Google Cloud virtualization environments
Citrix DaaS (formerly Citrix Virtual Apps and Desktops service) lets you provision and manage machines on Google Cloud.
Prerequisites
Before you start provisioning the VMs to Google Cloud Platform (GCP), you must make sure the following prerequisites are met.
- The Citrix subscription must include support for Hybrid Multi-Cloud workloads. For more information, see Compare Citrix subscription features.
- The admin account must have sufficient permissions to create host connections, machine catalogs, and delivery groups. For more information, see Configure Delegated Administration.
- Identify a Google Cloud project, in which all compute resources associated with the machine catalog are stored. It can be an existing project or a new one. For more information, see Google Cloud projects.
- Enable the Google Cloud APIs required for the integration with Citrix DaaS. For more information, see Enable Google Cloud APIs.
- Create the service accounts in Google Cloud and grant the appropriate permissions. For more information, see Configure and update service accounts.
- Download the key file for the Citrix Cloud Service Account. For more information, see Citrix Cloud Service Account key.
- The virtual machines must have access to the Google APIs without a public IP address. For more information, see Enable Private Google Access.
Google Cloud projects
There are basically two types of Google Cloud projects:
- Provisioning project: In this case, the current admin account owns the provisioned machines in the project. This project is also referred to as a local project.
- Shared VPC project: Project in which machines created in the provisioning project use the VPC from the Shared VPC project. The admin account used for provisioning projects has limited permissions in this project, specifically, only permissions to use the VPC.
Service endpoint URLs
You must have access to the following URLs:
https://oauth2.googleapis.comhttps://cloudresourcemanager.googleapis.comhttps://compute.googleapis.comhttps://storage.googleapis.comhttps://cloudbuild.googleapis.com
Enable Google Cloud APIs
To use the Google Cloud functionality through Studio, enable these APIs in your Google Cloud project:
- Compute Engine API
- Cloud Resource Manager API
- Identity and Access Management (IAM) API
- Cloud Build API
From the Google Cloud console, complete these steps:
- In the upper left menu, select APIs and Services > Enabled APIs & services.
-
On the Enabled APIs & services screen, ensure that the Compute Engine API is enabled. If not, follow these steps:
- Navigate to APIs and Services > Library.
- In the search box, type Compute Engine.
- From the search results, select Compute Engine API.
- On the Compute Engine API page, select Enable.
- Enable Cloud Resource Manager API.
- Navigate to APIs and Services > Library.
- In the search box, type Cloud Resource Manager.
- From the search results, select Cloud Resource Manager API.
- On the Cloud Resource Manager API page, select Enable. The status of the API appears.
- Similarly, enable Identity and Access Management (IAM) API and Cloud Build API, and Cloud Key Management Service (KMS) API.
You can also use Google Cloud Shell to enable the APIs. To do this:
- Open the Google Console and load the Cloud Shell.
-
Run the following four commands in the Cloud Shell:
- gcloud services enable compute.googleapis.com
- gcloud services enable cloudresourcemanager.googleapis.com
- gcloud services enable iam.googleapis.com
- gcloud services enable cloudbuild.googleapis.com
- gcloud services enable cloudkms.googleapis.com
- Click Authorize when the Cloud Shell prompts.
Configure and update service accounts
Note:
GCP is introducing changes to Cloud Build Service’s default behavior and use of service accounts after April 29, 2024. For more information, see Cloud Build Service Account Change. Your existing Google projects with Cloud Build API enabled before April 29, 2024 are not affected by this change. However, if you want to have existing Cloud Build Service behavior after April 29, you can create or apply the organization policy to disable the constraint enforcement before you enable the Cloud Build API. As a result, the following content is divided into two: Before April 29, 2024 and After April 29, 2024. If you set the new organization policy, follow the section Before April 29, 2024.
Before April 29, 2024
Citrix Cloud uses three separate service accounts within the Google Cloud project:
-
Citrix Cloud Service Account: This service account enables Citrix Cloud to access the Google project, provision, and manage machines. This service account authenticates to Google Cloud using a key generated by Google Cloud.
You must create this service account manually as outlined here. For more information, see Create a Citrix Cloud Service Account.
You can identify this service account with an email address. For example,
<my-service-account>@<project-id>.iam.gserviceaccount.com. -
Cloud Build Service Account: This service account is provisioned automatically after you enable all the APIs mentioned in Enable Google Cloud APIs. To view all automatically created service accounts, navigate to IAM & Admin > IAM in the Google Cloud console and select the Include Google-provided role grants checkbox.
You can identify this service account by an email address that begins with the Project ID and the word cloudbuild. For example,
<project-id>@cloudbuild.gserviceaccount.comVerify if the service account has been granted the following roles. If you must add roles, follow the steps outlined in Add roles to the Cloud Build Service Account.
- Cloud Build Service Account
- Compute Instance Admin
- Service Account User
-
Cloud Compute Service Account: This service account is added by Google Cloud to instances created in Google Cloud once the Compute API is activated. This account has the IAM basic editor role to do the operations. However, if you delete the default permission to have more granular control, you must add a Storage Admin role that requires the following permissions:
- resourcemanager.projects.get
- storage.objects.create
- storage.objects.get
- storage.objects.list
You can identify this service account by an email address that begins with the Project ID and the word compute. For example, <project-id>-compute@developer.gserviceaccount.com.
