Hi @channel. I need to use storage drive postgres. I don’t see any code sample in docs. My understanding is choosing this storage option replace the policy definition process instead of yaml file the policy would be stored in database. Can someone share more details any working sample for database approach.

With all storage options, including Postgres, policies are written in YAML. In case of database storage, use Cerbos Admin API to submit policies to Cerbos. Configuring policies in Postgres includes three steps. Each step is described in the documentation, but I am not sure there’s a complete example for this use-case. The three steps are: 1. Configure Postgres as a storage, Link a. create the DB schema. 2. Enable Admin API. Link 3. Use Admin API to manage policies. Link

@Dennis (Cerbos) so the policies submitted from admin API in this case would be added/updated in database that’s all. The YAML file won’t be effected in this case.

so the policies submitted from admin API in this case would be added/updated in database that’s all.

Yes

The YAML file won’t be effected in this case.

Can you please elaborate on this?

So if my storage option is postgres and I perform some policy update from Admin API will that update the YAML file that is the source for all the policies defined at first place?

No, those YAML files would remain intact.

So while looking up the policies cerbos internally will go for Yaml & then database for changes if any & driver is database. @Dennis (Cerbos) just clarifying if i got it correct.

No. If you use a database storage driver, the YAML files you have on disk are not visible to Cerbos at all. It'll only see what's stored in the database. You can update the policies in the database by using the Admin API as described above.

@Charith (Cerbos) is that so ? Dennis mentioned earlier that YAML is the only source for writing policies. Now I am confused

I think he meant that the way you write policies does not change much except for the fact that now you have to submit your policies to Cerbos through the Admin API instead of just adding them to Git or copying to a directory on disk that Cerbos is watching.

Okay. Got it. But writing polices from API is a bit handy when you want to write it in bulk. So i needed confirmation on that does it go for YAML as a base & then look for new changes in database.

It only uses the database. The storage backend you configure for Cerbos through the

storage.driver

configuration setting is the only source of truth for policies. There's no stacking or inheritance of different storage backends.

Okay got it, Apart from that my container stop’s with error using database approach. I already setup database schema but getting unable to connect error.

What is the error message?

message has been deleted

Looks like an IPv6 issue in your container runtime. Try setting database host to

127.0.0.1

instead.

Okay let me try that.