Keynote: Cutting Through the Fog: Clarifying CRA Compliance in Cloud Native
Talkat KubeCon + CloudNativeCon Europe 2025 · on Friday, 2025-04-04· at 09:39· Level 0 | ICC Auditorium·
summary
European Cyber Resilience Act goes into full effect in 2027 with a first enforceable reporting duty on Dec 11, 2026 for known exploitable vulnerabilities, maintainers are explicitly out of personal legal scope while manufacturers assume liability, stewards get case‑by‑case lighter rules, and products split into critical / important / class 1 bands (class 2 and critical require third‑party assessment; class 1 needs self‑assessment). Linux Foundation projects roll tools like LFX insights and the OpenSSF Security Baseline and work with OpenTelemetry, Flux, measurery and oscal compass to make assessments practical.
AI-written summary · about
chapters (8)
- 0:00CRA compliance challenges
- 1:26What the Cyber Resilience Act is
- 3:36CRA timeline milestones
- 5:46Roles under CRA
- 8:40Open-source product categorization
- 10:46Kubernetes liability example
- 12:53Linux Foundation compliance support
- 14:42Call to action for maintainers
related talks
46mLinux Foundation Initiatives Supporting the Implementation of the EU Cyber Resilience Act
33mImplementing the EU Cyber Resilience Act (CRA)
53mThe EU CRA Readiness for Contributors and Maintainers : A Survival Toolkit
32mHow to stay compliant with and take benefits from the EU CRA (Cyber Resilience Act)
22mEU Cyber Resilience Act - A Product Owner’s Approach
42mMaking EU CRA (Cyber Resilience Act) simplified and non-scary for OSS contributors
53mHow To Stay Compliant With and Take Benefits From the EU CRA (Cyber Resilience Act)
44mPanel Discussion: Prepare for the CRA: Open Source Governance in the Age of Cyber Resilience