When: Before user access, as needed
As explained in SAS Viya – Access CAS from Outside the Viya Deployment [Blog], an HTTP ingress is configured to provide access to each CAS server from outside the Viya deployment using the CAS REST-API. But that's all it allows.
In order to enable SAS 9.4, SAS Viya 3.5, other SAS Viya deployments or open-source programming clients like Python SWAT to get binary access to the CAS server(s) in your SAS Viya deployment, you need to enable the binary service by adding a reference to a patchTransformers to your kustomization.yaml file, and the corresponding transformer to your site-config directory structure.
In order to enable Postman, Jupyter or other HTTP clients to get HTTP access to the CAS server(s) in your SAS Viya deployment, you need to enable the HTTP service in a similar way.
The resources below explain how to do both.
Resources: