You can manage your SAP system landscape on Google Cloud with SAP Landscape Management, Enterprise Edition (SAP Landscape Management) by installing the Google Cloud Connector for SAP Landscape Management (Connector for LaMa).
Google Cloud provides the Connector for LaMa free of charge. You must obtain all licenses that are required for SAP Landscape Management from SAP.
Installing the Connector for LaMa enables a Cloud Manager function for Google Cloud in SAP Landscape Management.
This guide does not include instructions for installing, configuring, or operating SAP Landscape Management. For information about installing and configuring SAP Landscape Management, see the latest SAP documentation in the SAP Help Portal.
For information from SAP about configuration and support of the Connector for LaMa, see SAP Note 3078321.
Operations that Connector for LaMa enables
Installing the Connector for LaMa enables the following SAP SAP Landscape Management operations on Google Cloud.
SAP System and Instance Operations
The Cloud Manager function for Google Cloud supports the following SAP Landscape Management operations at the SAP system or SAP instance level:
- SAP System/Instance prepare, unprepare
- SAP System/Instance relocation
- SAP System start, stop including virtual hosts
SAP System Provisioning Scenarios
The cloud manager supports the following SAP Landscape Management scenarios for system Provisioning:
- SAP System Clone and System Copy
- Storage-based copy procedure, which are based on snapshots of Compute Engine persistent disks
- SAP System Refresh and Database Refresh
- Storage-based copy procedure, which are based on snapshots of Compute Engine persistent disks
Creating SAP HANA System Replication Tiers
The cloud manager supports the following SAP Landscape Management scenarios for SAP HANA system replication tiers:
- Storage-based copy procedure, which are based on snapshots of Compute Engine persistent disks
Architecture
The following diagram shows the high-level architecture of SAP Landscape Management on Google Cloud.
The following diagram illustrates the SAP and Google Cloud software that is required on a managed virtual host, as well as the types of SAP applications that can be managed.
Software requirements
The following sections list the SAP Landscape Management, SAP NetWeaver, and Google Cloud software that is required for managing SAP landscapes on Google Cloud.
When you evaluate the software requirements for the Connector for LaMa, you need to consider the requirements of SAP Landscape Management, the Connector for LaMa, and the managed systems.
SAP software requirements
| Software | Requirements |
|---|---|
| SAP Landscape Management | Enterprise Edition, 3.0 Support Package (SP) 15 or later. |
| SAP NetWeaver Application Server for Java | 7.50 SP 15 or later. |
| SAP Host Agent | 7.21 PL51 or later. Support for duplicate IP addresses requires version 7.21 PL54 or later. For more information, see the SAP documentation (You need an SAP user account to access SAP Notes.): |
| SAP Adaptive Extension | S1.0 EXT PL61 or later. Support for duplicate IP addresses requires version S1.0 EXT PL65 or later. For more information, see the SAP documentation: |
Connector for LaMa software requirements
| Software | Requirements |
|---|---|
| Connector for LaMa | Version 2.3.0 or later. |
| Operation definitions and scripts |
For Linux, Connector for LaMa version 2.3.0 or later. For Windows, Connector for LaMa version 2.3.0 or later. The Connector for LaMa download package includes two
operation definitions, The operation definitions and scripts are SAP Host Agent components that enable SAP Landscape Management to activate and deactivate Virtual IP addresses in alias IP ranges in the local OS. The alias IPs and logical host names are core elements of SAP Adaptive Design. The operation definitions and scripts must be installed on each VM that is managed by SAP Landscape Management. |
| OS storage libraries for sapacosprep |
For Linux, Connector for LaMa version 2.3.0 or later. For Windows, Connector for LaMa version 2.3.0 or later. The Connector for LaMa download package includes a storage library, which is an extension of the SAP Host Agent that enables SAP Landscape Management to trigger OS-level storage operations in VM instances on Google Cloud. The storage library needs to be deployed on each Compute Engine virtual machine (VM) that is managed by SAP Landscape Management. |
Managed SAP landscape requirements
In the SAP landscape that you manage, the software and infrastructure must meet certain requirements.
