# conftest --policy: Point at Shared Policy Bundles

> The conftest --policy/-p flag selects which Rego directory or bundle to evaluate. Reference for combining -p, --data, conftest pull, and the no-policies errors in CI.

Source: https://latchkey.dev/learn/command-reference/conftest-policy-flag  
Updated: 2026-06-30

conftest --policy (or -p) tells conftest which directory or bundle of Rego policies to load, defaulting to ./policy when omitted.

Real pipelines rarely keep policies in the default ./policy path. --policy lets you centralize rules in a shared bundle and point every repo at the same source of truth, which is the crux of consistent org-wide gates.

## What it does

The -p/--policy flag overrides the default policy location for both conftest test and conftest verify. You can repeat it to load multiple directories, and combine it with --data to add non-policy JSON/YAML data documents that the Rego references.

## Common usage

```Terminal
# load a specific policy directory
conftest test -p ./ci-policies deployment.yaml
# load multiple policy sources
conftest test -p base-policy/ -p team-policy/ deployment.yaml
# pull a shared bundle first, then test against it
conftest pull ghcr.io/acme/policies:latest
conftest test -p policy/ deployment.yaml
```

## Options

| Flag | What it does |
| --- | --- |
| -p, --policy <path> | Policy directory or file; repeatable |
| --data <path> | Extra data documents loaded alongside policies |
| -n, --namespace <name> | Which Rego package to evaluate |
| conftest pull <ref> | Download a policy bundle from an OCI registry |
| conftest push <ref> | Publish a policy bundle to an OCI registry |

## In CI

Either vendor the policies into each repo for a fully offline check, or conftest pull a versioned OCI bundle at the start of the job and pin the tag. Repeating -p lets a team layer its own rules on top of an org base bundle without forking it.

## Common errors in CI

"no policies found in [policy]" is the classic sign that -p points at an empty or wrong path, or that you forgot to conftest pull. "error running command: unable to pull" from conftest pull means a bad registry ref or missing auth. If test passes suspiciously fast, confirm -p actually resolved to the directory that holds your deny rules.

## Using this in CI

A runner has no kubeconfig, no cached context, and no interactive auth. Every kubectl invocation in CI needs the context supplied explicitly, and most confusing CI failures here are the command running against the wrong cluster or no cluster at all.

```Terminal
# never rely on the ambient context on a runner
kubectl --context "$KUBE_CONTEXT" -n "$NAMESPACE" get pods

# confirm what you are actually connected to before mutating anything
kubectl config current-context
kubectl cluster-info

# fail fast instead of hanging on an unreachable API server
kubectl --request-timeout=30s get nodes
```

> Always set `--request-timeout` in CI. Without it an unreachable API server hangs until the job times out, which turns a thirty-second failure into a twenty-minute one.

## FAQ

### conftest --policy: Point at Shared Policy Bundles?

Real pipelines rarely keep policies in the default ./policy path. --policy lets you centralize rules in a shared bundle and point every repo at the same source of truth, which is the crux of consistent org-wide gates.

### What it does?

The -p/--policy flag overrides the default policy location for both conftest test and conftest verify. You can repeat it to load multiple directories, and combine it with --data to add non-policy JSON/YAML data documents that the Rego references.

### In CI?

Either vendor the policies into each repo for a fully offline check, or conftest pull a versioned OCI bundle at the start of the job and pin the tag. Repeating -p lets a team layer its own rules on top of an org base bundle without forking it.

### Common errors in CI?

"no policies found in [policy]" is the classic sign that -p points at an empty or wrong path, or that you forgot to conftest pull. "error running command: unable to pull" from conftest pull means a bad registry ref or missing auth. If test passes suspiciously fast, confirm -p actually resolved to the directory that holds your deny rules.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt