS64p4sBkHPg)
- [Cozystack Meetings Notes](https://docs.google.com/document/d/1YObSKsQ3Gzi1gSLPlUp-PbSYEeVkoyzY20M_hXKVhq4/edit)

- [x] **Documentation of how to contribute, with increasing detail as the project matures.**

https://github.com/cozystack/cozystack/blob/main/CONTRIBUTING.md

- [x] **Demonstrate contributor activity and recruitment.**

[Cozystack DevStat Dashboard](https://cozystack.devstats.cncf.io/)

## Engineering Principles

### Suggested

- [x] **Roadmap change process is documented.**

[Community Roadmap](https://github.com/orgs/cozystack/projects/1)

- [x] **History of regular, quality releases.**

[Releases](https://github.com/cozystack/cozystack/releases)

Since joining CNCF Sandbox on March 4, 2025, Cozystack has delivered five stable minor releases (v1.1, v1.2, v1.3, v1.4, v1.5) and more than twenty patch releases on a predictable cadence, with public release candidates, long-lived patch branches, and automated backports. The most significant milestones include:

* **Reached `v1.0.0` stable**: first stable major release.
* **Introduced an operator-driven platform architecture**: declarative `Package` / `PackageSource` model, automated CRD lifecycle management, and Flux sharding for multi-tenant scalability.
* **Built a comprehensive backup and restore framework**: backup plans, restore jobs, Velero integration, native VM backup, RestoreJob dashboard, cross-namespace VM restore, and declarative `BackupStrategy` for PostgreSQL, MariaDB, ClickHouse, and FoundationDB (v1.4).
* **Significantly advanced virtualization support**: GPU support for VMs and tenant Kubernetes clusters, Windows VM support, built-in VNC console, separate `vm-disk` / `vm-instance` resources, persistent worker-node storage for tenant Kubernetes (v1.4), and HAMi-based fractional GPU sharing (v1.4).
* **Expanded managed services substantially**: added MongoDB, Qdrant, Harbor, OpenBAO, and continued improvements to RabbitMQ, NATS, MariaDB.
* **Delivered major storage improvements**: LINSTOR scheduler with storage-aware pod placement (v1.3), managed LINSTOR GUI with Keycloak SSO (v1.3), VM Default Images catalog (v1.3), auto-diskful support, tiered storage pools, per-user bucket credentials, read-only S3 access, and object locking.
* **Expanded networking capabilities**: VPC, multi-location networking based on Kilo / cilium-kilo, topology-aware routing, geo-distributed deployments, ouroboros hairpin-NAT with one-switch PROXY-protocol (v1.4), and tenant-scoped `cozy-proxy` BPF skip for VM LoadBalancer services.
* **Improved tenant isolation, observability, and API maturity**: stable per-namespace tenant resource limits, `WorkloadsReady` / Events observability surface with S3 bucket metering (v1.3), instance-type resource preset taxonomy (v1.4), public REST API and OpenAPI specifications, schema-driven dashboard rewrite talking directly to the Kubernetes API (v1.4).
* **Hardened CI/CD security**: migrated release workflows from long-lived PATs to short-lived tokens issued by the `cozystack-ci` GitHub App (v1.3).
* **Shipped v1.5 (June 2026)**: Gateway API ingress backed by Cilium as an opt-in alternative to ingress-nginx; operator-managed TLS for Kafka, NATS, Qdrant, and PostgreSQL endpoints; out-of-the-box backups via a platform-managed default `BackupClass` with a shared bucket, plus new etcd and generic Job backup strategies; automated GPU passthrough for VMs without manual KubeVirt patching; a `flux-shard-operator` spreading tenant HelmReleases across helm-controller shards; operator-provided wildcard certificates for platform and root-tenant ingress; a deletion-protection guardrail for critical platform objects; and runtime-populated dashboard dropdowns via a new Option API. Flux was upgraded to v2.8.0 with strict server-side apply and kstatus health checking.
* **Kept the platform on current upstream**: most recent components include Kubernetes 1.36, Talos v1.13, Cilium v1.19.3, cert-manager v1.20, KubeVirt v1.8.2, NVIDIA GPU Operator v26.3.1, Flux v2.8.0.
* **Established a mature release lifecycle**: pre-releases, long-lived patch branches, automated backports, and a steady stable + patch cadence.

