OLD TRE version used for test upgrade to tvstre prod main v0.25.0

.devcontainer/Dockerfile

@@ -85,7 +85,8 @@ RUN curl -L --fail -o /tmp/azcopy.tar.gz "https://aka.ms/downloadazcopy-v10-linu
   && chmod +x /usr/local/bin/azcopy
 
 ARG PAJV_VERSION="1.2.0"
-RUN npm install -g pajv@${PAJV_VERSION}
+RUN npm install -g pajv@${PAJV_VERSION} \
+    && npm install -g yarn@1.22.22
 
 # Install git - required for terraform's git modules
 RUN if [ "${INTERACTIVE}" = "false" ]; then \

.devcontainer/devcontainer.json

@@ -18,7 +18,7 @@
       "DOCKER_GROUP_ID": "${localEnv:DOCKER_GROUP_ID}",
       "INTERACTIVE": "true",
       "UPSTREAM_REPO": "OxBRCInformatics/AzureTRE",
-      "UPSTREAM_REPO_VERSION": "tvstre-prod-main-v0.23.1",
+      "UPSTREAM_REPO_VERSION": "tvstre-prod-main-v0.25.12",
       "GITHUB_TOKEN": ""
     }
   },

.github/actions/devcontainer_run_command/action.yml

@@ -1,6 +1,7 @@
 ---
 name: "run_command"
 description: "Run a command in a devcontainer"
+# yamllint disable rule:line-length
 inputs:
   COMMAND:
     description: "The command you want to run in the Devcontainer."
@@ -165,6 +166,14 @@ inputs:
     description: "When set to true removes the need for users to manually grant consent when creating new workspaces"
     required: false
     default: "false"
+  ENABLE_DNS_POLICY:
+    description: "Enable the DNS security policy"
+    required: false
+    default: "false"
+  ALLOWED_DNS:
+    description: "Add allowed domain name to the DNS security policy"
+    required: false
+    default: "[]"
   DOCKER_USERNAME:
     description: "Docker Hub username"
     required: true
@@ -296,7 +305,7 @@ runs:
           -e UI_FOOTER_TEXT="${{ inputs.UI_FOOTER_TEXT }}" \
           -e TF_VAR_resource_processor_number_processes_per_instance="${{ (inputs.RESOURCE_PROCESSOR_NUMBER_PROCESSES_PER_INSTANCE != ''
             && inputs.RESOURCE_PROCESSOR_NUMBER_PROCESSES_PER_INSTANCE) || 5 }}" \
-          -e TF_VAR_firewall_sku=${{ inputs.FIREWALL_SKU }} \
+          -e TF_VAR_firewall_sku=${{ inputs.FIREWALL_SKU != '' && inputs.FIREWALL_SKU || 'Standard' }} \
           -e TF_VAR_app_gateway_sku=${{ inputs.APP_GATEWAY_SKU }} \
           -e TF_VAR_enable_cmk_encryption="${{ (inputs.ENABLE_CMK_ENCRYPTION != ''
             && inputs.ENABLE_CMK_ENCRYPTION) || 'false' }}" \
@@ -307,6 +316,8 @@ runs:
           -e PRIVATE_AGENT_SUBNET_ID=${{ inputs.PRIVATE_AGENT_SUBNET_ID }} \
           -e TF_VAR_private_agent_subnet_id=${{ inputs.PRIVATE_AGENT_SUBNET_ID }} \
           -e TF_VAR_auto_grant_workspace_consent="${{ (inputs.AUTO_GRANT_WORKSPACE_CONSENT != '' && inputs.AUTO_GRANT_WORKSPACE_CONSENT) || 'false' }}" \
+          -e TF_VAR_enable_dns_policy="${{ (inputs.ENABLE_DNS_POLICY != '' && inputs.ENABLE_DNS_POLICY) || 'false' }}" \
+          -e TF_VAR_allowed_dns='${{ (toJson(inputs.ALLOWED_DNS) != '""' && inputs.ALLOWED_DNS) || '[]' }}' \
           -e DOCKER_USERNAME="${{ inputs.DOCKER_USERNAME }}" \
           -e DOCKER_TOKEN="${{ inputs.DOCKER_TOKEN }}" \
           -e E2E_TESTS_NUMBER_PROCESSES="${{ inputs.E2E_TESTS_NUMBER_PROCESSES }}" \

