Consolidated paths for different certificate delivery methods.

make_sts_agent_creds.py

@@ -4,26 +4,25 @@ import json
 import os
 import sys
 
-parser = argparse.ArgumentParser(description="Create the credential configuration directory for the Storage Transfer agent container.")
+parser = argparse.ArgumentParser(description="Create the credential configuration of the Storage Transfer agent container.")
 parser.add_argument("--project-number", required=True, help="number of the project of the workload identity pool")
 parser.add_argument("--pool", required=True, help="workload identity pool ID")
 parser.add_argument("--provider", required=True, help="X.509 provider ID")
 parser.add_argument("--service-account", required=True, help="email of the impersonated service account")
-parser.add_argument("--cert", default="/var/lib/vault-cert/wif/client_cert.pem", help="client certificate")
-parser.add_argument("--key", default="/var/lib/vault-cert/wif/client_key.pem", help="client private key")
-parser.add_argument("--output", default="/etc/sts-agent", help="credential configuration directory")
+parser.add_argument("--output", default="/etc/sts-agent", help="credential directory of the agent")
 args = parser.parse_args()
 
-cert = os.path.abspath(args.cert)
-key = os.path.abspath(args.key)
+output = os.path.abspath(args.output)
+cert = os.path.join(output, "client_cert.pem")
+key = os.path.join(output, "client_key.pem")
 
-# The container mounts the certificate directory, so the files must exist on the host.
+# The client certificate and key must be installed in the credential directory first.
 for path in (cert, key):
     if not os.path.isfile(path):
         sys.exit(f"{path} does not exist")
 
-# Credential configuration directory mounted read only in the agent container, its files hold no secrets.
-os.makedirs(args.output, mode=0o755, exist_ok=True)
+# The credential directory holds the private key and is mounted read only in the agent container.
+os.chmod(output, 0o750)
 
 cred = {
     "universe_domain": "googleapis.com",
@@ -39,7 +38,7 @@ cred = {
     "service_account_impersonation_url": f"https://iamcredentials.mtls.googleapis.com/v1/projects/-/serviceAccounts/{args.service_account}:generateAccessToken",
 }
 
-# The container mounts the certificate directory at the same path as on the host.
+# The container mounts the credential directory at the same path as on the host.
 certificate_config = {
     "cert_configs": {
         "workload": {
@@ -50,6 +49,6 @@ certificate_config = {
 }
 
 for name, content in (("cred.json", cred), ("certificate_config.json", certificate_config)):
-    with open(os.path.join(args.output, name), "w") as file:
+    with open(os.path.join(output, name), "w") as file:
         json.dump(content, file, indent=2)
         file.write("\n")