Managed Google Cloud resources
The Connector for LaMa currently supports the following combinations of managed resources on Google Cloud.
To see current restrictions for the management of Google Cloud resources by SAP Landscape Management, see the section for supported scenarios or known limitations.
| Resource | Description |
|---|---|
| VM instances | Compute Engine VM instances that are supported by SAP. For the list of supported VM types, see SAP Note 2456432 - SAP Applications on Google Cloud: Supported Products and Google Cloud machine types . For VM types that are certified by SAP for SAP HANA, see the SAP HANA Hardware Directory. |
| Operating systems |
|
| Storage | Compute Engine Zonal Persistent disks (Standard and SSD):
For more information about Compute Engine persistent disks, see Persistent disks. NFS based Storage:
For information about restrictions that are related to SAP Landscape Management storage operations on Google Cloud, see Known Issues and Limitations. |
Managed SAP resources
| Resource | Requirements |
|---|---|
| SAP NetWeaver based Systems | SAP NetWeaver ABAP or JAVA:
|
| Database Servers | SAP ASE:
SAP HANA:
|
Recommendations for managed resources
Deployment recommendations:
- Deploy SAP systems to be managed by SAP Landscape Management in accordance with SAP adaptive design or enablement principles. For more information, see:
- Run SAP systems that are managed by SAP Landscape Management on Compute Engine VM instances that are certified by SAP. See:
- Run SAP HANA databases on dedicated VMs.
Network Recommendations:
- Install each SAP and database instance by using a logical hostname with a dedicated virtual IP address (VIP).
- Virtual hostnames can be resolved to VIPs for Forward and Reverse lookup.
- DNS requires A (address) records. CNAME records are not supported.
- VIPs are based on Google Cloud alias IP ranges and can be bonded to a network interface on any VM instance within a given region.
- VIPs must be activated in the OS on the primary network interface.
- Google Cloud provides the operation definitions,
AcActivateIPandAcDeactivateIP, to handle IPs in the OS.
Storage and mount point configuration:
- Configure mount points that contain the data of an SAP system or database instance only for that system or instance. Do not share the mount points with any other system on the same VM.
- Configure mount points to support the SAP Landscape Management scenarios for Prepare, Unprepare, and Relocation.
For more information, see the SAP Landscape Management documentation:
Authentication and access control for the Connector for LaMa
Google Cloud uses service accounts to identify programs like the Connector for LaMa and to control which Google Cloud resources the programs can access.
The Connector for LaMa and, by extension, SAP Landscape Management use a service account to operate within the Google Cloud environment. The Google Cloud resources that SAP Landscape Management can operate on are determined by the permissions that are granted to one or more roles that are assigned to the service account.
Required permissions for the Connector for LaMa
The service account that the Connector for LaMa uses must be granted permissions to the Google Cloud resources that the Connector for LaMa accesses.
Depending on the actions that you perform with Connector for LaMa, the minimum permissions that you grant to the service account might be different.
The Compute Admin predefined IAM role and the
Compute Engine default service account for VMs each contain
all of the permissions that the Connector for LaMa requires,
but each also contains additional permissions that Connector for LaMa doesn't
need.
For the strictest access control, create a separate, dedicated service account for the Connector for LaMa and grant the service account only the minimum permissions that are required to perform the actions that you need SAP Landscape Management to perform.
For a list of permissions that Connector for LaMa requires, see Required IAM resource permissions for the Connector for LaMa.
Service account options for the Connector for LaMa
If the Connector for LaMa is installed on a Compute Engine VM, by default, the Connector for LaMa uses the service account of the VM.
If you use the VM service account, the Connector for LaMa has the same project-level permissions as all of the other programs and processes that use the VM service account.
If SAP Landscape Management is not running on a Compute Engine VM, you must create a service account for the Connector for LaMa.
