but rather dependent schemas

there is a similar issue about this for validation: https://github.com/authzed/spicedb/issues/497

hey! looking for some modeling help as I'm not seeing things chain back up to my user object as I'd expect. https://play.authzed.com/s/MaeuGf1jAPKl/relationships.

with a relation specified using a wildcard or non-wildcard, is there a pattern that one can use to follow the non-wildcard relation within a permission?

Hello, I am running into the same issue when I started pointing to Postgres db On executing the get schema API , I see the below error

curl --location --request POST 'http://localhost:8443/v1/schema/read' \
--header 'Authorization: Bearer graphToken'

{
  "code": 2,
  "message": "unable to find revision: ERROR: relation \"relation_tuple_transaction\" does not exist (SQLSTATE 42P01)",
  "details": []
}

I dont see any error logs from pod , any view ?

You need to run

spicedb migrate

Is this required even if this is a fresh new db instance?

especially if it’s a fresh new db. It lays down the starting schema

@here SpiceDB 1.7.0 was just release adding support for MySQL datastores and drastic performance improvements! https://twitter.com/authzed/status/1519390278523580416

You need to run

spicedb migrate

hey! apologies - more modeling questions around attributes. https://play.authzed.com/s/pqFVWEjV-16N/relationships

I have a question on deploying a spicedb cluster on k8s. The spicedb clients are going to be running external to the cluster and will need to send check requests to spicedb over the internet. While client side loadbalancing with the grpc-go extension described in the blog is attractive, it does mean that I will need to expose all my k8s worker IPs to the internet. Something I am not keen on doing. I could deploy an ingress or an external load balancer that can load balancing grpc requests, but such a load balancer would be oblivious of the spicedb hash ring and is likely to forward the request to the incorrect spicedb instance. What's the best practice for load balancing a spicedb cluster to clients over the internet.

> I could deploy an ingress or an external load balancer that can load balancing grpc requests, but such a load balancer would be oblivious of the spicedb hash ring and is likely to forward the request to the incorrect spicedb instance this is generally okay; if setup using the kubernetes resolver, SpiceDB will internally redispatch the subproblems to the correct nodes based on the hash ring

so even if a check request hits the "wrong" node, the next step(s) will redispatch to the correct node(s) and utilize the cache accordingly

yeah, that was my understanding too that it would work, just not in the most optimal fashion.

so a regular off-the-shelf ingress load balancer to spread load across all spicedb instances should work fine then?

yep

its not 100% optimal, but it shouldn't add much overhead

since the bulk of check problems will not be a direct relation, but rather have some sort of subproblem

we also cache on both sides

so even if you hit the "wrong" node, it'll be cached there for the next check call that matches

any recommendations on an ingress load balancer that is able to load balance individual grpc requests across the cluster?

Envoy seems pretty solid in our testing

thanks

are there any public helm charts or deployment specs for deploying a spicedb cluster using a cockroachdb cluster as the datastore?

there is a community one here: https://github.com/jonwhitty/helm-charts/tree/master/charts/spicedb, but I'm unsure how up-to-date it is

will look

we also have some additional work being done in the deployment area to make it easier

any PRs yet?

not yet, but coming soon (its in the discussion phase)