https://linen.dev logo
Join Slack
Powered by
Hi, I'm running on v0.9.9 and it works mostly okay...
# permit-saas
t
Hi, I'm running on v0.9.9 and it works mostly okay. Except I get these logs when permissions are being checked:
Copy code
nodeos-api-prod  | {"level":50,"time":"2026-05-08T03:54:21.406Z","label":"<http://Permit.io|Permit.io>","msg":"[502] Error in permit.check(68e64179-0082-4665-93a3-0cf9489a5780, read, default/direct_message_threads:*), err: {\"detail\":\"Failed to send request to OPA\"}"}
nodeos-api-prod  | {"level":50,"time":"2026-05-08T03:54:21.406Z","label":"<http://Permit.io|Permit.io>","msg":"[502] Error in permit.check(68e64179-0082-4665-93a3-0cf9489a5780, delete, default/direct_message_posts:*), err: {\"detail\":\"Failed to send request to OPA\"}"}
nodeos-api-prod  | {"level":50,"time":"2026-05-08T03:54:21.407Z","label":"<http://Permit.io|Permit.io>","msg":"[502] Error in permit.check(68e64179-0082-4665-93a3-0cf9489a5780, read, default/direct_message_posts:*), err: {\"detail\":\"Failed to send request to OPA\"}"}
nodeos-api-prod  | {"level":50,"time":"2026-05-08T03:54:21.407Z","label":"<http://Permit.io|Permit.io>","msg":"[502] Error in permit.check(68e64179-0082-4665-93a3-0cf9489a5780, update, default/direct_message_posts:*), err: {\"detail\":\"Failed to send request to OPA\"}"}
nodeos-api-prod  | {"level":50,"time":"2026-05-08T03:54:21.407Z","label":"<http://Permit.io|Permit.io>","msg":"[502] Error in permit.check(68e64179-0082-4665-93a3-0cf9489a5780, create, default/journals:*), err: {\"detail\":\"Failed to send request to OPA\"}"}
nodeos-api-prod  | {"level":50,"time":"2026-05-08T03:54:21.408Z","label":"<http://Permit.io|Permit.io>","msg":"[502] Error in permit.check(68e64179-0082-4665-93a3-0cf9489a5780, update, default/journals:*), err: {\"detail\":\"Failed to send request to OPA\"}"}
nodeos-api-prod  | {"level":50,"time":"2026-05-08T03:54:21.408Z","label":"<http://Permit.io|Permit.io>","msg":"[502] Error in permit.check(68e64179-0082-4665-93a3-0cf9489a5780, read, default/journals:*), err: {\"detail\":\"Failed to send request to OPA\"}"}
a
Hi @Tathagata Guha Ray, I'm an AI assistant for Permit.io. I'll analyze available sources and get back to you shortly.
The 502 errors with "Failed to send request to OPA" indicate that the PDP is unable to communicate with the OPA engine. This typically happens when OPA isn't running or isn't ready to accept requests. (1) Based on a similar issue documented, this can occur when the PDP tries to evaluate policies before OPA has fully started. The logs show connection errors like "ClientConnectorError" when the PDP attempts to reach OPA at localhost:8181. ​*To help investigate this issue, please provide:*​ 1. Which Workspace / Project / Env you are using 2. What calls are you performing (as SDK code or CURL) 3. Which PDP version you are running (you mentioned v0.9.9) 4. Relevant logs from your PDP container, particularly: • PDP startup logs • Any OPA-related errors • Health check status ​*Potential configuration to check:*​ The 
PDP_OPA_CLIENT_QUERY_TIMEOUT
setting controls the timeout for querying OPA. (2) In version 0.9.0 and above, the default is 
1
second, and 
0
means 0 seconds (not unlimited) . You might also want to verify the 
PDP_OPA_CLIENT_FAILURE_THRESHOLD
(default 
0.1
) and 
PDP_OPA_CLIENT_FAILURE_THRESHOLD_INTERVAL
(default 
60
seconds) settings, which determine when failed requests to OPA trigger a failure.
