 So hi everyone, and my name is Alex. I'm a visa SAP and today I would like to share with you the journey that SAP has actually begun almost two years ago to bring the sub-cloud platform to China And for today we have actually quite interesting session we will start with a little bit of introduction towards Alibaba and the most interesting services for you we will continue with an experience of what we actually had towards enabling the platform and all the services that SAP has In China, so we will talk about the challenges about the real so to speak what's make a little bit sometimes China more challenging to aim at and we will cover all the technical aspects all the Even we will cover all the interesting areas from our our experience and my team is actually responsible for working with different yes vendors, so we've worked previously with Google and we work with Azure and we actually Enabled the porting and the the support of the sub-cloud platform on the early stages on those platforms and Working with the different yes vendors normally what we do we ensure that they have the right features the right services enabled and In a good shape to enable the sub-cloud platform to run in an optimal way And we will also have a demo and a quick demo to show What actually it feels like to use Cloud Foundry in China So we will Also have a little bit hands-on on that and in the end of course there will be also some room for questions and answers So anyone that has something that he would like to ask there will be plenty room to share and I will try to answer Okay Some of you may know Alibaba and some of you may not for those of you who not and Alibaba are actually quite huge in Asia They have a lot of services a lot of offerings It goes from maybe Commercial offerings as As the Taobao as the eBay, sorry as the Taobao That is actually an so to speak Relatively and we can compare that to Amazon or to what eBay has to offer in China They have offerings as Alipay This is actually a service that can enable anyone in China to pay and perform transactions and Also B2B also Customers can use that if you travel as a foreigner to Asia you will actually find out that most of the People are not using currency to pay for different Things they buy they're actually using different payment systems So Alipay is one of the options and actually is one of the most interesting ones also transaction wise and Volume wise Alibaba actually has a lot of products and a lot of a lot of volume of transactions and data that's flowing in and maybe the best part about that Is that for their their own services? They're also using their own cloud and that's actually the Ali cloud What makes the cloud to be very major very full and rich of services and features? Essentially, it can be as such compared the volume and and also at the business Transactions that it serves to other big gas vendors that are out there today as Google as Azure and so so to speak we can expect from that cloud the same quantities and the same qualities So maybe let's take one step back and I will share with you when we first began to work on that project We actually work very closely with Alibaba. So my team and also SAP was closely engaged with the product teams and also with the service group in Alibaba So starting bottom up. So essentially when we started to work on the project There was actually no option for SAP to get a corporate account to use in Alibaba, but That was actually something we worked on with their product and today there is a corporate concept all features all things that are needed to actually enable corporates run have an So to speak overall master account that can manage sub accounts with at least the SAP features that we need Is in place. So Alibaba was very responsive all the features that we actually asked were implemented Going one step up to the S features and so on the S features area So I can say that from experience most of the features that existed there were sufficient So even even when we started around two years ago, most of the services did perform actually what we wanted to Have however, we did still and ask for few adjustments in the area of the security of the different services also we have actually Engaged in discussions regarding several features and because the sub-platform works also on other S vendors for us It sometimes actually is interesting to have a parity across some features to have our implementation on the high level so to speak the same and Implement so to speak the same common way to work on different yes vendors an example to that for instance Is that Ali cloud had a feature that enabled the only five security groups that could be assigned on the VM for SAP We had yes vendors were actually supported the 16 AWS support 16 and we had the requirement to increase that size of Security groups that can be attached that essentially allowed us to actually have the same implementation Have the same security groups as we have in AWS also work in AWS in Ali cloud with regards to the quantities But that's just a small example of a feature change of course there were more changes like that that we work together with them to actually adjust but Minority of features and as I said most of it is there and of course Maybe the most interesting part for all of you is the cloud foundry section so or or actually the the top most Implementation of what Alibaba has achieved and it's actually Very awesome. So in two years time Even before even as they started after around half a year or so They already came up with a Bosch CPI implementation. We will double-click that in a second That essentially enabled to deploy cloud foundry in Alibaba Alibaba is also a big company. It has different regions So you can actually deploy in China or outside of China So that's a preference when we tried out at first. We started with Frankfurt, but later on of course in China I will in a brief Say why we started in Frankfurt and actually what you can do and what are different deployment options? So the CPI is here and ready actually today. It's very mature stem cell very adjusted. So They supported the Ubuntu trustee as a private release and Xenial is already available at the Bosch IO website So it's a consumable you can use that There is a CI process in place. So they are currently working with the community to actually Roll that out fully to be integrated and Respectively the same as other yes vendors do with regards to verification and automation of everything So the quality of the changes and the releases of the CPI is going to be so to speak preserved and they are making efforts to make that happen and Of course other services as the bid service and the other community