Create service accounts for Connector for LaMa in the Google Cloud project that contains the SAP systems that SAP Landscape Management manages.
When you create a dedicated service account for the Connector for LaMa, you also need to create a service account key. You copy and paste the key file contents into SAP Landscape Management when you configure the Cloud Manager for Google Cloud functionality.
When using a dedicated service account for the Connector for LaMa, rotate your keys regularly as a best practice to protect against unauthorized access.
More information about IAM
For more information about IAM service accounts, roles, and permissions, and how they are used with Compute Engine VMs, see:
- Service accounts
- Understanding IAM roles
- Service accounts on Compute Engine VMs
- Compute Engine IAM roles and permissions
Meaning of SAP Landscape Management terms for Google Cloud
The following table maps terms that are used in the SAP Landscape Management interface to their meaning on Google Cloud.
| SAP Landscape Management term | Google Cloud meaning |
|---|---|
| Cloud Manager | Google Cloud |
| Project Pool | Google Cloud Project |
| Zone Pool | Google Cloud Zone |
| Virtual Host | Compute Engine VM instance |
| Virtual Disk | Compute Engine Persistent Disk |
Supported SAP Landscape Management Scenarios and Operations
The following sections describe the SAP Landscape Management scenarios and operations that are supported in the Google Cloud environment.
Instance, system, and host operations
On Google Cloud, you can perform the following SAP instance, SAP system, and Compute Engine VM operations with SAP Landscape Management:
| Action | SAP Landscape Management operation |
|---|---|
| SAP System / SAP Instance Start including Prepare |
|
| SAP System / SAP Instance Stop including Unprepare |
|
| Starting Systems and VM Hosts |
|
| Stopping Systems and VM Hosts |
|
| SAP Application Instance Relocation |
|
| SAP Central Instance and Database Relocation |
|
| Virtual Host Operations | For more information, see Virtual Host Management Operations. |
For details about how to configure and execute the operations and for further prerequisites, see the SAP Landscape Management documentation:
System provisioning
The following tables describes the supported system provisioning scenarios that you can use SAP Landscape Management for on Google Cloud.
To deploy new VMs with SAP Landscape Management, you first need to create Compute Engine VM instance templates.
The image that you use for the instance template must include an installed and configured SAP Host Agent with all additional components, like the storage library and operation definitions and scripts.
For more information about creating instance templates, see Creating instance templates.
| System provisioning type | Supported scenario |
|---|---|
| SAP System Clone by using Compute Engine snapshots |
|
| SAP System Copy |
|
| SAP System Refresh |
|
| SAP Database Refresh |
|
For an overview of the SAP Landscape Management system provisioning concepts, see the SAP Landscape Management documentation:
For scenario specific prerequisites and requirements and for details how to configure and execute the provisioning scenarios, see the following SAP Landscape Management documentation:
Creating SAP HANA System Replication tiers
You can use SAP Landscape Management to create SAP HANA System Replication tiers subject to the following supported scenario:
- Copy of an original SAP HANA system to create a system replication tier for HANA system replication.
- Storage based copy procedure.
- Target VMs already existing.
- Mount points and storage volumes containing the database logs, data, and software are only used for the database instance and not be shared with any other instance or database.
Virtual Host Management Operations
On Google Cloud you can perform the following SAP Landscape Management virtual host management operations:
| SAP Landscape Management operation | Google Cloud action |
|---|---|
| Activate | Start a VM instance. Equivalent to issuing the gcloud
command gcloud compute instances start. For more
information, see Stopping and starting an instance. |
| Deactivate (Power off) | Stop a VM instance. Equivalent to issuing the gcloud
command gcloud compute instances stop. For more
information, see Stopping and starting an instance. |
| Resize | Change the Compute Engine machin type. Equivalent to
issuing the
gcloud command gcloud compute instances
set-machine-type. For more information, see Changing the machine type of an instance. |
For details how to configure and execute the operations and for further prerequisites, see Virtual Element Operations in the SAP Landscape Management documentation.
