Action Required

The globalAccountId field in the CAPApplication spec is deprecated and will be removed in a future release. Update your CAPApplication resources to use providerSubaccountId instead.

Helm Values

All values supported by the latest CAP Operator Helm chart

Tags:

Setup

6 minute read

image:
  # -- Default image tag (can be overwritten on component level)
  tag: ""
  # -- Default image pull policy (can be overwritten on component level)
  pullPolicy: ""
# -- Default image pull secrets (can be overwritten on component level)
imagePullSecrets: []
# -- Default pod security content (can be overwritten on component level)
podSecurityContext: {}
# -- Default node selector (can be overwritten on component level)
nodeSelector: {}
# -- Default affinity settings (can be overwritten on component level)
affinity: {}
# -- Default tolerations (can be overwritten on component level)
tolerations: []
# -- Default priority class (can be overwritten on component level)
priorityClassName: ""
# -- Default topology spread constraints (can be overwritten on component level)
topologySpreadConstraints: []
# -- Additional pod labels for all components
podLabels: {}
# -- Additional pod annotations for all components
podAnnotations: {}
# -- Monitoring configuration for all components
monitoring:
  # -- Optionally enable Prometheus monitoring for all components (disabled by default)
  enabled: false
  # -- Prometheus service monitor selector labels
  serviceMonitorSelectorLabels: {}
  # -- Grafana configuration
  grafana:
    dashboard:
      # -- Labels for selecting ConfigMaps with dashboards in Grafana
      configMapLabels:
        grafana_dashboard: "1"

controller:
  # -- Replicas
  replicas: 1
  image:
    # -- Image repository
    repository: ghcr.io/sap/cap-operator/controller
    # -- Image tag
    tag: ""
    # -- Image pull policy
    pullPolicy: ""
  # -- Image pull secrets
  imagePullSecrets: []
  # -- Additional labels for controller pods
  podLabels: {}
  # -- Additional annotations for controller pods
  podAnnotations: {}
  # -- Pod security content
  podSecurityContext: {}
  # -- Node selector
  nodeSelector: {}
  # -- Affinity settings
  affinity: {}
  # -- Tolerations
  tolerations: []
  # -- Priority class
  priorityClassName: ""
  # -- Topology spread constraints
  topologySpreadConstraints: []
  # -- Security context
  securityContext: {}
  resources:
    limits:
      # -- Memory limit
      memory: 500Mi
      # -- CPU limit
      cpu: 0.2
    requests:
      # -- Memory request
      memory: 50Mi
      # -- CPU request
      cpu: 0.02
  # -- Optionally specify list of additional volumes for the controller pod(s)
  volumes: []
  # -- Optionally specify list of additional volumeMounts for the controller container(s)
  volumeMounts: []
  # -- The dns target mentioned on the public ingress gateway service used in the cluster
  dnsTarget: ""
  # -- Optionally enable detailed opertational metrics for the controller by setting this to true
  detailedOperationalMetrics: false
  maxConcurrentReconciles:
    # -- The maximum number of concurrent reconciles (e.g. "1") for the cap application
    capApplication: ""
    # -- The maximum number of concurrent reconciles (e.g. "3") for the cap application version
    capApplicationVersion: ""
    # -- The maximum number of concurrent reconciles (e.g. "10") for the cap tenant
    capTenant: ""
    # -- The maximum number of concurrent reconciles (e.g. "10") for the cap tenant operation
    capTenantOperation: ""
    # -- The maximum number of concurrent reconciles (e.g. "1") for the domain
    domain: ""
    # -- The maximum number of concurrent reconciles (e.g. "1") for the cluster domain
    clusterDomain: ""
  versionMonitoring:
    # -- The URL of the Prometheus server from which metrics related to managed application versions can be queried
    prometheusAddress: ""
    # -- The duration (example 2h) after which versions are evaluated for deletion; based on specified workload metrics
    metricsEvaluationInterval: "1h"
    # -- The duration (example 10m) to wait before retrying to acquire Prometheus client and verify connection, after a failed attempt
    promClientAcquireRetryDelay: "1h"
  clientRateLimiting:
    # -- The maximum queries per second from the controller client to the kubernetes API server (e.g. "20")
    qps: ""
    # -- The maximum burst for throttle (e.g. "30")
    burst: ""
  # -- The delay (example 1h) to wait before rolling out version workloads on credential update
  rolloutDelay: ""

