Skip to main content

​
Kubernetes on Windows & Linux

Kubernetes was originally Linux-only, but now supports Windows worker nodes, enabling hybrid clusters.

​
Why Windows Containers?

  • Legacy Apps: Lift-and-shift .NET Framework applications.
  • Unified Management: Manage Windows and Linux apps with the same tool (Kubernetes).
  • Modernization: Slowly refactor monoliths into microservices.

​
Architecture: Hybrid Cluster

A Kubernetes cluster can contain both Linux and Windows nodes.
  • Control Plane: MUST run on Linux.
  • Worker Nodes: Can be Linux or Windows.

​
Scheduling Workloads

You must ensure Windows Pods land on Windows Nodes and Linux Pods land on Linux Nodes.

​
Using nodeSelector

# Windows Pod
apiVersion: v1
kind: Pod
metadata:
  name: iis-web
spec:
  containers:
  - name: iis
    image: mcr.microsoft.com/windows/servercore/iis:windowsservercore-ltsc2019
  nodeSelector:
    kubernetes.io/os: windows

# Linux Pod
apiVersion: v1
kind: Pod
metadata:
  name: nginx
spec:
  containers:
  - name: nginx
    image: nginx:latest
  nodeSelector:
    kubernetes.io/os: linux

​
Using Taints and Tolerations

To prevent Linux pods from accidentally landing on Windows nodes (and vice-versa).
  1. Taint the Windows Node: 
    kubectl taint nodes win-node1 os=windows:NoSchedule
  2. Add Toleration to Windows Pod: 
    spec:
  tolerations:
  - key: "os"
    operator: "Equal"
    value: "windows"
    effect: "NoSchedule"

​
Key Differences & Limitations

FeatureLinuxWindows
Container Base ImageSmall (Alpine ~5MB)Large (Server Core ~3GB)
Startup TimeSecondsSeconds to Minutes
NetworkingBridge, OverlayHost Networking not supported
Privileged ContainersSupportedNot Supported
FilesystemCase-sensitiveCase-insensitive
Active DirectoryVia LDAP/KerberosGMSA (Group Managed Service Accounts)

​
Best Practices

Always taint Windows nodes to prevent Linux pods (like DaemonSets) from failing to start on them.
Windows images are large. Use a local registry or caching to speed up pulls. Match the container OS version with the host OS version (Process Isolation).
Use Group Managed Service Accounts (GMSA) for Windows pods that need to authenticate with Active Directory.
🎉 Congratulations! You’ve completed the Kubernetes Crash Course and the entire DevOps Tools Mastery course! Next: Back to Overview →