GMSA with Windows Containers doesnt work with ContainerD

[immuzz]

When using the ContainerD runtime (Feature State: Kubernetes v1.19 [beta]) accessing restricted network shares via the GMSA domain identity fails. The container will receive the identity of and calls from nltest.exe /query will work. It is recommended to use the Docker EE runtime if access to network shares is required.

[immuzz]

We are working to fix this issue. Currently this affects Windows Server 2019, 1903, 1909 and 2004. We are planning to fix it in 2004 first and then backport to 2019, 1903 and 1909. Current rough ETA for backporting is 2-3 months

[ghost]

This issue has been open for 30 days with no updates.
@immuzz, please provide an update or close this issue.

[ghost]

This issue has been open for 30 days with no updates.
@immuzz, please provide an update or close this issue.

[immuzz]

This has been resolved and will be released for Windows Server 2004 in 11C Windows Patch

[vitaliy-leschenko]

Hi @immuzz, as I understand from your comments in 11C Windows Patch fix will be available only for WS2004. So we need to wait 2-3 months for patch for WS2019. Is it correct?

[jayunit100]

also wondering the same thing.... when will this be available in 2019?

[unacceptable]

@vitaliy-leschenko @jayunit100 I reckon when saying Windows Server 2004 they are referring to the Windows Server SAC releases for Server 2019. Not 100% sure though since I am not a Windows guy.

[marosset]

I spoke with @immuzz and confirmed this will not be available for Windows Server 2019 until Feb 2021.

[immuzz]

Re-opening the issue as it will be available in Feb 2021 for Windows 2019. Will close it then

[immuzz]

Just to be clear. This fix is available today on Windows Server 2004 (SAC release)

[ghost]

This issue has been open for 30 days with no updates.
@immuzz, please provide an update or close this issue.

[ghost]

This issue has been open for 30 days with no updates.
@immuzz, please provide an update or close this issue.

[ericsmalling]

Just curious, @immuzz, is Win 2019 still on track for Feb 2021 release?

[immuzz]

Closing this issue as this should be part of Feb Patch Tuesday. Please let me know if someone is still running into issues and I will try to investigate.

[jsturtevant]

/reopen

[immuzz]

Befor re-opening i am waiting for gMSA team to confirm its the same issue

[marosset]

Closing this issue as this should be part of Feb Patch Tuesday. Please let me know if someone is still running into issues and I will try to investigate.

@immuzz were these fixes in 2B or 2C?

[jsturtevant]

should be in 2c or 3b

[dcantah]

The fix is in, you just need to enable the registry key it's gated behind: reg add "HKLM\SYSTEM\CurrentControlSet\Services\hns\State" /v EnableCompartmentNamespace /t REG_DWORD /d 1. We'll work to get this documented publicly

[perithompson]

Great work to everyone involved!