it's possible that there's an optimization where we realize that we're dispatching to the same node, and use another transport to get there faster, but it's also possible that kubernetes networking resolved the local pod name to localhost and uses loopback

until it turns into a bottleneck we're not going to worry about it

no premature optimization 😉

another option would be to hit the Kubernetes API to discover all deployments and balance between the requests directly 😉

Can you explain this a little more? I want to understand this better before I respond

Note this is purely some ideas on how to solve the problem of 'cluster' discovery to maybe come up with an improved Helm chart from the one above. As far as I understand spicedb dispatches subproblems to other instances of itself (including itself), in order to do that it needs to discover the other instances somehow. As far as I can see one approach is to point towards a kubernetes service, which will load balance it then to the instances (what Jonathan did in the above Helm chart). I'm not sure how authzed configures clusters though 🙂 - one alternative I see is a headless service for discovery, that gives you all the A records of instances and goes around loadbalancing/proxy-ing (see https://kubernetes.io/docs/concepts/services-networking/service/#headless-services) - a more kubernetes specific solution would be to hit kubernetes APIs to get the list of A records for all instances, also avoiding proxy-ing and load-balancing So to formulate it as a question: Is there some preferred way to run spicedb on Kubernetes? Or do you have some good experience/mistakes to learn from?

so that's what the kuberesolver does, it gets all of the pods from the service directly, then skips k8s load balancing

ahh, I'm silly, RTFM: https://authzed.com/blog/consistent-hash-load-balancing-grpc/ 🤦

Yep, you got it 👍

kuberesolver is dead simple and yet really slick 🙂

Hello all, I'm relatively new to Zanzibar paper and its implementations. We were currently hoping to implement the entire Ory Ecosystem of products in our organisation but stumbled upon a few issues we felt were too big for time being to adopt it. I have heard nothing but great things about SpiceDB and would love to use it. Can someone help me out with any piece or article that guides through integrating ory products like Kratos and Oathkeeper with SpiceDB instead of Keto?

hi @User, we don't have any formal docs or articles on that (although that's a really good idea). However, it should be fairly straightforward to do: you'd use Kratos to get an identity (user id, or somesuch), and then just make an API call to SpiceDB with the user as the subject

Let me elaborate our problem faced while trying to use Ory Keto. We wish to create an admin panel where in a user would be able to create organisations, roles in the organisations and attach policies that are a set of permissions granted to that particular role. A user may be a part of multiple organisations. The very issue is that we trying to use Keto that's an ACL as a RBAC but it doesn't have any rewrites functionality as mentioned in the Zanzibar paper to help batch additions or deletions or roughly anything close to it without iterating over Keto data one by one.

Any solutions you may be able to propose would be god sent for us 🙂

Answering your question - We are using Kratos

how are you calling Keto to check the permissions decisions?

We were in the planning stage when we faced this issue. (thank god we didn't jump into implementation)

Oathkeeper usually helps with that

Although i'm fairly sure we could have hard checks everytime when user hits an API resource

gotcha

so I don't know as much about Oathkeeper off of the top of my head, but if you're okay making the API checks yourself, then yes, you can use Authzed or SpiceDB to accomplish what you want today

basically, you'd make a gRPC or HTTP call to the Authzed/SpiceDB

CheckPermission

endpoint, and use its result

the SpiceDB Schema (docs here: https://docs.authzed.com/reference/schema-lang) defines how permissions are computed, including rewrites (we express them as "arrows")

https://docs.authzed.com/guides/schema does a walkthrough of how to write schema, including inline playgrounds for the examples that you can fork off of

One last question although it might sound a little silly - Can i have organisation with role like structure in SpiceDB?

yep

you just write your schema to do so

so you might have something like:

definition user {}

definition organization {
  relation role: role
}

definition role {
  relation member: user
}

definition resource {
  relation viewer: role
  permission view = viewer->member
}

(as a very simple example)

If this works out as planned, I would love to contribute towards the documentation for integrating Ory Products with SpiceDB because i'm very sure there would be a lot more folks out there with a similar problem! I'll keep you posted and thanks once again! I'll try out this approach.