844600078504951838 #spicedb

Channels

Joey

01/04/2022, 12:16 AM

as for frontend-based access, @User I'd be curious to learn more about your use case as we've had some ideas on how to enable frontend access without key compromise

gergan

01/04/2022, 3:59 PM

EU-based managed service will be great news. We are going to use microfrontends with microservices, which should be shown/hidden on the basis of the combination of the current user, a tenant, a license and a client. It is even more complicated, but for the frontend it is probably enough information. So the user will come from a OAuth2/OIDC token and the frontend shell, which should glue all the microfrontends together, will need to create the context for the application. The shell will let the user select a tenant, which also defines the license for the user, which in turn defines the microfrontends (products) and the clients, to which the user has access. A client could also be set in the context (as most of the products, operate on a client), but a client could be blocked for a given user and product, so we should only show it, if it is not blocked, the license of the user allows it and if the tenant has rights (relation of owning or sharing) on the client. So we thought, that we could in some way just call the SpiceDB from the frontend to list all the microfrontends (products), which a user could see for a combination of user, tenant and optionally a client. We probably will just need to implement a REST-API, in order to have this information. This information is not critical and we need it only in read only mode, the REST-APIs will nevertheless check SpiceDB to find out, if the user has enough permissions (tenant, license, client) for each call. I hope I have explained it somewhat clear 🙂

Joey

01/04/2022, 4:01 PM

@User yep! makes sense. REST-based API that does it for you sounds like a reasonable solution. As I said, we're investigating what it would be like for frontend-based access, but the key issue is preventing not only miswriting, but also information leakage in general (not just what you can access, but what you can see to check what you can access)

Sleipnir

01/04/2022, 5:39 PM

Is there any sort of timeline on https://github.com/authzed/connector-postgresql receiving a stable release?

ecordell

01/04/2022, 6:24 PM

The "import" part of it is available in

zed

under

zed experiment import postgres

Are you interested in running the connector continuously?

Sleipnir

01/04/2022, 6:24 PM

Yes.

ajshsu

01/04/2022, 8:19 PM

Is anyone familiar with deploying SpiceDB on Azure? It seems like gPRC is only supported on the new preview Azure Container Apps (https://github.com/dotnet/aspnetcore/issues/9020), but I've been having issues accessing the container's gRPC endpoint via the zed CLI.

Error: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing dial tcp IPADDRESS:8085: i/o timeout

Leads me to think there's a configuration issue somewhere on the Azure side...

Jake

01/05/2022, 1:30 AM

@ajshsu I don’t know of anyone using azure container apps to run spicedb

Jake

01/05/2022, 1:31 AM

AFAIK that error message shows the literal string it is trying to connect to, and should usually be a domain name or real IP address

Jake

01/05/2022, 1:32 AM

For authzed prod it would be

grpc.authzed.com:443

for example

Abhishek Dwivedi

01/05/2022, 3:13 PM

I am getting following error

uthzed-docker-compose-spicedb-engine-1  | {"level":"info","module":"pgx","args":[],"commandTag":"Uk9MTEJBQ0s=","pid":52,"sql":"rollback","time":0.531,"time":"2022-01-05T15:12:49Z","message":"Exec"}
authzed-docker-compose-spicedb-engine-1  | {"level":"error","grpc.component":"server","grpc.method":"WriteSchema","grpc.method_type":"unary","grpc.service":"authzed.api.v1.SchemaService","peer.address":"172.19.0.1:63740","protocol":"grpc","requestID":"b9220583cefbd8176c2e002d5799db48","grpc.start_time":"2022-01-05T15:12:49Z","grpc.code":"Unknown","grpc.error":"ERROR: relation \"namespace_config\" does not exist (SQLSTATE 42P01)","grpc.time_ms":"3.386","time":"2022-01-05T15:12:49Z","message":"finished call"}

Abhishek Dwivedi

01/05/2022, 3:13 PM

whilst using posgres what could be wrong here

Abhishek Dwivedi

01/05/2022, 3:14 PM

My configuration is

version: '3.6'
services:
  postgres:
    image: postgres:12
    restart: always
    volumes:
    - db_data:/var/lib/postgresql/data
    environment:
      POSTGRES_PASSWORD: secret
      POSTGRES_DB: defaultdb
  spicedb-engine:
    image: quay.io/authzed/spicedb:latest
    ports:
    - "8080:8080"
    - "9090:9090"
    - "50051:50051"
    depends_on:
    - "postgres"
    restart: always
    command: serve
    environment:
      ## spicedb preshared key for local execution
      SPICEDB_GRPC_PRESHARED_KEY: vista
      SPICEDB_LOG_LEVEL: "debug"
      ## this env var can be used to add the above postgres database to Hasura as a data source. this can be removed/updated based on your needs
      ##PG_DATABASE_URL: postgres://postgres:postgrespassword@postgres:5432/postgres
      SPICEDB_DATASTORE_ENGINE: postgres 
      SPICEDB_DATASTORE_CONN_URI: postgres://postgres:postgrespassword@postgres:5432/postgres
volumes:
  db_data:

