jacob-mathison/query-orchestration
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Activity

Merged in feature/local-pdp (pull request #208)

Browse Source 
permit.io local pdp

* docs and testing

* build fix

* docs

* permit rights

* accept self signed certs

* fix eula error
This commit is contained in:
Jay Brown
2026-02-12 23:46:53 +00:00
parent 963ccc6553
commit d7f6c3700b
14 changed files with 1269 additions and 165 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+56
View File
@@ -208,6 +208,62 @@ PERMIT_IO_PDP_URL=http://localhost:7766 # Permit.io Policy Decision Point URL -
Note: The Permit.io project and environment IDs are automatically derived from the API key
using the `/v2/api-key/scope` endpoint. Use a project-level or environment-level API key.
#### PDP Sidecar Deployment (AWS)
The Permit.io Policy Decision Point (PDP) runs as a sidecar container alongside queryAPI.
The PDP syncs policies from Permit.io cloud and serves authorization decisions locally for
low-latency checks.
**Container Image:**
```
permitio/pdp-v2:0.9.9
```
> **Ops Note:** The PDP image version should be stored in soft config (e.g., SSM Parameter Store
> or environment configuration) so upgrades require no code changes. Check for new stable versions
> at [Docker Hub](https://hub.docker.com/r/permitio/pdp-v2/tags) quarterly or when issues arise.
> Avoid `-rc` (release candidate) tags in production.
**ECS Task Definition Setup:**
Add the PDP as a sidecar container in the same task definition as queryAPI:
| Setting | PDP Sidecar | queryAPI |
|---------|-------------|----------|
| Container Name | `permit-pdp` | `query-api` |
| Image | `permitio/pdp-v2:0.9.9` | `<your-ecr>/queryorchestration:latest` |
| Port Mappings | 7000 (container) | 8080 (container) |
| Essential | Yes | Yes |
**PDP Environment Variables:**
| Variable | Value | Source |
|----------|-------|--------|
| `PDP_API_KEY` | Permit.io API key for target environment | Secrets Manager |
| `PDP_DEBUG` | `false` (production) | Task definition |
**queryAPI Environment Variables:**
| Variable | Value | Notes |
|----------|-------|-------|
| `PERMIT_IO_API_KEY` | Same key as PDP | Secrets Manager |
| `PERMIT_IO_PDP_URL` | `http://localhost:7000` | Sidecar shares localhost |
| `PERMIT_IO_TENANT` | `default` or your tenant | Task definition |
**Health Check:**
```
GET http://localhost:7000/health
```
**Resource Recommendations (per Permit.io docs):**
- CPU: 256-1024 units (start with 256)
- Memory: 512 MB minimum, scale by `(policy objects * 6KB)`
**Authentication Flow:**
1. PDP authenticates to Permit.io cloud using `PDP_API_KEY` to sync policies
2. queryAPI authenticates to PDP using `PERMIT_IO_API_KEY` as Bearer token
3. Both keys should be the same environment-scoped API key
### Optional Environment Variables
#### Development & Testing