Skip to content

Commit

Permalink
Update the user docs to the HP version (#915)
Browse files Browse the repository at this point in the history
* Update the user docs to the HP version

* Update links

* Minor fixes

* Formatting fix

* Apply review suggestions
  • Loading branch information
IwonaLanger authored Dec 10, 2024
1 parent 6cc9611 commit cb1ffe8
Show file tree
Hide file tree
Showing 13 changed files with 365 additions and 347 deletions.
6 changes: 4 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -44,9 +44,11 @@ In the [`user`](./docs/user) folder, you will find the following documents:
* [Working with Multiple Subaccounts](./docs//user/03-20-multitenancy.md)
* [Instance-Level Mapping](./docs/user/03-21-instance-level-mapping.md)
* [Namespace-Level Mapping](./docs/user/03-22-namespace-level-mapping.md)
* [Management of the Service Instances and Service Bindings Lifecycle](./docs//user/03-30-management-of-service-instances-and-bindings.md)
* [Service Binding Rotation](./docs//user/03-40-service-binding-rotation.md)
* [Create Service Instances and Service Bindings](./docs//user/03-30-create-instances-and-bindings.md)
* [Rotate Service Binding](./docs//user/03-40-service-binding-rotation.md)
* [Formats of Service Binding Secrets](./docs//user/03-50-formatting-service-binding-secret.md)
* [Pass Parameters](./docs/user/03-60-pass-parameters.md)
* [Delete Service Bindigs and Service Instances](./docs/user/03-70-delete-bindings-and-instances.md)
* [Resources](./docs/user/resources/README.md)
* [SAP BTP Operator Custom Resource](./docs/user/resources/02-10-sap-btp-operator-cr.md)
* [Service Instance Custom Resource](./docs/user/resources/02-20-service-instance-cr.md)
Expand Down
12 changes: 8 additions & 4 deletions docs/user/03-10-preconfigured-secret.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,37 +5,41 @@ When you create SAP BTP, Kyma runtime, all necessary resources for consuming SAP
## Credentials

When you create a Kyma instance in the SAP BTP cockpit, the following events happen in your subaccount:

1. An SAP Service Manager service instance with the `service-operator-access` plan is created.
2. An SAP Service Manager service binding with access credentials for the SAP BTP Operator is created.
3. The credentials from the service binding are passed on to the Kyma service instance in the creation process.
4. The `sap-btp-manager` Secret is created and managed in the `kyma-system` namespace.
5. The SAP BTP Operator module is installed by default together with:

* The `sap-btp-manager` Secret.
* The `sap-btp-service-operator` Secret with the access credentials for the SAP BTP service operator. You can view the credentials in the `kyma-system` namespace.
* The `sap-btp-operator-config` ConfigMap.

> [!TIP]
> [!TIP] <!--OS only-->
> In this scenario, the `sap-btp-service-operator` Secret is automatically generated when you create Kyma runtime. To create this Secret manually for a specific namespace, see [Create a Namespace-Based Secret](03-22-namespace-level-mapping.md#create-a-namespace-based-secret).
The `sap-btp-manager` Secret provides the following credentials:

* **clientid**
* **clientsecret**
* **cluster_id**
* **sm_url**
* **tokenurl**

> [!NOTE]
> If you modify or delete the `sap-btp-manager` Secret, it is modified back to its previous settings or regenerated within up to 24 hours.
When you add the SAP BTP Operator module to your cluster, the `sap-btp-manager` Secret generates the SAP BTP service operator's resources as shown in the following diagram:
<!-- for the HP doc this sentence is different: The SAP BTP Operator module is added by default to your cluster and the `sap-btp-manager` (...) -->

![module_credentials](../assets/module_credentials.drawio.svg)

The cluster ID represents a Kyma service instance created in a particular subaccount and allows for its identification. You can view the cluster ID in the SAP BTP cockpit:
* In the `sap-btp-manager` Secret
* In the `sap-btp-service-operator` Secret
* In the `sap-btp-operator-config` ConfigMap

> [!NOTE]
> If you modify or delete the `sap-btp-manager` Secret, it is modified back to its previous settings or regenerated within up to 24 hours.
## Cluster Access

