Clarifying CRA compliance in Cloud Native
Eddie Knight and Michael Lieberman did a great job at making regulatory topics interesting and tangible; they spoke about the upcoming EU Cyber Resilience Act, which will come into effect over the next 2-3 years and applies to so-called ‘product with digital elements’.
Starting 2027, vendors/manufacturers of these products will have security responsibilities, including e.g. providing SBOMs with their product. Luckily, there will be no liability for individuals, most importantly for maintainers of open-source software.
The exception are businesses (so-called stewards) that hire professionals to maintain and contribute to open-source software. I’m concerned that will keep larger cooperations from employing people and supporting full-time maintainers in their open-source work. This is a vital element of the open-source ecosystem, and losing this form of funding from big tech would be a major setback.
The role of steward is also assumed by the Linux Foundation (LF on the CRA), which takes the helm in supporting other stewards and manufacturers navigate regulations.
Cloud Native Infrastructure for Astronomy workloads
Having a background in astronomy/astrophysics and radio astronomy in particular, it was a pleasure to see Carolina Lindqvist on the keynote stage talking about the data processing setup for the upcoming Square Kilometer Array, which is scheduled to have science verification in 2027 and early operations in 2029. It’s a joint initiative with 12 member states and more partner and observers states, and the two sites for the telescope in South Africa and in Australia.
For the data volume, they are expecting around 600 Pb/year, and the SRCNet organization will be responsible for data storage and distribution.
The data processing will be distributed across 14 regional centers around the globe (mostly universities and affiliated supercomputing centers), with very heterogeneous infrastructure. This is where kubernetes comes in, which is a fantastic tool to homogenise this scattered landscape and allow for a consistent stack to build the data processing suite upon.
I’m particularly interested in the science they’ll be doing on cosmology and on the epoch of reionization in particular, and look forward to an astounding 50 years of planned operations!
Ensuring quality in k8s
Google engineers Antonio Ojea and Benjamin Elder walked us through the process to take kubernetes features from alpha to GA, and dove into the testing process behind these API changes. It was interesting to see the policy nowadays to maintain backward compatibility, and to see some practical tips and tricks from the SIG testings folks about how to design your pipeline for testing new features.
Type safe feature flagging in OpenFeature: Lessons learned at Google
Michael Beemer from Dynatrace and Florin-Mihai Anghel from Google gave a wonderful talk about OpenFeature and showed us how extensively this is currently being used at Google (~70% of dev using feature flags, around 140k flags currently in production). That comes with a lot of potential errors due to type errors or typos when managing the features separately in the flag management system and in the codebase itself.
To address that issue, OpenFeatures now ships with a universal API available for most modern language that allow you to generate the proper flags to import in your codebase, without copying the string values from the flag management system.
Daniel Lenz 