are you using the Insecure flag on the
# spicedbj
Joey
04/09/2025, 7:56 PMare you using the Insecure flag on the client?
s
sigge
04/09/2025, 8:02 PMI did at first but received another error, now I just pass
PRESHARED_KEYj
Joey
04/09/2025, 8:10 PMyou need to check if you have TLS configured on your cluster
Joey
04/09/2025, 8:10 PMif not, then you need to use the insecure flag
Joey
04/09/2025, 8:10 PMif so, make sure it has a valid cert
s
sigge
04/10/2025, 2:04 PMAh, thanks! We don't have TLS configured. I get this now:
Copy code
'invalid preshared key: rpc error: code = Unauthenticated desc = Request unauthenticated with bearer',j
Joey
04/10/2025, 2:07 PMif you're using Python, you need a special client
s
sigge
04/10/2025, 2:07 PMWe have Node
sigge
04/10/2025, 2:08 PM@authzed/authzed-node ^1.2.3"
j
Joey
04/10/2025, 2:14 PMs
sigge
04/10/2025, 3:00 PMI might be an idiot here, but do I need a token from authzed dashboard when I use open source? 😄
j
Joey
04/10/2025, 3:01 PMno
Joey
04/10/2025, 3:01 PMyou use the token from the Helm chart
s
sigge
04/10/2025, 3:09 PMSPICEDB_GRPC_PRESHARED_KEY: <set to the key 'preshared_key' in secret 'preview-pr7488-backend-spicedb-shared-config'> Optional: falsesigge
04/10/2025, 3:09 PMany ideas?
sigge
04/10/2025, 3:29 PMis it a problem that my URL is not localhost:50051 ?
j
Joey
04/10/2025, 3:32 PMwhat does your config look like?
Joey
04/10/2025, 3:32 PMfor the client
s
sigge
04/10/2025, 3:35 PM Copy code
ts
v1.NewClient(
env.SPICEDB_GRPC_PRESHARED_KEY,
datastoreUrls[tenant], // "preview-pr7488-backend-spicedb-shared.svc.cluster.local:50051"
v1.ClientSecurity.INSECURE_LOCALHOST_ALLOWED,
)sigge
04/10/2025, 3:43 PM Copy code
ts
const spiceDBCluster = new k8s.apiextensions.CustomResource(
name,
{
apiVersion: 'authzed.com/v1alpha1',
kind: 'SpiceDBCluster',
metadata: {
name,
namespace,
},
spec: {
config: {
datastoreEngine: 'postgres',
datastoreURI,
logLevel,
replicas: replicas.toString(),
image: 'legoraregistry.azurecr.io/authzed/spicedb',
},
secretName: configSecret.metadata.name,
},
},
{ parent: this },
);sigge
04/10/2025, 3:44 PM Copy code
ts
new k8s.helm.v3.Release(
'spicedb-operator',
{
namespace: coreNamespace.metadata.name,
repositoryOpts: {
repo: 'https://bushelpowered.github.io/spicedb-operator-chart',
},
chart: 'spicedb-operator',
version: '2.0.0',
values: {
image: {
repository: pulumi.interpolate`${registry}/authzed/spicedb-operator`,
pullPolicy: 'IfNotPresent',
},
installCRDs: true,
...getPodSpecForNodePool(NodePool.SYSTEM),
},
},
{ parent: this, protect: true },
);j
Joey
04/10/2025, 3:54 PMyeah
INSECURE_LOCALHOST_ALLOWEDJoey
04/10/2025, 3:54 PMyou'll need to pick the other insecure option
s
sigge
04/10/2025, 4:01 PMAh! the
INSECURE_PLAINTEXT_CREDENTIALSj
Joey
04/10/2025, 4:02 PMINSECURE_PLAINTEXT_CREDENTIALSJoey
04/10/2025, 4:02 PMnope
Joey
04/10/2025, 4:02 PMjust be aware it is insecure
Joey
04/10/2025, 4:02 PMso don't use it for anything real
s
sigge
04/10/2025, 4:32 PMomg thanks! It works now!!! ❤️
j
Joey
04/10/2025, 4:32 PMexcellent
c
canadaduane
05/01/2025, 4:26 PMI'm not sure if this is a helpful place to add feedback, but this question and its answers put our entire project back on track after being derailed by our pilot project not being able to connect to local orbstack docker container (orbstack uses
*.orb.localv1.ClientSecurity.INSECURE_PLAINTEXT_CREDENTIALScanadaduane
05/01/2025, 4:30 PM(The critical point is that although "INSECURE_LOCALHOST_ALLOWED" may appear to self-document that it is for localhost only, there are so many variables in an initial docker setup, that it is not obvious to newcomers that this is the key piece.)
j
Joey
05/01/2025, 5:57 PMmind filing an issue?
Joey
05/01/2025, 5:57 PMJoey
05/01/2025, 5:57 PMor feel free to issue a PR 🙂
c
canadaduane
05/01/2025, 10:17 PMcanadaduane
05/01/2025, 10:18 PMBTW thanks for making this Discord channel content google searchable via linen! I probably would have been googling for much longer without that 😄
j
Joey
05/01/2025, 10:58 PMof course