Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add --rego-v1 flag to check command #6429

Closed
johanfylling opened this issue Nov 23, 2023 · 0 comments · Fixed by #6430
Closed

Add --rego-v1 flag to check command #6429

johanfylling opened this issue Nov 23, 2023 · 0 comments · Fixed by #6430

Comments

@johanfylling
Copy link
Contributor

When applied, the --rego-v1 flag should make the check command reject modules that aren't compliant with OPA 1.0 Rego.

Since both the rego.v1 and future.keywords imports are no-ops in OPA 1.0, any valid combination of these imports are allowed, as long as the rest of the module is compliant with 1.0 Rego. E.g.:

Valid (rego.v1 imported):

package example

import rego.v1

p contains x if { 
  x := input.x;  
  x in [1, 2, 3]
}

Valid (future.keywords imported):

package example

import future.keywords.contains
import future.keywords.if
import future.keywords.in

p contains x if { 
  x := input.x;  
  x in [1, 2, 3]
}

Invalid (no imports):

package example

p contains x if { 
  x := input.x;  
  x in [1, 2, 3]
}

The last module is fully OPA 1.0 compliant Rego, but since this isn't also compatible with <1.0 Rego it must be rejected. To aid in migrating existing policies to 1.0 compliant Rego, it is important that the check command doesn't force users into updating existing code to no longer be compatible with their current runtime.

johanfylling added a commit to johanfylling/opa that referenced this issue Nov 23, 2023
When enabled, checked module must be compliant with OPA 1.0 Rego.

Fixes: open-policy-agent#6429
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
ashutosh-narkar pushed a commit to johanfylling/opa that referenced this issue Nov 29, 2023
When enabled, checked module must be compliant with OPA 1.0 Rego.

Fixes: open-policy-agent#6429
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
johanfylling added a commit that referenced this issue Nov 30, 2023
When enabled, checked module(s) must be compliant with OPA 1.0 Rego.

Fixes: #6429
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Open Policy Agent v1.0
Awaiting triage
Development

Successfully merging a pull request may close this issue.

1 participant