Skip to content

Commit

Permalink
Adding rego.v1 import section to Rego language docs
Browse files Browse the repository at this point in the history
Fixes: open-policy-agent#6453
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
  • Loading branch information
johanfylling committed Dec 6, 2023
1 parent a9e4d54 commit 1917f75
Show file tree
Hide file tree
Showing 2 changed files with 23 additions and 5 deletions.
10 changes: 5 additions & 5 deletions docs/content/opa-1.md
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ A policy that makes use of these keywords, but doesn't import `future.keywords`

### Making new and existing policies compatible with OPA v1.0

1. A new `rego.v1` import has been introduced that, when used, makes OPA apply all restrictions that will eventually be enforced by default in OPA v1.0.
1. A new [rego.v1](../policy-language/#the-regov1-import) import has been introduced that, when used, makes OPA apply all restrictions that will eventually be enforced by default in OPA v1.0.
If a Rego module imports `rego.v1`, it means applicable `future.keywords` imports are implied. It is illegal to import both `rego.v1` and `future.keywords` in the same module.
2. The `--rego-v1` flag on the `opa fmt` command will rewrite existing modules to use the `rego.v1` import instead of `future.keywords` imports.
3. The `--rego-v1` flag on the `opa check` command will check that either the `rego.v1` import or applicable `future.keywords` imports are present if any of the `in`, `every`, `if` and `contains` keywords are used in a module.
Expand Down Expand Up @@ -134,7 +134,7 @@ This will make Rego code easier to author and read; thereby making it simpler fo

### Making new and existing policies compatible with OPA v1.0

1. A new `rego.v1` import has been introduced that, when used, makes OPA apply all restrictions that will eventually be enforced by default in OPA v1.0.
1. A new [rego.v1](../policy-language/#the-regov1-import) import has been introduced that, when used, makes OPA apply all restrictions that will eventually be enforced by default in OPA v1.0.
If a Rego module imports `rego.v1`, it means the `if` and `contains` keywords are required when declaring rules. Constants, rules that only consist of a value assignment, are exempted.
2. The `--rego-v1` flag on the `opa fmt` command will rewrite existing modules to use the `if` and `contains` keywords where applicable.
3. The `--rego-v1` flag on the `opa check` command will check that the `if` and `contains` keywords are used where applicable in a module.
Expand All @@ -153,7 +153,7 @@ An import shadowing another is most likely an authoring error and probably unint

### Making new and existing policies compatible with OPA v1.0

1. A new `rego.v1` import has been introduced that, when used, makes OPA apply all restrictions that will eventually be enforced by default in OPA v1.0.
1. A new [rego.v1](../policy-language/#the-regov1-import) import has been introduced that, when used, makes OPA apply all restrictions that will eventually be enforced by default in OPA v1.0.
If a Rego module imports `rego.v1`, duplicate imports are prohibited.
2. The `--rego-v1` flag on the `opa fmt` command will reject modules with duplicate imports.
3. The `--rego-v1` flag on the `opa check` command will check that duplicate imports are not present in a module.
Expand All @@ -173,7 +173,7 @@ Hence, if a rule or variable shadows `input` or `data` you have the unintended c

### Making new and existing policies compatible with OPA v1.0

1. A new `rego.v1` import has been introduced that, when used, makes OPA apply all restrictions that will eventually be enforced by default in OPA v1.0.
1. A new [rego.v1](../policy-language/#the-regov1-import) import has been introduced that, when used, makes OPA apply all restrictions that will eventually be enforced by default in OPA v1.0.
If a Rego module imports `rego.v1`, it means `input` and `data` are reserved keywords and may not be used as names for rules and variable assignments.
2. The `--rego-v1` flag on the `opa fmt` command will reject modules where `input` and `data` are used as names for rules and local variable assignments.
In a future release, a `--refactor-local-variables` flag will be added to `opa fmt` to refactor local variable assignments.
Expand All @@ -194,7 +194,7 @@ In some cases, new built-in functions have been added that provide functionality

### Making new and existing policies compatible with OPA v1.0

1. A new `rego.v1` import has been introduced that, when used, makes OPA apply all restrictions that will eventually be enforced by default in OPA v1.0.
1. A new [rego.v1](../policy-language/#the-regov1-import) import has been introduced that, when used, makes OPA apply all restrictions that will eventually be enforced by default in OPA v1.0.
If a Rego module imports `rego.v1`, it means deprecated built-in functions are prohibited.
2. The `--rego-v1` flag on the `opa fmt` command will reject modules with calls to deprecated built-in functions.
In a future release, `opa fmt --rego-v1` will also rewrite modules to use an alternative, existing built-in function when possible and/or provide suggestions on how to author policies that avoid usage of deprecated built-ins.
Expand Down
18 changes: 18 additions & 0 deletions docs/content/policy-language.md
Original file line number Diff line number Diff line change
Expand Up @@ -3813,6 +3813,24 @@ If the `rego.v1` import is present in a module, all strict mode checks documente
Additionally the `rego.v1` import also requires the usage of `if` and `contains` keywords when declaring certain rules. The `if` keyword is required before a rule body and the `contains` keyword is required for partial set rules.
{{< /info >}}

## The `rego.v1` Import

In the future, when [OPA v1.0](../opa-1) is released, breaking changes will be introduced to the Rego language.
The `rego.v1` import is a way to opt-in to these breaking changes early, and ensure that your policies are compatible with OPA v1.0.
If a module containing this import is not compatible with OPA v1.0, it will cause a compilation error.

When a module imports `rego.v1`, the following features and constraints are implied:

* all [Future keywords](#future-keywords) are implied and can be used without import.
These imports are mutually exclusive, and it will cause a compilation error to import both `rego.v1` and `future.keywords` in the same module.
* the [if](#futurekeywordsif) keyword is required before a rule body declaration.
* the [contains](#futurekeywordscontains) keyword is required for partial set (multi-value) rules.
* most [Strict mode](#strict-mode) constraints and checks are implied and enforced. See the strict mode [constraints and checks table](#strict-mode-constraints-and-checks) for details.

The `rego.v1` import only affects the module where it's declared. It does not affect any other modules, even if they are importing, or is imported by, a module where `rego.v1` is declared.

In OPA v1.0, the `rego.v1` import will have no semantic impact on the policy, as all its implied features and constraints will be enforced by default. It will however still be a valid statement, and won't cause any compilation errors.

## Ecosystem Projects

{{< ecosystem_feature_embed key="learning-rego" topic="learning Rego" >}}

0 comments on commit 1917f75

Please sign in to comment.