Skip to main content

Deploy the PDP on Kubernetes with YAML manifests

Deploy the Permit.io policy decision point (PDP) on Kubernetes with plain YAML manifests, without Helm. This page is for operators who manage Kubernetes resources as manifests. To install with Helm instead, see Deploy the PDP on Kubernetes with Helm.

The kubernetes directory of the permit-pdp-deployments-examples repository has three manifests:

FileResourceNameNotes
deployment.yamlDeploymentpermitio-pdpOne replica of permitio/pdp-v2:latest, with liveness, readiness, and startup probes on port 7000.
service.yamlServicepermitio-pdpListens on port 80 and forwards to container port 7000.
secret.yamlSecretpermitio-pdp-secretHolds the API key in the PDP_API_KEY field.

The manifests don't set a namespace. Kubernetes creates the resources in the namespace you pass to kubectl, or in your context's default namespace.

Prerequisites​

  • A Kubernetes cluster, and kubectl configured for it.
  • Your environment API key. See Get your API key.

Deploy the PDP with kubectl​

  1. Download deployment.yaml, service.yaml, and secret.yaml from the kubernetes example directory into one local directory.
  2. In secret.yaml, replace <Your PDP API Key in base64> with your environment API key, base64-encoded. For example, run echo -n '<YOUR_API_KEY>' | base64 and paste the output. A key that isn't base64-encoded makes the Secret invalid.
  3. Create a namespace for the PDP. The example uses permit-pdp; you can choose another name.
kubectl create namespace permit-pdp
  1. From the directory that holds the three files, apply them in the namespace from step 3:
kubectl apply -f . -n permit-pdp
  1. Optional: wait for the PDP to become available:
kubectl wait --for=condition=available --timeout=600s deployment/permitio-pdp -n permit-pdp

Verify the PDP is running​

  1. Run kubectl get pods -n permit-pdp. The permitio-pdp pod shows 1/1 in the READY column.
  2. Run kubectl port-forward svc/permitio-pdp 7766:80 -n permit-pdp, then send a GET request to http://localhost:7766/health. A healthy PDP returns HTTP 200 with "status": "ok".

Connect to the PDP​

From inside the cluster, services reach the PDP through the permitio-pdp Service on port 80:

http://permitio-pdp.<NAMESPACE>.svc.cluster.local

Replace <NAMESPACE> with the namespace you deployed to (permit-pdp in the example). Set this URL as the PDP URL in your SDK. See Connect your SDK to the PDP.

From outside the cluster, expose the permitio-pdp Service with a load balancer or an ingress. Anyone who can reach an exposed PDP can send it permission checks, so restrict access to your own services.

PDP liveness, readiness, and startup probes​

The PDP serves one health check on three paths on port 7000: /health, /healthy, and /ready. Every path checks the PDP's internal API service (Horizon) and its policy engine, Open Policy Agent (OPA). The check returns HTTP 200 with "status": "ok" when both are healthy. It returns HTTP 503 with "status": "error" and the failing component when either one is not healthy. The health paths don't require an API key.

The example deployment.yaml assigns one path to each probe.

Liveness probe​

Kubernetes restarts the PDP container when the liveness probe fails. The example manifest calls /health on port 7000 every 10 seconds and restarts the container after 3 failures in a row.

Readiness probe​

Kubernetes sends Service traffic to a pod only while its readiness probe passes. The example manifest calls /healthy on port 7000 every 10 seconds and removes the pod from the Service after 10 failures in a row.

Startup probe​

Kubernetes holds the liveness and readiness probes until the startup probe passes. The PDP needs time at startup to fetch its configuration and load the policy. The example manifest waits 30 seconds, then calls /ready on port 7000 every 10 seconds, for up to 12 attempts.

For the same endpoints outside Kubernetes, see Verify the PDP is healthy.

Next steps​

Contents

Edit this page

Need help?