Skip to content

Commit

Permalink
Merge branch 'main' of https://github.com/microsoft/AzureTRE into cor…
Browse files Browse the repository at this point in the history
…e-network-subnets-change
  • Loading branch information
ShakutaiGit committed Feb 2, 2025
2 parents 99d695d + 7c88fe4 commit b297723
Show file tree
Hide file tree
Showing 29 changed files with 135 additions and 20 deletions.
3 changes: 3 additions & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,9 @@ ENHANCEMENTS:
* Update Guacamole dependencies ([[#4232](https://github.com/microsoft/AzureTRE/issues/4232)])
* Add option to force tunnel TRE's Firewall ([#4237](https://github.com/microsoft/AzureTRE/issues/4237))
* Add EventGrid diagnostics to identify airlock issues ([#4258](https://github.com/microsoft/AzureTRE/issues/4258))
* Allow enablement of Secure Boot and vTPM for Guacamole VMs ([#4235](https://github.com/microsoft/AzureTRE/issues/4235))
* Surface the server-layout parameter of Guacamole [server-layout](https://guacamole.apache.org/doc/gug/configuring-guacamole.html#session-settings) ([#4234](https://github.com/microsoft/AzureTRE/issues/4234))
* Add encryption at host for VMs ([#4263](https://github.com/microsoft/AzureTRE/pull/4263))

BUG FIXES:
* Update KeyVault references in API to use the version so Terraform cascades the update ([#4112](https://github.com/microsoft/AzureTRE/pull/4112))
Expand Down
6 changes: 4 additions & 2 deletions core/terraform/resource_processor/vmss_porter/main.tf
Original file line number Diff line number Diff line change
Expand Up @@ -79,9 +79,11 @@ resource "azurerm_linux_virtual_machine_scale_set" "vm_linux" {
disable_password_authentication = false
admin_password = random_password.password.result
custom_data = data.template_cloudinit_config.config.rendered
encryption_at_host_enabled = false
encryption_at_host_enabled = true
upgrade_mode = "Automatic"
tags = local.tre_core_tags
secure_boot_enabled = true
vtpm_enabled = true

extension {
auto_upgrade_minor_version = true
Expand Down Expand Up @@ -127,7 +129,7 @@ resource "azurerm_linux_virtual_machine_scale_set" "vm_linux" {
source_image_reference {
publisher = "Canonical"
offer = "0001-com-ubuntu-server-jammy"
sku = "22_04-lts"
sku = "22_04-lts-gen2"
version = "latest"
}

Expand Down
5 changes: 3 additions & 2 deletions core/terraform/servicebus.tf
Original file line number Diff line number Diff line change
Expand Up @@ -32,8 +32,9 @@ resource "azurerm_servicebus_namespace" "sb" {
dynamic "customer_managed_key" {
for_each = var.enable_cmk_encryption ? [1] : []
content {
key_vault_key_id = azurerm_key_vault_key.tre_encryption[0].id
identity_id = azurerm_user_assigned_identity.encryption[0].id
key_vault_key_id = azurerm_key_vault_key.tre_encryption[0].id
identity_id = azurerm_user_assigned_identity.encryption[0].id
infrastructure_encryption_enabled = true
}
}

