Installation

• 1: Prerequisites
• 2: Using Helm
• 2.1: Helm Values
• 3: Using CAP Operator Manager

1 - Prerequisites

We recommend that you use a “Gardener” managed cluster to deploy CAP applications that are managed with CAP Operator.

The Kubernetes cluster must be set up with the following prerequisites before you install CAP Operator:

Istio (version >= 1.22)

Istio service mesh is used for HTTP traffic management. CAP Operator creates Istio resources to manage incoming HTTP requests to the application as well as to route requests on specific (tenant) subdomains.

It’s required that you determine the public ingress Gateway subdomain and the overall shoot domain for the system and specify them in the chart values. See here for an example.

Note: Istio promoted many of its APIs to v1 in 1.22 release. Hence as of CAP Operator release v0.11.0 istio version >= 1.22 is a prerequisite.

sap-btp-service-operator or cf-service-operator

These operators can be used for managing SAP BTP service instances and service bindings from within the Kubernetes cluster.

If some SAP BTP services are not available for Kubernetes platforms, you may use cf-service-operator, which creates the services for a Cloud Foundry space and inserts the required access credentials as Secrets into the Kubernetes cluster.

Please note that service credentials added as Kubernetes Secrets to a namespace by these operators, support additional metadata. If you don’t use this feature of these operators, use secretKey: credentials in the spec of these operators to ensure that the service credentials retain any JSON data as it is. We recommend that you use secretKey, even when credential metadata is available to reduce the overhead of interpreting parsing multiple JSON attributes.

“Gardener” certificate management

This component is available in clusters managed by “Gardener” and will be used to manage TLS certificates and issuers. “Gardener” manages encryption, issuing, and signing of certificates. Alternatively, you can use cert-manager.io cert-manager.

2 - Using Helm

To install CAP operator components, we recommend using the Helm chart that is published as an OCI package at oci://ghcr.io/sap/cap-operator-lifecycle/helm/cap-operator.

Installation

Create a namespace and install the Helm chart in that namespace by specifying the domain and the dnsTarget for your subscription server, either

• As command line parameters:

  kubectl create namespace cap-operator-system
  helm upgrade -i -n cap-operator-system cap-operator oci://ghcr.io/sap/cap-operator-lifecycle/helm/cap-operator --set subscriptionServer.domain=cap-operator.<CLUSTER-DOMAIN> --set subscriptionServer.dnsTarget=public-ingress.<CLUSTER-DOMAIN>
  

• Or as a YAML file with the values:

  kubectl create namespace cap-operator-system
  helm upgrade -i -n cap-operator-system cap-operator oci://ghcr.io/sap/cap-operator-lifecycle/helm/cap-operator -f my-cap-operator-values.yaml
  

  In this example, the provided values file, my-cap-operator-values.yaml, can have the following content:

  subscriptionServer:
    dnsTarget: public-ingress.<CLUSTER-DOMAIN>
    domain: cap-operator.<CLUSTER-DOMAIN>   
  

Optional steps

• Enable Service Monitors for metrics emitted by controller and subscription server

  To enable Monitoring via metrics emitted by CAP Operator components, the following value can be specified:

  monitoring:
    enabled: true # <-- This enables creation of service monitors, for metrics emitted by the cap operator components
  

  Detailed operational metrics for the controller can be enabled with the following config:

  controller:
      detailedOperationalMetrics: true
  

• Setup Prometheus Integration for Version Monitoring

  To use the Version Monitoring feature of the CAP Operator, a Prometheus server URL can be provided to the CAP Operator. When installing the CAP Operator using the Helm chart, the following values can be specified in the values:

  controller:
    versionMonitoring:
      prometheusAddress: "http://prometheus-operated.monitoring.svc.cluster.local:9090" # <-- example of a Prometheus server running inside the same cluster
      promClientAcquireRetryDelay: "2h"
      metricsEvaluationInterval: "30m" # <-- duration after which version metrics are evaluated
  

  When the controller is started, the operator will try to connect to the Prometheus server and fetch runtime information to verify the connection. If the connection is not successful, it will be retried after the duration specified as controller.versionMonitoring.promClientAcquireRetryDelay. Check default values for these attributes here.

  Note

  • When connecting the controller to a Prometheus server running inside the cluster, please ensure that NetworkPolicies required for connecting to the service in the namespace where Prometheus is running are also created.
  • If the Prometheus service is configured to use TLS, the relevant CA root certificates which need to be trusted can be mounted as volumes to the controller.

2.1 - Helm Values

3 - Using CAP Operator Manager

To install the CAP Operator using CAP Operator Manager, please execute the following commands:

kubectl apply -f https://github.com/SAP/cap-operator-lifecycle/releases/latest/download/manager_manifest.yaml

The above command will create namespace cap-operator-system with CAP Operator Manager installed. Once the CAP Operator Manager pod is running, you can install the CAP operator by executing the following command:

kubectl apply -n cap-operator-system -f https://github.com/SAP/cap-operator-lifecycle/releases/latest/download/manager_default_CR.yaml

This would work only if the ingressGatewayLabels in your clusters matches the following values

ingressGatewayLabels:
  - name: istio
    value: ingressgateway
  - name: app
    value: istio-ingressgateway

If not, you will have to manually create the CAPOperator resource. For more details on the same, please refer to link.