Database is a bottleneck, it's for sure. We manage...
# spicedb
k
Database is a bottleneck, it's for sure. We managed to mitigate the problem with waiting connection by increasing max pool size for read operations, but queries itself most often take enormous time. We increased the database instance to ~25 vCPU, which gives a huge impact, but running such a database size just to handle 7 RPS for the simplest read permission sounds crazy. As @natholas mentioned, we have a superhigh number of queries (~65 per one CheckPermission API call) which are caused by our current schema design to meet our business requirements. We are trying to implement the permission model similar to Google Drive, with deep inheritance, different access levels (direct member, group member, organization member, public access), with detaching (or overriding) mode for child resources and everything else that you might see in Google Drive. I really passionated by articles like this https://authzed.com/blog/google-scale-authorization, but to be honest I didn't find any relevant information how SpiceDB solves a real world problem rather sythentic one. I think the Authzed team must be interested in how to implement a full-fledged Google Drive permission model while hitting a reasonable performance, because right now we are feeling like we are limiting on expressing business requirements using current SpiceDB functionality. We would be happy to receive any feedback on top of our schema and tell us where we are wrong and how we can improve our schema without trading business requirements. Because we believe simplifying the schema is a key to finding the best performance possible. Please take the time to explore the repo that we prepared for you https://github.com/nusign/spicedb-inheritance-override. We put our current implementation there that fully implements a Google Drive permission model, but performance makes us stop releasing it on production. Thanks!
3 Views