What is Kubernetes Pod Security Context Windows?

Question

Accepted Answer

**Windows Security** — security settings for Windows containers.

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: windows-pod
spec:
  os:
    name: windows
  nodeSelector:
    kubernetes.io/os: windows
  securityContext:
    windowsOptions:
      runAsUserName: "ContainerUser"
      gmsaCredentialSpecName: "my-gmsa"
      gmsaCredentialSpec: ""
      supplementalGroupsGroupPolicy: Merge
  containers:
  - name: app
    image: mcr.microsoft.com/dotnet/runtime:8.0
    securityContext:
      windowsOptions:
        runAsUserName: "ContainerUser"
        gmsaCredentialSpecName: "my-gmsa"
---
# Windows with service account
apiVersion: v1
kind: Pod
metadata:
  name: windows-sa-pod
spec:
  os:
    name: windows
  nodeSelector:
    kubernetes.io/os: windows
  serviceAccountName: myapp-sa
  securityContext:
    windowsOptions:
      runAsUserName: "ContainerUser"
  containers:
  - name: app
    image: mcr.microsoft.com/iis:windowsservercore-ltsc2022
```

```bash
# Check Windows Pod security
kubectl get pod windows-pod -o jsonpath='{.spec.securityContext.windowsOptions}' | jq

# Verify Windows user
kubectl exec windows-pod -- whoami
kubectl exec windows-pod -- net user

# Check node OS
kubectl get nodes -l kubernetes.io/os=windows
kubectl get nodes -o custom-columns=NAME:.metadata.name,OS:.status.nodeInfo.operatingSystem

# Check GMSA credential
kubectl get gmsacredentialspec my-gmsa -o yaml

# View Windows events
kubectl logs windows-pod --previous
```

**Windows Security Options:**
- runAsUserName: Windows user.
- gmsaCredentialSpec: Group Managed Service Account.
- supplementalGroupsGroupPolicy: group policy.

**Use cases:**
- .NET applications.
- IIS web servers.
- Windows services.

DevOps: What is Kubernetes Pod Security Context Windows?