services were also adjusted to support What SAP and also what the community normally will want to have from a cloud foundry offering running a top of yes vendor Last but not least and also a Terraform version is available It also started back then when SAP firstly engaged with Ali cloud for bringing the cloud foundry and what we have with regards to the platform to China and Terraform actually today supports most of the Ali Baba features So all of the new features and all of the existing features that they have they actually also implement support in Terraform what allows you essentially to Reuse your Terraform skills to use your projects that already supports Terraform to also deploy an Ali cloud for us It's also was actually essential and allowed us to Reuse the same concepts and the same and the same so to speak way that we deploy the platform on other yes vendors as well Okay, both CPI we're not going to go over all the changes but essentially already in 2017 there was a first release of the CPI already and Beyond that date actually there were some improvements on feature requests from us some feature requests from the community It's ongoing. We expect to have more changes here However, it's already up there. You can use that you can try that out and deploy cloud foundry with Ali Baba. It will work Okay, Ali Baba cloud services So here actually I wanted to go back to the first So to speak step of what does it mean to work and on Ali Baba what accounts what services are there that exist for you? So essentially and if you would like to work on Ali Baba You have two options or you go for an international account or you go for a domestic account So those two account types are actually and are important With regards to the business that you would like to do. So if you're in an international company, but you would like Maybe to offer your website in China or maybe just use Ali cloud for hosting So that's the kind of account that you should get and if you are a domestic company That's residing in China and you would like to sell to the outside of China or in China itself Different hosting services as actually SAP wants to do so you should go for the domestic version feature wise They're quite the same So you have all the features available in international and domestic the international one is a little bit more translated And there is also a policy in Ali cloud that they first released to the domestic accounts So there are more experimental features that have to prove themselves before they are transitioned to the international version From experience we work with both. We started in International account then we switched to domestic Cloud Foundry worked on both of them So essentially you can decide what your business needs and based on that actually make this decision Some and other interesting And maybe China specific Constraints that you may actually want to highlight for yourself is Several things so first there is a process of real user verification That's required if and only you would like to have actually Services and things consumed in China Soon I will also demonstrate the Ali cloud portal and show you actually and what does it mean how the regions looks like But essentially if you actually go and create resources in regions other than China then everything Will work no user verification is required But if you would like to provision resources in China, then you actually have to Fulfill a process of real user verification if you are a corporate So there is a different process for that you need to actually approve your company and and that also works So that's up actually and also to to to your specific needs to understand What verification you will have to do Ali cloud offer now both when we started it was actually They didn't have the corporate account concept Definitely, you can see how for SAP it's a challenge like to pass real user verification for our employees So when we started we actually started with a POC account that was a granted for us So it was easy for us to skip that but essentially if you are going to provide businesses Business services in China, so you have to decide where to go So one one word more maybe about what's special in China and if you are going to have domains in China And so you have to pass ISP certification to actually certify Those domains and to work in China It's very very important process as a corporate you shouldn't underestimate that process and it is a So to speak it's not an easy process You have to have someone in China that actually will submit this application And of course if you are a company you can achieve that there are Ali cloud actually even offer some services that can enable you to to go and Apply these their website and they offer the service but essentially to have a domain in China and If the domain is going to be used to sell or provide services there it should be ISP certified It means several things. It's not just the domain. It's also the hosting VM that's going to host the VM Sorry to host the website. It's the load balancer. This that is going to serve this VM so it's many products that are tied up to this verification and luckily So once you have the ISP certification done, you are okay. All the products will work As they should but it's something that you have to be aware of and it should be planned Like it's normally a process that can take some time from service perspective. We are not going to just you know Service-by-service and see what's there, but essentially and what I want you to take is that for every service that is available in AWS There is an a so to speak matching service offering in Ali cloud Far beyond the computing storage network database. They have most of the offerings most of the options so to speak to Select the database you need to have the different networking and VPC and Products to use One thing to say on top. So they also offer products that are of course Specific to China things that you will like to probably use if you would like to have your business there as the CDNs They offer acceleration products. They offer different So to speak ISP as a certification services So all of these things that you may need to start in China will be present for you and Of course, all the common services are also there or on the road map. So they have huge teams. They're working on everything. So that's Security management domain websites email and so all of them are there if you have any interest on Some details for some of the services. We can also you can also ask that on the questions Okay, so now let's go to cloud platform. Let's talk about a little bit about when we started what actually was the goal for the cloud platform in China and