.png)
Building a Secure and Scalable Remote Workspace
Remote Workspace Running on Kubernetes with noVNC Browser Frontend and Cloudflare ZeroTrust for Auth.
Introduction
KubeOps Consulting collaborated with a growing tech company looking for a scalable and secure remote workspace environment customized to their expanding operations. Their requirements included browser-based desktop access without the need for VPNs, the ability to dynamically adjust the number of desktops, encrypted connections and Cloudflare-managed user authentication. Our task was to architect and implement this solution on the AWS platform.
What we did
Our approach centered on leveraging the following technologies:
Kubernetes for container orchestration
noVNC for browser-based VNC access
Cloudflare for secure, zero-trust user authentication
Remote Workspace Implementation with noVNC and Cloudflare Zero Trust:
We implemented a remote workspace solution integrating OpenVNC and VNC client web application. OpenVNC provided a Ubuntu Desktop environment and NoVNC allowed us to access the VNC server directly from the browser.
We deployed AWS Application Load Balancers to expose the desktop instances securely over the internet, ensuring reliability and scalability.
Cloudflare Zero Trust was integrated to secure all public endpoints. This setup ensured that only authorized personnel could access the remote workspaces, enhancing security.
Dynamic Scaling with Kubernetes:
Addressing scalability, we utilized Kubernetes StatefulSet for pod management, which allowed each pod to maintain a unique identity. This is crucial for applications that require stable network identifiers and persistent storage.
Our team developed a custom Kubernetes operator to monitor the StatefulSet, and dynamically manage services and ingress resources for each pod, optimizing system accessibility and organization.
With this approach, each desktop had a unique endpoint - pod1.example.com, pod2.example.com and so on.
Custom noVNC Frontend:
We customized the noVNC frontend to securely manage VNC endpoints, ensuring a seamless and secure connection for users to their remote desktops.
This customization, paired with Cloudflare’s Zero Trust service, ensured that all connections were not only authenticated but also encrypted, providing an additional security layer.
Architecture
.png)
Key Components & Data + Interaction Flow
Browser UI:
This is the user interface where the end-users interact with the remote desktop system. It is accessed via a standard web browser, simplifying the user experience by eliminating the need for additional software.Cloudflare Zero Trust Authentication & SSL:
All traffic from the Browser UI passes through Cloudflare, where Zero Trust authentication ensures that only authenticated users can access the system. SSL (Secure Sockets Layer) encryption is applied to secure all data transmissions over HTTPS, protecting the data from interception or tampering.Authenticated Connection:
Once the user is authenticated and the connection is secured by SSL, they gain access to the Kubernetes-managed backend.Kubernetes with noVNC Frontend:
Kubernetes, a container orchestration platform, manages the deployment and scaling of the noVNC frontend services. noVNC is a browser-based tool that allows users to connect to VNC (Virtual Network Computing) sessions directly from their web browsers, without needing a traditional VNC client.StatefulSet Operator:
A Kubernetes operator manages the StatefulSets, which are used to manage stateful applications like VNC sessions. The operator ensures that each pod in the StatefulSet maintains its unique identity (e.g., network identifiers and storage), which is critical for applications that require a stable state across scaling and pod restarts.Service & Ingress:
Kubernetes Services and Ingress resources are dynamically managed by the operator. These components are responsible for networking within the Kubernetes cluster, providing stable internal routing and managing external access to the services.Pods (Pod 1, Pod 2, ... Pod N):
Each pod represents a containerized instance of the VNC environment, allowing multiple separate sessions to be managed and scaled independently. Each pod can be accessed via its unique endpoint (e.g., pod1.example.com, pod2.example.com), providing isolated workspaces for different users.
This architecture provides a secure, scalable, and user-friendly remote workspace environment. By integrating Cloudflare Zero Trust, the solution enhances security with robust authentication and encryption, ensuring that only authorized users can access their desktops. Kubernetes facilitates easy scaling and management of the remote desktop instances, while noVNC provides a seamless browser-based interface for users. The use of StatefulSets helps maintain the continuity and uniqueness of each session, essential for personalized user environments.
Conclusion
The solution we implemented not only met all of our client's requirements but also exceeded their expectations. By leveraging Kubernetes, noVNC, and Cloudflare, we delivered a secure, scalable and user-friendly remote workspace environment. This enabled precise control over resources and ensured the security of their data.
Our expertise in cloud technologies and DevOps enabled us to develop a customized solution that significantly improved operational efficiency and scalability for our client.
.png)
