orkungedik/SAP-basis-dataset huggingface dataset:
## 4.2.15.19  Scoping Framework
Learn how to use the scoping API.
Scoping is a mechanism that determines the visibility of certain development object types at configuration time. Depending on your decisions, some object types may be hidden or displayed in the current client.
For instance, in the Business Roles app, not all business catalogs shall be available for the administrator user, because their usage is subject to additional license constraints.
To scope the relevant objects, you can use the API IF\_APS\_BC\_SCOPE\_CHANGE\_API . The interface provides mass-enabled methods for setting the scope state of scoping-enabled TADIR objects in the current client.
##  Note
The objects to be scoped must be in the same software component as the caller.
The following TADIR types are supported:
List of TADIR Objects That Can Be Scoped
| Constant   | TADIR Object                      |
|------------|-----------------------------------|
| CMHC       | Cloud Management Health Check     |
| ESH1       | ESH: CDS Search Model             |
| JOBD       | Technical Job Definition          |
| PCFN       | Predefined Field: Extensible Node |
| SAJC       | Application Job Catalog Entry     |
| SCO1       | Communication Scenario            |
| SIA1       | Business Catalog                  |
| SIA6       | IAM App                           |
| SIA8       | Business Role Template            |
| UIST       | Fiori Launchpad Space Template    |
| UIPG       | Fiori Launchpad Page Template     |
To scope one of these objects, you have to provide the object type, object name, and the desired scoping state ( ON or OFF ).
##  Note
Objects that are set to scoping state ON should not be set to OFF . The object must remain available to the customer to guarantee further access to the data maintained via the object.
For further information, see the long text documentation of the API IF\_APS\_BC\_SCOPE\_CHANGE\_API .
## 4.2.15.21  Business Event Logging
This section describes all the released objects in Business Event Logging.
## 4.2.15.21.1  Log Custom Business Events
You can create your own business events with SAP-defined or customer-defined objects. For more information on creating events, see Business Events.
## Define Events for Business Event Logging
The event binding can contain an SAP-defined or a customer-defined object and and an operation.
Business events should be declared in the correct node they refer to - the child node or the root node.
You must add the @ObjectModel.sapObjectNodeType.name annotation in the abstract event entity denoting the SAP Object Node Type the event refers to.
@ObjectModel.sapObjectNodeType.name Annotation
@ObjectModel.sapObjectNodeType.name Annotation : The name of the object components the event refers to.
This can be an SAP-defined object component like SalesOrderItem, or a customer defined object component. For example: Z\_MyObjectItem. If the event refers to the object as a whole or the header of the object, then the object component name should be the same as the object component name in the event binding.
## 
```
Sample Code @ObjectModel.sapObjectNodeType.name: 'Z_MySalesOrderItem' define abstract entity ZD_SALESORDERITEMCREATED { ItemNo : item_no Status : Status }
```
In case an event referring to a child node is exceptionally assigned to a root node to support backward compatibility, then the following @Event.sapObjectNodeTypeKey annotation is additionally required:
@Event.sapObjectNodeTypeKey Annotations
@Event.sapObjectNodeTypeKey Annotations : The key of the object node the event refers to needs to be defined if this is a customer defined object component, or if the key is deviating from SAP standard. The elements of the key must either be defined in the underlying behaviour definition, or the abstract entity itself.
##  Note
The order of keys in the annotation should be the same as they are in the node's corresponding entity.
## 
```
Sample Code @ObjectModel.sapObjectNodeType.name: 'Z_MySalesOrderItem' @Event.sapObjectNodeTypeKey : [ { element : 'SalesOrder' } , { element :
```
```
'ItemNo' } ] define abstract entity ZD_SALESORDERITEMCREATED { ItemNo : item_no Status : Status }
```
## 4.2.15.21.3  Accessing Business Event Log Data using CDS Views
The following views are released for key user extensibility:
| CDS Views                     | Description                                                               |
|-------------------------------|---------------------------------------------------------------------------|
| C_BUSEVTLOGEVENTDEX_2         | This CDS view provides business event header data.                        |
| C_BUSEVTLOGPAYLOADDEX_2       | This CDS view provides a subset of event payload details.                 |
| C_BUEVLGEVTFULLPAYLOADJSONDEX | This CDS view provides full business event data (payload) in JSON format. |
## 4.2.16.1.1  Develop an OData UI Service Against a Released BO Interface or CDS View
Get an overview about how to create an OData UI service based on a released business object interface or CDS view using ABAP development tools for Eclipse, SAP Business Application Studio or Microsoft Visual Studio Code.
## Prerequisites
- If you are using SAP Business Application Studio:
- You have set up SAP Business Application Studio. See Setup of UI Development in SAP Business Application Studio
- You have established trust by setting up a custom identity service. See Setup of a Custom Identity Service.
- If you are using Visual Studio Code:
- You have installed and set up Visual Studio Code including the SAP Fiori tools extensions. See Visual Studio Code
- To establish a connection with your ABAP environment system, you either have to be a space developer in the ABAP environment instance or have access to a service key in the ABAP environment instance. See Add Space Members Using the Cockpit and Creating Service Keys in the ABAP service instance.
- You have established trust by setting up a custom Identity service. See Setup of a Custom Identity Service.
- If you are using ABAP development tools for Eclipse:
- You have installed and set up ABAP development tools for Eclipse. SeeDownload the Eclipse IDE and add the ABAP development Tools (ADT) Plugin .
## 1. Explore Business Object Interfaces and CDS Views suitable for UI Consumption
##  Note
## Prerequisites :
- Business Catalog SAP\_A4C\_BC\_DEV\_OBJ\_DIS\_PC, which allows you to discover released objects. See Business Catalogs for Development Tasks.
## Steps
<!-- image -->
1. As a developer user, explore business object interfaces as well as CDS views that are released with Contract C1: Use System-Internally
1. Business Object Interfaces and CDS views listed in SAP System Service Provider in the Service Center within SAP Business Application Studio. See SAP System Service Provider.
2. Core Data Services listed under the released objects tree in ABAP development tools for Eclipse, look for behavior definitions and data definitions. See ABAP Repository Trees.
##  Note
Customer-owned business object interfaces and CDS views are only visible in ABAP development tools for Eclipse as well as in the UI Service Generator. The SAP System Service Provider in Service Center within SAP Business Application only shows SAP-provided objects.
2. On top of finding released objects for consumption, you can further narrow down the selection to only those objects that support OData UI consumption.
1. In the Project Explorer of ABAP development tools for Eclipse, open a released core data service or the root view entity of a released business object interface.
2. Check the header annotations of the corresponding object. If the annotation and enumeration @ObjectModel.supportedCapabilities: [#UI\_PROVIDER\_PROJECTION\_SOURCE] are included, the OData UI consumption is supported.
<!-- image -->
## 4.2.16.1.2  Develop an SAP Fiori Application UI and Deploy it to ABAP Using SAP Business Application Studio
Get an overview about how to create and deploy an SAP Fiori application to ABAP using SAP Business Application Studio.
If you need further assistance with creating and deploying an application, check out the tutorial Create an SAP Fiori App and Deploy it to SAP BTP ABAP Environment .
## Prerequisites
- You have set up SAP Business Application Studio. See Setup of UI Development in SAP Business Application Studio.
- You have established trust by setting up a custom Identity service. See Setup of a Custom Identity Service.
## 1. Generating and Deploying Your Application
##  Note
## Prerequisites :
- You have created a development package in ABAP Development Tools for Eclipse. See Creating ABAP Packages.
- You have exposed a RAP business service as an OData service. See Using Service Binding Editor for OData Service. In case no suitable service is available yet, you may create one based on a released BO interface or CDS View. SeeDevelop an OData UI Service Against a Released BO Interface or CS View.
- Business catalog SAP\_A4C\_BC\_DEV\_UID\_PC is assigned to your user, which allows you to discover available services and deploy your application.
- Business catalog SAP\_CORE\_BC\_EXT\_TST is assigned to your user, which allows you to preview your application. See Business Catalogs for Development Tasks.
- You have an open transport request.
<!-- image -->
1. As a developer user in SAP Business Application Studio, generate an SAP Fiori application. See Generate an Application.
1. In the Data Source and Service Selection section of the Template Wizard, select the following values:
- Data source: Connect to a System .
- System:
- (Option 1) Select the destination that you have created for the SAP Business Application studio integration ( SAP\_Business\_Application\_Studio ). See Creating a Destination to the ABAP System for SAP Business Application Studio.
- (Option 2) Select ABAP Environment on SAP Business Technology Platform . From the ABAP environment drop-down menu, choose a service instance.
- Continue with choosing a service.
2. Add a deployment configuration. See section Add deployment configuration &gt; ABAP system in Additional Configuration.
<!-- image -->
If you want to create your deployment configuration later, see Generate Deployment Configuration ABAP.
3. Add an SAP Fiori launchpad configuration for your UI project. See section Add FLP configuration in Additional Configuration.
2. If you want to create you FLP configuration later, see SAP Fiori Launchpad Configuration.
2. Continue with the development of the UI, for example, with the help of guided development. See Implement Features using Guided Development.
3. Now you can preview the generated SAP Fiori application. See Preview an Application.
4. Deploy the SAP Fiori UI by executing command npm run deploy in the terminal of your project. See Deployment to ABAP.
5. 4. On top of these launchpad app descriptor items that are created automatically during app deployment, you may also create such objects manually in ABAP development tools for Eclipse. Refer to Creating Launchpad App Descriptor Items.
## 2. Creating and Publishing Your Identity and Access Management (IAM) App
<!-- image -->
1. To manage access to your SAP Fiori application, you need to log on as a developer in ABAP development tools for Eclipse to create an Identity and Access Management (IAM) application, assign a launchpad app descriptor item for your UI5 application and a service, and maintain authorizations (steps 1-3 in the figure above). See Creating an IAM App for the Business Service.
2. Once you have created your IAM app, you have to create a business catalog. See Creating a Business Catalog.
3. Assign your IAM app to the business catalog.
4. Publish the IAM app and business catalog locally.
## Next Step
Launch your app in SAP Fiori launchpad. See Add Your App to SAP Fiori Launchpad.
## Related Information
SAP Business Application Studio
SAP Fiori Tools
SAP Fiori Overview
Tutorial: Develop and Run SAP Fiori Application With SAP Business Application Studio https:/ /developers.sap.com/tutorials/abap-environment-abap-flp.html
Tutorial: Integrate List Report into ABAP Fiori Launchpad
## 4.2.16.1.3  Develop an SAP Fiori Application UI and Deploy it to ABAP Using Visual Studio Code
Get an overview about how to create and deploy an SAP Fiori application to ABAP using Visual Studio Code.
