spicedb-operator

This is a common frustration of mine as well! In the latest release of the spicedb-operator[0], I added a feature that allows users to specify arbitrary patches over operator-managed resources directly in the API (examples in the link). There are some other projects like Kyverno and Gatekeeper that try to do this generically with mutating webhooks, but embedding a `patches` API into the operator itself gives the operator a chance to ensure the changes are within some reasonable guardrails. [0]: https://github.com/authzed/spicedb-operator/releases/tag/v1....

Since Go got generics, working with the Kubernetes API could become far more ergonomic. It's been pulling teeth until now. I'm eager to see how the upstream APIs change over time. In the mean time, one of the creators of the Operator Framework[0] built a bunch of useful patterns using generics that we used to build the SpiceDB Operator[1] called controller-idioms[2]. Does anyone know of other efforts to improve the status quo? [0]: https://operatorframework.io [1]: https://github.com/authzed/spicedb-operator [2]: https://github.com/authzed/controller-idioms

>an efficient way to store and traverse graphs to determine an outcome ... I keep seeing more and more problems that could be solved this way Yes! The team over at Authzed keeps seeing this, too! While SpiceDB is fully embracing its primary use-case for permissions, you could also use it to solve many other problems that boil down to "the existence of a path on a graph". For example, we've considered using it for storing update graphs for automating software updates for our Kubernetes operator[0] The wonderful Kris Nova has also made this realization and considered SpiceDB for dependency resolution for an init system designed to replace systemd[1]. [0]: https://github.com/authzed/spicedb-operator [1]: https://docs.google.com/document/d/1dA591eipsgWeAlaSwbYNQtAQ...