Fairwinds Polaris vs Kubescape

Fairwinds Polaris is an open source policy engine for validating and remediating Kubernetes resource configuration. It includes more than 30 built-in policies, and teams can add their own using JSON Schema. Checks cover security practices such as least privilege, privilege escalation, root execution, and host IPC or PID settings, along with resource requests and limits, readiness and liveness probes, and image tags. Polaris can run as a dashboard, an admission controller, or a command-line tool for checking local YAML files in CI/CD. Its validating webhook rejects workloads that trigger danger-level checks; warning-level findings pass and appear in the dashboard or webhook logs. A mutating webhook or command-line run can automatically remediate supported issues, including missing limits and probes and some unsafe security settings. The dashboard can audit local files or connect to a live cluster, and can be installed with kubectl or Helm. The validating webhook requires a valid TLS certificate. Polaris is free and runs on Linux, macOS, Windows, web, and self-hosted environments.

Kubescape is an open-source platform for Kubernetes security across configuration, images, compliance, and activity in running clusters. It analyzes Kubernetes manifests, Helm charts, and live clusters for misconfigurations. Its operator scans deployed container images for vulnerabilities using Grype and public vulnerability databases, and monitors active clusters for suspicious behavior and threats. Kubescape supports CIS, NSA-CISA, MITRE ATT&CK, and SOC 2 frameworks. Its policy engine uses Open Policy Agent to evaluate Kubernetes objects against posture controls written in Rego; the operator runs as microservices that continuously monitor cluster posture. Integrations are available for GitHub, GitLab CI/CD, Lens, and Visual Studio Code. The CLI can download artifacts for local use, including in offline and air-gapped environments. Results can be exported as JSON or JUnit XML or rendered as HTML or PDF. The CLI and Kubernetes operator are self-hosted and free under Apache License 2.0. ARMO Platform is a compatible provider for uploading scan results and downloading custom artifacts; its price depends on vCPUs and other cloud resources.