844600078504951838 #spicedb

Channels

zanzibar

spicedb

Joey

06/08/2022, 11:35 PM

it also doesn't use a cache, so no need for setting the quantization for unit testing

Jwatton

06/08/2022, 11:36 PM

great - I'll try it out

Jwatton

06/08/2022, 11:36 PM

thanks

Rupa

06/09/2022, 6:54 AM

@Jake @Joey If we run spicedb as a docker container on our local machine do we still need the authzed token from our project?

Rupa

06/09/2022, 6:54 AM

Why?

Abhishek Dwivedi

06/09/2022, 10:53 AM

r u referring to preshared key?

Rupa

06/09/2022, 10:54 AM

Yes

Abhishek Dwivedi

06/09/2022, 10:58 AM

Copy code

if(process.env.AUTHZED_SPACE=="development"){
    client = v1.NewClient(process.env.AUTHZED_PRESHARED_TOKEN,process.env.AUTHZED_LOCAL_CONN,ClientSecurity.INSECURE_LOCALHOST_ALLOWED);
} else {
    client = v1.NewClient(process.env.AUTHZED_CLIENT_TOKEN);
}

Abhishek Dwivedi

06/09/2022, 10:58 AM

It is a static token to allow for interaction with GRPC backend in development mode

Jake

06/09/2022, 11:35 AM

Yes you always need to send a token. If you are using

serve-testing

, it can be anything.

vad8615

06/09/2022, 1:19 PM

hi, a question about Consistency for LookupResources: I understand zookies when it's the user that's changing a document (edit or share, I could store user.last_zookie), or when someone changes a document (I could store document.last_zookie) and I want to CheckPermission. But what about LookupResources? I cannot know if somebody else shared a document with him/her. Should I still use user.last_zookie? Is there any guarantee that the result will be at most X seconds old?

Joey

06/09/2022, 2:31 PM

You'd use a higher level zedtoken, if you have one. Otherwise, yes, there is a guarantee that it is at most X seconds old (usually ~5s, but depends on if you change the flag)

Joey

06/09/2022, 2:31 PM

you could also use "fully consistent" to get the latest data, but that will bypass the caches

vad8615

06/09/2022, 2:48 PM

ATM I'm using fully consistent but with ~8k resources fetched, and the request takes 2-7s. I just experimented with

Consistency(minimize_latency=True)

and it doesn't seem to improve at all. It wouldn't be a problem: 8k resources are a lot, it's not a use case for us. The problem is that this user is used by CI tests, and sometimes spicedb OOMs during CI runs. Usually spice runs on ~400MB of memory, but then it can spike to >1GB and oom. We're on spice 1.8.0. Since the dataset is pretty static, this is something unexpected and worrying. Again, we don't need to support 8k resources per user, but I wonder what would happen with real-world load (10k users in our case)

vad8615

06/09/2022, 2:50 PM

the question about consistency was just an idea, if that could improve memory/cpu usage compared to full consistency

vad8615

06/09/2022, 2:54 PM

about otel: it would be really nice to be able to use otlp grpc without TLS, I guess this should be the fix right? https://github.com/jzelinskie/cobrautil/commit/6f14a69ff8d40ee2dec61f83bc7fbfb74b6e62b4

vad8615

06/09/2022, 2:57 PM

more about this: first run of CI -> memory to 400MB. It could stay at that level for several runs, and then spike to 1GB for no apparent reason.

Joey

06/09/2022, 3:28 PM

if you can get a mem profile, that would help identify where the spike occurs

Joey

06/09/2022, 3:29 PM

long term, the real solution for lookup is the lookup watch and the tiger cache

Joey

06/09/2022, 3:29 PM

lookup itself does a full graph walk (and checks if it encounters any intersections or exclusions), which means a lot of data loaded and sent along the wire

Joey

06/09/2022, 3:29 PM

this means for a LARGE dataset, its going to be slower

Joey

06/09/2022, 3:30 PM

we're continuing to optimize it and hope to further reduce the memory and runtime for it, but realistically its still going to be a slower operation since it has to do a full walk

Tomek

06/10/2022, 8:14 AM

Hey guys, lately I've been working with SpiceDB. Must say I'm reaching out to you because I'm a bit stuck with performing relationship removal in Spice. To give you more context, lets assume there is a following relationship tuple in the database:

Copy code

namespace     |              object_id               |  relation   | userset_namespace |      userset_object_id
--------------+--------------------------------------+-------------+-------------------+--------------------------
    aminal    |               1234                   |   owner     |      user         |              4321
--------------+--------------------------------------+-------------+-------------------+--------------------------
    aminal    |               1234                   |   owner     |      user         |              8765

Let's say I want to remove all relationships where animal's resource

id

. My request via REST to SpiceDB looks like this.

Copy code

wget -qO- --post-data '{"relationshipFilter":{"resourceType": "animal", "optionalResourceId":"1234" }}' --header="Authorization: Bearer []" http://localhost:8443/v1/relationship/delete

From what I expected from this request, is that it removes all records from the db table snippet I introduced you. Unfortunately nothing happened and the records are still present. Could you help me out and try to figure out what is wrong with my understanding of relationship removal?

Rupa

06/10/2022, 9:05 AM

Hi, I have a local instance of spicedb running

Rupa

06/10/2022, 9:05 AM

grpcurl -rpc-header "authorization: Bearer tc_desk_default_token_42c2c202ed3c353a9dcc8ad6c1198b5332b88fdf4a34f37fc02e51af36d6db9d00327e653210d863f15772fd31f3b77c2f88edc708c807a13decf92236c99cb1" -d '{"schema": "definition agent {}"}' grpc.authzed.com:50051 "authzed.api.v1.SchemaService/WriteSchema" Failed to dial target host "grpc.authzed.com:50051": context deadline exceeded @Joey @Jake

Rupa

06/10/2022, 9:05 AM

keep getting this error whenever i try to upload to the schema

Rupa

06/10/2022, 9:24 AM

Another related question - How to point the spicedb to use cockroach db as a backend store? The thing is we have Cockroach DB running on AWS and we want spicedb to use that as the persistence layer. @Jake @Joey

Rupa

06/10/2022, 9:26 AM

Is serve-testing this : https://github.com/authzed/zed-testserver ?

Jake

06/10/2022, 11:45 AM

What is your datastore type? If it is MySQL or Postgres it will just mark the relationships dead

Jake

06/10/2022, 11:47 AM

You need to set your

datastore-engine

cockroachdb

and set an appropriate connection string: https://github.com/authzed/spicedb/blob/main/pkg/cmd/datastore/datastore.go#L91