# Sap Kyma Runtime

> >

- **Type:** Skill
- **Install:** `agentstack add skill-efeumutaslan-sap-skills-sap-kyma-runtime`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [efeumutaslan](https://agentstack.voostack.com/s/efeumutaslan)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [efeumutaslan](https://github.com/efeumutaslan)
- **Source:** https://github.com/efeumutaslan/SAP-SKILLS/tree/main/skills/sap-kyma-runtime

## Install

```sh
agentstack add skill-efeumutaslan-sap-skills-sap-kyma-runtime
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# SAP BTP Kyma Runtime

## Related Skills
- `sap-s4hana-extensibility` — S/4HANA events and APIs consumed by Kyma extensions
- `sap-devops-cicd` — CI/CD pipelines for Kyma deployments
- `sap-security-authorization` — XSUAA/IAS integration for Kyma workloads
- `sap-cap-advanced` — Deploying CAP applications on Kyma
- `sap-event-mesh` — Event-driven Kyma Functions consuming SAP events

## Quick Start

**Choose your extension pattern:**

| Scenario | Approach | Key Artifact |
|----------|----------|-------------|
| Lightweight webhook / event handler | Kyma Function (serverless) | `Function` CR |
| Full microservice | Kubernetes Deployment | `Deployment` + `Service` + `APIRule` |
| Scheduled job | Kubernetes CronJob | `CronJob` CR |
| Event-driven extension | Function + Event subscription | `Subscription` CR |
| Helm-based app | Helm chart | `Chart.yaml` + templates |

**Minimal Kyma Function:**

```yaml
apiVersion: serverless.kyma-project.io/v1alpha2
kind: Function
metadata:
  name: order-handler
  namespace: default
spec:
  runtime: nodejs20
  source:
    inline:
      source: |
        module.exports = {
          main: async function (event, context) {
            const order = event.data;
            console.log('Order received:', order.OrderID);
            return { statusCode: 200, body: { status: 'processed' } };
          }
        };
      dependencies: |
        { "name": "order-handler", "version": "1.0.0", "dependencies": {} }
```

## Core Concepts

### Kyma Architecture on BTP
- **Kyma modules**: Modular capabilities (Serverless, Istio, API Gateway, Eventing) enabled per cluster
- **BTP Service Operator**: Provisions BTP services (XSUAA, HANA, Destination) as Kubernetes secrets
- **Istio service mesh**: Mutual TLS, traffic management, observability built-in
- **Kyma Dashboard**: Web UI for managing resources (alternative to kubectl)

### Key Custom Resources

| CR | Purpose | Module |
|----|---------|--------|
| `Function` | Serverless function | Serverless |
| `APIRule` | Expose service externally (Istio Gateway) | API Gateway |
| `Subscription` | Subscribe to SAP/custom events | Eventing |
| `ServiceInstance` | Provision BTP service | BTP Operator |
| `ServiceBinding` | Bind BTP service to workload | BTP Operator |

### Namespace Strategy
- `default` — Quick prototyping only
- `production` / `staging` — Separate by environment
- One namespace per bounded context for microservice architectures
- Label namespaces with `istio-injection=enabled` for mesh

## Common Patterns

### Pattern 1: Microservice with BTP Service Binding

```yaml
# service-instance.yaml — provision XSUAA
apiVersion: services.cloud.sap.com/v1
kind: ServiceInstance
metadata:
  name: xsuaa-instance
spec:
  serviceOfferingName: xsuaa
  servicePlanName: application
  parameters:
    xsappname: order-service
    tenant-mode: dedicated
    scopes:
      - name: $XSAPPNAME.OrderRead
        description: Read orders
    role-templates:
      - name: OrderViewer
        scope-references:
          - $XSAPPNAME.OrderRead
---
# service-binding.yaml
apiVersion: services.cloud.sap.com/v1
kind: ServiceBinding
metadata:
  name: xsuaa-binding
spec:
  serviceInstanceName: xsuaa-instance
  secretName: xsuaa-credentials
```

```yaml
# deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: order-service
spec:
  replicas: 2
  selector:
    matchLabels:
      app: order-service
  template:
    metadata:
      labels:
        app: order-service
    spec:
      containers:
        - name: order-service
          image: myregistry.io/order-service:1.0.0
          ports:
            - containerPort: 8080
          envFrom:
            - secretRef:
                name: xsuaa-credentials
          resources:
            requests:
              memory: "128Mi"
              cpu: "100m"
            limits:
              memory: "256Mi"
              cpu: "500m"
          livenessProbe:
            httpGet:
              path: /health
              port: 8080
            initialDelaySeconds: 10
---
apiVersion: v1
kind: Service
metadata:
  name: order-service
spec:
  selector:
    app: order-service
  ports:
    - port: 80
      targetPort: 8080
```

### Pattern 2: API Rule (External Exposure)

