Hi team
# spicedb
n
Hi team We recently upgraded our spicedb from
v1.31.0
to
v1.45.1
running on EKS with spicedb operator. During the upgrade, we noticed a spike of
io.grpc.StatusException: UNIMPLEMENTED: unknown method DispatchLookupResources for service dispatch.v1.DispatchService
while the pods are being rolled, which caused errors on queries. Is this expected due to old node not being able to handle disptach requests from new nodes? What would be the best way to avoid this in future upgrades? (e.g. upgrade in a blue/green fashion instead) One thing we did wrong was we upgraded the db image instead of the operator (which is still at
v1.15.0
), would that have avoided the errors?
v
The LookupResources internal dispatch API changed in a breaking way. We typically recommend migrating version by version. This is because one of the intermediate versions likely had both the old and the new API, so your instance wouldn't have seen those unimplemented errors.
and yes, the reason this happens is a new node dispatches to a still existing old node
we recommend having a look at the release notes, and upgrading one minor version at a time
And yes, if you are using the operator, upgrading it via the
SpiceDBCluster
resource is the right way to go, because the operator has an "update graph", and knows what "version jumps" it can make
you can see here that the operator would have upgraded your 1.31 to 1.42.1, before continuing with the next versions up to 1.45
n
Thanks a lot @vroldanbet ! We are using
SpiceDBCluster
but we uses a custom image that is built from a in-house base. In this case, should we build and upgrade the image manually version by version based on the [upgrade graph ](https://github.com/authzed/spicedb-operator/blob/main/config/update-graph.yaml#L2782-L2792) It might also be helpful to publish this as an "upgrade path" in spice db docs
v
@Noah I believe there is a way to change the base URL, so you could point the update graph at your container registry. @ecordell can probably clarify. Is there anything you are missing from the upstream images we could change so you don't have to do a custom build?
e
Yep there is a
--base-image
flag you can pass to the operator to switch which image is used. The tags all need to match in order for the graph to work, though.
n
that is perfect, thanks both! @vroldanbet we use the [wolfi base image](https://images.chainguard.dev/directory/image/wolfi-base/overview) for security reason
v
@Noah SpiceDB images are already Wolfi based
3 Views