You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sap/automation/get-started.md
+1-4Lines changed: 1 addition & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -19,12 +19,9 @@ Get started quickly with the [SAP on Azure Deployment Automation Framework](depl
19
19
20
20
- An Azure subscription. If you don't have an Azure subscription, you can [create a free account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
21
21
- Ability to [download of the SAP software](software.md) in your Azure environment.
22
-
- A [Terraform](https://www.terraform.io/) installation. For more information, also see the [Terraform on Azure documentation](/azure/developer/terraform/).
23
22
- An [Azure CLI](/cli/azure/install-azure-cli) installation on your local computer.
23
+
- An [Azure PowerShell](/powershell/azure/install-az-ps#update-the-azure-powershell-module) installation on your local computer.
24
24
- A Service Principal to use for the control plane deployment
25
-
- Optionally, if you want to use PowerShell:
26
-
- An [Azure PowerShell](/powershell/azure/install-az-ps#update-the-azure-powershell-module) installation on your local computer.
27
-
- The latest PowerShell modules. [Update the PowerShell module](/powershell/azure/install-az-ps#update-the-azure-powershell-module) if needed.
28
25
29
26
Some of the prerequisites may already be installed in your deployment environment. Both Cloud Shell and the deployer have Terraform and the Azure CLI installed.
Copy file name to clipboardExpand all lines: articles/sap/automation/plan-deployment.md
+49-37Lines changed: 49 additions & 37 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -32,23 +32,25 @@ Before you design your control plane, consider the following questions:
32
32
* How is outbound internet provided for the Virtual Machines?
33
33
* Are you going to deploy Azure Firewall for outbound internet connectivity?
34
34
* Are private endpoints required for storage accounts and the key vault?
35
-
* Are you going to use a custom DNS zone for the Virtual Machines?
35
+
* Are you going to use an existing Private DNS zone for the Virtual Machines or will you use the Control Plane for it?
36
36
* Are you going to use Azure Bastion for secure remote access to the Virtual Machines?
37
37
* Are you going to use the SDAF Configuration Web Application for performing configuration and deployment activities?
38
38
39
-
### Deployment environments
39
+
### Control Plane
40
40
41
-
If you're supporting multiple workload zones in a region, use a unique identifier for your deployment environment and SAP library. Don't use the same identifier as for the workload zone. For example, use `MGMT` for management purposes.
41
+
If you're supporting multiple workload zones in a region, use a unique identifier for your control plane. Don't use the same identifier as for the workload zone. For example, use `MGMT` for management purposes.
42
42
43
-
The automation framework also supports having the deployment environment and SAP library in separate subscriptions than the workload zones.
43
+
The automation framework also supports having the control plane in separate subscriptions than the workload zones.
44
44
45
-
The deployment environment provides the following services:
45
+
The control plane provides the following services:
46
46
47
47
- Deployment VMs, which do Terraform deployments and Ansible configuration. Acts as Azure DevOps self-hosted agents.
48
48
- A key vault, which contains the deployment credentials (service principals) used by Terraform when performing the deployments.
49
49
- Azure Firewall for providing outbound internet connectivity.
50
-
- Azure Bastion component for providing secure remote access to the deployed Virtual Machines.
51
-
- An Azure Web Application for performing configuration and deployment activities.
50
+
- Azure Bastion for providing secure remote access to the deployed Virtual Machines.
51
+
- An SDAF Configuration Azure Web Application for performing configuration and deployment activities.
52
+
53
+
The control plane is defined using two configuration files:
52
54
53
55
The deployment configuration file defines the region, environment name, and virtual network information. For example:
When planning the DNS configuration for the deployment environment, consider the following questions:
79
-
- Is there an existing Private DNS that the solutions needs to integrate with?
80
-
- Do you need to use a custom Private DNS zone for the deployment environment?
86
+
When planning the DNS configuration for the automation framework, consider the following questions:
87
+
- Is there an existing Private DNS that the solutions can integrate with or do you need to use a custom Private DNS zone for the deployment environment?
81
88
- Are you going to use predefined IP addresses for the Virtual Machines or let Azure assign them dynamically?
82
89
83
-
You can integrate with exiting Private DNS Zones by providing the following values in your tfvars files:
90
+
You can integrate with an exiting Private DNS Zone by providing the following values in your tfvars files:
Without these values a Private DNS Zone will be created in the SAP Library resource group.
98
+
Without these values, a Private DNS Zone will be created in the SAP Library resource group.
92
99
93
100
For more information, see the [in-depth explanation of how to configure the deployer](configure-control-plane.md).
94
101
95
102
96
-
97
103
## SAP Library configuration
98
104
99
-
The SAP library provides storage for SAP installation media, Bill of Material (BOM) files, Terraform state files and optionally a Private DNS Zone. The configuration file defines the region and environment name for the SAP library. For parameter information and examples, see [how to configure the SAP library for automation](configure-control-plane.md).
