KICS vs kubeconform
KICS
kics.iokubeconform
kubeconform.mandragor.orgSide by side
| Figure | KICS | kubeconform |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Infrastructure Testing Tools | 7.9 (#12) | 7.7 (#14) |
| CI integrations | Documented integrations include Azure Pipelines, Bamboo, Bitbucket Pipelines, CircleCI, Codefresh, GitHub Actions, GitLab CI, Jenkins, TeamCity, Travis, Terraform Cloud, AWS CodeBuild, pre-commit hooks, and AWS CDK. | The documentation shows using Kubeconform with GitHub Actions and GitLab CI through its Docker images. |
| Installation | KICS can be run as a Docker image or built from source; its documentation also provides downloadable releases for Linux, Windows, and macOS. | The official installation guide documents Linux, macOS via Homebrew, and Windows downloads. |
| Purpose | KICS is an open-source static code analysis solution that finds security vulnerabilities, compliance issues, and infrastructure misconfigurations in Infrastructure as Code. | Kubeconform validates Kubernetes manifests so users can catch broken configuration before deploying. |
Plans
In their own words
KICS
KICS is a free, open-source static analysis solution powered by Checkmarx. It scans Infrastructure as Code for security vulnerabilities, compliance issues, and configuration mistakes across Terraform, Kubernetes, Docker, AWS CloudFormation, Ansible, Helm, Google Deployment Manager, AWS SAM, Microsoft ARM, Azure Blueprints, OpenAPI, Pulumi, Crossplane, Knative, and Serverless Framework files. Its security queries can be edited, extended, or supplemented with new queries, using OPA Rego policy language. Documented CI and delivery integrations include GitHub Actions, GitLab CI, Jenkins, Azure Pipelines, CircleCI, Bitbucket Pipelines, Terraform Cloud, AWS CodeBuild, pre-commit hooks, and others. A Visual Studio Code extension can scan automatically. KICS runs as a Docker image, from source, or through downloadable Linux, Windows, and macOS releases. Reports can be exported as JSON, SARIF, GitLab SAST, JUnit, HTML, PDF, CycloneDX, ASFF, or CSV. Terraform functions and environment variables are unsupported, and unofficial or custom Terraform modules are not supported.
kubeconform
Kubeconform is a command-line tool for validating Kubernetes manifests before deployment. It checks files against Kubernetes OpenAPI specifications, helping catch configuration problems before they reach a cluster. Validation and schema downloads run concurrently, and downloaded files are cached in memory. By default, it uses a self-updating fork of the Kubernetes JSON schema registry to supply schemas for recent Kubernetes versions. For custom resources, users can point it to local or remote schemas; local schemas also make offline validation possible. Results can be produced as JSON, JUnit, TAP, or plain text. Documentation describes using its Docker images in GitHub Actions and GitLab CI, and the images are published to GitHub Container Registry. It is free, with a listed plan of free. Installation instructions cover Linux, macOS through Homebrew, and Windows. Its checks do not cover additional server-side validation, and its Go module interface is still work in progress and unstable.