Known Issues and Limitations
The following sections explain the various restrictions that apply when using SAP Landscape Management with Google Cloud.
SAP Landscape Management System
With a dedicated service account configuration, you can run SAP Landscape Management outside Google Cloud; however, you need to use an appropriate hybrid connectivity solution to support your requirements for both performance and resiliency. For more information, see Choosing a Network Connectivity product.
Internet Protocol version 4 (IPv4) requirement
The SAP Landscape Management software stack requires Internet Protocol version 4 (IPv4). The Connector for LaMa installation instructions, include a step for configuring the Java Virtual Machine (JVM) to use IPv4.
To configure the JVM, you can use the Java System Properties tool of SAP Netweaver Administrator.
For more information about this requirement and configuring the JVM, see:
- SAP Note 2250890 - IPv6 addresses are used unexpectedly
- SAP Note 1888685 - Change the JVM parameter setting for NW7.1 and above releases
Compute Engine Persistent Disk
The following restrictions apply when using SAP Landscape Management to manage Compute Engine persistent disks:
- Only zonal persistent disks are supported. Regional Disks are not supported.
- Partitioning of disks to span multiple instances is not supported.
- For mount points that are managed by SAP Landscape Management:
- The
/etc/fstabfile cannot contain any entries. - Only one logical volume per volume group and one volume group per device is supported in the current version.
- All mount points that are associated with a logical volume in a volume group must be configured in SAP Landscape Management mount configuration. Any logical volume in a volume group that is not configured in the SAP Landscape Management mount configuration leads to errors during SAP Landscape Management operations like Unprepare. For more information, see Adding Mount Point Configurations.
- The
Operational restrictions
The following sections describe restrictions that apply to certain SAP Landscape Management operations and provisioning actions on Google Cloud.
Instance and system operational restrictions
The following restrictions apply to the SAP Landscape Management Prepare/Unprepare and Relocation operations on Google Cloud:
- If a mount point is busy, the unmount operation during unprepare or relocate can fail. For example, if a user that is logged on to a VM changes the working directory to a directory under a mount point that is managed by SAP Landscape Management.
- If a VM instance has an external IP address, you cannot use SAP Landscape Management to update an alias IP range. However, you can avoid this limitation if you use a second NIC for the external IP.
System provisioning restrictions
The following table shows the restrictions that apply to provisioning systems on Google Cloud with SAP Landscape Management:
| System provisioning scenario | Restrictions |
|---|---|
| SAP System Copy |
|
| SAP System Refresh |
|
| SAP Database Refresh |
|
Required IAM resource permissions for the Connector for LaMa
Grant all of the same permissions to a service account for the Connector for LaMa that a user would need to execute the same functions.
To allow stop and start actions on your managed VMs, you can assign the
Compute Admin (roles/compute.admin) role to the service account.
In production environments, follow the principle of least privilege.
If the Compute Admin role is too permissive, you can create a custom role and use the following permissions to start with:
compute.addresses.useInternal compute.disks.create compute.disks.createSnapshot compute.disks.delete compute.disks.get compute.disks.list compute.disks.setLabels compute.disks.update compute.disks.use compute.globalOperations.list compute.images.useReadOnly compute.instanceTemplates.list compute.instanceTemplates.useReadOnly compute.instances.attachDisk compute.instances.create compute.instances.delete compute.instances.detachDisk compute.instances.get compute.instances.list compute.instances.setMachineType compute.instances.setMetadata compute.instances.setServiceAccount compute.instances.setTags compute.instances.start compute.instances.stop compute.instances.suspend compute.instances.updateNetworkInterface compute.machineTypes.get compute.machineTypes.list compute.networks.use compute.projects.get compute.snapshots.create compute.snapshots.delete compute.snapshots.get compute.snapshots.list compute.snapshots.setLabels compute.snapshots.useReadOnly compute.subnetworks.use compute.zoneOperations.list compute.zones.list resourcemanager.projects.get resourcemanager.projects.list storage.objects.delete storage.objects.get storage.objects.list