Bartosz Wasilewski
11/26/2025, 8:31 AMOPAL_OPA_V0_COMPAT=true) as recommended
3. Then disabled compatibility mode (OPAL_OPA_V0_COMPAT=false) to test breaking changes
4. Expected our policies to fail (since we didn't add .v1 to package names)
What actually happened: Everything continues to work perfectly, even with compatibility mode disabled.
Here's our policy structure:
package data.role # No .v1 suffix - should this fail in strict v1 mode?
import rego.v1
import data.utils.v1.functions.jwt as functions_jwt
import data.utils.v1.roles as roles
default allow := false
allow if {
functions_jwt.user_has_role(roles.admin)
input.action == "get-roles"
}
According to the migration guide, without .v1 suffix and with compatibility mode disabled, this should fail. But it doesn't.
My questions:
1. Is import rego.v1 now sufficient for v1 compatibility, making the package .v1 suffix optional?
2. Has something changed in OPAL 0.9.0 that we're not aware of?
3. Are we possibly misunderstanding how compatibility mode works?
We want to ensure we're not missing something important before rolling this out to other environments.
Thanks for any insights!Ask Inkeep
11/26/2025, 8:31 AMAsk Inkeep
11/26/2025, 8:31 AMimport rego.v1. Let me clarify what's happening:
Understanding import rego.v1 vs Package .v1 Suffix
The import rego.v1 statement you're using is actually the modern way to enable OPA v1 compatibility (1) . When you use import rego.v1, it automatically enables v1 syntax for that entire module, making the .v1 package suffix unnecessary .
How Compatibility Mode Works
According to the migration guide, when OPAL_OPA_V0_COMPAT is set (2) :
• `true`: OPA accepts both v0 and v1 syntax
• `false`: OPA runs in strict v1 mode
The compatibility mode is controlled by the OPAL_OPA_V0_COMPAT setting, which can be configured as :
# Enable v0 compatibility (default in v0.9.x)
export OPAL_OPA_V0_COMPAT=true
# Disable v0 compatibility
export OPAL_OPA_V0_COMPAT=false
Why Your Policies Still Work
Your policies continue to work because you're using import rego.v1, which is the correct v1 syntax (1) . The migration guide shows two approaches (2) :
1. Adding .v1 suffix to package declarations
2. Using import rego.v1 (which you're already doing)
Since you're using import rego.v1, your policies are already v1-compliant, which is why they work even with compatibility mode disabled.
OPAL 0.9.x Defaults
In OPAL v0.9.x, OPAL_OPA_V0_COMPAT defaults to true for easier migration . The documentation states that OPAL v0.10.0+ will have this unconfigured (effectively false) by default .
Your understanding is correct - you've already migrated to v1 syntax by using import rego.v1, so disabling compatibility mode doesn't break your policies.Ask Inkeep
11/26/2025, 8:32 AMOmer Zuarets
11/26/2025, 8:45 AMBartosz Wasilewski
11/26/2025, 10:11 AM