Created
April 16, 2026 20:10
-
-
Save rleap-m/721e9ef019c56c4b57e31228fd1c7303 to your computer and use it in GitHub Desktop.
GenerateCredentialSpecResource.ps1 but with bad SHA for testing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <# | |
| .Synopsis | |
| Renders a GMSA kubernetes resource manifest. | |
| .DESCRIPTION | |
| This is me messing up the SHA value with a comment | |
| #> | |
| Param( | |
| [Parameter(Position = 0, Mandatory = $true)] [String] $AccountName, | |
| [Parameter(Position = 1, Mandatory = $true)] [String] $ResourceName, | |
| [Parameter(Position = 2, Mandatory = $false)] [String] $ManifestFile, | |
| [Parameter(Mandatory=$false)] $Domain, | |
| [Parameter(Mandatory=$false)] [string[]] $AdditionalAccounts = @() | |
| ) | |
| # Logging for troubleshooting | |
| Start-Transcript -Path "C:\gmsa\CredSpec.txt" | |
| # exit on error | |
| Set-StrictMode -Version Latest | |
| $ErrorActionPreference = 'Stop' | |
| $PSDefaultParameterValues['*:ErrorAction'] = 'Stop' | |
| # generate the name of the output file if not specified | |
| if (-not $ManifestFile -or $ManifestFile.Length -eq 0) { | |
| $ManifestFile = "gmsa-cred-spec-$ResourceName.yml" | |
| } | |
| # check the out file doesn't exist | |
| if ([System.IO.File]::Exists($ManifestFile)) { | |
| throw "Output file $ManifestFile already exists, refusing to overwrite it" | |
| } | |
| # install the dependencies we need | |
| if (-not (Get-WindowsFeature rsat-ad-powershell).Installed) { | |
| Add-WindowsFeature rsat-ad-powershell | |
| } | |
| if (-not (Get-Command ConvertTo-Yaml -errorAction SilentlyContinue)) { | |
| Install-Module powershell-yaml -Force | |
| } | |
| # download the canonical helper script | |
| Invoke-WebRequest "https://raw.githubusercontent.com/Microsoft/Virtualization-Documentation/live/windows-server-container-tools/ServiceAccounts/CredentialSpec.psm1" -UseBasicParsing -OutFile $env:TEMP\cred.psm1 | |
| Import-Module $env:temp\cred.psm1 | |
| # generate a unique docker cred spec name | |
| $dockerCredSpecName = "tmp-k8s-cred-spec" + -join ((48..57) + (97..122) | Get-Random -Count 64 | ForEach-Object {[char]$_}) | |
| # have the upstream function perform its magic | |
| if (-not $Domain) { | |
| $Domain = Get-ADDomain | |
| } | |
| New-CredentialSpec -Name $dockerCredSpecName -AccountName $AccountName -Domain $Domain.DnsRoot -AdditionalAccounts $AdditionalAccounts | |
| # parse the JSON file thus generated | |
| $dockerCredSpecPath = (Get-CredentialSpec | Where-Object {$_.Name -like "$dockerCredSpecName*"}).Path | |
| $credSpecContents = Get-Content $dockerCredSpecPath | ConvertFrom-Json | |
| # and clean it up | |
| Remove-Item $dockerCredSpecPath | |
| # generate the k8s resource | |
| $resource = [ordered]@{ | |
| "apiVersion" = "windows.k8s.io/v1"; | |
| "kind" = 'GMSACredentialSpec'; | |
| "metadata" = @{ | |
| "name" = $ResourceName | |
| }; | |
| "credspec" = $credSpecContents | |
| } | |
| ConvertTo-Yaml $resource | Set-Content $ManifestFile | |
| Write-Output "K8S manifest rendered at $ManifestFile" |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment