Group Managed Service Account

First, let's explain what gMSA is and why we need it in the context of Kubernetes.

Windows-based networks commonly use Active Directory (AD) to facilitate authentication and authorization between users, computers and other network resources. Enterprise application developers often design their apps to be AD-integrated and run them on domain-joined servers to take advantage of Windows integrated authentication.

Although Windows containers cannot be domain-joined, they can still use Active Directory domain identities to support various authentication scenarios.

To achieve this, you can configure a Windows container to run with a Group Managed Service Account (gMSA), which is a special type of service account introduced in Windows Server 2012, designed to allow multiple computers to share an identity without needing to know its password.

When you run a container with a gMSA, the container host retrieves the gMSA password from an Active Directory domain controller and gives it to the container instance. The container will use the gMSA credentials whenever its computer account (SYSTEM) needs to access network resources.

This article explains how to start using Active Directory group managed service accounts with Windows containers.

Prerequisites

To run a Windows container with a gMSA, you will need the following:

1. An Active Directory domain with at least one domain controller running Windows Server 2012+. There are no forest or domain functional level requirements for using gMSAs, but gMSA passwords can only be distributed by domain controllers running Windows Server 2012+.
2. Permission to create a gMSA account. To create a gMSA account, you need to be a domain administrator or use an account that has been delegated the Create msDS-GroupManagedServiceAccount objects permission.

One-time "Active Directory" preparation

If you haven't created a gMSA in your domain yet, you'll need to create a Key Distribution Service (KDS) root key. The KDS is responsible for creating, rotating and releasing gMSA passwords to authorized hosts. When a container host needs to use a gMSA to run a container, it will contact the KDS to retrieve the current password.

To check whether a KDS root key has already been created, run the following PowerShell cmdlet as a domain administrator on a domain controller or a domain member with the AD PowerShell tools installed:

Get-KdsRootKey

If the command returns a key ID, you're all set. Otherwise, you need to create a KDS root key.

Add-KdsRootKey -EffectiveImmediately

Although the command implies the key will be effective immediately, you will need to wait 10 hours before the KDS root key is replicated and available for use on all domain controllers.