Mantenha tudo organizado com as coleções
Salve e categorize o conteúdo com base nas suas preferências.
Last reviewed 2025-01-09 UTC
O Apache Guacamole
oferece uma maneira totalmente baseada em navegador para acessar áreas de trabalho remotas usando o protocolo
de área de trabalho remota (RDP), computação de rede virtual (VNC) e Secure Shell Protocol (SSH)
em máquinas virtuais (VMs) do Compute Engine. O Identity-Aware Proxy (IAP) fornece
acesso ao Guacamole com segurança aprimorada.
Este documento de arquitetura de referência é destinado a administradores e
engenheiros de servidores que querem hospedar o Apache Guacamole no Google Kubernetes Engine (GKE) e no
Cloud SQL. Neste documento, pressupomos que você esteja familiarizado com a implantação
de cargas de trabalho no Kubernetes e no Cloud SQL para MySQL. Neste documento também presumimos que você
conheça o Identity and Access Management e o Google Compute Engine.
Arquitetura
O diagrama a seguir mostra como um balanceador de carga Google Cloud é
configurado com o IAP para proteger uma instância do cliente
Guacamole em execução no GKE:
Essa arquitetura inclui os seguintes componentes:
Google Cloud balanceador de carga:distribui o tráfego em várias instâncias,
o que reduz o risco de problemas de desempenho.
IAP: fornece segurança aprimorada por meio de uma extensão
de autenticação personalizada.
Cliente Guacamole: é executado no GKE e se conecta ao
serviço de back-end guacd.
Serviço de back-end guacd: intermedia as conexões da área de trabalho remota a uma ou mais
VMs do Compute Engine.
Banco de dados do Guacamole no Cloud SQL: gerencia dados de configuração do
Guacamole.
Instâncias do Compute Engine: VMs hospedadas na infraestrutura do Google.
Considerações sobre o design
As diretrizes a seguir podem ajudar você a desenvolver uma arquitetura que atenda aos
requisitos da sua organização para segurança, custo e desempenho.
Segurança e compliance
Essa arquitetura usa o IAP para ajudar a proteger o acesso ao serviço Guacamole. Os usuários autorizados fazem login na instância do Guacamole por meio de uma extensão de autenticação personalizada do IAP. Para saber mais, consulte a extensão personalizada no GitHub.
Quando você adiciona outros usuários (por meio da interface do usuário do Guacamole), eles precisam ter permissões por meio do IAM com o papel IAP-secured Web App User.
A configuração do OAuth criada por essa implantação
é definida como interna.
Por causa dessa configuração, você precisa usar uma conta do Google na mesma organização
usada para implantar o Guacamole. Se você usar uma Conta do Google fora da organização, receberá um erro HTTP/403 org_internal.
Desempenho
Google Cloud O balanceador de carga e o GKE distribuem o tráfego
em várias instâncias, o que ajuda a reduzir o risco de problemas de desempenho.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-01-09 UTC."],[[["\u003cp\u003eApache Guacamole provides browser-based access to remote desktops via RDP, VNC, and SSH on Compute Engine VMs, enhanced by Identity-Aware Proxy (IAP) for security.\u003c/p\u003e\n"],["\u003cp\u003eThis architecture details hosting Apache Guacamole on Google Kubernetes Engine (GKE) and Cloud SQL, leveraging a Google Cloud load balancer to manage traffic and IAP for secure access.\u003c/p\u003e\n"],["\u003cp\u003eThe Guacamole setup uses a guacd backend service to broker remote connections, while the configuration data is managed through a Guacamole database in Cloud SQL.\u003c/p\u003e\n"],["\u003cp\u003eAccess to the Guacamole service is protected by IAP, requiring users to sign in through a custom IAP authentication extension and possess the \u003ccode\u003eIAP-secured Web App User\u003c/code\u003e role within IAM.\u003c/p\u003e\n"],["\u003cp\u003eThis deployment utilizes an internal OAuth configuration, restricting access to Google accounts within the same organization as the one used for deployment.\u003c/p\u003e\n"]]],[],null,["# Apache Guacamole on GKE and Cloud SQL\n\n[Apache Guacamole](https://guacamole.apache.org/)\noffers a fully browser-based way to access remote desktops through Remote Desktop\nProtocol (RDP), Virtual Network Computing (VNC), and Secure Shell Protocol (SSH)\non Compute Engine virtual machines (VMs). Identity-Aware Proxy (IAP) provides\naccess to Guacamole with improved security.