subscriptionServer:
  # -- Replicas
  replicas: 1
  image:
    # -- Image repository
    repository: ghcr.io/sap/cap-operator/server
    # -- Image tag
    tag: ""
    # -- Image pull policy
    pullPolicy: ""
  # -- Image pull secrets
  imagePullSecrets: []
  # -- Additional labels for subscription server pods
  podLabels: {}
  # -- Additional annotations for subscription server pods
  podAnnotations: {}
  # -- Pod security content
  podSecurityContext: {}
  # -- Node selector
  nodeSelector: {}
  # -- Affinity settings
  affinity: {}
  # -- Tolerations
  tolerations: []
  # -- Priority class
  priorityClassName: ""
  # -- Topology spread constraints
  topologySpreadConstraints: []
  # -- Security context
  securityContext: {}
  resources:
    limits:
      # -- Memory limit
      memory: 200Mi
      # -- CPU limit
      cpu: 0.1
    requests:
      # -- Memory request
      memory: 20Mi
      # -- CPU request
      cpu: 0.01
  # -- Optionally specify list of additional volumes for the server pod(s)
  volumes: []
  # -- Optionally specify list of additional volumeMounts for the server container(s)
  volumeMounts: []
  # -- Service port
  port: 4000
  # -- The namespace in the cluster where istio system components are installed
  istioSystemNamespace: istio-system
  # -- Labels used to identify the istio ingress-gateway component
  ingressGatewayLabels:
    istio: ingressgateway
    app: istio-ingressgateway
  # -- The dns target mentioned on the public ingress gateway service used in the cluster
  dnsTarget: public-ingress.clusters.cs.services.sap # replace with the actual cluster domain
  # -- The domain under which the cap operator subscription server would be available
  domain: cap-operator.clusters.cs.services.sap # replace with actual cluster domain
  # -- Certificate manager which can be either `Gardener` or `CertManager`
  certificateManager: Gardener
  # -- Certificate configuration
  # @default -- the `additionalCACertificate` part will contain the "SAP Cloud Root CA" certificate by default
  certificateConfig:
    # -- Optionally specify the corresponding certificate configuration
    gardener:
      # -- Issuer name
      issuerName: ""
      # -- Issuer namespace
      issuerNamespace: ""
    # -- Cert Manager configuration
    certManager:
      # -- Issuer group
      issuerGroup: ""
      # -- Issuer kind
      issuerKind: ""
      # -- Issuer name
      issuerName: ""
      # -- Optionally specify the common name (at most 64 characters). Not needed in most scenarios.
      commonName: ""
    # -- Optionally specify additional CA Certificate
    # @default -- this will contain the "SAP Cloud Root CA" certificate by default
    additionalCACertificate: |
      -----BEGIN CERTIFICATE-----
      MIIFZjCCA06gAwIBAgIQGHcPvmUGa79M6pM42bGFYjANBgkqhkiG9w0BAQsFADBN
      MQswCQYDVQQGEwJERTERMA8GA1UEBwwIV2FsbGRvcmYxDzANBgNVBAoMBlNBUCBT
      RTEaMBgGA1UEAwwRU0FQIENsb3VkIFJvb3QgQ0EwHhcNMTkwMjEzMTExOTM2WhcN
      MzkwMjEzMTEyNjMyWjBNMQswCQYDVQQGEwJERTERMA8GA1UEBwwIV2FsbGRvcmYx
      DzANBgNVBAoMBlNBUCBTRTEaMBgGA1UEAwwRU0FQIENsb3VkIFJvb3QgQ0EwggIi
      MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQChbHLXJoe/zFag6fB3IcN3d3HT
      Y14nSkEZIuUzYs7B96GFxQi0T/2s971JFiLfB4KaCG+UcG3dLXf1H/wewq8ahArh
      FTsu4UR71ePUQiYlk/G68EFSy2zWYAJliXJS5k0DFMIWHD1lbSjCF3gPVJSUKf+v
      HmWD5e9vcuiPBlSCaEnSeimYRhg0ITmi3RJ4Wu7H0Xp7tDd5z4HUKuyi9XRinfvG
      kPALiBaX01QRC51cixmo0rhVe7qsNh7WDnLNBZeA0kkxNhLKDl8J6fQHKDdDEzmZ
      KhK5KxL5p5YIZWZ8eEdNRoYRMXR0PxmHvRanzRvSVlXSbfqxaKlORfJJ1ah1bRNt
      o0ngAQchTghsrRuf3Qh/2Kn29IuBy4bjKR9CdNLxGrClvX/q26rUUlz6A3lbXbwJ
      EHSRnendRfEiia+xfZD+NG2oZW0IdTXSqkCbnBnign+uxGH5ECjuLEtvtUx6i9Ae
      xAvK2FqIuud+AchqiZBKzmQAhUjKUoACzNP2Bx2zgJOeB0BqGvf6aldG0n2hYxJF
      8Xssc8TBlwvAqtiubP/UxJJPs+IHqU+zjm7KdP6dM2sbE+J9O3n8DzOP0SDyEmWU
      UCwnmoPOQlq1z6fH9ghcp9bDdbh6adXM8I+SUYUcfvupOzBU7rWHxDCXld/24tpI
      FA7FRzHwKXqMSjwtBQIDAQABo0IwQDAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/
      BAUwAwEB/zAdBgNVHQ4EFgQUHLxmKw7KjUufjZNxqQ/KZ0ZpEyIwDQYJKoZIhvcN
      AQELBQADggIBABdSKQsh3EfVoqplSIx6X43y2Pp+kHZLtEsRWMzgO5LhYy2/Fvel
      eRBw/XEiB5iKuEGhxHz/Gqe0gZixw3SsHB1Q464EbGT4tPQ2UiMhiiDho9hVe6tX
      qX1FhrhycAD1xHIxMxQP/buX9s9arFZauZrpw/Jj4tGp7aEj4hypWpO9tzjdBthy
      5vXSviU8L2HyiQpVND/Rp+dNJmVYTiFLuULRY28QbikgFO2xp9s4RNkDBnbDeTrT
      CKWcVsmlZLPJJQZm0n2p8CvoeAsKzIULT9YSbEEBwmeqRlmbUaoT/rUGoobSFcrP
      jrBg66y5hA2w7S3tDH0GjMpRu16b2u0hYQocUDuMlyhrkhsO+Qtqkz1ubwHCJ8PA
      RJw6zYl9VeBtgI5F69AEJdkAgYfvPw5DJipgVuQDSv7ezi6ZcI75939ENGjSyLVy
      4SuP99G7DuItG008T8AYFUHAM2h/yskVyvoZ8+gZx54TC9aY9gPIKyX++4bHv5BC
      qbEdU46N05R+AIBW2KvWozQkjhSQCbzcp6DHXLoZINI6y0WOImzXrvLUSIm4CBaj
      6MTXInIkmitdURnmpxTxLva5Kbng/u20u5ylIQKqpcD8HWX97lLVbmbnPkbpKxo+
      LvHPhNDM3rMsLu06agF4JTbO8ANYtWQTx0PVrZKJu+8fcIaUp7MVBIVZ
      -----END CERTIFICATE-----

