AWS CloudFormation vs Sonobuoy

AWS CloudFormation models, provisions, and manages related AWS and third-party resources as infrastructure as code. YAML or JSON templates define AWS resources and their properties. StackSets deploy a common set of resources across multiple AWS accounts and Regions; Change Sets preview proposed stack updates, including possible deletion or replacement, and Drift Detection tracks changes made outside the service. For authoring, AWS CDK supports TypeScript, Python, Java, and .NET, while AWS SAM offers shorthand YAML for serverless resources that is converted during deployment. The CloudFormation Registry supports third-party resources and modules, and stacks can be updated from remote Git repositories. The service is available through API, Linux, macOS, web, and Windows, and manages state. CloudFormation itself has a free plan, with no additional charge for AWS and Alexa resource providers, but created AWS resources are billed at their standard rates. Third-party provider and custom hook operations may also incur charges. Access can be managed with IAM, and CloudTrail logs API calls.

Sonobuoy is a free, open-source diagnostic tool for examining Kubernetes cluster state with non-destructive configuration tests. It can check a cluster against official Kubernetes specifications and produce diagnostics for troublesome workloads. Teams can build plugins for additional tests and data collection. Its default plugins run Kubernetes end-to-end tests and gather systemd logs; community options include CIS Benchmarks, Kube-hunter, Who-can, Cluster-Inventory, and Reliability Scanner. It is cluster agnostic and officially supports the latest three minor Kubernetes versions. Beginning with version 0.20, it supports Kubernetes 1.17 or later. Sonobuoy can run end-to-end tests with custom registries in air-gapped deployments. It requires an active Kubernetes cluster and an admin kubeconfig, and can be installed from binary releases or through Homebrew on macOS. The project provides community support through GitHub. Its documentation warns that default settings need explicit hardening, and notes that some logging and retrieval commands can fail on Docker Desktop Kubernetes.