v3.19.0.0

[hdamecharla]

SDAF 3.19.0.0 — Release Notes

Release: March 2026 | Terraform: 1.14.6 | Repository: Azure/sap-automation

---

What's New

HANA Scale-Out & High Availability

This release delivers the most substantial iteration yet on HANA scale-out Pacemaker support, with a focus on correctness and operational reliability in multi-node topologies.

• SAPHanaSR-angi support is now enabled for SLES-based HANA scale-out deployments, including automated hook registration for the HANA controller.
• Pacemaker cluster configuration now conditionally moves the SAP HANA clone to the primary node, gated on both the instance name and the Pacemaker package version — preventing erroneous resource movement in heterogeneous environments.
• Scale-out tasks now execute StartSystem and StopSystem on both sites, with HANA stop/start operations conditionally applied per node based on instance name.
• The meta failure-timeout parameter has been added to Pacemaker configuration for improved cluster stability under transient failures.
• global.ini checks and configuration steps are now included in the scale-out provisioning flow, with cleanup logic to remove the flag when the cluster was not created by the automation framework.
• HANA replication stabilization now uses an increased retry count, with explicit clear host errors tasks added to guard against stale cluster state.

Azure Files NFS (AFS) — Encryption in Transit

• A new AFS_enable_encryption_in_transit parameter has been introduced across sap_landscape and sap_system Terraform modules, enabling NFSv4.1-based encrypted mounts for Azure Files shares.
• NFS mount options are now set conditionally based on the fstype variable, with nolock removed from AFS mount configurations where it is incompatible.
• Export policy rules on Azure NetApp Volumes now dynamically derive the allowed client address space from the virtual network, replacing previously hardcoded values.
• HTTPS traffic enforcement is scoped correctly: enabled for general Azure Storage Accounts, disabled specifically for SAP mount storage accounts.

Oracle Data Guard

• The primary instance mount step is now correctly sequenced before the database open operation, resolving a reliability gap in Data Guard setup.
• Post-processing tasks have been refactored to include explicit database open mode checks and zombie standby process cleanup, improving idempotency.
• Listener and tnsnames configuration is streamlined in the Data Guard preparation phase.
• The RUNINSTALLER media path and MOPatch directory references have been corrected across installation tasks.
• Dynamic SID handling is now applied in Oracle installation environment variable setup.

---

Platform Additions

Platform	Detail
Red Hat 10.0	Base and HA images added to VM-Images.json
Indonesia Central	Region support added across configuration files, scripts, and Helper.cs

---

Infrastructure & Terraform

• Terraform upgraded to 1.14.6 across all scripts, pipelines, and configuration references.
• Azure and Microsoft.Identity package versions updated.
• The azurerm provider configuration now conditionally sets use_msi and use_spn, with a corresponding conditional export of TF_VAR_use_spn for GitHub Actions workflows using MSI.
• A typo in role_assignments.tf resource references has been corrected.
• Role assignment scope and principal ID for HANA DB nodes have been fixed.
• The Terraform plugin cache directory ownership is now corrected during deployer creation, resolving a permission failure on first-run provisioning.
• HANA shared storage account and private endpoint logic has been significantly refactored to correctly handle single vs. multiple HANA shared scenarios, with version-gated count logic (version >= 19) and corrected index references throughout.
• Dynamic identity block added for the Azure Linux VM observer to support managed identities.

---

Ansible & OS Configuration

SUSE / zypper

• zypper repository installation now uses community.general.zypper with auto_import_keys and disable_gpg_check to resolve GPG-related hang issues in automated pipelines.
• ZYPP_LOCK_TIMEOUT is now set to 60 for package installation and refresh tasks.
• Microsoft GPG public keys are downloaded and imported for both RHEL and SUSE before repository configuration.
• Microsoft Production repository URLs have been corrected and standardised across RHEL and SLES versions.
• aznfs package entries removed from os-packages.yaml; Microsoft Production repository entries removed from repos.yaml where they were causing conflicts.
• SUSE subscription handling now supports BYOS/BYOL images with updated activation commands for public cloud extensions.
• New parameters for SUSE subscription ID and disk controller types added to SystemModel and related files.

Red Hat

• passlib installation has been refactored to use the OS package manager with a pip fallback, now running correctly for all OS families.
• compat-openssl11 and libcanberra-gtk2 packages commented out due to compatibility concerns.
• compat-sap-c++ package specification updated to use a wildcard for version matching.
• RHEL package installation tasks refactored for clarity and idempotency.

General

• NVMe swap dependency installation added for both RHEL and SUSE in swap configuration tasks.
• Installation logs are now persisted as pipeline artifacts.
• SYSTEM_ACCESSTOKEN parameter added to Ansible run configuration for enhanced ADO authentication.
• SAP password generation suffix character set expanded to include additional special characters.

---

BOM Processing

• BOM registration now appends patch information and handles missing patch definitions with improved logging.
• BOM download conditions include platform checks to ensure correct extraction per OS target.
• Platform code handling added to the BOM template with updated product ID formatting.
• Conditional BOM object display added based on operation type.

---

Networking & Greenfield / Brownfield

• Virtual network subnet ID resolution now correctly accommodates both greenfield (defined) and brownfield (existing) network segments, resolving issue #1010.
• Key Vault duplicate role assignment conflict in the workload zone has been resolved (#998).

---

VM Naming

• Name override logic now standardises virtualmachine_names values to a list of strings.
• Generator-produced values correctly override blank JSON keys.
• Original naming generator output is preserved when keys are missing in the name override JSON.

---

Removed

• SAP CAL Integration has been decommissioned. All associated variables have been removed from sap-parameters.yml and related resources.
• The AFS_enable_encryption_in_transit variable has been removed from LandscapeTemplate.txt and LandscapeModel (superseded by the proper Terraform variable path).

---

Bug Fixes

Area	Fix
ADO WorkloadZone setup	Resolved multiple silent failure bugs; improved error handling and logging in New-SDAFADOWorkloadZone
Service Principal login	Fixed az login for SPN-based authentication
Conditional state path	Corrected conditional nesting for state_path assignment in installer script
HANA cluster resource move	Fixed condition checking primary instance name for SAP HANA clone movement on RedHat
NFS options	Updated NFSv4.1 condition check in AFS configuration
AFS mount formatting	Fixed nfs_fs_type formatting and mount options in AFS mount tasks
Microsoft repo URL	Corrected RPM download URL for Microsoft packages repository on both RHEL and SUSE

---

---

This discussion was created from the release v3.19.0.0.