.github/workflows/deploy_tre_reusable.yml

@@ -1,5 +1,6 @@
 ---
 name: Deploy Azure TRE Reusable
+# yamllint disable rule:line-length rule:comments-indentation
 
 on: # yamllint disable-line rule:truthy
   workflow_call:
@@ -281,7 +282,8 @@ jobs:
             az acr login --name "${{ secrets.CI_CACHE_ACR_NAME }}" && ec=0 && break || ec="$?" && sleep 10
           done
           if [ "$ec" != 0 ]; then
-            echo "::error::Failed to login to ACR after 3 attempts. Make sure to run the pipleline on the main branch first."
+            echo "::error::Failed to login to ACR after 3 attempts. Make sure to run the" \
+                 "pipleline on the main branch first."
           fi
           # shellcheck disable=SC2242
           (exit "$ec")
@@ -406,6 +408,8 @@ jobs:
           USER_MANAGEMENT_ENABLED: ${{ vars.USER_MANAGEMENT_ENABLED }}
           PRIVATE_AGENT_SUBNET_ID: ${{ secrets.PRIVATE_AGENT_SUBNET_ID }}
           AUTO_GRANT_WORKSPACE_CONSENT: ${{ vars.AUTO_GRANT_WORKSPACE_CONSENT }}
+          ENABLE_DNS_POLICY: ${{ vars.ENABLE_DNS_POLICY }}
+          ALLOWED_DNS: ${{ vars.ALLOWED_DNS }}
           DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
           DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
 
@@ -781,7 +785,6 @@ jobs:
           TEST_ACCOUNT_CLIENT_SECRET: "${{ secrets.TEST_ACCOUNT_CLIENT_SECRET }}"
           TRE_ID: ${{ secrets.TRE_ID }}
           LOCATION: ${{ vars.LOCATION }}
-          FIREWALL_SKU: ${{ vars.FIREWALL_SKU}}
           DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
           DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
 

config.sample.yaml

@@ -68,6 +68,9 @@ tre:
 
   # Uncomment to deploy to a custom domain
   # custom_domain: __CHANGE_ME__
+
+  # Uncomment to enable vnet exception for the subnet to access private resources like TRE key vault and management storage account.
+  # private_agent_subnet_id: __CHANGE_ME__
 authentication:
   aad_tenant_id: __CHANGE_ME__
   # Setting AUTO_WORKSPACE_APP_REGISTRATION to false will:

templates/workspace_services/guacamole/user_resources/guacamole-azure-linuxvm-ouh2/porter.yaml

@@ -1,7 +1,7 @@
 ---
 schemaVersion: 1.0.0
 name: tre-service-guacamole-linuxvm-ouh2
-version: 1.1.8
+version: 1.2.0
 description: "An Azure TRE User Resource Template for Guacamole (Linux)"
 dockerfile: Dockerfile.tmpl
 registry: azuretre
@@ -44,20 +44,17 @@ custom:
       secure_boot_enabled: true
       vtpm_enabled: true
     "OUH Ubuntu 22.04 Data Science VM":
-      source_image_name: imgdef-linux-vm-custom
+      source_image_name: imgdef-linux-vm-custom-gen2
       install_ui: true
       conda_config: true
       r_config: true
       docker_config: true
-      secure_boot_enabled: true
-      vtpm_enabled: true
-    # For information on using custom images, see README.me in the guacamole/user-resources folder
-    # "Custom Image From Gallery":
-    #   source_image_name: your-image
-    #   install_ui: true
-    #   conda_config: true
-    #   secure_boot_enabled: false
-    #   vtpm_enabled: false
+      # secure_boot and vtpm are disabled because the image was captured from a Standard
+      # security type build VM. The image definition does not have SecurityType=TrustedLaunchSupported
+      # and enabling these flags would cause a validation error on deployment.
+      # Revisit when rebuilding from a Trusted Launch build VM.
+      secure_boot_enabled: false
+      vtpm_enabled: false
 
