[opensourcedex]

polaris is a free, open source compliance & risk management project written in Go and released under Apache-2.0. It has 3,387 GitHub stars, 231 forks and 17 open issues, and was last pushed 32 hours ago. On this registry it ranks #22 of 45 tracked projects in Compliance & Risk Management, with 5 head-to-head comparisons available. It gained 1 stars over the last 3 tracked days.

What is polaris?

What it is

Polaris is an open-source policy engine for Kubernetes, written in Go and released under the Apache-2.0 license. It lives in the Kubernetes ecosystem and supports cluster auditing, best-practice validation, and a dashboard.

The concrete problem it addresses is inconsistent or unsafe Kubernetes configuration. It validates resources against more than 30 built-in policies and supports custom policies with JSON Schema. It can also remediate configuration issues when run on the command line or as a mutating webhook.

Key capabilities

  • Polaris validates Kubernetes resources against policy-as-code through a dashboard.
  • It can operate as an admission controller that rejects or modifies non-compliant workloads.
  • It can run as a command-line tool to test local YAML files in a CI/CD process.
  • It includes more than 30 built-in configuration policies for common Kubernetes checks.
  • It supports custom policies written with JSON Schema for organization-specific rules.
  • It can remediate issues based on policy criteria in command-line or mutating webhook mode.
  • It publishes signed, immutable container images, with full version tags or digest pinning recommended.

Who uses it and how

  • Users can run the Polaris dashboard to audit Kubernetes clusters and review policy violations.
  • Users can use the admission controller to block or modify non-compliant workloads during deployment.
  • Users can run Polaris locally or in CI/CD to validate YAML manifests before applying them to a cluster.
  • Users can create custom JSON Schema policies to encode internal Kubernetes standards beyond the built-in checks.

Getting started

The README points to docs.fairwinds.com and lists the container image as us-docker.pkg.dev/fairwinds-ops/oss/polaris, replacing the deprecated quay.io/fairwinds/polaris image. Users can run Polaris as a dashboard, an admission controller, or a command-line tool, using full version tags or digest pinning for immutable images.

When to use it — and when not to

Polaris is suitable when a team wants an open-source Kubernetes policy engine for cluster auditing, admission control, and manifest testing. It may be less suitable when an organization needs the multi-cluster tracking, Slack, Datadog, and Jira integrations that the README associates with Fairwinds Insights. Self-hosters must operate the dashboard or admission controller and manage image updates, signed tags, and digest pinning, because the provided facts do not describe a hosted Polaris service.

project readme (upstream, from github) — read inline
Polaris Logo

Polaris is an open source policy engine for Kubernetes

Polaris is an open source policy engine for Kubernetes that validates and remediates resource configuration. It includes 30+ built in configuration policies, as well as the ability to build custom policies with JSON Schema. When run on the command line or as a mutating webhook, Polaris can automatically remediate issues based on policy criteria.

Polaris can be run in three different modes:

  • As a dashboard - Validate Kubernetes resources against policy-as-code.
  • As an admission controller - Automatically reject or modify workloads that don't adhere to your organization's policies.
  • As a command-line tool - Incorporate policy-as-code into the CI/CD process to test local YAML files.

Polaris Architecture

Documentation

Check out the documentation at docs.fairwinds.com

Notice: Registry Migration and Immutable Images (v10.1.8 → v10.2.0)

Starting with v10.2.0:

  • Images moved to us-docker.pkg.dev/fairwinds-ops/oss/polaris
  • quay.io/fairwinds/polaris is deprecated

Required action

- quay.io/fairwinds/polaris:<tag>
+ us-docker.pkg.dev/fairwinds-ops/oss/polaris:<tag>

Immutable and signed images

  • Images are now signed

  • Tags are immutable

  • No more floating tags:

    • v10
    • v10.1
    • latest

Use full version tags:

us-docker.pkg.dev/fairwinds-ops/oss/polaris:v<major>.<minor>.<patch>

Or pin by digest:

us-docker.pkg.dev/fairwinds-ops/oss/polaris@sha256:<digest>

Join the Fairwinds Open Source Community

The goal of the Fairwinds Community is to exchange ideas, influence the open source roadmap, and network with fellow Kubernetes users. Chat with us on Slack

Other Projects from Fairwinds

Enjoying Polaris? Check out some of our other projects:

  • Goldilocks - Right-size your Kubernetes Deployments by compare your memory and CPU settings against actual usage
  • Pluto - Detect Kubernetes resources that have been deprecated or removed in future versions
  • Nova - Check to see if any of your Helm charts have updates available
  • rbac-manager - Simplify the management of RBAC in your Kubernetes clusters

Or check out the full list

Fairwinds Insights

If you're interested in running Polaris in multiple clusters, tracking the results over time, integrating with Slack, Datadog, and Jira, or unlocking other functionality, check out Fairwinds Insights, a platform for auditing and enforcing policy in Kubernetes clusters.

Frequently asked questions

Is polaris free to use?

polaris is open source under the Apache-2.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does polaris do?

Validation of best practices in your Kubernetes clusters

What is polaris written in?

polaris is primarily written in Go. Its source is publicly available at https://github.com/FairwindsOps/polaris, and it has 3,387 GitHub stars.