Add Windows image field to Admin VM template (#4274)

* [NWSDE #107] Add Windows image field to Admin VM template

* Update parameters.json and CHANGELOG

* Update porter.yaml

* remove default on image_gallery_id - default gets set in porter.yaml

* Fix linting

* Ensure selected image uses image specific config for Secure Boot and vTPM values, rather than hardcoding to true

CHANGELOG.md

@@ -12,6 +12,7 @@ ENHANCEMENTS:
 * Subnet definitions are now inline in the `azurerm_virtual_network` resource, and NSG associations are set using `security_group` in each subnet block (no separate `azurerm_subnet_network_security_group_association` needed). ([[#4255](https://github.com/microsoft/AzureTRE/pull/4255/)])
 * Azure Cosmos DB should disable public network access ([#4322](https://github.com/microsoft/AzureTRE/issues/4322))
 * Add bundle target to Makefile for handling different bundle types in single command ([#4372](https://github.com/microsoft/AzureTRE/issues/4372))
+* Add Windows image field to the Admin VM template ([#4274](https://github.com/microsoft/AzureTRE/pull/4274))
 
 BUG FIXES:
 * Fix upgrade when porter install has failed ([#4338](https://github.com/microsoft/AzureTRE/pull/4338))

templates/shared_services/admin-vm/parameters.json

@@ -57,6 +57,18 @@
       "source": {
         "env": "KEY_STORE_ID"
       }
+    },
+    {
+      "name": "os_image",
+      "source": {
+        "env": "OS_IMAGE"
+      }
+    },
+    {
+      "name": "image_gallery_id",
+      "source": {
+        "env": "IMAGE_GALLERY_ID"
+      }
     }
   ]
 }

templates/shared_services/admin-vm/porter.yaml

@@ -1,11 +1,27 @@
 ---
 schemaVersion: 1.0.0
 name: tre-shared-service-admin-vm
-version: 0.5.2
+version: 0.5.3
 description: "An admin vm shared service"
 dockerfile: Dockerfile.tmpl
 registry: azuretre
 
+custom:
+  image_options:
+    "Windows 11":
+      source_image_reference:
+        publisher: MicrosoftWindowsDesktop
+        offer: windows-11
+        sku: win11-24h2-pro
+        version: latest
+      secure_boot_enabled: true
+      vtpm_enabled: true
+    # For information on using custom images, see README.me in the guacamole/user-resources folder
+    # "Custom Image From Gallery":
+    #   source_image_name: your-image
+    #   secure_boot_enabled: false
+    #   vtpm_enabled: false
+
 credentials:
   - name: azure_tenant_id
     env: ARM_TENANT_ID
@@ -50,6 +66,13 @@ parameters:
   - name: key_store_id
     type: string
     default: ""
+  - name: os_image
+    type: string
+    default: "Windows 11"
+  - name: image_gallery_id
+    type: string
+    description: Azure resource ID for the compute image gallery to pull images from (if specifying custom images by name)
+    default: ""
 
 mixins:
   - terraform:
@@ -64,6 +87,8 @@ install:
         admin_jumpbox_vm_sku: ${ bundle.parameters.admin_jumpbox_vm_sku }
         enable_cmk_encryption: ${ bundle.parameters.enable_cmk_encryption }
         key_store_id: ${ bundle.parameters.key_store_id }
+        image_gallery_id: ${ bundle.parameters.image_gallery_id }
+        image: ${ bundle.parameters.os_image }
       backendConfig:
         use_azuread_auth: "true"
         use_oidc: "true"
@@ -81,6 +106,8 @@ upgrade:
         admin_jumpbox_vm_sku: ${ bundle.parameters.admin_jumpbox_vm_sku }
         enable_cmk_encryption: ${ bundle.parameters.enable_cmk_encryption }
         key_store_id: ${ bundle.parameters.key_store_id }
+        image_gallery_id: ${ bundle.parameters.image_gallery_id }
+        image: ${ bundle.parameters.os_image }
       backendConfig:
         use_azuread_auth: "true"
         use_oidc: "true"
@@ -98,6 +125,8 @@ uninstall:
         admin_jumpbox_vm_sku: ${ bundle.parameters.admin_jumpbox_vm_sku }
         enable_cmk_encryption: ${ bundle.parameters.enable_cmk_encryption }
         key_store_id: ${ bundle.parameters.key_store_id }
+        image_gallery_id: ${ bundle.parameters.image_gallery_id }
+        image: ${ bundle.parameters.os_image }
       backendConfig:
         use_azuread_auth: "true"
         use_oidc: "true"

templates/shared_services/admin-vm/template_schema.json

@@ -6,6 +6,16 @@
   "description": "Provides VM in the core network",
   "required": [],
   "properties": {
+    "os_image": {
+      "$id": "#/properties/os_image",
+      "type": "string",
+      "title": "Windows image",
+      "description": "Select Windows image to use for VM",
+      "enum": [
+        "Windows 11"
+      ],
+      "default": "Windows 11"
+    },
     "admin_jumpbox_vm_sku": {
       "$id": "#/properties/admin_jumpbox_vm_sku",
       "type": "string",

templates/shared_services/admin-vm/terraform/admin-jumpbox.tf

@@ -37,14 +37,19 @@ resource "azurerm_windows_virtual_machine" "jumpbox" {
   admin_password             = random_password.password.result
   tags                       = local.tre_shared_service_tags
   encryption_at_host_enabled = true
-  secure_boot_enabled        = true
-  vtpm_enabled               = true
+  secure_boot_enabled        = local.secure_boot_enabled
+  vtpm_enabled               = local.vtpm_enabled
 
-  source_image_reference {
-    publisher = "MicrosoftWindowsDesktop"
-    offer     = "windows-11"
-    sku       = "win11-24h2-pro"
-    version   = "latest"
+  # set source_image_id/reference depending on the config for the selected image
+  source_image_id = local.selected_image_source_id
+  dynamic "source_image_reference" {
+    for_each = local.selected_image_source_refs
+    content {
+      publisher = source_image_reference.value["publisher"]
+      offer     = source_image_reference.value["offer"]
+      sku       = source_image_reference.value["sku"]
+      version   = source_image_reference.value["version"]
+    }
   }
 
   os_disk {

templates/shared_services/admin-vm/terraform/locals.tf

@@ -8,4 +8,16 @@ locals {
   }
   cmk_name                 = "tre-encryption-${var.tre_id}"
   encryption_identity_name = "id-encryption-${var.tre_id}"
+
+  # Load image details from porter.yaml
+  porter_yaml   = yamldecode(file("${path.module}/../porter.yaml"))
+  image_details = local.porter_yaml["custom"]["image_options"]
+
+  # Create local variables to support the VM resource
+  selected_image = local.image_details[var.image]
+  # selected_image_source_refs is an array to enable easy use of a dynamic block
+  selected_image_source_refs = lookup(local.selected_image, "source_image_reference", null) == null ? [] : [local.selected_image.source_image_reference]
+  selected_image_source_id   = lookup(local.selected_image, "source_image_name", null) == null ? null : "${var.image_gallery_id}/images/${local.selected_image.source_image_name}"
+  secure_boot_enabled        = lookup(local.selected_image, "secure_boot_enabled", false)
+  vtpm_enabled               = lookup(local.selected_image, "vtpm_enabled", false)
 }

templates/shared_services/admin-vm/terraform/variables.tf

@@ -20,3 +20,11 @@ variable "enable_cmk_encryption" {
 variable "key_store_id" {
   type = string
 }
+
+variable "image_gallery_id" {
+  type = string
+}
+
+variable "image" {
+  type = string
+}