Added Google Storage Transfer Agent configuration and tests.

make_sts_agent_creds.py

@@ -0,0 +1,32 @@
+#!/usr/bin/python3
+import argparse
+import json
+import os
+import shutil
+
+parser = argparse.ArgumentParser(description="Create the credential configuration directory for the Storage Transfer agent container.")
+parser.add_argument("--cred", default="cred.json", help="credentials configuration file")
+parser.add_argument("--cert", default="/var/lib/vault-cert/wif/client_cert.pem", help="client certificate on the host")
+parser.add_argument("--key", default="/var/lib/vault-cert/wif/client_key.pem", help="client private key on the host")
+parser.add_argument("--output", default="/etc/sts-agent", help="credential configuration directory on the host")
+parser.add_argument("--prefix", default="/transfer_root", help="container path under which the host paths are mounted")
+args = parser.parse_args()
+
+# Credential configuration directory mounted read only in the agent container, its files hold no secrets.
+os.makedirs(args.output, mode=0o755, exist_ok=True)
+
+shutil.copyfile(args.cred, os.path.join(args.output, "cred.json"))
+
+# Certificate and key paths as seen inside the container, where the host certificate directory is mounted under the prefix.
+certificate_config = {
+    "cert_configs": {
+        "workload": {
+            "cert_path": args.prefix + os.path.abspath(args.cert),
+            "key_path": args.prefix + os.path.abspath(args.key),
+        }
+    }
+}
+
+with open(os.path.join(args.output, "certificate_config.json"), "w") as file:
+    json.dump(certificate_config, file, indent=2)
+    file.write("\n")