No support for Rego.v1

[perithompson]

When trying to integrate conftest into atlantis policy-checks I am encountering errors when writing policies as per the conftest documentation, this seems to be due to a lack of support for rego.v1

rego_parse_error: if keyword is required before rule body

>> conftest --version    
Conftest: 0.56.0
OPA: 0.69.0

Please could we have updates to how to use conftest with rego.v1 and have some documentation on how exceptions and denies work when importing rego.v1 instead so that the contains and if keywords are used

[charlieegan3]

As a starting point, we have a guide here for projects integrating with OPA's go packages here: https://www.openpolicyagent.org/docs/latest/v0-upgrade/#upgrading-for-go-integrations. I am about to close up my working week here, but @ me if I can help at all here.

[jalseth]

I will look into bumping Conftest's dependency to Rego v1 soon. It does have breaking changes, so we'll likely need to update the examples, docs, etc.

@perithompson In the interim, you can add import rego.v1 to your Rego policies and update them with V1 syntax. This has been supported since OPA v0.59 https://docs.styra.com/regal/rules/imports/use-rego-v1#rationale.

[perithompson]

i think i tried import rego.v1 and it gave me a series of errors in conftest, i will try again, for now ive been importing future.keywords.in etc

[anderseknert]

Any updates on this @jalseth? Happy to help with whatever may be needed!

[jalseth]

I had some time to dig into this today. I'd like to do this in multiple stages.

Stage 1

• Bump the opa package to V1, but use the V0 implementation
• Add a flag to let users opt-in to using the V1 implementation rather than V0
• Release conftest with a warning that V1 will be the default in the next version

Stage 2

• Make V1 default behavior, but keep the flag so people can use V0 without changing their Rego
• Release N versions with this behavior (likely 3-6 with ~monthly cadence)

Stage 3

• Remove the flag so we don't have to support this indefinitely

However, the first step in Stage 1 is currently blocked: open-policy-agent/opa#7347

[jalseth]

Step one complete with https://github.com/open-policy-agent/conftest/releases/tag/v0.57.0

Closing this issue, and will track the next steps in #1067