

Sharing policies

Policies are often reusable between different projects, and Conftest supports a mechanism to specify dependent policies as well as download them. The format reuses the Bundle defined by Open Policy Agent.

Pulling

The pull command allows you to download policies using either a URL, a specific protocol (such as git), or an OCI Registry.

HTTPS

conftest pull https://raw.githubusercontent.com/open-policy-agent/conftest/master/examples/compose/policy/deny.rego

Git

conftest pull git::https://github.com/<Organization>/<Repository>.git//sub/folder

Git (with access token)

conftest pull git::https://<PersonalAccessToken>@github.com/<Organization>/<Repository>.git//sub/folder

OCI Registry

conftest pull oci://opa.azurecr.io/test

Always include the oci:// scheme for private or on-premises registries. This explicitly tells Conftest to use its OCI downloader instead of trying to infer the source type from the registry hostname:

conftest pull oci://registry.example.com/team/policies:latest

See the go-getter repository for more examples.

Pushing to an OCI registry

Policies can be stored in OCI registries that support the artifact specification mentioned above. Conftest accomplishes this by leveraging ORAS.

For example, if you have a compatible OCI registry you can push a new policy bundle like so:

conftest push opa.azurecr.io/test

--update flag

If you want to download the latest policies and run the tests in one go, you can do so with the --update flag:

conftest test --update <url(s)> <file-to-test>

For example, to update policies from a private OCI registry before testing a Kubernetes manifest:

conftest test --update oci://registry.example.com/team/policies:latest deployment.yaml