diff --git a/app/spicedb/getting-started/installing-zed/page.mdx b/app/spicedb/getting-started/installing-zed/page.mdx index df4abc96..83b0a0ee 100644 --- a/app/spicedb/getting-started/installing-zed/page.mdx +++ b/app/spicedb/getting-started/installing-zed/page.mdx @@ -1,4 +1,4 @@ -import { Callout } from 'nextra/components' +import { Callout } from "nextra/components"; # Installing Zed @@ -123,7 +123,6 @@ You can find more commands for tasks such as testing, linting in the repository' [CONTRIBUTING.md]: https://github.com/authzed/zed/blob/main/CONTRIBUTING.md - ## Reference: `zed` A command-line client for managing SpiceDB clusters. @@ -161,17 +160,16 @@ zed permission check --explain document:firstdoc writer user:emilia ### Children commands -- [zed backup](#reference-zed-backup) - Create, restore, and inspect permissions system backups -- [zed context](#reference-zed-context) - Manage configurations for connecting to SpiceDB deployments -- [zed import](#reference-zed-import) - Imports schema and relationships from a file or url -- [zed mcp](#reference-zed-mcp) - MCP (Model Context Protocol) server commands -- [zed permission](#reference-zed-permission) - Query the permissions in a permissions system -- [zed relationship](#reference-zed-relationship) - Query and mutate the relationships in a permissions system -- [zed schema](#reference-zed-schema) - Manage schema for a permissions system -- [zed use](#reference-zed-use) - Alias for `zed context use` -- [zed validate](#reference-zed-validate) - Validates the given validation file (.yaml, .zaml) or schema file (.zed) -- [zed version](#reference-zed-version) - Display zed and SpiceDB version information - +- [zed backup](#reference-zed-backup) - Create, restore, and inspect permissions system backups +- [zed context](#reference-zed-context) - Manage configurations for connecting to SpiceDB deployments +- [zed import](#reference-zed-import) - Imports schema and relationships from a file or url +- [zed mcp](#reference-zed-mcp) - MCP (Model Context Protocol) server commands +- [zed permission](#reference-zed-permission) - Query the permissions in a permissions system +- [zed relationship](#reference-zed-relationship) - Query and mutate the relationships in a permissions system +- [zed schema](#reference-zed-schema) - Manage schema for a permissions system +- [zed use](#reference-zed-use) - Alias for `zed context use` +- [zed validate](#reference-zed-validate) - Validates the given validation file (.yaml, .zaml) or schema file (.zed) +- [zed version](#reference-zed-version) - Display zed and SpiceDB version information ## Reference: `zed backup` @@ -210,13 +208,12 @@ zed backup [flags] ### Children commands -- [zed backup create](#reference-zed-backup-create) - Backup a permission system to a file -- [zed backup parse-relationships](#reference-zed-backup-parse-relationships) - Extract the relationships from a backup file -- [zed backup parse-revision](#reference-zed-backup-parse-revision) - Extract the revision from a backup file -- [zed backup parse-schema](#reference-zed-backup-parse-schema) - Extract the schema from a backup file -- [zed backup redact](#reference-zed-backup-redact) - Redact a backup file to remove sensitive information -- [zed backup restore](#reference-zed-backup-restore) - Restore a permission system from a file - +- [zed backup create](#reference-zed-backup-create) - Backup a permission system to a file +- [zed backup parse-relationships](#reference-zed-backup-parse-relationships) - Extract the relationships from a backup file +- [zed backup parse-revision](#reference-zed-backup-parse-revision) - Extract the revision from a backup file +- [zed backup parse-schema](#reference-zed-backup-parse-schema) - Extract the schema from a backup file +- [zed backup redact](#reference-zed-backup-redact) - Redact a backup file to remove sensitive information +- [zed backup restore](#reference-zed-backup-restore) - Restore a permission system from a file ## Reference: `zed backup create` @@ -253,8 +250,6 @@ zed backup create [flags] --token string token used to authenticate to SpiceDB ``` - - ## Reference: `zed backup