The CNCF pays for cert-manager's testing, web hosting and infrastructure costs and they paid for a professional security audit of the project. We get marketing help, exposure, talks, booths and other bits too. When we graduated last year, we got popcorn!
What I personally like too is that the CNCF provide a kind of "business continuity" aspect for open source, which is something I think about a lot. If the current maintainers got hit by an asteroid at an in-person event, there are CNCF people in our testing infra account and in GitHub who can log in and save the project. At the end of the day businesses have continuity plans for their projects, and for open-source projects of cert-manager's size it makes sense to do the same - and the CNCF neatly solves that problem for us.
I ask myself that every time I happen to stroll past CNCF things. I just can't avoid feeling that it's a big cloud complexity racket - and not even a classy one. A constant barrage of expensive conferences, vague memberships [1], and over-the-top certification schemes [2]. Not to even mention the obvious self-interests of hyperscalers of setting up this org in the first place.
[1] "The CNCF Silver Membership offers unmatched value across your entire organization. Whether a startup, scale-up, or mid-sized company, get ready to lead, learn, grow, and be recognized in the cloud native ecosystem." https://www.cncf.io/about/join/silver/
[2] "Individuals who have successfully passed every CNCF certification (currently CKA, CKAD, CKS, KCNA, KCSA, PCA, ICA, CCA, CAPA, CGOA, CBA, OTCA, KCA) and LFCS, will receive the title of Golden Kubestronaut for life [...]" https://www.cncf.io/training/kubestronaut/
You volunteer at a nonprofit, and come back from work one day to find the office empty, with the phones ringing. You answer the phone. It’s a user asking for support. You help them and conclude the call, then hang up the phone. It immediately rings. It’s the director of the organization. He’s resigning. As he is explaining that he won’t be coming in to work tomorrow, he wishes you good luck before peremptorily ending the call.
With a look toward your desk with rising anticipation, the phone once again begins to ring…
Do you go in to work the next day? What do you expect to find when you do?
A lot of open source software is developed by people employed by large tech companies, so that complicates ownership structures. I can see companies may view projects that are led by nonprofit orgs, trusts, or other durable formations of collaborators as more stable than those led by individuals or small groups, but perhaps they prefer these structures because they are easier to exert control over by those groups seeking to do so, like CNCF may be doing in the case of OP?