Skip to content

Commit 6807ab7

Browse files
author
Justin Davies
committed
Update GMSA docs to GA status
1 parent 0ac1270 commit 6807ab7

File tree

2 files changed

+3
-42
lines changed

2 files changed

+3
-42
lines changed

articles/aks/TOC.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -262,7 +262,7 @@
262262
href: managed-aad.md
263263
- name: Azure AD integration (legacy)
264264
href: azure-ad-integration-cli.md
265-
- name: Enable GMSA integration (Preview)
265+
- name: Enable GMSA integration
266266
href: use-group-managed-service-accounts.md
267267
- name: Use Azure RBAC for Kubernetes authorization
268268
href: manage-azure-rbac.md

articles/aks/use-group-managed-service-accounts.md

Lines changed: 2 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -1,65 +1,26 @@
11
---
2-
title: Enable Group Managed Service Accounts (GMSA) for your Windows Server nodes on your Azure Kubernetes Service (AKS) cluster (Preview)
2+
title: Enable Group Managed Service Accounts (GMSA) for your Windows Server nodes on your Azure Kubernetes Service (AKS) cluster
33
description: Learn how to enable Group Managed Service Accounts (GMSA) for your Windows Server nodes on your Azure Kubernetes Service (AKS) cluster for securing your pods.
44
services: container-service
55
ms.topic: article
66
ms.date: 11/01/2021
77
---
88

9-
# Enable Group Managed Service Accounts (GMSA) for your Windows Server nodes on your Azure Kubernetes Service (AKS) cluster (Preview)
9+
# Enable Group Managed Service Accounts (GMSA) for your Windows Server nodes on your Azure Kubernetes Service (AKS) cluster
1010

1111
[Group Managed Service Accounts (GMSA)][gmsa-overview] is a managed domain account for multiple servers that provides automatic password management, simplified service principal name (SPN) management and the ability to delegate the management to other administrators. AKS provides the ability to enable GMSA on your Windows Server nodes, which allows containers running on Windows Server nodes to integrate with and be managed by GMSA.
1212

13-
Enabling GMSA with Windows Server nodes on AKS is in preview.
14-
15-
[!INCLUDE [preview features callout](./includes/preview/preview-callout.md)]
1613

1714
## Pre-requisites
1815

1916
Enabling GMSA with Windows Server nodes on AKS requires:
2017

2118
* Kubernetes 1.19 or greater.
22-
* The `aks-preview` extension version 0.5.37 or greater.
23-
* The Docker container runtime, which is currently the default.
2419
* [Managed identities][aks-managed-id] with your AKS cluster.
2520
* Permissions to create or update an Azure Key Vault.
2621
* Permissions to configure GMSA on Active Directory Domain Service or on-prem Active Directory.
2722
* The domain controller must have Active Directory Web Services enabled and must be reachable on port 9389 by the AKS cluster.
2823

29-
### Install the `aks-preview` Azure CLI
30-
31-
You will need the *aks-preview* Azure CLI extension. Install the *aks-preview* Azure CLI extension by using the [az extension add][az-extension-add] command. Or install any available updates by using the [az extension update][az-extension-update] command.
32-
33-
```azurecli-interactive
34-
# Install the aks-preview extension
35-
az extension add --name aks-preview
36-
37-
# Update the extension to make sure you have the latest version installed
38-
az extension update --name aks-preview
39-
```
40-
41-
### Register the `AKSWindowsGmsaPreview` preview feature
42-
43-
To use the feature, you must also enable the `AKSWindowsGmsaPreview` feature flag on your subscription.
44-
45-
Register the `AKSWindowsGmsaPreview` feature flag by using the [az feature register][az-feature-register] command, as shown in the following example:
46-
47-
```azurecli-interactive
48-
az feature register --namespace "Microsoft.ContainerService" --name "AKSWindowsGmsaPreview"
49-
```
50-
51-
It takes a few minutes for the status to show *Registered*. Verify the registration status by using the [az feature list][az-feature-list] command:
52-
53-
```azurecli-interactive
54-
az feature list -o table --query "[?contains(name, 'Microsoft.ContainerService/AKSWindowsGmsaPreview')].{Name:name,State:properties.state}"
55-
```
56-
57-
When ready, refresh the registration of the *Microsoft.ContainerService* resource provider by using the [az provider register][az-provider-register] command:
58-
59-
```azurecli-interactive
60-
az provider register --namespace Microsoft.ContainerService
61-
```
62-
6324
## Configure GMSA on Active Directory domain controller
6425

6526
To use GMSA with AKS, you need both GMSA and a standard domain user credential to access the GMSA credential configured on your domain controller. To configure GMSA on your domain controller, see [Getting Started with Group Managed Service Accounts][gmsa-getting-started]. For the standard domain user credential, you can use an existing user or create a new one, as long as it has access to the GMSA credential.

0 commit comments

Comments
 (0)