Added a variant of the test that uses HashiCorp Vault to manage te

Certificate Authorities.

test_wif.sh

@@ -0,0 +1,38 @@
+source ./env.sh
+
+# Create a new gcloud configuration for the workload identity federation test
+gcloud config configurations create wif-test
+
+# Authenticate gcloud with the credentials configuration file
+gcloud auth login --cred-file=cred.json
+
+# Set the project
+gcloud config set project "${PROJECT_ID}"
+
+# Test the authentication by listing the project details
+gcloud auth list
+gcloud projects describe "${PROJECT_ID}"
+gcloud projects get-iam-policy "${PROJECT_ID}" \
+    --flatten="bindings[].members" \
+    --format="table(bindings.role, bindings.members)"
+
+# Test the bucket access by uploading and downloading a file
+gcloud storage ls "gs://${BUCKET}"
+gcloud storage cp README.md "gs://${BUCKET}/README.md"
+gcloud storage ls "gs://${BUCKET}"
+gcloud storage cp "gs://${BUCKET}/README.md" README.downloaded.md
+cmp README.md README.downloaded.md
+
+# Then, switch back to your original account
+gcloud config configurations activate default
+
+# List the audit log of the operations made by the service account
+gcloud logging read \
+    "protoPayload.authenticationInfo.principalEmail=\"${SA_EMAIL}\"" \
+    --project="${PROJECT_ID}" \
+    --freshness=1h \
+    --order=asc \
+    --format="table(timestamp, protoPayload.serviceName, protoPayload.methodName, protoPayload.authenticationInfo.principalEmail:label=EMAIL, protoPayload.authenticationInfo.principalSubject:label=SUBJECT, protoPayload.authenticationInfo.serviceAccountDelegationInfo[0].principalSubject:label=DELEGATED_BY)"
+
+# optionally switch back to the service account for further testing
+# gcloud config configurations activate wif-test