Carlsberg Group adds security, lowers costs, with Azure migration including SAP

More than just lift and shift

As part of a widescale corporate strategy (called SAIL’22), Carlsberg is embracing the cloud and digital technologies to drive product innovation and better experiences for customers. Yet a spate of acquisitions in recent years left the company with a patchwork of duplicate, custom, and legacy hardware and software. The move to the cloud was an opportunity to do more than a homogeneous lift-and-shift migration of onsite virtual machines (VMs) and databases. The goal was to make IT a strategic driver of change in the company. To do that, the company needed to consolidate disparate systems and to focus on how it could use its data not only to improve but also to reinvent business processes, expand the use of IoT in manufacturing, and help the business grow.

The plan was to move everything—from office systems and collaboration tools to the critical SAP workloads. “Everything” meant the systems running on 1,070 servers in the datacenter on-premises that ran AIX, Windows, and Linux, along with the data stored in IBM DB2 databases and SAP HANA database for BW on SUSE Linux nodes. It also meant several legacy SAP environments in Western Europe, including one used by HR, and an ERP setup in Italy.

E-commerce and ERP solutions are notoriously difficult to migrate because of the dependencies and customizations that accumulate over time, and the Carlsberg environment was no different. The company wanted to transform its SAP landscape entirely by:

• Migrating the outdated systems based on UNIX and an old version of DB2 to a new platform based on Windows Server 2016 and Microsoft SQL Server 2016.
• Using a standard SAP migration process based on the database-independent R3load procedure in the SAP Migration Toolkit, which provides speedy parallel import and export processes.
• Moving from BW on HANA on-premises to BW on HANA on Azure Large Instances.
• Migrating Windows–based servers using Azure Site Recovery, a tool for disaster recovery that can also be used to migrate on-premises and Azure Virtual Machines.

Now the company’s infrastructure consists of approximately 700 Azure Virtual Machines. On-premises, it retains approximately 150 servers. In all, about 1,600 terabytes of data was moved.

An architecture to bridge old and new

Carlsberg chose to replatform legacy systems based on UNIX and DB2, even though this decision added complexity to a high-risk migration. But the company’s goal was to repair, refactor, and replatform everything it could and to move it into the cloud. With that in mind, the transition team knew that some legacy manufacturing systems and data had to remain on-premises in the interim. The team chose Azure not only because of the long association Carlsberg has had with Microsoft but also because of the Microsoft team’s support of SAP systems. Azure provided the scale and support for the end-to-end experience, matching the scope of the Carlsberg cloud vision.

To test Azure and gain experience, the transition team began with a few smaller installations, including the SAP payroll software, before moving an 8,000-user SAP implementation. After verifying that payroll operated successfully on Azure—and that everyone would continue to get paid—the team migrated the SAP ERP environment in Italy. That, too, was a success and built confidence for the big go-live weekend.

The new Azure environment includes an Azure ExpressRoute connection between the Carlsberg datacenter and Azure, with dedicated network connectivity to SAP HANA on Azure Large Instances. HANA Large Instances are physical, isolated servers in Azure datacenters dedicated to running one customer’s deployment of SAP HANA.

The application and data tiers on Azure were designed for high availability (HA) and disaster recovery (DR) with failover to a secondary region. The SAP application tier uses Windows VMs that run SAP Central Services and SAP application servers. The VMs that run Central Services are configured as a Windows Server Failover Cluster (WSFC) for high availability. For continuous availability of file shares in Windows Server, Storage Spaces Direct (S2D) and Microsoft Scale-Out File Server (SOFS) provide an active-active clustered storage feature based on Server Message Block (SMB) 3.0. One advantage of this setup is that a WSFC includes the Continuous Availability (CA) feature. It also offers a fault-tolerant SAPMNT share for SAP batch processes to use.

All applications also run in an availability set, which provisions at least two VMs per role. Availability sets make the VMs eligible for a higher service-level agreement (SLA).

Data in transit

Replatforming the data was a major step in the Azure migration. In the first phase, the IBM DB2 databases used by the applications were replaced with SQL Server on Azure. The team chose SQL Server for its proven stability and operational power.