parse-relationships` Extract the relationships from a backup file @@ -289,8 +284,6 @@ zed backup parse-relationships [flags] --token string token used to authenticate to SpiceDB ``` - - ## Reference: `zed backup parse-revision` Extract the revision from a backup file @@ -318,8 +311,6 @@ zed backup parse-revision --token string token used to authenticate to SpiceDB ``` - - ## Reference: `zed backup parse-schema` Extract the schema from a backup file @@ -354,8 +345,6 @@ zed backup parse-schema [flags] --token string token used to authenticate to SpiceDB ``` - - ## Reference: `zed backup redact` Redact a backup file to remove sensitive information @@ -392,8 +381,6 @@ zed backup redact [flags] --token string token used to authenticate to SpiceDB ``` - - ## Reference: `zed backup restore` Restore a permission system from a file @@ -433,8 +420,6 @@ zed backup restore [flags] --token string token used to authenticate to SpiceDB ``` - - ## Reference: `zed context` Manage configurations for connecting to SpiceDB deployments @@ -460,11 +445,10 @@ Manage configurations for connecting to SpiceDB deployments ### Children commands -- [zed context list](#reference-zed-context-list) - Lists all available contexts -- [zed context remove](#reference-zed-context-remove) - Removes a context by name -- [zed context set](#reference-zed-context-set) - Creates or overwrite a context -- [zed context use](#reference-zed-context-use) - Sets a context as the current context - +- [zed context list](#reference-zed-context-list) - Lists all available contexts +- [zed context remove](#reference-zed-context-remove) - Removes a context by name +- [zed context set](#reference-zed-context-set) - Creates or overwrite a context +- [zed context use](#reference-zed-context-use) - Sets a context as the current context ## Reference: `zed context list` @@ -499,8 +483,6 @@ zed context list [flags] --token string token used to authenticate to SpiceDB ``` - - ## Reference: `zed context remove` Removes a context by name @@ -528,8 +510,6 @@ zed context remove --token string token used to authenticate to SpiceDB ``` - - ## Reference: `zed context set` Creates or overwrite a context @@ -557,8 +537,6 @@ zed context set --token string token used to authenticate to SpiceDB ``` - - ## Reference: `zed context use` Sets a context as the current context @@ -586,8 +564,6 @@ zed context use --token string token used to authenticate to SpiceDB ``` - - ## Reference: `zed import` Imports schema and relationships from a file or url @@ -658,8 +634,6 @@ zed import [flags] --token string token used to authenticate to SpiceDB ``` - - ## Reference: `zed mcp` MCP (Model Context Protocol) server commands. @@ -689,8 +663,7 @@ To use with Claude Code, run `zed mcp experimental-run` to start the SpiceDB Dev ### Children commands -- [zed mcp experimental-run](#reference-zed-mcp-experimental-run) - Run the Experimental MCP server - +- [zed mcp experimental-run](#reference-zed-mcp-experimental-run) - Run the Experimental MCP server ## Reference: `zed mcp experimental-run` @@ -725,8 +698,6 @@ zed mcp experimental-run [flags] --token string token used to authenticate to SpiceDB ``` - - ## Reference: `zed permission` Query the permissions in a permissions system @@ -752,12 +723,11 @@ Query the permissions in a permissions system ### Children commands -- [zed permission bulk](#reference-zed-permission-bulk) - Check permissions in bulk exist for resource-permission-subject triplets -- [zed permission check](#reference-zed-permission-check) - Check if a subject has permission on a resource -- [zed permission expand](#reference-zed-permission-expand) - Expand the structure of a permission -- [zed permission lookup-resources](#reference-zed-permission-lookup-resources) - Enumerates the resources of a given type for which a subject has permission -- [zed permission lookup-subjects](#reference-zed-permission-lookup-subjects) - Enumerates the subjects of a given type for which the subject has permission on the resource - +- [zed permission bulk](#reference-zed-permission-bulk) - Check permissions in bulk exist for resource-permission-subject triplets +- [zed permission