Hi, I have a little question/ issue regarding connecting to a self hosted SpiceDB on K8s. We set it up with a self signed certificate. Just for testing purposes I did set up a port-forward to the 50051 port on my K8s. Using this installation works fine with the zed cli using a context with --no-verify-ca parameter. No I did try to connect to it via a python client and that just does not work, I always get a message:

grpc._channel._InactiveRpcError: <_InactiveRpcError of RPC that terminated with:
        status = StatusCode.UNAVAILABLE
        details = "failed to connect to all addresses; last error: UNAVAILABLE: ipv4:127.0.0.1:50051: Socket closed"
        debug_error_string = "UNKNOWN:Error received from peer  {created_time:"2025-04-14T16:52:26.97323+02:00", grpc_status:14, grpc_message:"failed to connect to all addresses; last error: UNAVAILABLE: ipv4:127.0.0.1:50051: Socket closed"}"

I did try: - URL as localhost:50051, 127.0.0.1:50051 - Use the Client with insecure_bearer_token_credentials as well as bearer_token_credentials - Use the InsecureClient with insecure_bearer_token_credentials as well as bearer_token_credentials - Use the AsyncClient Im using spiceDB 1.40.1 and python 3.12.9 as well as the latest authzed package. I'm a bit out of ideas what to try, hence any help or hints appreciated

Perhaps you may want to look into

certChain

argument in `bearer_token_credentials`: https://github.com/authzed/authzed-py/blob/aff770dd70514721fc6436f27b23f4a5064f2d13/grpcutil/__init__.py#L6

the certChain needs to be the root certificate read as binary? Like:

python
f = open('fname.crt', 'rb')
cert = f.read()
cred = bearer_token_credential('mysupersecretpwd', cert)
`

Just for the record, it does work, if you use the certificate used in the operator installation, but this certificate needs to be created with localhost as a valid host. Otherwise connections will fail. It might be an option to add the localhost as an allowed host via the connection options. But on my side the parameter was ignored within the python client/library.

I think that's something that could be fixed with Server Name Indication. For example

zed

supports this: https://github.com/authzed/zed/pull/309