Skip to main content

Runtime Flow

When the edge authorizer has been bootstrapped it will transition to the runtime flow:

In this state, it will spin up two timer-based background tasks: The first is the discovery updates flow, which executes the discovery request described above to retrieve configuration updates. These updates include updates of the policy in case of a new version as well as configuration changes for the plugins, concretely the edge directory plugin. When a new policy version is available, the policy will be downloaded and applied to the authorizer.

A second time-based background task will synchronize the identity data from the central directory to the edge authorizer when the edge directory plugin is enabled. By default, directory synchronization is turned off and can be enabled in the Aserto console.

Runtime configuration

The runtime configuration is automatically retrieved from the control plane and is not persisted. The example below shows the resolved runtime configuration of the edge authorizer.

Example configuration of an authorizer that uses a policy image from the Aserto registry service:

---
tenant_id: <TENANT-ID>
policy_name: <POLICY-NAME>
instance_label: <INSTANCE-LABEL>

authorizer:
logging:
prod: true
log_level: info

directory_service:
path: /app/db/directory.db

api:
grpc:
connection_timeout_seconds: 2
listen_address: '0.0.0.0:8282'
certs:
tls_key_path: '/app/certs/grpc.key'
tls_cert_path: '/app/certs/grpc.crt'
tls_ca_cert_path: '/app/certs/grpc-ca.crt'
gateway:
listen_address: '0.0.0.0:8383'
allowed_origins:
- https://*.mydomain.com
certs:
tls_key_path: '/app/certs/gateway.key'
tls_cert_path: '/app/certs/gateway.crt'
tls_ca_cert_path: '/app/certs/gateway-ca.crt'
health:
listen_address: '0.0.0.0:8484'

opa:
discovery:
bundles:
'<POLICY_NAME>.<INSTANCE_LABEL>.<DIGEST>':
persist: false
polling:
max_delay_seconds: 120
min_delay_seconds: 60
resource: 'https://registry.prod.aserto.com/v2/<TENANT_NAME>/<REPO_NAME>:<LABEL>'
service: <CONNECTION_ID>-<TENANT_NAME>
signing: null,
size_limit_bytes: 0
plugins:
aserto_edge:
addr: authorizer.prod.aserto.com:8443
apikey: '<REDACTED directory API key>'
enabled: false
insecure: false
page_size: 100
sync_interval: 60
timeout: 10
services:
<CONNECTION_ID>-<TENANT_NAME>:
credentials:
bearer:
token: '<REDACTED> registry download API key'
response_header_timeout_seconds: 60
url: "https://registry.prod.aserto.com/v2/"

decision_logger:
enabled: false