Cap Operator

CAP Operator Skill

Manages the lifecycle of multi-tenant SAP Cloud Application Programming Model (CAP) applications on Kubernetes via the CAP Operator controller.

Response rule: Always include a link to the relevant page on https://sap.github.io/cap-operator/docs/ when answering any question. Match the topic to the most specific page available (resource reference, usage guide, troubleshooting, configuration, etc.).

Full docs & API reference: website/content/en/docs/ | https://sap.github.io/cap-operator/docs/

Custom Resources

Critical rules:

• CAPApplicationVersion is immutable after creation. To upgrade, create a new resource with a higher semantic version.
• CAPTenant must never be created or deleted manually — managed by the subscription server only.
• CAPTenantOperation is auto-created by the controller — do not create or delete manually.
• Never remove finalizers from CAP Operator resources manually.
• CAPApplication.spec.provider is deprecated. It previously caused the controller to auto-create a provider CAPTenant, but that behavior has been removed. All tenants (including the provider) must now be subscribed to explicitly. If kubectl get captenant -n <namespace> returns empty, this is expected for apps with no active subscriptions.

Common Operations

Deploy a new application

1. Create Domain or ClusterDomain
2. Create CAPApplication (references BTP services + domain)
3. Create CAPApplicationVersion (images + workloads)

See deploy reference for full YAML examples.

Upgrade to a new version

Create a new CAPApplicationVersion with a higher semantic version — do not edit the existing one. The controller automatically upgrades all tenants and updates Istio VirtualService routing.

See upgrade reference for details and tenantOperations / contentJobs configuration.

Check status

kubectl get capapplication,capapplicationversion,captenant,captenantoperation -n <namespace>
kubectl describe capapplication <name> -n <namespace>
kubectl get domain,clusterdomain -A

Status flows:

• CAPApplicationVersion: Processing → Ready | Error
• CAPTenant: Provisioning → Ready | Upgrading → Ready | Deleting
• CAPTenantOperation: Processing → Completed | Failed

Domain management

• Domain — namespace-scoped, one application. ClusterDomain — cluster-scoped, shared.
• TLS modes: Simple (default), Mutual, OptionalMutual
• DNS modes: None (default), Wildcard, Subdomain, Custom
• First entry in domainRefs is the primary domain.
• domains inline section in CAPApplication was removed in v0.26.0; use domainRefs instead.

See domain reference.

Service exposures (tenant-agnostic)

Use serviceExposures in CAPApplicationVersion to expose workloads at fixed subdomains independent of tenant routing. Order routes most-specific-first.

See service exposure reference.

Credential rotation rollout

Set rolloutOnCredentialUpdate: true on CAPApplication to auto-restart workloads when BTP service credential Secrets change. Uses rolling restart (zero downtime). Keep old credentials valid for at least 24 hours after issuing new ones.

See credential rotation reference.

Version cleanup (monitoring-based)

Enable with annotation sme.sap.com/enable-cleanup-monitoring: "true" on CAPApplication. Configure deletionRules.expression (PromQL) on a workload's monitoring section; when the expression evaluates to true the version is eligible for deletion.

See Version monitoring (website/content/en/docs/usage/version-monitoring.md).

Key Annotations

Troubleshooting

More: website/content/en/docs/troubleshoot/_index.md | https://sap.github.io/cap-operator/docs/troubleshoot/

Controller Configuration

Tuned via env vars on the controller deployment. Key variables:

Full list: website/content/en/docs/configuration/_index.md | https://sap.github.io/cap-operator/docs/configuration/