Kubernetes Windows容器GMSA配置：Webhook安装替代方案咨询

Got it, let's tackle this problem step by step. Since you're working entirely on a Windows machine with kubectl, and your cluster only uses Windows Server 2019 containers (so no Linux environment to run the official bash script), here are practical alternatives to configure the GMSA validation webhook:

1. Replicate the Script's Functionality with PowerShell #

You can generate all required certificates and set up the webhook using native PowerShell commands, no Linux tools needed. Here's how:

Step 1: Generate a self-signed CA certificate #

# Create a self-signed CA certificate
$caCert = New-SelfSignedCertificate -Type Custom -Subject "CN=gmsa-webhook-ca" -KeySpec Signature -KeyExportPolicy Exportable -KeyLength 2048 -KeyAlgorithm RSA -HashAlgorithm SHA256 -CertStoreLocation "Cert:\CurrentUser\My" -TextExtension @("2.5.29.19={text}ca=TRUE&pathlength=0")

Step 2: Generate the webhook server certificate #

The server certificate needs to match the webhook's service DNS name (typically gmsa-webhook.kube-system.svc):

$dnsName = "gmsa-webhook.kube-system.svc"
$serverCert = New-SelfSignedCertificate -Type Custom -Subject "CN=$dnsName" -KeySpec Signature -KeyExportPolicy Exportable -KeyLength 2048 -KeyAlgorithm RSA -HashAlgorithm SHA256 -CertStoreLocation "Cert:\CurrentUser\My" -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.1", "2.5.29.17={text}DNS=$dnsName") -Signer $caCert

Step 3: Export certificates and keys to PEM format #

PowerShell stores certs in Windows formats, so we need to convert them to PEM for Kubernetes:

# Export CA certificate to PEM
Export-Certificate -Cert $caCert -FilePath ".\ca.crt" -Type CERT
certutil -encode ".\ca.crt" ".\ca.pem"
del ".\ca.crt"

# Export server certificate to PEM
Export-Certificate -Cert $serverCert -FilePath ".\server.crt" -Type CERT
certutil -encode ".\server.crt" ".\server.pem"
del ".\server.crt"

# Export server private key to PEM (requires exporting as PFX first)
$pfxPassword = ConvertTo-SecureString -String "YourSecurePassword" -Force -AsPlainText
Export-PfxCertificate -Cert $serverCert -FilePath ".\server.pfx" -Password $pfxPassword
# Use OpenSSL (install from Win32OpenSSL if needed) to convert PFX to PEM key
openssl pkcs12 -in ".\server.pfx" -nocerts -out ".\server-key.pem" -nodes -passin pass:YourSecurePassword
del ".\server.pfx"

Step 4: Create Kubernetes Secret and Deploy Webhook #

• Encode the PEM files to base64 (required for Kubernetes Secrets):

  $caPemBase64 = [Convert]::ToBase64String((Get-Content -Path ".\ca.pem" -Encoding Byte))
  $serverPemBase64 = [Convert]::ToBase64String((Get-Content -Path ".\server.pem" -Encoding Byte))
  $serverKeyPemBase64 = [Convert]::ToBase64String((Get-Content -Path ".\server-key.pem" -Encoding Byte))
  

• Replace the base64 values in the official webhook YAML files (the secret.yaml and webhook-configuration.yaml) with these outputs, then apply them with kubectl apply -f.

2. Use Your Cluster's Existing CA (If Available) #

If your Kubernetes cluster was set up with a pre-existing PKI (e.g., using kubeadm), you can use the cluster's CA to sign the webhook certificate instead of generating a new one:

Step 1: Create a Certificate Signing Request (CSR) #

Create a csr.yaml file with the webhook's DNS name:

apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: gmsa-webhook-svc
spec:
  request: $(cat server.csr | base64 -w0)
  signerName: kubernetes.io/kube-apiserver-client
  usages:
  - digital signature
  - key encipherment
  - server auth

Generate the CSR file using OpenSSL for Windows:

openssl req -new -newkey rsa:2048 -nodes -keyout server-key.pem -out server.csr -subj "/CN=gmsa-webhook.kube-system.svc"

Step 2: Submit and Approve the CSR #

kubectl apply -f csr.yaml
kubectl certificate approve gmsa-webhook-svc

Step 3: Retrieve the Signed Certificate #

kubectl get csr gmsa-webhook-svc -o jsonpath='{.status.certificate}' | base64 -d > server.pem

You can then use this server.pem and your existing server-key.pem to create the Secret for the webhook, along with the cluster's CA certificate (usually found in $HOME/.kube/config or your cluster's PKI directory).

3. Manually Prepare Certificates with Windows Tools #

If you prefer using GUI tools, you can use the Certificate Manager (certmgr.msc) to generate certificates, then export them to PEM format using certutil as shown in the first method. Once you have the PEM files, encode them to base64 and plug them into the required Kubernetes YAML manifests manually.

Any of these approaches will let you configure the GMSA validation webhook without needing to run the Linux/Unix script. The PowerShell method is the most direct replacement for the official script, while using the cluster's existing CA is more aligned with standard Kubernetes PKI practices if your cluster supports it.

内容的提问来源于stack exchange，提问作者fortanu82