Skip to content

Conftest: policies for configuration

Security · Policy as Code
Not studied

Added 2026-10-29.

Problem

Requirements like "no privileged", "images only from our own registry", "every Deployment has limits" live in people's heads and in review. One missed manifest — and the rule is broken.

Solution

"Conftest helps you write tests against structured configuration data" — Kubernetes configuration, Tekton pipelines, Terraform code, Serverless configs or any other config files. It "uses the Rego language from Open Policy Agent for writing the assertions". Write the requirements as Rego policies and check YAML, JSON, Dockerfiles and other structured files with them in CI. A policy without tests is unreliable: each one needs an allowed and a denied example.

Example

policy/deployment.rego — Rego v1 syntax, as in the Conftest README:

package main

deny contains msg if {
  input.kind == "Deployment"
  some c in input.spec.template.spec.containers
  c.securityContext.privileged == true
  msg := sprintf("Container %s runs as privileged", [c.name])
}

conftest test k8s/deployment.yaml   # non-zero exit code on a violation
conftest test tests/good.yaml       # must pass
conftest test tests/bad.yaml        # must fail with the policy message

When to use

When the same configuration requirement has been checked by hand more than twice. For Kubernetes manifests — after Kubeconform: schema first, policy second.

Source

How to apply it yourself

  1. Pin the Conftest version.
  2. Write one policy and two files: good.yaml passes, bad.yaml fails.
  3. Add conftest test to CI before deploy.
  4. Mark it "Studied" once CI has stopped at least one real violating manifest.