diff --git a/.markdownlint-cli2.yaml b/.markdownlint-cli2.yaml index 0a6a891..4295ddc 100644 --- a/.markdownlint-cli2.yaml +++ b/.markdownlint-cli2.yaml @@ -8,6 +8,7 @@ config: no-hard-tabs: false no-inline-html: false no-multiple-blanks: false + max-one-sentence-per-line: false customRules: - "markdownlint-rule-max-one-sentence-per-line" fix: false diff --git a/pages/spicedb/concepts/_meta.json b/pages/spicedb/concepts/_meta.json index adb1521..9ae850d 100644 --- a/pages/spicedb/concepts/_meta.json +++ b/pages/spicedb/concepts/_meta.json @@ -8,7 +8,6 @@ "consistency": "Consistency", "datastores": "Datastores", "datastore-migrations": "Datastore Migrations", - "dispatch": "Dispatch", "reflection-apis": "Reflection APIs", "watch": "Watching Changes" } diff --git a/pages/spicedb/concepts/dispatch.mdx b/pages/spicedb/concepts/dispatch.mdx deleted file mode 100644 index baca416..0000000 --- a/pages/spicedb/concepts/dispatch.mdx +++ /dev/null @@ -1,57 +0,0 @@ -import { Callout } from 'nextra/components' -import Architecture from "@/public/images/dispatch-architecture.svg" - -# Dispatch - -Dispatching is a core part of SpiceDB functionality where API requests are broken down into smaller computations and forwarded to ("dispatched") other SpiceDB nodes within the cluster. - -Each SpiceDB node maintains an in-memory cache of permissions queries it has resolved in the past; when a new permissions query is encountered by one node, its answer may be present on another node, so SpiceDB will forward the request onward to the other node to check the shared cache. - -For more details on how dispatching works, see the [Consistent Hash Load Balancing for gRPC] article. - -[consistent hash load balancing for grpc]: https://authzed.com/blog/consistent-hash-load-balancing-grpc/ - -## Architecture Diagram - -The following diagram models requests flowing through the SpiceDB API into the Dispatch and Datastore: - - - -For more information, read our [architecture blog post]. - -[architecture blog post]: https://authzed.com/blog/spicedb-architecture - -## Configuring Dispatch in Kubernetes - -If not using the [SpiceDB Operator], the `dispatch-upstream-addr` should be of the form `kubernetes:///spicedb.default:50053` where `spicedb.default` is the Kubernetes `Service` in which SpiceDB is accessible. - - - If you are deploying SpiceDB under Kubernetes, it is recommended to use the [SpiceDB Operator], which configures dispatching automatically. - - [spicedb operator]: /spicedb/ops/operator - - -## Configuring Dispatch in non-Kubernetes Environments - - - Non-Kubernetes based dispatching relies upon DNS updates, which means it can become stale if DNS is changing. This is not recommended unless DNS updates are rare. - - -To enable dispatch, the following flags must be specified: - -```sh -spicedb serve \ - --dispatch-cluster-enabled=true \ - --dispatch-upstream-addr=upstream-addr \ - ... -``` - -or via environment variables with the `SPICEDB_` prefix: - -```sh -SPICEDB_DISPATCH_CLUSTER_ENABLED=true \ -SPICEDB_DISPATCH_UPSTREAM_ADDR=upstream-addr \ -spicedb serve ... -``` - -The `upstream-addr` should be the DNS address of the load balancer at which _all_ SpiceDB nodes are accessible at the default dispatch port of `:50053`. diff --git a/pages/spicedb/getting-started/first-steps.mdx b/pages/spicedb/getting-started/first-steps.mdx index bfb9adb..cd62189 100644 --- a/pages/spicedb/getting-started/first-steps.mdx +++ b/pages/spicedb/getting-started/first-steps.mdx @@ -35,7 +35,6 @@ import { InlinePlayground } from '@/components/playground' - ### Dive into some videos diff --git a/pages/spicedb/ops/_meta.json b/pages/spicedb/ops/_meta.json