Book Image

Running Windows Containers on AWS

By : Marcio Morales
Book Image

Running Windows Containers on AWS

By: Marcio Morales

Overview of this book

Windows applications are everywhere, from basic intranet applications to high-traffic public APIs. Their prevalence underscores the importance of combining the same tools and experience for managing a modern containerized application with existing critical Windows applications to reduce costs, achieve outstanding operational excellence, and modernize quickly. This comprehensive guide to running and managing Windows containers on AWS looks at the best practices from years of customer interactions to help you stay ahead of the curve. Starting with Windows containers basics, you’ll learn about the architecture design that powers Amazon ECS, EKS, and AWS Fargate for Windows containers. With the help of examples and best practices, you’ll explore in depth how to successfully run and manage Amazon ECS, EKS, and AWS Fargate clusters with Windows containers support. Next, the book covers day 2 operations in detail, from logging and monitoring to using ancillary AWS tools that fully containerize existing legacy .NET Framework applications into containers without any code changes. The book also covers the most common Windows container operations, such as image lifecycle and working with ephemeral hosts. By the end of this book, you’ll have mastered how to run Windows containers on AWS and be ready to start your modernization journey confidently.
Table of Contents (22 chapters)
1
Part 1: Why Windows Containers on Amazon Web Services (AWS)?
4
Part 2: Windows Containers on Amazon Elastic Container Service (ECS)
9
Part 3: Windows Containers on Amazon Elastic Kubernetes Service (EKS)
14
Part 4: Operationalizing Windows Containers on AWS

Understanding Active Directory integration on Kubernetes

In Chapter 5, Deploying an EC2 Windows-Based Task, in the Setting up Active Directory integration section, we dove deep into the use case and methods available to set up Active Directory integration. The concept and use case remains the same here; the only difference is how to implement it in Kubernetes.

In Kubernetes, two Webhook admission controllers (open sourced by Kubernetes-SIG) are required to support Active Directory integration with the Kerberos protocol:

  • A mutating Webhook is responsible for modifying objects sent to the API server, which modifies the gMSA account reference into a JSON file within the Pod spec
  • A validating Webhook ensures the gMSA account is authorized to be used by the Pod service account

Important note

The gMSA admission Webhook can be found at https://github.com/kubernetes-sigs/windows-gmsa.

Installing the gMSA Webhook admission controller is easy, but it requires changing...