Being "Cloud" one of today’s buzz words, that is also shaking-up
the SAP world alongside HANA, I’ve come across many customer with a strong “antagonism”
to any topic with “cloud” on the title.
I see as a root cause to this antagonism, the huge confusion
created by all the players that want to be in this market, whom call “cloud” to
everything that moves in their portfolio in their struggle to be relevant.
So, when talking with CIOs, Enterprise Architects and other
IT leaders, I see still lots of misunderstanding in relation to “all things
Cloud for SAP”.
In this blog, I’ll make a brief definition of my
understanding of “Cloud”, to then use this definition to do a high level discussion
on “what is the right cloud model for each company and business scenario”.
Note that you’ll see that my discussion is generic from a
pure cloud perspective, and not very “HANA” specific. The point here is that,
all I’ll be discussing in this blog post, can be part of a datacenter wide
strategy discussion on which SAP HANA today definitely fit in as well.
SAP HANA is becoming increasingly normal, and so you should
consider it as an integral part to your cloud strategy.
I know there are certain limitations in regards to “very
huge” HANA systems. But when talking with customers with 70 and more productive
systems with full landscapes of more than 300 SIDs, and many multi-terabyte
databases, the ones that require special attention are usually less than 10%. So, you
can set a rule for the other 90+ %, and then deal with the exceptions.
Let me tell you as well, that I’ve seen companies looking at
those huge SAP HANA systems first and using them to define the standard, and it
has led to massive costs that could have been avoided. But talking on the
benefits of standardization of IT would be another conversation I’ll leave to
another occasion!
What is "Cloud"?
So, let’s get to it and start putting some names on the “things”.
In fact, Cloud is a buzz word subject to many miss understandings
today, and due to that may not be “the first option” many organizations around
the world would think of.
Although the “Cloud” buzz word is relatively new, the
concept has been around for many years, and it’s all about industrialization of
IT.
Looking beyond the noise and the smoke, indeed Cloud not
being new, it is indeed real today.
I remember presenting at conferences for another company
many years ago about “industrialization of IT” where I knew that what I had was
a reference architecture, and that everything would have to be custom built through
massive consulting projects. This is no longer the case today.
And industrialization of IT is real because today we have
the technologies that indeed enable to manage IT as a Service at its multiple
levels.
Hardware has evolved to be able to be managed and configured
by software, and most components in the IT stack provide scripting interfaces
that enables “automation tools” to manage them.
This discussion has been becoming increasingly confusing for
customers because each provider organization abuses the “cloud” word to positon
themselves as relevant despite their disparate maturity, standardization,
automation, geographic coverage and competitive positioning.
Among the miss understandings of “cloud” there are 2 I
consider fundamental to overcome:
- That once a workload is virtualized, it is
already in some sort of cloud;
- And the idea that cloud is only “public cloud”.
Just Virtualizing Systems is not Cloud !!!
Let me then start setting some foundations by making a
reference to the U.S. National Institute for Standards and Technology
(N.I.S.T.). This organization came up with a definition of cloud, to which all
players in the market can refer to, so enabling cloud customers to have a
framework through which evaluate their candidate providers in terms of
completeness of offerings.
If you read through the N.I.S.T. definition of cloud
computing, it clearly identifies what are the essential characteristics needed
to be in place, so that you can call something “cloud”:
- On-demand self-service;
- Broad network access;
- Resource pooling;
- Rapid elasticity;
- Measured service.
You can read more about them both on the N.I.S.T.
documentation and on other documents available in the internet.
From these characteristics you can evaluate that they imply
a more comprehensive scenario than just virtualizing applications.
Virtualization can indeed be a key enabler of cloud as it enables for example
“rapid elasticity” and “resource pooling”, but to be in face of a cloud, you’ll
also need a significant level of automation.
Indeed, automation is a key component to any real cloud. If
you look at it, Information Technologies came with the promise of automating
the business processes of organizations, but the management of the IT systems
has been quite manual. In fact, for most organizations around the world (end
customers and service providers alike), the cost of labor is one of the biggest
items in IT operating expenses.
