source ./env.sh

# Generate the trust store from the Vault CA certificates
./make_trust_store.mjs

# Replace the trust store of the existing X.509 provider
gcloud iam workload-identity-pools providers update-x509 "${PROVIDER_ID}" \
  --project="${PROJECT_ID}" \
  --location=global \
  --workload-identity-pool="${POOL_ID}" \
  --trust-store-config-path=trust_store.yaml

# Show the provider configuration
gcloud iam workload-identity-pools providers describe "${PROVIDER_ID}" \
  --project="${PROJECT_ID}" \
  --location=global \
  --workload-identity-pool="${POOL_ID}"

# Test the federation with the client certificate issued by Vault
gcloud storage ls "gs://${BUCKET}" --configuration=wif-test