apache / apache/camel-kamelets
Detect Vulnerabilities in Kamelets / Containers
- Dominant language
- Java
- Stars
- 71
- Forks
- 88
- Avg merge
- 1d 13h
- Merged PRs (30d)
- 70
Description
## Problem
I am working on evaluating Kamelets from different point of views. One of them is the question, how to make sure containers that are spun up during the creation of an integration (whether with java or kamelets, I guess it doesn't matter for now) are **safe**.
Because there is no Code in Kamelets I quickly discarded the idea of Code-Scanning dependencies in Kamelets. Seems like there is neither a feature in Camel-K, nor another external tool that helps with that.
## Possible Solution
I read about **Container Scanning**, and found some tools related to it like [Clair](https://github.com/quay/clair), [Trivy](https://github.com/aquasecurity/trivy) and the [Container Scanning Feature in Snyk](https://docs.snyk.io/products/snyk-container)
## Questions
* But is there an accepted / proven way to do something like a container scan of containers that are generated by Camel-K from a KameletBinding? Does anyone have experience with that?
* Is there something planned in the future in terms of scanning the dependencies directly from the Kamelet without building the container?
* Bonus Question: When using Camel-K with minikube, how to access the actual images created from the Kamelets?
Alex
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the KameletBinding-generated container flow and the listed Clair, Trivy, and Snyk options. Investigate how Camel-K with minikube exposes the generated images and whether dependencies can be scanned without building a container. Done means documenting an accepted scanning approach and answers to the issue's three questions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, java, kubernetes
- Domain
- cloud, devops, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100