So, "Cloud" is all about bringing to IT what IT brought to
business processes many years ago: minimize the human intervention in regular
IT operations. The benefits from this reduction of human intervention has been
realized for many years in the manufacturing industries, having demonstrated to
reduce defects, improve response times, reduce operating costs and simplifying
change.
These levels of automation are implicit in characteristics
like “on-demand self-service”, where it is assumed that there will be no manual
work behind a “self-service portal”, as it would be fully orchestrated and
automated through workflows.
For me a “cloud” that is hosted at a service provider, but
that behind the “portal” has a lot of manual work, and because of that
has expensive costs and low response times, is not a cloud. Although many service
providers around the world advertise cloud offerings for SAP HANA that indeed in the
background operate in this way. They will always fall short on the expectations
created by the “true cloud players”.
Another key characteristic of cloud is to have a “measured
service”, as this is a key characteristic to enable your organization to run IT
as a Service, and become an IT services broker to your business organizations.
This would for example enable to, when a business user comes
to you asking for a system to start a new project, to check your “private cloud”
and “public cloud” costs, security, service levels and response times, and give
an the best option to the business user based on the business scenario he will
be implementing. Here is where I believe IT really becomes a partner to
business organizations in driving innovation and further organizational
agility.
I believe we can agree at this stage that “virtualization”
and “cloud” are not synonyms. Virtualization is definitely a key ingredient to
build efficient clouds, but is not “cloud” just by itself.
Cloud is not only “Public” Cloud – look for
Private and Hybrid as well.
The clarification for the second myth we’ve referred above comes
from the N.I.S.T. definition of Cloud Computing as well.
In that document there are also described the “Cloud Service
and Delivery Models”.
In terms of service models, N.I.S.T. defines the following:
- Software as a Service
- Platform as a Service
- Infrastructure as a Service
And in terms of delivery models, the following are defined:
- Private cloud;
- Community Cloud;
- Public Cloud;
- Hybrid Cloud.
Again, not being my goal to dive deep on the NIST definition (as you can read all about it online), the point here
is that private IT organizations can work in a “cloud operating model”,
delivering a Private Cloud to their business organizations with similar
characteristics to public cloud offerings.
To do this, what private organizations need is access to the
infrastructure components, tools and know how on the processes used by leading
public cloud providers. And this is available today!
I’m pleased to have gotten to know some IT organizations
that “got their act together” and stepped it up to be competitive in terms of
agility and quality of service with public cloud providers! In the end it’s all
about the people.
But there is another choice coming strong to market, that
might bring together the best of two worlds: what if the “public cloud provider”
offered his services to manage a private cloud hosted on your premises (under
your full span of control) in the same way it manages his public cloud?
This is what I call the “managed private cloud”.
The point here: cloud is not only public cloud. It’s all
about a service model around automation of IT.
I believe then, that we can agree that accepting this
definition, “cloud” must indeed be part of every IT organization’s strategy
discussions.
Should I go IaaS, PaaS or SaaS? Soo many “aaS” is so confusing...
Now, looking at the NIST defined service models, what is the
right one for each of your business processes / application stacks /
organizations?
Let me share what I’ve learned on this topic from working in
IT operations myself, and participating in many interesting discussions with
the leaders of those IT organizations.
Many organizations look to differentiate themselves through
the usage of information. This makes it that an increasing number of
organizations see “code development” capabilities increasingly as a core competence
as it provides them the capability to manage and analyze information. In the
information age, being able to rapidly turn information into actionable
insights to the business is a key competitive differentiator.
On the same side, there are also organizations that struggle
to get the skills they need at this level, and see themselves many times
hostages of “under-performing” IT teams. This has led in many cases to top
management decisions to embark on “comprehensive outsourcing deals”, which we’ve
seen as very popular through the late 90’s and early 2000’s, as they expected
the outsourcer to solve the problems they haven’t been able to solve
themselves.