ecordell

01/05/2022, 3:14 PM

You'll need to run

spicedb migrate head

against the postgres db before spicedb will work

ecordell

01/05/2022, 3:16 PM

spicedb migrate head --datastore-conn-uri=postgres://postgres:postgrespassword@postgres:5432/postgres --datastore-engine=postgres

Abhishek Dwivedi

01/05/2022, 3:24 PM

is there a place this is documented , i may have missed reading

Jake

01/05/2022, 3:26 PM

you're not the first person who has tripped on this, we will add it to the readme today!

Jake

01/05/2022, 3:26 PM

unless you want to take dibs on adding it to the readme?

Abhishek Dwivedi

01/05/2022, 3:46 PM

would love to do it , but before that i need it up and running 🙂

uthzed-docker-compose-spicedb-engine-migrate-1  | {"level":"fatal","error":"unable to instantiate AlembicPostgresDriver: pq: SSL is not enabled on the server","time":"2022-01-05T15:44:43Z","message":"unable to create migration driver"}

Jake

01/05/2022, 3:47 PM

you can disable SSL via the connection string, let me look up the flag

Abhishek Dwivedi

01/05/2022, 3:47 PM

I hope my config looks right

version: '3.6'
services:
  postgres:
    image: postgres:12
    restart: always
    volumes:
    - db_data:/var/lib/postgresql/data
    environment:
      POSTGRES_PASSWORD: secret
      POSTGRES_DB: defaultdb
  spicedb-engine-migrate:
    image: quay.io/authzed/spicedb:latest
    ports:
    - "8080:8080"
    - "9090:9090"
    - "50051:50051"
    depends_on:
     - postgres
    command: migrate head
    restart: always
    environment:
      ## spicedb preshared key for local execution
      SPICEDB_GRPC_PRESHARED_KEY: vista
      SPICEDB_LOG_LEVEL: "debug"
      ## this env var can be used to add the above postgres database to Hasura as a data source. this can be removed/updated based on your needs
      ##PG_DATABASE_URL: postgres://postgres:postgrespassword@postgres:5432/postgres
      SPICEDB_DATASTORE_ENGINE: postgres 
      SPICEDB_DATASTORE_CONN_URI: postgres://postgres:postgrespassword@postgres:5432/postgres
  spicedb-engine:
    image: quay.io/authzed/spicedb:latest
    ports:
    - "8080:8080"
    - "9090:9090"
    - "50051:50051"
    depends_on:
     - spicedb-engine-migrate
    command: serve 
    restart: always
    environment:
      ## spicedb preshared key for local execution
      SPICEDB_GRPC_PRESHARED_KEY: vista
      SPICEDB_LOG_LEVEL: "debug"
      ## this env var can be used to add the above postgres database to Hasura as a data source. this can be removed/updated based on your needs
      ##PG_DATABASE_URL: postgres://postgres:postgrespassword@postgres:5432/postgres
      SPICEDB_DATASTORE_ENGINE: postgres 
      SPICEDB_DATASTORE_CONN_URI: postgres://postgres:postgrespassword@postgres:5432/postgres
volumes:
  db_data:

Jake

01/05/2022, 3:48 PM

try adding

?sslmode=disable

to the end of your postgres connection string

Jake

01/05/2022, 4:09 PM

@User did that work?

Abhishek Dwivedi

01/05/2022, 4:20 PM

Does this look good ?

Jake

01/05/2022, 4:20 PM

yep

Jake

01/05/2022, 4:21 PM

can we move these logs to a Discord thread?

Jake

01/05/2022, 4:21 PM

looks like spicedb started up correctly

Abhishek Dwivedi

01/05/2022, 4:25 PM

looks like ... sorry b/w slack and discord too much to learn and do .. i need to check if it is working

Abhishek Dwivedi

01/05/2022, 4:39 PM

thanks works for me ... i have a correct configuration .. of a docker compose yaml now ..

ajshsu

01/05/2022, 6:07 PM

I see, thanks Jake! I managed to get something working using Azure Container Instances instead, I think it is something to do with how the network traffic is routed on the Azure side