Hi! having issue loading Flights

Hey Marin Š., we're looking into this!

Hey Marin Š., as discussed privately, we have a release tomorrow that aims to fix this issue. We'll provide you an update tomorrow

Hi Marin Š. Our MotherDuck release is out! Can you retry running your flight and let me know if its working?

Flights are loading now!

Question regarding Flights - we are building multitenant setup. service account owns central DB, which would then need to build tenant DBs - each under its service account. And we need to daily update those by central flights. they are updated using data from central db but also with using private data under each db which is joined to central data. Is this right setup? How it works with flights? Thanks

Hey Marin Š., glad it works now! As for your question, it seems you are trying to make the "central" service account update the data of the tenant databases, which are owned by different service accounts. Is that correct? Each tenant service account should have read access to the central DB, and they should then have a flight configured to update their respective databases

Yes - i understood that is best practice - or you have some other solution? But should each service account have read access to central DB if they are scoped only to their part of data in their DB?

In that case, the central flight would require write access to each tenant database so it needs to have a read/write token for each service account and stored as a Flight secret. When running the central flight, it would retrieve the secret to update the database tied to it

so in that case central accout has rw token for each tenant db - do they need to be shared to central db or? do you suggest build like this or something better?

The tenant rw token would be used to write to the tenant database, but you'll still use the token that came with the flight to read from the central db. I think given your limitation that the tenants cannot access data from the central DB other than what they're scoped to, this is what I would recommend

thanks! token that came with the flight to read from the central db - this does not need to be in secrets - it is service account flight?

You're welcome! So on your "central" flight, you would have two sets of tokens

This will have read access to your central DB because it's tied to your "central" service account - only read or rw?

do they need to be shared to central db or? - did not get this - central flight has rw token for each tenant db, but do tenant db need to be shared/attached to central service account also?

and how provisioning works - can central flights create tenant db's? I also have app where tenants are initialy created - they need to flow somehow to motherduck for provisoning/scoping. App in the end has embedded dive, and should choose db that belongs to that users tenant