Fairwinds Polaris vs Snyk IaC

Fairwinds Polaris is an open source policy engine for validating and remediating Kubernetes resource configuration. It includes more than 30 built-in policies, and teams can add their own using JSON Schema. Checks cover security practices such as least privilege, privilege escalation, root execution, and host IPC or PID settings, along with resource requests and limits, readiness and liveness probes, and image tags. Polaris can run as a dashboard, an admission controller, or a command-line tool for checking local YAML files in CI/CD. Its validating webhook rejects workloads that trigger danger-level checks; warning-level findings pass and appear in the dashboard or webhook logs. A mutating webhook or command-line run can automatically remediate supported issues, including missing limits and probes and some unsafe security settings. The dashboard can audit local files or connect to a live cluster, and can be installed with kubectl or Helm. The validating webhook requires a valid TLS certificate. Polaris is free and runs on Linux, macOS, Windows, web, and self-hosted environments.

Snyk IaC has no write-up on Specifiction yet; its figures are above.