Search code examples
google-cloud-platformgmsa

Create gMSA with managed AD on google cloud

For a POC for using AD on the google cloud with kuberenetes, I created a managed active directory, as is described in this link.

To add a gMSA account for the AD, I looked at this documentation. It looks like I should use the New-ADServiceAccount command from the AD VM. However, when looking at the domain I've created on pantheon , I couldn't find the VM it is on. The interface does not give me any clues as to how I could add users, or do anything with the domain.

Any help will be appreciated. Thank you,

Solution

  • It not written in the docs, but it is not complicated. One should first join the domain from another windows machine (note that this is not supported on all windows OSes). This is done exactly like a regular machine joining a regular AD, as long as the domain and the machine are in the same vpc.

    Then, install the AD roles on the joined machine, and run the New-ADServiceAccount commnad from there.

    Comment 1: Some machines on the GCE cannot join a domain (even with windows server datacenter). I have not figured out why, and instead opened a different machine.

    Comment 2: Windows integration in kubernetes is new, and possibly this answer will not be relevant in 6 mounts.