21 lines
698 B
Bash
21 lines
698 B
Bash
source ./env.sh
|
|
|
|
# Generate the trust store from the Vault CA certificates
|
|
./make_trust_store.mjs
|
|
|
|
# Replace the trust store of the existing X.509 provider
|
|
gcloud iam workload-identity-pools providers update-x509 "${PROVIDER_ID}" \
|
|
--project="${PROJECT_ID}" \
|
|
--location=global \
|
|
--workload-identity-pool="${POOL_ID}" \
|
|
--trust-store-config-path=trust_store.yaml
|
|
|
|
# Show the provider configuration
|
|
gcloud iam workload-identity-pools providers describe "${PROVIDER_ID}" \
|
|
--project="${PROJECT_ID}" \
|
|
--location=global \
|
|
--workload-identity-pool="${POOL_ID}"
|
|
|
|
# Test the federation with the client certificate issued by Vault
|
|
gcloud storage ls "gs://${BUCKET}" --configuration=wif-test
|