Creating model publishing destinations using the SAS Viya CLI

3 Likes

One of the updates with Stable 2022.1.2 was the ability to use the SAS Viya CLI to create model publishing destinations. While a publishing destination can be created using SAS Environment Manager, the credentials domain that is required for some destinations could not.

Prior to Stable 2022.1.2 you had to use the Viya REST API to create a base64 Credentials Domain. The ‘base64’ Credentials Domain is required when publishing a model to a Docker Registry (either a Private Docker destination or one of the Cloud Provider destinations).

I recently tested creating publishing destinations with SAS Viya Stable 2022.1.4 and version 1.20.0 of the SAS Viya CLI.

In this post we will look at this new functionality.

As I stated in the introduction, previously you had to use the Viya REST API to create the credentials domain. Once that has been created you could use either the Viya REST API or the Environment Manager to create the publishing destinations. This is required to publish models or decision flows to a registry, to create the SAS Container Runtime (SCR) docker container image.

In GitHub there is sample code to create the credentials domain and publishing destination. But you are working directly with the Viya REST APIs so it can be a little complicated and definitely harder than using a standard command-line interface (CLI).

See GitHub project: Configuring Publishing Destinations

The first thing to state is you should always be using the latest version of the Viya CLI to get the update for creating the publishing destinations. You can download the SAS Viya CLI directly from the SAS Support website. The download file is available here: Downloads: SAS Viya CLI.

For this support you need the CLI version 1.19.5 or higher. At the time of posting this, version 1.20.0 was available. For general information on using the CLI, see the SAS Viya Administration manual, SAS Viya: Using the Command-Line Interface.

What do you need to know?

Before I get into the details of using the CLI, here are some things to note:

You can’t separately create a credentials domain with the Viya CLI, it is created as part of creating the publishing destination.
This includes setting the user or group information for the domain.
The secrets stored in a base64 credentials domain must be base64 encoded.
While a credentials domain is created as part of creating a publishing destination, the domain can be shared with multiple publishing destination.
The description fields must be quoted.

The Viya CLI is self-documenting, for example to get help on creating a publishing destination:

./sas-viya models destination --help

This gives the following output.

Figure 1. Viya CLI help

Select any image to see a larger version.
Mobile users: To view the images, select the "Full" version at the bottom of the page.

To get the help for creating an Azure publishing destination, you would use the following:

./sas-viya models destination createAzure --help

Creating Publishing Destinations using the CLI

Here is an example of creating an Azure publishing destination (in my Viya environment). When I use the CLI, I use the Viya namespace name as the profile name.

./sas-viya --profile ${NS} models destination createAzure \ 
--name "testACR" \ 
--description "Test ACR" \ 
--baseRepoURL ${ACR_SERVER} \ 
--subscriptionId ${SUBSCRIPTION} \ 
--tenantId ${TENANT} \ 
--region ${REGION} \ 
--kubernetesCluster ${AKS_NAME} \ 
--resourceGroupName ${RG} \ 
--credDomainID "ACRCredDomain" \ 
--credDescription "Azure ACR credentials" \ 
--clientId ${APP_CLIENT_ID} \ 
--clientSecret ${APP_CLIENT_SECRET} \ 
--identityType user \ 
--identityId sasadm

If we look at this in more detail, the image below highlights the parameters that relate to the credentials domain definition, see lines 10 - 15.

For Azure the ‘clientId’ and ‘clientSecret’ is for the Azure App Registration. This is used to authenticate to the Azure Container Registry (ACR). They are stored as part of the base64 credentials domain, as such, the values used must be base64 encoded.

For this I used the following commands to set the variables being used:

export APP_CLIENT_ID=$(echo "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" | base64)

export APP_CLIENT_SECRET=$(echo "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" | base64)

The command output confirms that the publishing destination has been successfully created. For example, running the command above produced the following output:

ID                                     Name      Destination Type   Description
4372408b-4a01-42a8-99dd-f8848f3285ed   testACR   azure              Test ACR

Once the credentials domain has been created it can be use by other publishing destination definitions. When referring to an existing credentials domain (this could be created via the REST API or using the Viya CLI) you just need to specify the “--credDomainID”, lines 11 to 15 are not required.

For example, creating an Azure publishing destination call 'myACR' using the 'ACRCredDomain' credentials domain.

./sas-viya --profile ${NS} models destination createAzure \
--name "myACR" \
--description "Azure publishing destination for Mike" \
--baseRepoURL ${ACR_SERVER} \
--subscriptionId ${SUBSCRIPTION} \
--tenantId ${TENANT} \
--region ${REGION} \
--kubernetesCluster ${AKS_NAME} \
--resourceGroupName ${RG} \
--credDomainID "ACRCredDomain"

Once the publishing destination has been created you can use the ‘list’ command to confirm the available destinations. For example:

./sas-viya --profile ${NS} models destination list

You can also get the details of the publishing destination using the ‘models destination show’ command. For example, in this case:

./sas-viya --profile ${NS} models destination show -n testACR

When using this command (models destination show) there is a known issue that the ‘models’ plugin assumes a destination type of CAS. This is planned to be fixed, but currently no fix date is available. Therefore, the best approach is still to use Environment Manager to view the details for a publishing destination. This is shown in the following image.

Conclusion

I like this update, as you no longer have to work directly with the Viya REST API. Using the SAS Viya CLI is a much better approach and hides the complexity of working with the REST API.

Finally, as can be seen from Figure 1, it is also possible to update and delete the publishing destinations using the CLI.

I hope this is useful and thanks for reading.