Two SQL Server VMs are deployed to the back-end subnet and joined to the Active Directory domain. The new data tier uses the native SQL Server AlwaysOn Availability Groups to provide synchronous high availability replication and, for disaster recovery, asynchronous replication to a secondary Azure region.

The second phase, still underway, is to create a data lake. The team plans to take advantage of the structured data in SQL Server and other heterogeneous data to support the future Carlsberg Analytics Platform (CAP). This data platform is the pivotal back end for Carlsberg business systems. CAP can ingest data from SAP and other systems, giving team members real-time, actionable data to drive more dynamic and better-informed decision-making.

Network considerations

Network design is an important consideration for any enterprise that moves its workloads from an on-premises environment to the public cloud. The network between the Carlsberg datacenter and Azure was challenging to set up, if only because of the number of IP addresses that had to change and the 600 interfaces to transform.

Carlsberg implemented a multiple virtual network topology on Azure. The main virtual network included shared security and access requirements across workloads. This enabled the transition team to establish the cloud governance well in advance of the switchover. Specific workloads, such as the SAP applications, are deployed in the main virtual network, which also hosts the ExpressRoute connectivity. Other workloads are deployed in separate virtual networks.

The virtual networks that are peered to the main virtual network appear as one, for connectivity purposes. The traffic between VMs in the peered virtual networks is routed through the Microsoft backbone infrastructure, much like traffic is routed between VMs in the same virtual network, through private IP addresses only.

Carlsberg controls which services have access to and are accessible from the public internet. The main virtual network hosts a layer of defense in the form of firewalls (network virtual appliances). It also uses custom routing by defining user-defined routes. It filters traffic using network security groups that allow or deny inbound network traffic to, or outbound network traffic from, various Azure resources.

Azure services in the solution

Since the payroll system was the first to move, the transition team used it as a test case for the datacenter migration and for the digital transformation initiated through CAP.

CAP provides a unified platform for data analytics, and Carlsberg continues to invest in this custom solution. The aim is for business analysts to use CAP to get new and improved insights from the structured and unstructured data that is now available.

Other Azure services that make up CAP include:

• Azure Data Factory, a service that allows developers to integrate disparate data sources.
• Azure Data Lake Storage Gen2, a highly scalable and secure storage for big data analytics—the foundation of the CAP data lake.
• Azure Databricks, a streamlined, collaborative Apache Spark–based analytics platform optimized for Azure.
• Azure Synapse Analytics, an enterprise data warehouse that uses massively parallel processing to quickly run complex queries across petabytes of data.
• Microsoft Power BI, a data-modeling tool that can connect to hundreds of data sources on-premises and in the cloud.

Lessons learned along the way

Carlsberg attributes the success of its migration to an integrated approach that considered the network, the infrastructure, and the people. Success required a shift in mindset away from legacy thinking, so the IT teams invested heavily in training.

The company offered this advice, as well:

• Start small, and then go big. Carlsberg migrated a few smaller systems to gain the experience and to learn lessons before tackling the bigger move.
• Plan for contingencies. The team implemented data-consistency checks and potential reruns of failed transfers. Most of all, it rehearsed. For each step of the migration, the team had rollout and rollback plans.
• Involve the entire team, and enlist experts. Decisions were made jointly by Carlsberg and Microsoft, Accenture, and SAP—right up to the day of the switch.
• Go big to go fast. To ensure a speedy data transfer, the team supersized the initial Azure infrastructure. Afterward, Carlsberg began to scale back the resources to operational levels.

Next steps

For a company that prides itself on growing for a better today and tomorrow, the transition to Azure means the agility to innovate in a competitive market full of startups bent on disruption. But the digital transition was never about the cloud; it was about people—the bartenders serving the beer and the people who drink it. The cloud was simply the instrument that freed Carlsberg to focus on improving those experiences.

The next step is to find new ways to use its data to help bar owners and bartenders, improve the quality of the products, and lower costs. For example, the company is expanding its use of IoT to improve quality so customers get a better beer. Its newest beer dispenser preserves freshness and monitors beverage data, such as temperature, so Carlsberg can keep an eye on quality at the tap—not just in the production line.

As potentially thousands of these machines go into service, Azure provides the scale that can keep pace with Carlsberg’s innovation.