SAP BTP, Kyma runtime as of version 2.0 no longer comes with bundled dashboard UI. The dashboard is hosted as a central service. In order to make users aware of that change we included a migrator web application within SAP BTP, Kyma runtime. However this migrator lifecycle is also comming to an end and will be soon removed from all managed SAP BTP, Kyma runtime instances.
In this blog post I'd like to explain motivation behind removing the tool, explain impact and most of all, focus on mitigation.
Why we need to remove the migrator tool
One of the main motivations behind version 2.0 of SAP BTP, Kyma runtime was to reduce the footprint of the runtime. That is why locally hosted dashboard (a.k. a "Console" as it was exposed externally under "console" hostname ) and all related proxies were removed from the SAP BTP, Kyma runtime components in favour of centrally hosted Kyma Dashboard.
Additionally, with version 2.0 we wanted to simplify the authentication and authorisation in SAP BTP, Kyma runtime. Up until version 2.0 we were creating dedicated instances of SAP Authorization and Trust Management service per runtime and using it for authentication and authorisation. With version 2.0 we changed that and started using SAP Cloud Identity Services for authentication and native kubernetes roles and role bindings for authorisation.
Both those changes required additional tool to assist users and help with transition to SAP BTP, Kyma runtime 2.0. It not only helped with redirection to the centrally hosted UI service, but also assisted with the roles migration from the bundled SAP Authorization and Trust Management service instance.
Now, at the time when I write this blog post, version 2.5 of SAP BTP, Kyma runtime was rolled out to customers. As the authorisation mechanisms has changed 5 minor releases ago we believe it is high time to remove the already unused service instances of the SAP Authorization and Trust Management service. This meant that the migrator tool, which uses the instance to assist with roles migration, must be removed first.
Impact and Mitigation
The old "console" will no longer be exposed from your SAP BTP, Kyma runtime.
Please update your bookmarks to point to the centrally hosted Kyma Dashboard. For more information, see the Kyma Console URL Responds with Not Found 404 troubleshooting guide.
Additionally, if you have not migrated your permissions from SAP Authorization and Trust Management service yet using the migrator tool, you need to ask the Kyma runtime administrator to assign you a proper role in Kyma runtime. To learn more, visit the Forbidden Access to Kyma troubleshooting guide.
Share and Connect
In case you have additional questions please post as comment.
If you think this was helpful give us a like and share among other SAP BTP, Kyma runtime users who also may need to read this.
Thanks!
- SAP Managed Tags:
