Apache Guacamole Virtual Desktop workspace service

[christoferlof]

High-level requirements

• Virtual Desktops is in many cases the entry point into the TRE.
• Virtual Desktops can be configured to be access from the Internet over secure channel.
• Virtual Desktops can be configured to only be access from a private network.
• Ability to provision both Windows and Linux Data Science Virtual Machines.
  • Add additional base images in case the DSVM image is not desirable.
• Offer a defined set of Virtual Machine configurations, e.g. Small, Medium, Large and image.
• End-users should be able to connect to Virtual Desktops from Windows, Linux and Mac OSes.
• Ability to control how data is allowed to be moved from/to the VM and the connecting client
  • Clipboard: one-way / no-way / both-ways
  • Import and export data from the VM.
• Ability to mount user scoped storage across VMs
• Ability for end-user to start and stop VMs
• Scheduled start and stop of individual VMs
  • Whole workspace scheduling
• Ability to resize VM
• Updates management - Ability to pause or reschedule or apply updates to the VM.
• Ability to install licensed applications , e.g. Office 365 and Matlab applications
• Note: Azure subscription tenant might not be the same as the tenant the researcher was authenticated by.

Implementation

Milestone 0.2

• Explore Virtual Desktop service options #26
• Update this issue with additional tasks based on outcomes from above.
• [Task] High level design of Virtual Desktop Connectivity feature #490
• [Story] Create workspace service - template and bundle (guacamole)  #501
• [Story] Create target resource service - template and bundle (vm) #504
• [Story] Add API functionality to register a new workspace-service template #500
• [Story] Add API functionality to add a workspace-service to an existing workspace #553
• [Story] Add API functionality to register a new user-resource template #482
• [Story] Add API functionality to add a user-resource to an existing workspace/workspace-service #548
• [Story] Implement credentials retrival in Guacamole Auth extension #561
• [Story] Deploy bundles to a TRE workspace on message arrival #483
• [Story] Add Auth extension for Guacamole #502
• [Story] Connection URI should be generated and configured to allow remote connectivity #503
• [Story] Implement GET API to get a user-resource and a list of all user-resources of a workspace-service #658
• [BUG] User resource should include a property of who created it #692

Currently planned for milestone 0.3

• [Story] Provide via API the current state of a user resource #757
• Implement actions on resources - such as start/stop a VM #756
• App Registration missing ID token needed for Guacamole #1137
• Guacamole redirect URL needs adding to the app registration.  #1096
• Ubuntu DSVM template for Guacamole #864
• Guacamole does not get an image tag from resource processor  #848
• Create Windows DSVM user resource template for Guacamole Workspace Service #582
• Guacamole VM access failed due to expired JWT token #1110
• Create a Linux DSVM user resource template for the Guacamole Workspace Service #1114
• VM username should be the users username from access token, rather than a random one. #1148
• Guacamole extension should pass an access-token to the TRE API rather than id-token #1386
• Guacamole: Connection to user resource fails if allocated IP address of old resource which has failed to delete #1241
• Ability to select multiple VM sizes for the Guacamole user resource #1200
• VM name should be the name, not the ip address #1729
• Need to handle reset of password for Guacamole user resources #2087
• On first connection to a VM often get sent to the Guacamole connection listings, rather than a specific VM #1724

[christoferlof]

Azure DevTest Labs provide some of the capabilities listed above, which we should look into in a bit more detail.

[christoferlof]

Apache Guacamole ticks several of the boxes also.

[iankelly-github]

The ATRE is a highly controlled environment, many 'apps' will need configuring at the 'user' profile level for them to operate properly. For example if a network proxy is used for auditing then the browser, git client, conda, PyCharm, Azure storage explorer will all need to be configured to use it. This can be a big headache users as each time they login to a system they need to remember these configuration changes. We should make this as automated as we can to reduce the cost of adoption.

[ktakeda1]

@iankelly-github good points. We should pre-install everything that a user might need into the VM and have this configured to work seamlessly within the Azure TRE Workspace. TRE Admins are probably the people to provide significant additional customisations. Basically the same experience as managed desktops, not what people love, but people do understand this model at least. We do want to make the TRE user experience great though, so anything we can do to provide flexibility within the constraints of the environment is fantastic!

[marrobi]

@iankelly-github 100%. This is an interesting challenge, one way we have approached this is by using common DNS names across workspaces. So have packages.drednsname.com resolve to the package "server" IP address. In certain occasions can "hijack" the DNS name of the public package repo, but SSL can become a challenge.

[marrobi]

The following diagram created with @christoferlof might be a good starting point when thinking about user stories:

[iankelly-github]

I really like the diagram, very useful for brain-storming use cases. Should we capture all suggestions as issues or as 'ideas' under discussions?

[marrobi]

@iankelly-github If they are specific to virtual desktops/users creating compute along the lines of the diagram above, continue this chat.

If they are separate feature requests, feel free to create issues and will add them to the backlog, refine, and prioritize.

[iankelly-github]

Thanks for clarifying @marrobi. I just reviewed this issues requirements again and most of the use cases that I immediately thought of are already included :-) The only additional use case would be 'create a snapshot my VM/disks'.

[marrobi]

It's worth noting that Azure Virtual Desktop will be a valid alternative to a custom virtual desktop solution for some customers. We should define this in a separate story.