Fixes for unclear STS authentication artifacts placement.

make_sts_agent_creds.py

@@ -2,31 +2,54 @@
 import argparse
 import json
 import os
-import shutil
+import sys
 
 parser = argparse.ArgumentParser(description="Create the credential configuration directory for the Storage Transfer agent container.")
-parser.add_argument("--cred", default="cred.json", help="credentials configuration file")
-parser.add_argument("--cert", default="/var/lib/vault-cert/wif/client_cert.pem", help="client certificate on the host")
-parser.add_argument("--key", default="/var/lib/vault-cert/wif/client_key.pem", help="client private key on the host")
-parser.add_argument("--output", default="/etc/sts-agent", help="credential configuration directory on the host")
-parser.add_argument("--prefix", default="/transfer_root", help="container path under which the host paths are mounted")
+parser.add_argument("--project-number", required=True, help="number of the project of the workload identity pool")
+parser.add_argument("--pool", required=True, help="workload identity pool ID")
+parser.add_argument("--provider", required=True, help="X.509 provider ID")
+parser.add_argument("--service-account", required=True, help="email of the impersonated service account")
+parser.add_argument("--cert", default="/var/lib/vault-cert/wif/client_cert.pem", help="client certificate")
+parser.add_argument("--key", default="/var/lib/vault-cert/wif/client_key.pem", help="client private key")
+parser.add_argument("--output", default="/etc/sts-agent", help="credential configuration directory")
 args = parser.parse_args()
 
+cert = os.path.abspath(args.cert)
+key = os.path.abspath(args.key)
+
+# The container mounts the certificate directory, so the files must exist on the host.
+for path in (cert, key):
+    if not os.path.isfile(path):
+        sys.exit(f"{path} does not exist")
+
 # Credential configuration directory mounted read only in the agent container, its files hold no secrets.
 os.makedirs(args.output, mode=0o755, exist_ok=True)
 
-shutil.copyfile(args.cred, os.path.join(args.output, "cred.json"))
+cred = {
+    "universe_domain": "googleapis.com",
+    "type": "external_account",
+    "audience": f"//iam.googleapis.com/projects/{args.project_number}/locations/global/workloadIdentityPools/{args.pool}/providers/{args.provider}",
+    "subject_token_type": "urn:ietf:params:oauth:token-type:mtls",
+    "token_url": "https://sts.mtls.googleapis.com/v1/token",
+    "credential_source": {
+        "certificate": {
+            "use_default_certificate_config": True,
+        }
+    },
+    "service_account_impersonation_url": f"https://iamcredentials.mtls.googleapis.com/v1/projects/-/serviceAccounts/{args.service_account}:generateAccessToken",
+}
 
-# Certificate and key paths as seen inside the container, where the host certificate directory is mounted under the prefix.
+# The container mounts the certificate directory at the same path as on the host.
 certificate_config = {
     "cert_configs": {
         "workload": {
-            "cert_path": args.prefix + os.path.abspath(args.cert),
-            "key_path": args.prefix + os.path.abspath(args.key),
+            "cert_path": cert,
+            "key_path": key,
         }
     }
 }
 
-with open(os.path.join(args.output, "certificate_config.json"), "w") as file:
-    json.dump(certificate_config, file, indent=2)
-    file.write("\n")
+for name, content in (("cred.json", cred), ("certificate_config.json", certificate_config)):
+    with open(os.path.join(args.output, name), "w") as file:
+        json.dump(content, file, indent=2)
+        file.write("\n")