kube-score vs Serverspec

kube-score statically analyzes Kubernetes object definitions and recommends changes intended to improve application security and resilience. Its checks cover container limits, NetworkPolicy targeting, PodDisruptionBudget, Pod anti-affinity, container probes, security context, and stable APIs. Optional checks include matching resource requests and limits, container ports, and seccomp profile configuration. You can configure tests to be ignored or enabled globally or for individual objects. kube-score works with Helm, Kustomize, static YAML files, Docker, and resources retrieved from a Kubernetes cluster. Its browser demo accepts Kubernetes YAML or JSON and, according to the maker, processes it in the browser without sending data to a server. Local options include prebuilt binaries for Linux, macOS, and Windows, along with Docker, Homebrew, and Kubernetes Krew. Output formats include human-readable, JSON, CI, and SARIF. In CI/CD, critical errors return exit code 1; warnings can also be set as the exit threshold. The free, MIT-licensed project recommends analyzing all applications deployed to the same namespace together. Building from source requires Go 1.21 or later.

Serverspec is an open-source Ruby gem for writing RSpec tests that verify server configuration. It examines actual machine state by executing commands locally or through SSH, WinRM, and the Docker API, without requiring agent software on target servers. Checks cover packages, services, files, ports, users, Docker containers and images, Windows features, and X.509 certificates and private keys. Both RSpec should and expect syntax are supported. Serverspec can accompany Puppet, Ansible, CFEngine, Itamae, and Chef, with infrastructure-code refactoring stated as its central aim. The tutorial names Linux distributions, macOS, Windows, BSD systems, Solaris, SmartOS, and others, while noting incomplete support for some. Each suite targets one machine or Docker container, so separate RSpec commands are advised for separate targets. Install through Bundler or gem install serverspec. It is MIT licensed and maintained by Gosuke Miyashita.