Quickstart: Kubernetes deployment

This guide walks you through deploying the Access Decision Service (ADS) on Kubernetes (K8s) using Helm in under 10 minutes. It covers the minimal steps to get ADS running. For production configuration options, see the full Kubernetes deployment guide.

Prerequisites

• kubectl installed and configured to communicate with your cluster. See the kubectl documentationOpens in a new tab.
• Helm installed. See the Helm documentationOpens in a new tab.
• AWS CLI configured with the Access key ID and Secret access key provided by Axiomatics (required to pull the ADS image from the Axiomatics ECR).
• License file: axiomatics_ADS.license, provided by Axiomatics.
• Authorization domain file: a domain.yaml file or a URL pointing to a remote domain.
• The ADS Kubernetes distribution .zip file, extracted to a local directory. See Prepare your environment.

Steps

1. Add the Helm repository

Navigate to the kubernetes/charts directory inside the extracted ADS distribution:

cd kubernetes/charts

Copy your license file into this directory:

cp /path/to/axiomatics_ADS.license .

2. Create the image pull secret

ADS pulls its Docker image from the Axiomatics Amazon ECR (Elastic Container Registry). Authenticate and create the pull secret so Kubernetes can access the registry:

aws ecr get-login-password --region <region> | \
  docker login --username AWS --password-stdin \
  <aws_account_id>.dkr.ecr.<region>.amazonaws.com

kubectl create secret docker-registry regcred \
  --docker-server=<aws_account_id>.dkr.ecr.<region>.amazonaws.com \
  --docker-username=AWS \
  --docker-password=$(aws ecr get-login-password)

3. Install the Helm chart with a minimal values override

The following command deploys ADS using a local domain.yaml file. Replace <aws_account_id> and <region> with your AWS account ID and the target region:

helm install ads \
  -f ads/values.yaml \
  -f ads/values-fetch-domain-from-file.yaml \
  ads/ \
  --set licenseValue=$(cat axiomatics_ADS.license | base64 -w 0) \
  --set domainValue=$(cat domain.yaml | base64 -w 0) \
  --set image.repository=<aws_account_id>.dkr.ecr.<region>.amazonaws.com/axiomatics/ads \
  --set 'imagePullSecrets[0].name=regcred'

tip

The values.yaml and values-*.yaml files supplied in the chart are baseline configurations. Any value you pass with --set takes precedence over the same value in a file.

With this command, ADS is deployed with the following configuration:

Setting	Value
Mode	ads (core ADS service only)
Domain	Loaded from the domain.yaml you provided at install time
Container port	8888 (exposed via the chart's default service configuration)
Authentication	Enabled, using the credentials defined in values.yaml

To inspect or customise all available Helm values, open ads/values.yaml in the chart directory. For deployment.yaml configuration options, see Deployment configuration samples.

4. Verify the deployment is ready

Check that the ADS pod is running:

kubectl get pods

Watch the pod logs to confirm a successful startup:

kubectl logs <ads-pod-name>

Replace <ads-pod-name> with the name of the ADS pod from the kubectl get pods output.

5. Check the health endpoint

Forward the pod port to your local machine so you can reach the ADS API:

kubectl port-forward <ads-pod-name> 8081:8888

Then send a health check request:

curl http://localhost:8081/health

note

The ADS container listens on service.appPort, which defaults to 8888 in the Helm chart. The local port (8081 above) can be any available port on your machine. Update the curl command to match if you use a different one.

ADS returns HTTP 200 OK with a JSON body when it is healthy:

{
  "status": "UP",
  "components": {
    "liveness": { "status": "UP" },
    "readiness": { "status": "UP" },
    "ping": { "status": "UP" }
  }
}

Next steps

• Full Kubernetes deployment guide
• Kubernetes TLS setup
• Deployment configuration samples: basic and extended deployment.yaml templates