Hey guys, does spicedb currently support reading configuration from a file (

.env

for example)? Thanks 🙂

it does: https://github.com/authzed/spicedb/pull/1426

That's awesome! Does this work if I run spicedb as a container?

that I haven't tried

@terrakube would this be for locally messing around or for production deployment? how are you planning on deploying?

Hey @yetitwo it'd be for production deployment. It'd be deployed to a K8S cluster using the docker image. Because K8S secrets are plain text, we cannot store spicebd secrets there (mainly datastore connectionm string and grpc preshared key), so I was thinking how to retrieve secrets from, let's say, Azure Keyvault in a init container and write them in the spicedb env file for the main container to load

hmm is there anything about the SpiceDB CLI API that does not allow you to store your env vars in a secret storage?

I could store them as a K8S Secret, however I've been advised not to, as they're stored as plain text. Also we're using FluxCD, and any manifests will be checked in source control, so passing hardcoded secrets is not an option either

Was thinking of loading it from the vault into a secret with IRS own secret provider, not soring it plain text: https://damn.engineer/2022/01/31/azure-keyvault-to-kubernetes

I didn't know about this, thanks. Will take a look 🙂