105
+
The SAP library resource group provides storage for SAP installation media, Bill of Material (BOM) files, Terraform state files and optionally the Private DNS Zones. The configuration file defines the region and environment name for the SAP library. For parameter information and examples, see [how to configure the SAP library for automation](configure-control-plane.md).
100
106
101
107
## Workload zone planning
102
108
@@ -106,17 +112,17 @@ The default naming convention for workload zones is `[ENVIRONMENT]-[REGIONCODE]-
106
112
107
113
The `SAP01` and `SAP02` define the logical names for the Azure virtual networks, these can be used to further partition the environments. If you need two Azure Virtual Networks for the same workload zone, for example, for a multi subscription scenario where you host development environments in two subscriptions, you can use the different logical names for each virtual network. For example, `DEV-WEEU-SAP01-INFRASTRUCTURE` and `DEV-WEEU-SAP02-INFRASTRUCTURE`.
108
114
109
-
The workload zone provides the following services for the SAP Applications:
115
+
The workload zone provides the following shared services for the SAP Applications:
110
116
111
-
* Azure Virtual Network, for a virtual network, subnets and network security groups.
117
+
* Azure Virtual Network, subnets and network security groups.
112
118
* Azure Key Vault, for storing the virtual machine and SAP system credentials.
113
119
* Azure Storage accounts, for Boot Diagnostics and Cloud Witness.
114
120
* Shared storage for the SAP Systems either Azure Files or Azure NetApp Files.
115
121
116
122
Before you design your workload zone layout, consider the following questions:
117
123
118
124
* In which regions do you need to deploy workloads?
119
-
* How many workload zones does your scenario require (development, quality assurance, production etc)?
125
+
* How many workload zones does your scenario require (development, quality assurance, production etc.)?
120
126
* Are you deploying into new Virtual networks or are you using existing virtual networks
121
127
* How is DNS configured (integrate with existing DNS or deploy a Private DNS zone in the control plane)?
122
128
* What storage type do you need for the shared storage (Azure Files NFS, Azure NetApp Files)?
@@ -125,18 +131,24 @@ For more information, see [how to configure a workload zone deployment for autom
125
131
126
132
### Windows based deployments
127
133
128
-
When doing Windows based deployments the Virtual Machines in the workload zone's Virtual Network need to be able to communicate with Active Directory in order to join the SAP Virtual Machines to the Active Directory Domain. The provided DNS name needs to be resolvable by the Active Directory.
134
+
When doing Windows based deployments the Virtual Machines in the workload zone's Virtual Network need to be able to communicate with Active Directory in order to join the SAP Virtual Machines to the Active Directory Domain. The provided DNS name needs to be resolvable by the Active Directory.
129
135
130
-
The workload zone key vault must contain the following secrets:
136
+
As SDAF won't create accounts in Active Directory the accounts need to be precreated and stored in the workload zone key vault.
| SID Service account password |[IDENTIFIER]-[SID]-svc-sidadm-password | DEV-WEEU-SAP01-W01-svc-sidadm-password |
144
+
| SQL Server Service account |[IDENTIFIER]-[SID]-sql-svc-account | DEV-WEEU-SAP01-W01-sql-svc-account |
145
+
| SQL Server Service account password |[IDENTIFIER]-[SID]-sql-svc-password | DEV-WEEU-SAP01-W01-sql-svc-password |
146
+
| SQL Server Agent Service account |[IDENTIFIER]-[SID]-sql-agent-account | DEV-WEEU-SAP01-W01-sql-agent-account |
147
+
| SQL Server Agent Service account password |[IDENTIFIER]-[SID]-sql-agent-password | DEV-WEEU-SAP01-W01-sql-agent-password |
138
148
149
+
#### DNS settings
139
150
151
+
For High Availability scenarios a DNS record is needed in the Active Directory for the SAP Central Services cluster. The DNS record needs to be created in the Active Directory DNS zone. The DNS record name is defined as '[sid]>scs[scs instance number]cl1'. For example, `w01scs00cl1` for the cluster for the 'W01' SID using the instance number '00'.
140
152
## Credentials management
141
153
142
154
The automation framework uses [Service Principals](#service-principal-creation) for infrastructure deployment. It's recommended to use different deployment credentials (service principals) for each [workload zone](#workload-zone-planning). The framework stores these credentials in the [deployer's](deployment-framework.md#deployment-components) key vault. Then, the framework retrieves these credentials dynamically during the deployment process.
@@ -145,22 +157,22 @@ The automation framework uses [Service Principals](#service-principal-creation)
145
157
146
158
The automation framework will use the workload zone key vault for storing both the automation user credentials and the SAP system credentials. The virtual machine credentials are named as follows:
0 commit comments