kube-score vs terraform-compliance

kube-score statically analyzes Kubernetes object definitions and recommends changes intended to improve application security and resilience. Its checks cover container limits, NetworkPolicy targeting, PodDisruptionBudget, Pod anti-affinity, container probes, security context, and stable APIs. Optional checks include matching resource requests and limits, container ports, and seccomp profile configuration. You can configure tests to be ignored or enabled globally or for individual objects. kube-score works with Helm, Kustomize, static YAML files, Docker, and resources retrieved from a Kubernetes cluster. Its browser demo accepts Kubernetes YAML or JSON and, according to the maker, processes it in the browser without sending data to a server. Local options include prebuilt binaries for Linux, macOS, and Windows, along with Docker, Homebrew, and Kubernetes Krew. Output formats include human-readable, JSON, CI, and SARIF. In CI/CD, critical errors return exit code 1; warnings can also be set as the exit threshold. The free, MIT-licensed project recommends analyzing all applications deployed to the same namespace together. Building from source requires Go 1.21 or later.

terraform-compliance is a free, open-source framework for security and compliance testing of Terraform infrastructure as code. It checks Terraform plan or state output against policies written as behavior-driven feature files, and it can read plan output converted to JSON. Given steps establish context, When steps filter it, and Then steps fail scenarios when conditions are unmet. The project says it works with any Terraform provider and supports Terraform versions newer than 0.12. Checks can run before deployment, in pipelines, or through git hooks. Feature files may come from a local directory or Git repository, with SSH authentication for private repositories. Installation is documented through pip, requiring Python 3.x, or Docker. CI/CD examples cover CircleCI and GitHub Actions. Controls include warning-only failures, skipped-step failures, case-sensitive matching, and resource exclusion. The tool supports policy testing, admission control, and policy reporting, but not runtime enforcement. Its MIT license permits free use.