History has shown that most of these comprehensive
outsourcing deals apart from the short term financial impact of turning CAPEX into OPEX and providing a cash injection, have come short on most operational, innovation and strategic expectations.
So, externalization of IT functions, being through
Outsourcing or Cloud, has been a tool in the hands of CEOs, CFOs, CIOs and in
general C-level executives as a way to solve many different problems
(strategic, financial, etc), including IT skills and processes problems.
I have worked both on architecting solutions for these “old
large outsourcing contracts” as well on the delivery of those contracts, and I
have a ton of stories to tell on my learnings from it.
But the point is that these problems haven’t gone away, and
still exist in many organizations.
So choosing between SaaS, PaaS and IaaS may also align to
where the problem lies in the customer’s IT organization.
I would say that a decision to adopt IaaS, PaaS or SaaS
should be based fundamentally on the business scenario to be supported. But I
have to acknowledge that on the board room, this is not the only discussion
argument.
This is why I say that SaaS may be a way to solve your
problems when functional and development teams do not deliver. By going SaaS
you externalize all of that to the provider. Of course this should be balanced
with an analysis of the application, as going to a SaaS model would be a good
fit if the application has mainly standard requirements across the company’s
industry.
As for PaaS, apart from providing pervasive access to a
development platform, it might be looked as well as a way to cover poor
capabilities of DB and OS admin teams, as that would be in the responsibility
of the provider.
Remember, these are just examples of discussions I’ve
observed, and I believe it is important to put the SaaS/PaaS/IaaS options in
perspective.
Associate this previous aspect with the fact that in many
parts of the world there are severe technical and regulatory limitations to a
public cloud model, and the scenario of implementing a IaaS private or hybrid
cloud model is in fact the most accepted one for business critical applications.
I see this today, and foresee it will stay like this for the coming years.
What is the right cloud delivery model for
my Business Critical applications?
So what kind of a cloud will you’ll be putting each of your
workloads on?
Will everything be public?
It depends on the specifics of each customer / country and
use-case, and the following metrics should provide you a good guidance on how
to decide: Economics; Trust; Functional.
For example:
- Where is more economic to run this workload? On the public cloud or on my private cloud?
- As internal IT usually does not have a profitability goal, the end cost for the company may be lower running it on-premise. But on the other side, in many occasions private IT organizations do not have either the scale or the most efficient operating model, making it then more costly in the long run. Not all companies are alike, so the result of this evaluation is absolutely unique to each customer scenario.
- What confidentiality and compliance requirements are applicable to this business process/application? It is subject to data sovereignty regulations, or other risk related regulations like "Sarbanes/Oxley" or "Basel"?
- Not all countries have the same regulation, and each organization manages business in a different and unique way. There may be scenarios that either industry, country or corporate regulations impose certain restrictions on "data placement". Also the risk profile of each company defines their approach to risk, and their evaluation on probability, impact and acceptable risk containment/management practices.
- Does the public could provider provide functionality that maps to the unique needs of the organization?
- There are business processes in organizations that are quite standard in the industry, leading to look at application adoption as a way to have access to standard and updated industry best practices. There are as well situations where the business processes and functional requirements are very unique or custom to the organization, being even a unique source of competitive differentiation, situation in which most likely a standardized public cloud offering may not be a good fit.
Again, this is just an example of a reflection, and if you look at this, you can realize that most likely you'll find workloads suitable to public cloud offerings, and other that will be subject to more restrictive conditions.
Apart from this, we have to remember as well that not all the world has today cheap
and stable high bandwidth connectivity, and that the increased news on data
privacy violations and questionable access by public entities to private data, makes it
that many organizations see themselves in the cross-roads of making careful
decisions of what should be placed under the organization’s direct span of
control (the private cloud), and what is acceptable to be put in a fully public
environment.
Let me share one example provided by one customer I met some
weeks ago on his reasoning of what we could place on one side or on the other.
This customer gave as an example 2 particular systems:
- one to support employee performance evaluation,
career planning and skills development;
- and another system for “order to cash processes”
like invoicing and accounts receivable.
