[pjfanning]

What

Adds the third-party Kubernetes manifests and configuration files that the source release physically ships to the top-level LICENSE, and propagates the NOTICE attribution for the two ASF upstreams among them.

Found while verifying the 0.9.0-incubating RC5 source tarball. None of these were mentioned in the top-level LICENSE, whose "Bundled components" section only listed OpenWhisk, Spray and the Gradle wrapper. The oplugins-op/LICENSE only says the manifests reference third-party images; it does not say the manifest text itself is copied from upstream.

Files covered

Every upstream was verified by diffing the shipped file (ASF header removed) against the upstream artefact at the tag stated. All are Apache License 2.0.

Upstream	Version	Shipped copies	Match
cert-manager	v1.10.1, v1.11.0	5 × cert-manager.yaml	byte-identical to the GitHub release asset
ingress-nginx	v1.5.1 / 1.7.0 / 1.7.1 / 1.8.1	7 manifests	upstream deploy/static/provider/* with 0–58 lines of local edits
Kubegres	v1.18	3 × kubegres-crd.yaml	2 copies identical to v1.18; the testing/ copy is an older build
Milvus Operator	v1.1.3	1 CRD bundle	rendered chart CRDs, 18 lines of Helm templating differ
Milvus / milvus-helm	chart 4.2.32, config trimmed	4 config maps + 2 rendered manifests	retains Copyright (C) 2019-2021 Zilliz
MongoDB Community Operator	v0.7.3	1 CRD	byte-identical
Prometheus community chart	(server config)	1 ConfigMap	rendered
Apache Kvrocks	2.8.0	1 ConfigMap	kvrocks.conf with 16 lines of local edits

Non-Apache licences: none found, two things worth knowing

• MinIO chart 8.0.17 (rendered inside milvus_manifest.yaml): the chart templates are Apache-2.0. They were published by MinIO before its April 2021 switch to AGPL-3.0 and are redistributed by milvus-helm under that repo's Apache-2.0 licence. The MinIO server image is AGPL-3.0 but is only referenced, not shipped.
• MongoDB Community Operator: the repo's LICENSE.md is Apache-2.0 for all source and content, with a separate proprietary licence for the MongoDB Agent binary. Only the CRD is shipped, so no proprietary content is included. The LICENSE text says so explicitly.

Follow-ups outside this repo

• oplugins-op/deploy/cert-manager/cert-manager.yaml (operator repo) had the upstream # Copyright 2022 The cert-manager Authors. header removed and replaced with the ASF header. The four copies in oplugins retained it. Apache-2.0 §4(c) requires keeping the notice, so that file needs a fix in apache/openserverless-operator.
• oplugins-op/LICENSE should carry the same section, since the operator ships the same files on its own.
• Every submodule LICENSE/NOTICE refers readers to a WARN file that no-release.txt strips from the source tarball.

Not in scope here: the pre-built JS bundles under oplugins/util and oplugins/admin/usage embed MIT/ISC/BSD npm packages that are attributed only in oplugins/NOTICE, not the top-level LICENSE.

🤖 Generated with Claude Code

[sciabarracom]

actually minio and mongodb has been removed from the distribution so it is better to remove them

[pjfanning]

This is not a blocker for me but we need to fixed before we do a future release. If we merge this and remove the minio and mongodb LICENSE bits when we remove them from the release build - would that be ok?

[sciabarracom]

I am not merging this PR because we plan to clean the code first removing unnecessary and obsolete dependencies - work is already started by the community members to clean them

[pjfanning]

If any of these files are retained, the LICENSE and NOTICE will need to updated to mention the ones that are retained.

[sciabarracom]

managed after cleaning the code