Luca BertonCloud infrastructure software faces some of the CRA's most stringent requirements. Hypervisors (EN 304 635), container runtime systems, and firewalls/IDS/IPS (EN 304 636) are classified as Important Class II — requiring mandatory third-party conformity assessment.
What's Affected
- Hypervisors — VMware ESXi, KVM, Hyper-V, Xen when sold as products
- Container runtimes — Docker Engine, containerd, CRI-O, Podman when distributed commercially
- Firewalls — Both hardware appliances and software firewalls (pfSense, OPNsense commercial editions)
- IDS/IPS — Snort, Suricata, and commercial equivalents
Kubernetes and the CRA
Kubernetes itself is an interesting case. The open-source project (maintained by CNCF) falls under the steward provisions. But commercial Kubernetes distributions — Red Hat OpenShift, Rancher, Tanzu — are commercial products subject to full CRA obligations.
Kubernetes Recipes
A practical guide for container orchestration and deployment by Grzegorz Stencel & Luca Berton (Apress).
Watch on Skillshare →Impact on Platform Engineering
If you build internal developer platforms using these components, you're a user, not a manufacturer. But your vendors must be CRA compliant. This means:
- Vendor due diligence should include CRA conformity status
- Component selection should factor in the vendor's CRA readiness
- Long-term support and security update commitments become contractual requirements