Expand Down
2 changes: 1 addition & 1 deletion core/version.txt
Original file line number Diff line number Diff line change
@@ -1 +1 @@
__version__ = "0.11.17"
__version__ = "0.11.19"
15 changes: 15 additions & 0 deletions docs/azure-tre-overview/airlock.md
Original file line number Diff line number Diff line change
Expand Up @@ -141,6 +141,21 @@ graph LR
```
> Data movement in an Airlock import request
```mermaid
graph LR
subgraph TRE workspace
data(Data to export)-->A
A[(stalexint</br>export internal)]-->|Request Submitted| B
B[(stalexip</br>export in-progress)]-->|Security issues found| D[(stalexblocked</br>export blocked)]
B-->|No security issues found| review{Manual</br>Approval}
review-->|Rejected| C[(stalexrej</br>export rejected)]
end
subgraph External
review-->|Approved| E[(stalexapp</br>export approved)]
end
```
> Data movement in an Airlock export request

TRE:

Expand Down
2 changes: 1 addition & 1 deletion resource_processor/_version.py
Original file line number Diff line number Diff line change
@@ -1 +1 @@
__version__ = "0.11.0"
__version__ = "0.11.1"
2 changes: 1 addition & 1 deletion templates/shared_services/admin-vm/porter.yaml
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---
schemaVersion: 1.0.0
name: tre-shared-service-admin-vm
version: 0.5.1
version: 0.5.2
description: "An admin vm shared service"
dockerfile: Dockerfile.tmpl
registry: azuretre
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,9 @@ resource "azurerm_windows_virtual_machine" "jumpbox" {
admin_username = "adminuser"
admin_password = random_password.password.result
tags = local.tre_shared_service_tags
encryption_at_host_enabled = true
secure_boot_enabled = true
vtpm_enabled = true

source_image_reference {
publisher = "MicrosoftWindowsDesktop"
Expand All @@ -51,7 +54,10 @@ resource "azurerm_windows_virtual_machine" "jumpbox" {
disk_encryption_set_id = var.enable_cmk_encryption ? azurerm_disk_encryption_set.jumpbox_disk_encryption[0].id : null
}

lifecycle { ignore_changes = [tags] }
# ignore changes to secure_boot_enabled and vtpm_enabled as these are destructive
# (may be allowed once https://github.com/hashicorp/terraform-provider-azurerm/issues/25808 is fixed)
#
lifecycle { ignore_changes = [tags, secure_boot_enabled, vtpm_enabled] }
}

resource "azurerm_disk_encryption_set" "jumpbox_disk_encryption" {
Expand Down
2 changes: 1 addition & 1 deletion templates/shared_services/sonatype-nexus-vm/porter.yaml
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---
schemaVersion: 1.0.0
name: tre-shared-service-sonatype-nexus
version: 3.3.1
version: 3.3.2
description: "A Sonatype Nexus shared service"
dockerfile: Dockerfile.tmpl
registry: azuretre
Expand Down
8 changes: 7 additions & 1 deletion templates/shared_services/sonatype-nexus-vm/terraform/vm.tf
Original file line number Diff line number Diff line change
Expand Up @@ -103,10 +103,16 @@ resource "azurerm_linux_virtual_machine" "nexus" {
admin_username = "adminuser"
admin_password = random_password.nexus_vm_password.result
tags = local.tre_shared_service_tags
encryption_at_host_enabled = true
secure_boot_enabled = true
vtpm_enabled = true

custom_data = data.template_cloudinit_config.nexus_config.rendered

lifecycle { ignore_changes = [tags] }
# ignore changes to secure_boot_enabled and vtpm_enabled as these are destructive
# (may be allowed once https://github.com/hashicorp/terraform-provider-azurerm/issues/25808 is fixed)
#
lifecycle { ignore_changes = [tags, secure_boot_enabled, vtpm_enabled] }

source_image_reference {
publisher = "Canonical"
Expand Down
Original file line number Diff line number Diff line change
@@ -1 +1 @@
__version__ = "0.9.3"
__version__ = "0.9.4"
Original file line number Diff line number Diff line change
Expand Up @@ -111,6 +111,13 @@ private static void setConfig(
config.setParameter("drive-path", System.getenv("GUAC_DRIVE_PATH"));
config.setParameter("disable-download", System.getenv("GUAC_DISABLE_DOWNLOAD"));
