https://linen.dev logo
Join Slack
Powered by
Hello, installed pdp helm chart and logs shows : ...
# permit-saas
e
Hello, installed pdp helm chart and logs shows : | INFO | Received request. GET /health 2025-11-27T061015.020533+0000 | opal_client.engine.logger | INFO | Sent response. GET /health -> 200 2025-11-27T061016.986584+0000 | fastapi_websocket_rpc.websocket_rpc_c...| INFO | Trying server - wss://opal.permit.io/ws 2025-11-27T061017.007336+0000 | fastapi_websocket_rpc.websocket_rpc_c...| INFO | RPC Connection failed - [Errno -5] Name has no usable address 2025-11-27T061017.036199+0000 | opal_client.policy_store.opa_client |WARNING | OPA client health: False (policy: False, data: False) 2025-11-27T061017.036497+0000 | uvicorn.protocols.http.httptools_impl | INFO | 127.0.0.1:51190 - "GET /healthy HTTP/1.1" 503 2025-11-27T061018.960840+0000 | fastapi_websocket_rpc.websocket_rpc_c...| INFO | Trying server - wss://opal.permit.io/ws 2025-11-27T061018.975944+0000 | fastapi_websocket_rpc.websocket_rpc_c...| INFO | RPC Connection failed - [Errno -5] Name has no usable address 2025-11-27T061021.188084+0000 | opal_client.policy_store.opa_client |WARNING | OPA client health: False (policy: False, data: False) 2025-11-27T061021.188436+0000 | uvicorn.protocols.http.httptools_impl | INFO | 127.0.0.1:40428 - "GET /healthy HTTP/1.1" 503 [2025-11-27T061021Z INFO pdp_server:apihealth:handlers] Health check failed: horizon: Horizon returned status 503 Service Unavailable 2025-11-27T061021.188967+0000 | opal_client.engine.logger | INFO | Received request. GET /health 2025-11-27T061021.189310+0000 | opal_client.engine.logger | INFO | Sent response. GET /health -> 200 2025-11-27T061025.018754+0000 | opal_client.policy_store.opa_client |WARNING | OPA client health: False (policy: False, data: False) 2025-11-27T061025.019149+0000 | uvicorn.protocols.http.httptools_impl | INFO | 127.0.0.1:40428 - "GET /healthy HTTP/1.1" 503 [2025-11-27T061025Z INFO pdp_server:apihealth:handlers] Health check failed: horizon: Horizon returned status 503 Service Unavailable 2025-11-27T061025.019503+0000 | opal_client.engine.logger | INFO | Received request. GET /health 2025-11-27T061025.019841+0000 | opal_client.engine.logger | INFO | Sent response. GET /health -> 200 2025-11-27T061027.037228+0000 | opal_client.policy_store.opa_client |WARNING | OPA client health: False (policy: False, data: False) 2025-11-27T061027.037677+0000 | uvicorn.protocols.http.httptools_impl | INFO | 127.0.0.1:48132 - "GET /healthy HTTP/1.1" 503 [2025-11-27T061027Z WARN watchdog::service] Service 'python3' health check failed: Unhealthy status code: 503 (expected 200) (consecutive failures: 6/12) 2025-11-27T061031.187797+0000 | opal_client.engine.logger | INFO | Received request. GET /health 2025-11-27T061031.188469+0000 | opal_client.policy_store.opa_client |WARNING | OPA client health: False (policy: False, data: False) 2025-11-27T061031.188779+0000 | uvicorn.protocols.http.httptools_impl | INFO | 127.0.0.1:48148 - "GET /healthy HTTP/1.1" 503 [2025-11-27T061031Z INFO pdp_server:apihealth:handlers] Health check failed: horizon: Horizon returned status 503 Service Unavailable 2025-11-27T061031.189099+0000 | opal_client.engine.logger | INFO | Sent response. GET /health -> 200 2025-11-27T061031.192362+0000 | opal_client.policy_store.opa_client |WARNING | OPA client health: False (policy: False, data: False) 2025-11-27T061031.192574+0000 | uvicorn.protocols.http.httptools_impl | INFO | 127.0.0.1:48148 - "GET /healthy HTTP/1.1" 503 [2025-11-27T061031Z INFO pdp_server:apihealth:handlers] Health check failed: horizon: Horizon returned status 503 Service Unavailable 2025-11-27T061031.192840+0000 | opal_client.engine.logger | INFO | Received request. GET /health 2025-11-27T061031.193401+0000 | opal_client.engine.logger | INFO | Sent response. GET /health -> 200 when im trying to resolve opal.permit.io also from my local machine im getting No answer
a
Hi @Ester Hatchuel, I'm an AI assistant for Permit.io. I'll analyze available sources and get back to you shortly.
