844600078504951838 #spicedb

Channels

zanzibar

spicedb

Singha1

12/29/2022, 8:34 PM

at some point you need to define base

derekperkins

01/02/2023, 11:41 PM

I'm looking to add Google Cloud style RPC permissions to our app. My original idea was to generate mappings inside our proto, with the fully qualified name as the id, e.g.

/nozzle.billing.v1.PlansService/ListPlans

, but it appears that isn't supported. I found this recommendation from 8 months ago to base64 encode it. Is that still the recommendation? Is there a better approach? https://discord.com/channels/844600078504951838/844600078948630559/972191542435532860

kameshraj

01/03/2023, 4:40 PM

authz-as-a-service

pquerna

01/03/2023, 5:48 PM

This isn't quite what you are looking for, and maybe not relvant to spicedb directly, but i've played with generating code based on Proto specs, and then using that at runtime to do authorization: https://github.com/pquerna/protoc-gen-authz/blob/main/examplepb/example.proto

tim-dcdbl

01/04/2023, 12:53 AM

I just started SpiceDB in k8s via the k8s operator, as recommended (https://authzed.com/docs/spicedb/operator). When I hit it from the client I see this message:

Copy code

$ zed version
client: zed 0.7.5
4:46PM WRN the version of SpiceDB being called is out of date. See: https://github.com/authzed/spicedb/releases/tag/v1.15.0 latest-released-version=v1.15.0 this-version=v1.11.0
service: v1.11.0

I would expect a brand new SpiceDB instance from a brand new install of the k8s operator would be up to date, but instead it is 4 minor versions behind. Anybody know what's up? What should I do instead? Yes I need features that don't work with this version but did work when I installed via

brew install authzed/tap/spicedb

and ran from the command line. I need to convince folks at my company (including myself) that SpiceDB is the way to go, and have been impressed so far. It'd be a real big help if the recommended install method was up to date. Or else am I missing something? Thank you!

ecordell

01/04/2023, 1:01 AM

The operator will run the newer releases of spicedb, you can set the image field on the SpicedbCluster object. (The default version will be bumped up the newest release when we cut the next release of the operator, which is currently undergoing more internal testing before we tag a new version)

tim-dcdbl

01/04/2023, 1:05 AM

Awesome, thank you. Really appreciate the fast response. I see the instructions at https://authzed.com/docs/spicedb/operator#manual-upgrades . Does this look right:

Copy code

spec:
  config:
    image: authzed/spicedb:v1.15.0

Joey

01/04/2023, 1:23 AM

I believe that is correct, yes

tim-dcdbl

01/04/2023, 1:25 AM

Fixed. Then I hit this problem https://github.com/authzed/spicedb-operator/issues/111 and used the workaround (remove from Deployment env var

SPICEDB_DISPATCH_UPSTREAM_ADDR

). I see the fix was merged 2022-12-01. I'll be using postrges store so I expect operator to work out of the box (unaffected by this issue). Again, sure appreciate your help!

tim-dcdbl

01/04/2023, 9:12 PM

I'm using

datastoreEngine: postgres

with the k8s operator, but the initial migrate job the operator attempts fails with error message:

Copy code

unable to migrate to `head` revision: error executing migration `add-xid-columns`: ERROR: type "xid8" does not exist (SQLSTATE 42704)

on postgres 12.4. Any ideas? Thanks!

tim-dcdbl

01/04/2023, 9:21 PM

Ah! Per https://pkg.go.dev/github.com/authzed/spicedb/internal/datastore/postgres: > Minimum required version: 13.0

Joey

01/04/2023, 9:34 PM

and, in fact, we recommend at least 13.8

Joey

01/04/2023, 9:34 PM

we'll get the doc comment updated

smithp4ntz

01/04/2023, 10:37 PM

Is there any examples of Kubernetes using SpiceDB for its authz?

vroldanbet

01/05/2023, 9:32 AM

Is there any examples of Kubernetes

Shyam

01/05/2023, 11:07 AM

#844600078948630559 Hi guys, Am trying to change the endpoint for opentelemtry tracing by using the env variables suggested here https://github.com/jzelinskie/cobrautil/pull/3 But seems to be that during the initialization, the spicedb is not taking the exporters and endpoints that have been passed as ENV variables and takes the default values Passing a different endpoint using this variable "OTEL_EXPORTER_OTLP_ENDPOINT", but doesn't work Any suggestions ?

