Define a policy for accepting commercial vendor plugins

[evan2645]

SPIRE has historically not accepted upstream plugin contributions for integration with commercial software. There have been several reasons cited - philosophical questions, difficulty in testing, and maintenance over time, are the primary concerns. That said, SPIRE does generally accept upstream plugin contributions for commercial integration when the integration in question is a compute platform, like AWS.

The concerns are real, and the project does struggle with some of those concerns when it comes to the existing plugins. For example, maintainers need AWS accounts in order to test the AWS plugins, testing is manual and time intensive. Changes in cloud vendor APIs sometimes go unnoticed, and we have had breakages. Investment is needed in this area, but getting that investment has also been hard.

This issue is being raised now as a result of #4162. The project needs a policy clearly defining the conditions necessary for accepting upstream plugins with regards to commercial integration. It's unfair to make the call on a case-by-case basis.

[github-actions]

This issue is stale because it has been open for 365 days with no activity.

[evan2645]

This issue is still relevant.