844600078504951838 #spicedb

Channels

zanzibar

test-forum

spicedb

poulpi

12/01/2022, 10:24 AM

(with kubectl port-forward -n spicedb deployment/main-spicedb 50051:50051 to redirect spicedb on localhost beforehand)

poulpi

12/01/2022, 10:25 AM

However, all calls made by zed end up with: transport: authentication handshake failed: x509: certificate signed by unknown authority

poulpi

12/01/2022, 10:26 AM

And when running with --insecure, I get: connection closed before server preface received, which seems to be "normal" for grpc when it get an insecure connection while the server is configured with TLS

poulpi

12/01/2022, 10:27 AM

If my analysis is correct, I need to get the root CA used to sign the TLS cert given to SpiceDB (generated by cert manager) on my local machine before making zed initiating the calls

poulpi

12/01/2022, 10:28 AM

I can download the root CA generated in the kube cluster with some kubectl commands and write it locally, but how can I make sure that zed is using them?

poulpi

12/01/2022, 10:43 AM

okay, I found the solution, it was more a linux thing that a SpiceDB matter but here are the commands if it can help some people in the future:

poulpi

12/01/2022, 10:43 AM

kubectl get secret -n spicedb internal-ca -o jsonpath="{.data.tls\.crt}" | base64 --decode > tls.crt

poulpi

12/01/2022, 10:45 AM

⤴️ This is downloading the root CA used to sign the TLS cert given to SpiceDB from the kubernetes cluster, it should be the Secret passed to

dispatchUpstreamCASecretName

in the

SpiceDBCluster

config

poulpi

12/01/2022, 10:45 AM

sudo mv tls.crt /usr/local/share/ca-certificates/ && update-ca-certificates

poulpi

12/01/2022, 10:46 AM

⤴️ For people on Debian / Unbuntu, this is putting the certificate in the place where root CA certificates can be imported in the OS

poulpi

12/01/2022, 10:47 AM

This is making zed work to make calls directly inside the cluster with

zed schema read --endpoint localhost:50051 --token "verystrong"

vroldanbet

12/01/2022, 10:58 AM

what's the challenge? is it also a corporate machine that does not allow you do run binaries downloaded from the internet?

hcguy

12/01/2022, 4:46 PM

To use zed on windows using docker use the following command. This assumes the spicedb is running in docker on a network called “datastores_default” which will be the case for the examples in the datastores folder

docker run -it —rm —network=“datastores_default” authzed/zed —token secrettoken —endpoint spicedb:50051 —insecure permission check <objtype:objid perm subtype:subdivided> —explain

. Done from my iPad, transcribed from my work computer. watch out for typos. It collapsed the double dashes into one long dash, sorry.

hcguy

12/01/2022, 4:56 PM

Update. I have a program that runs a bunch of perm checks, emulating the assertions tab in the playground. It seems the failure occurs on certain checks and not others, consistently. The ones that fail have complex explanations. The explanations appear in zed just fine. I can see the two calls in the server log (trace level) and I don’t see any obvious difference. I’ll compare more closely when I get a chance

Joey

12/01/2022, 4:57 PM

strange... if they appear in zed, then they are being sent back over the wire correctly

hcguy

12/01/2022, 5:16 PM

Yep. Anyone know what consistency value zed is using?

Joey

12/01/2022, 5:17 PM

by default? minimize latency

Joey

12/01/2022, 5:17 PM

you can specify a zedtoken though to use that with at least as fresh

hcguy

12/01/2022, 6:03 PM

I’m using minimize latency. Just looking for something I might be doing differently at the api

Perseus

12/02/2022, 6:07 AM

In what case does the

LookupSubjectsResponse

return the

ResolvedSubject

? I'm trying to make a call to fetch all subjects of a resource, but the

subjectType

is not something that is returned in that

Joey

12/02/2022, 6:09 AM

not sure I understand

Perseus

12/02/2022, 6:12 AM

I'm trying to use LookupSubjects to fetch the list of "subjects" that have some permission on a resource - the response contains something like this, which is the

id

of the subject and the zedToken. Is there a way to include the

type

of the subject in the result as well?

Joey

12/02/2022, 6:12 AM

ah. well, you are giving the subject type in the request... so just use that?

Perseus

12/02/2022, 6:13 AM

i'm not passing in the subject type - believe thats optional? i need a list of all the subjects

Joey

12/02/2022, 6:13 AM

it is not

Joey

12/02/2022, 6:13 AM

it is required to pass in the subject type

Joey

12/02/2022, 6:13 AM

the subject relation is optional (since you may not need one), but the subject type is required on the request

Joey

12/02/2022, 6:13 AM

hence why the response does not have it; it would be repeated information

Perseus

12/02/2022, 6:14 AM

ahhh yes, you're right, brain fart. thank you

Joey

12/02/2022, 6:14 AM

if you need to find all subject types, then you can use

Expand