config.setParameter("disable-upload", System.getenv("GUAC_DISABLE_UPLOAD"));

String serverLayout = System.getenv("GUAC_SERVER_LAYOUT");
if (serverLayout != null) {
if (!serverLayout.isEmpty()) {
config.setParameter("server-layout", serverLayout);
}
}
}

private static JSONArray getVMsFromProjectAPI(final AzureTREAuthenticatedUser user) throws GuacamoleException {
Expand Down
6 changes: 6 additions & 0 deletions templates/workspace_services/guacamole/parameters.json
Original file line number Diff line number Diff line change
Expand Up @@ -94,6 +94,12 @@
"env": "GUAC_ENABLE_DRIVE"
}
},
{
"name": "guac_server_layout",
"source": {
"env": "GUAC_SERVER_LAYOUT"
}
},
{
"name": "image_tag",
"source": {
Expand Down
10 changes: 9 additions & 1 deletion templates/workspace_services/guacamole/porter.yaml
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---
schemaVersion: 1.0.0
name: tre-service-guacamole
version: 0.12.6
version: 0.12.7
description: "An Azure TRE service for Guacamole"
dockerfile: Dockerfile.tmpl
registry: azuretre
Expand Down Expand Up @@ -75,6 +75,11 @@ parameters:
type: boolean
default: true
env: GUAC_DISABLE_UPLOAD
- name: guac_server_layout
type: string
default: ""
env: GUAC_SERVER_LAYOUT
description: "Guacamole server keyboard layout (defaults to en-us-qwerty when not set)"
- name: is_exposed_externally
type: boolean
default: true
Expand Down Expand Up @@ -144,6 +149,7 @@ install:
guac_drive_path: ${ bundle.parameters.guac_drive_path }
guac_disable_download: ${ bundle.parameters.guac_disable_download }
guac_disable_upload: ${ bundle.parameters.guac_disable_upload }
guac_server_layout: ${ bundle.parameters.guac_server_layout }
is_exposed_externally: ${ bundle.parameters.is_exposed_externally }
tre_resource_id: ${ bundle.parameters.id }
aad_authority_url: ${ bundle.parameters.aad_authority_url }
Expand Down Expand Up @@ -177,6 +183,7 @@ upgrade:
guac_drive_path: ${ bundle.parameters.guac_drive_path }
guac_disable_download: ${ bundle.parameters.guac_disable_download }
guac_disable_upload: ${ bundle.parameters.guac_disable_upload }
guac_server_layout: ${ bundle.parameters.guac_server_layout }
is_exposed_externally: ${ bundle.parameters.is_exposed_externally }
tre_resource_id: ${ bundle.parameters.id }
aad_authority_url: ${ bundle.parameters.aad_authority_url }
Expand Down Expand Up @@ -210,6 +217,7 @@ uninstall:
guac_drive_path: ${ bundle.parameters.guac_drive_path }
guac_disable_download: ${ bundle.parameters.guac_disable_download }
guac_disable_upload: ${ bundle.parameters.guac_disable_upload }
guac_server_layout: ${ bundle.parameters.guac_server_layout }
is_exposed_externally: ${ bundle.parameters.is_exposed_externally }
tre_resource_id: ${ bundle.parameters.id }
aad_authority_url: ${ bundle.parameters.aad_authority_url }
Expand Down
4 changes: 4 additions & 0 deletions templates/workspace_services/guacamole/terraform/variables.tf
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,10 @@ variable "guac_disable_upload" {
type = bool
description = "Disable upload to the Guacamole workspace"
}
variable "guac_server_layout" {
type = string
description = "Server keyboard layout"
}
variable "is_exposed_externally" {
type = bool
description = "Is the Guacamole workspace to be exposed externally?"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,7 @@ resource "azurerm_linux_web_app" "guacamole" {
GUAC_DRIVE_PATH = var.guac_drive_path
GUAC_DISABLE_DOWNLOAD = var.guac_disable_download
GUAC_DISABLE_UPLOAD = var.guac_disable_upload
GUAC_SERVER_LAYOUT = var.guac_server_layout

AUDIENCE = "@Microsoft.KeyVault(SecretUri=${data.azurerm_key_vault_secret.workspace_client_id.id})"
ISSUER = local.issuer
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -37,10 +37,14 @@ custom:
apt_sku: 22.04
install_ui: true
conda_config: false
secure_boot_enabled: true
vtpm_enabled: true
# "Custom Image From Gallery":
# source_image_name: your-image
# install_ui: true
# conda_config: true
# secure_boot_enabled: true
# vtpm_enabled: true
```

