we'll update here once its past that point

I’m giving a training on SpiceDB to my team tomorrow and then we are going live with it next week 🎉

Can spicedb be deployed as a simple linux process/service, the documentation refers to deploying it as docker, but not particularly about this? We have some deployments on one single docker container and each service is a process in it.

Yes it will work that way, you just won’t be able to scale it horizontally as easily

Hey guys, can read relationship be used with a wildcard? Having a composite resource name

sysprefix/resourceType:parent-child

I'd like to run

zed relationship read sysprefix/resourceType:parent-* relationName

. Should this work?

No, but you can read all of the rels for a specific resource type and filter client side

Hey everyone had a question around how to handle permissions for "get All/list All" type authorization. Since, in spicedb all the relationships are created with specific objectId and subjectId how would I go about creating a relationship and checking permission for "Get all entities of type X that's under this company/org"

You'd normally define something like that permission on the company/org itself rather than the entity that's being checked e.g.

hs
definition user {}
definition organization {
  relation reader: user
  relation admin: user
  permission can_read_all_docs = reader + admin
}
definition doc {
  relation org: organization
  relation reader: user
  permission can_read = reader + org->can_read_all_docs // org-wide listers can also view all
}

Oh I see @jzelinskie thanks for the recommendation

exactly what I was looking for

glad to help!

Have you seen anyone use spicedb for authorizing network policy and other generalized policies?

we have seen a lot of people try to think about it that way, and some people use it as a generalized middleware, but in general we wrote it with the app developer in mind

hi, I'm deploying spice (1.7.0) on our k8s cluster, but I'm running into an issue: it's panic-ing with https://gist.github.com/vad/d9c8d7ca0cf0fe0b9dac67fd7498e0a4 . I'm using default configuration with only 3 parameters set: grpc preshared key, PG as datastore engine, and PG connection URI. The datastore is still empty except for the migrate head

@vad the panic should be fixed in head, but we haven't cut a release with that fix yet if you look at the startup logs you should see a

warn

log with a message like

unable to initialize telemetry collector

that might tell you specifically what's failing - do you see a log like that?

@ecordell

{
  "level": "warn",
  "error": "unable to query DB stats: unable to read relationship count: can't scan into dest[0]: -1 is less than zero for uint64",
  "time": "2022-05-03T12:47:30Z",
  "message": "unable to initialize telemetry collector"
}

Ah, that is also fixed in head but isn't in a release yet

we need to cut a release today to resolve these I think

thank you!

Hi there, I'm trying to wire up spicedb deployed onto GKE with the telemetry collector, all in all: 1. SpiceDB config

SPICEDB_OTEL_ENDPOINT:  localhost:4317
      SPICEDB_OTEL_PROVIDER:  otlpgrpc

2. collector sidecar

otel/opentelemetry-collector-contrib

3. receiver configured:

receivers:
      otlp:
        protocols:
          grpc:

What I expect: Traces received and forwarded by the collector. What actually happens: the collector thinks the forwarded traces are bogus

Am I missing something? Is there an easy way to debug that further?

The collector already treats the 'greeting' as bogus:

[core] grpc: Server.Serve failed to create ServerTransport:  connection error: desc = "transport: http2Server.HandleStreams received bogus greeting from client:

just published 1.7.1 which should resolve the issues you're seeing!

that error looks like a mismatch between tls config options to me (one side expecting tls, the other side not?)

@ecordell it's running 😉 I'm waiting to see if everything's fine

That was my suspicion as well, according to

spicedb help serve

there is no definition whether this will expect TLS or not. Does it expect TLS?

In other words, if I configure

otlpgrpc

will this try to open a TLS connection or not?

hm, what is even weirder, some of the spicedb logs are unstructured:

2022/05/03 14:12:32 max retry time elapsed: rpc error: code = Unavailable desc = connection error: desc = "transport: authentication handshake failed: tls: first record does not look like a TLS handshake"

I suspect some library might go around your logging setup.

So I guess spicedb expects TLS for otlp

Is that correct?