BTP & Integrationadvanced

BTP Kyma Part 3: APIRules, Istio and Securing Workloads

Key takeaway

Secure Kyma workloads: APIRules with JWT validation against your identity provider, Istio sidecars and mutual TLS inside the cluster, authorization policies, network policies, secrets handling and namespace isolation — plus troubleshooting 401/403/503 errors.

Explanation

📌 KEY POINTS
✅ APIRules expose services and enforce access rules (e.g. JWT validation with issuer and JWKS URL).
✅ Istio sidecars provide mutual TLS between services in the mesh.
✅ Authorization policies and network policies restrict which workloads can talk to each other.
✅ Secrets come from bindings; namespaces isolate teams and apps.
⚠️ A missing sidecar (injection disabled) can break mTLS communication and cause 503 errors.

━━━━━━━━━━━━━━━━━━━━
▶ WHERE WE ARE
Part 2 deployed a service. Now security.

━━━━━━━━━━━━━━━━━━━━
▶ 1. APIRULES

Host, service, rules per path/method; JWT access.

━━━━━━━━━━━━━━━━━━━━
▶ 2. TOKENS

Tokens from IAS/XSUAA; issuer and JWKS.\n\n━━━━━━━━━━━━━━━━━━━━\n▶ 3. ISTIO & mTLS\n• Sidecar injection per namespace.

━━━━━━━━━━━━━━━━━━━━
▶ 4. POLICIES

AuthorizationPolicy, NetworkPolicy.

━━━━━━━━━━━━━━━━━━━━
▶ 5. TROUBLESHOOTING

401 (token), 403 (policy/scopes), 503 (upstream/sidecar).

━━━━━━━━━━━━━━━━━━━━
▶ STEP BY STEP

Create an APIRule with JWT access.
Call with and without a token.
Add an AuthorizationPolicy between services.

✅ CHECKPOINT: only authenticated callers and allowed services reach the workload.

Code example

ABAP Code

===== APIRule (simplified) =====spec:  host: orders  service: { name: orders, port: 8080 }  rules:    - path: /api/.*      methods: [GET, POST]      jwt:        authentications: [ { issuer: https://<tenant>.accounts.ondemand.com, jwksUri: https://<tenant>.accounts.ondemand.com/oauth2/certs } ] ===== TROUBLESHOOTING =====401 → missing/invalid token or wrong issuer | 403 → policy/scope denies | 503 → pod not ready or sidecar missingkubectl get pod -o jsonpath='{.spec.containers[*].name}'  # sidecar present?

Real project scenario

During a project connecting a Kyma service to SAP Build apps, calls failed with 401. The APIRule used the XSUAA issuer while tokens came from IAS. Aligning the issuer and JWKS URL fixed authentication.

Common mistakes

noAuth rules in prod.
Wrong issuer.
Disabled sidecar injection.
No policies.
Shared namespaces.

Best practices

JWT everywhere.
Match token issuer.
Enable injection.
Least-privilege policies.
Namespace isolation.

Interview angle

Questions: "How do you secure a Kyma API?", "What does Istio add?", "How do you troubleshoot 401 vs 403?"
Strong answer: APIRules/JWT, tokens, mTLS, policies, troubleshooting.

Practice this lesson

Quick check

1. What does Istio provide inside Kyma?

2. Calls to a Kyma API fail with 401 though users are logged in. What is a common cause?

3. Services in a namespace return 503 after enabling mTLS. What might be missing?

Interview questions

1. Calls to a Kyma API return 401/403/503 intermittently. How do you secure and troubleshoot it?

Answer it in your own words first, then compare.

2. A production issue is reported in Kyma Runtime. What would you check first, and how would you troubleshoot it systematically?