Added prototype files.

make_wif.sh

@@ -0,0 +1,32 @@
+# Create a workload identity pool and a X.509 provider
+gcloud iam workload-identity-pools create dom-lab-pool \
+  --project=dom-lab \
+  --location=global \
+  --display-name="Dom Lab Pool"
+
+# Create X.509 provider
+gcloud iam workload-identity-pools providers create-x509 dom-lab-x509 \
+  --project=dom-lab \
+  --location=global \
+  --workload-identity-pool=dom-lab-pool \
+  --trust-store-config-path=trust_store.yaml \
+  --attribute-mapping="google.subject=assertion.subject.dn.cn"
+
+# Create the service account
+gcloud iam service-accounts create sa-test \
+  --project=dom-lab \
+  --display-name="SA Test"
+
+# Allow impersonation of the service account
+gcloud iam service-accounts add-iam-policy-binding \
+    sa-test@dom-lab.iam.gserviceaccount.com \
+    --role=roles/iam.workloadIdentityUser \
+    --member="principal://iam.googleapis.com/projects/267098479356/locations/global/workloadIdentityPools/dom-lab-pool/subject/test-client"
+
+# Create credentials configuration files
+gcloud iam workload-identity-pools create-cred-config \
+    projects/267098479356/locations/global/workloadIdentityPools/dom-lab-pool/providers/dom-lab-x509 \
+    --service-account=sa-test@dom-lab.iam.gserviceaccount.com \
+    --credential-cert-path=client_cert.pem \
+    --credential-cert-private-key-path=client_key.pem \
+    --output-file=cred.json