February 2023 Summaries

The SpiceDB Caveats feature is being prepared for its general availability in the 1.17.0 release, with a focus on sharing common use cases for caveats, which allow dynamic logic to be added to SpiceDB schema using Google's CEL language. The top-3 most used caveat patterns include IP Allowlists, Session-bound permissions, and Time-Bound Permissions, each with built-in functionality in SpiceDB to support their implementation. Examples of these patterns are shown in GitHub's IP Allowlists functionality, a hypothetical temporal repository access grant, and a user session-based policy for enforcing 2FA setup or SAML Session tags. The SpiceDB Caveats feature aims to provide first-class support for conditional access based on various criteria, improving security posture and reducing the attack surface.

SpiceDB is a unique database that implements a pattern called MVCC (Multi-Version Concurrency Control), which allows it to run queries against snapshots of the data instead of the actual data. This provides flexibility in terms of consistency levels, with options such as `at_exact_snapshot` allowing users to specify their desired level of consistency on each request. However, this also means that SpiceDB stores multiple versions of data, and requires a mechanism for garbage collection to manage these versions. In CockroachDB v23.1, the default configuration for `gc.ttlseconds`, which controls how long values are retained before being overwritten, has been changed from 25 hours to 4 hours, affecting SpiceDB users who rely on this feature. This change means that SpiceDB's --datastore-gc-window cannot be older than CockroachDB's gc.ttlseconds, limiting the range of times that can be queried in SpiceDB. For open-source users of SpiceDB, future versions will non-fatally warn and fallback to the CockroachDB value in this scenario to avoid downtime while upgrading.

We're kicking off the year with a ton of new updates across our open source projects and managed services, including the general availability of Google Cloud for SpiceDB Dedicated. Major highlights include the release of several new versions of our open source projects, such as SpiceDB v1.16.0, and the introduction of update channels for fully automating SpiceDB upgrades. We're also expanding our community engagement through regular blog posts, monthly wrap-ups, and a new Slack channel with off-topic goodness. Additionally, we've made updates to Authzed products like Playground, Caveats, and Zed, which now support caveats, custom annotations, and serverless functionality. Our team is proud of the progress made by our community members, including those who have modeled Google Cloud IAM services and created SpiceDB schemas using ChatGPT.