From f0bfba4f4e7cb5a8ad55fcb8796d52e5097fd6b5 Mon Sep 17 00:00:00 2001 From: Confidential Space Date: Mon, 30 Jun 2025 18:59:04 -0700 Subject: [PATCH] No public description PiperOrigin-RevId: 777814461 --- .../scripts/common.sh | 24 ++++++++++++++----- .../create_workload_service_account.sh | 2 +- .../scripts/setup_primus_bank_resources.sh | 2 +- .../scripts/setup_secundus_bank_resources.sh | 2 +- .../src/uwear/workload.go | 2 +- server/gcpcredential/validate.go | 2 +- server/gcpcredential/validate_test.go | 2 +- 7 files changed, 24 insertions(+), 12 deletions(-) diff --git a/codelabs/bank_data_analysis_codelab/scripts/common.sh b/codelabs/bank_data_analysis_codelab/scripts/common.sh index a010ff5..923f074 100644 --- a/codelabs/bank_data_analysis_codelab/scripts/common.sh +++ b/codelabs/bank_data_analysis_codelab/scripts/common.sh @@ -154,16 +154,28 @@ destroy_kms_key() { # Name of the service-account ####################################### create_service_account() { - gcloud iam service-accounts describe ${1} | grep ${1} + local sa_name="$1" + local project_id="$2" # Accept the project ID as the second argument. + + # Construct the full, unique service account email address. + local sa_email="${sa_name}@${project_id}.iam.gserviceaccount.com" + + # Check if the service account already exists IN THE SPECIFIED PROJECT. + # Note the addition of the --project flag. + gcloud iam service-accounts describe "${sa_email}" --project="${project_id}" >/dev/null 2>&1 + if [[ $? -eq 0 ]]; then - echo "Service-account ${1} already exists. Skipping the create of new service-account ..." + echo "Service-account ${sa_email} already exists in project ${project_id}. Skipping creation." else - echo "Creating service-account ${1} ..." - gcloud iam service-accounts create ${1} + echo "Creating service-account ${sa_name} in project ${project_id}..." + # Create the service account IN THE SPECIFIED PROJECT. + gcloud iam service-accounts create "${sa_name}" --display-name="${sa_name}" --project="${project_id}" + if [[ $? -eq 0 ]]; then - echo "Service-account ${1} is created successfully." + echo "Service-account ${sa_email} is created successfully." else - err "Failed to create service-account ${1}." + echo "Error: Failed to create service-account ${sa_name} in project ${project_id}." >&2 + return 1 fi fi } diff --git a/codelabs/bank_data_analysis_codelab/scripts/create_workload_service_account.sh b/codelabs/bank_data_analysis_codelab/scripts/create_workload_service_account.sh index 95342e1..42a27cd 100755 --- a/codelabs/bank_data_analysis_codelab/scripts/create_workload_service_account.sh +++ b/codelabs/bank_data_analysis_codelab/scripts/create_workload_service_account.sh @@ -8,7 +8,7 @@ source common.sh set_gcp_project ${SECUNDUS_PROJECT_ID} echo "Creating workload service-account ${WORKLOAD_SERVICE_ACCOUNT} under project ${SECUNDUS_PROJECT_ID}..." -create_service_account ${WORKLOAD_SERVICE_ACCOUNT} +create_service_account ${WORKLOAD_SERVICE_ACCOUNT} ${SECUNDUS_PROJECT_ID} echo "Granting roles/iam.serviceAccountUser role to workload operator ..." if ! gcloud iam service-accounts add-iam-policy-binding ${WORKLOAD_SERVICE_ACCOUNT}@${SECUNDUS_PROJECT_ID}.iam.gserviceaccount.com \ diff --git a/codelabs/bank_data_analysis_codelab/scripts/setup_primus_bank_resources.sh b/codelabs/bank_data_analysis_codelab/scripts/setup_primus_bank_resources.sh index f05b9c8..9104a46 100755 --- a/codelabs/bank_data_analysis_codelab/scripts/setup_primus_bank_resources.sh +++ b/codelabs/bank_data_analysis_codelab/scripts/setup_primus_bank_resources.sh @@ -34,7 +34,7 @@ echo "Uploading the encrypted file to storage bucket ${PRIMUS_INPUT_STORAGE_BUCK gsutil cp ${PARENT_DIR}/artifacts/primus_enc_customer_list.csv gs://${PRIMUS_INPUT_STORAGE_BUCKET}/primus_enc_customer_list.csv echo "Creating service-account ${PRIMUS_SERVICE_ACCOUNT} for Primus Bank." -create_service_account ${PRIMUS_SERVICE_ACCOUNT} +create_service_account ${PRIMUS_SERVICE_ACCOUNT} ${PRIMUS_PROJECT_ID} echo "Granting KMS decryptor role to the service-account ${PRIMUS_SERVICE_ACCOUNT} ..." gcloud kms keys add-iam-policy-binding \ diff --git a/codelabs/bank_data_analysis_codelab/scripts/setup_secundus_bank_resources.sh b/codelabs/bank_data_analysis_codelab/scripts/setup_secundus_bank_resources.sh index 4bb6035..153499f 100755 --- a/codelabs/bank_data_analysis_codelab/scripts/setup_secundus_bank_resources.sh +++ b/codelabs/bank_data_analysis_codelab/scripts/setup_secundus_bank_resources.sh @@ -38,7 +38,7 @@ echo "Uploading the encrypted file to storage bucket ${SECUNDUS_INPUT_STORAGE_BU gsutil cp ${PARENT_DIR}/artifacts/secundus_enc_customer_list.csv gs://${SECUNDUS_INPUT_STORAGE_BUCKET}/secundus_enc_customer_list.csv echo "Creating service-account ${SECUNDUS_SERVICE_ACCOUNT} for secundus bank ..." -create_service_account ${SECUNDUS_SERVICE_ACCOUNT} +create_service_account ${SECUNDUS_SERVICE_ACCOUNT} ${SECUNDUS_PROJECT_ID} echo "Granting KMS decryptor role to the service-account ${SECUNDUS_SERVICE_ACCOUNT}" gcloud kms keys add-iam-policy-binding \ diff --git a/codelabs/health_data_analysis_codelab/src/uwear/workload.go b/codelabs/health_data_analysis_codelab/src/uwear/workload.go index db13bbe..7058e12 100644 --- a/codelabs/health_data_analysis_codelab/src/uwear/workload.go +++ b/codelabs/health_data_analysis_codelab/src/uwear/workload.go @@ -18,7 +18,7 @@ import ( "os" "time" - "github.com/golang-jwt/jwt/v5" + "google3/third_party/golang/github_com/golang_jwt/jwt/v/v4/jwt" "github.com/gorilla/websocket" diff --git a/server/gcpcredential/validate.go b/server/gcpcredential/validate.go index 15c0179..885eba8 100644 --- a/server/gcpcredential/validate.go +++ b/server/gcpcredential/validate.go @@ -20,9 +20,9 @@ import ( + "google3/third_party/golang/github_com/golang_jwt/jwt/v/v4/jwt" "google.golang.org/api/idtoken" "google.golang.org/api/option" - "github.com/golang-jwt/jwt/v5" ) const googleCAURL = "https://pki.goog/roots.pem" diff --git a/server/gcpcredential/validate_test.go b/server/gcpcredential/validate_test.go index 2d7ef48..aaea2c7 100644 --- a/server/gcpcredential/validate_test.go +++ b/server/gcpcredential/validate_test.go @@ -16,8 +16,8 @@ import ( "time" "github.com/google/go-cmp/cmp" + "google3/third_party/golang/github_com/golang_jwt/jwt/v/v4/jwt" "google.golang.org/api/idtoken" - jwt "github.com/golang-jwt/jwt/v5" ) const testAudience = "testaud"