Skip to content

Commit 08fedf5

Browse files
ludwig-muellersurajsbharadwaj
ludwig-mueller
and
surajsbharadwaj
authored
feat: support scc workload protection and sysdig agent installation (#791)
--------- Co-authored-by: surajsbharadwaj <suraj.bharadwaj@ibm.com>
1 parent 4588f58 commit 08fedf5

File tree

23 files changed

+197
-28
lines changed

23 files changed

+197
-28
lines changed

‎.secrets.baseline

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"files": "go.sum|^.secrets.baseline$",
44
"lines": null
55
},
6-
"generated_at": "2025-01-30T15:02:17Z",
6+
"generated_at": "2025-03-05T16:55:23Z",
77
"plugins_used": [
88
{
99
"name": "AWSKeyDetector"
@@ -102,7 +102,7 @@
102102
"hashed_secret": "2254481e1661d8f017a712b0d1ad9a14fd9460a3",
103103
"is_secret": false,
104104
"is_verified": false,
105-
"line_number": 56,
105+
"line_number": 57,
106106
"type": "Secret Keyword",
107107
"verified_result": null
108108
}
@@ -112,7 +112,7 @@
112112
"hashed_secret": "2254481e1661d8f017a712b0d1ad9a14fd9460a3",
113113
"is_secret": false,
114114
"is_verified": false,
115-
"line_number": 65,
115+
"line_number": 66,
116116
"type": "Secret Keyword",
117117
"verified_result": null
118118
}

‎ibm_catalog.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -379,7 +379,7 @@
379379
{
380380
"diagram": {
381381
"caption": "Full SAP environment provisioned on a 'Power Virtual Server with VPC landing zone'",
382-
"url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-powervs-sap/refs/tags/v3.5.2/reference-architectures/sap-ready-to-go/deploy-arch-ibm-pvs-sap-ready-to-go.svg",
382+
"url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-powervs-sap/refs/tags/v3.6.0/reference-architectures/sap-ready-to-go/deploy-arch-ibm-pvs-sap-ready-to-go.svg",
383383
"type": "image/svg+xml"
384384
},
385385
"description": "'SAP ready PowerVS' variation of 'Power Virtual Server for SAP HANA' creates a basic and expandable SAP system landscape builds on the foundation of the 'Power Virtual Server with VPC landing zone'. PowerVS instances for SAP HANA, SAP NetWeaver and optionally for shared SAP files are deployed and preconfigured for SAP installation.\n\nServices such as DNS, NTP and NFS running in VPC and provided by 'Power Virtual Server with VPC landing zone' are leveraged.\n\nThe resulting SAP landscape leverages the services such as Activity Tracker, Cloud Object Storage, Key Management and the network connectivity configuration provided by 'Power Virtual Server with VPC landing zone'."
@@ -795,7 +795,7 @@
795795
{
796796
"diagram": {
797797
"caption": "Full SAP S/4HANA or BW/4HANA environment provisioned on a 'Power Virtual Server with VPC landing zone'",
798-
"url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-powervs-sap/refs/tags/v3.5.2/reference-architectures/sap-s4hana-bw4hana/deploy-arch-ibm-pvs-sap-s4hana-bw4hana.svg",
798+
"url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-powervs-sap/refs/tags/v3.6.0/reference-architectures/sap-s4hana-bw4hana/deploy-arch-ibm-pvs-sap-s4hana-bw4hana.svg",
799799
"type": "image/svg+xml"
800800
},
801801
"description": "'SAP S/4HANA or BW/4HANA' variation of 'Power Virtual Server for SAP HANA' creates a basic and expandable SAP system landscape builds on the foundation of 'Power Virtual Server with VPC landing zone'. PowerVS instances for SAP HANA, SAP NetWeaver and optionally for shared SAP files are deployed and preconfigured for SAP installation. S/4HANA or BW/4HANA solution is installed based on selected version. \n\nServices such as DNS, NTP and NFS running in VPC and provided by 'Power Virtual Server with VPC landing zone' are leveraged.\n\nThe resulting SAP landscape leverages the services such as Activity Tracker, Cloud Object Storage, Key Management and the network connectivity configuration provided by the 'Power Virtual Server with VPC landing zone'. Additionally if a Monitoring Instance was configured in the 'Power Virtual Server with VPC landing zone' deployment, this solution will then install and enable SAP monitoring Dashboard."

