slawek/gcp-wif-test
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Consolidated paths for different certificate delivery methods.

Browse Source
This commit is contained in:
slawek committed 2026-10-19 16:57:46 +02:00
1 parent 4f0d3f4f04
commit 93bb0b78a2
4 files changed
+25 -43
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/storage-transfer.md
+8 -9
View File
@@ -16,7 +16,7 @@ Agent host, for sections 3 and 4:
- Linux on AMD64 with a container runtime, Python 3, and the external storage mounted at `/mnt/ext-storage`.
- A copy of this repository, a `git clone` or an archive unpacked as described in the section "Copy the repository to a server" of the main `README.md`, with `env.sh` created as described in the Configuration section of the main `README.md`. The commands run from its directory.
- With the Vault CA, the client certificate renewed in `/var/lib/vault-cert/wif/`, as described in section 4 of `docs/vault-approle.md`. With the OpenSSL CA, the certificate is installed in section 3.
- With the Vault CA, the client certificate renewed in `/etc/sts-agent/`, as described in section 4 of `docs/vault-approle.md`. With the OpenSSL CA, the certificate is installed in section 3.
The names come from `env.sh`.
@@ -54,7 +54,7 @@ Role: **Server administrator**
### Install the client certificate
The agent reads the client certificate and key from `/var/lib/vault-cert/wif/`. With the Vault CA, `vault-cert-renew@wif.timer` keeps them there and this step is skipped.
The agent reads the client certificate and key, which authenticate the service account it uses, from its credential directory `/etc/sts-agent/`, regardless of the CA that issued them. With the Vault CA, `vault-cert-renew@wif.timer` keeps them there and this step is skipped.
With the OpenSSL CA, `make_certs.sh` created `client_cert.pem` and `client_key.pem` in the repository directory on the admin workstation. Copy them to the agent host, replacing `agent-host` with its name:
@@ -65,15 +65,15 @@ scp client_cert.pem client_key.pem agent-host:
Install them on the agent host and delete the copies:
```bash
sudo install -d -m 0750 /var/lib/vault-cert/wif
sudo install -m 0644 ~/client_cert.pem /var/lib/vault-cert/wif/client_cert.pem
sudo install -m 0600 ~/client_key.pem /var/lib/vault-cert/wif/client_key.pem
sudo install -d -m 0750 /etc/sts-agent
sudo install -m 0644 ~/client_cert.pem /etc/sts-agent/client_cert.pem
sudo install -m 0600 ~/client_key.pem /etc/sts-agent/client_key.pem
rm ~/client_cert.pem ~/client_key.pem
```
### Create the credentials configuration
`make_sts_agent_creds.py` runs on the agent host. It checks that the client certificate and key exist, and creates the directory `/etc/sts-agent` with the following files, which hold no secrets:
`make_sts_agent_creds.py` runs on the agent host. It checks that the client certificate and key exist in `/etc/sts-agent`, sets the mode of the directory to 0750, and creates the following files next to them:
- `cred.json`, the credentials configuration for the X.509 provider and the impersonation of the service account. The agent finds it through the `GOOGLE_APPLICATION_CREDENTIALS` environment variable. It refers to the default certificate configuration, which the agent finds through the `GOOGLE_API_CERTIFICATE_CONFIG` environment variable.
- `certificate_config.json`, with the paths of the client certificate and key.
@@ -87,9 +87,9 @@ sudo ./make_sts_agent_creds.py \
--service-account="${SA_EMAIL}"
```
The options `--cert` and `--key` (default the files in `/var/lib/vault-cert/wif/`) and `--output` (default `/etc/sts-agent`) change the paths.
The option `--output` (default `/etc/sts-agent`) changes the credential directory.
The certificate and key are not copied into `/etc/sts-agent`. The agent reads them from the mounted directory `/var/lib/vault-cert/wif/`, so certificates renewed there by `vault-cert-renew@wif.timer` are used without changes to the configuration.
The agent reads the certificate and key from the mounted directory, so certificates renewed there by `vault-cert-renew@wif.timer` are used without changes to the configuration.
## 4. Start the transfer agent
@@ -102,7 +102,6 @@ The agent container runs with the following settings:
| Image | `gcr.io/cloud-ingest/tsop-agent:latest` |
| Mount | `/mnt/ext-storage`, read only |
| Mount | `/etc/sts-agent`, read only |
| Mount | `/var/lib/vault-cert/wif`, read only |
| Environment | `GOOGLE_APPLICATION_CREDENTIALS=/etc/sts-agent/cred.json` |
| Environment | `GOOGLE_API_CERTIFICATE_CONFIG=/etc/sts-agent/certificate_config.json` |
| Locked memory limit | `64000000` bytes |