From 45df4d0d9b577fecee798d672695fe24ff57fb1b Mon Sep 17 00:00:00 2001 From: mo khan Date: Tue, 15 Jul 2025 16:37:08 -0600 Subject: feat: migrate from Cedar to SpiceDB authorization system This is a major architectural change that replaces the Cedar policy-based authorization system with SpiceDB's relation-based authorization. Key changes: - Migrate from Rust to Go implementation - Replace Cedar policies with SpiceDB schema and relationships - Switch from envoy `ext_authz` with Cedar to SpiceDB permission checks - Update build system and dependencies for Go ecosystem - Maintain Envoy integration for external authorization This change enables more flexible permission modeling through SpiceDB's Google Zanzibar inspired relation-based system, supporting complex hierarchical permissions that were difficult to express in Cedar. Breaking change: Existing Cedar policies and Rust-based configuration will no longer work and need to be migrated to SpiceDB schema. --- Dockerfile | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) (limited to 'Dockerfile') diff --git a/Dockerfile b/Dockerfile index e1c3d7a0..8df86423 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,11 +1,9 @@ # syntax=docker/dockerfile:1 -# Build stage for authzd -FROM rust:alpine AS authzd-builder -RUN apk add --no-cache musl-dev openssl-dev openssl-libs-static pkgconfig +FROM golang:1.24 AS authzd-builder +ENV CGO_ENABLED=0 WORKDIR /app COPY . ./ -RUN cargo build --bins --release --target x86_64-unknown-linux-musl --offline -RUN strip /app/target/x86_64-unknown-linux-musl/release/authzd +RUN go build -o /bin/authzd ./cmd/authzd/main.go # Build stage for getting Envoy binary FROM envoyproxy/envoy:v1.34-latest AS envoy-binary @@ -30,7 +28,7 @@ WORKDIR / COPY --from=authzd-builder /app/Procfile /Procfile COPY --from=authzd-builder /app/etc/authzd /etc/authzd COPY --from=authzd-builder /app/etc/envoy /etc/envoy -COPY --from=authzd-builder /app/target/x86_64-unknown-linux-musl/release/authzd /bin/authzd +COPY --from=authzd-builder /bin/authzd /bin/authzd COPY --from=envoy-binary /usr/local/bin/envoy /bin/envoy COPY --from=minit-builder /go/bin/minit /bin/minit COPY --from=dumb-init-builder /usr/bin/dumb-init /usr/bin/dumb-init -- cgit v1.2.3