844600078504951838 #spicedb

Channels

RobertM

11/22/2022, 4:29 AM

Hi! I'm looking into using spicedb operator and have a question about the configuration options for SpiceDB clusters. It seems like the only way to pass configuration now to a new SpiceDB cluster is by specifying

secretName

- is this correct? I'm basing my assumption on: https://github.com/authzed/spicedb-operator/blob/cac0628fcdc84c111d081f303641a790925a17f9/pkg/config/config.go#L198-L217 Is there another way I could provide

datastore_uri

for operator to use for clusters? env variable? Are there plans to introduce any other way? Currently I have credentials that I want to use in

datastore_uri

in another secret, so I'm looking for a solution here... Thanks!

ethanlew

11/22/2022, 4:31 AM

Question - Say I wanted to make a schema change to make all user profiles visible to the public - is there a way to add a reference to "all users" in the schema without writing a new relationship for every single user to to user:*? I'm curious if there's a way to do this with only a schema change to a permission.

Joey

11/22/2022, 4:33 AM

I believe the current requirement is a secret, but I'll ask our operator experts tomorrow and see if there is another way

RobertM

11/22/2022, 4:34 AM

Thanks! If that's the only way happy to create some issue and discuss it!

Joey

11/22/2022, 4:34 AM

the general recommendation is to have a parent organization/namespace/something, have each object have a reference to that parent container, and then add a permission on that parent so that you can grant "global" access with one additional relationship write

Joey

11/22/2022, 4:34 AM

similar to if you wanted a superuser

Joey

11/22/2022, 4:34 AM

so you might do

Joey

11/22/2022, 4:35 AM

definition user {}

definition platform {
  relation superuser: user
}

definition resource {
  relation platform: platform
  relation viewer: user
  permission view = viewer + platform->superuser
}

Joey

11/22/2022, 4:35 AM

you could do something similar to have a wildcard on the platform

ethanlew

11/22/2022, 4:36 AM

cool that makes sense - I'm using this exact approach for some other things as I'm trying out the playground

Joey

11/22/2022, 4:37 AM

great!

Joey

11/22/2022, 4:37 AM

there has been a request for either a wildcard resource or a static relationship; we have a proposal tracking some ideas here: https://github.com/authzed/spicedb/issues/346

Joey

11/22/2022, 4:37 AM

but nothing concrete yet as to a plan

symion

11/22/2022, 6:17 PM

Is there something the lists all of the config flags / variables?

symion

11/22/2022, 6:17 PM

i see the page for data store config, and the dispatching config. is that everything? or is there more that I'm not seeing?

vroldanbet

11/22/2022, 6:31 PM

spicedb serve --help

should offer you an exhaustive list

Singha1

11/22/2022, 8:51 PM

Does Java Client library support Cavetas ?

jzelinskie

11/22/2022, 11:08 PM

Looks like it still needs an update. It's a one line change, though. Can probably do it tonight or tomorrow morning.

ensonic

11/23/2022, 10:24 AM

Now that https://github.com/authzed/spicedb-operator/blob/main/default-operator-config.yaml got updated, even if I reapply:

kubectl apply --server-side -k github.com/authzed/spicedb-operator/config

I am still on 1..11.0:

zed version
client: zed 0.7.5
11:22AM WRN the version of SpiceDB being called is out of date. See: https://github.com/authzed/spicedb/releases/tag/v1.15.0 latest-released-version=v1.15.0 this-version=v1.11.0
service: v1.11.0

what am I missing?

ensonic

11/23/2022, 10:25 AM

I'd like to try the update since there is no more replies on https://github.com/authzed/zed/issues/169 and I'd like to even finish the getting started tutorials at some point to make a call it this is the authz engine to bet on

vroldanbet

11/23/2022, 11:03 AM

we are actively working on evolving the operator to follow an update channels model, so some things are in flight at the moment 🙏🏻 I believe you should be able to specify the target image in your CR and the operator would use it.

spec:
  config:
    image: authzed/spicedb:v1.15.0

ensonic

11/23/2022, 11:32 AM

thanks, let me try that

ensonic

11/23/2022, 11:39 AM

that worked, thanks!

ensonic

11/23/2022, 11:43 AM

but the error iwrt to displatch is still there :/

zed version
client: zed 0.7.5
service: v1.15.0
...
zed permission check blog/post:1 read  blog/user:emilia --revision "${ZEDTOKEN}"
Error: rpc error: code = Unavailable desc = last connection error: connection error: desc = "transport: Error while dialing dial tcp 192.168.9.11:50053: connect: connection refused"

Can/Should I disable dispatch in the operator config? And is there is list of cli-flags for spicedb ?

vroldanbet

11/23/2022, 11:45 AM

the list of CLI flags can be determined by running

spicedb serve --help

. The parameter to disable dispatch is

--dispatch-upstream-addr

, setting it to empty string disables dispatching, AFAIK

vroldanbet

11/23/2022, 11:46 AM

The tutorial suggests using memory, if I'm not mistaken, and dispatch shouldn't be enabled for the memory datastore (by definition that won't work since global state is in memory)

vroldanbet

11/23/2022, 11:46 AM

if the operator is still setting an upstream for that datastore, it must be a regression

ensonic

11/23/2022, 11:48 AM

will try that now (FYI: go install github.com/authzed/spicedb@v1.15.0 does not work :()

go install github.com/authzed/spicedb@v1.15.0
go: github.com/authzed/spicedb@v1.15.0 (in github.com/authzed/spicedb@v1.15.0):
    The go.mod file for the module providing named packages contains one or
    more replace directives. It must not contain directives that would cause
    it to be interpreted differently than if it were the main module.

vroldanbet

11/23/2022, 11:48 AM

in the meanwhile, you can try to add

dispatchUpstreamAddr

to your CR with an empty string to see if that forces

vroldanbet

11/23/2022, 11:51 AM

I'll open an issue. Alternatively you can use our docker images