Conftest vs kube-score

Conftest is a free utility for testing structured configuration data, designed for use in CI environments. It uses the Open Policy Agent Rego language to express policies, then evaluates deny, violation, and warning rules within namespaces. Configuration can be read from individual files, directories, multiple files, or standard input. Supported inputs include Kubernetes-style YAML, JSON, HCL and HCL2, Dockerfiles, Terraform-related data, JSONnet, TOML, and XML. Results can be output as plaintext, JSON, TAP, table, JUnit, GitHub, Azure DevOps, or SARIF; the GitHub outputter can annotate test results in workflows. The `conftest verify` command runs policy unit tests. Policies can be pulled from HTTPS URLs, Git repositories, and OCI registries, or pushed to compatible OCI registries. Plugins extend the CLI, with downloads available from sources including OCI, Git, HTTP/HTTPS, Mercurial, and cloud storage. Pre-commit hooks support policy workflows, and integrations are documented for CircleCI, GitHub Actions, and Tekton. Conftest is available for Linux, macOS, and Windows.

kube-score statically analyzes Kubernetes object definitions and recommends changes intended to improve application security and resilience. Its checks cover container limits, NetworkPolicy targeting, PodDisruptionBudget, Pod anti-affinity, container probes, security context, and stable APIs. Optional checks include matching resource requests and limits, container ports, and seccomp profile configuration. You can configure tests to be ignored or enabled globally or for individual objects. kube-score works with Helm, Kustomize, static YAML files, Docker, and resources retrieved from a Kubernetes cluster. Its browser demo accepts Kubernetes YAML or JSON and, according to the maker, processes it in the browser without sending data to a server. Local options include prebuilt binaries for Linux, macOS, and Windows, along with Docker, Homebrew, and Kubernetes Krew. Output formats include human-readable, JSON, CI, and SARIF. In CI/CD, critical errors return exit code 1; warnings can also be set as the exit threshold. The free, MIT-licensed project recommends analyzing all applications deployed to the same namespace together. Building from source requires Go 1.21 or later.