Operations
Deploy topology, secrets, env vars, warm pool, and verify gates for desktop pods and VMs.
Desktop traffic spans GKE pods (Linux) and an AWS desktop VPC (Windows VM via Guacamole + EC2 Mac). Trainers only talk to the gateway; sandboxes pods reach private streamers over VPN / PrivateLink.
| Profile | Where it runs | Notes |
|---|---|---|
desktop-ubuntu | GKE sandbox-jobs pods | Warm pool; recycle after image push |
desktop-windows | EC2 VM + Guacamole | SANDBOX_VM_DESKTOP_VIEWER_HOST from sandboxes |
desktop-macos | External Mac (aws-ec2-mac) | Stream only reachable from sandboxes pods |
Public internet exposure of RDP / VNC / Mac streams without the sandboxes token proxy is not supported.
Image deploy (Linux)
- Build
sandbox-desktop-ubuntuwith TigerVNC-BlacklistThreshold 0in supervisord. - Push to the env registry; CD updates the deployment.
- Recycle warm pool: delete stale warm pods in
sandbox-jobs. - Run
scripts/verify-viewer-dev.sh.
Secrets
| Secret | Profiles |
|---|---|
| Viewer signing key | all desktop |
sandbox-desktop-aws | desktop-macos (secret_ref) |
| EC2 / Guacamole DB credentials | desktop-windows |
GSM → ESO wiring: in-repo docs/sandbox/SECRETS.md.
Env parity
New env vars must appear in payload*.json.example, Helm values, and Terraform.
| Variable | Purpose |
|---|---|
SANDBOX_VM_DESKTOP_VIEWER_HOST | Guacamole host for Windows VM backend |
SANDBOX_VM_DESKTOP_VIEWER_ENDPOINT | Alternate host:port form |
SANDBOX_VM_DESKTOP_VIEWER_PORT | Guacamole port (default 4822) |
SANDBOX_AWS_EC2_MAC_VIEWER_HOST | Override Mac stream host (dev/smoke) |
Verify gate (dev)
make check-sandbox
scripts/verify-viewer-dev.sh
scripts/verify-viewer-windows-dev.sh
scripts/verify-viewer-macos-dev.shSet catalog enabled: true for each profile only after its verify script passes.
desktop-windows and desktop-macos ship enabled: false until then.
Warm pool
desktop-ubuntu uses SessionWarmPool. After image updates, drain old pods so
trainers do not get stale TigerVNC configs.
Cross-cloud networking
Sandboxes pods must reach:
- Guacamole (Windows) — typically
:8080/ configured viewer port - EC2 Mac private stream port (macOS)
Document CIDRs and VPN/PrivateLink endpoints in the infra runbooks
(turing-agios-infra).