kube-score vs Terratest

kube-score statically analyzes Kubernetes object definitions and recommends changes intended to improve application security and resilience. Its checks cover container limits, NetworkPolicy targeting, PodDisruptionBudget, Pod anti-affinity, container probes, security context, and stable APIs. Optional checks include matching resource requests and limits, container ports, and seccomp profile configuration. You can configure tests to be ignored or enabled globally or for individual objects. kube-score works with Helm, Kustomize, static YAML files, Docker, and resources retrieved from a Kubernetes cluster. Its browser demo accepts Kubernetes YAML or JSON and, according to the maker, processes it in the browser without sending data to a server. Local options include prebuilt binaries for Linux, macOS, and Windows, along with Docker, Homebrew, and Kubernetes Krew. Output formats include human-readable, JSON, CI, and SARIF. In CI/CD, critical errors return exit code 1; warnings can also be set as the exit threshold. The free, MIT-licensed project recommends analyzing all applications deployed to the same namespace together. Building from source requires Go 1.21 or later.

Terratest is an open-source Go library for writing automated tests for infrastructure code. Its helpers cover Terraform, OpenTofu, Terragrunt, Packer, Helm, Docker, and Kubernetes, as well as AWS, Azure, and GCP APIs. Tests can run infrastructure tools, deploy real resources, validate the resulting environment, and remove resources afterward. Validation can use HTTP requests, API calls, SSH connections, and shell commands. The documentation covers unit, integration, and end-to-end tests, along with parallelism, retries, error handling, and static analysis. Terratest runs locally and supports configuration-compliance checks, provisioning tests, deployed checks, and policy as code. The project is free under the Apache 2.0 License. The quick start requires Go 1.26 or later and OpenTofu or Terraform for its examples. The documentation recommends cleaning up after tests because they may create resources in real environments. General questions and issue reports go through GitHub Discussions and Issues; Gruntwork offers commercial support to companies using Terratest in production. The v1 line receives security fixes only while v2 is in development.