Side by side
Conftest vs Open Policy Agent Gatekeeper
Both stand on infrastructure policy as code tools. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
Free plan LinuxMacWindows
Conftest provides policy-based configuration checks with a broad set of inputs and CI outputs. Teams can use its integrations, plugins, and pre-commit hooks to fit those checks into existing workflows.
Visit Conftest
Free plan Open source APILinuxSelf-hosted
Gatekeeper combines admission policy controls with recurring audits and customizable policy examples. Installation permissions and audit reporting limits are important operational considerations.
Visit Open Policy Agent GatekeeperThe facts
| Conftest | Open Policy Agent Gatekeeper | |
|---|---|---|
| Free plan | Yes | Yes |
| Open source | Not published | Yes |
| Runs on | Linux, Mac, Windows | API, Linux, Self-hosted |
| Lowest paid plan | Free or on request | Free or on request |
| Plans published | 1 | 2 |
| Maker | Not published | Not published |
| Website | conftest.dev | open-policy-agent.github.io |
| On infrastructure policy as code tools | #6 of 25 | #2 of 25 |
Conftest: what it does well
- Free under the Apache License 2.0.
- Accepts numerous configuration formats and input methods.
- Offers CI-focused output formats, including JUnit and SARIF.
- Policies and plugins can be retrieved from multiple sources.
- Pre-commit hooks cover several policy tasks.
What to know first
- The deprecated instrumenta/conftest image should not be used.
- Questions and discussions are directed to the OPA Slack channel.
Open Policy Agent Gatekeeper: what it does well
- Validation supports deny, warn, dry-run and report modes.
- Mutation policies change resources before validation.
- Periodic audits check existing cluster resources.
- Several installation options are documented.
What to know first
- Installation requires cluster-admin permissions.
- Kubernetes resources from version 1.16 are required.
- Audit reports at most 20 violations by default.
Alternatives to Conftest Alternatives to Open Policy Agent Gatekeeper The whole list