If they lose access to the employee evaluation system, the
company will not stop operating. Also, the kind of data included in such a
system does not contain critical data in terms of the company secrets, which
makes that having a reliable public cloud offering it might be the right
solution for such a system.
On the other way, for the invoicing and accounts receivable
system, if access to such a system might be lost, the business operations would
be paralyzed and cash inflows might be negatively impacted.
Also if in such
information there is business critical data, like the markets an organization
is operating, its revenues by market, its customers, its planned promotions and
new product launches, etc… This is definitely the kind of system that it will
be most difficult for an organization to accept being operated outside its span
of control, or without access to its own auditing services.
If we remember as well, that apart from the US, Western
Europe and certain specific countries in Asia, the majority of the world still
has both technical and legal constraints around public cloud, I believe
on-premise (or a hosted / managed private environments) will still be the mainstream
option for the core business systems of organizations for quite some years to
come.
So, we will have cases where a pure public cloud offering where you have no control over the software stack or the data placement location will be an acceptable choice, and also cases on the other extreme where you'll need to keep full control of the software stack and data location. But between these two extremes, there are a multitude of possibilities, like leveraging a local provider providing you an hybrid model like: having the data placed in the local provider within the country's borders, in association with a global provider providing the cloud services on top of that infrastructure, either in a dedicated or in a shared environment.
The point: today there are multiple options, so embrace the discussion and find out what are the best options for your organization from a financial, strategic, innovation and operational perspectives.
IaaS is the Cloud Service Model that Provides you the most flexibility
Assuming that through your “cloud workload filter” you
define what services are acceptable to run on a public cloud and which are not,
you’ll end up with the conclusion that you’ll be operating a Hybrid Cloud
Model, with certain services running under your span of control (either hosted
by your own IT or managed in a hosted managed private environment at a Service
Provider).
How do you ensure you do not end up locked-in to a certain
vendor, and that you don’t lose the flexibility an hybrid cloud model should be
providing you in the first place?
The response would be: adopt a cloud service model that
enables you to have control over the “mobility” of your workloads between
public clouds, or between public and private clouds.
Today, only Infrastructure as a Service (IaaS) offers this.
Let’s look at it for an instant:
- SaaS: the application logic will be property of
the service provider, and if your organization wants to move that process back
to its span of control, it will imply a major migration project as it will be
needed to configure a new application to support that functionality alongside a
migration of the data from the public provider to your controlled environment.
This will definitely be time and resource consuming, representing a disruptive
change. So we can say, that once you make a choice to adopt a SaaS offering in
a Public Cloud, there will be a number of barriers to exit, that must be
evaluated beforehand and included in your contract “exit clauses”.
- PaaS: the provider owns up to the run-time
platform where you deploy your code. Means that most likely, your data will
also be hosted on the provider infrastructure. Here moving these processes from
public to private cloud becomes simpler, whenever the platform you’ve chosen to
run your code on can be easily deployed on-premise as well. But also in this
case, moving functionality from public to private will be a disruptive event
which will imply certain costs and application downtime.
Both in SaaS and PaaS, when talking about hybrid cloud
scenarios, we are thinking about the possibility of business processes or
applications interact and expand between private and public cloud. But in
neither of these cases we can talk about “dynamic workload mobility”. At least
with the current (that I know of, and foreseen for the medium term) public
cloud offerings and technologies, there is NO dynamic / real-time workload
mobility.
But this is a reality today in the IaaS model.
When considering Infrastructure as a Service, apart from
having complete isolation at the data level with today’s Virtualization
Technologies like the ones provided by VMware, the whole stack needed to run
your business processes is packed in a container that is the Virtual Machine,
that you can absolutely control form a confidentiality point of view and move
around between compatible clouds.
But the key benefit here is that if you choose public cloud
providers who operate on VMware, having VMware as well as an enabling
technology for your private cloud in a IaaS model, you can today use
technologies like “long distance vMotion” (check out the announcements on this
topic from VMworld US 2015) to dynamically and without disruption move applications
from the private to the public cloud and back, avoiding being locked-in to a
specific vendor.