 
 credentials:
@@ -102,7 +99,7 @@ parameters:
     default: ""
     type: string
     description: "Time of day to shutdown the VM (HHmm format)"
-    pattern: "^([01]?[0-9]|2[0-3])[0-5][0-9]$"
+    pattern: "^([01]?[0-9]|2[0-3])[0-5][0-9]?$"
   - name: shutdown_timezone
     type: string
     description: "Timezone for the shutdown schedule"
@@ -183,9 +180,9 @@ outputs:
 mixins:
   - exec
   - terraform:
-      clientVersion: 1.9.8
+      clientVersion: 1.14.3
   - az:
-      clientVersion: 2.67.0
+      clientVersion: 2.81.0
 
 install:
   - terraform:
@@ -329,7 +326,7 @@ start:
         - login
       flags:
         identity:
-        username: ${ bundle.credentials.azure_client_id }
+        client-id: ${ bundle.credentials.azure_client_id }
   - az:
       description: "Start the VM"
       arguments:
@@ -365,7 +362,7 @@ stop:
         - login
       flags:
         identity:
-        username: ${ bundle.credentials.azure_client_id }
+        client-id: ${ bundle.credentials.azure_client_id }
   - az:
       description: "Stop the VM"
       arguments:
@@ -404,7 +401,7 @@ reset_password:
         - login
       flags:
         identity:
-        username: ${ bundle.credentials.azure_client_id }
+        client-id: ${ bundle.credentials.azure_client_id }
   - exec:
       description: "Reset password and persist to keyvault"
       suppress-output: true

templates/workspace_services/guacamole/user_resources/guacamole-azure-linuxvm-ouh2/template_schema.json

