SAS Viya deployment error downloading assets

[common-sasadmin]

Good morning:

I am trying to deploy SAS Viya 2024.09 LTS with SAS Deployment Operator but the deploment fails because it couldn't retrieve files. I didn't setup a mirror neither conigured anything related to mirrors/download endpoints. When reading SAS Help Center: Fields in the SASDeployment Custom Resource i decided to check the different download enpoints listed in SAS Help Center: Create a Mirror Registry, which are:

- ses.sas.download

- ses.sas.com

- crbwp.sas.com

- bwp2.ses.sas.download

- cr.sas.com

I checked them inside and outsideour firewall and some of them are down, specially ses.sas.download with even trying:

- curl (-k) https://ses.sas.download/ses/entitlements.json

Inspired by https://communities.sas.com/t5/SAS-Viya/viya4-deployment-on-onpremis-k8-using-github/m-p/926015

It fails.

curl log:

[tecasada@TDS88]/mnt/c/Users/rodrigo-gonzalez/Documents/Prod-SASV% curl https://ses.sas.download/ses/entitlements.json
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
[tecasada@TDS88]/mnt/c/Users/rodrigo-gonzalez/Documents/Prod-SASV% curl -k https://ses.sas.download/ses/entitlements.json
curl: (35) Recv failure: Connection reset by peer

Pod log:

Reason:
FailedToRetrieveImagePullSecret
Message:
Unable to retrieve some image pull secrets (sas-orchestration-secret); attempting to pull the image may not succeed.

[JuanS_OCS]

Hi @common-sasadmin ,

The connection to those repositories depend on a certificate that is included in the assets. Since you seem unable to download the assets, those connection failures are expected to happen.

To be able to download the assets, you either do it manually, or with the SAS Viya Orders CLI, which depends on having a token from the SAS Viya Orders API (look it up in the SAS Viya Operations Guide and in developer.sas.com).

I cannot say what is wrong with the SAS Viya Deployment Operator without seeing previous messages in your (multiple) logs, unfortunately. However I can tell you you have options in front of you:

- Of course move forward with ensuring the SAS Viya Deployment Operator works with the Orders CLI & API.

- If that looks complicated, look into manually downloading manually & upfront the assets and having them as input.

- When all fails, you can always change your deployment method. There are 3 more out there!

- And, of course, do rely on the help from SAS Technical Support.

[common-sasadmin]

In theory, when i did https://documentation.sas.com/doc/es/itopscdc/v_056/dplyml0phy0dkr/p0nid9gu3x2cvln1pzpcxa68tpom.htm I associated the license and the certificates (i checked and even i try to ommit them and the execution failed). In my certificates I have two certificates, ca-certificates and entitlement certificates.

Could you give me references regarding the first two options you listed?

[JuanS_OCS]

Okay, then perhaps the initial description was a bit misleading or incomplete.

You don't have issues with the download of deployment assets, as you already have them and passing them as input to your docker run command.

It could be your SAS Deployment Operator is not catching well the certificate chain for entitlements. Look into what and how you are passing it in the parameter --deployment-data.

You could verify this as well looking at the generated viya1-sasdeployment.yaml file.

[common-sasadmin]

Yes, it could be misleading because assets are also those files on the order web. I mean the assets needed for the kubernetes deployment.

On other side my viya1-sasdeployment.yaml is perfect. The only issue could appear is that I am trying to deploy on Openshift but already added the FLATTENED_REGISTRY. This is why i don't understand the error.

I attached an image as zip due to file limitations. The image is an screeshot of my argocd withthe status of a pods.

[common-sasadmin]

Also in the yaml the certificates are correctly written

[JuanS_OCS]

Mhm, I hear you.

Is there any chance that the sas-orchestration tool is outdated or not in the same version as the deployment assets?

You can check here how to validate that

https://communities.sas.com/t5/SAS-Communities-Library/Updating-The-SAS-Viya-Platform-Orchestration-... 

[common-sasadmin]

No, i am using the SAS Deployment operator. I tried because the docs say to use one and because of your previous message i tried the latest.

cr.sas.com/viya-4-x64_oci_linux_2-docker/sas-orchestration   latest                           0fe7b724d2fe   4 weeks ago    559MB
sas-orchestration                                            latest                           0fe7b724d2fe   4 weeks ago    559MB
cr.sas.com/viya-4-x64_oci_linux_2-docker/sas-orchestration   1.128.2-20241002.1727879835425   e820581c038a   2 months ago   552MB

both give the same error. Now i improve the ci pipeline and the error message changed. 

It says the user password are incorrect. I wolud say i have a valid license, maybe i should contact support because it is my license?

[JuanS_OCS]

Yes, something might have changed there. It would be a good idea to reach out to SAS Technical Support.