Skip to content

Commit 6ace02b

Browse files
v-shilsv-shils
authored
Merge pull request #252831 from KimForss/main
Control plane deployment updates
2 parents 646cb40 + 121a27c commit 6ace02b

File tree

1 file changed

+183
-48
lines changed

1 file changed

+183
-48
lines changed

‎articles/sap/automation/deploy-control-plane.md

Lines changed: 183 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -43,71 +43,94 @@ Optionally, assign the following permissions to the service principal:
4343
az role assignment create --assignee <appId> --role "User Access Administrator" --scope /subscriptions/<subscriptionID>/resourceGroups/<resourceGroupName>
4444
```
4545

46-
## Prepare the web app
47-
This step is optional. If you want a browser-based UX to help the configuration of SAP workload zones and systems, run the following commands before you deploy the control plane.
4846

49-
# [Linux](#tab/linux)
47+
## Deploy the control plane
5048

51-
```bash
52-
echo '[{"resourceAppId":"00000003-0000-0000-c000-000000000000","resourceAccess":[{"id":"e1fe6dd8-ba31-4d61-89e7-88639da4683d","type":"Scope"}]}]' >> manifest.json
49+
All the artifacts that are required to deploy the control plane are located in GitHub repositories.
5350

54-
region_code=WEEU
51+
Prepare for the control plane deployment by cloning the repositories using the following commands:
5552

56-
export TF_VAR_app_registration_app_id=$(az ad app create \
57-
--display-name ${region_code}-webapp-registration \
58-
--enable-id-token-issuance true \
59-
--sign-in-audience AzureADMyOrg \
60-
--required-resource-access @manifest.json \
61-
--query "appId" | tr -d '"')
6253

63-
export TF_VAR_webapp_client_secret=$(az ad app credential reset \
64-
--id $TF_VAR_app_registration_app_id --append \
65-
--query "password" | tr -d '"')
54+
```bash
55+
mkdir -p ~/Azure_SAP_Automated_Deployment; cd $_
6656

67-
export TF_VAR_use_webapp=true
68-
rm manifest.json
57+
git clone https://github.com/Azure/sap-automation.git sap-automation
58+
59+
git clone https://github.com/Azure/sap-automation-samples.git samples
6960

7061
```
71-
# [Windows](#tab/windows)
7262

73-
```powershell
63+
The sample deployer configuration file `MGMT-WEEU-DEP00-INFRASTRUCTURE.tfvars` is located in the `~/Azure_SAP_Automated_Deployment/samples/Terraform/WORKSPACES/DEPLOYER/MGMT-WEEU-DEP00-INFRASTRUCTURE` folder.
7464

75-
Add-Content -Path manifest.json -Value '[{"resourceAppId":"00000003-0000-0000-c000-000000000000","resourceAccess":[{"id":"e1fe6dd8-ba31-4d61-89e7-88639da4683d","type":"Scope"}]}]'
65+
The sample SAP library configuration file `MGMT-WEEU-SAP_LIBRARY.tfvars` is located in the `~/Azure_SAP_Automated_Deployment/samples/Terraform/WORKSPACES/LIBRARY/MGMT-WEEU-SAP_LIBRARY` folder.
7666

77-
$region_code="WEEU"
67+
You can copy the sample configuration files to start testing the deployment automation framework.
7868

79-
$env:TF_VAR_app_registration_app_id = (az ad app create `
80-
--display-name $region_code-webapp-registration `
81-
--required-resource-accesses ./manifest.json `
82-
--query "appId").Replace('"',"")
69+
A minimal Terraform file for the `DEPLOYER` might look like this example:
8370

84-
$env:TF_VAR_webapp_client_secret=(az ad app credential reset `
85-
--id $env:TF_VAR_app_registration_app_id --append `
86-
--query "password").Replace('"',"")
71+
```terraform
72+
# The environment value is a mandatory field, it is used for partitioning the environments.
73+
environment = "MGMT"
74+
# The location/region value is a mandatory field, it is used to control where the resources are deployed
75+
location = "westeurope"
8776
88-
$env:TF_VAR_use_webapp="true"
77+
# management_network_address_space is the address space for management virtual network
78+
management_network_address_space = "10.10.20.0/25"
79+
# management_subnet_address_prefix is the address prefix for the management subnet
80+
management_subnet_address_prefix = "10.10.20.64/28"
8981
90-
del manifest.json
82+
# management_firewall_subnet_address_prefix is the address prefix for the firewall subnet
83+
management_firewall_subnet_address_prefix = "10.10.20.0/26"
84+
firewall_deployment = false
85+
86+
# management_bastion_subnet_address_prefix is the address prefix for the bastion subnet
87+
management_bastion_subnet_address_prefix = "10.10.20.128/26"
88+
bastion_deployment = true
89+
90+
# deployer_enable_public_ip controls if the deployer Virtual machines will have Public IPs
91+
deployer_enable_public_ip = false
92+
93+
# deployer_count defines how many deployer VMs will be deployed
94+
deployer_count = 1
95+
96+
# use_service_endpoint defines that the management subnets have service endpoints enabled
97+
use_service_endpoint = true
98+
99+
# use_private_endpoint defines that the storage accounts and key vaults have private endpoints enabled
100+
use_private_endpoint = false
101+
102+
# enable_firewall_for_keyvaults_and_storage defines that the storage accounts and key vaults have firewall enabled
103+
enable_firewall_for_keyvaults_and_storage = false
104+
105+
# public_network_access_enabled controls if storage account and key vaults have public network access enabled
106+
public_network_access_enabled = true
91107
92108
```
93109

94-
# [Azure DevOps](#tab/devops)
110+
Note the Terraform variable file locations for future edits during deployment.
95111

96-
Currently, it isn't possible to perform this action from Azure DevOps.
112+
A minimal Terraform file for the `LIBRARY` might look like this example:
97113

98-
---
114+
```terraform
115+
# The environment value is a mandatory field, it is used for partitioning the environments, for example, PROD and NP.
116+
environment = "MGMT"