Also in a bit, we will talk about the challenges that we had so Everything started around two years ago. The main Goal for SAP is actually to make the sub platform offering available in China. It should come with all the SAP services including a big data including machine learning including web editors including connectivity to SAP including all in all what we have to offer in other yes regions and as we do today Outside of China. So we want to package everything make everything available in China and it's going to be also accessible for corporates in China and It's ease and so to speak an offering that will be offered not by SAP itself, but an offering that will be offered by a SAP partner company because you have to be actually An Chinese company to offer a service like that in China, but that's So to speak business aspects. I'm less in the details. So don't quote me for that but anyhow the offering is intended to actually Be available in a full extent. So what you can do in the platform outside of China is going to be shipped and available also in China From the platform just I wanted to highlight like the main areas we have so that later on once we talked about We'll talk about the challenges. So you can Actually point out and see like really yeah, there was work here to do so it's not Something small so on top of the regular areas that you can actually see in Cloud Foundry itself So it's the left section here. This is the Cloud Foundry area. So the Diego cells Cloud controller UA so all the services of Cloud Foundry has on top of that We also have a layer in SAP that knows to actually monitor everything knows to audit knows to provide the different Visibility to operations knows to actually tell what is what what's going on what's not going So well on the platform. We also have all the marketplace services that comes from SAP So all the service teams that work in SAP normally They also will deliver something that will be available for easy consumption for developers of the platform And that's so to speak is a service that is going to be offered Cross the different locations that we work on and of course in China as well So when we will talk about the challenges we actually my team also had to understand that each service all requirements are met so so that Everything security connectivity everything can actually go what go well Another aspect to this platform to the sub-cloud platform is actually the deployment deployment wise it's a super challenging platform to deploy operate and monitor so You can see that We using heavily concourse to deploy sinks and initiate updates We also have and Bosch in place that uses the CPI to work with different yes vendors for so for Ali cloud Of course, we are using the Ali cloud CPI today and also they have changes made in Bosch to enable us to Deploy everything and honestly, so it's it's working great. So all the changes codewise and are working as expected And what we can actually add on and look as something special In this implementation in what we in the team had to actually deal is also the connectivity aspects and this China specific challenges and Actually, this may be one of the most interesting slides. So in this slide and I will share with you some of the challenges so before we begin to dive into each one of those points and say maybe a few words about them so Many of you probably heard that the China has actually a firewall that So to speak governs and what's enters and governs what goes out? So from our experience and the firewall works like that. So if you're going to be using Something in China that is hosted outside of China. You will have issues. The firewall is actually unpredictable And it means that you may have connections that will go who super fast You will you get good connectivity, but if you try and download that again, you will be down down to kilobytes Bytes and even the connection can be shut down. So essentially if you try to download outside of China You have some trouble. You cannot actually do a lot of things we will touch the things that are challenging and Actually, if you are trying to access China again from outside of China, you are hitting the same problem So the firewall works both ways. So if you download from China or if you download from outside of China, you will have challenges doing so Let's talk a little bit about time and DNS So when we try to actually implement things in China We soon found out that we couldn't use the Google DNS time and we could ask We couldn't use the Google DNS and the Google NTP time servers Simply because they are blocked in China Essentially you could try to use other time servers or other So to speak name servers, but those essentially would be flaky and won't actually work all the time And that's something that you have to guarantee to be actually precise if you have time issues things will go really wrong Like certificates won't work CPI commands will fail. So really wrong things will happen and to solve that luckily Ali cloud offers local NTP time servers So you can configure those and they will be locally available in your network to use So that's a problem solved for that DNS. Also, they have local DNS every VM, of course can connect to that consume the the names every single will be good, but DNS is not perfect DNS actually can lie So it can if you try to query for websites that are actually not permitted in China, so We saw that for Facebook Normally content websites. So if you do technical stuff probably this is okay But if you go for content websites DNS may actually return you something false We didn't try to solve the problem. It's problem. That's essentially couldn't be solved easily It's something that you cannot trick so the DNS you have to leave is that so to speak and we Actually when we face that as SAP we face that in the deployment perspective So for us we actually made sure that Thousands of services that we deploy didn't suffer from the DNS issue So of course and the impact is that something won't work Simply we won't trust the certificate and the connection won't succeed So there is like no impact to download something falsely But there is an impact that something will fail if the DNS will be flaky. So for that that's for the DNS Networking so networking as I said if you are in China, you are good if you are out of China and trying so to speak To provide the research to China you have a challenge to solve that if you are a corporate You can buy from Ali cloud Express Connect It will and so to speak cost a lot of money, but it will solve the connectivity problem by 100 percent We actually tested that it's a good connection that you can't be trusted And I speak feeling a little bit talked