@@ -83,7 +83,14 @@
       "title": "Enable Shutdown Schedule",
       "default": false,
       "description": "Enable automatic shutdown schedule for the VM"
-    }
+    },
+      "assign_to_another_user": {
+      "type": "boolean",
+      "title": "Assign this VM to another user",
+      "description": "Check this box if you want to assign this VM to another user.",
+      "default": false,
+      "updateable": false
+      }
   },
   "allOf": [
     {
@@ -112,31 +119,112 @@
             "description": "Timezone for the shutdown schedule",
             "default": "UTC",
             "enum": [
-              "UTC -12",
-              "UTC -11",
-              "UTC -10",
-              "UTC -9",
-              "UTC -8",
-              "UTC -7",
-              "UTC -6",
-              "UTC -5",
-              "UTC -4",
-              "UTC -3",
-              "UTC -2",
-              "UTC -1",
+              "Afghanistan Standard Time",
+              "Alaskan Standard Time",
+              "Arab Standard Time",
+              "Arabian Standard Time",
+              "Arabic Standard Time",
+              "Argentina Standard Time",
+              "Atlantic Standard Time",
+              "AUS Central Standard Time",
+              "AUS Eastern Standard Time",
+              "Azerbaijan Standard Time",
+              "Azores Standard Time",
+              "Bahia Standard Time",
+              "Bangladesh Standard Time",
+              "Belarus Standard Time",
+              "Canada Central Standard Time",
+              "Cape Verde Standard Time",
+              "Caucasus Standard Time",
+              "Cen. Australia Standard Time",
+              "Central America Standard Time",
+              "Central Asia Standard Time",
+              "Central Brazilian Standard Time",
+              "Central Europe Standard Time",
+              "Central European Standard Time",
+              "Central Pacific Standard Time",
+              "Central Standard Time (Mexico)",
+              "Central Standard Time",
+              "China Standard Time",
+              "Dateline Standard Time",
+              "E. Africa Standard Time",
+              "E. Australia Standard Time",
+              "E. Europe Standard Time",
+              "E. South America Standard Time",
+              "Eastern Standard Time (Mexico)",
+              "Eastern Standard Time",
+              "Egypt Standard Time",
+              "Ekaterinburg Standard Time",
+              "Fiji Standard Time",
+              "FLE Standard Time",
+              "Georgian Standard Time",
+              "GMT Standard Time",
+              "Greenland Standard Time",
+              "Greenwich Standard Time",
+              "GTB Standard Time",
+              "Hawaiian Standard Time",
+              "India Standard Time",
+              "Iran Standard Time",
+              "Israel Standard Time",
+              "Jordan Standard Time",
+              "Kaliningrad Standard Time",
+              "Korea Standard Time",
+              "Libya Standard Time",
+              "Line Islands Standard Time",
+              "Magadan Standard Time",
+              "Mauritius Standard Time",
+              "Middle East Standard Time",
+              "Montevideo Standard Time",
+              "Morocco Standard Time",
+              "Mountain Standard Time (Mexico)",
+              "Mountain Standard Time",
+              "Myanmar Standard Time",
+              "N. Central Asia Standard Time",
+              "Namibia Standard Time",
+              "Nepal Standard Time",
+              "New Zealand Standard Time",
+              "Newfoundland Standard Time",
+              "North Asia East Standard Time",
+              "North Asia Standard Time",
+              "Pacific SA Standard Time",
+              "Pacific Standard Time (Mexico)",
+              "Pacific Standard Time",
+              "Pakistan Standard Time",
+              "Paraguay Standard Time",
+              "Romance Standard Time",
+              "Russia Time Zone 10",
+              "Russia Time Zone 11",
+              "Russia Time Zone 3",
+              "Russian Standard Time",
+              "SA Eastern Standard Time",
+              "SA Pacific Standard Time",
+              "SA Western Standard Time",
+              "Samoa Standard Time",
+              "SE Asia Standard Time",
+              "Singapore Standard Time",
+              "South Africa Standard Time",
+              "Sri Lanka Standard Time",
+              "Syria Standard Time",
+              "Taipei Standard Time",
+              "Tasmania Standard Time",
+              "Tokyo Standard Time",
+              "Tonga Standard Time",
+              "Turkey Standard Time",
+              "Ulaanbaatar Standard Time",
+              "US Eastern Standard Time",
+              "US Mountain Standard Time",
               "UTC",
-              "UTC +1",
-              "UTC +2",
-              "UTC +3",
-              "UTC +4",
-              "UTC +5",
-              "UTC +6",
-              "UTC +7",
-              "UTC +8",
-              "UTC +9",
-              "UTC +10",
-              "UTC +11",
-              "UTC +12"
+              "UTC+12",
+              "UTC-02",
+              "UTC-11",
+              "Venezuela Standard Time",
+              "Vladivostok Standard Time",
+              "W. Australia Standard Time",
+              "W. Central Africa Standard Time",
+              "W. Europe Standard Time",
+              "West Asia Standard Time",
+              "West Pacific Standard Time",
+              "Yakutsk Standard Time"
             ]
           }
         },
@@ -145,6 +233,32 @@
           "shutdown_timezone"
         ]
       }
+    },
+    {
+      "if": {
+        "properties": {
+          "assign_to_another_user": {
+            "const": true
+          }
+        },
+        "required": [
+          "assign_to_another_user"
+        ]
+      },
+      "then": {
+        "properties": {
+          "owner_id": {
+            "type": "string",
+            "title": "Owner ID",
+            "description": "Enter the Object ID of the user you want to assign this VM to.",
+            "default": false,
+            "updateable": false
+          }
+        },
+        "required": [
+          "owner_id"
+        ]
+      }
     }
   ],
   "uiSchema": {