For further assistance with creating and deploying an application into SAP Fiori launchpad, see Create a SAP Fiori App in Visual Studio Code and Deploy it to SAP BTP ABAP Environment .
## Prerequisites
- You have installed and set up Visual Studio Code including the SAP Fiori tools extensions. See Visual Studio Code.
- You have access to a RAP business service that has been exposed as an OData UI service. See Using Service Binding Editor for OData V2 Service.
- To establish a connection with your ABAP environment system, you either have to be a space developer in the ABAP environment instance or have access to a service key in the ABAP environment instance. See Add Space Members Using the Cockpit and Creating Service Keys in the ABAP service instance.
- You have established trust by setting up a custom Identity service. See Setup of a Custom Identity Service.
## 1. Generating and Deploying Your Application
##  Note
## Prerequisites
- You have created a development package in ABAP development tools for Eclipse. See Creating ABAP Packages.
- You have exposed a RAP business service as an OData UI service. See Using Service Binding Editor for OData V2 Service.
- Business catalog SAP\_A4C\_BC\_DEV\_UID\_PC is assigned to your user, which allows you to discover available OData UI services and deploy your application.
- Business catalog SAP\_CORE\_BC\_EXT\_TST is assigned to your user, which allows you to preview your application. See Business Catalogs for Development Tasks [page 2648].
- You have an open transport request.
1. As a developer user in Visual Studio Code, generate an SAP Fiori application. See Generate an Application. In the Data Source and Service Selection section of the Template Wizard, select the following values:
- Data source: Connect to a System .
- System: New System
- System type: ABAP Environment on SAP Business Technology Platform
- ABAP environment definition source:
- (Option 1) Discover a Cloud Foundry Service
<!-- image -->
##  Note
You have to log on to your Cloud Foundry space by executing command cf login in the terminal or by navigating to View Find Command CF: Login to Cloud Foundry . When you're prompted to enter the API endpoint, org name, and space, you can navigate to your subaccount in the SAP BTP cockpit, where you can find this information.
- (Option 2) Upload a Service Key File
- Continue with choosing a system name and service.
In the Project Attributes section, add deployment configuration and FLP configuration to your UI project. See Additional Configuration.
If you want to create your deployment configuration later, see Generate Deployment Configuration ABAP. If you want to create you FLP configuration later, see SAP Fiori Launchpad Configuration.
2. Continue with the development of the UI, for example, with the help of guided development. See Implement Features using Guided Development.
3. Now you can preview the generated SAP Fiori application. See Preview an Application.
4. Deploy the SAP Fiori UI by executing command npm run deploy in the terminal of your project. See Deployment to ABAP.
5. On top of these launchpad app descriptor items that are created automatically during app deployment, you may also create such objects manually in ABAP development tools for Eclipse. Refer to Creating Launchpad App Descriptor Items.
## 2. Creating and Publishing Your Identity and Access Management (IAM) App
##  Note
Prerequisites : Business catalog SAP\_A4C\_BC\_DEV\_PC is assigned to your user, which is required for development with ABAP development tools for Eclipse. See Business Catalogs for Development Tasks [page 2648].
<!-- image -->
1. To manage access to your SAP Fiori application, you have to log on as a developer in ABAP development tools for Eclipse to create an Identity and Access Management (IAM) application, assign a launchpad app descriptor item for your UI5 application and a service, and maintain authorizations (steps 1-3 in the figure above). See Creating an IAM App for the Business Service.
2. Once you have created your IAM app, you have to create a business catalog. See Creating a Business Catalog.
3. Assign your IAM app to the business catalog.
4. Publish the IAM app and business catalog locally.
## Next Step
Launch your app in SAP Fiori launchpad. See Add Your App to SAP Fiori Launchpad [page 1760].
## Related Information
## Visual Studio Code
SAP Fiori Tools
SAP Fiori Overview Tutorial: Integrate List Report into ABAP Fiori Launchpad Tutorial: Create an SAP Fiori App in Visual Studio Code and Deploy it to SAP BTP ABAP Environment
## 4.2.16.1.5  Add Your App to SAP Fiori Launchpad
Get an overview on how to add your app to SAP Fiori launchpad.
If you need further assistance with the individual steps, check out the developer tutorial Integrate List Report into ABAP Fiori Launchpad .
<!-- image -->
1. In the SAP Fiori launchpad of your ABAP system, create a business role with the Maintain Business Roles app. See Maintain Business Roles.
2. Assign a business catalog and business user to the business role. See Maintain Business Users.
3. Create a launchpad space and page. See Step by Step: Create a New Space and Page for a Business Role.
##  Note
To use this app, your user must be assigned to business catalog SAP\_CORE\_BC\_UI\_FLD .
4. Enable spaces for your user. See Enabling Spaces. Optionally, you can personalize and adapt the user interface of your app for all users. See Personalizing and Adapting Apps.
5. As a business user, you can launch the app.
## Next Step
Transport Your App
## Related Information
Transporting Changes to Spaces and Pages
## 4.2.16.1.6  Scoping Space and Page Templates
The scoping of space and page templates refers to the process of defining the visibility or accessibility of these objects.
Space and page templates are not visible in the Manage Launchpad Spaces and Manage Launchpad Pages apps in the development system by default. Meaning, they cannot be assigned or used within a business role. The space and page templates need to be scoped.
