CFRipper vs Kyverno
CFRipper
github.comKyverno
kyverno.ioSide by side
| Figure | CFRipper | Kyverno |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | Yes | Yes |
| Web | Yes | Yes |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 2 | 2 |
| Spec score · Infrastructure as Code Security Software | 8.9 (#4) | 8.4 (#8) |
| Documentation | The README links to a dedicated Read the Docs documentation site. | The documentation covers installation, policy types, testing, reporting, monitoring, tracing, security, troubleshooting, high availability and CLI usage. |
| Project status | PyPI classifies CFRipper as production/stable software. | The CNCF lists Kyverno as a Graduated project, with graduation recorded in March 2026. |
| Purpose | CFRipper is a library and CLI security analyzer for AWS CloudFormation templates that aims to prevent vulnerable infrastructure from reaching production. | Kyverno is a Kubernetes-native policy engine for defining and enforcing policy as code. |
| What it does | CFRipper analyzes AWS CloudFormation templates for security and compliance problems before deployment. | Kyverno is a cloud-native policy engine for automating Kubernetes security, compliance, governance and best-practice checks. |
Plans
In their own words
CFRipper
CFRipper is a free, open-source Python library and command-line security analyzer for AWS CloudFormation templates. It examines template files to help keep vulnerable infrastructure from reaching production. The CLI accepts templates as arguments and can return text or JSON findings, with an option to save results in an output folder. Example findings include wildcard principals and IAM role policies that grant excessive permissions. Rules can be configured with a rules file and filters folder, and users can add plugins for their own compliance checks. Documented exit codes distinguish successful scans, scanning errors, invalid templates, and unhandled exceptions. CFRipper runs on Linux, macOS, Windows, or as self-hosted software. The project uses uv for dependencies, provides installation instructions for those operating systems, and is distributed under the Apache License 2.0. Its analysis scope is CloudFormation; Terraform and Kubernetes are not supported.
Kyverno
Kyverno is a free, open-source policy engine for defining and enforcing policy as code in Kubernetes. Its stable policy types can validate, mutate, generate or delete resources, and verify container image signatures and attestations. The Kyverno CLI can test policies against Kubernetes resource manifests in CI before they are applied to a live cluster. Documentation describes use with Helm, YAML manifests, GitHub Actions and GitOps tools such as ArgoCD. Kyverno is installed in a Kubernetes cluster; Helm is recommended for production, and YAML manifests are also available. A standard installation requires an admission controller, while background, reports and cleanup controllers are optional. Production installations should use high availability mode. The project supports CEL-based policy types and describes applying Kubernetes-style policies outside Kubernetes as part of its mission. Its webhooks default to fail-closed, so matching requests can fail if the API server cannot reach Kyverno. The project documents Cosign signatures for images and manifests, and lists CLI binaries for Linux, macOS and Windows.