# Create a workload identity pool and a X.509 provider
gcloud iam workload-identity-pools create dom-lab-pool \
  --project=dom-lab \
  --location=global \
  --display-name="Dom Lab Pool"

# Create X.509 provider
gcloud iam workload-identity-pools providers create-x509 dom-lab-x509 \
  --project=dom-lab \
  --location=global \
  --workload-identity-pool=dom-lab-pool \
  --trust-store-config-path=trust_store.yaml \
  --attribute-mapping="google.subject=assertion.subject.dn.cn"

# Create the service account
gcloud iam service-accounts create sa-test \
  --project=dom-lab \
  --display-name="SA Test"

# Allow impersonation of the service account
gcloud iam service-accounts add-iam-policy-binding \
    sa-test@dom-lab.iam.gserviceaccount.com \
    --role=roles/iam.workloadIdentityUser \
    --member="principal://iam.googleapis.com/projects/267098479356/locations/global/workloadIdentityPools/dom-lab-pool/subject/test-client"

# Grant the service account read access to the project
gcloud projects add-iam-policy-binding dom-lab \
    --member="serviceAccount:sa-test@dom-lab.iam.gserviceaccount.com" \
    --role=roles/browser

# Create credentials configuration files
gcloud iam workload-identity-pools create-cred-config \
    projects/267098479356/locations/global/workloadIdentityPools/dom-lab-pool/providers/dom-lab-x509 \
    --service-account=sa-test@dom-lab.iam.gserviceaccount.com \
    --credential-cert-path=client_cert.pem \
    --credential-cert-private-key-path=client_key.pem \
    --output-file=cred.json

# Authenticate gcloud with the credentials configuration file
gcloud auth login --cred-file=cred.json

# Test the authentication by listing the project details
gcloud auth list
gcloud projects describe dom-lab
gcloud projects get-iam-policy dom-lab \
    --flatten="bindings[].members" \
    --format="table(bindings.role, bindings.members)"

# Then, switch back to your original account
gcloud config set account adminslawek@gcp-lab.koszewscy.waw.pl

# and again switch back to the service account using the credentials configuration file
gcloud config set account sa-test@dom-lab.iam.gserviceaccount.com