hpinc / cloud_deployment_scripts Goto Github PK

By default, the following network and subnetwork names are created: vpc-cas, subnet-dc, subnet-cac, and subnet-ws. Only vpc-cas can be customized. Would be great to parameterize these so that users can customize the names.

If the AD domain is a single word, e.g. demo, the deployment would apparently succeed, but the AD domain controller would fail to initialize properly. As a result, machines are unable to join the domain. The error does not percolate up to the Terraform process. It would be very helpful if it did somehow to stop the deployment. Upstream client tools and users should perform validation and make sure that the domain complies with the AD policies for being at least two tokens separated by dots, e.g. studio.demo However, it should fail if any errors occur during configuration of AD controller. See GoogleCloudPlatform/solutions-cloud-orchestrate#2 for reference.

Hi I was wondering if these workstations should theoretically be possible to image and redeploy? I love building initial infrastructure with this, but ideally our team would deploy new workstations to ec2 from image via lambda/boto.

Currently, without any modifications after the terraform build, if I make an AMI from it, boot it into the same subnet-ws, and add it to CAM, when I go to connect in PCoiP client it only ever says "restarting remote workstation" and didnt does anything in EC2. Is there a guide for this? Our team had deployed a PCoIP solution earlier that imaged fine but was pointing to aws-marketplace-subscription— was hoping to emulate the same with CAM.

Thank you for any info, I really have appreciated your past help

Hi Hi,

Looks like this has been moved/deleted;

"https://raw.githubusercontent.com/teradici/deploy/master/remote-workstations/new-agent-vm/Install-Idle-Shutdown.sh" -O /tmp/idleShutdown/Install-Idle-Shutdown-raw.sh

How are you dealing with idle shutdown at the moment? I see idle logoff function but nothing to shutdown.

Description
Ran into this problem when executing the python script
./gcp-cloudshell-quickstart.py

*You might also see an error message about needing the "compute.project.get" permission

What may have fixed the problem:

• Added the permissions by running the command: gcloud projects add-iam-policy-binding [PROJECT_ID] --member=serviceAccount:[PROJECT_NUMBER][email protected] --role=roles/compute.admin
  • solution found here: https://stackoverflow.com/questions/58768924/cloud-container-clusters-create-compute-networks-get-permission-error
• Toggling by enabling and then disabling the Kubernetes Engine API (the GKE should be disabled) might have somehow corrected the permissions

Possible Environment

• When running a gcloud command for the first time in a new shell, an "Authorise Cloud Shell" prompt should show up, but when this issue happened, it did not. Note the "!Untrusted" sign, which expands to the following prompt
  • Note: the shell might suggest running the command gcloud auth login , but this might not solve this problem because it will only authorize user accounts, not service accounts.
  • See: https://cloud.google.com/sdk/docs/authorizing
• Perhaps when the cloud shell was created, some permissions were somehow missing
  • "Untrusted" means the default cloudshell image was not launched, so the credentials needed aren't there
  • See https://offensi.com/2019/12/16/4-google-cloud-shell-bugs-explained-bug-2/
  • Google Cloud Shell provisions a GCE VM instance
  • The missing permissions was GCE permissions
• See https://cloud.google.com/shell/docs/how-cloud-shell-works

Reproducing the Issue
may not work every time trouble reproducing the issue

• Created a new GCP project and resetting the cloud shell --- worked in reproducing the error once
  • https://cloud.google.com/shell/docs/resetting-cloud-shell
• Changing the region and zone --- does not reproduce
• Further toggling with the GKE API --- does not reproduce
• Trying it on another VM

Interesting Notes

• You can use GKE features with GCE permissions: https://cloud.google.com/kubernetes-engine/docs/how-to/iam
• When grabbing the metadata, the user account did not show up (note the presence of the / at the end)
  • curl http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/
  • 
• A discussion that might be related terraform-google-modules/terraform-google-kubernetes-engine#459

I'm unable to get in via ssh after creating workstations. (Specifically trying centos gfx after doing a single-connector deployment). I understand to ssh I need to connect to CAC as bastion, but when I do I'm consistently rejected.

made key with ssh-keygen -t rsa @ ~/.ssh/id_rsa

var in terraform: ~/.ssh/id_rsa.pub

attempting connection with CAC via ssh -i -A -v ~/.ssh/id_rsa [email protected]

No dice. Any thoughts? I need to get these workstations wrapped into ansible and I'm currently unable to. Thank you for any thoughts or assistance.

Trying to use the deployment script and I'm fumbling at the download token for teradici...getting a trust error.

--> Downloading PCoIP graphics agent from https://dl.teradici.com/xXZvMRtQ5hFRw6ed/pcoip-agent/raw/names/pcoip-agent-graphics-exe/versions/latest/pcoip-agent-graphics_latest.exe...
Exception calling "DownloadFile" with "2" argument(s): "The underlying connection was closed: Could not establish trust
relationship for the SSL/TLS secure channel."

Am I doing something wrong here or do I need to grab a new token everytime i want to use the pipeline?

Can we have an field in the quickstart tutorial that allows users to change the GCP region that the CAM deployment is deployed in? May need some warning so that users will check if the region they are deploying has GPUs. Perhaps it can default to us-west2

I'm think the documentation assumes that the user has the relevant CLI already installed but you would hit a barrier without knowing that it's a requirement

https://github.com/teradici/cloud_deployment_scripts/blob/master/docs/aws/README.md#requirements

There is a variable to specify the location of a custom CSV file containing the list of users to initialize in the AD domain controller. However, it is not actually used where it tries to upload it to the project. It uses a hard-coded name domain_users_list.csv expecting to find it in the current directory where the deployment is started from.