Remote SpiceDB Support #24
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
github-actions
bot
added
area/core
area/dependencies
ecordell
force-pushed
the
durable-writes
branch
3 times, most recently
from
e9c8ce0
to
db94273
Compare
vroldanbet
force-pushed
the
remote-spicedb
branch
from
6644405
to
998914a
Compare
vroldanbet
force-pushed
the
remote-spicedb
branch
7 times, most recently
from
1bcfaac
to
ef2a553
Compare
ecordell
force-pushed
the
durable-writes
branch
from
db94273
to
0f25b07
Compare
the proxy now take new arguments to configure a remote SpiceDB: - spicedb-endpoint: url to the remote SpiceDB - spicedb-insecure: allows connecting to SpiceDB in plain text - spicedb-skip-verify-ca: lets the proxy connect to a remote service without verifying the certificate trust chain - spicedb-token: the preshared key of the remote server if spicedb-endpoint is set to "embedded://", the original behaviour of spinning up an embedded SpiceDB will take place, which is useful for testing purposes. An additional flag to support setting a path for the durable task database is also added: durabletask-database-path. It will default to /tmp/dtx.sqlite".
vroldanbet
force-pushed
the
remote-spicedb
branch
from
ef2a553
to
992df9b
Compare
ecordell
reviewed
Sep 6, 2023
| @@ -146,7 +137,11 @@ func NewServer(ctx context.Context, o Options) (*Server, error) { | |||
| codecs := serializer.NewCodecFactory(scheme) | |||
| failHandler := genericapifilters.Unauthorized(codecs) | |||
|
|
|||
| handler := s.WithAuthorization(clusterProxy, failHandler, watchClient, taskHubClient) | |||
| handler, err := WithAuthorization(clusterProxy, failHandler, o.PermissionsClient, o.WatchClient, taskHubClient, &s.LockMode) | |||
There was a problem hiding this comment.
just curious why you made this not a method? it would have direct access to the lockmode and clients if so
There was a problem hiding this comment.
I wanted to separate concerns, the server was becoming a god-class like structure and I thought as the authorization handler evolves, it would be easier for testing purposes to decouple it from the server.
ecordell
approved these changes
Sep 6, 2023
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Closes #8
Based on top of #16
The proxy now takes new arguments to configure a remote SpiceDB:
spicedb-endpoint: URL to the remote SpiceDBspicedb-insecure: allows connecting to SpiceDB in plain textspicedb-skip-verify-ca: lets the proxy connect to a remote service withoutverifying the certificate trust chain
spicedb-token: the preshared key of the remote serverif spicedb-endpoint is set to
embedded://, the originalbehavior of spinning up an embedded SpiceDB will take place, which
is useful for testing purposes.
An additional flag to support setting a path for the durable task database is
also added:
durabletask-database-path. It will default to/tmp/dtx.sqlite.Note
I implemented it so
Complete(context.Context)wouldn't fail if it was unable to reach to the server. I could have usedWithBlockand make it fail with a timeout, so that it ends up restarted after it fails kube's health check. I considered that having rakis call the proxy and get a "no healthy backend" wasn't much better than getting an error because the gRPC connection is broken.