Object Store | Setting up Object Store on a Kyma environment

[SilviaPedroso]

Object Store on SAP BTP service is available on the Kyma environment for SAP external customers that want to leverage this storage service on the Kyma environment.

Object Store on SAP BTP lets you store and manage objects involving creation, upload, download, and deletion. This service is specific to the IaaS layer such as Azure, Amazon Web Services, and Google Cloud Platform via AWS S3 buckets, Azure Blob container or Google Cloud Storage buckets.

SAP BTP, Kyma runtime is a fully managed Kubernetes runtime based on the open-source project "Kyma". The offered functionality ensures smooth consumption of SAP and non-SAP applications, running workloads in a highly scalable environment, and building event- and API-based extensions.

By having Object Store on SAP BTP available on the Kyma environment customers can leverage Kyma’s fully managed Kubernetes cluster and eliminate overhead such as infrastructure management and maintenance effort.

Currently Object Store on Kyma environment is available for AWS and Azure, GCP will follow.

Before starting to use the service ensure you have carried out the prerequisites below

Prerequisites:

• You need to have a global account on SAP BTP Cockpit (refer to Getting a Global Account)


• Create a subaccount on SAP BTP (refer to Managing Subaccounts Using the Cockpit)


• Enable Kyma within your SAP BTP Cockpit Subaccount (refer to Create the Kyma Environment Instance)


• Ensure that you have enough quota to add Object Store entitlements to your environment (refer to AWS entitlements and Azure entitlements)

Validate that Kyma is enabled on your subaccount

Validate that within your subaccount (1) you can see the Kyma tab enabled (2). If this is not the case refer to Create the Kyma Environment Instance in order to enable your Kyma environment.

Add Object Store entitlements to your Kyma environment

Within your subaccount, navigate to the entitlement tab > select ‘Configure Entitlements’> followed by ‘Add Service Plan’. Search for ‘Object Store’ and select the Object Store service plan desired, for more information on which service plans are available and their limits refer to AWS Service Plans and Azure Service Plans.Add the service plans to the subaccount, to validate you may check that the entitlements are available to be used under ‘Entitlements’ > Object Store.

You are now ready to deploy an Object Store instance in this subaccount

Go to your SAP BTP Cockpit and select the subaccount where your Kyma environment is enabled. Select the console URL link (3).Firstly, within the Kyma dashboard you need to create a new namespace, once created go to ‘Service Management’ > ‘Service Instances’ and select ‘Create Service Instance’ (7).

Please note:

• To create a service instance on Kyma, consider which service plan of Object Store you wish to consume.


• You will need to provide the following information:

Field	Value
Name	<name of your choice>
Offering Name	objectstore
Service Plan Name	<Service plan of your choice>

Validate the service instance was created successfully

Once you have created your instance successfully you will be able to see it within SAP BTP Cockpit by navigating to ‘Services’ > ‘Instances and Subscriptions’ within the instance subsection your new instance will appear.

Creating a service binding within your Kyma environment

Within the Kyma Dashboard, navigate to your newly created instance and select ‘Create Service Binding’.Provide the following information and select ‘Create’:

Field	Value
Name	<name of your choice>
Service Instance Name	<select your previously created instance from the drop down>

Once created, the status will be shown as ‘Provisioned’Validate the service binding was created successfully

Within the SAP BTP Cockpit your instance will now show your new service binding, click within it for more information.You have now successfully added an Object Store instance to your Kyma environment.

To connect to your newly created Object Store instance you need to access the instance credentials, you can extract and decode this information from your binding on your Kyma dashboard

Within your Kyma dashboard you can access the ‘access_key_id’ and ‘secret_access_key’ of your Object Store instance. Navigate to your service binding (1) and select the service binding name hyperlink (2)Select the ‘Secret Name’ hyperlink, here you will have the ID of the bucket created and the credentials needed to access your Object Store instance. The initial screen is coded, thus select the ‘decode’ button (3) to see the values decoded.

Now that you have your credentials, take a note of the access_key_id, secret_access_key and bucket you will need this in the following steps.Connect to your Object Store instance

As an example we will connect to our AWS Object Store instance, upload a document onto our bucket and validate that the document is within the bucket.

