Performing extended checks with conftest

Open Policy Agent (OPA) (https://www.openpolicyagent.org) is an engine that can validate objects prior to performing a change on them. Its main advantage lies in the fact that it doesn’t come with a predefined list of checks; instead, it supports extensible policies as they are based on rules created in the Rego language (https://www.openpolicyagent.org/docs/latest/policy-language/). You might have heard of OPA in conjunction with Kubernetes: that it can be used like an admission controller (a part usually handled by the Gatekeeper project: https://github.com/open-policy-agent/gatekeeper) in order to add a pre-validation of the objects you want to apply in a cluster. OPA is really successful at adding policy-as-code checks for Kubernetes, but it is more than that: it is an engine that can be run almost everywhere we have a runtime, including in our CI/CD pipelines.

For Kubernetes, you can create your own custom rules to be enforced...