check](#reference-zed-permission-check) - Check if a subject has permission on a resource +- [zed permission expand](#reference-zed-permission-expand) - Expand the structure of a permission +- [zed permission lookup-resources](#reference-zed-permission-lookup-resources) - Enumerates the resources of a given type for which a subject has permission +- [zed permission lookup-subjects](#reference-zed-permission-lookup-subjects) - Enumerates the subjects of a given type for which the subject has permission on the resource ## Reference: `zed permission bulk` @@ -799,8 +769,6 @@ zed permission bulk [flags] --token string token used to authenticate to SpiceDB ``` - - ## Reference: `zed permission expand` Expand the structure of a permission @@ -882,8 +848,6 @@ zed permission expand [flags] --token string token used to authenticate to SpiceDB ``` - - ## Reference: `zed permission lookup-resources` Enumerates the resources of a given type for which a subject has permission @@ -926,8 +890,6 @@ zed permission lookup-resources [flags] --token string token used to authenticate to SpiceDB ``` - - ## Reference: `zed permission lookup-subjects` Enumerates the subjects of a given type for which the subject has permission on the resource @@ -967,8 +929,6 @@ zed permission lookup-subjects [flags] zed preview schema compile schema.zed 1> compiled.zed Write to a file: zed preview schema compile root.zed --out compiled.zed - + ``` ### Options @@ -1015,8 +975,6 @@ zed preview schema compile [flags] --token string token used to authenticate to SpiceDB ``` - - ## Reference: `zed relationship` Query and mutate the relationships in a permissions system @@ -1042,13 +1000,12 @@ Query and mutate the relationships in a permissions system ### Children commands -- [zed relationship bulk-delete](#reference-zed-relationship-bulk-delete) - Deletes relationships matching the provided pattern en masse -- [zed relationship create](#reference-zed-relationship-create) - Create a relationship for a subject -- [zed relationship delete](#reference-zed-relationship-delete) - Deletes a relationship -- [zed relationship read](#reference-zed-relationship-read) - Enumerates relationships matching the provided pattern -- [zed relationship touch](#reference-zed-relationship-touch) - Idempotently updates a relationship for a subject -- [zed relationship watch](#reference-zed-relationship-watch) - Watches the stream of relationship updates and schema updates from the server - +- [zed relationship bulk-delete](#reference-zed-relationship-bulk-delete) - Deletes relationships matching the provided pattern en masse +- [zed relationship create](#reference-zed-relationship-create) - Create a relationship for a subject +- [zed relationship delete](#reference-zed-relationship-delete) - Deletes a relationship +- [zed relationship read](#reference-zed-relationship-read) - Enumerates relationships matching the provided pattern +- [zed relationship touch](#reference-zed-relationship-touch) - Idempotently updates a relationship for a subject +- [zed relationship watch](#reference-zed-relationship-watch) - Watches the stream of relationship updates and schema updates from the server ## Reference: `zed relationship bulk-delete` @@ -1085,8 +1042,6 @@ zed relationship bulk-delete < --token string token used to authenticate to SpiceDB ``` - - ## Reference: `zed relationship touch` Idempotently updates a relationship for a subject @@ -1265,8 +1214,6 @@ zed relationship touch [flags] --token string token used to authenticate to SpiceDB ``` - - ## Reference: `zed schema diff` Diff two schema files @@ -1410,8 +1352,6 @@ zed schema diff --token string token used to authenticate to SpiceDB ``` - - ## Reference: `zed schema read` Read the schema of a permissions system @@ -1445,8 +1385,6 @@ zed schema read [flags] --token string token used to authenticate to SpiceDB ``` - - ## Reference: `zed schema write` Write a schema file (.zed or stdin) to the current permissions system @@ -1492,8 +1430,6 @@ zed schema write [flags] --token string token used to authenticate to SpiceDB ``` - - ## Reference: `zed use` Alias for `zed context use` @@ -1521,8 +1457,6 @@ zed use --token string