Is there any install docs for production, or is it expected that we use the managed service?

hi @User - we're currently working on install docs for production deployments of SpiceDB. In the meantime, there is a community provided Helm chart, and we can provide guidance here (we also have an on prem Enterprise offering if you want paid help and support)

@User can you link your Helm chart again ^?

Thanks 🙂

Would you ever recommend the

in-memory

storage for prod use, or is that really just for local testing?

IE. is it safe to use?

The chart doesn't yet support all of the command-line flags. The support in there is quite new and needs some more work, but it does work to deploy a basic spicedb cluster in k8s.

@User its only recommended for local testing, unless you intend to never have more than one node and, even then, its not optimized for performance

if you're deploying in, say, IoT, its probably fine

but longer term, it might be better to write something like a SQLite datastore

Nah we're looking at kubernetes

if you have more than one node, then it can't be used

since all nodes need access to the same data

Yeah multi-node

so Postgres, CRDB and (in beta) Spanner are your options

Hi 👋 Question: Can I make lookup requests via HTTP POST requests? Only found expand requests on the Swagger doc https://petstore.swagger.io/?url=https://raw.githubusercontent.com/authzed/authzed-go/main/proto/apidocs.swagger.json#/

Lookup: https://petstore.swagger.io/?url=https://raw.githubusercontent.com/authzed/authzed-go/main/proto/apidocs.swagger.json#/PermissionsService/PermissionsService_LookupResources

Check: https://petstore.swagger.io/?url=https://raw.githubusercontent.com/authzed/authzed-go/main/proto/apidocs.swagger.json#/PermissionsService/PermissionsService_CheckPermission

Oooff missed that! Thanks!

anytime 🙂

Hi i have this really noob question. Is the zedtoken only relevant to one relationship? Here's what im thinking, im planning to keep the zedtoken as volatile. If the zedtoken doesn't exist, the app will use fully_consistent check then keep the zedtoken in mem.

the zed token applies to all the data in the datastore and can be thought of as a revision of the database

we recommend only keeping around zedtokens and using them when you need to guarantee as fresh as the request that minted the zed token (e.g. a read after write)

If you were to have a worker just updating a zedtoken in the background, it would lose the context of why it needs to be that fresh. You could still have inconsistent reads if that token isn't updated after writes. In this hypothetical scenario it'd probably be better to provide no zedtoken and just let SpiceDB pick the best one for you.

Hi folks! Is this an appropriate place to ask questions about policy schema design?

Thanks for the response. Sorry i wasnt very clear with my scenario. I wanted to keep the zedtoken in memory and update it when there is a relationship mutation instead of stashing it on to a permanent store. As long as i have the latest zedtoken in mem, then it will be immune to the new enemy problem, plus it will be more efficient for spicedb. But i get the concept now!! Thanks 👍

Consider an API following the guidance from https://cloud.google.com/apis/design/resources. Your API is modeled as collections of individually-addressable resources (the nouns of the API). For example, you could have a root /widgets collection which contains individual widgets, e.g. /widgets/72. Some operations apply to the /widgets collection, e.g. List, and some operations apply to the an individual widget, e.g Get or Update. Do you have any guidance on SpiceDB schema design for collections vs elements of collections?

Yup! Happy to help answer questions about schema design. So the SpiceDB schema language doesn't inherently have a notion of collections but you can define object definitions as you see fit. For example, you could have:

definition widget {}
definition widget_collection {
  relation member: widget
}

and define permissions on the widget_collection appropriate for a collection. Some of the schema patterns listed in our docs have object definitions that represent collections of objects which will be more concrete examples: https://docs.authzed.com/reference/schema-lang#common-patterns

That is what my intuition was telling me. Thanks for confirming.