⚖️ Kafka image : wurstmeister vs. bitnami

adriens - Jun 29 '22 - - Dev Community

❔ Context

We recenlty did operate maintenance on our interal (yet public repo) that helps us internally promote Kafka practices :

GitHub logo opt-nc / atelier-spring-kafka

Projet d'exemple d'utilisation de la lib `org.springframework.kafka:spring-kafka`

Project Website Confluent tutorial

A propos

Ce projet explique comment développer un producer/consumer sans la lib interne historique au profit de celle développée et maintenue par Spring.

📝 Description

Projet d'exemple d'utilisation de la lib org.springframework.kafka:spring-kafka

Pré-requis

  • Instance kafka
  • docker & docker-compose (si utilisation de kafka.yml)

👶 Kafka ?! WTF

Avant de passer à la suite, prendre soin de consulter les ressources ci-dessous:

🧑‍🎓 Supports custome

📜 Scripts

1️⃣ Initialiser le topic demo.user

Entrer dans le container kafka :

docker exec -ti kafka bash

Créer le producer :

kafka-console-producer.sh --broker-list kafka:9092 --topic demo.user --property "parse.key=true" --property "key.separator=|"

Copier les lignes (inclure la dernière ligne vide) :

112233|{"phoneNumber":"112233", "firstName":"Hubert", "lastName":"Bonisseur de la Bath"}
998877|{"phoneNumber":"998877", "firstName":"Jean", "lastName":"Soudajman"}
446655|{"phoneNumber":"446655", "firstName":"Henri", "lastName":"Tathan"}

2️⃣ Ecriture automatique dans le topic demo.sms

Initialiser le topic demo.user par

☝️ We also do apply a maintenance strategy on this content like :

We created a dedicated issue to upgrade to Kafka 3.2, we switched from wurstmeister/kafka to bitnami/kafka (by vmWare) cf our configuration change.

🛡️ Security concerns

☝️ Each time we use a new Docker image, we also focus on the security part.

👉 This post is about the comparison of these two images security levels.

grype --add-cpes-if-none wurstmeister/kafka:latest \
    | grep Critical \
    | wc -l
# 14
grype bitnami/kafka:latest \
    | grep Critical \
    | wc -l
# 5
Enter fullscreen mode Exit fullscreen mode
Criticity wurstmeister/kafka:latest bitnami/kafka:latest
☣️Critical 14 5
High 34 17
Medium 16 9
⚠️Low 9 9
🪶Negligible 68 66
Unknown 15 13

📊 Charts

Image description

Image description

🤔 The Unknown Criticity

Wondering what means Unknown Criticity ? Check the answer below :

❔ What does Unknown mean ❔ #807

What happened

When analyzin Bitnami Kafka image I felt on the Unknown value :

grype bitnami/kafka:3.2 | grep Unknown

image

👉 So I don't knwo what to answer to the security team

✔️ What you expected to happen

I was expecting to get one of the following values :

  • Critical
  • High
  • Medium
  • Low
  • Negligible

🔁 Step to reproduce

grype bitnami/kafka:3.2 | grep Unknown

Environment

grype version:

Version:              0.40.0
Syft Version:         v0.48.1
BuildDate:            2022-06-17T16:15:24Z
GitCommit:            0703bae9778e661e2cc21d5caa816cda30472b14
GitDescription:       v0.40.0

🐧 OS

NAME="Linux Mint"
VERSION="20.3 (Una)"
ID=linuxmint
ID_LIKE=ubuntu
PRETTY_NAME="Linux Mint 20.3"
VERSION_ID="20.3"
HOME_URL="https://www.linuxmint.com/"
SUPPORT_URL="https://forums.linuxmint.com/"
BUG_REPORT_URL="http://linuxmint-troubleshooting-guide.readthedocs.io/en/latest/"
PRIVACY_POLICY_URL="https://www.linuxmint.com/"
VERSION_CODENAME=una
UBUNTU_CODENAME=focal

📦 Apache Kafka packaged by Bitnami

GitHub logo bitnami / bitnami-docker-kafka

Bitnami Docker Image for Kafka

In order to unify the approaches followed for Bitnami containers and Bitnami Helm charts, we are moving the different bitnami/bitnami-docker-<container> repositories to a single monorepo bitnami/containers. Please follow bitnami/containers to keep you updated about the latest Bitnami images.

More information here: https://blog.bitnami.com/2022/07/new-source-of-truth-bitnami-containers.html

Apache Kafka packaged by Bitnami

What is Apache Kafka?

Apache Kafka is a distributed streaming platform designed to build real-time pipelines and can be used as a message broker or as a replacement for a log aggregation solution for big data applications.

Overview of Apache Kafka

Trademarks: This software listing is packaged by Bitnami. The respective trademarks mentioned in the offering are owned by the respective companies, and use of them does not imply any affiliation or endorsement.

TL;DR

Run the application using Docker Compose

The main folder of this repository contains a functional docker-compose.yml file. Run the application using it as shown below:

$ curl -sSL
Enter fullscreen mode Exit fullscreen mode

🔖 Resources

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .