Run SpiceDB on Kubernetes without the toil.

The official Kubernetes operator for SpiceDB. Create, manage, and scale clusters from a single resource, migrate datastores without downtime, and follow release channels instead of chasing versions.

Read the docs

cluster.yaml1 resource

apiVersion: authzed.com/v1alpha1kind: SpiceDBClustermetadata:  name: stagingprodspec:  config:    replicas: 33    datastoreEngine: cockroachdbpostgres  secretName: staging-spicedb-configprod-spicedb-config

$ kubectl apply -f cluster.yaml

spicedbcluster.authzed.com/stagingprod created

Day 1 and day 2

A cluster is one Kubernetes resource

The operator owns the parts of running SpiceDB that are easy to get wrong the first time and tedious every time after.

Built on controller-idioms, the controller library behind AuthZed's own managed services.

Docs →

kubectl create spicedbcluster

Create, manage, and scale a SpiceDB cluster from a single Kubernetes resource.

Docs →

Zero-downtime migrations

Run datastore migrations without taking the permissions system offline, whichever datastore you are on.

Docs →

Automated update channels

Pin a cluster to a release channel and let the operator roll updates out for you.

GitHub →

Built by Kubernetes people

Built by the Operator Framework creators on top of the controller-idioms library.

Alongside

What people run with it

Pairs with · Open sourceSpiceDB ClientsOfficial and community libraries, plus the Zed CLI, for talking to the cluster you just deployed.

Explore Clients →

Pairs with · LicenseSpiceDB EnterpriseThe commercially licensed build, with restricted API access, audit logging, and embargoed security fixes.

Explore Enterprise →

Deploy SpiceDB on Kubernetes

Install the operator with kubectl, then describe the cluster you want and let it converge.

Free and open source. Questions are welcome on the AuthZed Discord.