Understanding Active Directory integration on Kubernetes
In Chapter 5, Deploying an EC2 Windows-Based Task, in the Setting up Active Directory integration section, we dove deep into the use case and methods available to set up Active Directory integration. The concept and use case remains the same here; the only difference is how to implement it in Kubernetes.
In Kubernetes, two Webhook admission controllers (open sourced by Kubernetes-SIG) are required to support Active Directory integration with the Kerberos protocol:
- A mutating Webhook is responsible for modifying objects sent to the API server, which modifies the gMSA account reference into a JSON file within the Pod spec
- A validating Webhook ensures the gMSA account is authorized to be used by the Pod service account
Important note
The gMSA admission Webhook can be found at https://github.com/kubernetes-sigs/windows-gmsa.
Installing the gMSA Webhook admission controller is easy, but it requires changing...
