Originally reported by Container Journal (July 2019). This article expands on the original announcement for a DevOps engineering audience.
What Is Fairwinds Polaris?
Fairwinds announced the open source release of Polaris, a Kubernetes configuration validation tool designed to help engineering teams avoid common misconfiguration mistakes. Polaris can be run as a self-hosted dashboard, as an admission webhook inside a cluster, or as a command-line tool in a CI/CD pipeline. Fairwinds also offered it as a hosted service for teams that prefer a managed approach.
The motivation behind Polaris is straightforward: Kubernetes exposes an enormous number of configuration options, and the gap between a working cluster and a well-configured cluster is significant. Teams that are new to Kubernetes often omit resource limits, run containers as root, or skip liveness and readiness probes — issues that only become visible under production load.
Core Components
Polaris ships with two primary operational modes:
- Dashboard: A web UI that connects to a running cluster and scores deployed workloads against a set of best-practice checks. Each check is rated by severity, giving teams a prioritised view of configuration debt across namespaces and deployments.
- Admission Webhook: A validating admission webhook that intercepts resource creation and update requests. Depending on how Polaris is configured, it can either warn teams about policy violations or actively block non-compliant workloads from reaching a production cluster.
A command-line interface is also available, enabling Polaris checks to be embedded directly into a CI/CD pipeline so configuration problems are caught before a manifest ever reaches the cluster.
What Polaris Checks For
Polaris evaluates workload manifests against a configurable set of checks. At launch, the built-in checks covered areas including:
- CPU and memory resource requests and limits being set on containers
- Containers running as root or with unnecessary privilege escalation
- Missing liveness and readiness probes
- Use of the latest image tag instead of a pinned version
- Host networking, host PID, and host IPC settings
- Read-only root filesystems
Teams can customise the severity thresholds — marking certain checks as warnings rather than hard failures — and can extend or override the default policy file to match their own standards.
Why Kubernetes Misconfiguration Is a Real Problem
Kubernetes is highly flexible by design, which means that a cluster can be operational without being secure, efficient, or reliable. Common misconfiguration consequences include:
- Node instability: Containers without resource limits can consume all available CPU or memory on a node, triggering evictions across unrelated workloads.
- Security exposure: Containers running as root or with privilege escalation create an enlarged attack surface if a workload is compromised.
- Deployment fragility: Missing health probes mean Kubernetes cannot accurately determine whether a pod is ready to serve traffic, increasing the risk of routing requests to unhealthy instances.
- Cluster sprawl: Without automated guardrails, teams working independently may provision multiple single-purpose clusters that each carry their own misconfiguration risk.
Tools like Polaris shift configuration quality checks left — catching problems at the manifest or CI stage rather than after a production incident.
Polaris in a CI/CD Pipeline
Fairwinds designed Polaris with CI/CD integration in mind. The CLI can be pointed at a directory of Kubernetes manifests or at a Helm chart output and will return a pass/fail result that a pipeline can act on. A typical integration looks like this:
# Run Polaris audit against local manifests and fail the build
# if the score falls below a defined threshold
polaris audit --audit-path ./k8s-manifests \
--set-exit-code-on-danger \
--set-exit-code-below-score 80Code language: PHP (php)This approach means configuration policy is enforced consistently across every merge, not just when a human reviewer happens to notice a problem.
Managed Service vs. Self-Hosted
At launch, Fairwinds offered Polaris both as a self-hosted open source project and as part of its managed Kubernetes service. According to Fairwinds CEO Bill Ledingham, many customers were expected to ask Fairwinds to operate Polaris alongside their Kubernetes clusters. However, the open source nature of the project also makes it straightforward for other managed service providers or internal platform teams to adopt it without vendor dependency.
Addressing the Kubernetes Expertise Gap
One of the structural challenges Polaris aims to address is the gap between the widespread adoption of Kubernetes and the depth of expertise available to operate it well. As Ledingham noted at the time, while many enterprises had adopted Kubernetes, the proportion of actual production workloads running on it remained relatively small — partly because provisioning a production-grade cluster correctly requires significant knowledge.
By codifying best practices into an automated tool, Polaris gives teams a starting point they can refine over time, reducing the documentation burden and providing a machine-enforceable baseline that survives staff turnover and organisational change.
Getting Started with Polaris
Polaris is open source and maintained by Fairwinds on GitHub. To install the dashboard in-cluster using Helm:
helm repo add fairwinds-stable https://charts.fairwinds.com/stable
helm install polaris fairwinds-stable/polaris \
--namespace polaris \
--create-namespaceCode language: PHP (php)Once deployed, port-forward to the dashboard service to review the configuration audit results for your cluster. Refer to the official Polaris GitHub repository for current installation instructions, as the project has evolved since its 2019 launch.
Summary
Polaris fills a genuine gap in the Kubernetes ecosystem by automating the enforcement of configuration best practices. Whether used as a read-only dashboard, a blocking admission webhook, or a CI/CD gate, it reduces the risk of misconfigured workloads reaching production and gives platform teams a reproducible, auditable standard to work from.