open-policy-agent/conftest

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

3274 stars · 363 forks observed · 2026-09-30

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Conftest is a CLI utility for writing tests against structured configuration data using the Open Policy Agent Rego language. It validates files like Kubernetes manifests, Terraform code, and Tekton pipelines against deny/warn policy rules, commonly in CI pipelines.

Use cases

• validate kubernetes manifests against policies in ci
• test terraform code for security misconfigurations
• write policy-as-code tests for config files
• enforce that containers don't run as root
• lint structured configuration with rego policies
• generate documentation from policy metadata

When to choose

• you want policy-as-code validation of Kubernetes, Terraform, or other structured configs
• your team already uses Open Policy Agent and Rego
• you need a lightweight CLI that fits into CI/CD pipelines

When to avoid

• you need runtime admission enforcement rather than static config testing (use OPA Gatekeeper)
• you prefer writing validation rules in a non-Rego language
• you only need simple YAML/JSON schema validation without policy logic

Facets

cli-tool · maturity active

testing security configuration-management cli ci-cd developer-tools testing infrastructure-as-code security windows cli go rego open-policy-agent policy-as-code kubernetes terraform configuration-validation devops linux macos docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="open-policy-agent/conftest")