To learn more, see the sources I considered: [[1] Unable to push the policy data since OPA is not ready yet in sidecar pattern](https://github.com/permitio/PDP/issues/266) [[2] Configurations](https://docs.permit.io/concepts/pdp/configuration)
t
These logs are also present:
Copy code
nodeos-api-prod  | 2026-05-08 06:24:42 [warn] [nodeos-backend]: Permission check failed in batch fallback {"version":"1.0.0","permission":"journals:create","error":"Permit SDK got error: \n Request failed with status code 502 \n\n          and cannot connect to the PDP, please check your configuration and make sure the PDP is running at <http://permit-pdp:7000> and accepting requests. \n\n          Read more about setting up the PDP at <https://docs.permit.io>"}
nodeos-api-prod  | 2026-05-08 06:24:42 [warn] [nodeos-backend]: Permission check failed in batch fallback {"version":"1.0.0","permission":"journals:read","error":"Permit SDK got error: \n Request failed with status code 502 \n\n          and cannot connect to the PDP, please check your configuration and make sure the PDP is running at <http://permit-pdp:7000> and accepting requests. \n\n          Read more about setting up the PDP at <https://docs.permit.io>"}
nodeos-api-prod  | 2026-05-08 06:24:42 [warn] [nodeos-backend]: Permission check failed in batch fallback {"version":"1.0.0","permission":"journals:update","error":"Permit SDK got error: \n Request failed with status code 502 \n\n          and cannot connect to the PDP, please check your configuration and make sure the PDP is running at <http://permit-pdp:7000> and accepting requests. \n\n          Read more about setting up the PDP at <https://docs.permit.io>"}
o
often this would mean that the PDP doesn't have enough resources and is hanging on OPA. increase resource allocation for the container, turn on caching, and/or apply elasticity and load balance between several PDP instances @Ask Inkeep
a
Thanks for tagging me @Or Weis. I'll look through relevant sources and get back to you shortly.
The 502 errors indicating "Failed to send request to OPA" suggest the PDP is resource-constrained and OPA is becoming unresponsive under load. (1) ​*Immediate actions to resolve this:*​ ​*1. Increase PDP resources*​ (2) The PDP's system requirements recommend starting with: • CPU: ~200 mcores with an upper limit of at least ~1000 mcores to handle CPU spikes • Memory: ~512MB For your environment's data volume, you may need to scale memory vertically. A rough estimate is approximately 6KB per policy object (users, resource instances, tenants) . ​*2. Enable caching*​ (1) The PDP includes a configurable caching mechanism that significantly improves performance by reducing redundant policy evaluations. (3) Configure caching using these environment variables: • 
PDP_CACHE_STORE
- Set to 
memory
for single instance or 
redis
for distributed caching (1) • 
PDP_CACHE_TTL_SECONDS
- Configure the cache time-to-live ​*3. Scale horizontally*​ (2) Deploy multiple PDP instances behind a load balancer to distribute the authorization query load. (3) (2) For Kubernetes deployments, you can use the PDP Helm chart to create a deployment with multiple replicas. (2) ​*4. Optimize for production*​ Disable debug logging to enhance performance:
Copy code
--env PDP_DEBUG=False
​*To help investigate further, please provide:*​ 1. Which Workspace / Project / Env you are using 2. What calls are you performing (as SDK code or CURL) 3. Which PDP version you are running (you mentioned v0.9.9) 4. Relevant logs from your PDP container showing resource usage and OPA health status
To learn more, see the sources I considered: [[1] Configurations](https://docs.permit.io/concepts/pdp/configuration) [[2] Deploy Permit to Production](https://docs.permit.io/how-to/deploy/deploy-to-production) [[3] Permit's PDP (Policy Decision Point)](https://docs.permit.io/concepts/pdp/overview)
2 Views
Open in Slack
PreviousNext
Powered by