Hi,
I am testing ABAC policies locally to change s...
# opalm
Michał Wójcik
10/15/2025, 9:52 AMHi,
I am testing ABAC policies locally to change some conditions in ABAC rules. My local PDP needs about 5 minutes to update the changed conditions... Is it possible to force an immediate update?
Interestingly, when I change any state in the policy editor, it is updated immediately.
PDP LOGS
Copy code
2025-10-15T09:25:08.891982+0000 | opal_client.policy.updater | INFO | Received policy update: topic=d7c2f5d674f54f82a21b401cf5190d32:policy:., message={'old_policy_hash': '9ed9fb1d2c4defae9d020e36f3c8510aa2930464', 'new_policy_hash': '7a919fe931c2403e183b134187a28abd8a8878d4', 'changed_directories': ['.', 'permit', 'permit/generated', 'permit/generated/conditionset']}
2025-10-15T09:25:08.892246+0000 | opal_client.policy.updater | INFO | Refetching policy code (delta bundle), base hash: '9ed9fb1d2c4defae9d020e36f3c8510aa2930464'
2025-10-15T09:25:08.892655+0000 | opal_client.policy.fetcher | INFO | Fetching policy bundle from <https://opal-v2.permit.io/scopes/d7c2f5d674f54f82a21b401cf5190d32/policy>
2025-10-15T09:25:10.461838+0000 | uvicorn.protocols.http.httptools_impl | INFO | 127.0.0.1:37394 - "GET /healthy HTTP/1.1" 200
2025-10-15T09:25:11.840135+0000 | opal_client.policy.fetcher | INFO | Fetched valid bundle, id: 7a919fe931c2403e183b134187a28abd8a8878d4
2025-10-15T09:25:11.841801+0000 | opal_client.policy.updater | INFO | got policy bundle (delta): '9ed9fb1d2c4defae9d020e36f3c8510aa2930464' -> '7a919fe931c2403e183b134187a28abd8a8878d4', manifest: ['permit/generated/conditionset/Large_5fquantity.rego'], deleted: None
2025-10-15T09:25:11.847489+0000 | opal_client.engine.logger | INFO | Received request. PUT /v1/policies/permit/generated/conditionset/Large_5fquantity.rego
2025-10-15T09:25:11.994635+0000 | opal_client.engine.logger | INFO | Sent response. PUT /v1/policies/permit/generated/conditionset/Large_5fquantity.rego -> 200a
Ask Inkeep
10/15/2025, 9:52 AMHi @Michał Wójcik, I'm an AI assistant for Permit.io. I'll analyze available sources and get back to you shortly.
Ask Inkeep
10/15/2025, 9:53 AMBased on your logs, the policy update is actually happening quite quickly (about 3 seconds from receiving the update to completing it) . The 5-minute delay you're experiencing is likely the time between when you make changes and when OPAL detects and propagates them.
You can trigger an immediate data update using the PDP's API endpoint (1) :
Copy code
curl -XPOST <http://localhost:7766/data-updater/trigger>Ask Inkeep
10/15/2025, 9:53 AMTo learn more, see the sources I considered: [[1] Send Consistent Updates (Read-Your-Own-Writes)](https://docs.permit.io/how-to/manage-data/local-facts-uploader)
m
Michał Wójcik
10/15/2025, 9:56 AMworkspace: sea.live
project: dev
env: default
pdp version : the latest
a
Alon Boshi
10/15/2025, 10:00 AMHey @Michał Wójcik, thanks for reaching out, we're investigate it and will circle back to you soon
✅ 1
Alon Boshi
10/15/2025, 3:12 PMHey @Michał Wójcik, thanks for your patience!
Could you check now if you're seeing any improvement on your end?
m
Michał Wójcik
10/15/2025, 5:58 PMAt this point, I can see in the pdp logs that opal detects the change and updates it immediately, but when I call the check function, it still returns the same result despite the change... Could this be a cache issue? After restarting, pdp works as it should. Is there any way I can get around this? I have a demo tomorrow and I wanted to show them ABAC :)
t
Thomas
10/15/2025, 6:02 PMhey @Michał Wójcik what is your pdp config? also can you try and delete the local image
latesto
Or Weis
10/15/2025, 6:03 PMAlso please share these recent PDP logs
m
Michał Wójcik
10/15/2025, 6:43 PM@Thomas I did that.
Copy code
docker run -it -p 7766:7000 -p 8181:8181 --env PDP_API_KEY=secret--env PDP_DEBUG=True permitio/pdp-v2:latesto
Or Weis
10/15/2025, 6:54 PMThere are two types of updates in the system policy (code such as ABAC conditions) and facts (data such as permission or role assignment)
fact updates are usually within 100ms
policy updates should happen within a few seconds - 30 seconds is within bounds - 5 minutes is outside of expected bounds.
We did have a server issue that we addressed, and working to investigate further that slowed down updates dramatically.
There might be a few more slow effects here, that we’ll address further.
t
Thomas
10/15/2025, 6:55 PM@Michał Wójcik can you try a manual call to the PDP to update the policy? https://pdp-api.permit.io/redoc#tag/Policy-Updater/operation/trigger_policy_update_policy_updater_trigger_post
Thomas
10/15/2025, 6:56 PMyou can also do the same for data: https://pdp-api.permit.io/redoc#tag/Data-Updater/operation/trigger_policy_data_update_data_updater_trigger_post
m
Michał Wójcik
10/15/2025, 7:14 PMThomas, I tried to invoke these endpoints, but the update is not immediate.
I keep my fingers crossed that the server problem will be solved. I tested ABAC some time ago and I remember that it worked without any problems :)
t
Thomas
10/15/2025, 7:27 PM@Michał Wójcik for the sake of your demo you may need to reboot the PDP as a temporary workaround (just as an interim). The reason it can have up to 5 minute delay is that policy code doesn't change that often and thus has a max longer time to be updated. Normally people aren't doing live demos of ABAC policies that have to be consistently synced 😅
✅ 1
o
Omer Zuarets
10/16/2025, 6:34 AM@Michał Wójcik looking at the logs you attached I can see the second update did arrive shortly after the first one ( see PUT /v1/policies/… )
After that arrived the pdp was up to date with the latest changes - it did happen ~30seconds after the data update, but do notice it can happen due to policy updates being slower than data updates as they include actual change of code ( similarly, a rollout deployment in k8s using helm or any other tool takes some time )
Can you attach the logs of the 5 minutes time ( preferably as a file I guess ), did it happen also after we improved the performance on our side ?