conftest

Why we included this project

Conftest lets you write tests for your configuration files before they ever reach a cluster. You define assertions in Rego, the policy language from Open Policy Agent, and run them against Kubernetes manifests, Terraform plans, Tekton pipelines, or any other structured data. That turns rules like 'containers must not run as root' into executable checks instead of tribal knowledge. It reads a wide range of formats, including YAML, JSON, HCL, Dockerfile, and TOML, so the same policy approach works across your stack. Teams that want to catch misconfigurations in CI rather than after a rollout will find it a practical, low-ceremony way to enforce guardrails.