To use the space and page templates in the development system you must implement your own scoping using the scoping API (Application Programming Interface) CL APS BC SCOPE CHANGE API . It's recommended to use a console application to set the space and page template in scope.
##  Note
Please be aware that the API in the following example is not available for SAP trial accounts.
##  Sample Code
```
CONSTANTS obj_name_page  TYPE c LENGTH 40 VALUE 'PAGE_NAME' ##NO_TEXT. CONSTANTS obj_name_space TYPE c LENGTH 40 VALUE 'SPACE_NAME' ##NO_TEXT. DATA(lo_scope_api) = cl_aps_bc_scope_change_api=>create_instance( ). lo_scope_api->scope( EXPORTING it_object_scope  = VALUE #( pgmid       = if_aps_bc_scope_change_api=>gc_tadir_pgmid-R3TR scope_state = if_aps_bc_scope_change_api=>gc_scope_state-ON ( object = if_aps_bc_scope_change_api=>gc_tadir_object-UIST obj_name = obj_name_space ) ( object = if_aps_bc_scope_change_api=>gc_tadir_object-UIPG obj_name = obj_name_page ) ) iv_simulate      = abap_false iv_force         = abap_false IMPORTING et_object_result = DATA(lt_results) et_message       = DATA(lt_messages) ). LOOP AT lt_results INTO DATA(ls_result). ... ENDLOOP.
```
In non-development systems, space and page templates are scoped automatically during import into the system.
## Related Information
## Scoping Framework
## 4.2.16.2.1  Develop an SAP Fiori Application and Deploy it to Cloud Foundry Using SAP Business Application Studio
Get an overview about how to create and deploy an SAP Fiori application to Cloud Foundry using SAP Business Application Studio.
## Prerequisites
- A subaccount administrator has provided access to SAP Business Application Studio. See Setup of UI Development in SAP Business Application Studio (Optional) [page 198].
- A subaccount administrator has created a destination to the ABAP system to integrate SAP Business Application Studio. See Creating a Destination to the ABAP System for SAP Business Application Studio [page 202].
- You have created a dev space of type SAP Fiori. See SAP Business Application Studio.
- You have access to a RAP business service that has been exposed as an OData service. See Using Service Binding Editor for OData V2 Service.
## Generating and Deploying Your Application
<!-- image -->
1. Create an MTA project with approuter configuration. To do so, use the Fiori CF Application Router Generator
. See Generate an MTA Deployment File.
This generates an MTA project and the corresponding application router configuration.
2. With the SAP Fiori Generator , create an SAP Fiori application in the subfolder of the MTA file location by selecting Fiori: Open Application Generator from the command palette. See Generate an Application and Add a Fiori Application to an MTA Deployment File with the Fiori Generator.
- As a data source, select Connect to a System .
- As a system, choose the destination to the ABAP system that has been created to integrate SAP Business Application Studio.
- As a service, select your RAP business service that has been exposed as an OData service In the Project Attributes section, add an SAP Fiori launchpad configuration for your UI project. See section Add FLP configuration in Additional Configuration.
If you want to create you FLP configuration later, see SAP Fiori Launchpad Configuration.
3. Continue with the development of the UI, for example, with the help of guided development. See Implement Features using Guided Development.
4. Now you can preview the generated SAP Fiori application. See Preview an Application.
5. Build the application by executing command npm run build in the terminal of your project. See Deployment to Cloud Foundry.
This generates an *.mtar file and mta\_archives folder.
6. Log on to Cloud Foundry and deploy the SAP Fiori UI to your development space by executing command npm run deploy . See Deployment to Cloud Foundry.
##  Tip
If you can't discover an available OData service in the generator, or preview your application, check if you user is assigned to business catalog SAP\_CORE\_BC\_EXT\_TST . If you aren't authorized to deploy the application, check if business catalog SAP\_A4C\_BC\_DEV\_UID\_PC is assigned to your user.
## Related Information
SAP Business Application Studio
SAP Fiori Tools
SAP Fiori Overview
Tutorial: Create an SAP Fiori App and Deploy it to SAP BTP, Cloud Foundry environment
## 4.2.16.2.3  Integration with Approuter
You can integrate the OData service of your ABAP environment into the application by specifying a corresponding route in the xs-app.json file of the HTML5 module. The routing can be done either by providing a destination that points to the ABAP environment instance or by specifying the service endpoint of the ABAP environment and binding the service instance.
##  Note
If the application and the instance of the ABAP environment are deployed to different subaccounts, use routing via destination.
For more information about the two types of routing, navigate to Routing via Service [page 1768] or Routing via Destination [page 1771].
## 4.2.17  ABAP Service Instance URL
## Context
Previously, when creating a new ABAP Cloud project in ABAP development tools for Eclipse, a service key was necessary to connect to the SAP BTP ABAP environment. In the window Connection to an ABAP Service Instance , there was a distinction between the connection to SAP S/4HANA Cloud Public Edition and SAP BTP ABAP environment. From now on, only one option to paste in your ABAP service instance URL is available.
## Connection to an ABAP Service Instance
1. Select Create a new ABAP cloud project . This opens up a window called Connection to an ABAP Service Instance .
2. Following, you can now choose two options to connect to your ABAP service instance listed below.
1. Insert the URL from the SAP Fiori launchpad of your system.
2. If you still have a service key available, you can extract the URL from it by clicking the link shown in the description text of the window you're in: Do you have a service key? Extract the URL from the service key.
