Conftest

Visit Website

Introduction

Conftest is a utility for writing tests against structured configuration data. The policies are written in Rego, the Open Policy Agent language, and Conftest runs them against files such as Kubernetes manifests, Tekton pipelines, Terraform code, Serverless configs, Dockerfiles or any JSON, YAML, HCL, TOML, INI or XML document.

It exists to make OPA easy to use in CI. Instead of wiring the OPA engine into a pipeline yourself, you place policies in a policy/ directory and run conftest test deployment.yaml. Rules named deny, violation or warn produce failures or warnings with readable messages, and the exit code fails the build when a deny rule matches.

Conftest understands many file formats out of the box, can parse multiple files together, and can pull shared policies from OCI registries, Git or HTTP so one central policy repository serves many projects. It also has a verify command that runs Rego unit tests for the policies themselves.

In the quality loop, Conftest is a lightweight release gate for configuration. It catches problems like containers running as root, missing resource limits or unapproved base images before anything is applied to a cluster or cloud account.

The source code is at open-policy-agent/conftest on GitHub under the Apache-2.0 licence, with about 3,300 stars; the most recent commit was on 11 November 2026.

Features

1. Many formats: YAML, JSON, HCL, TOML, INI, XML, Dockerfile, CUE and more.
2. deny and warn rules: Distinguish hard failures from advisory warnings.
3. Policy sharing: conftest pull fetches policies from OCI registries, Git or HTTP.
4. Policy tests: conftest verify runs unit tests for Rego rules.
5. Multiple outputs: Table, JSON, TAP, JUnit and GitHub annotations for CI.
6. Namespaces: Organise policies by namespace and select them per run.

Pros

1. Simple CI integration: One binary and one command per check.
2. Free to use: Open source under the Apache-2.0 licence, so the core tool costs nothing to use.
3. Actively maintained: The repository had commits as recent as 11 November 2026.
4. Community: About 3,300 GitHub stars.

Cons

1. Rego required: Teams still need to learn OPA’s language.
2. Static only: It checks files, not live cluster state.
3. Policy authoring: No large built-in rule set; you write or import rules.

Usage and Links (Example)

# policy/deployment.rego
cat > policy/deployment.rego <<'R'
package main
deny contains msg if {
  input.kind == "Deployment"
  not input.spec.template.spec.securityContext.runAsNonRoot
  msg := "Containers must not run as root"
}
R

conftest test k8s/deployment.yaml
conftest test --output junit k8s/ > conftest.xml

Resources:

• Conftest website
• GitHub repository

Pricing

Conftest is free and open source under the Apache-2.0 licence.

Recommended for?

1. Teams already using OPA who want the same rules in CI.
2. Platform teams enforcing configuration standards across many repositories.
3. Projects with mixed config formats that need one checking tool.

Conclusion

Conftest is the quickest way to bring policy-as-code into a pipeline. It keeps OPA’s power while hiding most of the integration work.

If your team can invest in a small Rego policy library, Conftest gives you a fast, format-agnostic gate for configuration changes.

On CheckOps, Conftest is filed under the Release & CI gates and Security testing stages. Related tools listed here include Open Policy Agent, Checkov, KICS, Kyverno, KubeLinter and Hadolint. Which one fits best depends mostly on your stack, your team’s size and skills, and whether you prefer to run tools yourself or pay for a managed service. This page reflects the official website, documentation and repository as they stood on 11 November 2026.