https://github.com/instrumenta/conftest

Write tests against structured configuration data using the Open Policy Agent Rego query language
https://github.com/instrumenta/conftest

kubernetes open-policy-agent openpolicyagent rego testing

Last synced: about 1 month ago
JSON representation

Write tests against structured configuration data using the Open Policy Agent Rego query language

• Host: GitHub
• URL: https://github.com/instrumenta/conftest
• Owner: open-policy-agent
• License: other
• Created: 2019-03-28T17:12:29.000Z (over 5 years ago)
• Default Branch: master
• Last Pushed: 2024-04-11T08:17:11.000Z (5 months ago)
• Last Synced: 2024-04-11T16:01:06.208Z (5 months ago)
• Topics: kubernetes, open-policy-agent, openpolicyagent, rego, testing
• Language: Go
• Homepage: https://conftest.dev
• Size: 3.93 MB
• Stars: 2,783
• Watchers: 27
• Forks: 296
• Open Issues: 31
• Metadata Files:
  • Readme: README.md
  • Contributing: CONTRIBUTING.md
  • License: LICENSE
  • Code of conduct: CODE_OF_CONDUCT.md
  • Security: SECURITY.md

Awesome Lists containing this project

• awesome - conftest - Write tests against structured configuration data using the Open Policy Agent Rego query language (Go)
• awesome-devsecops - Conftest - _Instrumenta_ - Create custom tests to scan any configuration file for security flaws. (Tools / Static Analysis)

README

        
# Conftest

[![Go Report Card](https://goreportcard.com/badge/open-policy-agent/opa)](https://goreportcard.com/report/open-policy-agent/conftest) [![Netlify](https://api.netlify.com/api/v1/badges/2d928746-3380-4123-b0eb-1fd74ba390db/deploy-status)](https://app.netlify.com/sites/vibrant-villani-65041c/deploys)

Conftest helps you write tests against structured configuration data. Using Conftest you can

write tests for your Kubernetes configuration, Tekton pipeline definitions, Terraform code,

Serverless configs or any other config files.

Conftest uses the Rego language from [Open Policy Agent](https://www.openpolicyagent.org/) for writing

the assertions. You can read more about Rego in [How do I write policies](https://www.openpolicyagent.org/docs/how-do-i-write-policies.html)

in the Open Policy Agent documentation.

Here's a quick example. Save the following as `policy/deployment.rego`:

```rego

package main

deny[msg] {

  input.kind == "Deployment"

  not input.spec.template.spec.securityContext.runAsNonRoot

  msg := "Containers must not run as root"

}

deny[msg] {

  input.kind == "Deployment"

  not input.spec.selector.matchLabels.app

  msg := "Containers must provide app label for pod selectors"

}

```

Assuming you have a Kubernetes deployment in `deployment.yaml` you can run Conftest like so:

```console

$ conftest test deployment.yaml

FAIL - deployment.yaml - Containers must not run as root

FAIL - deployment.yaml - Containers must provide app label for pod selectors

2 tests, 0 passed, 0 warnings, 2 failures, 0 exceptions

```

Conftest isn't specific to Kubernetes. It will happily let you write tests for any configuration files in a variety of different formats. See the [documentation](https://www.conftest.dev/) for [installation instructions](https://www.conftest.dev/install/) and

more details about the features.

## Want to contribute to Conftest?

* See [DEVELOPMENT.md](DEVELOPMENT.md) to build and test Conftest itself.

* See [CONTRIBUTING.md](CONTRIBUTING.md) to get started.

For discussions and questions join us on the [Open Policy Agent Slack](https://slack.openpolicyagent.org/)

in the `#opa-conftest` channel.