Fairwinds Polaris

Fairwinds Polaris is a free, open-source policy engine for validating and remediating Kubernetes resource configuration. It includes more than 30 built-in policies, and teams can add custom checks using JSON Schema. Checks cover security practices such as privilege escalation, root execution, read-only root filesystems, and host IPC or PID settings, as well as resource requests and limits, readiness and liveness probes, host network and port use, and image tags and pull policies.

Polaris can run as a dashboard, an admission controller, or a command-line tool that checks local YAML files in CI/CD. Its validating webhook rejects workloads that trigger danger-level checks; warning-level findings pass and are recorded in the dashboard or webhook logs. A mutating webhook or command-line run can automatically correct supported issues, including missing limits and probes and some unsafe security settings. The dashboard can audit local files or connect to a cluster using KUBECONFIG credentials. It can be installed with kubectl or Helm; the validating webhook requires a valid TLS certificate. Fairwinds Insights can retain findings across clusters and provide remediation guidance.

Polaris offers several ways to check Kubernetes configuration, from local CI/CD files to cluster admission. Teams should account for the TLS requirement on the validating webhook and the limited scope of automatic remediation.

Polaris suits Kubernetes teams that want to check configuration practices in local YAML files or cluster workloads. It is also relevant to teams seeking automated fixes for supported issues.

Overview

Fairwinds Polaris is an open-source policy engine for checking Kubernetes resource configuration. It suits Kubernetes teams that want to catch configuration problems in deployment files and clusters. Its range of checks and run modes is useful, but admission enforcement brings a TLS certificate requirement.

Key features

Polaris includes more than 30 built-in policies, with custom policies available through JSON Schema. It checks security settings such as privilege escalation, root execution, read-only root filesystems, and host IPC or PID use. It also covers reliability through readiness and liveness probes, efficiency through CPU and memory requests and limits, and image practices by flagging missing or latest tags and checking image pull policy. The breadth suits teams looking to apply routine configuration standards alongside security checks.

Polaris can run as a dashboard, an admission controller, or a command-line tool. The CLI checks local YAML files in CI/CD, while the dashboard can audit local files or connect to a cluster using credentials in KUBECONFIG. Teams can install the dashboard in a cluster with kubectl or Helm, or run it locally. This gives teams options to review configuration before deployment or inspect a live cluster.

At admission, the validating webhook rejects workloads that trigger danger-level checks. Warning-level issues pass validation and appear in the dashboard or webhook logs, which lets teams distinguish blocking findings from those to review. The mutating webhook and CLI can automatically fix supported issues, including missing resource limits and probes and some unsafe security settings. Remediation is therefore useful for selected policy findings, but it does not remove the need to address issues outside that supported set.

Polaris integrates with Fairwinds Insights, which records findings across clusters and provides remediation guidance. Fairwinds points to Insights for multi-cluster history and integrations with Slack, Datadog, and Jira. Polaris container images are signed and use immutable tags; its documentation recommends full version tags or digest pinning. Fairwinds says it is SOC 2 Type II compliant.

Pricing

Polaris (Open Source): free. The free plan is an open-source policy engine aimed at small teams. It includes the policy engine without a paid tier or trial term to weigh. Teams needing multi-cluster history and integrations with Slack, Datadog, and Jira can look to Fairwinds Insights.

Platforms

Polaris supports Linux, macOS, Windows, self-hosted deployments, and web access. Its Kubernetes analysis can run in a cluster or locally, with the CLI covering local YAML files in CI/CD.

Who it's for

Polaris is a strong fit for Kubernetes teams that want configuration checks across local manifests, CI/CD, and cluster admission, especially small teams seeking an open-source policy engine. Teams that need multi-cluster history or broader integrations should consider Fairwinds Insights. Organizations that require admission validation should be prepared to install and maintain a valid TLS certificate for the validating webhook.

Pros and cons

• Broad Kubernetes coverage: More than 30 built-in policies cover security, reliability, resource sizing, and image settings.
• Flexible placement: Dashboard, webhook, and CLI modes let teams check local files and cluster workloads.
• Selective automatic remediation: The CLI and mutating webhook can fix supported issues, including missing limits and probes.
• Admission setup requirement: The validating webhook needs a valid TLS certificate, adding an operational prerequisite for teams enforcing policies at admission.
• Remediation has a defined scope: Automatic fixes apply to supported findings, so teams still need to handle other policy issues.

Alternatives

Choose Conftest if you want a free, open-source policy testing option for Linux, macOS, or Windows. Open Policy Agent is another free open-source policy engine, with API, self-hosted, and web platforms as well as Linux, macOS, and Windows support. Google Cloud Terraform Policy Validation is a free beta client-side tool for Terraform policy validation. For infrastructure policy and security options, see Infrastructure Policy as Code Tools, Kubernetes Security Software, and Infrastructure as Code Security Software.

Verdict

Choose Fairwinds Polaris if your Kubernetes team wants a free policy engine that can check manifests in CI/CD, audit cluster configuration, and enforce danger-level findings during admission. Its broad built-in checks and multiple run modes make it a practical fit for small teams standardizing Kubernetes configuration. Look elsewhere if you need multi-cluster history and integrations, or if the validating webhook's TLS requirement is a poor fit for your deployment operations.