https://linen.dev logo
Join Slack
Powered by
Hello, We're running the <Permit.io> PDP as a loc...
# permit-saas
m
Hello, We're running the Permit.io PDP as a local sidecar (permitio/pdp-v2:0.9.9) alongside our Go service and want to confirm that authorization decision logs are being synced to the Permit.io cloud dashboard. We'd like to understand what's required to ensure this works reliably and how to verify it's active. Our setup: - Go SDK: github.com/permitio/permit-golang v1.2.8 - PDP image: permitio/pdp-v2:0.9.9, running as a Docker sidecar on port 7000 (internal) - The SDK client is initialized with WithPdpUrl(...) pointing at the sidecar, and Check() calls are routed to it - PERMIT_IO_API_KEY is being to the PDP container - The PDP has outbound internet access to api.permit.io What we're asking: 1. With this setup, does the PDP automatically push decision logs to the Permit.io cloud, or does something need to be explicitly enabled? We see api_decision_logs_ingress.go in the SDK but we are not calling it ourselves — is that expected, or should the application be calling it directly? 2. Is there a specific PDP environment variable or anything else that we need to set to activate decision log shipping? 3. How can we verify that decision logs are actually reaching the cloud — is there a dashboard view, a health endpoint on the PDP that reports sync status, or a log message we should look for in the PDP container output? 4. Are there any known issues or caveats with decision log sync on PDP version 0.9.9 specifically? Thanks.
a
Hi @Mohit, I'm an AI assistant for Permit.io. I'll analyze available sources and get back to you shortly.
Based on your setup with the container PDP (permitio/pdp-v2:0.9.9) , here's what you need to know about decision log syncing: ​*1. Automatic Decision Log Shipping*​ The PDP automatically handles decision log uploads to Permit.io cloud by default. You don't need to call any SDK methods directly - the 
api_decision_logs_ingress.go
code you mentioned is internal SDK infrastructure, not something your application should invoke. (1) ​*2. Configuration Requirements*​ Decision logs are enabled by default. The key environment variables are: • 
PDP_OPA_DECISION_LOG_ENABLED
- defaults to 
True
, so logs are automatically uploaded • 
PDP_API_KEY
- must be set (which you have as 
PERMIT_IO_API_KEY
) Optional tuning parameters include: • 
PDP_OPA_DECISION_LOG_MIN_DELAY
- minimum time between uploads (default: 1 second) • 
PDP_OPA_DECISION_LOG_MAX_DELAY
- maximum backoff time (default: 10 seconds) • 
PDP_OPA_DECISION_LOG_UPLOAD_SIZE_LIMIT
- upload size limit in bytes (default: 65536) You can also enable console logging of decisions locally with 
PDP_OPA_DECISION_LOG_CONSOLE=True
​*3. Verification Methods*​ To verify decision logs are reaching the cloud: (2) • ​*Audit Logs UI*​: Decision logs from the container PDP appear in the Audit Logs UI in the same format as Cloud PDP logs • ​*PDP Container Logs*​: Look for log messages about decision log uploads in your PDP container output (1) • ​*Debug Mode*​: You can enable 
PDP_DEBUG=True
to inject additional debug attributes into decision logs for richer context ​*4. Known Considerations for v0.9.9*​ The documentation doesn't indicate specific issues with decision log sync on v0.9.9. However, if you encounter upload failures, the PDP performs exponential backoff between 
PDP_OPA_DECISION_LOG_MIN_DELAY
and 
PDP_OPA_DECISION_LOG_MAX_DELAY
until successful. ​*Troubleshooting Steps*​ If you're not seeing logs in the dashboard, please share with our engineers: 1. Which Workspace / Project / Env you are using 2. What calls you're performing (as SDK code or CURL) 3. Which PDP version you're running (you mentioned 0.9.9) 4. Relevant logs from your PDP container, especially any errors related to decision log ingress or uploads The PDP should automatically chunk uploads to stay within the size limit and handle retries with backoff.
To learn more, see the sources I considered: [[1] Configurations](https://docs.permit.io/concepts/pdp/configuration) [[2] Cloud PDP Capabilities](https://docs.permit.io/concepts/pdp/cloud-pdp-capabilities)
d
Hi Mohit — the Agent gave a nice response Small clarification - The PDP container authenticates using 
PDP_API_KEY
(an Environment-level API key), not 
PERMIT_IO_API_KEY
— that latter name is the SDK-side token convention and isn't read by the container. On your specific questions: 1. Yes, shipping is automatic — the PDP uploads OPA decision logs to the cloud on its own. 
api_decision_logs_ingress.go
is generated SDK client code and is not part of the runtime path; your app shouldn't call it. 2. Nothing extra to enable — 
PDP_OPA_DECISION_LOG_ENABLED
defaults to 
True
. Just the correct 
PDP_API_KEY
. 3. Verify in Audit Logs in the dashboard. To watch it live from the container, set 
PDP_OPA_DECISION_LOG_CONSOLE=True
and look for upload log lines; 
/health
reports sync/connection status. 4. No decision-log issue specific to 0.9.9, but you're a few patches behind — worth pulling latest if the problem persists.
👍 1
m
Thanks, David. Much appreciated. I'll reach out if I have further questions.
2 Views
Open in Slack
PreviousNext
Powered by