From 7f07e47138a489f91ad4a85503dba99aa9029418 Mon Sep 17 00:00:00 2001 From: Slawomir Koszewski Date: Sat, 17 Oct 2026 11:23:00 +0200 Subject: [PATCH] Update README.md - make it more readable. --- README.md | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 4cb6a55..35a6555 100644 --- a/README.md +++ b/README.md @@ -40,7 +40,11 @@ The `.sh` files are meant as references for copying and pasting the commands one ## 1. Create the certificates -`make_certs.sh` creates a root CA, an issuing CA and a client certificate. The client certificate subject CN (`test-client`) becomes the WiF subject. +`make_certs.sh` performs the following steps: + +1. Creates a root CA certificate and key (`ca_cert.pem`, `ca_key.pem`). +2. Creates an issuing CA certificate and key (`issuing_ca_cert.pem`, `issuing_ca_key.pem`), signed by the root CA. +3. Creates a client certificate and key (`client_cert.pem`, `client_key.pem`), signed by the issuing CA. Its subject CN (`test-client`) becomes the WiF subject. ```bash bash make_certs.sh @@ -69,13 +73,27 @@ The PEM files must contain only the certificate block. A trailing newline after ## 3. Create the pool, provider and credentials -`make_wif.sh` creates the workload identity pool, the X.509 provider and a service account. It allows the client certificate subject to impersonate the service account, grants the service account read access to the project, creates a storage bucket with read and write access to its objects for the service account, enables Data Access audit logs for Cloud Storage, and writes `cred.json`. It then logs in with `cred.json` in a separate gcloud configuration, checks the access, uploads and downloads a file, makes the public folder of the bucket publicly readable, and lists the audit log of the service account operations. +`make_wif.sh` performs the following steps: + +1. Creates the workload identity pool and the X.509 provider. +2. Creates a service account. +3. Allows the client certificate subject to impersonate the service account. +4. Grants the service account read access to the project. +5. Writes `cred.json`. +6. Creates a storage bucket and grants the service account read and write access to its objects. +7. Enables Data Access audit logs for Cloud Storage. +8. Creates a separate gcloud configuration and logs in with `cred.json`. +9. Checks the access to the project and the bucket, including an upload and a download of a file. +10. Switches back to the original gcloud configuration. +11. Makes the `public/` managed folder of the bucket publicly readable. +12. Lists the audit log of the service account operations. +13. Optionally switches back to the service account configuration. ```bash bash make_wif.sh ``` -Data Access audit logs are enabled for the whole project, not per bucket, by editing the project IAM policy. `add_audit_config.mjs` adds the `auditConfigs` section to the policy file fetched by gcloud. The policy must be fetched as YAML, because a different default gcloud output format makes `set-iam-policy` reject the file. +Data Access audit logs are enabled for the whole project, not per bucket, by editing the project IAM policy. `add_audit_config.mjs` adds the `auditConfigs` section to the policy file fetched by gcloud. The audit log lists only Cloud Storage operations of the service account. Resource Manager calls such as `projects describe` are not covered by the Data Access configuration.