about that what you can also maybe take an outline for you What does it mean for a shared domain concept this cloud fundery if you have to do I speak feeling for The domain the root domain. Can you trust the so to speak application hosted on your shared domain? Maybe you cannot so that's a topic for itself And and for SAP actually if we go one slide forward the way to actually solve the connectivity between China and So to speak make everything available in China And so we actually took the direction of self-contained deployment and what we try to do we actually try to Package and all our resources and make those available in China. So what does it mean to package our resources so for And so the most maybe easy thing to package is the boss releases So they can be pre-compiled and then they can actually be somehow transferred to China and Docker images they can be also stored in the repository that will be available in China Stem cell images and they can also be stored as part of the same repository So essentially all the artifacts that are needed for the SAP deployment We have a process to package them up and make them available in China One of the most complex processes that is not yet fully developed. So it's currently work in progress is actually the build pack area So if you push an application you actually have to Download things the build pack are normally coming Online they will try to download stuff and one option to solve that is also to actually Pre-compile the build packs and they have the application binaries already so to speak There so if it's a node just application You will have the node models there if it's a goaling application you will submit the vendor and and use that and SAP will actually provide you the build pack probably offline that you can use and then everything from a push perspective should work Essentially for us we will have to provide enough versioning enough flexibility for the customer to look on the different So to speak build pack version. So it's challenge definitely It's not easy to transfer Thousand of so to speak dependencies to China and also make those updated But that's something that SAP established to actually overcome that issue and how you can actually transfer between two regions You can use the express connect product to actually reliably transfer towers or you can fly With hard drives on that that also will work. Maybe even be cheaper because it's a very expensive line really really expensive Okay So I think We have maybe two minutes for a quick demo To me share my screen So and actually what I wanted to show you is that I'm going to use a CF endpoint that is currently hosted in China and Just a second also need to adjust my screen because I'm not seeing so well from here So let's do a mirror awesome Now that can work Okay, and so what I wanted to show you that actually I'm going to connect to an endpoint in China and to prove that we can actually ping The IP of the cloud foundry Application and that we will try to deploy soon So currently the application doesn't yet is not yet deployed So we are getting a for a o4 route for that But essentially that's the IP of the load balancer and the entry in China. We can actually confirm the IP location Here and we will resolve to a location in China and Now what I want to do is I want to actually see a push an application and to our cloud foundry version running on Ali cloud and other interesting Detail I can share with you is that we in this deployment have one or one 101 instances running serving cloud foundry in China and you can actually see the Ali cloud portal if you were interested of Actually, how you can switch between regions so you can see that Right now I have selected Shanghai, but I can easily actually also go to other regions Those are the available location the portal is actually a domestic version, but it's fully translated to English so they have English translation in place as well and What I want to show you is actually how the push works so Let's see if I have a connection. Okay, so this actually is a VM that is located in China I am connected to that in an accelerated way. So you can see that my terminal works pretty fast and What we can do we we have actually a demo app that I prepared And we can try to push that the demo app actually has two manifests one manifest include Billpeck that's called test node. This billpeck is actually in cash billpeck and it will work So if I will use this billpeck in China and push my application Then we can expect the application to complete and work successfully And that's probably will be also what we will offer to customers The offline billpecks and all the process like that you can select what you would like to have So right now the application is staged and soon enough it will be ready to go Okay, it's online if you refresh the page we will yeah, we got it and Just another manifest that's not using and flying billpeck just feel so to speak the pain. So CF push Manifest you So essentially this one is using a different billpeck at the default one actually the default node. Yes billpeck in China So the default node billpeck I expect maybe we'll be lucky. Maybe it will work now But I expect it actually to fail on some random download phase Okay, so maybe it will succeed now The thing is that it will be sporadic. So you may have actually sporadic experience for goal and it won't work Because Goaling is actually based on Google and a lot of repositories. They're actually even Trickier to trick so to speak but offline billpecks of that's issue completely So I'm open for questions. If you have any questions or anything that you would like to ask Please feel free to do so Feeling it's yeah filing. That's for certifying a domain in China. So you have to actually Pass a process that will Actually make your domain certified there to be used in China you will use a verification. So you also have to write Yeah, so you are actually. Yeah, so you are getting a permit to actually delegate also this verification to your employees and You essentially will verify you as a company entity to work with I so to speak with Alibaba With regards to hosting in China Yeah, okay, so essentially all VMs in Ali cloud come with DTS its local time zone in China so You can change that easily you can actually configure the VMs to use UTC actually the Bosch VMs and they're going to use UTC by default But you have to be aware of that Yeah, so Gardner and we'll also work of course in China. Kubernetes already is supported So there are also efforts that were done to also enable the Kubernetes story to work on Ali cloud as well Great. Any other questions? Okay. Thanks everyone for joining and coming to session