Conftest

Overview

Conftest is a command-line utility for checking configuration against policies written in Rego, the language used by Open Policy Agent. It suits teams that want policy checks inside CI and are comfortable working with policy code. Its breadth of input and CI output options is a strong fit for varied infrastructure workflows, though it is not a turnkey visual policy-management service.

Key features

Conftest checks Kubernetes-style YAML, JSON, HCL and HCL2, Dockerfiles, Terraform-related data, JSONnet, TOML, XML, and other formats. Teams can pass a single file, a directory, multiple files, or standard input, making it practical to place checks at different points in a configuration workflow. It evaluates deny, violation, and warn rules and supports namespaces, while conftest verify runs policy unit tests. That combination lets teams validate both their configurations and the policies governing them.

For automation, output can be plaintext, JSON, TAP, table, JUnit, GitHub, Azure DevOps, or SARIF. The GitHub outputter can annotate results in workflows; documented integrations also cover CircleCI and Tekton Pipelines. This range helps fit results into existing CI systems, but users still need to author and maintain the Rego policies.

Policies can be pulled from HTTPS URLs, Git repositories, and OCI registries, and pushed to compatible OCI registries. Plugins extend the CLI and can be downloaded through OCI, local files, Git, HTTP or HTTPS, Mercurial, Amazon S3, or Google Cloud Storage. Pre-commit hooks cover testing, verifying, documenting, pulling, and formatting policies. These options support shared policy workflows, although they add moving parts for teams that only need a small set of local checks.

Conftest releases, checksums, and container images carry GitHub artifact attestations with SLSA provenance signed through Sigstore. It can be installed with Homebrew, Scoop, Mise, Docker, or from source. The old instrumenta/conftest container image is deprecated; deployments using a container should use openpolicyagent/conftest instead.

Pricing

Open-source Conftest costs free under the Apache License 2.0. The free plan includes the policy-checking utility; no paid plan, seat cap, or usage quota is part of this offering. It is a compelling option when a team can operate its own policy workflow, but the project directs questions and discussions to the Open Policy Agent Slack #opa-conftest channel rather than offering a paid support tier.

Platforms

Conftest runs on Linux, macOS, and Windows. The choice of Homebrew, Scoop, Mise, Docker, or source installation gives teams several ways to match installation to their environment.

Who it's for

Conftest is best for infrastructure and platform teams that already use OPA or are prepared to write Rego policies, and want configuration checks in CI. Its support for Kubernetes, Terraform, Tekton, Serverless, and other structured data suits teams governing more than one configuration type. Readers looking for a point-and-click interface or policy checks without writing rules should look elsewhere.

Pros and cons

• Pros: Broad input coverage. YAML, JSON, HCL/HCL2, Dockerfiles, JSONnet, TOML, and XML support makes one tool useful across varied configuration sources.
• Pros: CI-friendly reporting. GitHub annotations and formats such as JUnit, Azure DevOps, and SARIF help deliver findings where teams work.
• Pros: Policy workflow support. Verification, pre-commit hooks, policy sharing, and extensible plugins cover more than just running a check.
• Cons: Rego is central to the workflow. Teams that do not want to write and maintain policy code may find Conftest a poor fit.
• Cons: Community-oriented support. Questions go to the OPA Slack channel, which may not suit organizations needing formal vendor support.

Alternatives

For AWS-focused infrastructure provisioning, choose AWS CloudFormation when its AWS service model is a better fit; CloudFormation itself is free, while underlying AWS resources are billed at their own rates. Test Kitchen is another free, Apache-licensed option for readers seeking a different infrastructure testing tool. For CloudFormation template linting specifically, cfn-lint is a free alternative.

Chef InSpec offers a free plan limited to non-production workloads and personal, non-commercial use, plus a 30-day trial; consider it when those terms and its approach better match the intended use. Cinc Auditor is a free distribution of Chef InSpec, with no formal warranties or support. OpenSCAP is a free open-source option for readers comparing infrastructure security tools. TFLint is a free command-line Terraform linter, while KICS is a free open-source infrastructure policy-as-code project.

Browse Infrastructure Testing Tools, Infrastructure as Code Security Software, and Infrastructure Policy as Code Tools for more options by category.

Verdict

Choose Conftest if your team wants free, CI-oriented configuration policy checks across multiple formats and can work in Rego. Its flexible inputs, integrations, and policy tooling are the main reasons to pick it; teams that need a visual workflow or formal support should look elsewhere.