#3213·spicedb

Add configurable gRPC message size limits for server

Author: rrossi-scCreated Jul 6, 2026Updated Sep 7, 2026

Problem

When using LookupSubjects with complex permission schemas involving recursive relations (e.g., group#downwards_member) and set operations, requests fail with:

rpc error: code = ResourceExhausted desc = grpc: received message after decompression larger than max 4194304

Why client-side options don't help

  • Client-side grpc.MaxCallRecvMsgSize() only affects the client connection
  • The limit is hit on internal dispatch calls where CollectingDispatchStream buffers results during Union/Intersection/Exclusion operations
  • The server uses gRPC's default 4 MiB limit with no way to configure it

Use case

  • Org with ~100k users
  • Complex permission schema with recursive group membership (group#downwards_member)
  • LookupSubjects to find all users with a permission on a resource

Proposed Solution

Add configurable gRPC message size limits to GRPCServerConfig:

  • --grpc-max-recv-msg-size (default: 4194304)
  • --grpc-max-send-msg-size (default: 4194304)

Since GRPCServerConfig is shared, this also enables:

  • --dispatch-cluster-max-recv-msg-size
  • --dispatch-cluster-max-send-msg-size

Implementation

I have a working implementation ready to submit as a PR if this approach is acceptable.

Changes:

  • Add MaxRecvMsgSize and MaxSendMsgSize fields to GRPCServerConfig struct
  • Register corresponding flags in RegisterGRPCServerFlags()
  • Apply grpc.MaxRecvMsgSize() and grpc.MaxSendMsgSize() server options in Complete()