自动将 GKE Windows Server 节点加入 Managed Microsoft AD 域
使用集合让一切井井有条
根据您的偏好保存内容并对其进行分类。
本页介绍了如何使用自动网域加入功能，将 Google Kubernetes Engine (GKE) 集群中的 Windows Server 节点加入到托管的 Microsoft AD 网域。
代管式 Microsoft AD 如何自动将 Windows Server 节点加入网域
在 GKE 集群中创建节点池时，您可以使用 Managed Microsoft AD 提供的现成脚本自动加入 Managed Microsoft AD 网域。GKE 创建节点池后，托管式 Microsoft AD 会发起域名加入请求，并尝试将节点加入您的网域。如果网域加入请求成功，托管式 Microsoft AD 会将节点加入您的网域。如果网域加入请求失败，则创建的节点会继续运行。您需要查看日志以找出并解决问题，然后才能重新创建节点池。如需了解详情，请参阅查看调试日志。
在某些特定情况下，您需要从托管式 Microsoft AD 中手动清理与未加入的节点相关的信息。如需了解详情，请参阅清理未加入集群的虚拟机。
您无法使用域名加入脚本更新现有节点池，以自动将现有节点加入您的网域。
自动加入网域功能不会将 GKE 节点配置为使用 gMSA 进行身份验证。不过，您可以在托管式 Microsoft AD 中手动创建 gMSA，并将 GKE 节点配置为使用 gMSA。如需了解如何为 GKE 节点配置 gMSA，请参阅为 Windows Pod 和容器配置 gMSA。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[],[],null,["# Join GKE Windows Server nodes automatically to a Managed Microsoft AD domain\n\nThis page explains how to join Windows Server nodes in your\nGoogle Kubernetes Engine (GKE) cluster to a Managed Microsoft AD domain using\nthe [automated domain join](/managed-microsoft-ad/docs/seamless-domain-join-gce)\nfeature.\n\nHow Managed Microsoft AD joins Windows Server nodes automatically to a domain\n-----------------------------------------------------------------------------\n\nWhen you create a [node pool](/kubernetes-engine/docs/concepts/node-pools) in\nyour [GKE\ncluster](/kubernetes-engine/docs/concepts/cluster-architecture), you can use the\nready-made scripts that are available from Managed Microsoft AD to\nautomatically join your Managed Microsoft AD domain. After\nGKE creates the node pool, Managed Microsoft AD\ninitiates the domain join request and attempts to join the nodes with your\ndomain. If the domain join request succeeds, Managed Microsoft AD\njoins the nodes to your domain. If the domain join request fails, the created\nnodes continue to run. You need to check the logs to identify and fix the issue\nbefore creating the node pool again. For more information, see [View debug\nlogs](/managed-microsoft-ad/docs/seamless-domain-join-gce#view-logs).\n\nYou need to clean up the information about unjoined nodes manually from\nManaged Microsoft AD in some specific scenarios. For more information, see\n[Clean up unjoined\nVMs](/managed-microsoft-ad/docs/seamless-domain-join-gce#cleanup-vm).\n\nYou can't update an existing node pool with the domain join scripts to\nautomatically join the existing nodes to your domain.\n\nThe automated domain join feature doesn't configure the GKE\nnodes to run with\n[gMSA](https://learn.microsoft.com/en-us/virtualization/windowscontainers/manage-containers/manage-serviceaccounts)\nfor authentication. However, you can manually [create a\ngMSA](/managed-microsoft-ad/docs/create-gmsa) in Managed Microsoft AD and\nconfigure the GKE nodes to use the gMSA. For information\nabout configuring gMSA for the GKE nodes, see [Configure\ngMSA for Windows Pods and\ncontainers](https://kubernetes.io/docs/tasks/configure-pod-container/configure-gmsa/).\n\nBefore you begin\n----------------\n\n1. [Create a Managed Microsoft AD\n domain](/managed-microsoft-ad/docs/create-domain).\n\n2. [Create a GKE cluster using Windows Server node\n pools](/kubernetes-engine/docs/how-to/creating-a-cluster-windows).\n\n3. Make sure that the Windows Server nodes run on a [Windows version that\n Managed Microsoft AD\n supports](/managed-microsoft-ad/docs/os-versions#windows-domain-join).