Skip to main content

Deploy the PDP on Kubernetes with Terraform

Install the Permit.io policy decision point (PDP) on Kubernetes with Terraform. This page is for operators who manage cluster workloads with Terraform.

The Terraform example in the permit-pdp-deployments-examples repository uses the Terraform Helm provider to install the PDP Helm chart. The chart creates a Deployment, a Service, and a Secret, all named with the permitio-pdp prefix. For what the chart installs, see Deploy the PDP on Kubernetes with Helm.

Prerequisites​

  • A Kubernetes cluster. The example's providers.tf reads the cluster connection from ~/.kube/config.
  • Terraform installed.
  • Git installed.
  • Your environment API key. See Get your API key.

Install the PDP with Terraform​

  1. Clone the deployment examples repository:
git clone https://github.com/permitio/permit-pdp-deployments-examples
  1. Change to the terraform directory of the cloned repository:
cd permit-pdp-deployments-examples/terraform
  1. Initialize Terraform. The command downloads the Helm provider:
terraform init
  1. Edit main.tf:
    • Replace the <API_KEY> placeholder with your environment API key.
    • Set repository to https://permitio.github.io/PDP. The address in the example, https://permitio.github.io/sidecar, no longer serves a Helm repository, and terraform apply fails with it.
  2. Preview the changes. The plan shows one helm_release resource named pdp to add:
terraform plan
  1. Apply the changes and confirm with yes:
terraform apply

The release installs the PDP in the pdp namespace, which the example creates.

API key in main.tf

A key typed into main.tf is stored in plain text in the file and in the Terraform state. Don't commit the edited main.tf. For shared or production setups, pass the key from a Terraform variable marked sensitive, and store the state in an encrypted backend.

Helm provider version

The example uses Helm provider 2.x syntax: a set block in main.tf and a kubernetes block in providers.tf. Helm provider 3.0.0 changed both to attributes. If terraform plan reports errors on those blocks, pin the provider to a 2.x version or follow the Helm provider v3 upgrade guide.

Verify the PDP is running​

  1. Run kubectl get pods -n pdp. The permitio-pdp pod shows Running in the STATUS column.
  2. Run kubectl port-forward svc/permitio-pdp 7766:7766 -n pdp, then send a GET request to http://localhost:7766/health. A healthy PDP returns HTTP 200 with "status": "ok".

Connect to the PDP​

Inside the cluster, the PDP is at http://permitio-pdp.pdp.svc.cluster.local:7766. To reach the PDP from outside the cluster, expose the permitio-pdp Service. See Connect to the PDP.

Next steps​

Contents

Edit this page

Need help?