117+
# The location/region value is a mandatory field, it is used to control where the resources are deployed
118+
location = "westeurope"
99119
100-
## Deploy the control plane
120+
#Defines the DNS suffix for the resources
121+
dns_label = "azure.contoso.net"
101122
102-
The sample deployer configuration file `MGMT-WEEU-DEP00-INFRASTRUCTURE.tfvars` is located in the `~/Azure_SAP_Automated_Deployment/samples/Terraform/WORKSPACES/DEPLOYER/MGMT-WEEU-DEP00-INFRASTRUCTURE` folder.
123+
# use_private_endpoint defines that the storage accounts and key vaults have private endpoints enabled
124+
use_private_endpoint = false
125+
```
103126

104-
The sample SAP library configuration file `MGMT-WEEU-SAP_LIBRARY.tfvars` is located in the `~/Azure_SAP_Automated_Deployment/samples/Terraform/WORKSPACES/LIBRARY/MGMT-WEEU-SAP_LIBRARY` folder.
105127

106-
Run the following command to create the deployer and the SAP library. The command adds the service principal details to the deployment key vault. If you followed the web app setup in the previous step, this command also creates the infrastructure to host the application.
128+
Note the Terraform variable file locations for future edits during deployment.
129+
130+
Run the following command to create the deployer and the SAP library. The command adds the service principal details to the deployment key vault.
107131

108132
# [Linux](#tab/linux)
109133

110-
You can copy the sample configuration files to start testing the deployment automation framework.
111134

112135
Run the following command to deploy the control plane:
113136

@@ -119,7 +142,7 @@ export ARM_CLIENT_SECRET="<password>"
119142
export ARM_TENANT_ID="<tenantId>"
120143
export env_code="MGMT"
121144
export region_code="WEEU"
122-
export vnet_code="DEP01"
145+
export vnet_code="DEP00"
123146

124147
export DEPLOYMENT_REPO_PATH="${HOME}/Azure_SAP_Automated_Deployment/sap-automation"
125148
export CONFIG_REPO_PATH="${HOME}/Azure_SAP_Automated_Deployment/WORKSPACES"
@@ -128,16 +151,18 @@ export SAP_AUTOMATION_REPO_PATH="${HOME}/Azure_SAP_Automated_Deployment/sap-auto
128151
az logout
129152
az login --service-principal -u "${ARM_CLIENT_ID}" -p="${ARM_CLIENT_SECRET}" --tenant "${ARM_TENANT_ID}"
130153

131-
132154
cd ~/Azure_SAP_Automated_Deployment/WORKSPACES
133155

134156

135-
sudo ${SAP_AUTOMATION_REPO_PATH}/deploy/scripts/deploy_controlplane.sh \
136-
--deployer_parameter_file "${CONFIG_REPO_PATH}/DEPLOYER/${env_code}-${region_code}-${vnet_code}-INFRASTRUCTURE/${env_code}-${region_code}-${vnet_code}-INFRASTRUCTURE.tfvars" \
137-
--library_parameter_file "${CONFIG_REPO_PATH}/LIBRARY/${env_code}-${region_code}-SAP_LIBRARY/${env_code}-${region_code}-SAP_LIBRARY.tfvars" \
138-
--subscription "${ARM_SUBSCRIPTION_ID}" \
139-
--spn_id "${ARM_CLIENT_ID}" \
140-
--spn_secret "${ARM_CLIENT_SECRET}" \
157+
deployer_parameter_file="${CONFIG_REPO_PATH}/DEPLOYER/${env_code}-${region_code}-${vnet_code}-INFRASTRUCTURE/${env_code}-${region_code}-${vnet_code}-INFRASTRUCTURE.tfvars"
158+
library_parameter_file="${CONFIG_REPO_PATH}/LIBRARY/${env_code}-${region_code}-SAP_LIBRARY/${env_code}-${region_code}-SAP_LIBRARY.tfvars"
159+
160+
${SAP_AUTOMATION_REPO_PATH}/deploy/scripts/deploy_controlplane.sh \
161+
--deployer_parameter_file "${deployer_parameter_file}" \
162+
--library_parameter_file "{library_parameter_file}" \
163+
--subscription "${ARM_SUBSCRIPTION_ID}" \
164+
--spn_id "${ARM_CLIENT_ID}" \
165+
--spn_secret "${ARM_CLIENT_SECRET}" \
141166
--tenant_id "${ARM_TENANT_ID}"
142167
```
143168

