Conftest

Overview

Conftest is an open-source command-line utility for checking structured configuration against policies written in Open Policy Agent’s Rego language. It suits infrastructure teams that want policy checks in CI and can maintain policy code. Its broad format and CI support are useful strengths; the trade-off is that teams must supply and manage the rules themselves.

Key features

Conftest accepts configuration from files, directories, multiple files, or standard input, and covers Kubernetes-style YAML, JSON, HCL and HCL2, Dockerfiles, Terraform-related data, JSONnet, TOML, XML, and other formats. That breadth makes it a practical fit for teams checking several kinds of infrastructure configuration with one utility. It evaluates deny, violation, and warn rules, supports namespaces, and can run policy unit tests with conftest verify. Teams can therefore check both the configuration and the policies they use to govern it.

CI results can be emitted as plaintext, JSON, TAP, table, JUnit, GitHub, Azure DevOps, or SARIF. The GitHub outputter can annotate workflow results, and documented integrations cover CircleCI, GitHub Actions, and Tekton Pipelines. These options help route findings into existing workflows, though they do not replace the work of authoring and maintaining Rego policies.

Policies can be pulled from HTTPS URLs, Git repositories, and OCI registries, and pushed to compatible OCI registries. Plugins extend the CLI and can be downloaded from OCI, local files, Git, HTTP or HTTPS, Mercurial, Amazon S3, or Google Cloud Storage. Pre-commit hooks cover testing, verifying, documenting, pulling, and formatting policies. This supports teams that want policy work integrated into their development workflow, while the CLI-centered approach may not suit those seeking a visual policy-management service.

Release assets, checksums, and container images carry GitHub artifact attestations with SLSA provenance signed through Sigstore. Installation options include Homebrew, Scoop, Mise, Docker, and source. Use the documented openpolicyagent/conftest image; the older instrumenta/conftest image is deprecated.

Pricing

Conftest is free. The open-source plan costs free under the Apache License 2.0, so teams can use its policy checks without a software subscription. Its value is strongest where the team can provide the policy-writing and maintenance effort; the free price does not turn it into a managed policy service.

Platforms

Conftest supports Linux, macOS, and Windows. The range gives teams options across common developer environments, with Docker also available as an installation route for container-based workflows.

Who it's for

Conftest is a good fit for platform, infrastructure, and security teams that need custom policy checks across Kubernetes, Terraform, Tekton, Serverless, or other structured configuration in CI. Rego and OPA familiarity—or willingness to build it—is important. Teams seeking prebuilt controls or a managed interface should consider a different approach.

Pros and cons

Broad input coverage: One utility handles multiple structured formats and input methods, which is useful when configuration is spread across files and toolchains.

CI-ready results: Multiple output formats, GitHub annotations, and documented integrations make findings easier to place in existing automation.

Policy workflow support: Unit testing, pre-commit hooks, and policy sharing provide practical support for maintaining custom rules.

Requires policy ownership: Rego policies must be written and maintained by the team, so Conftest is less suitable when users expect turnkey policy management.

Container image transition: Users of the deprecated instrumenta image need to adopt openpolicyagent/conftest.

Alternatives

Consider Chef InSpec if you want a freemium option with a free tier limited to non-production workloads and personal, non-commercial use, plus a 30-day trial. Choose kubeconform for a free alternative with no paid plans or usage limits stated on its official site. Test Kitchen is another free Apache-licensed option, installable through RubyGems, system packages, or Cinc/Chef Workstation.

AWS CloudFormation may fit readers working with AWS: the service itself is free, while underlying AWS resources are billed separately. Sonobuoy is a free open-source alternative. Terratest is an Apache 2.0 open-source project built by Gruntwork. TFLint is a free open-source command-line Terraform linter, while cfn-lint is a free MIT-0 licensed option supporting Python 3.10–3.14.

Browse Infrastructure Testing Tools, Infrastructure as Code Security Software, and Infrastructure Policy as Code Tools for more options.

Verdict

Choose Conftest if your team needs free, CI-oriented policy checks across varied configuration formats and is prepared to own Rego policies. Its breadth of inputs and automation outputs is the main reason to use it; the need to supply and maintain the policy layer is the main reason to look elsewhere.