Kubernetes. Part 7: How to run a Pod under a gMSA in Kubernetes

Create the account:

New-ADServiceAccount $serviceaccount `
  -DNSHostName $hostname `
  -PrincipalsAllowedToRetrieveManagedPassword $principals

Here:

• $serviceaccount - the account name (gMSA)
• $hostname - $serviceaccount.domain.com (the account name + the domain name)
• $principals - the list of computers allowed to retrieve the account's password

Now it has to be installed on all Windows nodes in the cluster. Connect to each node and run:

Add-WindowsFeature RSAT-AD-PowerShell
Install-ADServiceAccount -Identity $serviceaccount
Test-ADServiceAccount -Identity $serviceaccount

Get the details of our account:

Install-Module CredentialSpec
New-CredentialSpec -AccountName $serviceaccount

As a result, we get json like this:

{
  "CmsPlugins": [
    "ActiveDirectory"
  ],
  "DomainJoinConfig": {
    "Sid": "S-1-5-21-173000223-3773341904-835667822",
    "MachineAccountName": "vitaliy-org",
    "Guid": "4013ea6c-1050-4ed3-9ce0-10912b11769d",
    "DnsTreeName": "vitaliy.org",
    "DnsName": "vitaliy.org",
    "NetBiosName": "VITALIY"
  },
  "ActiveDirectoryConfig": {
    "GroupManagedServiceAccounts": [
      {
        "Name": "vitaliy-org",
        "Scope": "vitaliy.org"
      },
      {
        "Name": "vitaliy-org",
        "Scope": "VITALIY"
      }
    ]
  }
}

Now we need to produce a gmsa.yaml like this:

apiVersion: windows.k8s.io/v1alpha1
kind: GMSACredentialSpec
metadata:
  name: gmsa-vitaliy-org
credspec:
  ActiveDirectoryConfig:
    GroupManagedServiceAccounts:
    - Name: vitaliy-org
      Scope: VITALIY
    - Name: vitaliy-org
      Scope: vitaliy.org
  CmsPlugins:
  - ActiveDirectory
  DomainJoinConfig:
    DnsName: vitaliy.org
    DnsTreeName: vitaliy.org
    Guid: 4013ea6c-1050-4ed3-9ce0-10912b11769d
    MachineAccountName: vitaliy-org
    NetBiosName: VITALIY
    Sid: S-1-5-21-173000223-3773341904-835667822

Send it to kubernetes:

kubectl apply -f gmsa.yaml

Now we need to create a cluster role that grants access to the gmsa-vitaliy-org resource:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: gmsa-vitaliy-org-role
rules:
- apiGroups: ["windows.k8s.io"]
  resources: ["gmsacredentialspecs"]
  verbs: ["use"]
  resourceNames: ["gmsa-vitaliy-org"]

And finally, add this to the Pod spec:

apiVersion: apps/v1
kind: Pod
spec:
  securityContext:
    windowsOptions:
      gmsaCredentialSpecName: gmsa-vitaliy-org

That's it!