You require the following prerequisites for creating the Authorization images:

• Podman on the build machine (if Linux version is greater than or equal to 8).
• Docker on the build machine (if Linux version is lesser than 8).
• Authorization Builder Toolkit. For the toolkit, see "Unified Inventory and Topology Toolkit".
• Install Maven and update the path variable with Maven Home as follows:

  set PATH variable export PATH=$PATH:$MAVEN_HOME/bin

• Install Java with JAVA_HOME set in the environment as follows:

  Set PATH variable export PATH=$PATH:$JAVA_HOME/bin

• Bash, to enable the <tab> command.

The corresponding manifest file describes the input that goes into the Authorization images. The default configuration in the latest manifest file provides the necessary components for creating the Authorization images. See "About the Manifest File" for more information.

The Authorization image builder creates images with names and tags based on the settings in the manifest file. By default, this results in the following images:

• authorization-base-1.0.0.0.0:latest
• authorization-schema-1.0.0.0.0:latest
• authorization-1.0.0.0.0:latest

Build container images for the following using the Authorization cloud native image builder:

• Authorization application
• Authorization schema installer

See "Deployment Toolkits" to download the Common cloud native toolkit archive file. Set the variable for the installation directory by running the following command, where $WORKSPACEDIR is the installation directory of the COMMON cloud native toolkit:

export COMMON_CNTK=$WORKSPACEDIR/common-cntk

The Authorization service relies on access to certain environment variables to run seamlessly. Ensure the following variables are set in your environment:

• Path to your common cloud native toolkit
• Traefik namespace

To set the environment variables:

1. Set the COMMON_CNTK variable to the path of directory where the Common cloud native toolkit is extracted as follows:

   $ export COMMON_CNTK=$WORKSPACEDIR/common-cntk

2. Set SPEC_PATH variable to the location where application and database YAML files are copied. See "Assembling the Specifications" to copy specification files if not already copied.

   $ export SPEC_PATH=$WORKSPACEDIR/spec_dir

   For example:

   $ mkdir -p $SPEC_PATH/$PROJECT/$INSTANCE/common
   $ cp $COMMON_CNTK/samples/applications.yaml $SPEC_PATH/$PROJECT/$INSTANCE/applications.yaml
   
   $ cp $COMMON_CNTK/samples/database.yaml $SPEC_PATH/$PROJECT/$INSTANCE/database.yaml
   $ cp $COMMON_CNTK/samples/credentials/common-config.yaml $SPEC_PATH/$PROJECT/$INSTANCE/common/common-config.yaml

You must store sensitive data and credential information in the form of Kubernetes Secrets that the scripts and Helm charts in the toolkit consume. Managing secrets is out of the scope of the toolkit and must be implemented while adhering to your organization's corporate policies. Additionally, ATA service does not establish password policies.

To install the Authorization service schema:

1. Update values under authorization-schema in $SPEC_PATH/sr/quick/database.yaml file with values required for authorization schema creation.

   Note:

   • The YAML formatting is case-sensitive. Use a YAML editor to ensure that you do not make any syntax errors while editing. Follow the indentation guidelines for YAML.
   • Before changing the default values provided in the specification file, verify that they align with the values used during PDB creation. For example, the default tablespace name should match the value that you used while creating PDB.
2. Edit the database.yaml file and update the Authorization schema installer image to point to the location of your image as follows:

   authorization-schema:
     #imagePullPolicy: IfNotPresent
     schema:
       image:
         name: "authorization-schema-1.0.0.0.0"
         tag: latest
    
     db:
       defaultTablespace: SYSTEM
       tempTablespace: TEMP

3. If your environment requires a password to download the container images from your repository, create a Kubernetes secret with the Docker pull credentials. See "Kubernetes documentation" for details. Refer the secret name in the database.yaml. Provide the image pull secret and image pull policy details.

   authorization-schema:
     imagePullPolicy: IfNotPresent
   # The image pull access credentials for the "docker login" into Docker repository, as a Kubernetes secret.
   # Uncomment and set if required.
   #  imagePullSecret: ""

4. Run the following script to start the Authorization Schema installer, which instantiates a Kubernetes pod resource. The pod resource lives until the Schema installation operation completes.

       $COMMON_CNTK/scripts/install-database.sh -p <project-name> -i <instance-name> -f $SPEC_PATH/<project-name>/<instance-name>/database.yaml -a authorization -c 1
   
       <project-name> -> This value should match with the namespace in which you are running the helm install.
       <instance-name> -> This value should be matching with the instance that you specified while creating the secret.

   For Example:

   $COMMON_CNTK/scripts/install-database.sh -p sr -i quick -f $SPEC_PATH/sr/quick/database.yaml -a authorization -c 1

5. Check the console to see if the Schema installer is installed successfully.
6. If the installation has failed, run the following command to review the error message in the log:

   kubectl logs -n sr sr-quick-authorization-schema

7. Clear the failed pod by running the following command:

    helm uninstall sr-quick-authorization-schema -n sr

8. Run the install-database script again to install the Authorization schema installer.

To create an Authorization service instance in your environment using the scripts that are provided with the toolkit:

1. Run the following command to create an Authorization service instance:

   $COMMON_CNTK/scripts/create-applications.sh -p sr -i quick -f $SPEC_PATH/sr/quick/applications.yaml -a authorization

   The create-applications script uses the helm chart located in $COMMON_CNTK/charts/authorization-app to create and deploy an authorization service.

2. If the scripts fail, run the following command to review the error message in the log:

   kubectl logs -n sr sr-quick-authorization

3. Clear the failed pod by running the following command:

   helm uninstall sr-quick-authorization -n sr

4. Fix the issues, if any, and run the script again to deploy the Authorization service.