KICS vs kube-score

KICS is a free, open-source static analysis solution powered by Checkmarx. It scans Infrastructure as Code for security vulnerabilities, compliance issues, and configuration mistakes across Terraform, Kubernetes, Docker, AWS CloudFormation, Ansible, Helm, Google Deployment Manager, AWS SAM, Microsoft ARM, Azure Blueprints, OpenAPI, Pulumi, Crossplane, Knative, and Serverless Framework files. Its security queries can be edited, extended, or supplemented with new queries, using OPA Rego policy language. Documented CI and delivery integrations include GitHub Actions, GitLab CI, Jenkins, Azure Pipelines, CircleCI, Bitbucket Pipelines, Terraform Cloud, AWS CodeBuild, pre-commit hooks, and others. A Visual Studio Code extension can scan automatically. KICS runs as a Docker image, from source, or through downloadable Linux, Windows, and macOS releases. Reports can be exported as JSON, SARIF, GitLab SAST, JUnit, HTML, PDF, CycloneDX, ASFF, or CSV. Terraform functions and environment variables are unsupported, and unofficial or custom Terraform modules are not supported.

kube-score statically analyzes Kubernetes object definitions and recommends changes intended to improve application security and resilience. Its checks cover container limits, NetworkPolicy targeting, PodDisruptionBudget, Pod anti-affinity, container probes, security context, and stable APIs. Optional checks include matching resource requests and limits, container ports, and seccomp profile configuration. You can configure tests to be ignored or enabled globally or for individual objects. kube-score works with Helm, Kustomize, static YAML files, Docker, and resources retrieved from a Kubernetes cluster. Its browser demo accepts Kubernetes YAML or JSON and, according to the maker, processes it in the browser without sending data to a server. Local options include prebuilt binaries for Linux, macOS, and Windows, along with Docker, Homebrew, and Kubernetes Krew. Output formats include human-readable, JSON, CI, and SARIF. In CI/CD, critical errors return exit code 1; warnings can also be set as the exit threshold. The free, MIT-licensed project recommends analyzing all applications deployed to the same namespace together. Building from source requires Go 1.21 or later.