‎modules/ansible/templates-ansible/configure-scc-wp-agent/ansible_configure_scc_wp_agent.sh.tftpl

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#!/bin/bash
2+
3+
### Using input variables from terraform
4+
ansible_playbook=${ansible_playbook_file}
5+
ansible_log_path=${ansible_log_path}
6+
ansible_inventory=${ansible_inventory}
7+
ansible_private_key_file=${ansible_private_key_file}
8+
9+
# Create ansible.cfg file
10+
ansible_playbook_name=$(basename $${ansible_playbook})
11+
echo -e "[defaults]\nhost_key_checking=False" >ansible.cfg
12+
export ANSIBLE_LOG_PATH=$${ansible_log_path}/$${ansible_playbook_name}.$(date "+%Y.%m.%d-%H.%M.%S").log
13+
export ANSIBLE_PRIVATE_KEY_FILE=$${ansible_private_key_file}
14+
15+
#Execute ansible playbook
16+
unbuffer ansible-playbook -i $${ansible_inventory} $${ansible_playbook} --vault-password-file password_file
17+
if [ $? -ne 0 ]; then
18+
rm -rf $${ansible_private_key_file}
19+
rm -rf password_file
20+
exit 1
21+
fi
22+
echo \"Playbook command successful\"
23+
rm -rf $${ansible_private_key_file}

‎modules/ansible/templates-ansible/configure-scc-wp-agent/playbook-configure-scc-wp-agent.yml.tftpl

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# ------------------------------------------------------------------------
2+
# This playbook installs the sysdig agent and connects it to a
3+
# Security and Compliance Center Workload Protection instance
4+
# ------------------------------------------------------------------------
5+
6+
---
7+
8+
- name: Install and connect Sysdig Agent
9+
hosts: all
10+
vars:
11+
wp_guid: "${SCC_WP_GUID}"
12+
collector_endpoint: "${COLLECTOR_ENDPOINT}"
13+
wp_api_endpoint: "${API_ENDPOINT}"
14+
access_key: "${ACCESS_KEY}"
15+
tasks:
16+
- name: Check if agent is already running
17+
ansible.builtin.stat:
18+
path: /opt/draios/logs/running
19+
register: file_exists_before
20+
21+
- name: Download Sysdig agent installation script
22+
ansible.builtin.get_url:
23+
url: https://ibm.biz/install-sysdig-agent
24+
dest: /tmp/install-agent.sh
25+
mode: "0755"
26+
when: not file_exists_before.stat.exists
27+
retries: 3
28+
delay: 20
29+
30+
- name: Install Sysdig agent
31+
ansible.builtin.command:
32+
argv:
33+
- /tmp/install-agent.sh
34+
- --access_key
35+
- "{{ access_key }}"
36+
- --collector
37+
- "{{ collector_endpoint }}"
38+
- --collector_port
39+
- 6443
40+
- --secure
41+
- true
42+
- "{{ '--universal_ebpf' if ansible_kernel is version('5.8','>=') else '--kmod' }}"
43+
- --additional_conf
44+
- "sysdig_api_endpoint: {{ wp_api_endpoint }}\nhost_scanner:\n enabled: true\n scan_on_start: true\nkspm_analyzer:\n enabled: true"
45+
when: not file_exists_before.stat.exists
46+
47+
- name: Ensure Sysdig agent is enabled and started
48+
ansible.builtin.service:
49+
name: dragent
50+
state: started
51+
enabled: true
52+
53+
- name: Wait for Sysdig agent to report as running
54+
ansible.builtin.wait_for:
55+
path: /opt/draios/logs/running
56+
timeout: 120

