Skip to main content

New Edge PDP Configuration

Environment variable reference for the New Edge PDP (permitio/pdp-v3).

Beta — expect changes

The New Edge PDP is in early access and this configuration surface is not yet stable. Variables and defaults on this page may be renamed, replaced, or removed before general availability.

Treat it as a working reference rather than a contract: pin an image tag, and re-read this page when you upgrade. If you are depending on a specific variable, tell us so we can flag it before it moves.

For the container PDP (permitio/pdp-v2), see Configurations instead. The two runtimes do not share a configuration surface, and a variable of the same name may mean something different on each.

Credentials​

VariableDefaultDescription
PDP_API_KEYrequiredYour environment-level Permit API key.

PDP_API_KEY is the entire credential. This single value:

  • binds the container to exactly one Permit environment,
  • authenticates it to the control plane,
  • carries the control-plane routing, so the PDP finds the right plane on its own,
  • and is the bearer token the authorization API accepts from your services.
No control-plane URL to set

Unlike the container PDP, there is no PDP_CONTROL_PLANE value to configure. The API key routes the PDP to the correct control plane automatically.

Storage and ports​

VariableDefaultDescription
EDGE_DB_PATH/var/lib/edge-pdp/dbEmbedded database directory. Must be on a persistent volume.
EDGE_DATA_DIR/var/lib/edge-pdpEvent store and generated credentials. Must be on a persistent volume.
EDGE_PUBLIC_PORT7000Authorization API — the only port your services need.
EDGE_HEALTH_PORT7001Health and readiness. Probe this port, never 7000.

Both storage paths must be on persistent storage that survives restarts. On ephemeral storage every restart becomes a full cold start. See Deployment requirements.

Ports 7002, 7003, 8181, 4222, and 8222 are used internally and bind to loopback only — see Architecture. Expose 7000 and 7001 and nothing else.

Behavior and tuning​

VariableDefaultDescription
RUST_LOGinfoLog level. Try info,edge_pdp=debug when debugging.
PDP_DEBUGfalseInclude debug detail in authorization responses.
OPA_TIMEOUT_MS800Per-request policy evaluation timeout.
EDGE_PARALLELISM4How many change transactions are applied concurrently.
EDGE_DECISION_LOG_OPT_OUTfalseSet to true to stop shipping decision logs.
EDGE_DRAIN_TIMEOUT_SECS10Shutdown drain budget.
EDGE_CHILD_TERMINATION_TIMEOUT_SECS30Child-process shutdown budget.

Your terminationGracePeriodSeconds must be at least the sum of the last two — 40 seconds at defaults. See Deployment requirements.

Child process logging​

VariableDefaultDescription
EDGE_NATS_LOG_LEVELfollows RUST_LOGControl-plane client log level.
EDGE_OPA_LOG_LEVELfollows RUST_LOGPolicy engine log level.
Debug levels expose your data

EDGE_NATS_LOG_LEVEL=trace logs raw message payloads — which means your authorization data — and EDGE_OPA_LOG_LEVEL=debug logs authorization request and response bodies. Use these only for short, deliberate debugging sessions, and never leave them on in production.

Storage engine​

The embedded database inherits storage-engine defaults tuned for cloud-scale workloads, not for a small container. These are the levers that matter for memory footprint:

VariableDefaultEffect
SURREAL_ROCKSDB_BLOCK_CACHE_SIZE536870912 (512 MiB)Read cache. The single largest lever on resident memory.
SURREAL_ROCKSDB_WRITE_BUFFER_SIZE268435456 (256 MiB)In-memory write buffer before flushing to disk.
SURREAL_ROCKSDB_MAX_WRITE_BUFFER_NUMBER32How many write buffers may exist at once.
SURREAL_ROCKSDB_BACKGROUND_THREADS4Background compaction threads.

At these defaults a container given only a few hundred MiB will be OOM-killed on startup. Start at 4 GiB and tune down against your own data set. See Resource footprint.

Contents