By default, SAP BTP Operator has cluster-wide permissions. You cannot reconfigure the predefined settings.
Expand Down
102 changes: 7 additions & 95 deletions docs/user/03-20-multitenancy.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,9 @@ With the SAP BTP Operator module, you can create configurations for several suba

## Context

By default, a Kyma cluster is associated with one subaccount. Consequently, any service instance created within any namespace is provisioned in the associated subaccount. See [Preconfigured Credentials and Access](03-10-preconfigured-secret.md). However, SAP BTP Operator also supports configurations for several subaccounts in a single Kyma cluster.
To apply the multitenancy feature, choose the method that suits your needs and application architecture:
By default, a Kyma cluster is associated with one subaccount. Consequently, any service instance created within any namespace is provisioned in the associated subaccount. See [Preconfigured Credentials and Access](03-10-preconfigured-secret.md). However, with SAP BTP Operator, you can create configurations in a single Kyma cluster that are applied to several subaccounts.
To apply the multitenancy feature, choose the method that suits your needs and application architecture:

* [Namespace-level mapping](03-22-namespace-level-mapping.md): Connect namespaces to separate subaccounts by configuring dedicated credentials for each namespace.
* [Instance-level mapping](03-21-instance-level-mapping.md): Define a specific subaccount for each service instance, regardless of the namespace context.

Expand All @@ -14,103 +15,14 @@ Regardless of the method, you must create Secrets managed in the `kyma-system` n
### Secrets Precedence

SAP BTP Operator searches for the credentials in the following order:

1. Explicit Secret defined in a service instance
2. Managed namespace Secret assigned for a given namespace
3. Managed namespace default Secret

![Secrets precedence](../assets/secrets_precedence_4.drawio.svg)

## Namespace-Level Mapping

To connect a namespace to a specific subaccount, maintain access credentials to this subaccount in a Secret dedicated to the specific namespace. Define the `{NAMESPACE-NAME}-sap-btp-service-operator` Secret in the `kyma-system` namespace.

See the following examples:
* Default access credentials:

```yaml
apiVersion: v1
kind: Secret
metadata:
name: {NAMESPACE_NAME}-sap-btp-service-operator
namespace: kyma-system
type: Opaque
stringData:
clientid: {CLIENT_ID}
clientsecret: {CLIENT_SECRET}
sm_url: {SM_URL}
tokenurl: {AUTH_URL}
tokenurlsuffix: "/oauth/token"
```
* mTLS access credentials:
```yaml
apiVersion: v1
kind: Secret
metadata:
name: {NAMESPACE_NAME}-sap-btp-service-operator
namespace: kyma-system
type: Opaque
stringData:
clientid: {CLIENT_ID}
tls.crt: {TLS_CERTIFICATE}
tls.key: {TLS_KEY}
sm_url: {SM_URL}
tokenurl: {AUTH_URL}
tokenurlsuffix: "/oauth/token"
```
## Instance-Level Mapping
To deploy service instances belonging to different subaccounts within the same namespace, follow these steps:
1. Define a new Secret: Securely store access credentials for each subaccount in a separate Secret in the `kyma-system` namespace.

See the following examples:
* Default access credentials

```yaml
apiVersion: v1
kind: Secret
metadata:
name: {SECRET_NAME}
namespace: kyma-system
type: Opaque
stringData:
clientid: {CLIENT_ID}
clientsecret: {CLIENT_SECRET}
sm_url: {SM_URL}
tokenurl: {AUTH_URL}
tokenurlsuffix: "/oauth/token"
```

* mTLS access credentials

```yaml
apiVersion: v1
kind: Secret
metadata:
name: {SECRET_NAME}
namespace: kyma-system
type: Opaque
stringData:
clientid: {CLIENT_ID}
tls.crt: {TLS_CERTIFICATE}
tls.key: {TLS_KEY}
sm_url: {SM_URL}
tokenurl: {AUTH_URL}
tokenurlsuffix: "/oauth/token"
```

