Relative location of schema files to import

[heytrav]

Hi all,

I'm attempting to set up our GitOps to import schema and seed relationships by mounting them in a pod and running the zed import command.

I'm importing both my schema and my relationships as separate configmaps because I'd like to be able to use a common schema across multiple environments and import different relationships depending on the environment (different ids etc.).

Right now I'm trying to use volumeMounts to put them in a directory together so that I have

/spicedb/relations.yaml
/spicedb/schema.yaml

The import runs in the pod as:

          - "import"
          - "/spicedb/relations.yaml"
          - "--log-level=debug"
          - "--insecure"

I'm getting the error message:

schema filepath /spicedb/spicedb.yaml must be local to where the command was invoked

I can't figure out where I need to put the spicedb.yaml file so that it's "local to where the command is invoked". I've tried adding a specific path and mounting in various other locations and nothing I do seems to work.

My pod

apiVersion: batch/v1
kind: Job
metadata:
  name: load-schema
spec:
  template:
    spec:
      volumes:
        - name: spicedb-schema
          configMap:
            name: spicedb-schema
        - name: spicedb-relations
          configMap:
            name: spicedb-relations
      containers:
      - name: load-schema
        image: authzed/zed:latest
        volumeMounts:
          - name: spicedb-schema
            mountPath: /spicedb/spicedb.yaml
            subPath: spicedb.yaml
          - name: spicedb-relations
            mountPath: /spicedb/relations.yaml
            subPath: relations.yaml
        command: ["zed"]
        args:
          - "import"
          - "/spicedb/relations.yaml"
          - "--log-level=debug"
          - "--token=averysecretpresharedkey"
          - "--insecure"

        [REDACTED]

My schema and relationships are both mounted from a ConfigMap and mounted into the pod.

Schema:

apiVersion: v1
kind: ConfigMap
metadata:
  name: spicedb-schema
data:
  spicedb.yaml: |
    schema: |-
      use expiration

      definition user {
        relation owner: user
        relation parent: organization
        relation accepted_tos: user

        permission view = owner + parent->view


     [REDACTED]

Relations:

apiVersion: v1
kind: ConfigMap
metadata:
  name: spicedb-relations
data:
  relations.yaml: |
    schemaFile: "spicedb.yaml"
    relationships: |-
      
    [REDACTED]

Please let me know if more info is needed..

[tstirrat15]

It's basically checking that the current working directory is a parent directory of the targeted file. This is intended as a security measure to prevent zed from accessing files that it shouldn't have access to.

We're using filepath.IsLocal to check this, and from the docs:

// IsLocal reports whether path, using lexical analysis only, has all of these properties:
//
//   - is within the subtree rooted at the directory in which path is evaluated
//   - is not an absolute path
//   - is not empty
//   - on Windows, is not a reserved name such as "NUL"

I looked it up, and the working directory for a zed container should already be the root. Have you tried removing the leading slash? I think that ought to work.

[heytrav]

Yep that worked, thanks!
Such a simple solution 🤦

[tstirrat15]

No worries! It isn't obvious :/