Common Configuration Service problems and how to resolve them. For installer-side issues see Installer → Troubleshooting.

Cannot Sign in

Symptom: clicking Sign in loops back to the sign-in screen, or the identity provider shows an error.

Resolve:

  1. Wrong credentials. Try resetting your password through your identity provider, then retry.
  2. Account missing the required role. The Configuration Service requires the vam-admin role. Check that your account is assigned vam-admin (in Keycloak or via group mapping in your external OIDC).
  3. OIDC misconfiguration. If you recently changed the identity provider settings, recheck them in Platform → Authentication. The page validates the authority before applying, and an auth/cert change auto-reverts if you don't confirm it — so if you were just locked out, wait for the pending window to revert, or sign in from another device and Discard. In the worst case, contact support to reset OIDC via vamctl.
  4. Clock skew. OIDC tokens are time-sensitive. Confirm the cluster nodes' time is synchronised (NTP).
  5. Redirect URI mismatch. Confirm the redirect URI registered in your identity provider matches the Configuration Service's URL (https://<your-vam-host>/config) exactly — including https and no unexpected trailing slash.

Configuration Service Is Unreachable

Symptom: browsing to https://<your-vam-host>/config shows a connection error, certificate error, or 502 / 503.

Resolve:

  1. DNS / network. Confirm the hostname resolves and the IP is reachable from your client.
  2. TLS certificate expired. A browser certificate warning that wasn't there yesterday suggests an expired or replaced certificate. Use vamctl on the installer host to reissue.
  3. Service down. Run Health → Run Checks (or, if the UI is unreachable, use vamctl on the installer host). If multiple services are down, the cluster itself may be unhealthy — see the Cluster view or the installer's cluster-health view.
  4. Ingress down. If the cluster is healthy but the config service URL is unreachable, the ingress controller pod may have crashed. Contact support — restarting ingress is risky and support has tooling for it.

Package Install Fails

Symptom: installing a package reports an error part-way through.

Resolve:

  1. Expand the failed step to read the diagnosis. Most failures are configuration-related (a required field with an invalid value, credentials that don't work).
  2. Fix the configuration on the package's install form and retry.
  3. If the error mentions missing dependencies, install the dependent packages first.
  4. If the error mentions registry / image pull, the cluster cannot fetch the package's container images. Confirm the cluster has network access to the configured registry (registry settings are established at install time via vamctl).

Package Shows "Degraded" or "Failed"

Symptom: a package's status indicator is yellow or red on the Packages list.

Resolve:

  1. Click the package to open its detail view.
  2. Read the Overview status and the Diagnostics tab — they show the specific failing checks.
  3. Read the Logs tab (and the Pods tab) for relevant error messages.
  4. Common causes:
    • The package depends on another that is down.
    • The package's configuration references credentials that have rotated.
    • A backing store (database, object store) is unhealthy.

If you cannot diagnose from the package logs alone, run Health → Run Checks for a coordinated view.

"Configuration Save Failed: Schema Validation"

Symptom: editing a package's configuration and clicking save shows a validation error.

Resolve: the package's configuration schema rejected a value. The error message points to the specific field. Fix the value and retry. If the message is unclear, the package's documentation (visible on its detail view) explains valid values.

Backup to Network Mount / External S3 Fails

Symptom: a backup whose target is Network mount or External S3 fails (the Download target is local and rarely fails).

Resolve:

  • Network mount: confirm the SMB / NFS share is reachable from the cluster nodes (not just your workstation), the PV/PVC for the share exists (create it from the Backup screen if not) and the credentials have read+write. For SMB, the SMB CSI driver must be installed.
  • External S3: confirm the endpoint URL is reachable from the cluster, the bucket exists and the access key has s3:PutObject, s3:GetObject and s3:ListBucket on the bucket.
  • Use a backup's Verify action to confirm integrity of completed backups.

Storage License Shows Expired / Invalid

Symptom: Platform → Storage license reports the AiStor license is expired, invalid, or has the wrong feature set (enterprise features such as replication are gated on it).

Resolve:

  1. Contact Vizrt to request a renewed or corrected license.
  2. Open Platform → Storage license, paste the new license and save.
  3. Confirm the entitlement (for example, ENTERPRISE) in the section header.

Getting Support

When opening a support case, include:

  • The VAM version (Configuration Service footer).
  • A current Health → Run Checks result.
  • The installer log bundle from the installer host (if relevant).
  • A description of what you were doing when the issue occurred and what you've already tried.