April 2024 Summaries

The SpiceDB KubeAPI Proxy is an open-sourced project that functions as a network proxy between a Kubernetes client and a cluster, presenting itself as a full-fledged kube-apiserver to clients. It utilizes SpiceDB to make decisions about how to forward requests to an upstream kube-apiserver, determining whether a request can proceed and how to filter responses. The proxy supports write requests, executing distributed transactions across SpiceDB and the Kube API, ensuring permissions data remains synchronized with the backing cluster. It maintains a durable log of operations and can be configured with rules that determine how to authorize requests and filter responses. The project was written to support Authzed Cloud's multi-tenant control plane management, providing fine-grained permissions to users. The Kubernetes authorization layer is modular, but this approach allows for validation of concepts in a production environment before suggesting methods for deeper integration.

The SpiceDB Playground is now open source and self-hostable, offering a quick and easy way to start using SpiceDB for modeling permissions. The Playground features rich schema and relationship editors, as well as full SpiceDB and zed instances running via WebAssembly, ensuring that authorization queries run identically in the Playground as they do in a deployed instance. Additionally, users can collaborate on permissions system designs by sharing exported YAML files and join the SpiceDB open source community to stay updated with the latest updates.