https://authzed.com logo
Powered by
spicedb
  • j

    Joey

    12/29/2022, 8:22 PM
    at some point you need to define base permissions to check
    s
    • 2
    • 12
  • s

    Singha1

    12/29/2022, 8:34 PM
    at some point you need to define base
  • d

    derekperkins

    01/02/2023, 11:41 PM
    I'm looking to add Google Cloud style RPC permissions to our app. My original idea was to generate mappings inside our proto, with the fully qualified name as the id, e.g. 
    /nozzle.billing.v1.PlansService/ListPlans
    , but it appears that isn't supported. I found this recommendation from 8 months ago to base64 encode it. Is that still the recommendation? Is there a better approach? https://discord.com/channels/844600078504951838/844600078948630559/972191542435532860
    j
    j
    • 3
    • 9
  • k

    kameshraj

    01/03/2023, 4:40 PM
    authz-as-a-service
    j
    • 2
    • 5
  • p

    pquerna

    01/03/2023, 5:48 PM
    This isn't quite what you are looking for, and maybe not relvant to spicedb directly, but i've played with generating code based on Proto specs, and then using that at runtime to do authorization: https://github.com/pquerna/protoc-gen-authz/blob/main/examplepb/example.proto
  • t

    tim-dcdbl

    01/04/2023, 12:53 AM
    I just started SpiceDB in k8s via the k8s operator, as recommended (https://authzed.com/docs/spicedb/operator). When I hit it from the client I see this message: 
    $ zed version
client: zed 0.7.5
4:46PM WRN the version of SpiceDB being called is out of date. See: https://github.com/authzed/spicedb/releases/tag/v1.15.0 latest-released-version=v1.15.0 this-version=v1.11.0
service: v1.11.0
    I would expect a brand new SpiceDB instance from a brand new install of the k8s operator would be up to date, but instead it is 4 minor versions behind. Anybody know what's up? What should I do instead? Yes I need features that don't work with this version but did work when I installed via 
    brew install authzed/tap/spicedb
    and ran from the command line. I need to convince folks at my company (including myself) that SpiceDB is the way to go, and have been impressed so far. It'd be a real big help if the recommended install method was up to date. Or else am I missing something? Thank you!
  • e

    ecordell

    01/04/2023, 1:01 AM
    The operator will run the newer releases of spicedb, you can set the image field on the SpicedbCluster object. (The default version will be bumped up the newest release when we cut the next release of the operator, which is currently undergoing more internal testing before we tag a new version)
  • t

    tim-dcdbl

    01/04/2023, 1:05 AM
    Awesome, thank you. Really appreciate the fast response. I see the instructions at https://authzed.com/docs/spicedb/operator#manual-upgrades . Does this look right: 
    spec:
  config:
    image: authzed/spicedb:v1.15.0
  • j

    Joey

    01/04/2023, 1:23 AM
    I believe that is correct, yes
  • t

    tim-dcdbl

    01/04/2023, 1:25 AM
    Fixed. Then I hit this problem https://github.com/authzed/spicedb-operator/issues/111 and used the workaround (remove from Deployment env var 
    SPICEDB_DISPATCH_UPSTREAM_ADDR
    ). I see the fix was merged 2022-12-01. I'll be using postrges store so I expect operator to work out of the box (unaffected by this issue). Again, sure appreciate your help!
  • t

    tim-dcdbl

    01/04/2023, 9:12 PM
    I'm using 
    datastoreEngine: postgres
    with the k8s operator, but the initial migrate job the operator attempts fails with error message: 
    unable to migrate to `head` revision: error executing migration `add-xid-columns`: ERROR: type "xid8" does not exist (SQLSTATE 42704)
    on postgres 12.4. Any ideas? Thanks!
  • t

    tim-dcdbl

    01/04/2023, 9:21 PM
    Ah! Per https://pkg.go.dev/github.com/authzed/spicedb/internal/datastore/postgres: > Minimum required version: 13.0
  • j

