Hi there I just wanted to flag this issue regarding Health check not working as expected when using a Datastore (Postgres in our case) https://github.com/authzed/spicedb/issues/692

@shubhamsinha this is expected behavior; I'll respond in more detail in the issue this evening

Cool cool thank you

hi team, i followed this example deployment yaml (https://github.com/authzed/spicedb/blob/main/examples/k8s/example.yaml) to config prometheus and my spicedb server is up and running, where can i access those reported metrics (https://github.com/authzed/spicedb/blob/main/TELEMETRY.md) ?

Hi guys, awesome work on SpiceDB, just what our team are looking for! We just have one more question before we adopt it. Some of our service deployments will be in our customer's private clusters, and some clients block inbound requests to their clusters. Does the node authzed client use a bi-directional TCP connection within it's channel? (specifically for the checkPermission call)

What do you mean by a bi-directional tcp connection? All of our clients use grpc, which uses http/2, which is built on top of tcp. As far as I know all tcp connections are bi-directional as they are stream based and not datagram based like UDP.

Apologies, I'm quite new to gRPC - made me forget networking 101 😅

No need to apologize, this stuff can be tricky. Do you have what you need now to make your decision?

Yes thanks for checking! I've been playing around with SpiceDB for the last 10 days and created a couple POCs to see how it can integrate with our authentication solution - Everything is working great 😁 This discord channel has been very helpful for finding answers

Something that would be really helpful is an "explain" mode for checkPermission, which would return the reasons why a user has or does not have a given permission. Main use-case is debugging ("why does this user not have this permission?")

I am very interested on spicedb's implementation of consistent hash load balancer. I am going through your implementation. Unfortunately i fail to find at which point Add and Remove of the member nodes are called. Btw great product!! Thanks

Thanks, i saw that piece of code, but isn't called only while building the hashring?

The hash ring gets rebuilt every time the node membership changes

That’s a feature of kuberesolver

Aaaa ok. So there's no reason to call remove since it is always rebuilt. Got it. 👍

would you want the single path that was found or all paths for the Check?

Not 100% sure, it's mostly for debugging so I'd mostly like: - if the permission was OK, the path that gave access to the resource. Having multiple paths would be OK too - if the permission was NOK, all paths that have been explored and why they failed

Hi! is there someone I can ask these questions for Authzed/spicedb implementation? 1. For Data locality and deployment regions - where are you hosted and any latency issues? we're hosted in AWS US-West2 initially 2. Is authzed HIPAA compliant? Can you provide us information on that? How do you handle PHI identifiers?

for a healthcare application, our dedicated offering is the preferred solution. It can be deployed into the cloud and region of your choice. In terms of PHI identifiers, we recommend using a non-PHI ID for relationships stored

hi. so for "api access permissions" on authzed, there's viewer, writer, and admin. what abilities do each of these permissions have? my first guess would be:

viewer allows for checking permissions, reading relationships, etc. writer allows for writing relationships and admin allows for updating of schema

if you'd like to learn more about the Dedicated offering, feel free to schedule a call on https://authzed.com/contact and we can discuss in detail

Joey, thanks. For self-hosting of spiceDB, is there also a way to configure multiple clients and assign them viewer, writer, and admin permissions?

Sure, I will. Thank you for the info!

the commercial self-hosted Authzed will have that capability, yes

@Joey okay, thanks. And then for CI, what's the recommended method for promoting schema and initial relationships to various environments? (dev, staging, prod, etc)

validate your schema in CI and then have your CD WriteSchema when your code goes to that environment

Thanks. Them for a authzed hosted solution, create a different "permission system" for each environment?