cfn-lint vs kube-score

cfn-lint is a free, open-source validator for AWS CloudFormation YAML and JSON templates. It checks templates against resource provider schemas and applies additional rules, including validation of property values and best practices. AWS Serverless Application Model templates are processed after transformation with AWS SAM. Users can configure built-in checks through command-line options, configuration files, or CloudFormation template metadata, and can add custom rules. Results can be emitted as quiet, parseable, JSON, JUnit, pretty, or SARIF output. Installation options documented by the project include pip, Homebrew for macOS, and Docker; supported Python versions are 3.10 through 3.14. Listed integrations include Atom, Emacs, NeoVim/Vim, Sublime, Visual Studio Code, IntelliJ IDEA, GitHub Actions, and pre-commit. The project treats complex template-value validation as best effort and does not fail merely because it cannot interpret or translate a value. The repository identifies its license as MIT No Attribution, and the plan costs nothing.

kube-score statically analyzes Kubernetes object definitions and recommends changes intended to improve application security and resilience. Its checks cover container limits, NetworkPolicy targeting, PodDisruptionBudget, Pod anti-affinity, container probes, security context, and stable APIs. Optional checks include matching resource requests and limits, container ports, and seccomp profile configuration. You can configure tests to be ignored or enabled globally or for individual objects. kube-score works with Helm, Kustomize, static YAML files, Docker, and resources retrieved from a Kubernetes cluster. Its browser demo accepts Kubernetes YAML or JSON and, according to the maker, processes it in the browser without sending data to a server. Local options include prebuilt binaries for Linux, macOS, and Windows, along with Docker, Homebrew, and Kubernetes Krew. Output formats include human-readable, JSON, CI, and SARIF. In CI/CD, critical errors return exit code 1; warnings can also be set as the exit threshold. The free, MIT-licensed project recommends analyzing all applications deployed to the same namespace together. Building from source requires Go 1.21 or later.