The error shows your PDP is failing to connect to the OPAL server at 
<wss://opal.permit.io/ws>
. The connection error "[Errno -5] Name has no usable address" indicates a DNS resolution issue. The PDP is trying to connect to the wrong OPAL server URL. According to the configuration documentation, the default OPAL server URLs are (1) : • 
OPAL_SERVER_URL
defaults to 
<https://opal-v2.permit.io>
• 
OPAL_SERVER_WS_URL
defaults to 
<wss://opal-v2.permit.io>
Your logs show it's trying to connect to 
<wss://opal.permit.io/ws>
instead of 
<wss://opal-v2.permit.io>
. To fix this, ensure you've set the correct environment variables in your Helm deployment :
Copy code
env:
  - name: PDP_API_KEY
    value: "your-api-key"
  - name: OPAL_SERVER_URL
    value: "<https://opal-v2.permit.io>"
  - name: OPAL_SERVER_WS_URL
    value: "<wss://opal-v2.permit.io>"
Also verify that your 
PDP_API_KEY
is correctly set with an Environment-level API Key as this is required for the PDP to authenticate . To help our engineers investigate further: 1. Which Workspace / Project / Env are you using? 2. What calls are you performing (as SDK code or CURL) ? 3. Which PDP version are you running? 4. Can you share the full PDP logs including startup logs?
To learn more, see the sources I considered: [[1] Configurations](https://docs.permit.io/concepts/pdp/configuration)
o
Hi @Ester Hatchuel, making sure the AI agent's answer works for you. Seems correct to me
e
Hey OR, indeed i use to work with environment key and then i changed it to project key ( since connect github requires project level key ) so actually i need to use 2 different keys one environment level for the pdp the for git the project level ?
o
connecting to the Git repository is a once per environment setup, and a separate flow from spinning up a PDP. you shouldn't need to mix it with the PDP's key. While you can run PDPs with Project or Org key, we highly recommend you use an environment key
So yes. separate keys for each of these flows
e
ok greate, i have another question, i already set up the pdp. i have envoyfilter passing the request to the pdp, does pdp supports grpc_service: google_grpc: ? which target uri i suppose to insert port 9191 enabled? or 7000?
a
@Ask Inkeep
a
Thanks for tagging me @Alon Boshi. I'll look through relevant sources and get back to you shortly.
I can't find specific documentation about gRPC service configuration for Envoy integration with the PDP in the available sources. The PDP documentation shows it runs on port 7000 by default (1) , and the configuration documentation mentions port 7001 is used for the Horizon service (PDP's internal Python service bridge) (2) . However, there's no explicit information about gRPC service support or which port to use for 
grpc_service: google_grpc
configuration. To help our engineers investigate your specific setup: 1. Which Workspace / Project / Env are you using? 2. Can you share your complete EnvoyFilter configuration? 3. Which PDP version are you running? 4. Can you share the PDP logs when Envoy attempts to connect? You might want to reach out over Email for detailed guidance on Envoy gRPC integration, as this specific configuration isn't covered in the current documentation.
To learn more, see the sources I considered: [[1] Permit's PDP (Policy Decision Point)](https://docs.permit.io/concepts/pdp/overview) [[2] Configurations](https://docs.permit.io/concepts/pdp/configuration)
o
The PDP API doesn’t support GRPC at the moment (Only REST) We recommend you stick to the restful API
e
OK, so you have maybe a reference how to configure envoyfilter base on that ?
a
Hey @Ester Hatchuel, Looping in the team and will circle back to you shortly.
o
Hey @Ester Hatchuel, I’m currently working on a guide on how to make Envoy work with our PDP, will let you know once I have a setup ready for you to check out 🙂
e
thanks 🙏
o
Hey @Ester Hatchuel, Attached here is a demo demonstrating a setup that uses Envoy Filter <> OPA integration to enable URL based authorization. This demo utilizes Permit URL Mapping feature to enable this, converting HTTP Requests to Permit resources. We are planning to release the code, demo and setup for this soon. Will make sure to update you once it is released 🙂 CC: @Alon Boshi
Screen Recording 2025-11-30 at 19.56.26.mov
Open in Slack
PreviousNext
Powered by