getting 401 on K8s health checks for PDP version 0...
# permit-saasr
Ryan Barriger
10/27/2025, 7:39 PMgetting 401 on K8s health checks for PDP version 0.9.8 and 0.9.7
a
Ask Inkeep
10/27/2025, 7:39 PMHi @Ryan Barriger, I'm an AI assistant for Permit.io. I'll analyze available sources and get back to you shortly.
p
permit support automation2
10/27/2025, 7:39 PMHey, thanks for reaching out !
It seems our team is a little busy right now, a human will be with you within the next hour or so.
In the meantime, can I help you ?
a
Ask Inkeep
10/27/2025, 7:39 PM\
The 401 error on health checks indicates an authentication issue. According to the documentation, the PDP requires bearer token authentication by default (1) .
The PDP has a configuration
PDP_OPA_BEARER_TOKEN_REQUIREDTruePDP_ALLOW_METRICS_UNAUTHENTICATED=True/metrics/health/healthy/readyAsk Inkeep
10/27/2025, 7:39 PMTo learn more, see the sources I considered: [[1] Configurations](https://docs.permit.io/concepts/pdp/configuration) [[2] Deploying PDP using raw Kubernetes YAMLs](https://docs.permit.io/how-to/deploy/cloud-hosts/kubernetes-raw)
o
Or Weis
10/27/2025, 7:53 PMHi Ryan can you share a little more here?
• What version you were on before (that worked)
• How the probe is configured
r
Ryan Barriger
10/27/2025, 7:56 PMI was on 'latest' for the past couple of weeks since 0.9.2 didnt work with our K8s upgrade. Then today i started noticing 401 errors on the health probe for 0.9.8. Backed it down to 0.9.7 and see errors again. My original livenessProbe section looked like:
ports:
- containerPort: 7000
livenessProbe:
httpGet:
path: '/healthcheck'
port: 7000
initialDelaySeconds: 10
periodSeconds: 30
failureThreshold: 5
Ryan Barriger
10/27/2025, 7:56 PMhavent touched that section since my original implementation
Ryan Barriger
10/27/2025, 7:59 PMchanging the path to '/health' right now - will let you know in about 20 min or so
Ryan Barriger
10/27/2025, 8:09 PMok can confirm that '/healthcheck' throws 401, while '/health' throws 200:
Ryan Barriger
10/27/2025, 8:10 PMnot a big deal for me to switch, just caught off guard :)
o
Or Weis
10/27/2025, 8:11 PMNice. glad that was an easy catch -
I’m not actually sure when that changed - @Ask Inkeep can you check?
I’ll do a retrospective with the team accordingly
a
Ask Inkeep
10/27/2025, 8:11 PMThanks for tagging me @Or Weis. I'll look through relevant sources and get back to you shortly.
Ask Inkeep
10/27/2025, 8:11 PMBased on the documentation, there are actually different health check endpoints between OPAL and the PDP
Ask Inkeep
10/27/2025, 8:11 PMFeel free to tag me with additional questions. I also appreciate feedback, it helps me improve. 👍 button 👎 button
o
Or Weis
10/27/2025, 8:12 PMUseless 😄
r
Ryan Barriger
10/27/2025, 8:12 PMno worries. I need to connect up with your SDK guy on the variations for resource instances. will try and set something up next week
✅ 1
o
Or Weis
10/27/2025, 8:12 PM@Omer Zuarets - Job security achieved