webhook:
  # -- Replicas
  replicas: 1
  image:
    # -- Image repository
    repository: ghcr.io/sap/cap-operator/web-hooks
    # -- Image tag
    tag: ""
    # -- Image pull policy
    pullPolicy: ""
  # -- Image pull secrets
  imagePullSecrets: []
  # -- Additional labels for validating webhook pods
  podLabels: {}
  # -- Additional annotations for validating webhook pods
  podAnnotations: {}
  # -- Pod security content
  podSecurityContext: {}
  # -- Node selector
  nodeSelector: {}
  # -- Affinity settings
  affinity: {}
  # -- Tolerations
  tolerations: []
  # -- Priority class
  priorityClassName: ""
  # -- Topology spread constraints
  topologySpreadConstraints: []
  # -- Security context
  securityContext: {}
  resources:
    limits:
      # -- Memory limit
      memory: 200Mi
      # -- CPU limit
      cpu: 0.1
    requests:
      # -- Memory request
      memory: 20Mi
      # -- CPU request
      cpu: 0.01
  # -- Service port
  service:
    # -- Service type
    type: ClusterIP
    # -- Service port
    port: 443
    # -- Target port
    targetPort: 1443
  # -- Optionally specify list of additional volumes for the webhook pod(s)
  volumes: []
  # -- Optionally specify list of additional volumeMounts for the webhook container(s)
  volumeMounts: []
  # -- Certificate manager which can be either `Default` or `CertManager`
  certificateManager: "Default"
  # -- Optionally specify the corresponding certificate configuration
  certificateConfig:
    certManager:
      # -- Issuer group
      issuerGroup: ""
      # -- Issuer kind
      issuerKind: ""
      # -- Issuer name
      issuerName: ""

Last modified July 24, 2026: Update publish-website.yaml (9777fa6)