‎modules/pi-sap-system-type1/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ The Power Virtual Server for SAP module automates the following tasks:
3434
| <a name="module_ansible_netweaver_sapmnt_mount"></a> [ansible\_netweaver\_sapmnt\_mount](#module\_ansible\_netweaver\_sapmnt\_mount) | ../ansible | n/a |
3535
| <a name="module_ansible_sap_instance_init"></a> [ansible\_sap\_instance\_init](#module\_ansible\_sap\_instance\_init) | ../ansible | n/a |
3636
| <a name="module_ansible_sharefs_instance_exportfs"></a> [ansible\_sharefs\_instance\_exportfs](#module\_ansible\_sharefs\_instance\_exportfs) | ../ansible | n/a |
37+
| <a name="module_configure_scc_wp_agent"></a> [configure\_scc\_wp\_agent](#module\_configure\_scc\_wp\_agent) | ..//ansible | n/a |
3738
| <a name="module_pi_hana_instance"></a> [pi\_hana\_instance](#module\_pi\_hana\_instance) | terraform-ibm-modules/powervs-instance/ibm | 2.4.2 |
3839
| <a name="module_pi_hana_storage_calculation"></a> [pi\_hana\_storage\_calculation](#module\_pi\_hana\_storage\_calculation) | ../pi-hana-storage-config | n/a |
3940
| <a name="module_pi_netweaver_instance"></a> [pi\_netweaver\_instance](#module\_pi\_netweaver\_instance) | terraform-ibm-modules/powervs-instance/ibm | 2.4.2 |
@@ -63,6 +64,7 @@ The Power Virtual Server for SAP module automates the following tasks:
6364
| <a name="input_prefix"></a> [prefix](#input\_prefix) | Unique prefix for resources to be created (e.g., SAP system name). | `string` | n/a | yes |
6465
| <a name="input_sap_domain"></a> [sap\_domain](#input\_sap\_domain) | SAP network domain name. | `string` | `"sap.com"` | no |
6566
| <a name="input_sap_network_services_config"></a> [sap\_network\_services\_config](#input\_sap\_network\_services\_config) | Configures network services NTP, NFS and DNS on PowerVS instance. Requires 'pi\_instance\_init\_linux' to be specified. | <pre>object(<br/> {<br/> squid = object({ enable = bool, squid_server_ip_port = string, no_proxy_hosts = string })<br/> nfs = object({ enable = bool, nfs_server_path = string, nfs_client_path = string, opts = string, fstype = string })<br/> dns = object({ enable = bool, dns_server_ip = string })<br/> ntp = object({ enable = bool, ntp_server_ip = string })<br/> }<br/> )</pre> | <pre>{<br/> "dns": {<br/> "dns_server_ip": "",<br/> "enable": false<br/> },<br/> "nfs": {<br/> "enable": false,<br/> "fstype": "",<br/> "nfs_client_path": "",<br/> "nfs_server_path": "",<br/> "opts": ""<br/> },<br/> "ntp": {<br/> "enable": false,<br/> "ntp_server_ip": ""<br/> },<br/> "squid": {<br/> "enable": false,<br/> "no_proxy_hosts": "",<br/> "squid_server_ip_port": ""<br/> }<br/>}</pre> | no |
67+
| <a name="input_scc_wp_instance"></a> [scc\_wp\_instance](#input\_scc\_wp\_instance) | SCC Workload Protection instance to connect to. Leave empty to not use it. | <pre>object({<br/> guid = string,<br/> access_key = string,<br/> api_endpoint = string,<br/> ingestion_endpoint = string<br/> })</pre> | <pre>{<br/> "access_key": "",<br/> "api_endpoint": "",<br/> "guid": "",<br/> "ingestion_endpoint": ""<br/>}</pre> | no |
6668

6769
### Outputs
6870

‎modules/pi-sap-system-type1/main.tf

Lines changed: 42 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -50,14 +50,9 @@ locals {
5050
valid_sharefs_nfs_config = var.pi_sharefs_instance.enable && var.pi_sharefs_instance.storage_config != null ? var.pi_sharefs_instance.storage_config[0].name != "" ? true : false : false
5151
pi_sharefs_instance_nfs_server_config = {
5252
nfs = {
53-
enable = local.valid_sharefs_nfs_config ? true : false,
54-
nfs_file_system = local.valid_sharefs_nfs_config ? [
55-
for volume in var.pi_sharefs_instance.storage_config :
56-
{ name = volume.name,
57-
mount_path = volume.mount,
58-
size = volume.size
59-
}
60-
] : [] }
53+
enable = local.valid_sharefs_nfs_config ? true : false,
54+
directories = local.valid_sharefs_nfs_config ? [for volume in var.pi_sharefs_instance.storage_config : volume.mount] : []
55+
}
6156
}
6257
}
6358