index f546db5..968e8cb 100644 --- a/pages/spicedb/ops/_meta.json +++ b/pages/spicedb/ops/_meta.json @@ -3,6 +3,7 @@ "deploying-spicedb-operator": "Deploying the SpiceDB Kubernetes Operator", "eks": "Deploying to AWS EKS", "data": "Writing data to SpiceDB", + "performance": "Improving Performance", "observability": "Observability Tooling", "ai-agent-authorization": "Authorization for AI Agents", "secure-rag-pipelines": "Secure Your RAG Pipelines with Fine Grained Authorization" diff --git a/pages/spicedb/ops/eks.mdx b/pages/spicedb/ops/eks.mdx index d597087..a3ea202 100644 --- a/pages/spicedb/ops/eks.mdx +++ b/pages/spicedb/ops/eks.mdx @@ -151,13 +151,13 @@ If the `spicedb-le-tls` secret is not present, follow this [troubleshooting guid [Secret]: https://kubernetes.io/docs/concepts/configuration/secret [troubleshooting guide]: https://cert-manager.io/docs/troubleshooting/acme/ -### Configuring Dispatch TLS +### Configuring Cross-Pod TLS -SpiceDB [dispatches] work across instances in the same deployment via [gRPC]. +SpiceDB will be more performant when cross-pod communication is enabled (see [performance]). We'll be securing this pod-to-pod communication with its own internal-only certificate: [gRPC]: https://grpc.io -[dispatches]: ../concepts/dispatch +[performance]: performance#by-enabling-cross-node-communication ```sh kubectl apply --server-side -f - < + If you are deploying SpiceDB under Kubernetes, it is recommended to use the [SpiceDB Operator], which configures dispatching automatically. + + [spicedb operator]: /spicedb/ops/operator + + +### Configuration in non-Kubernetes environments + + + Non-Kubernetes based dispatching relies upon DNS updates, which means it can become stale if DNS is changing. This is not recommended unless DNS updates are rare. + + +To enable dispatch, the following flags must be specified: + +```sh +spicedb serve \ + --dispatch-cluster-enabled=true \ + --dispatch-upstream-addr=upstream-addr \ + ... +``` + +or via environment variables with the `SPICEDB_` prefix: + +```sh +SPICEDB_DISPATCH_CLUSTER_ENABLED=true \ +SPICEDB_DISPATCH_UPSTREAM_ADDR=upstream-addr \ +spicedb serve ... +``` + +The `upstream-addr` should be the DNS address of the load balancer at which _all_ SpiceDB nodes are accessible at the default dispatch port of `:50053`. + +## By enabling Materialize + +[Materialize] is a separate service that allows for the precomputation of permission query results. + +If Materialize is running, SpiceDB can dispatch sub-queries to Materialize, which can significantly speed up permission checks. + +[Materialize]: /authzed/concepts/authzed-materialize + +## By enabling the schema cache + +The schema cache stores type definitions and caveat definitions to avoid repeatedly fetching schema information from the datastore. + +SpiceDB offers two caching modes: + +1. **Just-In-Time (JIT) Caching**: The default mode that loads definitions on-demand. Uses less memory, but it incurs a cold start penalty on first access to each definition. +2. **Watching Cache**: An experimental mode that proactively maintains an always-up-to-date cache. This mode uses more memory but avoids cold start penalties. It is recommended when there are frequent schema changes. + +To configure the schema cache, use the following flags: + +```bash +# Enable namespace cache (default: true) +--ns-cache-enabled=true + +# Maximum memory (default: 32 MiB) +--ns-cache-max-cost=32MiB + +# Enable experimental watchable schema cache (default: false) +# When true: uses watching cache if datastore supports it +# When false: always uses JIT caching +--enable-experimental-watchable-schema-cache=false +```