@jzelinskie ^

that sounds like something you'd use the opentelemetry collector for https://opentelemetry.io/docs/collector/

the general opentelemetry architecture is to have this collector act as the aggregator that filters things before going to your visualization tool

which part of it? would it be the exporter or the receiver?

or would it be a processor?

It acts a receiver from SpiceDB and then an (re)Exporter to your visualization tool (jaeger, lightstep, etc...)

i'm not sure how powerful the filtering capabilities are though

we just stuff everything into jaeger right now

yeah that makes sense... a processor-level change would make sense, as would something where i could exclude traces on input, but i'm having a hell of a time finding any related stuff in OTEL documentation generally -_-

yeah navigating the SDK to instrument something is an equally frustrating journey

Hello, My company is interested in using spicedb, but we are missing one mandatory feature: authorization-aware filtering. From what I read, this is covered exactly by this issue: https://github.com/authzed/spicedb/issues/207 We're considering some ways to have this feature, one of those would be to finance the feature. Would authzed company be open to that ? I don't know if this is the right channel for this kind of question, sorry if it isn't !

yep! we can line-item the work in a contract and then prioritize it accordingly

if you're interesting in discussing, please feel free to grab a time slot on the calendly on https://authzed.com/contact

Cool, thanks @Joey ! I share the news with my managers. I'll have an update at the end of August I think (sorry for that: holiday period)

no rush! feel free to ping if you have any questions

@here SpiceDB v1.10.0 was just released! Highlights include: - Enabled the ability to safely use Postgres read replicas - Added a webassembly interface for devtools - Fixed namespaces not being garbage collected for Postgres & MySQL datastores - Added health checking and Watch service to HTTP API - Added seamless TLS certificate rotation https://github.com/authzed/spicedb/releases/tag/v1.10.0

here SpiceDB v1 10 0 was just released

I am looking for mechanism to -> fetch all the Permissions Subject has on all the objects_ids of a specific object_type

Read can provide me -> fetch all the Relations Subject has on all the objects_ids of a specific object_type.

Lookup can help me to fetch User/Group has a specific permission on all object_ids of Object_Type.

Is there any way I can achieve the first me , fetch all the Permissions Subject has on all the objects_ids of a specific object_type

you'd need to issue a lookup for each permission

Got it !! thanks for confirming Joey !!

if you think this would be a generally applicable improvement, feel free to file an issue and we can see what the community wants

Hi all. I'm trying to deploy spicedb to cockroachDB's serverless environment, but I'm running into some errors when I perform the migration (to

head

).

{"level":"info","time":"2022-07-27T11:02:04-07:00","message":"migrating cockroachdb datastore"}
{"level":"info","module":"pgx","host":"free-tier4.aws-us-west-2.cockroachlabs.cloud","time":"2022-07-27T11:02:04-07:00","message":"Dialing PostgreSQL server"}
{"level":"info","targetRevision":"head","time":"2022-07-27T11:02:04-07:00","message":"running migrations"}
{"level":"error","module":"pgx","args":[],"err":"ERROR: relation \"schema_version\" does not exist (SQLSTATE 42P01)","pid":1532891,"sql":"SELECT version_num from schema_version","time":"2022-07-27T11:02:04-07:00","message":"Query"}
{"level":"error","module":"pgx","args":[],"err":"ERROR: relation \"schema_version\" does not exist (SQLSTATE 42P01)","pid":1532891,"sql":"SELECT version_num from schema_version","time":"2022-07-27T11:02:04-07:00","message":"Query"}
{"level":"info","from":"","to":"initial","time":"2022-07-27T11:02:04-07:00","message":"migrating"}
{"level":"error","module":"pgx","args":[],"err":"ERROR: cluster setting 'kv.rangefeed.enabled' is currently overridden by the operator (SQLSTATE XXUUU)","pid":1532891,"sql":"SET CLUSTER SETTING kv.rangefeed.enabled = true;","time":37.093002,"time":"2022-07-27T11:02:04-07:00","message":"Exec"}
{"level":"fatal","error":"error executing migration function: ERROR: cluster setting 'kv.rangefeed.enabled' is currently overridden by the operator (SQLSTATE XXUUU)","time":"2022-07-27T11:02:04-07:00","message":"unable to complete requested migrations"}

The same command works fine against a single node cluster on my local machine. Is the cockroach serverless environment just not capable of supporting spicedb or is there something that can be done to work around the problems/limitations above?

@ecordell ^

Cockroach serverless should be fine (https://www.cockroachlabs.com/docs/stable/change-data-capture-overview.html suggests that the rangefeed is enable-able) I think we just need to skip setting that in the migrations, since it's a cockroach-wide setting . I have a tentative PR up for this: https://github.com/authzed/spicedb/pull/707, but we need to make sure the UX is reasonable (do we disable the

watch

api if your cockroach doesn't have rangefeeds enabled?)

Thanks @ecordell. I'll watch that PR and try again later. 🙂

Hey guys, I'm looking to see if spicedb supports out-of-the-box integration with Auth0 specifically for M2M authentication for requests to spicedb (i.e. authzed.api.v2.*) itself. We are currently using a pre shared key, but this isn't very secure, especially as our number of micro-services grows... I think (I would like to be wrong!). I was thinking of creating a proxy micro-service in front of spicedb to perform the token validation before forwarding the request to spicedb, but then I'd just create a bottleneck and loose so many of the benefits of spicedb. Do you guys have any suggestions?

can you expand a bit on your use case? SpiceDB does support multiple preshared keys, so you can rotate or use a key per calling microservice (although it does grant "full" access)