@@ -170,7 +165,9 @@ locals {
170165
nfs = {
171166
enable = local.valid_sharefs_nfs_config ? true : false,
172167
nfs_server_path = local.valid_sharefs_nfs_config ? join(";", [for volume in var.pi_sharefs_instance.storage_config : "${module.pi_sharefs_instance[0].pi_instance_primary_ip}:${volume.mount}"]) : "",
173-
nfs_client_path = local.valid_sharefs_nfs_config ? join(";", [for volume in var.pi_sharefs_instance.storage_config : volume.mount]) : ""
168+
nfs_client_path = local.valid_sharefs_nfs_config ? join(";", [for volume in var.pi_sharefs_instance.storage_config : volume.mount]) : "",
169+
opts = "sec=sys,nfsvers=4.1,nofail",
170+
fstype = "nfs4"
174171
}
175172
}
176173
}
@@ -235,3 +232,39 @@ module "ansible_sap_instance_init" {
235232
dst_inventory_file_name = "${local.sap_instance_names[count.index]}-instance-inventory"
236233
inventory_template_vars = { "pi_instance_management_ip" : local.target_server_ips[count.index] }
237234
}
235+
236+
#######################################################################
237+
# Ansible Install Sysdig agent and connect to SCC Workload Protection
238+
#######################################################################
239+
240+
locals {
241+
enable_scc_wp = var.scc_wp_instance.guid != "" && var.scc_wp_instance.ingestion_endpoint != "" && var.scc_wp_instance.api_endpoint != "" && var.scc_wp_instance.access_key != ""
242+
scc_wp_playbook_template_vars = {
243+
SCC_WP_GUID : var.scc_wp_instance.guid,
244+
COLLECTOR_ENDPOINT : var.scc_wp_instance.ingestion_endpoint,
245+
API_ENDPOINT : var.scc_wp_instance.api_endpoint,
246+
ACCESS_KEY : var.scc_wp_instance.access_key
247+
}
248+
}
249+
module "configure_scc_wp_agent" {
250+
251+
source = "..//ansible"
252+
depends_on = [module.pi_hana_instance, module.pi_netweaver_instance, module.ansible_netweaver_sapmnt_mount, module.ansible_sap_instance_init]
253+
count = local.enable_scc_wp ? 1 : 0
254+
255+
bastion_host_ip = var.pi_instance_init_linux.bastion_host_ip
256+
ansible_host_or_ip = var.pi_instance_init_linux.ansible_host_or_ip
257+
ssh_private_key = var.pi_instance_init_linux.ssh_private_key
258+
ansible_vault_password = var.ansible_vault_password
259+
configure_ansible_host = false
260+
261+
src_script_template_name = "configure-scc-wp-agent/ansible_configure_scc_wp_agent.sh.tftpl"
262+
dst_script_file_name = "${var.prefix}-configure_scc_wp_agent.sh"
263+
264+
src_playbook_template_name = "configure-scc-wp-agent/playbook-configure-scc-wp-agent.yml.tftpl"
265+
dst_playbook_file_name = "${var.prefix}-playbook-configure-scc-wp-agent.yml"
266+
playbook_template_vars = local.scc_wp_playbook_template_vars
267+
src_inventory_template_name = "pi-instance-inventory.tftpl"
268+
dst_inventory_file_name = "${var.prefix}-scc-wp-inventory"
269+
inventory_template_vars = { "pi_instance_management_ip" : join("\n", [module.pi_hana_instance.pi_instance_primary_ip], var.pi_netweaver_instance.instance_count >= 1 ? module.pi_netweaver_instance[*].pi_instance_primary_ip : [], var.pi_sharefs_instance.enable ? [module.pi_sharefs_instance[0].pi_instance_primary_ip] : []) }
270+
}

‎modules/pi-sap-system-type1/variables.tf

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -221,3 +221,19 @@ variable "sap_domain" {
221221
type = string
222222
default = "sap.com"
223223
}
224+
225+
variable "scc_wp_instance" {
226+
description = "SCC Workload Protection instance to connect to. Leave empty to not use it."
227+
type = object({
228+
guid = string,
229+
access_key = string,
230+
api_endpoint = string,
231+
ingestion_endpoint = string
232+
})
233+
default = {
234+
guid = "",
235+
access_key = "",
236+
api_endpoint = "",
237+
ingestion_endpoint = ""
238+
}
239+
}

‎reference-architectures/sap-ready-to-go/deploy-arch-ibm-pvs-sap-ready-to-go.md

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,13 @@
22

33
copyright:
44
years: 2024, 2025
5-
lastupdated: "2025-02-27"
5+
lastupdated: "2025-03-18"
66
keywords:
77
subcollection: deployable-reference-architectures
88
authors:
99
- name: Arnold Beilmann
1010
- name: Suraj Bharadwaj
11+
- name: Ludwig Mueller
1112
production: true
1213
deployment-url: https://cloud.ibm.com/catalog/architecture/deploy-arch-ibm-pvs-sap-9aa6135e-75d5-467e-9f4a-ac2a21c069b8-global
1314
docs: https://cloud.ibm.com/docs/sap-powervs
@@ -16,7 +17,7 @@ use-case: ITServiceManagement
1617
industry: Technology
1718
compliance: SAPCertified
1819
content-type: reference-architecture
19-
version: v3.5.2
20+
version: v3.6.0
2021
related_links:
2122
- title: 'SAP in IBM Cloud documentation'
2223
url: 'https://cloud.ibm.com/docs/sap'
@@ -38,15 +39,15 @@ related_links:
3839
{: toc-industry="Technology"}
3940
{: toc-use-case="ITServiceManagement"}
4041
{: toc-compliance="SAPCertified"}
41-
{: toc-version="3.5.2"}
42+
{: toc-version="v3.6.0"}
4243

