Conftest

Conftest is a configuration-testing utility built on Open Policy Agent. It applies policies written in Rego to structured data such as Kubernetes configurations, Tekton pipelines, Terraform code, Serverless configurations, and other supported inputs. You can check files, directories, several files together, or standard input. Its rules cover denials, violations, and warnings, with namespaces for organizing policies; `conftest verify` runs policy unit tests. Results can be produced in formats including JSON, TAP, JUnit, GitHub, Azure DevOps, and SARIF, and the GitHub output can annotate findings in workflows. Policies can be pulled from HTTPS URLs, Git repositories, or OCI registries, and pushed to compatible OCI registries. Plugins extend the CLI, while pre-commit hooks cover policy testing, verification, documentation, pulling, and formatting. Conftest runs on Linux, macOS, and Windows, and can be installed through Homebrew, Scoop, Mise, Docker, or from source. The free plan is free under the Apache License 2.0.

Conftest brings structured configuration checks, policy unit tests, and multiple CI-oriented output formats into one utility. It is a fit for teams comfortable writing Rego policies and incorporating checks into their configuration workflow.

Conftest suits teams that need to check structured configuration as part of CI, including users working with Kubernetes or Terraform. It may also suit teams that want policy tests and results integrated with GitHub Actions, CircleCI, or Tekton Pipelines.

Overview

Conftest checks structured configuration against policies written in Rego, Open Policy Agent’s policy language. It is best suited to infrastructure teams that want policy checks in CI and are prepared to maintain policy code. Its format coverage and automation outputs are useful strengths; teams seeking a visual, managed policy service should look elsewhere.

Key features

Conftest accepts Kubernetes-style YAML, JSON, HCL/HCL2, Dockerfiles, Terraform-related data, JSONnet, TOML, XML, and other formats. It can inspect a file, directory, group of files, or standard input, so teams can place checks at different points in a configuration workflow. It evaluates deny, violation, and warn rules, supports namespaces, and can target Kubernetes configurations, Tekton pipelines, Terraform code, Serverless configurations, and other structured data.

The conftest verify command runs policy unit tests, extending checks beyond configuration to the rules themselves. That is useful for teams building a dependable policy set, though it adds another body of Rego code to author and maintain.

For CI, outputs include plaintext, JSON, TAP, table, JUnit, GitHub, Azure DevOps, and SARIF. The GitHub outputter can annotate configuration test results in workflows, and documented integrations cover CircleCI, GitHub Actions, and Tekton Pipelines. This range makes results easier to fit into different pipelines; it does not remove the need to configure and own those pipelines.

Policies can be pulled from HTTPS URLs, Git repositories, and OCI registries, then pushed to compatible OCI registries. Plugins extend the CLI and can be downloaded from OCI, local files, Git, HTTP/HTTPS, Mercurial, Amazon S3, or Google Cloud Storage. Pre-commit hooks cover testing, verifying, documenting, pulling, and formatting policies, which can bring policy maintenance closer to the work that changes configurations.

Release assets, checksums, and container images carry GitHub artifact attestations with SLSA provenance signed through Sigstore. Installation options include Homebrew, Scoop, Mise, Docker, or source. The instrumenta/conftest image is deprecated; users should use openpolicyagent/conftest. Questions and discussions go to the Open Policy Agent Slack channel #opa-conftest.

Pricing

Conftest is free and open source under Apache License 2.0. The Open-source Conftest plan costs free. The free plan includes policy checks, Terraform and Kubernetes analysis, custom policies, and pull request scanning. There are no paid tiers or plan-based quotas in the available plan details, making it a practical option for teams that can supply the policy expertise and CI setup themselves.

Platforms

Conftest supports Linux, macOS, and Windows. Its installation options span package managers, Docker, and source, giving teams several ways to fit it into their development environments.

Who it's for

Conftest is a strong fit for platform, infrastructure, and DevOps teams that already work with Rego or are willing to adopt it, especially when configuration checks need to run in CI. Its broad input support helps teams working across infrastructure formats. It is less suitable for organizations that want policy enforcement without writing and maintaining code.

Pros and cons

• Pros: Broad configuration-format support makes one utility applicable across varied infrastructure files.
• Pros: Multiple CI output formats, including GitHub annotations and SARIF, help route results into existing workflows.
• Pros: Policy unit testing and pre-commit hooks support checks on both policies and the configurations they govern.
• Cons: Rego policies require teams to take on policy authoring and upkeep rather than relying on a turnkey visual interface.
• Cons: The deprecated instrumenta/conftest image makes it important to choose the current openpolicyagent/conftest image when using Docker.

Alternatives

• Google Cloud Terraform Policy Validation is another free option for Linux, macOS, and Windows; its gcloud beta terraform vet plan is a client-side tool available at no charge.
• Open Policy Agent is a free, open-source policy engine under Apache License 2.0. Choose it when you want the underlying policy engine rather than Conftest’s configuration-testing utility.
• Terraform may suit readers seeking a broader infrastructure-as-code product; its Free plan includes 500 managed resources, one concurrent remote run, and one concurrent agent run.
• Cloud Custodian is a free, open-source option under Apache 2.0 for readers comparing other infrastructure policy tools.
• Google Config Sync includes Config Sync with Google Kubernetes Engine, but requires a supported cluster version and fleet registration.
• terraform-compliance is a free, open-source Terraform compliance testing framework and is a focused alternative for Terraform compliance checks.
• AWS CloudFormation is a free service for CloudFormation itself, though underlying AWS resources are billed at their own rates.
• cfn-lint is a free MIT-0 licensed option for readers comparing tools in this space.

Explore more in Infrastructure Policy as Code Tools, Infrastructure Testing Tools, and Infrastructure as Code Security Software.

Verdict

Choose Conftest if your team wants free, CI-oriented configuration testing across several infrastructure formats and can work with Rego. Its combination of policy checks, unit tests, and automation-friendly results is the reason to pick it; the main reason to look elsewhere is the need to author and maintain policies in code.