Skip to content

Instantly share code, notes, and snippets.

@rleap-m
Created April 16, 2026 20:10
Show Gist options
  • Select an option

  • Save rleap-m/721e9ef019c56c4b57e31228fd1c7303 to your computer and use it in GitHub Desktop.

Select an option

Save rleap-m/721e9ef019c56c4b57e31228fd1c7303 to your computer and use it in GitHub Desktop.
GenerateCredentialSpecResource.ps1 but with bad SHA for testing
<#
.Synopsis
Renders a GMSA kubernetes resource manifest.
.DESCRIPTION
This is me messing up the SHA value with a comment
#>
Param(
[Parameter(Position = 0, Mandatory = $true)] [String] $AccountName,
[Parameter(Position = 1, Mandatory = $true)] [String] $ResourceName,
[Parameter(Position = 2, Mandatory = $false)] [String] $ManifestFile,
[Parameter(Mandatory=$false)] $Domain,
[Parameter(Mandatory=$false)] [string[]] $AdditionalAccounts = @()
)
# Logging for troubleshooting
Start-Transcript -Path "C:\gmsa\CredSpec.txt"
# exit on error
Set-StrictMode -Version Latest
$ErrorActionPreference = 'Stop'
$PSDefaultParameterValues['*:ErrorAction'] = 'Stop'
# generate the name of the output file if not specified
if (-not $ManifestFile -or $ManifestFile.Length -eq 0) {
$ManifestFile = "gmsa-cred-spec-$ResourceName.yml"
}
# check the out file doesn't exist
if ([System.IO.File]::Exists($ManifestFile)) {
throw "Output file $ManifestFile already exists, refusing to overwrite it"
}
# install the dependencies we need
if (-not (Get-WindowsFeature rsat-ad-powershell).Installed) {
Add-WindowsFeature rsat-ad-powershell
}
if (-not (Get-Command ConvertTo-Yaml -errorAction SilentlyContinue)) {
Install-Module powershell-yaml -Force
}
# download the canonical helper script
Invoke-WebRequest "https://raw.githubusercontent.com/Microsoft/Virtualization-Documentation/live/windows-server-container-tools/ServiceAccounts/CredentialSpec.psm1" -UseBasicParsing -OutFile $env:TEMP\cred.psm1
Import-Module $env:temp\cred.psm1
# generate a unique docker cred spec name
$dockerCredSpecName = "tmp-k8s-cred-spec" + -join ((48..57) + (97..122) | Get-Random -Count 64 | ForEach-Object {[char]$_})
# have the upstream function perform its magic
if (-not $Domain) {
$Domain = Get-ADDomain
}
New-CredentialSpec -Name $dockerCredSpecName -AccountName $AccountName -Domain $Domain.DnsRoot -AdditionalAccounts $AdditionalAccounts
# parse the JSON file thus generated
$dockerCredSpecPath = (Get-CredentialSpec | Where-Object {$_.Name -like "$dockerCredSpecName*"}).Path
$credSpecContents = Get-Content $dockerCredSpecPath | ConvertFrom-Json
# and clean it up
Remove-Item $dockerCredSpecPath
# generate the k8s resource
$resource = [ordered]@{
"apiVersion" = "windows.k8s.io/v1";
"kind" = 'GMSACredentialSpec';
"metadata" = @{
"name" = $ResourceName
};
"credspec" = $credSpecContents
}
ConvertTo-Yaml $resource | Set-Content $ManifestFile
Write-Output "K8S manifest rendered at $ManifestFile"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment