SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions.

SpiceDB

once its installed, you just create a CR with a cluster config

I think there were some limitations around being able to set labels and annotations that we need

yeah, we don't allow custom annotations yet

if you're running under kub, you can use `--dispatch-upstream-addr=kubernetes:///spicedb.default:50053`

where `spicedb.default` is, I believe, your service

and one cache usually has a higher hit rate (client if I recall correctly)

this can be set with an environment variable? `SPICEDB_UPSTREAM_ADDR=kubernetes://spicedb.default.svc.cluster.local:50051` ?

there are also per-request-type caching metrics: https://github.com/authzed/spicedb/blob/main/internal/dispatch/caching/caching.go#L67

which is the address for the *internal* API

I should also set `SPICEDB_DISPATCH_CLUSTER_ENABLED=true` ?

to further complicate the matter we run on a service mesh

I don't suspect this to be all that useful, its probably a linkerd issue to sort out

Where to check, what is latest api version, I am using Java client in my app, in gradle I had like this com.authzed.api:authzed:0.2.0

Java version: https://github.com/authzed/authzed-java/tags
SpiceDB version is in the logs on startup

yeah, a bit outside my personal wheelhouse. <@767896513590329344> might have some insights, but as its a holiday, no expectations on response time

i disabled linkerd for the moment.  I think the connection is just failing

```
{"level":"info","grpc.component":"server","grpc.method":"CheckPermission","grpc.method_type":"unary","grpc.service":"authzed.api.v1.PermissionsService","peer.address":"10.11.246.160:55750","protocol":"grpc","requestID":"6d51de7529f6d1ba4a79b5b8811fc1f1","grpc.start_time":"2022-11-11T21:24:38Z","grpc.code":"OK","grpc.time_ms":"0.02","time":"2022-11-11T21:24:38Z","message":"started call"}

{"level":"warn","grpc.component":"server","grpc.method":"CheckPermission","grpc.method_type":"unary","grpc.service":"authzed.api.v1.PermissionsService","peer.address":"10.11.246.160:55750","protocol":"grpc","requestID":"6d51de7529f6d1ba4a79b5b8811fc1f1","grpc.start_time":"2022-11-11T21:24:38Z","grpc.code":"Unavailable","grpc.error":"rpc error: code = Unavailable desc = last connection error: connection closed before server preface received","grpc.time_ms":"7.6","time":"2022-11-11T21:24:38Z","message":"finished call"}
```

```
apiVersion: v1
kind: Service
metadata:
  name: database
  namespace: spicedb
  labels:
    app: database
spec:
  ports:
    - name: http
      protocol: TCP
      port: 80
      targetPort: 50051
    - name: dispatch
      protocol: TCP
      port: 8080
      targetPort: 50053
```

```
            - name: SPICEDB_DISPATCH_UPSTREAM_ADDR
              value: kubernetes:///database.spicedb:8080
            - name: SPICEDB_DISPATCH_CLUSTER_ENABLED
              value: "true"
```

Thanks, got it, I hope it has client for latest lookup subject API ?