There are also storage provider technologies that facilitate
the movement and copy of virtual machines between clouds that are in use by
many service providers around the world and that can be used in combination
with “long distance vMotion”. But to my current knowledge, the scenarios I know
are in production still imply a minimal application downtime to do this
workload mobility, as “long distance vMotion” is a brand new feature that will
still take some time to become widely implemented and integrated with key
hardware infrastructure components.
So, from a risk perspective, IaaS is the only model that
truly enables you to operate in a hybrid cloud that doesn’t get you "technically" locked-in
to one public cloud vendor.
IaaS is the only true hybrid cloud model without vendor lock-in
Cloud isn’t then just Public Cloud.
Cloud is about industrialization of IT, being its
architecture enablers: virtualization, automation and orchestration software, and
most important, people and processes.
Today it is possible to acquire a pre-configured
infrastructure, with all the software already deployed on it to provide an out
of the box self-service portal, charge back tools, automated deployment workflows,
and all those other tools that truly enable a private cloud according to the
characteristics of cloud described above as per the N.I.S.T. definition of
cloud computing.
Considering the profile of your organization, and the
different types of business processes you’ll be supporting, cloud must
definitely be a part of your IT strategy conversations.
In many cases, implementing a private cloud and adopting a
cloud operating model on your own IT organization may show to be the right
solution to your most critical and customized business applications. But in
many cases I’m finding out that with the increased security certifications
obtained by cloud companies like Virtustream, the option for a hosted / managed
private cloud receives a lot of very strong positive feedback.
Having hosted managed private cloud offerings, brings most
of the benefits of a public cloud but under your organization’s span of
control.
Being Cloud a key topic in your architecture discussions
today, adopting a TDI and Virtualized infrastructure for your on-premise SAP
HANA deployment will also enable you to be prepared for the adoption of a
Hybrid Cloud IaaS scenario, where you’ll be able to have full control of the
mobility of your workloads between your private and multiple cloud providers
operating under this model.
This scenario will for example enable:
- Higher utilization of private assets:
provisioning only for average workload, being able to leverage public cloud for
peaks;
- Simplification of operations: by having the same
base architectures on-premise and on your cloud provider you can for example
setup your disaster recovery to the cloud in a fully automated way;
- Reduction of the risk of change: having a new
project you can just deploy a system either on-premise or on the cloud,
whatever is more convenient, being able at a later stage to move that system in
either direction depending on your “workload filter” and whether the
applications will more or less critical and confidential.
- Drive business innovation: one of the key
aspects to business innovation is to be able to experiment at a low cost. This
scenario provides you full flexibility, so that you don’t have to say no to
your business ever. In this scenario you can truly operate as a business broker
taking the best of your private infrastructure as well as the public providers
you are working with.
Conclusion
Hope that at this point you agree with me that “Cloud” must
be in every organization’s strategy and architecture discussion.
Which one is the right one for you? There is definitely not
a “one size fits all” answer.
The good thing is that there are choices that can map to
your specific organization, industry, location, and business scenario.
I hope this discussion helps you get started with your own
ideas on cloud.
From my side, it is my true belief that an Hybrid IaaS model
will be the leading option for mission critical SAP application, being based on
SAP HANA or AnyDB.
If you want to get started in engaging with candidate
providers to work with you on building your cloud strategy and architecture,
being close to me, let me advise the following:
- EMC Federation Enterprise Hybrid Cloud for SAP: this
solution makes available a fully enabled cloud infrastructure factory build
and fully integrated, delivered pre-configured on your datacenter, leveraging
the best technologies from the EMC Federation (EMC, VCE, VMware, Virtustream),
so that you can start operating a private cloud without having to build all
functionalities on your own from scratch;
- Virtustream Hosted and Managed Cloud offerings
for SAP: Virtustream is a recognized leader in cloud for SAP and SAP HANA and
has been recently acquired by the EMC Federation, being as well one of the only
3 SAP Premium HANA Cloud Partners.
