SAS Viya4 on AWS - how to access cr.sas.com via a forward proxy with custom CA signed certificate

[EyalGonen]

Hi experts,

I need to deploy SAS Viya4 on AWS. The designated VPC does have access to the public Internet but only via a forward proxy which is accessed via HTTPS and its certificate is signed by a customer's CA. According to the customer the EKS nodes can access "cr.sas.com" to pull SAS docker images but they say that we need two things for this to work:

1. To make EKS (nodes? kubelet?) go through the forward proxy to reach "cr.sas.com".

2. Import the forward proxy's CA chain to EKS (to the nodes? kubelet?) otherwise TLS communication with the proxy will fail.

Anyone has experience doing something like this?

[gwootton]

I think you'd need to set the HTTPS_PROXY environment variable for the container daemon (docker/containerd)

I found this article that seems to describe the process:
https://repost.aws/knowledge-center/eks-http-proxy-containerd-automation

Another option would be to use mirror manager and pointing to an Elastic Container Registry instead of cr.sas.com.