Conftest vs Nirmata Enterprise for Kyverno
Conftest
conftest.devNirmata Enterprise for Kyverno
nirmata.comSide by side
| Figure | Conftest | Nirmata Enterprise for Kyverno |
|---|---|---|
| Price from | Free | $1,233.33/mo |
| Free plan | Yes | — |
| Free trial | — | — |
| Open source | — | — |
| Windows | Yes | — |
| macOS | Yes | — |
| Linux | Yes | Yes |
| Self-hosted | — | Yes |
| Plans published | 1 | 1 |
| Spec score · Infrastructure Policy as Code Tools | 8.5 (#5) | 7.2 (#17) |
| CI integration | The project documents integrations with CircleCI, GitHub Actions and Tekton Pipelines. | Nirmata says its nctl tool can scan Terraform configurations, Dockerfiles, and Kubernetes manifests in CI pipelines. |
| Purpose | Conftest is a utility for writing tests against structured configuration data. | Nirmata Enterprise for Kyverno is an OSS-compatible, no-fork distribution of Kyverno for organizations that need a hardened and supported Kubernetes policy engine. |
| Support | Questions and discussions are directed to the Open Policy Agent Slack channel `#opa-conftest`. | The product includes 24/7 enterprise support with SLAs for CVEs and critical fixes. |
| Target users | Conftest is designed for configuration testing in CI environments. | Nirmata describes the product as intended for businesses that need a trusted distribution and tested, secure build of Kyverno. |
Plans
Nirmata Enterprise for Kyverno
- Nirmata Enterprise for Kyverno$14,800 a year
In their own words
Conftest
Conftest is a free utility for testing structured configuration data, designed for use in CI environments. It uses the Open Policy Agent Rego language to express policies, then evaluates deny, violation, and warning rules within namespaces. Configuration can be read from individual files, directories, multiple files, or standard input. Supported inputs include Kubernetes-style YAML, JSON, HCL and HCL2, Dockerfiles, Terraform-related data, JSONnet, TOML, and XML. Results can be output as plaintext, JSON, TAP, table, JUnit, GitHub, Azure DevOps, or SARIF; the GitHub outputter can annotate test results in workflows. The `conftest verify` command runs policy unit tests. Policies can be pulled from HTTPS URLs, Git repositories, and OCI registries, or pushed to compatible OCI registries. Plugins extend the CLI, with downloads available from sources including OCI, Git, HTTP/HTTPS, Mercurial, and cloud storage. Pre-commit hooks support policy workflows, and integrations are documented for CircleCI, GitHub Actions, and Tekton. Conftest is available for Linux, macOS, and Windows.
Nirmata Enterprise for Kyverno
Nirmata Enterprise for Kyverno has no write-up on Specifiction yet; its figures are above.