Continuous deployment support

[UncleBats]

In a system where we could deploy multiple times a day, there would be a nasty side effect: due to the immutable nature of the model on each deployment, there would be a new version even when there is no change. I created a script in our pipelines that will leverage the openfga/cli to transform our model.fga and transform it into a .json file. Together with a model read on the currently deployed model, this would result in 2 json files that are sorted by fga and could be comparable.

function is_model_changed()
{
    STORE_ID=$( validate_parameter "storeid" "[$1]" )
    MODEL=$( validate_parameter "autorizationmodel" "[$2]" '\.fga$' )

    fga model get --store-id $STORE_ID => existing_model.fga
    fga model transform --file $AUTORIZATINONMODEL => temp.json
    fga model transform --file temp.json => new_model.fga 

    DIFF_OUTPUT=$( diff existing_model.fga new_model.fga )
    if [ $? -eq 0 ]; then #0 files are the same. #1 they differ
        echo false
    fi

    echo true
}

Of course, there are different ways to solve this; however, I prefer keeping everything in a single pipeline (infrastructure, model, anti-corruption API). Is there a way to instruct openFGA to verify if the model was changed instead of me trying to work around this?

[aaguiarz]

Hi @UncleBats

We could avoid generating a new model if it's the same one. However, we've also heard a few times that it would be useful to be able to either set the Model ID, or to be able to retrieve it using another identifier (e.g. a model name, commit id, etc).

This would simplify continuous deployment scenarios where you actually change the model ID.

Do you think that feature would address this issue for you?

[UncleBats]

Hey thnx for the response, when you would use commit ID that would not help cause that will change on any change in the repo. In my mind it should not change if there is no change and you can --force to apply it anyway. This however would be a breaking change from how it is working now.

I noticed that there is a difference between ordering of the relations, thats why I tansform and read them both to json. But thats is assuming there would not be another change implemnted that we can miss.

Adding a flag like --skip-when-unchanged or something like that would make sense from the CD perspective. Or only apply when a version is defined and different.