Hello everyone, We've encountered something puzzli...
# opal
b
Hello everyone, We've encountered something puzzling during our OPAL Client migration from 0.8.3 to 0.9.0, and I'd really appreciate some clarification. What we did: 1. Updated OPAL Client to 0.9.0 2. Initially enabled compatibility mode (
OPAL_OPA_V0_COMPAT=true
) as recommended 3. Then disabled compatibility mode (
OPAL_OPA_V0_COMPAT=false
) to test breaking changes 4. Expected our policies to fail (since we didn't add
.v1
to package names) What actually happened: Everything continues to work perfectly, even with compatibility mode disabled. Here's our policy structure:
Copy code
package data.role  # No .v1 suffix - should this fail in strict v1 mode?

import rego.v1

import data.utils.v1.functions.jwt as functions_jwt
import data.utils.v1.roles as roles

default allow := false

allow if {
    functions_jwt.user_has_role(roles.admin)
    input.action == "get-roles"
}
According to the migration guide, without
.v1
suffix and with compatibility mode disabled, this should fail. But it doesn't. My questions: 1. Is
import rego.v1
now sufficient for v1 compatibility, making the package
.v1
suffix optional? 2. Has something changed in OPAL 0.9.0 that we're not aware of? 3. Are we possibly misunderstanding how compatibility mode works? We want to ensure we're not missing something important before rolling this out to other environments. Thanks for any insights!
a
Hi @Bartosz Wasilewski, I'm an AI assistant for Permit.io. I'll analyze available sources and get back to you shortly.
Based on the documentation, you're experiencing expected behavior with OPA v1 and
import rego.v1
. Let me clarify what's happening: Understanding
import rego.v1
vs Package
.v1
Suffix
The
import rego.v1
statement you're using is actually the modern way to enable OPA v1 compatibility (1) . When you use
import rego.v1
, it automatically enables v1 syntax for that entire module, making the
.v1
package suffix unnecessary . How Compatibility Mode Works According to the migration guide, when
OPAL_OPA_V0_COMPAT
is set (2) : • `true`: OPA accepts both v0 and v1 syntax • `false`: OPA runs in strict v1 mode The compatibility mode is controlled by the
OPAL_OPA_V0_COMPAT
setting, which can be configured as :
Copy code
# Enable v0 compatibility (default in v0.9.x)  
export OPAL_OPA_V0_COMPAT=true  
  
# Disable v0 compatibility  
export OPAL_OPA_V0_COMPAT=false
Why Your Policies Still Work Your policies continue to work because you're using
import rego.v1
, which is the correct v1 syntax (1) . The migration guide shows two approaches (2) : 1. Adding
.v1
suffix to package declarations 2. Using
import rego.v1
(which you're already doing) Since you're using
import rego.v1
, your policies are already v1-compliant, which is why they work even with compatibility mode disabled. OPAL 0.9.x Defaults In OPAL v0.9.x,
OPAL_OPA_V0_COMPAT
defaults to
true
for easier migration . The documentation states that OPAL v0.10.0+ will have this unconfigured (effectively
false
) by default . Your understanding is correct - you've already migrated to v1 syntax by using
import rego.v1
, so disabling compatibility mode doesn't break your policies.
To learn more, see the sources I considered: [[1] OPA v1 is Almost Out! Here’s What You Need to Know](https://www.permit.io/blog/whats-new-on-opa-v1) [[2] OPA Version Migration Guide](https://docs.opal.ac/tutorials/opa-version-migration)
o
Hey @Bartosz Wasilewski , OPA v1 doesn't require all your packages to finish with .v1, there are few breaking changes between v0 and v1 in the rego syntax, and for that they have the following migration guide: 1. Your initial setup - running with OPA v0 and rego syntax v0 2. update your OPA server version with v0 compatible flag ( in OPAL it means changing the env var to true ) 3. update your rego to the v1 syntax 4. Perform opa check or build with opa v1 to verify your rego is in v1 syntax 5. update your OPA server without the v0 compatible flag ( in OPAL it means updating the env var to false ) From what I see your rego is compatible with v1 as it has the if keyword after the rule name, note that as far as I recall the import rego.v1 is not needed when running with v1 OPA. This migration guide summary above is written in the OPA docs also with more details and explanations, would recommend reading it thoroughly before doing the migration on production
b
Hi @Omer Zuarets this makes sense now. Appreciate the detailed explanation.
💜 1