On-premises deployment
Run the full Permit Platform, including the control plane and the policy decision points (PDPs), inside your own Kubernetes or OpenShift cluster. This section is for operators who install and run the self-hosted platform. To decide whether you need a full on-premises deployment, see Deployment options.
The on-premises installer is available to Enterprise customers with an on-premises license. To get a license, contact Permit.io.
When to deploy on-premises
Choose a full on-premises deployment when:
- Your network is air-gapped. The installer package includes the platform's container images as
.tarfiles, so the cluster does not pull images from the internet. - Your data residency or compliance requirements don't allow policies, users, or decision logs to leave your infrastructure.
- Your security policy requires you to operate every authorization component yourself.
In the default hybrid deployment, Permit runs the control plane in its cloud and you run only the PDPs. The on-premises deployment moves the control plane into your cluster as well.
Set up the platform in order
- Prepare the prerequisites: cluster size, tools, Git repository, network, and storage.
- Install the platform, or follow the quick start for a default installation.
- Deploy PDPs next to your applications.
- Manage the platform: configuration, upgrades, backups, and scaling.
- Troubleshoot problems, and look up commands and settings in the reference.
How the on-premises platform works
Policy decision point (PDP)
The policy decision point (PDP) answers authorization checks from your applications. Each PDP:
- Receives policies and data from the control plane over the Open Policy Administration Layer (OPAL) and keeps a local copy.
- Evaluates each check with Open Policy Agent (OPA) against that local copy.
- Answers checks from the local copy, so a check doesn't make a request to the control plane.
See the PDP overview and the PDP repository on GitHub.
Architecture diagram
The control plane, the PDPs, and your applications all run in your infrastructure. Policy Sync connects the control plane to your Git repository, and the OPAL server sends policy updates to the PDPs:
┌──────────────────────────────────────────────────────────────────┐
│ Your Infrastructure │
│ │
│ ┌────────────────────────────────────────────────────────────┐ │
│ │ Permit Platform (Control Plane) │ │
│ │ │ │
│ │ ┌──────────────┐ ┌──────────────┐ ┌───────────────┐ │ │
│ │ │ Frontend │ │ Backend │ │ OPAL Server │ │ │
│ │ │ (UI/API) │ │ Services │ │(Policy Engine)│ │ │
│ │ └──────────────┘ └──────────────┘ └───────────────┘ │ │
│ │ │ │
│ │ ┌──────────────┐ ┌──────────────┐ ┌───────────────┐ │ │
│ │ │ PostgreSQL │ │ Redis │ │ RabbitMQ │ │ │
│ │ │ (Database) │ │ (Cache) │ │ (Messaging) │ │ │
│ │ └──────────────┘ └──────────────┘ └───────────────┘ │ │
│ │ │ │
│ │ ┌──────────────┐ ┌──────────────┐ ┌───────────────┐ │ │
│ │ │ OpenSearch │ │ Keycloak │ │ Policy Sync │ │ │
│ │ │ (Logs) │ │ (IAM) │ │ (Git→OPAL) │ │ │
│ │ └──────────────┘ └──────────────┘ └───────┬───────┘ │ │
│ └────────────────────────────────────────────────┼──────────┘ │
│ │ Policy │
│ │ Updates │
│ ┌─────────────────────────┘ │
│ │ │
│ ▼ │
│ ┌────────────────────────────────────────────────────────────┐ │
│ │ Policy Decision Points (PDPs) │ │
│ │ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐ │ │
│ │ │ PDP Pod │ │ PDP Pod │ │ PDP Pod │ │ ... │ │ │
│ │ │ + OPA │ │ + OPA │ │ + OPA │ │ │ │ │
│ │ └────▲─────┘ └────▲─────┘ └────▲─────┘ └──────────┘ │ │
│ └───────┼─────────────┼─────────────┼────────────────────────┘ │
│ │ │ │ │
│ │ Authorization Requests (low latency) │
│ │ │ │ │
│ ┌───────┴─────────────┴─────────────┴────────────────────────┐ │
│ │ Your Applications / Services │ │
│ └─────────────────────────────────────────────────────────────┘ │
│ │
│ ┌─────────────────────────────────────────────────────────────┐ │
│ │ External Policy Repository (Git) │ │
│ │ - Authorization policies in Rego format (OPA) │ │
│ │ - Synced to OPAL via Policy Sync service │ │
│ └─────────────────────────────────────────────── ──────────────┘ │
└───────────────────────────────────────────────────────────────────┘
Platform components
The control plane installs as three Helm releases in one namespace. PDPs install separately.
| Layer | Component | Role |
|---|---|---|
| Control plane | Frontend | Web UI for managing policies, users, and environments |
| Control plane | Backend services | REST API, policy management, and background workers |
| Control plane | OPAL server | Distributes policy and data updates to PDPs |
| Control plane | Policy Sync | Syncs policies with your Git repository over SSH |
| Infrastructure | PostgreSQL | Stores policies, users, and configuration. Runs with a read replica and PgBouncer connection pooling. |
| Infrastructure | Redis | Cache |
| Infrastructure | RabbitMQ | Message queue for asynchronous work |
| Infrastructure | OpenSearch | Stores decision logs |
| Infrastructure | Keycloak | Sign-in for the Permit Platform UI |
| Data plane | PDP pods | Answer authorization checks. Deployed with a separate Helm chart. |
| Data plane | OPA | Policy engine inside each PDP |
The installation guide lists each service the installer deploys.
Supported platforms
- Kubernetes: Amazon EKS, Google GKE, Azure AKS, or a self-managed cluster.
- Red Hat OpenShift: OpenShift Container Platform (OCP), Red Hat OpenShift Service on AWS (ROSA), or OpenShift Dedicated.
- Kind, for local development and testing only.
See cluster sizing for node counts and versions.
Security controls you configure
| Control | How the platform implements it | Where to configure it |
|---|---|---|
| TLS | Self-signed certificates, your own certificate, or TLS terminated outside the cluster | Configure TLS certificates |
| Generated credentials | The installer generates the database, RabbitMQ, and Keycloak passwords and stores them in Kubernetes secrets and in values.yaml | Read the completion message |
| Platform sign-in | Keycloak authenticates users of the Permit Platform UI | Sign in to the platform |
| Git access | Policy Sync authenticates to your repository with an SSH deploy key | Set up the Git repository |
| PDP authentication | Each PDP connects to the control plane with an API key | Deploy PDPs |
| Namespace isolation | All platform components run in one Kubernetes namespace, permit-platform by default | Installer options |
The installer exposes OpenSearch Dashboards at /opensearch/ on the frontend domain without a sign-in. Anyone who can reach the domain can read decision logs. Restrict network access to the ingress. See Access the platform dashboards.
Get help
Email support@permit.io, or ask in the Permit community on Slack.