2. Specify a subaccount per service: Configure the Secret name in the ServiceInstance resource within the **btpAccessCredentialsSecret** property. The Secret containing the relevant subaccount's credentials tells SAP BTP Operator explicitly which subaccount to use to provision the service instance. The Secret must be located in the `kyma-system` namespace.
## Procedure

```yaml
apiVersion: services.cloud.sap.com/v1
kind: ServiceInstance
metadata:
name: {SERVICE_INSTANCE_NAME}
spec:
serviceOfferingName: service-manager
servicePlanName: subaccount-audit
btpAccessCredentialsSecret: {SECRET_NAME}
```

* To connect a namespace to a specific subaccount, see [Namespace-Level Mapping](03-22-namespace-level-mapping.md).
* To deploy service instances belonging to different subaccounts within the same namespace, see [Instance-Level Mapping](03-21-instance-level-mapping.md).
48 changes: 38 additions & 10 deletions docs/user/03-21-instance-level-mapping.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,22 +5,20 @@ You can map a Kubernetes service instance to an SAP Service Manager instance in
## Prerequisites

* A subaccount in the SAP BTP cockpit.
* kubectl configured for communicating with your Kyma instance.
* kubectl configured for communicating with your Kyma instance. See [Access a Kyma Instance Using kubectl](https://help.sap.com/docs/btp/sap-business-technology-platform/access-kyma-instance-using-kubectl).

## Context

To have multiple service instances from different subaccounts associated with a namespace, you must use a custom Secret to create these service instances.
To have multiple service instances from different subaccounts associated with a namespace, you must store access credentials for each subaccount in a custom Secret in the `kyma-system` namespace.
To create a service instance with a custom Secret, you must use the **btpAccessCredentialsSecret** field in the `spec` of the service instance. In it, you pass the Secret from the `kyma-system` namespace to create your service instance. You can use different Secrets for different service instances.

## Procedure

### Create Your Custom Secret
## Create Your Custom Secret

1. In the SAP BTP cockpit, create an SAP Service Manager service instance with the `service-operator-access` plan. See [Creating Instances in Other Environments](https://help.sap.com/docs/service-manager/sap-service-manager/creating-instances-in-other-environments?locale=en-US&version=Cloud).
2. Create a service binding to the SAP Service Manager service instance you have created. See [Creating Service Bindings in Other Environments](https://help.sap.com/docs/service-manager/sap-service-manager/creating-service-bindings-in-other-environments?locale=en-US&version=Cloud).
3. Get the access credentials of the SAP Service Manager instance from its service binding. Copy them from the BTP cockpit as a JSON.
3. Get the access credentials of the SAP Service Manager instance from its service binding. Copy them from the BTP cockpit as a JSON file.
4. Create the `creds.json` file in your working directory and save the credentials there.
5. In the same working directory, generate the Secret by calling the `create-secret-file.sh` script with the **operator** option as the first parameter and **your-secret-name** as the second parameter:
5. In the same working directory, generate the Secret by calling the `create-secret-file.sh` script with the **operator** option as the first parameter and **your-secret-name** as the second parameter:

```sh
curl https://raw.githubusercontent.com/kyma-project/btp-manager/main/hack/create-secret-file.sh | bash -s operator {YOUR_SECRET_NAME}
Expand Down Expand Up @@ -49,13 +47,42 @@ To create a service instance with a custom Secret, you must use the **btpAccessC
kubectl create -f ./btp-access-credentials-secret.yaml
```

7. To verify if the Secret has been successfully created, run:

```
kubectl get secret -n kyma-system {YOUR_SECRET_NAME}
```

You see the status `Created`.

### Create a Service Instance with the Custom Secret
> [!NOTE]
> You can also view the Secret in Kyma dashboard. In the `kyma-system` namespace, go to **Configuration** -> **Secrets**, and check the list of Secrets.

## Create a Service Instance with the Custom Secret

To create the service instance, use either Kyma dashboard or kubectl.

### Procedure

<!-- tabs:start -->
#### Use Kyma Dashboard

1. In the **Namespaces** view, go to the namespace you want to work in.
2. Go to **Service Management** -> **Service Instances**.
3. In the **BTP Access Credentials Secret** field, add the name of the custom Secret you have created.
4. Provide other required service details and create a service instance.

> [!WARNING]
> Once you set a Secret name in the service instance, you cannot change it in the future.

You see the status `PROVISIONED`.

