1. Kyma vs Cloud Foundry: Architectural Decision Framework

When developing side-by-side extensions under SAP Clean Core, architects must decide between SAP BTP Cloud Foundry and SAP BTP Kyma Runtime (Kubernetes):

• Choose Cloud Foundry: Standard SAP CAP (Node.js/Java) business services, low operational overhead, straightforward buildpacks, and moderate scaling requirements.
• Choose Kyma: Polyglot containerized microservices (Python, Go, Rust), custom C/C++ libraries, headless batch workloads/CronJobs, event-driven serverless functions reacting to high-volume CloudEvents, and full Kubernetes ecosystem integration (Istio, Prometheus, Grafana).

2. Anatomy of Kyma Serverless Functions

Kyma Serverless allows developers to write pure business logic without managing container build pipelines. The Kyma Serverless Controller builds and containerizes code directly inside the cluster:

apiVersion: serverless.kyma-project.io/v1alpha2
kind: Function
metadata:
  name: order-validation-service
  namespace: prod
spec:
  runtime: nodejs18
  source:
    inline:
      source: |
        module.exports = {
          main: async function(event, context) {
            console.log("Validating payload:", event.data);
            return { valid: true };
          }
        }
      dependencies: |
        {
          "dependencies": {
            "@sap/cds": "^7.0.0"
          }
        }

3. Zero-Trust Gateway Security with APIRules & Istio

Kyma exposes workloads securely via the APIRule custom resource. Rather than implementing JWT verification inside application code, the Istio Envoy proxy validates signatures against SAP Cloud Identity Services (IAS) or XSUAA:

apiVersion: gateway.kyma-project.io/v1beta1
kind: APIRule
metadata:
  name: order-service-api
  namespace: prod
spec:
  host: orders.mycorp-kyma.ondemand.com
  service:
    name: order-validation-service
    port: 8080
  gateway: kyma-gateway/kyma-gateway
  rules:
    - path: /.*
      methods: ["GET", "POST"]
      accessStrategies:
        - handler: jwt
          config:
            authentications:
              - issuer: https://mycorp.accounts.ondemand.com
                jwksUri: https://mycorp.accounts.ondemand.com/oauth2/certs

4. Consuming On-Premise S/4HANA via BTP Connectivity

Kyma workloads communicate with private S/4HANA instances through the SAP BTP Service Binding Operator. Secrets containing OAuth2 client credentials and proxy URLs are automatically mounted:

• btp-destination-service: Fetches target endpoints, mTLS certificates, and authentication tokens.
• btp-connectivity-service: Establishes secure SOCKS5 proxy tunnels through the on-premise Cloud Connector.