<p>I have a <code>.NET Core</code> service running on <code>Azure Kubernetes Service</code> and a Linux Docker image. It needs to connect to an on-premise database with Integrated Security. One of the service accounts in my on-premise AD has access to this database.</p>

<p>My question is - is it possible to run a pod under a specific service account so the service can connect to the database? (Other approach I took was to impersonate the call with <code>WindowsIdentity.RunImpersonated</code>, however that requires the DLL "advapi32.dll" and I couldn't find a way to deploy it to the Linux container and make it run.)</p>

<p>A pod can run with the permissions of an Azure Active Directory service account if you install and implement <a href="https://github.com/Azure/aad-pod-identity" rel="nofollow noreferrer">AAD Pod Identity components</a> in your cluster.</p>

<p>You'll need to set up an <code>AzureIdentity</code> and an <code>AzureIdentityBinding</code> resource in your cluster then add a label to the pod(s) that will use permissions associated with the service account.</p>

<p>Please note that this approach relies on the <a href="https://github.com/Azure/aad-pod-identity/blob/master/docs/readmes/README.role-assignment.md#performing-role-assignments" rel="nofollow noreferrer">managed identity or service principal associated with your cluster having the role "Managed Identity Operator"</a> granted against the service account used to access SQL Server (service account must exist in Azure Active Directory). </p>

<p>I suspect you may have a requirement for the pods to take on the identity of a "group managed service account" which exists in your local AD only. I don't think this is supported in Linux containers (<a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-gmsa/" rel="nofollow noreferrer">Recently, Windows nodes support GMSAs as a GA feature</a>). </p>