1. In this case, a new window opens up where you can paste in your service key.
2. Next, choose Copy to Clipboard .
3. Now, you are in the Connect to an ABAP Service Instance window again and can paste in the service instance URL.
4. Choose Copy logon URL to clipboard .
5. Finally, you can paste the URL into your browser and log on to the system. The message shows You have been successfully logged on and ABAP development tools for Eclipse
10. will pick up your project data.
## 4.3.1.1 Istio Module
Use the Istio module to manage and configure the Istio service mesh.
## What Is Istio?
Istio is an open-source service mesh that provides a uniform way to manage, connect, and secure microservices. It helps to manage traffic, enhance security capabilities, and provide telemetry data for understanding service behavior. See the open-source Istio documentation .
The Istio module installs and manages Istio in your Kyma cluster. By default, the Istio module is automatically added once you create a Kyma runtime instance.
## Features
The Istio module offers the following features:
- Management of Istio installation and upgrades: The module installs Istio and simplifies the process of managing its installation, reducing the complexity and time required for maintenance.
- Default Istio configuration: You can quickly have Istio installed with default settings.
- Fine-tuning capabilities: You can optimize Istio and fine-tune its settings according to specific performance or operational requirements.
- Synchronization of the data plane with the Istio control plane: This ensures that changes you make to the control plane are consistently reflected in the data plane, ensuring that the network operates consistently and reliably without any discrepancies.
- Support for the X-Forwarded-For (XFF) header: You can configure the XFF header to manage and track the source of incoming requests.
## Architecture
<!-- image -->
## Istio Operator
Within the Istio module, Istio Operator handles the management and configuration of the Istio service mesh. It contains one controller, referred to as Istio Controller.
## Istio Controller
Istio Controller manages Istio installation as defined in the Istio custom resource (CR). Istio Controller is responsible for:
- Installing, upgrading, and uninstalling Istio
- Restarting workloads that have Istio sidecar proxy injected to ensure that these workloads use the correct version of Istio
## API/Custom Resource Definitions
The istios.operator.kyma-project.io CustomResourceDefinition (CRD) describes the Istio CR that Istio Controller uses to manage the installation of Istio. See Istio Custom Resource .
## Resource Consumption
To learn more about the resources used by the Istio module, see Kyma Modules' Sizing [page 3164].
## 4.3.1.1.1.2  Enabling Istio Sidecar Proxy Injection
To include your workloads into the Istio service mesh, enable the Istio sidecar proxy injection. You can do this for either an entire namespace or a single Deployment. Learn how to perform both these operations.
## Enabling Injection for a Namespace
## Prerequisites
- You have the Istio module added. See Adding and Deleting a Kyma Module [page 3157].
- You have access to Kyma dashboard. Alternatively, to use CLI instructions, you must install kubectl .
## Context
Enabling Istio sidecar proxy injection for a namespace allows istiod to watch all Pod creation operations in this namespace and automatically inject newly created Pods with an Istio sidecar proxy.
##  Note
A Pod is not injected with an Istio sidecar proxy if:
- Istio sidecar proxy injection is disabled at the namespace level
- The sidecar.istio.io/inject label on the Pod is set to false
- The Pod's spec contains hostNetwork: true
## Procedure
- You can either use Kyma dashboard, or kubectl.
- Use Kyma dashboard.
- a. Select the namespace where you want to enable Istio sidecar proxy injection.
- b. Choose Edit .
- c. In the UI Form section, switch the toggle to enable Istio sidecar proxy injection.
- d. Choose Save .
- Use kubectl.
Replace the placeholder and run the command:
kubectl label namespace &lt;namespace-name&gt; istio-injection=enabled
## Results
You've enabled Istio sidecar proxy injection for the specified namespace. The namespace is labeled with istio-injection: enabled , which means that all Pods created in it from now on will have the Istio sidecar proxy injected.
## Enabling Injection for a Deployment
## Prerequisites
- You have the Istio module added. See Adding and Deleting a Kyma Module [page 3157].
- To use CLI instructions, you must install kubectl . Alternatively, you can use Kyma dashboard.
## Context
Enabling Istio sidecar proxy injection for a Deployment injects an Istio sidecar proxy into all the Deployment's Pods.
##  Note
A Pod is not injected with an Istio sidecar proxy if:
- Istio sidecar proxy injection is disabled at the namespace level
- The sidecar.istio.io/inject label on the Pod is set to false
- The Pod's spec contains hostNetwork: true
## Procedure
- Use Kyma dashboard.
- a. Select the namespace of the Deployment for which you want to enable Istio sidecar proxy injection.
- b. In the Workloads section, choose Deployments .
- c. Choose the Deployment.
- d. Choose Edit .
- e. In the UI Form section, switch the toggle to enable Istio sidecar proxy injection.
- f. Choose Save .
- Use kubectl.
Replace the placeholders and run the following command:
```
kubectl patch -n <namespace-name> deployments/<deployment-name> -p '{"spec":
```
```
{"template":{"metadata":{"labels":{"sidecar.istio.io/inject":"true"}}}}}'
```
## Results
You've enabled Istio sidecar proxy injection for the specified Deployment. The Deployment and all its Pods are labeled with istio-injection: enabled . All the Deployment's Pods are instantly injected with an Istio sidecar proxy.
