SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions.

SpiceDB

We're setting up the SpiceDB operator for the first time and have a question:

...we're using Amazon RDS for the datastore, which uses TLS that isn't trusted by default. For our manually set up SpiceDB pod, we mounted the Amazon-provided public key to a volume and referenced it from our connection string, but it's not clear how to do this with the operator. From looking through the code, it looks like we can use DatastoreTLSSecretName to inject a very similar volume mount, but is this what's recommended?

yep, if you put the RDS CA in a key called `ca.crt` in the secret you pass to `datastoreTLSSecretName` it will wire it into the postgres connection

Very cool! While we're talking about it, is there a similar facility for other related secrets, like postgres passwords?

Right now the only option is to provide it in `datastore_uri` in the config secret (that you pass in `.spec.secretName`)

I should mention that the TLS certs get mounted under `/spicedb-db-tls` so when you build your postgres uri you'll want to reference it, i.e.:
```
postgres://username:password@rds_url:5432/db-name?sslmode=verify-ca&sslrootcert=/spicedb-db-tls/ca.crt
```