Checkov is a static analysis tool for Infrastructure as Code (IaC) security and compliance. It scans Terraform, CloudFormation, Kubernetes, Helm, Dockerfile, ARM, Bicep, and many other IaC frameworks against thousands of built-in policies covering AWS, Azure, GCP, and other cloud providers. The tool operates as a CLI application and can also be used as a Python library or integrated into CI/CD pipelines. Its architecture is modular, with separate runners per framework, a graph-based analysis engine for cross-resource checks, and a pluggable check registry system. Checkov also includes software composition analysis (SCA) for container images and packages, secrets detection, and integration with the Bridgecrew/Prisma Cloud platform for policy management and reporting.
This repository is a comprehensive library of Kyverno policies for Kubernetes, providing a curated collection of Validating, Mutating, Generating, and Cleanup policies. It covers Pod Security Standards (baseline and restricted), best practices, RBAC restrictions, image registry controls, and integrations with ecosystem tools like Istio, Linkerd, Karpenter, and ArgoCD. The policies are written as YAML manifests using Kyverno's CEL-based API (policies.kyverno.io/v1) and are accompanied by extensive test suites using both Chainsaw and Kyverno CLI frameworks. The repository serves as a reference implementation and distribution channel for Kyverno users, with standardized metadata (ArtifactHub), CI/CD pipelines, and contribution guidelines. While not a traditional application, it functions as a policy-as-code library with a strong emphasis on security and operational best practices.