token used to authenticate to SpiceDB ``` - - ## Reference: `zed validate` Validates the given validation file (.yaml, .zaml) or schema file (.zed) @@ -1581,8 +1515,6 @@ zed validate [flags] --token string token used to authenticate to SpiceDB ``` - - ## Reference: `zed version` Display zed and SpiceDB version information @@ -1616,6 +1548,3 @@ zed version [flags] --skip-version-check if true, no version check is performed against the server --token string token used to authenticate to SpiceDB ``` - - - diff --git a/app/spicedb/ops/performance/page.mdx b/app/spicedb/ops/performance/page.mdx index 3c488864..35161104 100644 --- a/app/spicedb/ops/performance/page.mdx +++ b/app/spicedb/ops/performance/page.mdx @@ -2,6 +2,13 @@ import { Callout } from "nextra/components"; # Improving Performance + + SpiceDB's server-side configuration defaults favor correctness over raw speed. API requests, + however, default to `minimize_latency` consistency for read operations, favoring cache utilization + over strict freshness. The flags documented on this page allow you to further tune SpiceDB for + your specific workload. + + ## By enabling cross-node communication SpiceDB can be deployed in a clustered configuration where multiple nodes work together to serve API requests. In such a configuration, and for the CheckPermissions API, enabling a feature called **dispatch** allows nodes to break down one API request into smaller "questions" and forward those to other nodes within the cluster. This helps reduce latency and improve overall performance. @@ -59,6 +66,21 @@ spicedb serve ... The `upstream-addr` should be the DNS address of the load balancer at which _all_ SpiceDB nodes are accessible at the default dispatch port of `:50053`. +### Dispatch Chunk Size + +The `--dispatch-chunk-size` flag controls the maximum number of object IDs included in a single dispatched request. +This is particularly impactful for lookup operations (such as LookupResources and LookupSubjects) that need to process many objects. + +```sh +spicedb serve \ + --dispatch-chunk-size=100 +``` + + + Larger chunk sizes reduce dispatch overhead but increase memory usage per request. Start with the + default (100) and increase if you observe high dispatch latency with large lookup operations. + + ## By enabling Materialize [Materialize] is a separate service that allows for the precomputation of permission query results. @@ -90,3 +112,24 @@ To configure the schema cache, use the following flags: # When false: always uses JIT caching --enable-experimental-watchable-schema-cache=false ``` + +## By tuning revision quantization + +The `--datastore-revision-quantization-interval` and `--datastore-revision-quantization-max-staleness-percent` flags control how SpiceDB groups revisions for caching. +Increasing these values improves cache hit rates at the cost of data freshness. + +See the [load testing guide](/spicedb/ops/load-testing#spicedb-quantization-performance) for details on how quantization affects performance, and the [hotspot caching blog post](https://authzed.com/blog/hotspot-caching-in-google-zanzibar-and-spicedb) for a deeper explanation. + +## By tuning connection pools + +For PostgreSQL, CockroachDB, and MySQL datastores, connection pool sizing significantly impacts performance under load. +Key flags include `--datastore-conn-pool-read-max-open`, `--datastore-conn-pool-write-max-open`, and the corresponding min and jitter settings. + +See the [datastores reference](/spicedb/concepts/datastores) for the full list of connection pool flags and defaults, and the [best practices guide](/best-practices#tune-connections-to-datastores) for sizing recommendations. + +## By tuning the transaction overlap strategy (CockroachDB only) + +The `--datastore-tx-overlap-strategy` flag controls how SpiceDB handles concurrent write transactions. +CockroachDB users can trade consistency guarantees for write throughput by selecting from strategies: `static` (default), `prefix`, `request`, or `insecure`. + +See the [CockroachDB datastore documentation](/spicedb/concepts/datastores#overlap-strategy) for detailed strategy descriptions and trade-offs.