844600078504951838 #spicedb

Channels

Jake

10/14/2022, 1:21 AM

and this one that fails:

compose-spicedb-1            | {"level":"error","module":"pgx","args":["resource","alerts","reader","role","readonly","member","resource","views","reader","role","readonly","member"],"err":"ERROR: duplicate key value violates unique constraint \"uq_relation_tuple_living_xid\" (SQLSTATE 23505)","pid":86,"sql":"INSERT INTO relation_tuple (namespace,object_id,relation,userset_namespace,userset_object_id,userset_relation) VALUES ($1,$2,$3,$4,$5,$6),($7,$8,$9,$10,$11,$12)","time":0.718452,"time":"2022-10-14T00:56:57Z","message":"Exec"}

symion

10/14/2022, 1:22 AM

oh, I read that as echoing back the error from postgres from the first one

Jake

10/14/2022, 1:23 AM

no, you can see that it is two separate transactions

Jake

10/14/2022, 1:23 AM

compose-spicedb-1            | {"level":"debug","module":"pgx","args":[],"pid":86,"rowCount":1,"sql":"INSERT INTO relation_tuple_transaction DEFAULT VALUES RETURNING xid","time":0.442488,"time":"2022-10-14T00:56:57Z","message":"Query"}

Jake

10/14/2022, 1:23 AM

there is one of those between the two log lines

symion

10/14/2022, 1:26 AM

alright, its a me problem

williamdclt

10/14/2022, 12:31 PM

Is there something that runs every 2min in SpiceDB? From time to time I get a few spikes in latency, evenly spaced by 2min, always at the 15th second (here 13:12:15, 13:14:15, 13:16:15, 13:18:15). It happens a few times a day. I have no idea where it could come from, I don't think it's due to our traffic (nothing on our side runs every 2min) so maybe it's something in SpiceDB itself?

Jake

10/14/2022, 12:31 PM

Check your garbage collection interval

Jake

10/14/2022, 12:33 PM

default is 3 minutes: https://github.com/authzed/spicedb/blob/main/pkg/cmd/datastore/datastore.go#L106

Jake

10/14/2022, 12:35 PM

maybe autovacuum in postgres? the naptime defaults to 1 minute, and that's between runs

williamdclt

10/14/2022, 1:11 PM

spicedbdatastore.go at main · authzeds...

niodice

10/14/2022, 6:11 PM

Is there a way to have a permission based on the document in which it's defined? I want to model a permission that should only be granted to the specific user's profile. Example:

definition user {
    permission user_can_view_some_private_info = this // "this" could be replaced with "self" or something that points back to the user doc
}

I know I can set a

relation self: user

but it feels like there may be a built-in way to do this without needing to set that relationship?

Joey

10/14/2022, 6:12 PM

not currently, but its been proposed: https://github.com/authzed/spicedb/issues/338

niodice

10/14/2022, 6:16 PM

Has this been re-visited? It looks like the last update was "not gonna do it'?

Joey

10/14/2022, 6:17 PM

nah, that was Jake's modified proposal that it refers to the top level

symion

10/14/2022, 10:07 PM

Not sure if this is helpfule, but here is the basic output from one of the tests that has trouble, minus the sql.

symion

10/14/2022, 10:07 PM

it isn't doing much, but it is doing a lot in a very small time frame.

symion

10/14/2022, 10:08 PM

I sorted out the migration script, it something was slow and the driver was issuing retries - so duplicates.

Jake

10/14/2022, 10:09 PM

it looks like overlapping deleterelationships calls, do you know what the filters being used are?

Singha1

10/15/2022, 8:59 AM

I have to display lookup API response on UI, is there anyway to get pagination response instead of Streaming, or should I store the response in some cache like Redis and create a paginated response from Redis? Any suggestions?

Singha1

10/15/2022, 9:41 AM

Don't want to use websockets or SSE API.

symion

10/15/2022, 12:48 PM

Yeah, I can track those down.

Joey

10/15/2022, 5:59 PM

for now, you'll need to store it to get it paginated. We have an issue filed to add pagination, but it is highly non-trivial

Singha1

10/15/2022, 6:35 PM

Thanks ! Joey.

Singha1

10/15/2022, 6:35 PM

Can you please share the issue? I will add , design I have in my mind.

Unhinged

10/17/2022, 9:44 AM

I can see that MySQL is supported, could it work on MSSQL as well, as that is what we normally use

raffaelespazzoli

10/17/2022, 5:19 PM

I have a deployment of spicedb + postgresql on kubernetes. I'm not using the operator. I noticed that after a while all pods except one become unready. Recently I upgraded to using TLS everywhere I am not sure if that is related. This is what I see in the logs of the unready pods:

{"level":"debug","datastoreReady":true,"dispatchReady":true,"time":"2022-10-17T17:14:38Z","message":"completed dispatcher and datastore readiness checks"}
{"level":"info","grpc.component":"server","grpc.method":"Check","grpc.method_type":"unary","grpc.service":"grpc.health.v1.Health","peer.address":"[::1]:56680","protocol":"grpc","requestID":"029dcbed3eb352a21117e9de95e9e401","grpc.request.deadline":"2022-10-17T17:14:39Z","grpc.start_time":"2022-10-17T17:14:38Z","grpc.code":"OK","grpc.time_ms":"0.015","time":"2022-10-17T17:14:38Z","message":"started call"}
a bunch of these and then ...
{"level":"info","time":"2022-10-17T17:16:27Z","message":"received interrupt"}
{"level":"info","time":"2022-10-17T17:16:27Z","message":"shutting down"}
{"level":"warn","error":"context canceled","time":"2022-10-17T17:16:27Z","message":"completed shutdown of postgres datastore"}
{"level":"info","addr":":50051","network":"tcp","prefix":"grpc","time":"2022-10-17T17:16:27Z","message":"grpc server stopped listening"}
{"level":"info","addr":":8080","prefix":"dashboard","time":"2022-10-17T17:16:27Z","message":"http server stopped serving"}
{"level":"info","addr":":9090","prefix":"metrics","time":"2022-10-17T17:16:27Z","message":"http server stopped serving"}
{"level":"info","addr":":50053","network":"tcp","prefix":"dispatch-cluster","time":"2022-10-17T17:16:27Z","message":"grpc server stopped listening"}

raffaelespazzoli

10/17/2022, 5:33 PM

You need to a certificate with name service-name.namespace in order to connect with TLS to your services.

this is bad, I can's generate such certificate...

ecordell

10/17/2022, 5:34 PM

why can't you generate certs like that?

Jake

10/17/2022, 5:38 PM

We don't have an MSSQL driver at this time. You could definitely write your own and include it in a custom build of SpiceDB, eventually submitting it upstream for inclusion