vroldanbet

01/05/2023, 12:58 PM

Make OTLP initialization more generic an...

fmascarenhas

01/05/2023, 1:58 PM

I am getting this in the logs:

Copy code

│ spicedb-5bc6d7f6d5-9g8p7 {"level":"warn","error":"timeout: context deadline exceeded","time":"2023-01-05T13:53:24Z","message":"error attempting to perform garbage collection"}                                 │
│ spicedb-5bc6d7f6d5-dx8sb {"level":"error","module":"pgx","args":[4124334],"err":"timeout: context deadline exceeded","pid":25001,"sql":"WITH rows AS (SELECT namespace, object_id, relation, userset_namespace, │
│  userset_object_id, userset_relation, created_xid, deleted_xid FROM relation_tuple WHERE deleted_xid < $1 LIMIT 1000)\n\t\t  DELETE FROM relation_tuple\n\t\t  WHERE (namespace, object_id, relation, userset_n │
│ amespace, userset_object_id, userset_relation, created_xid, deleted_xid) IN (SELECT namespace, object_id, relation, userset_namespace, userset_object_id, userset_relation, created_xid, deleted_xid FROM rows) │
│ ;\n\t","time":59989.653851,"time":"2023-01-05T13:53:24Z","message":"Exec"}

There is probably a lot of garbage because I was using TOUCH instead of CREATE consistently, and unaware of https://github.com/authzed/spicedb/issues/901. This has been fixed, but I would like to clean the existing garbage. Is it possible to increase this deadline through an environment variable? For context, the datastore is Postgres, in a rather beefy RDS instance of Postgres 14 (4 vCPU).

vroldanbet

01/05/2023, 2:13 PM

Issues · authzed/spicedb

RobertM

01/06/2023, 5:39 AM

Hello 👋 Question about schema - is it possible to import schema from some file or a custom resource? Does operator have this functionality?

Joey

01/06/2023, 5:40 AM

spicedb itself can be given a schema + relationships on startup to be imported

Joey

01/06/2023, 5:40 AM

it is, however, not recommended for production

Joey

01/06/2023, 5:41 AM

Copy code

--datastore-bootstrap-files strings                        bootstrap data yaml files to load
      --datastore-bootstrap-overwrite                            overwrite any existing data with bootstrap data

Joey

01/06/2023, 5:41 AM

the file format is that produced by the Playground

Joey

01/06/2023, 5:42 AM

examples here: https://github.com/authzed/spicedb/tree/main/pkg/validationfile/testdata

RobertM

01/06/2023, 5:43 AM

Thank you!

poulpi

01/06/2023, 4:38 PM

Hello, is there anyone using pgbouncer around here? I'm having some errors that seems to come from it + SpiceDB. Like:

2 UNKNOWN: unable to find revision: ERROR: prepared statement \"lrupsc_89_0\" does not exist (SQLSTATE 26000)

poulpi

01/06/2023, 4:38 PM

It look like this pgx issue: https://github.com/jackc/pgx/issues/602

poulpi

01/06/2023, 4:40 PM

It seems that spicedb is using pgx: https://github.com/authzed/spicedb/blob/06a4a74a2967427ec0a90045fd373bf2ba52c5bc/internal/datastore/postgres/postgres.go

poulpi

01/06/2023, 4:41 PM

And that to make pgx works with pgbouncer, some additional connConfig as to be made, like: func TestPgbouncerStatementCacheDescribe(t *testing.T) { connString := os.Getenv("PGX_TEST_PGBOUNCER_CONN_STRING") if connString == "" { t.Skipf("Skipping due to missing environment variable %v", "PGX_TEST_PGBOUNCER_CONN_STRING") } config := mustParseConfig(t, connString) config.DefaultQueryExecMode = pgx.QueryExecModeCacheDescribe // This seems to be important config.DescriptionCacheCapacity = 1024 testPgbouncer(t, config, 10, 100) }