\n\n4. [Configure domain\n peering](/managed-microsoft-ad/docs/quickstart-domain-peering) between the\n Managed Microsoft AD domain and the nodes' network, or have both the\n Managed Microsoft AD domain and the nodes in the same network.\n\n5. Create a service account with the Google Cloud Managed Identities Domain\n Join (`roles/managedidentities.domainJoin`) IAM role on the\n project that has the Managed Microsoft AD domain. For more information,\n see [Cloud Managed Identities\n roles](/iam/docs/understanding-roles#cloud-managed-identities-roles).\n\n - For more information about granting roles, see [Grant a single\n role](/iam/docs/manage-access-service-accounts#grant-single-role).\n\n - For information about creating a service account, see [Authenticate\n workloads using service\n accounts](/compute/docs/access/create-enable-service-accounts-for-instances).\n\n6. Set the full `cloud-platform` access scope on the Windows Server nodes. For\n more information, see\n [Authorization](/compute/docs/access/service-accounts#authorization).\n\nMetadata\n--------\n\nYou need the following metadata keys to join your Windows Server nodes to a\ndomain.\n\n- `windows-startup-script-url`\n- `managed-ad-domain`\n- Optional: `enable-guest-attributes`\n- Optional: `managed-ad-ou-name`\n- Optional: `managed-ad-force`\n\nFor more information about these metadata keys, see\n[Metadata](/managed-microsoft-ad/docs/seamless-domain-join-gce#metadata).\n\nThe domain join request fails when the computer account of a Windows Server node\nalready exists in Managed Microsoft AD. For Managed Microsoft AD to\nreuse the existing computer account during the domain join process, you can use\nthe `managed-ad-force` metadata key when you [create the node\npool](/kubernetes-engine/docs/how-to/node-pools#add).\n\nJoin Windows Server nodes\n-------------------------\n\nYou can configure these [metadata\nkeys](/managed-microsoft-ad/docs/automated-domain-join-gke#metadata) when you\nadd a Windows Server node pool to your GKE cluster. This\nsection illustrates how to use these metadata keys in gcloud CLI\ncommands when you create a node pool.\n\nHowever, you can use these metadata keys when you create a node pool using the\nother available options as well. For more information, see [Add and manage node\npools](/kubernetes-engine/docs/how-to/node-pools).\n\nTo create a node pool and join the Windows Server nodes, run the following\ngcloud CLI command: \n\n```\ngcloud container node-pools create NODE_POOL_NAME \\\n --cluster=CLUSTER_NAME \\\n \"--metadata=windows-startup-script-url=URL,managed-ad-domain=DOMAIN_RESOURCE_PATH,managed-ad-force=TRUE\" \\\n --service-account=SERVICE_ACCOUNT \\\n --image-type=WINDOWS_IMAGE_NAME \\\n --scopes=https://www.googleapis.com/auth/cloud-platform \\\n --location=ZONE_OR_REGION \\\n --no-enable-autoupgrade\n```\n\nYou can replace the placeholders in the `--metadata` flag with relevant values\nas described in the\n[metadata](/managed-microsoft-ad/docs/seamless-domain-join-gce#metadata)\nsection.\n\nFor more information about this gcloud CLI command, see [gcloud\ncontainer node-pools create](/sdk/gcloud/reference/container/node-pools/create).\n\nWhat's next\n-----------\n\n- [Join a Windows VM automatically to a\n domain](/managed-microsoft-ad/docs/seamless-domain-join-gce)."]]