The `vm_sizes` section is a map of a custom SKU description to the SKU identifier.
Expand All @@ -55,6 +59,8 @@ Within the image definition in `image_options` there are a few properties that c
| `source_image_reference` | Specify VM image to use by `publisher`, `offer`, `sku` & `version` (e.g. for Azure Marketplace images) |
| `install_ui` | (Linux only) Set `true` to install desktop environment |
| `conda_config` | Set true to configure conda |
| `secure_boot_enabled` | Set true to enable [Secure Boot](https://learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch#secure-boot). Requires a Requires a [Gen 2](https://learn.microsoft.com/en-us/azure/virtual-machines/generation-2) VM image |
| `vtpm_enabled` | Set true to enable [Secure Boot](https://learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch#vtpm). Requires a [Gen 2](https://learn.microsoft.com/en-us/azure/virtual-machines/generation-2) VM image |

When specifying images using `source_image_name`, the image must be stored in an [image gallery](https://learn.microsoft.com/en-us/azure/virtual-machines/azure-compute-gallery).
To enable re-using built user resource templates across environments where the image may vary, the image gallery is configured via the `RP_BUNDLE_VALUES` environment variable when deploying the TRE.
Expand Down
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---
schemaVersion: 1.0.0
name: tre-service-guacamole-export-reviewvm
version: 0.2.1
version: 0.2.2
description: "An Azure TRE User Resource Template for reviewing Airlock export requests"
dockerfile: Dockerfile.tmpl
registry: azuretre
Expand All @@ -18,6 +18,8 @@ custom:
sku: winserver-2019
version: latest
conda_config: true
secure_boot_enabled: false # dsvm-win-2019 is not a gen2 image
vtpm_enabled: false

credentials:
- name: azure_tenant_id
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,8 @@ locals {
# selected_image_source_refs is an array to enable easy use of a dynamic block
selected_image_source_refs = lookup(local.selected_image, "source_image_reference", null) == null ? [] : [local.selected_image.source_image_reference]
selected_image_source_id = lookup(local.selected_image, "source_image_name", null) == null ? null : "${var.image_gallery_id}/images/${local.selected_image.source_image_name}"
secure_boot_enabled = lookup(local.selected_image, "secure_boot_enabled", false)
vtpm_enabled = lookup(local.selected_image, "vtpm_enabled", false)

cmk_name = "tre-encryption-${local.workspace_resource_name_suffix}"
encryption_identity_name = "id-encryption-${var.tre_id}-${local.short_workspace_id}"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -124,6 +124,9 @@ resource "azurerm_windows_virtual_machine" "windowsvm" {
allow_extension_operations = true
admin_username = random_string.username.result
admin_password = random_password.password.result
encryption_at_host_enabled = true
secure_boot_enabled = local.secure_boot_enabled
vtpm_enabled = local.vtpm_enabled

custom_data = base64encode(data.template_file.download_review_data_script.rendered)

Expand Down Expand Up @@ -152,7 +155,10 @@ resource "azurerm_windows_virtual_machine" "windowsvm" {

tags = local.tre_user_resources_tags

lifecycle { ignore_changes = [tags] }
# ignore changes to secure_boot_enabled and vtpm_enabled as these are destructive
# (may be allowed once https://github.com/hashicorp/terraform-provider-azurerm/issues/25808 is fixed)
#
lifecycle { ignore_changes = [tags, secure_boot_enabled, vtpm_enabled] }
}

resource "azurerm_disk_encryption_set" "windowsvm_disk_encryption" {
Expand Down
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---
schemaVersion: 1.0.0
name: tre-service-guacamole-import-reviewvm
version: 0.3.1
version: 0.3.2
description: "An Azure TRE User Resource Template for reviewing Airlock import requests"
dockerfile: Dockerfile.tmpl
registry: azuretre
Expand All @@ -18,11 +18,15 @@ custom:
sku: winserver-2019
version: latest
conda_config: true
secure_boot_enabled: false # dsvm-win-2019 is not a gen2 image
vtpm_enabled: false
# For information on using custom images, see README.me in the guacamole/user-resources folder
# "Custom Image From Gallery":
# source_image_name: sltestwin1
# source_image_reference: null,
# conda_config: true
# secure_boot_enabled: false
# vtpm_enabled: false