Using AWS CLI (for more information on how to obtain CLI please refer to AWS CLI or Azure CLI) to connect to the instance, open your terminal window (cmd) and execute the below command.

aws configure

You will be prompted to provide the following information:

Field	Value
AWS Access Key ID	<AWS access key id decoded from Kyma dashboard>
AWS Secret Access Key	< AWS Secret Access Key decoded from Kyma dashboard >
Default Region name	<Your subaccount region>
Default output format	Json

You have successfully connected to your instance

To upload an Object into our Object Store bucket, start by validating the path of the file you wish to upload and ensure that you are in the correct directory on your cmd console. Then use the following command:

aws s3 cp <your file> s3://<your bucket>

You will receive an upload response on your cmd console.

In order to confirm the upload is successful or to confirm which files are within your bucket you can use the following command:

aws s3 ls s3://<your bucket>

Congratulations! You have now successfully connected and uploaded files into your Object Store instance and are ready to start using it for your development.

Relevant sources of information:

• For detailed information on Object Store on SAP BTP, hyperscaler option service, please check SAP Help.


• For information on Object Store pricing and commercial options and regions, please check SAP Discovery Center


• For additional details on Kyma set-ups please access the SAP Help portal and also have a look at the video series provided in the following Kyma blog.


• If any Object Store errors occur, please open a ticket in the component BC-CP-CF-OSAAS.

Thank you,

SAP BTP Backing Services – Product Management

[quovadis]

Hello @silvia.pedroso,

Thank you for this informative blogpost.

As instructed I went to the official documentation where I can read one can have a hundred of service instances per a given BTP sub-account but there is a hard limit of up to 5 service keys/bindings.

So what about service instance sharing from a kyma runtime environment ?

One can have easily a dozen or more namespaces with microservices using object store service instances.

So where is the hard service bindings limit coming from ?

Furthermore, what is advice towards sharing of object store service instances as obviously with the hard limit of 5 service bindings there can be no more than 5 objectstore service instances?

Thank you.

PS. the help page with the hard limit of 5 service keys

[1941971361]

Hi piotr.tesny

Thank you for reaching out!

Regarding the instances quota, irrespective of the environment, the quota of 100 applies to a subaccount in BTP Cockpit. Of course, you can always request an increase of the quota.

Regarding instance sharing across subaccounts/namespaces, that is not supported. You would need to find a way to make the credentials available from one space to another, in order to access the instance from different spaces.

Regarding the bindings limit, the binding limit is the sum of the number of applications bound to a single objectstore instance and the number of service keys created for the same instance.

In case you need to have over 5 bindings, you may then rather create a service key and using the same create a user-provided-service. Then you would be able to bind higher number of your applications to the same user-provided-service. For further details, you may please refer: Steps to create instances and bindings.

Thanks & Regards,

Swati Jain

[quovadis]

Thank you 1941971361 for the heads up.

Regarding the bindings limit, the binding limit is the sum of the number of applications bound to a single objectstore instance and the number of service keys created for the same instance.

Does it mean the limit for service keys and bindings is up to 500 (five hundred) per sub-account assuming the default max of one hundred service instances ?

If this is the case would you please make it prominent in the above documentation?

Could could you please re-confirm that yes this five service keys/bindings per a single objectstore instance thus making this up to 500 per BTP sub-acount ?

In case you need to have over 5 bindings, you may then rather create a service key and using the same create a user-provided-service

A user-provided service is a mechanism that applies to CF runtime environment only.

My question was about the instance sharing between namespaces with the BTP Kyma runtime environment rather.

And then what about the credentials rotation ? This works out-of-the-box with the btp service operator with k8s/kyma runtime environments provided a service binding can be created. When you start sharing credentials this mechanism no longer applies.

Thus, the only reasonable way to achieve the instance sharing and the credentials rotation is when the objecstore service starts to support the service instance sharing mechanism of the BTP service manager. I'd be keen to know when this service manager based mechanism could be implemented with the objectstore service.

kind regards; Piotr