There is a separate entrypoint on the spicedb binary for

serve-testing

, you run it like

spicedb serve-testing ...

I have a question on distributed deployment models. Do you see any concerns with this deployment model - A cockroach DB cluster hosted in a multi-region cloud - Multiple spice db clusters and perhaps single spicedb instances geographically distributed across edge PoPs and on-premise talking to the cloud hosted cockroachdb cluster

Yup, it's on Postgres, so as I understand db lookups to check if permissions exist is not a good source of truth 😛

@liammoch the major risks there are (a) making sure CRDB is configured so that if one region goes down, it doesn't take the other regions with it (this requires careful thought and design) (b) the latency between SpiceDB and its datastore

so long as you can minimize

b

, should be fine

any guidelines on the maximum latency bounds

depends on your latency requirements

I would suggest anything over 100ms will slow down checks significantly

you might have to extend the max timeout on the SpiceDB side, but even a very slow connection should be fine; it'll just take longer to compute results

ok, just want to make sure if there are any requirements from an internal spicedb perspective

so long as the queries succeed and don't go beyond the timeouts, SpiceDB will be fine

ok, and can you confirm that the same cockroachdb cluster can support multiple spicedb clusters feeding off it

so: clusters as in distinct permissions systems, or all talking to the same logical database?

(the answer to both is yes, but requires some config on your part)

I expect the permissions system to span across spicedb clusters, so same logical database

the idea is to have spicedb closer to the edge, while having the database in cloud regions

perfectly valid

the database is the source of truth; SpiceDB will just do caching within its own cluster

in fact, this is exactly how Authzed Dedicated is deployed to multiple regions

ok, that validates my understanding

although in that case, the database and SpiceDB nodes are in the same cloud region(s)

to minimize latency

can the database be logically spread across regions in your deployment?

yes

ok

@Joey we discussed the latency between spicedb and crdb. what about bandwidth requirements for a large permission system. would spicedb need to fetch lots of data from the backend while traversing the graph? I am thinking the case where there is a large fan out of objects on a relation (edge).

depends on your schema and the relationships found, but yes, it can fan out

we have some ideas to drastically reduce fan out in certain cases, but they are still in the early discussion phase

regardless, when you have to check a relation, data is going to need to be loaded

it isn't so much bandwidth as latency that will be most important