Conftest vs OPA: Policy as Code Compared
They are related, not rival: both use the Rego language. OPA (Open Policy Agent) is a general-purpose policy engine, often run as a service; Conftest is a CLI built on OPA for testing structured config files against Rego policies.
A frequent question is whether to use Conftest or OPA. Conftest wraps the OPA engine to make one job easy: check config files (YAML, JSON, Dockerfile, HCL, and more) against Rego in CI. OPA is the broader engine that also handles runtime authorization. Here is how they relate.
| Conftest | OPA | |
|---|---|---|
| What it is | CLI for testing config files | General policy engine + library |
| Language | Rego | Rego |
| Primary use | CI/CD config checks | Runtime authorization + policy |
| Inputs | YAML/JSON/HCL/Dockerfile/etc. | Any JSON data / API queries |
| Deployment | Run as a CLI step | Server, sidecar, or embedded |
| Relationship | Built on OPA | Underlies Conftest |
Engine vs CLI wrapper
OPA is a full policy engine you can embed in applications, run as a server for admission control (via Gatekeeper) or API authorization, and query at runtime. Conftest narrows that to a developer-friendly CLI: point it at config files and Rego policies, and it passes or fails. If your need is static checks on files in CI, Conftest is the ergonomic choice.
Choosing by use case
Use Conftest to gate pull requests: block a Kubernetes manifest missing resource limits, a Dockerfile running as root, or Terraform with a public bucket. Use OPA when you need policy decisions at runtime, cluster admission control, or a reusable policy service across systems. The Rego you write is portable between them.
In CI
Conftest fits naturally as a fail-fast gate on config files; run it on changed manifests in pull requests. If you already run OPA elsewhere, sharing Rego between runtime policy and Conftest CI checks avoids duplicating rules.
The verdict
Choose Conftest for testing config files against Rego in CI; choose OPA (directly or via Gatekeeper) when you need a general policy engine for runtime authorization or admission control. They share Rego, so investments carry over.