## 4.3.1.1.1.4  Optimizing Sidecars
Configure Istio using the Sidecar resource to minimize the load and footprint.
With automatic Istio sidecar proxy injection enabled, all of your workloads' Pods get their own sidecar proxy container running next to the application. Using sidecar proxies is beneficial but also has some side effects.
## Default Behavior
By default, Istio enables communication between all the services in the service mesh. As a result, each sidecar proxy receives all the configurations for every service. The configurations contain a lot of Istio-based resource details. Also, when a service scales or a Pod restarts, the Istio control plane always propagates the configurations of all other services to Istio sidecar proxies.
If you have only a few services in your Kyma cluster, this is not a problem. However, as you start expanding your microservice architecture and the number of services grows, you can notice the following effects:
- Increased network traffic and CPU usage for the Istio control plane.
- Increased memory usage due to the growing number of configurations stored by each sidecar proxy.
- Slower changes propagation to the services in the mesh.
All these effects can be solved with the optimized usage of the Istio Sidecar resource.
## Optimization
To select which services communicate with each other, specify the configurations the proxy should get from the Istio control plane using the Sidecar custom resource (CR).
In plain language, using the Sidecar CR, you can tell the Istio control plane the following: There are 500 services in my Kyma runtime, but my application/scenario needs to access only 5. I need details only about those 5.
See the following example of the Sidecar CR configuration:
```
 Sample Code apiVersion: networking.istio.io/v1beta1 kind: Sidecar metadata: name: default namespace: my-namespace spec: egress: - hosts: - ./* - istio-system/* - kyma-system/eventing-event-publisher-proxy.kyma-system.svc.cluster.local
```
The following table presents the example egress.hosts values from the sample code and their corresponding access details.
Example egress.hosts Values
| Value                                                                     | Description                                                          |
|---------------------------------------------------------------------------|----------------------------------------------------------------------|
| ./*                                                                       | Access all services in this namespace.                               |
| istio-system/*                                                            | Access all services in the istio-system namespace.                   |
| kyma-system/eventing-event-publisher- proxy.kyma-system.svc.cluster.local | Access the eventing-event-publisher-proxy service to publish events. |
##  Tip
If you want to apply the configuration to specific workloads, configure the workloadSelector . For more information, see Sidecar in the official Istio documentation.
## 4.3.1.1.1.5  Istio Version
To track the changes introduced in the upstream Istio, learn which version of Istio the Istio module installs. To revert certain changes in Istio's behavior when you encounter compatibility issues with its new version, consider enabling compatibility mode.
The version of Istio depends on the version of the Istio module that you use. If a new version of the Istio module introduces a new version of Istio, an upgrade of the module causes an automatic upgrade of Istio. To learn which version of Istio is installed by the newest version of the Istio module, follow What's New notes.
## Compatibility Mode
Compatibility mode allows you to revert certain changes in Istio's behavior, and it is recommended only when you encounter compatibility issues with the new version of Istio. The Istio module supports compatibility with the previous minor version of Istio. For example, for the version of the Istio module that contains Istio 1.24, you can apply a compatibility version of Istio 1.23. See Compatibility Versions .
##  Caution
You can use the compatibility mode to retain the behavior of the current Istio version before a new version of the Istio module with a higher version of Istio is released. Then, the compatibility is first set to a minor version lower than the one you are currently using. If this lower version's behavior is not compatible with your current mesh setup, some configurations may be broken until the new release of the Istio module is rolled out.
To enable compatibility mode, set the spec.compatibilityMode field in the Istio CR to true.
When you set spec.compatibilityMode: true , the Istio module applies an opinionated subset of Istio compatibilityVersion variables. To learn more about the changes that specific compatibility versions revert, follow What's New notes.
## 4.3.1.1.6 Troubleshooting for the Istio Module
Troubleshoot problems related to the Istio module.
```
Network Connectivity - Basic Diagnostics [page 1806] Connection Refused Errors [page 1806] Istio Sidecar Proxy Injection Issues [page 1807] Incompatible Sidecar Version After the Istio Module's Update [page 1809] Learn which Pods you must restart manually after the Istio module's update.
```
Pods Created by Jobs Can't Finish [page 1810]
Init Containers Can't Access the Network [page 1811]
## Reverting the Istio Module's Deletion [page 1813]
Follow the steps outlined in this troubleshooting guide if you unintentionally deleted the Istio module and want to restore the cluster to its normal state without losing any resources created in the cluster.
SAP HANA Database Connection Issues [page 1814]
## 4.3.1.1.6.1  Network Connectivity - Basic Diagnostics
If you're having trouble with network connectivity and don't know where to begin troubleshooting, follow these steps. The issues may not be directly related to Istio, but could be due to misconfigured Istio resources or other cluster resources.
- Verify the state of the Istio custom resource. If it is in the Warning state, check the warning message and conditions.
- Verify that no NetworkPolicy resources affect the connectivity by blocking traffic between Pods in the service mesh. To get all NetworkPolicy resources, run kubectl get networkpolicies -A .
- The configuration of the following kinds of resources might affect the connectivity in the service mesh. Verify that these resources are configured as intended:
- DestinationRule
- PeerAuthentication
- Gateway
- AuthorizationPolicy
- RequestAuthentication
- To check for potential issues in the Istio configuration and see suggestions on how to fix them, run the command istioctl analyze -A .
