Enhanced Vault guides and fixed some wording.

docs/vault-approle.md

@@ -291,3 +291,21 @@ Role: **Server administrator**
     ```
 
 The service logs to the journal. A run that finds a valid certificate logs `nothing to do`, a renewal logs the new expiry date and the hook.
+
+## Next steps
+
+1. Create the credentials configuration `cred.json` on the server for the certificate and the key managed by the renewal service. The names come from `env.sh`.
+
+    ```bash
+    gcloud iam workload-identity-pools create-cred-config \
+        "projects/${PROJECT_NUMBER}/locations/global/workloadIdentityPools/${POOL_ID}/providers/${PROVIDER_ID}" \
+        --service-account="${SA_EMAIL}" \
+        --credential-cert-path=/var/lib/vault-cert/client_cert.pem \
+        --credential-cert-private-key-path=/var/lib/vault-cert/client_key.pem \
+        --output-file=cred.json
+    ```
+
+2. Activate the service account with `gcloud auth login --cred-file=cred.json`.
+3. Run the WIF tests.
+
+Example test commands are in `test_wif.sh`.