Skip to main content

Deploy the PDP on Kubernetes with Pulumi

Install the Permit.io policy decision point (PDP) on Kubernetes with Pulumi. This page is for operators who manage cluster workloads with Pulumi in Python.

The Pulumi example in the permit-pdp-deployments-examples repository is a Python program (__main__.py). The program creates a pdp namespace and installs the PDP Helm chart into it as a release named pdp. The chart creates a Deployment, a Service, and a Secret, all named with the permitio-pdp prefix. For what the chart installs, see Deploy the PDP on Kubernetes with Helm.

Prerequisites​

  • A Kubernetes cluster, and a kubeconfig that Pulumi can use.
  • The Pulumi CLI and Python 3 installed.
  • Git installed.
  • Your environment API key. See Get your API key.

Install the PDP with Pulumi​

  1. Clone the deployment examples repository:
git clone https://github.com/permitio/permit-pdp-deployments-examples
  1. Change to the pulumi directory of the cloned repository:
cd permit-pdp-deployments-examples/pulumi
  1. Create a Pulumi Python project and stack in the directory. The directory isn't empty, so pulumi new needs --force, which replaces __main__.py with the template's file. These commands keep a copy of the example's __main__.py and restore it. The kubernetes-python template adds pulumi-kubernetes, which the program imports, to requirements.txt:
cp __main__.py /tmp/permit-pdp-main.py
pulumi new kubernetes-python --force
cp /tmp/permit-pdp-main.py __main__.py
  1. Store your environment API key as an encrypted Pulumi secret. Replace <YOUR_API_KEY> with the key. The program reads the key from the apiKey config value:
pulumi config set --secret apiKey <YOUR_API_KEY>
  1. Preview and deploy the resources. Select yes to confirm:
pulumi up
Known issue with the example

The program installs the chart from https://permitio.github.io/sidecar, which no longer serves a Helm repository. Change repo in __main__.py to https://permitio.github.io/PDP.

Verify the PDP is running​

  1. Run kubectl get pods -n pdp. The permitio-pdp pod shows Running in the STATUS column.
  2. Run kubectl port-forward svc/permitio-pdp 7766:7766 -n pdp, then send a GET request to http://localhost:7766/health. A healthy PDP returns HTTP 200 with "status": "ok".

Connect to the PDP​

Inside the cluster, the PDP is at http://permitio-pdp.pdp.svc.cluster.local:7766. To reach the PDP from outside the cluster, expose the permitio-pdp Service. See Connect to the PDP.

Next steps​

Contents

Edit this page

Need help?