kube-score vs Sonobuoy

kube-score statically analyzes Kubernetes object definitions and recommends changes intended to improve application security and resilience. Its checks cover container limits, NetworkPolicy targeting, PodDisruptionBudget, Pod anti-affinity, container probes, security context, and stable APIs. Optional checks include matching resource requests and limits, container ports, and seccomp profile configuration. You can configure tests to be ignored or enabled globally or for individual objects. kube-score works with Helm, Kustomize, static YAML files, Docker, and resources retrieved from a Kubernetes cluster. Its browser demo accepts Kubernetes YAML or JSON and, according to the maker, processes it in the browser without sending data to a server. Local options include prebuilt binaries for Linux, macOS, and Windows, along with Docker, Homebrew, and Kubernetes Krew. Output formats include human-readable, JSON, CI, and SARIF. In CI/CD, critical errors return exit code 1; warnings can also be set as the exit threshold. The free, MIT-licensed project recommends analyzing all applications deployed to the same namespace together. Building from source requires Go 1.21 or later.

Sonobuoy is a free, open-source diagnostic tool for examining Kubernetes cluster state with non-destructive configuration tests. It can check a cluster against official Kubernetes specifications and produce diagnostics for troublesome workloads. Teams can build plugins for additional tests and data collection. Its default plugins run Kubernetes end-to-end tests and gather systemd logs; community options include CIS Benchmarks, Kube-hunter, Who-can, Cluster-Inventory, and Reliability Scanner. It is cluster agnostic and officially supports the latest three minor Kubernetes versions. Beginning with version 0.20, it supports Kubernetes 1.17 or later. Sonobuoy can run end-to-end tests with custom registries in air-gapped deployments. It requires an active Kubernetes cluster and an admin kubeconfig, and can be installed from binary releases or through Homebrew on macOS. The project provides community support through GitHub. Its documentation warns that default settings need explicit hardening, and notes that some logging and retrieval commands can fail on Docker Desktop Kubernetes.