\n\nThis reference architecture document is intended for server administrators and\nengineers who want to host Apache Guacamole on Google Kubernetes Engine (GKE) and\nCloud SQL. This document assumes you are familiar with deploying\nworkloads to Kubernetes and Cloud SQL for MySQL. This document also assumes you\nare familiar with Identity and Access Management and Google Compute Engine.\n| **Note:** Apache Guacamole is not a full Virtual Desktop Infrastructure (VDI) solution by itself. For alternative solutions that provide a full VDI, see [Virtual Desktops Solutions](/solutions/virtual-desktops).\n\nArchitecture\n------------\n\nThe following diagram shows how a Google Cloud load balancer is\nconfigured with IAP, to protect an instance of the Guacamole\nclient running in GKE:\n\nThis architecture includes the following components:\n\n- **Google Cloud load balancer:** Distributes traffic across multiple instances, which reduces the risk of performance issues.\n- **IAP:** Provides improved security through a custom authentication extension.\n- **Guacamole client:** Runs in GKE and connects to the guacd backend service.\n- **Guacd backend service:** Brokers remote desktop connections to one or more Compute Engine VMs.\n- **Guacamole database in Cloud SQL:** Manages configuration data for Guacamole.\n- **Compute Engine instances:** VMs hosted on the Google infrastructure.\n\nDesign considerations\n---------------------\n\nThe following guidelines can help you to develop an architecture that meets your\norganization's requirements for security, cost, and performance.\n\n### Security and compliance\n\nThis architecture uses IAP to help protect access to the\nGuacamole service. Authorized users sign in to the Guacamole instance through a\ncustom IAP authentication extension. For details, see the [custom\nextension in GitHub](https://github.com/GoogleCloudPlatform/guacamole-on-gcp/tree/main/client/extensions/guacamole-auth-googleiap).\n\nWhen you add additional users (through the Guacamole user interface), these additional\nusers must have permissions through IAM, with the\n`IAP-secured Web App User` role.\n\nThe OAuth configuration that this deployment creates\nis set to [internal](https://support.google.com/cloud/answer/6158849).\nBecause of this setting, you must use a Google account in the same organization\nas the one you use to deploy Guacamole. If you use a Google account outside the\norganization, you receive an `HTTP/403 org_internal` error.\n\n### Performance\n\nGoogle Cloud load balancer and GKE distributes traffic\nacross multiple instances, which helps to reduce the risk of performance issues.\n\nDeployment\n----------\n\nTo deploy this architecture, see [Deploy Apache Guacamole on GKE and Cloud SQL](/architecture/deploy-guacamole-gke/deployment).\n\nWhat's Next?\n------------\n\n- Review the GKE guidance on [Hardening your cluster's security](/kubernetes-engine/docs/how-to/hardening-your-cluster).\n- Review [Encrypt secrets at the application layer](/kubernetes-engine/docs/how-to/encrypting-secrets) to increase security for secrets, such as database credentials and OAuth credentials.\n- Review [IAM Conditions](/iam/docs/conditions-overview) to learn how to provide more granular control for user access to Guacamole.\n- Understand more about how IAP integration works by reviewing the custom authentication provider in the [GitHub repository](https://github.com/GoogleCloudPlatform/guacamole-on-gcp).\n- For more reference architectures, diagrams, and best practices, explore the [Cloud Architecture Center](/architecture).\n\nContributors\n------------\n\nAuthor: [Richard Grime](https://www.linkedin.com/in/richard-grime-53777880) \\| Principal Architect, UK Public Sector\n\nOther contributors:\n\n- [Aaron Lind](https://www.linkedin.com/in/the-aaron-lind/) \\| Solution Engineer, Application Innovation\n- [Eyal Ben Ivri](https://www.linkedin.com/in/eyalbenivri) \\| Cloud Solutions Architect\n- [Ido Flatow](https://www.linkedin.com/in/idoflatow) \\| Cloud Solutions Architect\n\n\u003cbr /\u003e"]]