- To enable the access logs of the Envoy proxy, follow the guide Envoy Access Logs . In the access logs, you can find the field response\_flags . The response flags DC (Downstream client terminated connection) and UC (Upstream terminated connection) are not within the scope of the Istio module, as they relate to the behavior of the client (DC) or the workload application (UC).
## 4.3.1.1.6.2  Connection Refused Errors
## Symptom
You get either the Connection reset by peer response or the GOAWAY response when you attempt to establish the connection between a service without a sidecar and a service with a sidecar.
## Cause
By default, mutual TLS (mTLS) is enabled in the service mesh. As a result, every element of the service mesh must have an Istio sidecar with a valid TLS certificate to allow communication.
## Solution
- To add a service without a sidecar to the allowlist and disable mTLS traffic for it, create a DestinationRule resource. See DestinationRule .
- To allow connections between a service without a sidecar and a service with a sidecar, create a PeerAuthentication resource in the PERMISSIVE mode. See PeerAuthentication .
## 4.3.1.1.6.4  Incompatible Sidecar Version After the Istio Module's Update
Learn which Pods you must restart manually after the Istio module's update.
## Symptom
After the Istio module's update, the Istio custom resource (CR) is in the Warning state, and mesh connectivity is disrupted. When you click on the warning in Kyma dashboard or run kubectl get istio default -n kyma-system -o jsonpath='{.status.description}' , you get the following message:
Some Pods with Istio sidecar injection failed to restart. To learn more about the warning, see kyma-system/istio-controller-manager logs: Istio Controller could not restart one or more Istio-injected Pods.
## Cause
The sidecar version in Pods must match the installed Istio version to ensure proper mesh connectivity. During an upgrade of the Istio module to a new version, Istio Operator's ProxySidecarReconcilation component performs a rollout for most common workload types ensuring that the injected Istio sidecar proxies are updated correctly. However, if a resource is a Job, a ReplicaSet that is not managed by any Deployment, or a Pod that is not managed by any other resource, the restart cannot be performed automatically.
You must manually restart such workloads to ensure proper functionality with the updated Istio version.
## Solution
## Use Kyma dashboard.
1. Choose Modify Modules .
2. Select the Istio module.
The ProxySidecarRestartSucceeded reconciliation condition has the status False and the reason: ProxySidecarManualRestartRequired . The message contains the list of workloads that you must restart manually, for example:
```
The sidecars of the following workloads could not be restarted: test/httpbin
```
3. Restart the listed workloads so that new Istio sidecars are injected into the Pods. The method for restarting resources varies depending on your specific use case. For standalone resources, one approach is to modify the configuration of the running Pod to initiate a restart and then revert it back to the previous configuration. Since restart issues might also be application-specific, it's recommended that you check your application's logs for more insights.
## Use kubectl.
1. To get the Istio CR, run:
2. To learn if any Pods or workloads require a manual restart, see the message in the status.conditions section of the Istio CR, for example:
3. Restart the listed workloads so that new Istio sidecars are injected into the Pods. The method for restarting resources varies depending on your specific use case. For standalone resources,
```
kubectl get istio default -n kyma-system -o yaml
```
```
- lastTransitionTime: "2025-01-23T10:02:08Z" message: 'The sidecars of the following workloads could not be restarted: test/httpbin' reason: ProxySidecarManualRestartRequired status: "False" type: ProxySidecarRestartSucceeded
```
one approach is to modify the configuration of the running Pod to initiate a restart and then revert it back to the previous configuration. Since restart issues might also be application-specific, it's recommended that you check your application's logs for more insights.
## 4.3.1.1.6.5  Pods Created by Jobs Can't Finish
## Symptom
Pods created by Jobs remain in the NotReady status after the main containers have finished.
## Cause
The istio-proxy sidecar runs as a regular sidecar container, independently of the application container. There is no mechanism that shuts down the istio-proxy sidecar when the main container completes its tasks. Consequently, the Pod is also running.
## Solution
Inject istio-proxy as a native sidecar container.
To do this, set the sidecar.istio.io/nativeSidecar annotation in the Pod template to "true" .
See the following example:
```
 Sample Code apiVersion: batch/v1 kind: Job metadata: name: test-job namespace: test spec: template: metadata: annotations: sidecar.istio.io/nativeSidecar: "true" spec: containers: - name: test-job image: alpine:latest command: [ "/bin/sleep", "10" ] restartPolicy: Never
```
This annotation instructs Istio to run istio-proxy as a native sidecar container. Then, the lifecycle of the native sidecar depends on the main application container, so istio-proxy finishes automatically at the same time as the main application container. After this, the Pod's state changes to Completed .
## Related Information
Istio Proxy as Native Sidecar Container
## 4.3.1.1.6.6  Init Containers Can't Access the Network
## Symptom
Init containers can't access the network.
## Cause
If Istio injection is enabled, the istio-proxy container intercepts all network traffic from all containers. Init containers are started before regular containers. This means that istio-proxy running as a regular sidecar doesn't work when init containers are running. As a result, init containers don't have network access.
## Solution
Inject istio-proxy as a native sidecar container.
To do this, set the sidecar.istio.io/nativeSidecar annotation in the Pod to "true" .
