Conftest — Test Structured Config with Open Policy Agent

What it is

Conftest is a command-line tool for writing tests against structured configuration data using the Rego policy language from Open Policy Agent (OPA). It validates Kubernetes manifests, Terraform plans, Dockerfiles, and any structured format (JSON, YAML, TOML, HCL) against custom policies you define.

Conftest is for platform engineers and DevOps teams who want to enforce configuration standards automatically. Instead of reviewing YAML files by hand for security misconfigurations or missing labels, you write policies once and run them in CI.

How it saves time or tokens

This workflow provides the installation command and a starter policy structure. Instead of learning OPA from scratch and figuring out how to integrate it with your config files, you get a working conftest setup with a deny policy template. Running conftest test against your configs takes seconds and catches issues that manual reviews miss.

How to use

1. Install Conftest:

brew install conftest

1. Create a policy directory and write your first Rego policy:

mkdir policy
cat > policy/deny.rego << 'EOF'
package main

deny[msg] {
  input.kind == "Deployment"
  not input.spec.template.spec.securityContext.runAsNonRoot
  msg := "Deployments must set runAsNonRoot to true"
}

deny[msg] {
  input.kind == "Deployment"
  not input.spec.template.metadata.labels.app
  msg := "Deployments must have an app label"
}
EOF

1. Test your configuration files:

conftest test deployment.yaml
# FAIL - deployment.yaml - Deployments must set runAsNonRoot to true

Example

# policy/dockerfile.rego
package main

deny[msg] {
  input[i].Cmd == "from"
  val := input[i].Value[0]
  val == "latest"
  msg := "Do not use latest tag in FROM statements"
}

deny[msg] {
  input[i].Cmd == "run"
  contains(input[i].Value[0], "curl")
  not contains(input[i].Value[0], "--fail")
  msg := "curl commands should use --fail flag"
}

# Test a Dockerfile
conftest test --parser dockerfile Dockerfile

Related on TokRepo

• Security tools -- Policy enforcement and security scanning tools
• DevOps tools -- Infrastructure and configuration management tools

Common pitfalls

• Rego syntax is different from imperative languages. The biggest confusion is that Rego rules are declarative assertions, not if-else blocks. Read the OPA documentation on Rego basics before writing complex policies.
• Conftest expects policies in a policy/ directory by default. Use --policy flag to specify a different path.
• Terraform plan output must be converted to JSON with terraform show -json plan.tfplan before Conftest can test it. Raw plan files are not supported.