    Joey

    01/04/2023, 9:34 PM
    and, in fact, we recommend at least 13.8
  • j

    Joey

    01/04/2023, 9:34 PM
    we'll get the doc comment updated
  • s

    smithp4ntz

    01/04/2023, 10:37 PM
    Is there any examples of Kubernetes using SpiceDB for its authz?
    v
    j
    • 3
    • 5
  • v

    vroldanbet

    01/05/2023, 9:32 AM
    Is there any examples of Kubernetes
  • s

    Shyam

    01/05/2023, 11:07 AM
    #844600078948630559 Hi guys, Am trying to change the endpoint for opentelemtry tracing by using the env variables suggested here https://github.com/jzelinskie/cobrautil/pull/3 But seems to be that during the initialization, the spicedb is not taking the exporters and endpoints that have been passed as ENV variables. "OTEL_EXPORTER_OTLP_ENDPOINT" Any suggestions ?
    v
    • 2
    • 19
  • v

    vroldanbet

    01/05/2023, 12:58 PM
    Make OTLP initialization more generic an...
  • f

    fmascarenhas

    01/05/2023, 1:58 PM
    I am getting this in the logs: 
    │ spicedb-5bc6d7f6d5-9g8p7 {"level":"warn","error":"timeout: context deadline exceeded","time":"2023-01-05T13:53:24Z","message":"error attempting to perform garbage collection"}                                 │
│ spicedb-5bc6d7f6d5-dx8sb {"level":"error","module":"pgx","args":[4124334],"err":"timeout: context deadline exceeded","pid":25001,"sql":"WITH rows AS (SELECT namespace, object_id, relation, userset_namespace, │
│  userset_object_id, userset_relation, created_xid, deleted_xid FROM relation_tuple WHERE deleted_xid < $1 LIMIT 1000)\n\t\t  DELETE FROM relation_tuple\n\t\t  WHERE (namespace, object_id, relation, userset_n │
│ amespace, userset_object_id, userset_relation, created_xid, deleted_xid) IN (SELECT namespace, object_id, relation, userset_namespace, userset_object_id, userset_relation, created_xid, deleted_xid FROM rows) │
│ ;\n\t","time":59989.653851,"time":"2023-01-05T13:53:24Z","message":"Exec"}
    There is probably a lot of garbage because I was using TOUCH instead of CREATE consistently, and unaware of https://github.com/authzed/spicedb/issues/901. This has been fixed, but I would like to clean the existing garbage. Is it possible to increase this deadline through an environment variable? For context, the datastore is Postgres, in a rather beefy RDS instance of Postgres 14 (4 vCPU).
    v
    • 2
    • 4
  • v

    vroldanbet

    01/05/2023, 2:13 PM
    Issues · authzed/spicedb
  • r

    RobertM

    01/06/2023, 5:39 AM
    Hello 👋 Question about schema - is it possible to import schema from some file or a custom resource? Does operator have this functionality?
  • j

    Joey

    01/06/2023, 5:40 AM
    spicedb itself can be given a schema + relationships on startup to be imported
    e
    • 2
    • 6
  • j

    Joey

    01/06/2023, 5:40 AM
    it is, however, not recommended for production
  • j

    Joey

    01/06/2023, 5:41 AM
    --datastore-bootstrap-files strings                        bootstrap data yaml files to load
      --datastore-bootstrap-overwrite                            overwrite any existing data with bootstrap data
  • j

    Joey

    01/06/2023, 5:41 AM
    the file format is that produced by the Playground
  • j

    Joey

    01/06/2023, 5:42 AM
    examples here: https://github.com/authzed/spicedb/tree/main/pkg/validationfile/testdata
  • r

    RobertM

    01/06/2023, 5:43 AM
    Thank you!
  • Hello is there anyone using pgbouncer
    p

    poulpi

    01/06/2023, 4:38 PM
    Hello, is there anyone using pgbouncer around here? I'm having some errors that seems to come from it + SpiceDB. Like: 
    2 UNKNOWN: unable to find revision: ERROR: prepared statement \"lrupsc_89_0\" does not exist (SQLSTATE 26000)
    l
    v
    • 3
    • 2
  • p

    poulpi

    01/06/2023, 4:38 PM
    It look like this pgx issue: https://github.com/jackc/pgx/issues/602
  • p

    poulpi

    01/06/2023, 4:40 PM
    It seems that spicedb is using pgx: https://github.com/authzed/spicedb/blob/06a4a74a2967427ec0a90045fd373bf2ba52c5bc/internal/datastore/postgres/postgres.go
1...315316317...325Latest