See the following example:
## 
```
kind: Pod metadata: name: init-container-network-check namespace: test annotations: spec: initContainers: - name: init image: curlimages/curl containers: - name: main image: alpine:latest command: ["/bin/sleep", "10"] restartPolicy: Never
```
```
Sample Code apiVersion: v1 sidecar.istio.io/nativeSidecar: "true" command: [ "curl", "httpbin.org/get" ]
```
This annotation instructs Istio to run istio-proxy as a native sidecar container. In this case, Istio injects istio-proxy as the first init container, so all containers running later are able to access the network.
## Related Information
Istio Proxy as Native Sidecar Container
## 4.3.1.1.6.7  Reverting the Istio Module's Deletion
Follow the steps outlined in this troubleshooting guide if you unintentionally deleted the Istio module and want to restore the cluster to its normal state without losing any resources created in the cluster.
## Symptom
The Istio custom resource (CR) is in the Warning state. The condition of type Ready is set to false with the reason IstioCustomResourcesDangling . T o verify this, run the command:
```
kubectl get istio default -n kyma-system -o jsonpath='{.status.conditions[0]}'
```
You get an output similar to this:
```
{"lastTransitionTime":"2024-09-26T18:23:00Z","message":"Istio deletion blocked because of existing Istio custom resources","reason":"IstioCustomResourcesDangling","status":"False","type":"Ready"}
```
##  Note
If you intended to delete the Istio module, the symptoms described in this document are expected, and you must clean up the remaining resources yourself. To check which resources are blocking the deletion, see the logs of the istio-controller-manager container.
## Cause
The Istio module wasn't completely removed because related resources still exist in the cluster.
For example, the issue occurs when you delete Istio, but there are still VirtualService resources either created by you or installed by another Kyma component or module. In such cases, the hooked finalizer pauses the deletion of Istio until you remove all the related resources. This blocking deletion strategy is intentionally designed and is enabled by default for the Istio module.
## Solution
## Use Kyma dashboard.
1. In the Cluster Details section, select Modify Modules .
2. Select the Istio module.
3. Choose Edit .
4. Switch to the YAML section.
5. To remove the finalizers from the Istio custom resource, delete the following lines:
```
finalizers: - istios.operator.kyma-project.io/istio-installation
```
When the finalizers are removed, the Istio module is deleted. All the other resources remain in the cluster.
6. Choose Save .
7. Add the Istio module again.
When you re-add the Istio module, its reconciliation is reinitiated. The Istio CR returns to the Ready state within a few seconds.
## Use kubectl.
1. To edit the Istio CR, run:
2. To remove the finalizers from the Istio custom resource, delete the following lines:
```
kubectl edit istio -n kyma-system default
```
```
finalizers:
```
```
- istios.operator.kyma-project.io/istio-installation
```
When the finalizers are removed, the Istio module is deleted. All the other resources remain in the cluster.
3. Save the changes.
4. Add the Istio module again.
When you re-add the Istio module, its reconciliation is reinitiated. The Istio CR returns to the Ready state within a few seconds.
## 4.3.1.1.6.8  SAP HANA Database Connection Issues
## Symptom
You're unable to connect an application to a SAP HANA Database instance.
## Cause
The Istio module's default configuration does not restrict outbound traffic. This means that the application should have no issues connecting to a SAP HANA Database instance. If you are experiencing issues, they may be related to the SAP HANA Database instance or your cluster configuration. To identify the source of the problem, follow the troubleshooting steps.
## Solution
## Connect to the SAP HANA Database Instance from Outside of the Cluster
1. Download SAP HANA Client for your operating system from SAP Development Tools.
2. Unpack the downloaded archive.
3. Install SAP HANA Client.
4. To connect to SAP HANA Database instance, use the following command:
```
hdbsql -n <Hana_DB_instance_adress> -u <Hana_DB_user> -p <Hana_DB_password>
```
For example:
```
hdbsql -n aaa.bbb.ccc.ddd:30015 -u my_user -p mypassword
```
If the connection is successful and you can run queries, the issue is not related to the SAP HANA Database instance.
## Connect to the SAP HANA Database Instance from Inside of the Cluster
1. Build a Docker image with the SAP HANA Client installed. You can use the following Dockerfile:
2. Download SAP HANA Client for Linux x86 64-bit from SAP Development Tools and save it as client.tar in the same directory as the Dockerfile.
3. To build the image, run the following command:
4. To test your image, run the following command:
```
FROM eclipse-temurin:17 WORKDIR /build COPY client.tar client.tar RUN tar -xvf client.tar RUN echo "/usr/local/bin" | ./client/hdbinst ENTRYPOINT ["sleep", "8000"]
```
```
docker buildx build --platform=linux/amd64 -t hdbsql .
```
```
docker run --entrypoint "hdbsql" hdbsql -v
```
You get an output similar to this example:
HDBSQL version 2.20.20.1712178305, the SAP HANA Database interactive terminal. Copyright 2000-2024 by SAP SE.
5. Publish the image to a container registry.
6. Run the image in the Kubernetes cluster:
kubectl create deployment hdbsql --image={PUBLISHED\_IMAGE\_NAME}
7. To attach to the Pod and connect to the SAP HANA Database instance, run the following command:
```
hdbsql -n {HANA_DB_INSTANCE_ADDRESS} -u {HANA_DB_USER} -p {HANA_DB_PASSWORD}
```
If the connection is successful and you can execute queries, the issue is not related to the setup of the cluster.
8. Check the connection from a Pod that has the Istio sidecar injected. To do this, create a Deployment in a namespace with Istio sidecar injection enabled.