SpiceDB Operator & Google Cloud SQL Auth Proxy
# spicedbj
jawnsyy
08/16/2023, 4:10 PMHey, with the SpiceDB Operator, what's the recommended way to add a sidecar to the deployment? Looking at the CRD definition, it looks like we can throw a patch in there... https://github.com/authzed/spicedb-operator/blob/main/pkg/apis
For context, I'm trying to use SpiceDB with the Google Cloud SQL Auth Proxy as a sidecar. I'm also open to managing the Deployment myself if that's not a totally harebrained idea (we use FluxCD and automate our updates with updatecli)
j
jzelinskie
08/16/2023, 4:23 PMYep, patches are the way to go for now. I think it makes sense to have default values for the security context. @ecordell is the operator maintainer and will probably have thoughts, but I think it's probably a good contribution to the project.
jzelinskie
08/16/2023, 4:25 PMYou want to avoid managing the deployment yourself if possible. The operator will manage rolling zero-downtime updates to your cluster among other things that would be very manual otherwise.
j
jawnsyy
08/16/2023, 4:25 PMGreat, I'll open an issue about the security context stuff (opentelemetry-operator might be a useful example) and in the meantime will figure out this patch thing :)
Nice to see you here Jimmy!
j
jzelinskie
08/16/2023, 4:28 PMOnce you've got things figured out, we'd love to hear more about the use case with the proxy. I'm not sure we've seen anyone else attaching sidecars to the SpiceDB pods
jzelinskie
08/16/2023, 4:30 PMDoes the OTEL operator just embed the security context?
j
jawnsyy
08/16/2023, 4:31 PMWe have a lot of sidecars in our pods haha -- the Cloud SQL Auth proxy just handles database auth using IAM. We also inject Istio proxies sometimes, and OpenTelemetry-Collector sidecars (though the latter two are handled by operators)
jawnsyy
08/16/2023, 4:31 PMyea they have a field for security context in the CRD
j
jzelinskie
08/16/2023, 4:31 PMYeah, that makes sense. We explicitly decided to opt for patches because there's unlimited number of things you'll eventually add if you start adding them first class like that.
jzelinskie
08/16/2023, 4:31 PMEach eats up the space you actually have left for your custom stuff (there are lots of limits on CRDs)
j
jawnsyy
08/16/2023, 4:32 PMI have an issue here for the otel one, they have the fields but the defaults could be improved https://github.com/open-telemetry/opentelemetry-operator/issues/1264
j
jzelinskie
08/16/2023, 4:45 PMEvan can probably correct me when he gets back from lunch, but I think here is the place where we have our defaults: https://github.com/authzed/spicedb-operator/blob/main/pkg/config/config.go#L742
j
jawnsyy
08/16/2023, 9:05 PMI opened some issues to track: https://github.com/authzed/spicedb-operator/issues/236 and https://github.com/authzed/spicedb-operator/issues/237 - I'll open a PR for the latter to get that change upstreamed
j
jzelinskie
08/16/2023, 9:32 PMThanks for the PR!
5 Views