The question behind most of my Udienza conversations at Open Source Summit Europe 2026 was not technical. It was about governance: how does a project stay neutral when the companies paying for it have their own plans?
That question is not abstract any more. OpenSearch exists because of a licence change. AlmaLinux exists because of a change in how RHEL source is published. Valkey, OpenTofu and OpenBao all have similar origin stories. And the State of Open Source in Europe report presented in Prague found that foundation-hosted, neutrally governed projects are Europe’s preferred model, at 52%.
So I spent a good part of Thursday and Friday with the people who run foundations.
CNCF: scaling support for 200+ projects
After the Udienza recording with the CNCF team on Thursday afternoon.
The Linux Foundation and CNCF press team set up a half-hour session with two people who see the whole CNCF landscape from the inside:
- Bob Killen, CNCF technical program management. He focuses on open source strategy, project success, maintainers and end users. He previously served on the Kubernetes Steering Committee, chaired Kubernetes Contributor Experience, and worked on open source strategy at Google’s OSPO.
- Daniel Krook, CNCF developer experience. He focuses on maintainers, contributors and users across the 200+ CNCF-hosted projects, and brings more than 20 years in open source, including senior technical roles at IBM.
The best angle with them was how a foundation scales support for hundreds of projects without turning governance into bureaucracy. The questions I prepared:
- What signal tells you a project is healthy before adoption numbers show it?
- What is the biggest maintainer bottleneck CNCF can actually solve centrally?
- Where should contributor experience be standardised across projects, and where should every project stay different?
- How should projects handle AI-generated contributions without exhausting maintainers?
- What does “graduation” fail to capture about real project maturity?
- If you could remove one source of maintainer toil across the ecosystem tomorrow, what would it be?
The conversation went well beyond these questions, into how AI agents stress Kubernetes. I wrote it up in full in CNCF’s Bob Killen and Daniel Krook on Agents and Kubernetes.
The timing was good. Two CNCF announcements came out of embargo on the first morning of the summit: Meshery moving to the CNCF Incubating level, and OVHcloud becoming a CNCF Platinum Member. A European cloud provider at the top membership tier fits the sovereignty theme of the week. I talked about OVHcloud’s direction with Guido Laout at KubeCon Europe, and CNCF’s AI direction with CTO Chris Aniszczyk.
OpenSearch: from “the fork” to an institution
On Friday the LF press team booked a slot with Bianca Lewis, Executive Director of the OpenSearch Software Foundation. She took the role in September 2025 with a mandate for vendor-neutral, community-first growth, after executive roles at Opster and Logz.io. OpenSearch was a Platinum sponsor in Prague, and its 2026 positioning is vendor-neutral AI data infrastructure across search, observability, security and AI workloads.
The question I most wanted answered: at what point does OpenSearch stop being described as “the Elasticsearch fork”? Every successful fork has to cross that line. LibreOffice crossed it. MariaDB crossed it (I asked Monty Widenius about that at FOSDEM). My other questions:
- How do you prove vendor neutrality when large vendors are major contributors and members?
- How do you balance long-term support for enterprises with a fast AI and search innovation cycle?
- What governance mechanism matters most when a sponsor’s commercial incentives diverge from community priorities?
- Which metric matters more to you than downloads?
AlmaLinux: compatible, but independent
At the AlmaLinux booth on Thursday afternoon.
benny Vasquez chairs the Board of Directors of the AlmaLinux OS Foundation. We first met on the show floor on Wednesday and picked a Thursday afternoon slot during the sessions, when the crowd was quieter.
AlmaLinux is the case study for community governance in enterprise Linux. It is compatible with RHEL but wants its own technical direction. I wrote about that balance in AlmaLinux 10: community enterprise Linux. The questions I prioritised:
- AlmaLinux is compatible with RHEL but also wants to be independent. Where do you draw that line technically?
- What does community governance protect you from that a single-vendor distribution cannot?
- How do you make sure a major sponsor never becomes the de facto owner of the project?
- What are enterprise users asking for today that they were not asking for two or three years ago?
- What would you like people who still see AlmaLinux simply as a “RHEL replacement” to understand differently?
Linux Foundation Europe: two decades of open infrastructure
I also had slots with two people from Linux Foundation Europe. Thierry Carrez is its General Manager. He was involved in OpenStack from the start and still contributes to its governance and release management. He also sits on the board of the Open Source Initiative. Paula Grzegorzewska works on strategic partnerships and co-authored the State of Open Source in Europe report. She reached out to Udienza herself during the week, which I appreciated.
The angle with Thierry was what twenty years of open infrastructure teach about sovereignty, neutral governance and sustainable collaboration. In particular: which governance pattern looks good on paper but fails at scale? And how should foundations balance the vendors who fund projects with the maintainers who actually build them?
The pattern
Across all of these conversations, one pattern held: neutrality is not a licence, it is a set of habits. It looks like this:
- Membership does not buy technical control. Technical decisions sit with maintainers and technical committees, not with the governing board.
- No single company holds a majority of maintainers on a critical project.
- The trademark and infrastructure belong to the foundation, so nobody can take the name and leave.
- The project measures health beyond downloads: contributor diversity, maintainer load, response times.
When you choose a dependency, check those four things, not just the licence. The Who Owns the Stack? panel made the same argument at policy level.
The Udienza episodes from Prague will be published at udienza.com. The full week is in my Open Source Summit Europe 2026 recap.
