Skip to content

Commit 7907ddd

Browse files
miparnisarimiparnisari
authored
Merge pull request #386 from authzed/axe-extenders-page
remove extenders page
2 parents 65388fb + 2ae7edb commit 7907ddd

File tree

4 files changed

+38
-56
lines changed

4 files changed

+38
-56
lines changed

‎pages/authzed/concepts/audit-logging.mdx‎

Lines changed: 18 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -162,16 +162,30 @@ This is an example trust policy that allows the AuthZed account to assume the ro
162162
## Configuration
163163

164164
The process for setting up audit logging varies depending on the AuthZed product you're using.
165-
Find the instructions for your product below.
166165

167-
### Dedicated
166+
### Dedicated & Cloud
168167

169168
Using the web dashboard, navigate to the Permission System's settings page to find the Audit Log settings.
170169

171170
### Self-Hosted
172171

173-
Audit logging is configured using command-line flags.
174-
See the full list of flags in the [Extenders section](extenders#flags).
172+
Use the following command-line flags:
173+
174+
| Flag | Description | Default |
175+
|--------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------|
176+
| --extender-enabled | must be set to`authzed-audit` | |
177+
| --extender-audit-batch-size-limit | defines the maximum number of audit events to be processed as a unit | `10000` |
178+
| --extender-audit-buffer-size | defines the size of the audit log buffer that holds events to be processed by workers | `1000000` |
179+
| --extender-audit-buffer-window | defines maximum amount of time events are buffered before being pushed | `1s` |
180+
| --extender-audit-disabled-on-methods strings | list of comma-separated, fully-qualified API methods to disable events for. Watch API is always excluded (e.g. `/authzed.api.v1.PermissionsService/CheckPermission`) | |
181+
| --extender-audit-initial-retry-interval duration | sets the first retry backoff in case of a failure to push audit events to the backend | `1s` |
182+
| --extender-audit-max-retry-interval duration | sets the maximum backoff duration in case of failure to push events | `30s` |
183+
| --extender-audit-retry-randomizer-factor | sets the randomization factor for the backoff duration - this helps prevent thundering herds on event push errors | `0.5` |
184+
| --extender-audit-stream-name | defines the name of the target stream/topic (e.g. Kafka Topic, Kinesis Stream...) | `spicedb` |
185+
| --extender-audit-target-configuration | target-type specific configuration | `[]` |
186+
| --extender-audit-target-endpoint-url string | defines the URL of target endpoint to ingest audit events. If left unspecified, some types will try to determine automatically (e.g. AWS SDK) | |
187+
| --extender-audit-target-type | defines the type of target to ingest audit events | `noop` |
188+
| --extender-audit-worker-count | defines the number of worker goroutines to process audit events (default 5) | |
175189

176190
### Tokens in Audit Logs
177191

‎pages/authzed/concepts/extenders.mdx‎

Lines changed: 0 additions & 37 deletions
This file was deleted.

‎pages/authzed/concepts/management-dashboard.mdx‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,6 @@ The Management Dashboard is a web-based application for organizations to manage
44
The dashboard is primarily targeting platform operators that want to configure and monitor the service.
55

66
The Management Dashboard is exclusive to AuthZed [Dedicated] and [Cloud].
7-
In order to support a wider variety of environments, [Enterprise] customers configure [Extenders] directly instead of the Management Dashboard.
87

98
[Dedicated]: ../guides/picking-a-product#dedicated
109
[Cloud]: ../guides/picking-a-product#cloud
11-
[Enterprise]: ../guides/picking-a-product#enterprise
12-
[Extenders]: ./extenders

‎pages/authzed/concepts/restricted-api-access.mdx‎

Lines changed: 20 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
import { Callout, Tabs } from 'nextra/components'
2-
import { Bleed } from 'nextra-theme-docs'
32

43
# Restricted API Access
54

@@ -62,8 +61,6 @@ The command should output the hash, which can be referenced in your static confi
6261
71c73ba92f2032416b18a4f4fffb2a825755bea6a8430f2622ab1f3fb35a10d0
6362
```
6463

65-
[static configuration]: #static-configuration
66-
6764
### Roles
6865

6966
Roles define rules for accessing the SpiceDB API.
@@ -189,18 +186,29 @@ This CEL expression limits CheckPermissions requests to only be able to check a
189186
CheckPermissionRequest.permission == "admin"
190187
```
191188

192-
## Static Configuration
189+
## Configuration
193190

194-
Enterprise builds of SpiceDB can have their API access configured statically with a YAML configuration file.
191+
The process for setting up this feature varies depending on the AuthZed product you're using.
195192

196-
<Callout type="warning">
197-
These configuration files contain hashes of Tokens and should be treated like secrets.
198-
</Callout>
193+
### Dedicated & Cloud
194+
195+
Using the web dashboard, navigate to the Permission System's "Access" tab.
196+
197+
### Self-Hosted
199198

200-
This functionality is configured with the following flag:
199+
Use the following command-line flags:
201200

202-
- `--extender-enabled authzed-fgam`
203-
- `--extender-authzed-fgam-endpoint /path/to/configuration.yaml`
201+
| Flag | Description | Default |
202+
|---------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------|
203+
| --extender-authzed-fgam-endpoint | defines the external SpiceDB endpoint used to authorize operations for the authzed-fgam extender. If a file:// endpoint is provided, server is run embedded with static configuration | |
204+
| --extender-authzed-fgam-preshared-key | defines the external SpiceDB preshared key used to authorize operations for the authzed-fgam extender. Ignored if endpoint is local (file://) | |
205+
| --extender-enabled | must be set to `authzed-fgam` | |
206+
207+
If you set `--extender-authzed-fgam-endpoint` to a file, it must be a YAML configuration file.
208+
209+
<Callout type="warning">
210+
This configuration file should be treated like a secret because it contains token hashes.
211+
</Callout>
204212

205213
Here's an example showcasing the structure of static configuration:
206214

@@ -235,7 +243,7 @@ policy:
235243
236244
## Enabling without downtime
237245
238-
If you want to apply a static configuration to an existing SpiceDB cluster without downtime, you must conduct an upgrade process with the following steps:
246+
If you want to apply a configuration to an existing SpiceDB cluster without downtime, you must conduct an upgrade process with the following steps:
239247
240248
1. Create pre-shared keys that follow the token format for each client of your SpiceDB instance.
241249
You should add those to your SpiceDB instance configuration.

0 commit comments

Comments
 (0)