request: recurring ~$3000USD D&O Insurance

[parispittman]

• Description:
  Requesting Directors and Officers Insurance for Steering Committee, Code of Conduct Committee, and Security Response Committee members.
  https://www.kubernetes.dev/community/community-groups/#committees
  19 total members

  Referrals / Recs / Other:
  1 Thomas S. Pappas, MSA, CNAP | Senior Consultant | Virtual, Inc. - ASF
  2 https://docs.opencollective.foundation/what-we-offer/liability-insurance - offers a flat rate of $600

• Requesting SIG:
  s/sig/committee: steering

• SIG approval:
  collecting approvals on this chain

• Cost:
  We will need to get proper quotes from CNCF folks. Here's what the broad range is:

  1
  "under 3k a year"
  https://www.insureon.com/small-business-insurance/directors-officers/cost

  2
  https://www.embroker.com/blog/directors-and-officers-insurance-cost/
  Funding | Limits | Retention | Premium
  -- | -- | -- | --
  $0 – 10M | $1 – 2M | $10 – 25k | $3.5 – 6k
  $10 – 25M | $2 – 3M | $10 – 50k | $5 – 10k

  • Frequency:
    yearly?

  • Scale function:

    unsure - will need to research when we get actual quotes

• owner of cancellation/renewal
  cancellation - steering
  renewal - hopefully automatic; cncf

• Alternatives considered:

alternatives are no insurance or individuals insuring themselves, which is where we are today

[dims]

+1 from me!

[cblecker]

+1

[karenhchu]

This is very much needed! +1!

[cpanato]

+1

[mrbobbytables]

+1 from me as swell

[enj]

+1

[tpepper]

+1

[parispittman]

5/7 SC, 1 rep from SRC, 2 reps from CoCC

filed CNCFSD-1171 servicedesk ticket with cncf; keeping issue open to log progress and catch any other +1s/comments from committee members.

[justaugustus]

+1!

[celestehorgan]

+1000000

Comment: This is potentially confernece-talk levels of interesting to figure out and unfortunately I do not think it will be as straightforward as purchasing a policy off an online insurance agency. When I looked into this to get a personal D&O insurance policy, legally most policies don't cover the openness that open source work entails:

• We are not directors at a nonprofit. This includes @parispittman and any other members who sit on the CNCF Governing Board. Please note the specific language in use in the CNCF charter's membership: we have representatives rather than directors. I also do not believe the CNCF Technical Oversight Committee count as Officers or Directors, though I think they're closer than anyone on this committee is. And that's all at the CNCF level: as such, I don't think anyone's role at the project level counts as a Director or Officer, unless I'm mistaken. There's more complication to this but I request that someone ask me over DM rather than post it publicly. Resolving this would involve legal-ifying both some of k8s procedures and possibly amending the CNCF charter to indicate that any member at $LEVEL in a project acts as a director on behalf of CNCF
• D&O insurance hinges on the idea of wrongs committed when a director or officer acts as a fiduciary: that is, when they act in the best interests of the company. Nowhere in any charter of any committee do we have language about any of us acting as a fiduciary on behalf of the project: it's assumed that we act in the project's best interests, but I think we're all aware that there's plenty of opportunity to represent each of our company's interests instead. Resolving this point would require us to legal-ify some of our operating procedures, ensuring that anyone on a committee acts as a fiduciary for the project.
• The nature of how Kubernetes works makes a blanket insurance policy confusing. In what jurisdiction would we be insured? (Is global coverage possible)?

I'm all for this but @parispittman I think the step forward here is working with LF Legal (and Amye) to find an insurance agent willing to understand Open Source and craft us a bespoke insurance policy. I don't think anything off the shelf will work for our circumstances :/

[parispittman]

update here:
cncf/foundation#329

will close this issue when we have the copy

[justaugustus]

Adding the CNCF service desk ticket for completeness: https://cncfservicedesk.atlassian.net/servicedesk/customer/portal/1/CNCFSD-1171

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[BenTheElder]

/remove-lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[cpanato]

/lifecycle rotten

[cpanato]

/remove-lifecycle rotten

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle rotten
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[BenTheElder]

/remove-lifecycle rotten

cncf/foundation#329 (comment) seems relevant

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[BenTheElder]

/remove-lifecycle stale

[BenTheElder]

As I understand it: This was raised to the CNCF and the responses are largely public in cncf/foundation#329 (I've looked back over the service desk ticket).

We should probably close this in favor of cncf/foundation#329