56 lines
2.4 KiB
Python
Executable File
56 lines
2.4 KiB
Python
Executable File
#!/usr/bin/python3
|
|
import argparse
|
|
import json
|
|
import os
|
|
import sys
|
|
|
|
parser = argparse.ArgumentParser(description="Create the credential configuration directory for the Storage Transfer agent container.")
|
|
parser.add_argument("--project-number", required=True, help="number of the project of the workload identity pool")
|
|
parser.add_argument("--pool", required=True, help="workload identity pool ID")
|
|
parser.add_argument("--provider", required=True, help="X.509 provider ID")
|
|
parser.add_argument("--service-account", required=True, help="email of the impersonated service account")
|
|
parser.add_argument("--cert", default="/var/lib/vault-cert/wif/client_cert.pem", help="client certificate")
|
|
parser.add_argument("--key", default="/var/lib/vault-cert/wif/client_key.pem", help="client private key")
|
|
parser.add_argument("--output", default="/etc/sts-agent", help="credential configuration directory")
|
|
args = parser.parse_args()
|
|
|
|
cert = os.path.abspath(args.cert)
|
|
key = os.path.abspath(args.key)
|
|
|
|
# The container mounts the certificate directory, so the files must exist on the host.
|
|
for path in (cert, key):
|
|
if not os.path.isfile(path):
|
|
sys.exit(f"{path} does not exist")
|
|
|
|
# Credential configuration directory mounted read only in the agent container, its files hold no secrets.
|
|
os.makedirs(args.output, mode=0o755, exist_ok=True)
|
|
|
|
cred = {
|
|
"universe_domain": "googleapis.com",
|
|
"type": "external_account",
|
|
"audience": f"//iam.googleapis.com/projects/{args.project_number}/locations/global/workloadIdentityPools/{args.pool}/providers/{args.provider}",
|
|
"subject_token_type": "urn:ietf:params:oauth:token-type:mtls",
|
|
"token_url": "https://sts.mtls.googleapis.com/v1/token",
|
|
"credential_source": {
|
|
"certificate": {
|
|
"use_default_certificate_config": True,
|
|
}
|
|
},
|
|
"service_account_impersonation_url": f"https://iamcredentials.mtls.googleapis.com/v1/projects/-/serviceAccounts/{args.service_account}:generateAccessToken",
|
|
}
|
|
|
|
# The container mounts the certificate directory at the same path as on the host.
|
|
certificate_config = {
|
|
"cert_configs": {
|
|
"workload": {
|
|
"cert_path": cert,
|
|
"key_path": key,
|
|
}
|
|
}
|
|
}
|
|
|
|
for name, content in (("cred.json", cred), ("certificate_config.json", certificate_config)):
|
|
with open(os.path.join(args.output, name), "w") as file:
|
|
json.dump(content, file, indent=2)
|
|
file.write("\n")
|