Deploy the PDP on Kubernetes with Helm

Install the Permit.io policy decision point (PDP) on Kubernetes with the official pdp Helm chart. This page is for operators who run Kubernetes and want a PDP that services in the cluster can call.

The chart is published from the permitio/PDP repository at https://permitio.github.io/PDP. It creates these resources:

Resource	Name	Notes
Deployment	permitio-pdp	Runs the permitio/pdp-v2 image, with a liveness probe on /health and a readiness probe on /healthy, both on port 7000.
Service	permitio-pdp	Listens on port 7766 and forwards to container port 7000.
Secret	permitio-pdp-secret	Holds the API key. The chart skips the Secret when you set pdp.existingApiKeySecret.
PodDisruptionBudget	permitio-pdp-pdb	Created only when pdp.replicas is greater than 1.

Prerequisites

• A Kubernetes cluster, and kubectl configured for it.
• Helm installed.
• Your environment API key. See Get your API key.

Install the PDP with Helm

1. Add the Permit PDP Helm repository:

helm repo add pdp https://permitio.github.io/PDP

2. Confirm Helm added the repository, and list the chart versions:

helm search repo pdp

The output lists the pdp/pdp chart.

3. Install the chart. Replace <API_KEY> with your environment API key:

helm install pdp pdp/pdp --set pdp.ApiKey=<API_KEY> --create-namespace --namespace pdp --wait

The command creates the pdp namespace, installs a release named pdp, and waits until the PDP pod is ready.

API key on the command line

A key passed with --set stays in your shell history, and anyone who can run helm get values on the release can read it. To keep the key out of the command, create a Kubernetes Secret yourself and set pdp.existingApiKeySecret.name and pdp.existingApiKeySecret.key in a values file.

Verify the PDP is running

1. Run kubectl get pods -n pdp. The permitio-pdp pod shows 1/1 in the READY column and Running in the STATUS column.
2. Run kubectl port-forward svc/permitio-pdp 7766:7766 -n pdp.
3. In another terminal, send a GET request to http://localhost:7766/health. A healthy PDP returns HTTP 200 with "status": "ok".

For what each health endpoint returns, see Verify the PDP is healthy.

Connect to the PDP

From inside the cluster, services reach the PDP through the permitio-pdp Service on port 7766:

http://permitio-pdp.<NAMESPACE>.svc.cluster.local:7766

Replace <NAMESPACE> with the namespace you installed the chart in (pdp in the example above). Set this URL as the PDP URL in your SDK. See Connect your SDK to the PDP.

From outside the cluster, expose the permitio-pdp Service with a load balancer or an ingress. Anyone who can reach an exposed PDP can send it permission checks, so restrict access to your own services.

Common chart values

Set values with --set or a values file. For the full list, see the chart's values.yaml.

Value	Default	Purpose
pdp.ApiKey	Placeholder	Environment API key, stored in the permitio-pdp-secret Secret.
pdp.existingApiKeySecret.name, pdp.existingApiKeySecret.key	Not set	Use an existing Secret for the API key instead.
pdp.port	7766	Port of the permitio-pdp Service.
pdp.replicas	1	Number of PDP pods.
pdp.image.tag	latest	PDP image tag. Pin a version to control upgrades.
pdp.pdpEnvs	[]	Extra PDP environment variables, as a list of name and value pairs.
pdp.debug_mode	false	Sets PDP_DEBUG=true on the PDP.

Next steps

• Size the PDP for production
• Run the PDP in offline mode
• Monitor your PDPs
• Deploy the PDP with Terraform