Add configurable gRPC message size limits for server
Author: rrossi-scCreated Jul 6, 2026Updated Sep 7, 2026
Problem
When using LookupSubjects with complex permission schemas involving recursive
relations (e.g., group#downwards_member) and set operations, requests fail with:
rpc error: code = ResourceExhausted desc = grpc: received message after decompression larger than max 4194304
Why client-side options don't help
- Client-side
grpc.MaxCallRecvMsgSize()only affects the client connection - The limit is hit on internal dispatch calls where
CollectingDispatchStreambuffers results during Union/Intersection/Exclusion operations - The server uses gRPC's default 4 MiB limit with no way to configure it
Use case
- Org with ~100k users
- Complex permission schema with recursive group membership (
group#downwards_member) LookupSubjectsto find all users with a permission on a resource
Proposed Solution
Add configurable gRPC message size limits to GRPCServerConfig:
--grpc-max-recv-msg-size(default: 4194304)--grpc-max-send-msg-size(default: 4194304)
Since GRPCServerConfig is shared, this also enables:
--dispatch-cluster-max-recv-msg-size--dispatch-cluster-max-send-msg-size
Implementation
I have a working implementation ready to submit as a PR if this approach is acceptable.
Changes:
- Add
MaxRecvMsgSizeandMaxSendMsgSizefields toGRPCServerConfigstruct - Register corresponding flags in
RegisterGRPCServerFlags() - Apply
grpc.MaxRecvMsgSize()andgrpc.MaxSendMsgSize()server options inComplete()
Source: authzed/spicedb