diff --git a/.agents/skills/cap-operator/SKILL.md b/.agents/skills/cap-operator/SKILL.md index d42a1b3a..4c711a1c 100644 --- a/.agents/skills/cap-operator/SKILL.md +++ b/.agents/skills/cap-operator/SKILL.md @@ -14,24 +14,27 @@ allowed-tools: Bash(kubectl:*) Manages the lifecycle of multi-tenant SAP Cloud Application Programming Model (CAP) applications on Kubernetes via the CAP Operator controller. -Full docs: `website/content/en/docs/` | API reference: `website/content/en/docs/reference/` | Website: https://sap.github.io/cap-operator +**Response rule:** Always include a link to the relevant page on https://sap.github.io/cap-operator/docs/ when answering any question. Match the topic to the most specific page available (resource reference, usage guide, troubleshooting, configuration, etc.). + +Full docs & API reference: `website/content/en/docs/` | https://sap.github.io/cap-operator/docs/ ## Custom Resources | Resource | Scope | Purpose | |---|---|---| -| `CAPApplication` | Namespaced | High-level app: BTP services, domain refs, provider subaccount | -| `CAPApplicationVersion` | Namespaced | Immutable version: images, workloads, tenant operation steps | -| `CAPTenant` | Namespaced | A subscribed consumer tenant — controller-managed only | -| `CAPTenantOperation` | Namespaced | Orchestrates provisioning/upgrade/deprovisioning — auto-created | -| `Domain` | Namespaced | Istio Gateway + TLS + DNS for one application | -| `ClusterDomain` | Cluster | Shared domain config across applications | +| [`CAPApplication`](https://sap.github.io/cap-operator/docs/usage/resources/capapplication/) | Namespaced | High-level app: BTP services, domain refs, provider subaccount | +| [`CAPApplicationVersion`](https://sap.github.io/cap-operator/docs/usage/resources/capapplicationversion/) | Namespaced | Immutable version: images, workloads, tenant operation steps | +| [`CAPTenant`](https://sap.github.io/cap-operator/docs/usage/resources/captenant/) | Namespaced | A subscribed consumer tenant — controller-managed only | +| [`CAPTenantOperation`](https://sap.github.io/cap-operator/docs/usage/resources/captenantoperation/) | Namespaced | Orchestrates provisioning/upgrade/deprovisioning — auto-created | +| [`Domain`](https://sap.github.io/cap-operator/docs/usage/resources/domain/) | Namespaced | Istio Gateway + TLS + DNS for one application | +| [`ClusterDomain`](https://sap.github.io/cap-operator/docs/usage/resources/clusterdomain/) | Cluster | Shared domain config across applications | **Critical rules:** - `CAPApplicationVersion` is **immutable** after creation. To upgrade, create a new resource with a higher semantic version. - `CAPTenant` must **never** be created or deleted manually — managed by the subscription server only. - `CAPTenantOperation` is auto-created by the controller — do not create or delete manually. - Never remove finalizers from CAP Operator resources manually. +- `CAPApplication.spec.provider` is **deprecated**. It previously caused the controller to auto-create a provider `CAPTenant`, but that behavior has been removed. All tenants (including the provider) must now be subscribed to explicitly. If `kubectl get captenant -n ` returns empty, this is expected for apps with no active subscriptions. ## Common Operations @@ -62,7 +65,7 @@ kubectl get domain,clusterdomain -A ### Domain management - `Domain` — namespace-scoped, one application. `ClusterDomain` — cluster-scoped, shared. -- TLS modes: `Simple` (default), `Mutual`, `OptionalMutual` (Domain only) +- TLS modes: `Simple` (default), `Mutual`, `OptionalMutual` - DNS modes: `None` (default), `Wildcard`, `Subdomain`, `Custom` - First entry in `domainRefs` is the primary domain. - `domains` inline section in `CAPApplication` was removed in v0.26.0; use `domainRefs` instead. @@ -82,6 +85,8 @@ See [credential rotation reference](references/credential-rotation.md). ### Version cleanup (monitoring-based) Enable with annotation `sme.sap.com/enable-cleanup-monitoring: "true"` on `CAPApplication`. Configure `deletionRules.expression` (PromQL) on a workload's `monitoring` section; when the expression evaluates to `true` the version is eligible for deletion. +See [Version monitoring](https://sap.github.io/cap-operator/docs/usage/version-monitoring/) (`website/content/en/docs/usage/version-monitoring.md`). + ## Key Annotations | Annotation | Resource | Effect | @@ -101,7 +106,7 @@ Enable with annotation `sme.sap.com/enable-cleanup-monitoring: "true"` on `CAPAp | Approuter can't reach CAP backend | Missing `routerDestinationName` | Add `routerDestinationName` to the CAP workload port definition | | Credentials not injected | Service not in `consumedBTPServices` | Verify service name matches `CAPApplication.spec.btp.services[].name` | -More: `website/content/en/docs/troubleshoot/_index.md` +More: `website/content/en/docs/troubleshoot/_index.md` | https://sap.github.io/cap-operator/docs/troubleshoot/ ## Controller Configuration @@ -116,4 +121,4 @@ Tuned via env vars on the controller deployment. Key variables: | `MAX_CONCURRENT_RECONCILES_CAP_TENANT` | CAPTenant reconciliation concurrency | | `MAX_CONCURRENT_RECONCILES_CAP_TENANT_OPERATION` | CAPTenantOperation reconciliation concurrency | -Full list: `website/content/en/docs/configuration/_index.md` +Full list: `website/content/en/docs/configuration/_index.md` | https://sap.github.io/cap-operator/docs/configuration/ diff --git a/.agents/skills/cap-operator/references/credential-rotation.md b/.agents/skills/cap-operator/references/credential-rotation.md index b72abda3..ce9a7b46 100644 --- a/.agents/skills/cap-operator/references/credential-rotation.md +++ b/.agents/skills/cap-operator/references/credential-rotation.md @@ -30,4 +30,4 @@ spec: - Keep old credentials valid for **at least 24 hours** after issuing new ones — do not revoke until all pods have restarted with the new credentials. - The batching window is configurable via the `ROLLOUT_DELAY` env var on the controller deployment (minimum `30s`). -See `website/content/en/docs/usage/rollout-on-credential-update.md`. +See `website/content/en/docs/usage/rollout-on-credential-update.md` | [Rollout on credential update](https://sap.github.io/cap-operator/docs/usage/rollout-on-credential-update/). diff --git a/.agents/skills/cap-operator/references/deploy.md b/.agents/skills/cap-operator/references/deploy.md index 6860335d..2ffed965 100644 --- a/.agents/skills/cap-operator/references/deploy.md +++ b/.agents/skills/cap-operator/references/deploy.md @@ -155,3 +155,5 @@ The `getDependencies` endpoint is exposed automatically at: ``` GET /dependencies/{providerSubaccountId}/{appName}/ ``` + +See `website/content/en/docs/usage/deploying-application.md` | [Deploying an application](https://sap.github.io/cap-operator/docs/usage/deploying-application/). diff --git a/.agents/skills/cap-operator/references/domain.md b/.agents/skills/cap-operator/references/domain.md index 090f0c03..573bcdd1 100644 --- a/.agents/skills/cap-operator/references/domain.md +++ b/.agents/skills/cap-operator/references/domain.md @@ -36,7 +36,7 @@ spec: ingressSelector: app: istio-ingressgateway istio: ingressgateway - tlsMode: Simple # Simple (default) | Mutual + tlsMode: Simple # Simple (default) | Mutual | OptionalMutual dnsMode: Subdomain # None (default) | Wildcard | Subdomain | Custom ``` @@ -46,9 +46,9 @@ spec: |---|---| | `Simple` | Standard one-way TLS (default) | | `Mutual` | mTLS required — clients must present a certificate | -| `OptionalMutual` | mTLS optional (`Domain` only — not supported on `ClusterDomain`) | +| `OptionalMutual` | mTLS optional — client certificate is accepted if provided | -When `tlsMode` is `Mutual` or `OptionalMutual`, provide additional CA certificates via `certConfig.additionalCACertificate`. See `website/content/en/docs/usage/domain-management/additional-ca.md`. +When `tlsMode` is `Mutual` or `OptionalMutual`, provide additional CA certificates via `certConfig.additionalCACertificate`. See `website/content/en/docs/usage/domain-management/additional-ca.md` | [Additional CA certificates](https://sap.github.io/cap-operator/docs/usage/domain-management/additional-ca/). ## DNS modes @@ -57,7 +57,7 @@ When `tlsMode` is `Mutual` or `OptionalMutual`, provide additional CA certificat | `None` | No DNS entry created (default) | | `Wildcard` | Single wildcard DNS entry (`*.`) | | `Subdomain` | Per-tenant subdomain DNS entries | -| `Custom` | Template-based DNS entry — see `website/content/en/docs/usage/domain-management/custom-dns.md` | +| `Custom` | Template-based DNS entry — see `website/content/en/docs/usage/domain-management/custom-dns.md` \| [Custom DNS](https://sap.github.io/cap-operator/docs/usage/domain-management/custom-dns/) | ## Referencing domains in CAPApplication @@ -82,4 +82,4 @@ A mutation webhook will reject any attempt to reintroduce the `domains` section. 1. Upgrade to v0.25.0 first — this runs the automatic `domains` → `domainRefs` migration. 2. Then upgrade to the latest release. -See `website/content/en/docs/usage/domain-management/_index.md`. +See `website/content/en/docs/usage/domain-management/_index.md` | [Domain management](https://sap.github.io/cap-operator/docs/usage/domain-management/). diff --git a/.agents/skills/cap-operator/references/service-exposure.md b/.agents/skills/cap-operator/references/service-exposure.md index 5d4effd8..671b1eea 100644 --- a/.agents/skills/cap-operator/references/service-exposure.md +++ b/.agents/skills/cap-operator/references/service-exposure.md @@ -59,3 +59,5 @@ For a domain `my.example.com` this produces: | `app.my.example.com` | `app:5000` | **Important:** Order routes most-specific-first within a `subDomain` to avoid routing conflicts (e.g. `/api/v2` before `/api`). + +See `website/content/en/docs/usage/service-exposure.md` | [Service exposure](https://sap.github.io/cap-operator/docs/usage/service-exposure/). diff --git a/.agents/skills/cap-operator/references/upgrade.md b/.agents/skills/cap-operator/references/upgrade.md index 0cc03b72..615f30ef 100644 --- a/.agents/skills/cap-operator/references/upgrade.md +++ b/.agents/skills/cap-operator/references/upgrade.md @@ -60,3 +60,5 @@ Defines execution order for `Content` workload jobs when a `CAPApplicationVersio ## Version Affinity (experimental) Add annotation `sme.sap.com/enable-version-affinity: "true"` to `CAPApplication` to keep users on their current version until logout. Set `sme.sap.com/logout-endpoint: ""` on `CAPApplicationVersion` for a custom logout path (no leading slash). + +See `website/content/en/docs/usage/version-upgrade.md` | [Version upgrade](https://sap.github.io/cap-operator/docs/usage/version-upgrade/).