@@ -163,7 +188,7 @@ You can track the progress in the Azure DevOps portal. After the deployment is f
163188

164189
---
165190

166-
### Manually configure the deployer by using Azure Bastion
191+
### Manually configure a virtual machine as a SDAF deployer by using Azure Bastion
167192

168193
To connect to the deployer:
169194

@@ -204,7 +229,7 @@ cd sap-automation/deploy/scripts
204229

205230
The script installs Terraform and Ansible and configures the deployer.
206231

207-
### Manually configure the deployer
232+
### Manually configure a virtual machine as a SDAF deployer
208233

209234
Connect to the deployer VM from a computer that can reach the Azure virtual network.
210235

@@ -251,6 +276,116 @@ cd sap-automation/deploy/scripts
251276

252277
The script installs Terraform and Ansible and configures the deployer.
253278

279+
## Securing the control plane
280+
281+
The control plane is the most critical part of the SAP automation framework. It's important to secure the control plane. The following steps help you secure the control plane.
282+
If you have created your control plane using an external virtual machine or by using the cloud shell, you should secure the control plane by implementing private endpoints for the storage accounts and key vaults.
283+
284+
Log on to the deployer virtual machine and copy the control plane configuration `tfvars` terraform files to the deployer. Ensure that the files are located in the `~/Azure_SAP_Automated_Deployment/WORKSPACES` DEPLOYER and LIBRARY folders.
285+
286+
Ensure that the `use_private_endpoint` variable is set to `true` in the `DEPLOYER` and `LIBRARY` configuration files. Also ensure that `public_network_access_enabled` is set to `false` in the `DEPLOYER` configuration files.
287+
288+
```terraform
289+
290+
# use_private_endpoint defines that the storage accounts and key vaults have private endpoints enabled
291+
use_private_endpoint = true
292+
293+
# public_network_access_enabled controls if storage account and key vaults have public network access enabled
294+
public_network_access_enabled = false
295+
296+
```
297+
298+
Rerun the control plane deployment to enable private endpoints for the storage accounts and key vaults.
299+
300+
```bash
301+
302+
export ARM_SUBSCRIPTION_ID="<subscriptionId>"
303+
export ARM_CLIENT_ID="<appId>"
304+
export ARM_CLIENT_SECRET="<password>"
305+
export ARM_TENANT_ID="<tenantId>"
306+
export env_code="MGMT"
307+
export region_code="WEEU"
308+
export vnet_code="DEP00"
309+
export storageaccountname=<storageaccountname>
310+
311+
export DEPLOYMENT_REPO_PATH="${HOME}/Azure_SAP_Automated_Deployment/sap-automation"
312+
export CONFIG_REPO_PATH="${HOME}/Azure_SAP_Automated_Deployment/WORKSPACES"
313+
export SAP_AUTOMATION_REPO_PATH="${HOME}/Azure_SAP_Automated_Deployment/sap-automation"
314+
315+
az logout
316+
az login --service-principal -u "${ARM_CLIENT_ID}" -p="${ARM_CLIENT_SECRET}" --tenant "${ARM_TENANT_ID}"
317+
318+
cd ~/Azure_SAP_Automated_Deployment/WORKSPACES
319+
320+
deployer_parameter_file="${CONFIG_REPO_PATH}/DEPLOYER/${env_code}-${region_code}-${vnet_code}-INFRASTRUCTURE/${env_code}-${region_code}-${vnet_code}-INFRASTRUCTURE.tfvars"
321+
library_parameter_file="${CONFIG_REPO_PATH}/LIBRARY/${env_code}-${region_code}-SAP_LIBRARY/${env_code}-${region_code}-SAP_LIBRARY.tfvars"
322+
323+
${SAP_AUTOMATION_REPO_PATH}/deploy/scripts/deploy_controlplane.sh \
324+
--deployer_parameter_file "${deployer_parameter_file}" \
325+
--library_parameter_file "{library_parameter_file}" \
326+
--subscription "${ARM_SUBSCRIPTION_ID}" \
327+
--spn_id "${ARM_CLIENT_ID}" \
328+
--spn_secret "${ARM_CLIENT_SECRET}" \
329+
--tenant_id "${ARM_TENANT_ID}" \
330+
--storageaccountname "${storageaccountname}" \
331+
--recover
332+
```
333+
334+
335+
## Prepare the web app
336+
This step is optional. If you want a browser-based UX to help the configuration of SAP workload zones and systems, run the following commands before you deploy the control plane.
337+
338+
# [Linux](#tab/linux)
339+
340+
```bash
341+
echo '[{"resourceAppId":"00000003-0000-0000-c000-000000000000","resourceAccess":[{"id":"e1fe6dd8-ba31-4d61-89e7-88639da4683d","type":"Scope"}]}]' >> manifest.json
342+
343+
region_code=WEEU
344+
345+
export TF_VAR_app_registration_app_id=$(az ad app create \
346+
--display-name ${region_code}-webapp-registration \
347+
--enable-id-token-issuance true \
348+
--sign-in-audience AzureADMyOrg \
349+
--required-resource-access @manifest.json \
350+
--query "appId" | tr -d '"')
351+
352+
export TF_VAR_webapp_client_secret=$(az ad app credential reset \
353+
--id $TF_VAR_app_registration_app_id --append \
354+
--query "password" | tr -d '"')
355+
356+
export TF_VAR_use_webapp=true
357+
rm manifest.json
358+
359+
```
360+
# [Windows](#tab/windows)
361+
362+
```powershell
363+
364+
Add-Content -Path manifest.json -Value '[{"resourceAppId":"00000003-0000-0000-c000-000000000000","resourceAccess":[{"id":"e1fe6dd8-ba31-4d61-89e7-88639da4683d","type":"Scope"}]}]'
365+
366+
$region_code="WEEU"
367+
368+
$env:TF_VAR_app_registration_app_id = (az ad app create `
369+
--display-name $region_code-webapp-registration `
370+
--required-resource-accesses ./manifest.json `
371+
--query "appId").Replace('"',"")
372+
373+
$env:TF_VAR_webapp_client_secret=(az ad app credential reset `
374+
--id $env:TF_VAR_app_registration_app_id --append `
375+
--query "password").Replace('"',"")
376+
377+
$env:TF_VAR_use_webapp="true"
378+
379+
del manifest.json
380+
381+
```
382+
383+
# [Azure DevOps](#tab/devops)
384+
385+
Currently, it isn't possible to perform this action from Azure DevOps.
386+
387+
---
388+
254389
## Next step
255390

256391
> [!div class="nextstepaction"]

0 commit comments

Comments
 (0)