Clarification on ConfigMap `update-graph` and Image Configuration in the Operator

[yanmxa]

What is the role of the ConfigMap update-graph in the operator? I noticed it is referenced but couldn't find any detailed description in the documentation. Could you provide more insight into its purpose and functionality?

Additionally, there is an imageName field in the ConfigMap, but the operand (SpicedbCluster) also provides a way to configure the image. What is the difference between these two configurations, and which one should be used to set the image?

reference: https://github.com/authzed/spicedb-operator/blob/main/config/update-graph.yaml, #327

[tstirrat15]

The update describes a path between SpiceDB versions that are known to be fully compatible with each other. The idea is that as the operator upgrades a set of SpiceDB nodes, it will walk the graph between the version you're on and the desired version.

A concrete example of this: we introduced a new implementation of LookupResources in one version of SpiceDB and deprecated the old implementation in a subsequent version. SpiceDB dispatches LookupResources subproblems between nodes. If you were to upgrade directly from a earlier version to the version where the old LR was deprecated, you would potentially have request failures on LookupResources, because dispatches between new nodes and old nodes would fail. Walking the update graph avoids this by doing intermediate upgrades.

The image on the SpiceDBCluster gives you a means of pinning to a specific image for specific use cases, but it's meant as an escape hatch, not a normal way of using it: https://github.com/authzed/spicedb-operator?tab=readme-ov-file#force-override

[AmythD]

Hi @tstirrat15, I am currently deploying spicedb using the latest available helm charts and I noticed that the update-graph configmap does not go until the latest version which is spicedb:v1.49.1 as of today. So, when I upgrade from this version :v1.49.1 to a newer version in future is there a way to indentify what changes would be needed to run the migrations since the the graph hasn't been updated in a while?

[tstirrat15]

I can verify this, but I believe you'd unpin the version and let the operator manage it again, unless I'm missing what you're asking.