apache / apache/camel-kamelets

Detect Vulnerabilities in Kamelets / Containers

Open
#558 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
71
Forks
88
Avg merge
1d 13h
Merged PRs (30d)
70

Description

## Problem
I am working on evaluating Kamelets from different point of views. One of them is the question, how to make sure containers that are spun up during the creation of an integration (whether with java or kamelets, I guess it doesn't matter for now) are **safe**.

Because there is no Code in Kamelets I quickly discarded the idea of Code-Scanning dependencies in Kamelets. Seems like there is neither a feature in Camel-K, nor another external tool that helps with that.

## Possible Solution
I read about **Container Scanning**, and found some tools related to it like [Clair](https://github.com/quay/clair), [Trivy](https://github.com/aquasecurity/trivy) and the [Container Scanning Feature in Snyk](https://docs.snyk.io/products/snyk-container)

## Questions
* But is there an accepted / proven way to do something like a container scan of containers that are generated by Camel-K from a KameletBinding? Does anyone have experience with that?

* Is there something planned in the future in terms of scanning the dependencies directly from the Kamelet without building the container?

* Bonus Question: When using Camel-K with minikube, how to access the actual images created from the Kamelets?

Alex

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the KameletBinding-generated container flow and the listed Clair, Trivy, and Snyk options. Investigate how Camel-K with minikube exposes the generated images and whether dependencies can be scanned without building a container. Done means documenting an accepted scanning approach and answers to the issue's three questions.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, java, kubernetes
Domain
cloud, devops, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.