### Required

- [x] **Document project goals and objectives that illustrate the project's differentiation in the Cloud Native landscape as well as outlines how this project fulfills an outstanding need and/or solves a problem differently.**

https://cozystack.io/docs/introduction/

- [x] **Document what the project does, and why it does it - including viable cloud native use cases.**

https://cozystack.io/docs/introduction/

- [x] **Document and maintain a public roadmap or other forward looking planning document or tracking mechanism.**

[Community Roadmap](https://github.com/orgs/cozystack/projects/1)

- [x] **Document overview of project architecture and software design that demonstrates viable cloud native use cases, as part of the project's documentation.**

https://cozystack.io/docs/guides/, https://cozystack.io/docs/guides/use-cases/

- [x] **Document the project's release process.**

https://cozystack.io/docs/operations/cluster/upgrade/

## Security

### Suggested

N/A

### Required

- [x] **Clearly defined and discoverable process to report security issues.**

[SECURITY.md](https://github.com/cozystack/cozystack/blob/main/SECURITY.md) — published since v1.3.0. Documents private reporting paths, supported version lines, acknowledgement and triage targets (3 / 7 business days), coordinated disclosure model via GitHub Security Advisories, and out-of-scope cases.

- [x] **Enforcing Access Control Rules to secure the code base against attacks (Example: two factor authentication enforcement, and/or use of ACL tools).**

- Organization-wide 2FA enforcement on the `cozystack` GitHub org
- `CODEOWNERS`-mandated review for protected paths
- Branch protection on `main` and release branches (required reviews, status checks)
- Release workflows migrated from long-lived PATs to short-lived tokens issued by the `cozystack-ci` GitHub App (v1.3.0, PRs #2351, #2383)
- Renovate-managed dependency updates with security alerts

- [x] **Document assignment of security response roles and how reports are handled.**

[SECURITY.md](https://github.com/cozystack/cozystack/blob/main/SECURITY.md) describes the reporting, triage, and coordinated disclosure flow. Coordinated disclosure is performed through [GitHub Security Advisories](https://github.com/cozystack/cozystack/security/advisories). The most recent example of the process in operation is [GHSA-g883-q79m-8225](https://github.com/cozystack/cozystack/security/advisories/GHSA-g883-q79m-8225), an unauthenticated information disclosure in the `kubeovn-webhook` admission handler, triaged and patched in v1.3.3 with a public advisory.

- [ ] **Document [Security Self-Assessment](https://tag-security.cncf.io/community/assessments/guide/self-assessment/).**

In progress. A draft self-assessment is being prepared by the maintainers and will be submitted via PR to [`cncf/tag-security`](https://github.com/cncf/tag-security/tree/main/community/assessments/projects) for a joint assessment with TAG-Security. A copy will be maintained in `docs/security/self-assessment.md` in the project repository.

- [x] **Achieve the Open Source Security Foundation (OpenSSF) Best Practices passing badge.**

[OpenSSF Best Practices: passing, 100% (64/64)](https://www.bestpractices.dev/en/projects/10177)

## Ecosystem

### Suggested

N/A

### Required

- [x] **Publicly documented list of adopters, which may indicate their adoption level (dev/trialing, prod, etc.)**

[ADOPTERS.md](https://github.com/cozystack/cozystack/blob/main/ADOPTERS.md)

- [x] **Used in appropriate capacity by at least 3 independent + indirect/direct adopters.**

Cozystack is used in production and development capacities by independent organizations across hosting, cloud, and consulting domains. The public adopter list is in [ADOPTERS.md](https://github.com/cozystack/cozystack/blob/main/ADOPTERS.md). Verified adopter contacts have been shared privately with the TOC.

- [ ] **TOC verification of adopters.**

Adopter contact details have been shared privately with the TOC for verification. Refer to the Adoption Assertion section of this document.

- [x] **Clearly documented integrations and/or compatibility with other CNCF projects as well as non-CNCF projects.**

Cozystack integrates dozens of CNCF and cloud-native projects as platform building blocks: https://cozystack.io/docs/guides/platform-stack/

## Additional Information

This project is important for advancing digital sovereignty, enabling migration from public clouds to bare metal, and equipping local service providers and integrators with an open, free toolkit to compete with hyperscalers (AWS, GCP, Azure) and proprietary platforms (OpenShift, VMware Cloud).