Create a Citrix Cloud Service Account
To create a Citrix Cloud Service Account, follow these steps:
- In the Google Cloud console, navigate to IAM & Admin > Service accounts.
- On the Service accounts page, select CREATE SERVICE ACCOUNT.
- On the Create service account page, enter the required information, and then select CREATE AND CONTINUE.
-
On the Grant this service account access to project page, click the Select a role drop-down menu and select the required roles. Click +ADD ANOTHER ROLE if you want to add more roles.
Each account (personal or service) has various roles defining the management of the project. Grant the following roles to this service account:
- Compute Admin
- Storage Admin
- Cloud Build Editor
- Service Account User
- Cloud Datastore User
- Cloud KMS Crypto Operator
The Cloud KMS Crypto Operator requires the following permissions:
- cloudkms.cryptoKeys.get
- cloudkms.cryptoKeys.list
- cloudkms.keyRings.get
- cloudkms.keyRings.list
- cloudkms.cryptoKeyVersions.useToDecrypt
- cloudkms.cryptoKeyVersions.useToEncrypt
Note:
Enable all the APIs to get the complete list of roles available while creating a new service account.
- Click CONTINUE
- On the Grant users access to this service account page, add users or groups to grant them access to perform actions in this service account.
- Click DONE.
- Navigate to the IAM main console.
- Identify the service account created.
- Validate the roles are assigned successfully.
Considerations:
When creating the service account, consider the following:
- The steps Grant this service account access to project and Grant users access to this service account are optional. If you choose to skip these optional configuration steps, the newly created service account does not display in the IAM & Admin > IAM page.
- To display roles associated with a service account, add the roles without skipping the optional steps. This process ensures that roles appear for the configured service account.
Citrix Cloud Service Account key
The Citrix Cloud Service Account key is required for creating a connection in Citrix DaaS. The key is contained in a credential file (.json). The file is automatically downloaded and saved to the Downloads folder after you create the key. When you create the key, be sure to set the key type to JSON. Otherwise, Studio cannot parse it.
To create a Service Account Key, navigate to IAM & Admin > Service accounts and click the email address of the Citrix Cloud Service Account. Switch to the Keys tab and select Add Key > Create new key. Make sure to select JSON as the key type.
Tip:
Create keys using the Service accounts page in the Google Cloud console. We recommend that you change keys regularly for security purposes. You can provide new keys to the Citrix Virtual Apps and Desktops application by editing an existing Google Cloud connection.
Add roles to the Citrix Cloud Service Account
To add roles to the Citrix Cloud Service Account:
- In the Google Cloud console, navigate to IAM & Admin > IAM.
-
On the IAM > PERMISSIONS page, locate the service account you created, identifiable with an email address.
For example,
<my-service-account>@<project-id>.iam.gserviceaccount.com - Select the pencil icon to edit the access to the principal of the service account.
- On the Edit access to “project-id” page for the selected principal option, select ADD ANOTHER ROLE to add the required roles to your service account one by one and then select SAVE.
Add roles to the Cloud Build Service Account
To add roles to the Cloud Build Service Account:
- In the Google Cloud console, navigate to IAM & Admin > IAM.
-
On the IAM page, locate the Cloud Build service account, identifiable with an email address that begins with the Project ID and the word cloudbuild.
For example,
<project-id>@cloudbuild.gserviceaccount.com - Select the pencil icon to edit the Cloud Build account roles.
-
On the Edit access to “project-id” page for the selected principal option, select ADD ANOTHER ROLE to add the required roles to your Cloud Build service account one by one and then select SAVE.
Note:
Enable all the APIs to get the complete list of roles.
After April 29, 2024
Citrix Cloud uses two separate service accounts within the Google Cloud project:
-
Citrix Cloud Service Account: This service account enables Citrix Cloud to access the Google project, provision, and manage machines. This service account authenticates to Google Cloud using a key generated by Google Cloud.
You must create this service account manually.
You can identify this service account with an email address. For example,
<my-service-account>@<project-id>.iam.gserviceaccount.com. -
Cloud Compute Service Account: This service account is provisioned automatically after you enable all the APIs mentioned in Enable Google Cloud APIs. To view all automatically created service accounts, navigate to IAM & Admin > IAM in the Google Cloud console and select the Include Google-provided role grants checkbox. This account has the IAM basic editor role to do the operations. However, if you delete the default permission to have more granular control, you must add Storage Admin role that requires the following permissions:
- resourcemanager.projects.get
- storage.objects.create
- storage.objects.get
- storage.objects.list
You can identify this service account by an email address that begins with the Project ID and the word compute. For example,
<project-id>-compute@developer.gserviceaccount.com.Verify if the service account has been granted the following roles.
- Cloud Build Service Account
- Compute Instance Admin
- Service Account User
Create a Citrix Cloud Service Account
To create a Citrix Cloud Service Account, follow these steps:
- In the Google Cloud console, navigate to IAM & Admin > Service accounts.
