Add instructions on how to setup the CNCF CLA check

2 files changed, 68 insertions, 0 deletions

diff --git a/CLA.md b/CLA.md
index b8e2d4d6..741a9ee5 100644
--- a/CLA.md
+++ b/CLA.md
@@ -81,3 +81,9 @@ Once you have this, the CLA authorizer bot will authorize your PRs.
 If you are having problems with signed the CLA send a mail to: `helpdesk@rt.linuxfoundation.org`.
 
 Someone from the CNCF will respond to your ticket to help.
+
+## Setting up the CNCF CLA check
+
+If you are a Kubernetes GitHub organization or repo owner, and would like to setup
+the Linux Foundation CNCF CLA check for your repositories, please 
+[read the docs on setting up the CNCF CLA check](/setting-up-cla-check.md)
diff --git a/setting-up-cla-check.md b/setting-up-cla-check.md
new file mode 100644
index 00000000..16ab0bbc
--- /dev/null
+++ b/setting-up-cla-check.md
@@ -0,0 +1,62 @@
+# Setting up the CNCF CLA check
+
+If you are trying to sign the CLA so your PR's can be merged, please 
+[read the CLA docs](https://git.k8s.io/community/CLA.md)
+
+If you are a Kubernetes GitHub organization or repo owner, and would like to setup
+the Linux Foundation CNCF CLA check for your repositories, please read on.
+
+## Setup the webhook
+
+1. Go to the settings for your organization or webhook, and choose Webhooks from the menu, then
+   "Add webhook"
+    - Payload URL: https://identity.linuxfoundation.org/lfcla/github/postreceive?group=284&comment=no&target=https://identity.linuxfoundation.org/projects/cncf
+      - `group=284` specifies the ID of the CNCF project authorized committers group in our CLA system.
+      - `comment=no` specifies that our system should not post help comments into the pull request (since the Kubernetes mungebot does this).
+      - `target=https://identity.linuxfoundation.org/projects/cncf` specifies what will be used for the "Details" link in Github for this status check.
+    - Content Type: application/json
+    - Secret: Please contact one of [@idvoretskyi](https://github.com/idvoretskyi) <ihor@linux.com> or [@caniszczyk](https://github.com/caniszczyk) <caniszczyk@linuxfoundation.org>
+    - Events: Let me select individual events
+      - Push: **unchecked**
+      - Pull request: checked
+      - Issue comment: checked
+      - Active: checked
+1. Add the [@linuxfoundation](https://github.com/linuxfoundation) GitHub user as an **Owner**
+   to your organization or repo to ensure the CLA status can be applied on PR's
+1. After you send an invite, contact the Linux Foundation (Chris Aniszczyk
+   <caniszczyk@linuxfoundation.org>, or Eric Searcy <eric@linuxfoundation.org>), or email the
+   helpdesk at helpdesk@rt.linuxfoundation.org to ensure that the invite gets accepted.
+1. Finally, open up a test PR to check that:
+    1. webhooks are delivered correctly, which can be monitored in the “settings” for your org
+    1. the PR gets the cla/linuxfoundation status
+
+## Branch protection
+
+It is recommended that the Linux Foundation CLA check be added as a strict requirement
+for any change to be accepted to the master branch.
+
+To do this manually:
+
+1. Go to the Settings for the repository, and choose Branches from the menu.
+1. Under Protected Branches, choose "master".
+1. Check "Protect this branch".
+1. Check "Require status checks to pass before merging", "Require branches to be up to date before merging", and the "cla/linuxfoundation" status check.
+
+Given the Kubernetes projects anticipates having "human reviewed" CLA acceptance, you may
+not do the last step, but it is still recommended to enable branch protection to require all
+changes to be done through pull requests, instead of direct pushing that will never kick off
+a CLA check.
+
+## Label automation
+
+The label automation is done using the [CLA plugin in prow](https://git.k8s.io/test-infra/prow/plugins/cla).
+In order to turn on the CLA labels on your repo, add it as appropriate within the
+[plugins.yaml](https://git.k8s.io/test-infra/prow/plugins.yaml), and add the cla plugin to it.
+
+You also need to add [@k8s-ci-robot](https://github.com/k8s-ci-robot) as one of the owners in
+the same org/repo, to ensure that it can add labels `cncf-cla: yes` and `cncf-cla: no` based
+on the status published by the Linux Foundation webhook.
+
+The label automation may not be essential for your repository, if you’re not using merge
+automation. For repos with maintainers doing manual merges, github protected branches may
+suffice.