#### Use kubectl

1. Create your service instance with:
* the **btpAccessCredentialsSecret** field in the `spec` pointing to the custom Secret you have created
* other parameters as needed<br>

* The **btpAccessCredentialsSecret** field in the `spec` pointing to the custom Secret you have created
* Other parameters as needed

> [!WARNING]
> Once you set a Secret name in the service instance, you cannot change it in the future.
Expand Down Expand Up @@ -86,6 +113,7 @@ To create a service instance with a custom Secret, you must use the **btpAccessC
You also see your Secret name in the **btpAccessCredentialsSecret** field of the `spec`.
3. To verify if you've correctly added the access credentials of the SAP Service Manager instance in your service instance, go to the CR `status` section, and make sure the subaccount ID to which the instance belongs is provided in the **subaccountID** field. The field must not be empty.
<!-- tabs:end -->
## Related Information
Expand Down
18 changes: 8 additions & 10 deletions docs/user/03-22-namespace-level-mapping.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,19 +5,17 @@ You can map a Kubernetes namespace to an SAP Service Manager instance in a given
## Prerequisites

* A subaccount in the SAP BTP cockpit.
* kubectl configured for communicating with your Kyma instance.
* kubectl configured for communicating with your Kyma instance. See [Access a Kyma Instance Using kubectl](https://help.sap.com/docs/btp/sap-business-technology-platform/access-kyma-instance-using-kubectl).

## Context

To have service instances from one subaccount associated with one namespace, you must use a Secret dedicated to this namespace to create these service instances.
To connect a namespace to a specific subaccount, maintain the access credentials to the subaccount in a Secret dedicated to a specific namespace. Create the `{NAMESPACE-NAME}-sap-btp-service-operator` Secret in the `kyma-system` namespace.

## Procedure
## Create a Namespace-Based Secret

### Create a Namespace-Based Secret

1. In the SAP BTP cockpit, create an SAP Service Manager service instance with the `service-operator-access` plan. See [Creating Instances in Other Environments](https://help.sap.com/docs/service-manager/sap-service-manager/creating-instances-in-other-environments?locale=en-US&version=Cloud).
1. In the SAP BTP cockpit, create a new SAP Service Manager service instance with the `service-operator-access` plan. See [Creating Instances in Other Environments](https://help.sap.com/docs/service-manager/sap-service-manager/creating-instances-in-other-environments?locale=en-US&version=Cloud).
2. Create a service binding to the SAP Service Manager service instance you have created. See [Creating Service Bindings in Other Environments](https://help.sap.com/docs/service-manager/sap-service-manager/creating-service-bindings-in-other-environments?locale=en-US&version=Cloud).
3. Get the access credentials of the SAP Service Manager instance with the `service-operator-access` plan from its service binding. Copy them from the SAP BTP cockpit as a JSON.
3. Get the access credentials of the SAP Service Manager instance from its service binding. Copy them from the SAP BTP cockpit as a JSON file.
4. Create the `creds.json` file in your working directory and save the credentials there.
5. In the same working directory, generate the Secret by calling the `create-secret-file.sh` script with the **operator** option as the first parameter and **namespace-name-sap-btp-service-operator** Secret as the second parameter.

Expand Down Expand Up @@ -50,11 +48,11 @@ To have service instances from one subaccount associated with one namespace, you
You can see the status `Created`.


### Create a Service Instance with a Namespace-Based Secret
## Create a Service Instance with a Namespace-Based Secret

1. To create a service instance with a namespace-based Secret, follow the instructions on [creating service instances](03-30-management-of-service-instances-and-bindings.md#create-a-service-instance).
1. To create a service instance with a namespace-based Secret, follow the instructions in [Create Service Instances and Service Bindings](03-30-create-instances-and-bindings.md).

2. To verify if you've correctly added the access credentials of the SAP Service Manager instance in your service instance, go to the CR `status` section, and make sure the subaccount ID to which the instance belongs is provided in the **subaccountID** field. The field must not be empty.
2. To verify if you've correctly added the access credentials of the SAP Service Manager instance in your service instance, go to the custom resource (CR) `status` section, and make sure the subaccount ID to which the instance belongs is provided in the **subaccountID** field. The field must not be empty.
## Related Information
Expand Down
Loading

0 comments on commit cb1ffe8

Please sign in to comment.