- On the Service accounts page, select CREATE SERVICE ACCOUNT.
- On the Create service account page, enter the required information, and then select CREATE AND CONTINUE.
-
On the Grant this service account access to project page, click the Select a role drop-down menu and select the required roles. Click +ADD ANOTHER ROLE if you want to add more roles.
Each account (personal or service) has various roles defining the management of the project. Grant the following roles to this service account:
- Compute Admin
- Storage Admin
- Cloud Build Editor
- Service Account User
- Cloud Datastore User
- Cloud KMS Crypto Operator
The Cloud KMS Crypto Operator requires the following permissions:
- cloudkms.cryptoKeys.get
- cloudkms.cryptoKeys.list
- cloudkms.keyRings.get
- cloudkms.keyRings.list
Note:
Enable all the APIs to get the complete list of roles available while creating a new service account.
- Click CONTINUE
- On the Grant users access to this service account page, add users or groups to grant them access to perform actions in this service account.
- Click DONE.
- Navigate to the IAM main console.
- Identify the service account created.
- Validate the roles are assigned successfully.
Considerations:
When creating the service account, consider the following:
- The steps Grant this service account access to project and Grant users access to this service account are optional. If you choose to skip these optional configuration steps, the newly created service account does not display in the IAM & Admin > IAM page.
- To display roles associated with a service account, add the roles without skipping the optional steps. This process ensures that roles appear for the configured service account.
Citrix Cloud Service Account key
The Citrix Cloud Service Account key is required for creating a connection in Citrix DaaS. The key is contained in a credential file (.json). The file is automatically downloaded and saved to the Downloads folder after you create the key. When you create the key, be sure to set the key type to JSON. Otherwise, Studio cannot parse it.
To create a Service Account Key, navigate to IAM & Admin > Service accounts and click the email address of the Citrix Cloud Service Account. Switch to the Keys tab and select Add Key > Create new key. Make sure to select JSON as the key type.
Tip:
Create keys using the Service accounts page in the Google Cloud console. We recommend that you change keys regularly for security purposes. You can provide new keys to the Citrix Virtual Apps and Desktops application by editing an existing Google Cloud connection.
Add roles to the Citrix Cloud Service Account
To add roles to the Citrix Cloud Service Account:
- In the Google Cloud console, navigate to IAM & Admin > IAM.
-
On the IAM > PERMISSIONS page, locate the service account you created, identifiable with an email address.
For example,
<my-service-account>@<project-id>.iam.gserviceaccount.com - Select the pencil icon to edit the access to the principal of the service account.
- On the Edit access to “project-id” page for the selected principal option, select ADD ANOTHER ROLE to add the required roles to your service account one by one and then select SAVE.
Add roles to the Cloud Compute Service Account
To add roles to the Cloud Compute Service Account:
- In the Google Cloud console, navigate to IAM & Admin > IAM.
-
On the IAM page, locate the Cloud Compute Service Account, identifiable with an email address that begins with the Project ID and the word compute.
For example,
<project-id>-compute@developer.gserviceaccount.com - Select the pencil icon to edit the Cloud Build account roles.
-
On the Edit access to “project-id” page for the selected principal option, select ADD ANOTHER ROLE to add the required roles to your Cloud Build service account one by one and then select SAVE.
Note:
Enable all the APIs to get the complete list of roles.
Storage permissions and bucket management
Citrix DaaS improves the process of reporting cloud build failures for the Google Cloud service. This service runs builds on the Google Cloud. Citrix DaaS creates a storage bucket named citrix-mcs-cloud-build-logs-{region}-{5 random characters} where the Google Cloud services captures build log information. An option is set on this bucket that deletes the contents after a period of 30 days. This process requires that the service account used for the connection has Google Cloud permissions set to storage.buckets.update. If the service account does not have this permission, Citrix DaaS ignores errors and proceeds with the catalog creation process. Without this permission, the size of the build logs increases and requires manual cleanup.
Enable private Google access
When a VM lacks an external IP address assigned to its network interface, packets are only sent to other internal IP addresses destinations. When you enable private access, the VM connects to the set of external IP addresses used by the Google API and associated services.
Note:
Whether private Google access is enabled, all VMs that are with and without public IP addresses, must be able to access Google Public APIs, especially if third-party networking appliances have been installed in the environment.
To ensure that a VM in your subnet can access the Google APIs without a public IP address for MCS provisioning:
- In Google Cloud, access the VPC network configuration.
- Identify the subnets used or the Citrix environment in the Subnets in current project tab.
- Click the name of the subnets and enable Private Google Access.
For more information, see Configuring Private Google Access.
Important:
If your network is configured to prevent VM access to the internet, ensure that your organization assumes the risks associated with enabling Private Google access for the subnet to which the VM is connected.
Where to go next
- For a simple proof-of-concept deployment, install a VDA on a machine designated to deliver apps or a desktop to your users.
- For creating and managing connections, see Connection to Google cloud environments.
- Review all the steps in the installation and configuration process.