This page provides instructions to configure your Windows Server nodes in your Google Kubernetes Engine (GKE) cluster to automatically join an Active Directory (AD) domain.
Before you begin
Before you start, make sure you have performed the following tasks:
- Ensure that you have enabled the Google Kubernetes Engine API. Enable Google Kubernetes Engine API
- Ensure that you have installed the Google Cloud CLI.
- Set up default Google Cloud CLI settings for your project by using one of the following methods:
- Use
gcloud init
, if you want to be walked through setting project defaults. - Use
gcloud config
, to individually set your project ID, zone, and region. -
Run
gcloud init
and follow the directions:gcloud init
If you are using SSH on a remote server, use the
--console-only
flag to prevent the command from launching a browser:gcloud init --console-only
- Follow the instructions to authorize the gcloud CLI to use your Google Cloud account.
- Create a new configuration or select an existing one.
- Choose a Google Cloud project.
- Choose a default Compute Engine zone.
- Choose a default Compute Engine region.
- Set your default project ID:
gcloud config set project PROJECT_ID
- Set your default Compute Engine region (for example,
us-central1
):gcloud config set compute/region COMPUTE_REGION
- Set your default Compute Engine zone (for example,
us-central1-c
):gcloud config set compute/zone COMPUTE_ZONE
- Update
gcloud
to the latest version:gcloud components update
gcloud init
gcloud config
By setting default locations, you can avoid errors in gcloud CLI like the
following: One of [--zone, --region] must be supplied: Please specify location
.
- Ensure you have the correct IAM permission to create clusters. At minimum, you should be a Kubernetes Engine Cluster Admin.
Configure auto join for Windows Server node pools
Configure AD and your Google Cloud project for automatic joining by completing the instructions in the Configuring Active Directory for VMs to automatically join a domain tutorial.
Create a GKE cluster:
gcloud container clusters create CLUSTER_NAME \ --enable-ip-alias \ --num-nodes=NUMBER_OF_NODES \ --no-enable-shielded-nodes \ --cluster-version=VERSION
Replace the following:
CLUSTER_NAME
: the name of your new cluster.NUMBER_OF_NODES
: the number of Linux nodes to create. You should provide sufficient compute resources to run cluster add-ons. This is an optional field and, if omitted, uses the default value of 3.VERSION
: the GKE cluster version, which must be 1.17.14-gke.1200 or later or 1.18.9-gke.100 or later. You can also use the--release-channel
flag to enroll the cluster in a release channel.--enable-ip-alias
turns on alias IP. Alias IP is required for Windows Server nodes.--no-enable-shielded-nodes
disables Shielded GKE nodes.
Set the following variables:
export DOMAIN_PROJECT_ID=PROJECT_ID export SERVERLESS_REGION=REGION export REGISTER_URL=https://$SERVERLESS_REGION-$DOMAIN_PROJECT_ID.cloudfunctions.net/register-computer
Replace the following:
PROJECT_ID
: the project ID of your domain project.REGION
: the region to deploy your Cloud Function in. Choose a region that supports both Cloud Functions and Serverless VPC Access. The region does not have to be the same region as the one you plan to deploy VM instances in.
Create and start a Windows Server node pool by passing the specialized scriptlet that joins the node to the AD domain:
gcloud container node-pools create NODE_POOL_NAME \ --cluster=CLUSTER_NAME \ --image-type=IMAGE_NAME \ --no-enable-autoupgrade \ --machine-type=MACHINE_TYPE_NAME \ "--metadata=sysprep-specialize-script-ps1=iex((New-Object System.Net.WebClient).DownloadString('$REGISTER_URL'))"
Replace the following:
NODE_POOL_NAME
: the name of your Windows Server node pool.CLUSTER_NAME
: the name of the cluster you created.IMAGE_NAME
: the node image to use, which can beWINDOWS_LTSC
orWINDOWS_SAC
. For more information, see Choose your Windows Server node image.MACHINE_TYPE_NAME
: the machine type.n1-standard-2
is the minimum recommended machine type as Windows Server nodes require additional resources. Machine typesf1-micro
andg1-small
are not supported. Each machine type is billed differently. For more information, refer to the machine type price sheet.
Your Windows Server node is now joined to your Active Directory domain.
What's next
- To use a Group Managed Service Account (gMSA) with your Windows Server node pools, see Using gMSA.
- Learn about the Managed Service for Microsoft Active Directory.