```yaml
apiVersion: gateway.kyma-project.io/v1beta1
kind: APIRule
metadata:
  name: order-api
spec:
  host: order-api
  service:
    name: order-service
    port: 80
  gateway: kyma-system/kyma-gateway
  rules:
    - path: /orders.*
      methods: ["GET", "POST"]
      accessStrategies:
        - handler: jwt
          config:
            jwks_urls:
              - https://.authentication..hana.ondemand.com/token_keys
            trusted_issuers:
              - https://.authentication..hana.ondemand.com
    - path: /health
      methods: ["GET"]
      accessStrategies:
        - handler: noop
```

### Pattern 3: Event-Driven Extension (S/4HANA Events)

```yaml
apiVersion: eventing.kyma-project.io/v1alpha2
kind: Subscription
metadata:
  name: order-created-sub
spec:
  sink: http://order-handler.default.svc.cluster.local
  source: sap.s4.beh/ER9
  types:
    - sap.s4.beh.businesspartner.v1.BusinessPartner.Created.v1
  typeMatching: standard
```

### Pattern 4: Destination Service Access

```yaml
apiVersion: services.cloud.sap.com/v1
kind: ServiceInstance
metadata:
  name: dest-instance
spec:
  serviceOfferingName: destination
  servicePlanName: lite
---
apiVersion: services.cloud.sap.com/v1
kind: ServiceBinding
metadata:
  name: dest-binding
spec:
  serviceInstanceName: dest-instance
  secretName: dest-credentials
```

```javascript
// Node.js — call S/4HANA via Destination Service
const { getDestination, executeHttpRequest } = require('@sap-cloud-sdk/connectivity');

async function getBusinessPartners() {
  const dest = await getDestination({ destinationName: 'S4HANA_SYSTEM' });
  const response = await executeHttpRequest(dest, {
    method: 'GET',
    url: '/sap/opu/odata/sap/API_BUSINESS_PARTNER/A_BusinessPartner?$top=10'
  });
  return response.data;
}
```

### Pattern 5: Helm Chart Deployment

```
my-extension/
├── Chart.yaml
├── values.yaml
└── templates/
    ├── deployment.yaml
    ├── service.yaml
    ├── apirule.yaml
    └── service-binding.yaml
```

```bash
# Deploy with Helm
helm upgrade --install my-extension ./my-extension \
  --namespace production \
  --set image.tag=1.2.0 \
  --set replicas=3
```

## Error Catalog

| Error | Message | Root Cause | Fix |
|-------|---------|------------|-----|
| `Function CrashLoopBackOff` | Runtime error in function code | Syntax error or missing dependency | Check logs: `kubectl logs -n default -l serverless.kyma-project.io/function-name=` |
| `APIRule ERROR` | `VirtualService creation failed` | Duplicate host or invalid gateway | Ensure unique host; verify gateway exists: `kubectl get gateways -n kyma-system` |
| `ServiceBinding failed` | `Could not find service instance` | Instance not ready or wrong name | Check `kubectl get serviceinstances`; wait for `Ready` status |
| `Subscription NATS error` | `No events received` | Wrong event type string or source | Match exact type from SAP Event Catalog; check eventing module is enabled |
| `ImagePullBackOff` | `unauthorized: authentication required` | Registry credentials missing | Create `imagePullSecret` and reference in Deployment spec |
| `OOMKilled` | Container killed by OOM | Memory limit too low | Increase `resources.limits.memory`; profile actual usage first |

## Performance Tips

1. **Right-size resources** — Start with `100m` CPU / `128Mi` memory, scale based on metrics
2. **HPA for autoscaling** — Use `HorizontalPodAutoscaler` on CPU/memory or custom metrics
3. **Function cold starts** — Set `minReplicas: 1` for latency-sensitive Functions
4. **Connection pooling** — Reuse HTTP clients and DB connections across invocations
5. **Istio sidecar** — Adds ~20ms latency per hop; disable for internal batch jobs if acceptable
6. **Image size** — Use distroless/alpine base images; smaller image = faster pull = faster scaling
7. **Pod disruption budgets** — Set `PodDisruptionBudget` for critical services during node upgrades

## Gotchas

- **Kyma module enablement**: Serverless, Eventing, API Gateway are separate modules — enable them in BTP Cockpit or via `Kyma` CR before use
- **Function source size limit**: Inline source max ~1MB; use Git source for larger codebases
- **Secret rotation**: BTP Service Operator does NOT auto-rotate secrets; delete and recreate ServiceBinding to refresh
- **Network policies**: By default, all pods can communicate; add `NetworkPolicy` for production isolation
- **Kyma trial limitations**: 14-day expiry, limited resources, no custom domains

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [efeumutaslan](https://github.com/efeumutaslan)
- **Source:** [efeumutaslan/SAP-SKILLS](https://github.com/efeumutaslan/SAP-SKILLS)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-efeumutaslan-sap-skills-sap-kyma-runtime
- Seller: https://agentstack.voostack.com/s/efeumutaslan
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.