GKE Pod 身份：访问 Bucket 与 Secret Manager

gcloud container clusters update "$CLUSTER" \
  --project="$GKE_PROJECT_ID" --location="$LOCATION" \
  --workload-pool="${GKE_PROJECT_ID}.svc.id.goog"

NODE_POOL='REPLACE_NODE_POOL'

gcloud container node-pools update "$NODE_POOL" \
  --project="$GKE_PROJECT_ID" --location="$LOCATION" \
  --cluster="$CLUSTER" --workload-metadata=GKE_METADATA

GKE_PROJECT_NUMBER=$(gcloud projects describe "$GKE_PROJECT_ID" --format='value(projectNumber)')
RUN_ID=$(date -u +%Y%m%d%H%M%S)
NAMESPACE="wi-demo-${RUN_ID}"
KSA='reader'
BUCKET="gke-wi-${GKE_PROJECT_NUMBER}-${RUN_ID}"
SECRET="gke-wi-${RUN_ID}"

gcloud services enable iamcredentials.googleapis.com sts.googleapis.com --project="$GKE_PROJECT_ID"

gcloud services enable storage.googleapis.com secretmanager.googleapis.com --project="$RESOURCE_PROJECT_ID"

kubectl --context="$KUBE_CONTEXT" create namespace "$NAMESPACE"
kubectl --context="$KUBE_CONTEXT" -n "$NAMESPACE" create serviceaccount "$KSA"

gcloud storage buckets create "gs://$BUCKET" \
  --project="$RESOURCE_PROJECT_ID" --location="$BUCKET_LOCATION" \
  --uniform-bucket-level-access --public-access-prevention

printf 'hello from GKE workload identity\n' | gcloud storage cp - "gs://$BUCKET/hello.txt" --project="$RESOURCE_PROJECT_ID"

printf 'synthetic-demo-value' | \
  gcloud secrets create "$SECRET" --project="$RESOURCE_PROJECT_ID" \
  --replication-policy=automatic --data-file=-

cat > wi-check.yaml <<EOF_POD
apiVersion: v1
kind: Pod
metadata:
  name: wi-check
  namespace: ${NAMESPACE}
spec:
  serviceAccountName: ${KSA}
  restartPolicy: Never
  containers:
    - name: cli
      image: gcr.io/google.com/cloudsdktool/google-cloud-cli:stable
      command: ["sleep", "3600"]
      env:
        - name: RESOURCE_PROJECT_ID
          value: "${RESOURCE_PROJECT_ID}"
        - name: BUCKET
          value: "${BUCKET}"
        - name: SECRET
          value: "${SECRET}"
      resources:
        requests:
          cpu: "250m"
          memory: "512Mi"
          ephemeral-storage: "256Mi"
        limits:
          cpu: "250m"
          memory: "512Mi"
          ephemeral-storage: "256Mi"
EOF_POD

spec:
  nodeSelector:
    iam.gke.io/gke-metadata-server-enabled: "true"

kubectl --context="$KUBE_CONTEXT" apply -f wi-check.yaml

kubectl --context="$KUBE_CONTEXT" -n "$NAMESPACE" wait --for=condition=Ready pod/wi-check --timeout=600s

import os
from google.cloud import storage, secretmanager

project = os.environ["RESOURCE_PROJECT_ID"]
blob = storage.Client(project=project).bucket(os.environ["BUCKET"]).blob("hello.txt")
object_bytes = blob.download_as_bytes()

client = secretmanager.SecretManagerServiceClient()
version = f"projects/{project}/secrets/{os.environ['SECRET']}/versions/1"
secret_bytes = client.access_secret_version(
    request={"name": version}
).payload.data

# 将内容交给业务逻辑；不打印 Secret、token 或对象的敏感内容。
if not object_bytes or not secret_bytes:
    raise RuntimeError("Unexpected empty demo payload")
print("PASS: Bucket object and Secret version readable")

GSA_NAME="wi-demo-${RUN_ID}"
GSA_EMAIL="${GSA_NAME}@${GKE_PROJECT_ID}.iam.gserviceaccount.com"

gcloud iam service-accounts create "$GSA_NAME" --project="$GKE_PROJECT_ID"

gcloud storage buckets add-iam-policy-binding "gs://$BUCKET" \
  --project="$RESOURCE_PROJECT_ID" \
  --member="serviceAccount:$GSA_EMAIL" --role=roles/storage.objectViewer

gcloud secrets add-iam-policy-binding "$SECRET" \
  --project="$RESOURCE_PROJECT_ID" \
  --member="serviceAccount:$GSA_EMAIL" --role=roles/secretmanager.secretAccessor

gcloud iam service-accounts add-iam-policy-binding "$GSA_EMAIL" \
  --project="$GKE_PROJECT_ID" --role=roles/iam.workloadIdentityUser \
  --member="serviceAccount:${GKE_PROJECT_ID}.svc.id.goog[${NAMESPACE}/${KSA}]"

# 在指定集群/namespace 的 KSA 上添加 annotation，指定使用哪个 Google SA 获取凭据；--overwrite 允许替换已有值，此命令本身不授予 IAM 权限。
kubectl --context="$KUBE_CONTEXT" -n "$NAMESPACE" annotate serviceaccount "$KSA" \
  "iam.gke.io/gcp-service-account=${GSA_EMAIL}" --overwrite

gcloud secrets remove-iam-policy-binding "$SECRET" \
  --project="$RESOURCE_PROJECT_ID" \
  --member="$KSA_PRINCIPAL" --role=roles/secretmanager.secretAccessor

kubectl --context="$KUBE_CONTEXT" -n "$NAMESPACE" exec wi-check -- \
  gcloud storage cat "gs://$BUCKET/hello.txt" --project="$RESOURCE_PROJECT_ID"

kubectl --context="$KUBE_CONTEXT" -n "$NAMESPACE" exec wi-check -- \
  gcloud secrets versions access 1 \
  --project="$RESOURCE_PROJECT_ID" --secret="$SECRET" >/dev/null

kubectl --context="$KUBE_CONTEXT" delete namespace "$NAMESPACE"

gcloud storage rm --recursive "gs://$BUCKET" --project="$RESOURCE_PROJECT_ID"

gcloud secrets delete "$SECRET" --project="$RESOURCE_PROJECT_ID"

# 仅执行过备选方案且该 SA 是本例专用时：
# gcloud iam service-accounts delete "$GSA_EMAIL" --project="$GKE_PROJECT_ID"