credentials:
- name: azure_tenant_id
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,8 @@ locals {
# selected_image_source_refs is an array to enable easy use of a dynamic block
selected_image_source_refs = lookup(local.selected_image, "source_image_reference", null) == null ? [] : [local.selected_image.source_image_reference]
selected_image_source_id = lookup(local.selected_image, "source_image_name", null) == null ? null : "${var.image_gallery_id}/images/${local.selected_image.source_image_name}"
secure_boot_enabled = lookup(local.selected_image, "secure_boot_enabled", false)
vtpm_enabled = lookup(local.selected_image, "vtpm_enabled", false)

cmk_name = "tre-encryption-${local.workspace_resource_name_suffix}"
encryption_identity_name = "id-encryption-${var.tre_id}-${local.short_workspace_id}"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,9 @@ resource "azurerm_windows_virtual_machine" "windowsvm" {
allow_extension_operations = true
admin_username = random_string.username.result
admin_password = random_password.password.result
encryption_at_host_enabled = true
secure_boot_enabled = local.secure_boot_enabled
vtpm_enabled = local.vtpm_enabled

custom_data = base64encode(data.template_file.download_review_data_script.rendered)

Expand Down Expand Up @@ -73,7 +76,10 @@ resource "azurerm_windows_virtual_machine" "windowsvm" {

tags = local.tre_user_resources_tags

lifecycle { ignore_changes = [tags] }
# ignore changes to secure_boot_enabled and vtpm_enabled as these are destructive
# (may be allowed once https://github.com/hashicorp/terraform-provider-azurerm/issues/25808 is fixed)
#
lifecycle { ignore_changes = [tags, secure_boot_enabled, vtpm_enabled] }
}

resource "azurerm_disk_encryption_set" "windowsvm_disk_encryption" {
Expand Down
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---
schemaVersion: 1.0.0
name: tre-service-guacamole-linuxvm
version: 1.2.3
version: 1.2.4
description: "An Azure TRE User Resource Template for Guacamole (Linux)"
dockerfile: Dockerfile.tmpl
registry: azuretre
Expand All @@ -23,11 +23,15 @@ custom:
apt_sku: 22.04
install_ui: true
conda_config: false
secure_boot_enabled: true
vtpm_enabled: true
# For information on using custom images, see README.me in the guacamole/user-resources folder
# "Custom Image From Gallery":
# source_image_name: your-image
# install_ui: true
# conda_config: true
# secure_boot_enabled: false
# vtpm_enabled: false

credentials:
- name: azure_tenant_id
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,9 @@ resource "azurerm_linux_virtual_machine" "linuxvm" {
disable_password_authentication = false
admin_username = random_string.username.result
admin_password = random_password.password.result
encryption_at_host_enabled = true
secure_boot_enabled = local.secure_boot_enabled
vtpm_enabled = local.vtpm_enabled

custom_data = data.template_cloudinit_config.config.rendered

Expand Down Expand Up @@ -72,7 +75,10 @@ resource "azurerm_linux_virtual_machine" "linuxvm" {

tags = local.tre_user_resources_tags

lifecycle { ignore_changes = [tags] }
# ignore changes to secure_boot_enabled and vtpm_enabled as these are destructive
# (may be allowed once https://github.com/hashicorp/terraform-provider-azurerm/issues/25808 is fixed)
#
lifecycle { ignore_changes = [tags, secure_boot_enabled, vtpm_enabled] }
}

resource "azurerm_disk_encryption_set" "linuxvm_disk_encryption" {
Expand Down
Loading

0 comments on commit b297723

Please sign in to comment.