43-
The SAP-ready PowerVS variation of the Power Virtual Server for SAP HANA creates a basic and expandable SAP system landscape. The variation builds on the foundation of the VPC landing zone and Power Virtual Server with VPC landing zone. PowerVS instances for SAP HANA, SAP NetWeaver, and optionally for shared SAP files are deployed and preconfigured for SAP installation.
44+
The SAP-ready PowerVS variation of the Power Virtual Server for SAP HANA creates a basic and expandable SAP system landscape. The variation builds on the foundation of the VPC landing zone and Power Virtual Server with VPC landing zone. PowerVS instances for SAP HANA, SAP NetWeaver, and optionally for shared SAP files are deployed and pre-configured for SAP installation.
4445

4546
Services such as DNS, NTP, and NFS running in VPC and provided by Power Virtual Server with VPC landing zone are leveraged.
4647

4748
The transit gateway provide the network bridge between the IBM Power infrastructure and the IBM Cloud® VPC and public internet.
4849

49-
The resulting SAP landscape leverages the services such as Activity Tracker, Cloud Object Storage, Key Management from the VPC landing zone and the network connectivity configuration provided by Power Virtual Server with VPC landing zone.
50+
The resulting SAP landscape leverages services such as Activity Tracker, Cloud Object Storage, Key Management from the VPC landing zone and the network connectivity configuration provided by Power Virtual Server with VPC landing zone. Additionally, it will also setup SCC Workload Protection if the feature was enabled during the landing zone deployment.
5051

5152
## Architecture diagram
5253
{: #sap-ready-to-go-architecture-diagram}
@@ -81,6 +82,7 @@ IBM Cloud Power Virtual Servers (PowerVS) is a public cloud offering that allows
8182
|* Deploy PowerVS instance for SAP HANA workload \n * Use SAP certified configurations regarding CPU and memory combinations (t-shirt sizes) \n * Prepare operating system for SAP HANA workload | PowerVS instance | * Allow customer to specify certified SAP configuration and calculate all additional parameters automatically \n * Attach all required storage filesystems based on PowerVS instance memory size \n * Attach networks for management, backup and for SAP system internal communication \n * Connect instance with infrastructure management services like DNS, NTP, NFS \n * Perform OS configuration for SAP HANA| Allow customer to specify additional parameters, like non-standard file system sizes |
8283
|* Deploy PowerVS instances for SAP NetWeaver workload \n * Prepare operating system for SAP NetWeaver workload | PowerVS instance | * Allow customer to specify number of instances that must be deployed and CPU and memory for every instance \n * Attach all required storage filesystems \n * Attach networks for management, backup and for SAP system internal communication \n * Connect instance with infrastructure management services like DNS, NTP, NFS \n * Perform OS configuration for SAP NetWeaver | Allow customer to specify additional parameters, like non-standard file system sizes |
8384
|* Deploy PowerVS instance for hosting shared SAP system files \n * Prepare operating system | PowerVS instance | Host shared SAP system files on one of PowerVS instances for SAP NetWeaver and do not deploy a separate PowerVS instance | * Allow customer to deploy PowerVS instance with specified CPU and memory \n * Attach specified storage filesystems \n * Attach networks for management, backup and for SAP system internal communication \n * Connect instance with infrastructure management services like DNS, NTP, NFS \n * Perform OS configuration \n * Allow customer to specify additional parameters, like non-standard file system sizes |
85+
|* Optionally, enable [Security and Compliance Center Workload Protection](/docs/workload-protection) on the PowerVS instances \n * Collect posture management information, enable vulnerability scanning and threat detection|IBM Cloud® Security and Compliance Center Workload Protection, Sysdig agent on all PowerVS instances in the deployment.|Optionally, install and configure the sysdig agent on PowerVS instances in the deployment | The automation automatically picks up the configuration from the landing zone. If SCC Workload Protection is enabled in the landing zone, the Sysdig agent will be installed and configured on all PowerVS instances in this deployment. |
8486
{: caption="Table 2. PowerVS workspace architecture decisions" caption-side="bottom"}
8587

8688
### Key and password management architecture decisions

‎reference-architectures/sap-ready-to-go/deploy-arch-ibm-pvs-sap-ready-to-go.svg

Lines changed: 1 addition & 1 deletion
Loading

0 commit comments

Comments
 (0)