### Default の KSA
$ kubectl get serviceaccount default -n [名前空間]
NAME      SECRETS   AGE
default   0         14d

### Default の KSA トークンを確認
$ DEFAULT_KSA_TOKEN=$(kubectl exec -it [POD_NAME] -- cat /var/run/secrets/kubernetes.io/serviceaccount/token)
$ jwt decode $DEFAULT_KSA_TOKEN

{
  "aud": ["https://kubernetes.default.svc"],
  "exp": 1753085237,
  "iat": 1721549237,
  "iss": "https://oidc.eks.[REGION].amazonaws.com/id/[PROVIDER_ID]", // EKS の場合
  "kubernetes.io": {
    "namespace": "[名前空間]",
    "pod": {
      "name": "[Pod 名]",
      "uid": "baefc91e-980b-42c0-961d-dcfe08f117b3"
    },
    "serviceaccount": {
      "name": "[KSA 名]",
      "uid": "b5b8b845-b463-4557-b668-208716fa990f"
    },
    "warnafter": 1721552844
  },
  "nbf": 1721549237,
  "sub": "system:serviceaccount:[名前空間]:[KSA 名]"
}

apiVersion: v1
kind: ServiceAccount
metadata:
  name: [KSA 名]
  namespace: [名前空間]
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::[AWS_ACCOUNT_ID]:role/[ROLE_NAME]

### JWT（OIDC トークン）の確認
$ OIDC_TOKEN=$(kubectl exec -it [POD_NAME] -- cat /var/run/secrets/eks.amazonaws.com/serviceaccount/token)
$ jwt decode $OIDC_TOKEN

{
  "aud": ["sts.amazonaws.com"], // トークン対象者（トークン自体は Pod が持つが、その対象が STS であることが分かる）
  "exp": 1721599908,
  "iat": 1721513508,
  "iss": "https://oidc.eks.[REGION].amazonaws.com/id/[PROVIDER_ID]", // トークン発行者
  "kubernetes.io": {
    "namespace": "[名前空間]",
    "pod": {
      "name": "[Pod 名]",
      "uid": "baefc91e-980b-42c0-961d-dcfe08f117b3"
    },
    "serviceaccount": {
      "name": "[KSA 名]",
      "uid": "b5b8b845-b463-4557-b668-208716fa990f"
    }
  },
  "nbf": 1721513508,
  "sub": "system:serviceaccount:[名前空間]:[KSA 名]"
}

### EKS OIDC Provider から IdP の情報を取得
$ IDP=$(aws eks describe-cluster --name [CLUSTER_NAME] --query cluster.identity.oidc.issuer --output text)
$ curl -s $IDP/.well-known/openid-configuration | jq -r '.'

{
  "issuer": "https://oidc.eks.[REGION].amazonaws.com/id/[PROVIDER_ID]", // JWT の発行者（EKS OIDC Provider）
  "jwks_uri": "https://oidc.eks.[REGION].amazonaws.com/id/[PROVIDER_ID]/keys", // 公開鍵を取得するためのエンドポイント
  "authorization_endpoint": "urn:kubernetes:programmatic_authorization", // 認可エンドポイント
  "response_types_supported": ["id_token"], // OIDC Provider がサポートするレスポンスタイプ（ID トークン）
  "subject_types_supported": ["public"], // サポートされているサブジェクトタイプ
  "claims_supported": ["sub", "iss"], // OIDC Provider がサポートするクレーム
  "id_token_signing_alg_values_supported": ["RS256"] // ID トークンの署名に使用されるアルゴリズム
}

### JWKS URL から取得される公開鍵を確認
$ curl -s $IDP/keys | jq -r '.'

{
  "keys": [
    {
      "kty": "RSA", // Key Type：公開鍵暗号方式の種類
      "kid": "b12d2f264e3eb3036bde33008066f24f9eafa28e", // Key ID：公開鍵の識別子
      "use": "sig", // Public Key Use：鍵の用途（sig：デジタル署名）
      "alg": "RS256", // Algorithm：鍵が使用されるアルゴリズム（RS256：RSA SHA-256）
      "n": "xxx", // Modulus：RSA 公開鍵のモジュラス
      "e": "AQAB" // Exponent：RSA 公開鍵の指数部分
    },
    （以下省略）
  ]
}

$ kubectl get daemonset -n kube-system | grep -E 'NAME|gke-metadata-server'
NAME                                     DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR                                                        AGE
gke-metadata-server                      6         6         6       6            6           iam.gke.io/gke-metadata-server-enabled=true,kubernetes.io/os=linux   2y21d

$ iptables-legacy -L -n -v -t nat
Chain PREROUTING (policy ACCEPT 2655 packets, 160K bytes)
 pkts bytes target          prot opt in     out     source               destination
 129M 9016M KUBE-SERVICES   all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* kubernetes service portals */
    0     0 DNAT            tcp  --  *      *       0.0.0.0/0            169.254.169.254      tcp dpt:8080 /* metadata-concealment: bridge traffic to metadata server goes to metadata proxy */ to:127.0.0.1:987
45715 2743K DNAT            tcp  --  *      *       0.0.0.0/0            169.254.169.254      tcp dpt:80 /* metadata-concealment: bridge traffic to metadata server goes to metadata proxy */ to:127.0.0.1:988
...

apiVersion: v1
kind: ServiceAccount
metadata:
  name: [KSA 名]
  namespace: [名前空間]
  annotations:
    iam.gke.io/gcp-service-account: [GSA 名]@[PROJECT_ID].iam.gserviceaccount.com

principal://iam.googleapis.com/projects/[GCP_PROJECT_NUMBER]/locations/global/workloadIdentityPools/[GCP_WIF_POOL_ID]/subject/SUBJECT_ATTRIBUTE_VALUE`

### GSA を定義
resource "google_service_account" "default" {
  project      = "[GCP_PROJECT_ID]"
  account_id   = "[GSA_NAME]"
  display_name = "[GSA_NAME]"
  description  = "Managed by terraform: [GSA_NAME]"
}

### GSA に プロジェクトレベルで IAM ロールを付与
resource "google_project_iam_member" "default" {
  project = "[GCP_PROJECT_ID]"
  member  = "serviceAccount:${google_service_account.default.email}"
  for_each = toset([
    "roles/storage.objectViewer" # Storage Object Viewer
  ])
  role = each.value
}

### GSA の所定の Principal に対して Workload Identity User 権限を付与
resource "google_service_account_iam_member" "default" {
  for_each = toset([
    "principal://iam.googleapis.com/projects/408046229787/locations/global/workloadIdentityPools/[GCP_WIF_POOL_ID]/subject/system:serviceaccount:[名前空間]:[KSA 名]",
  ])
  service_account_id = google_service_account.default.id
  role               = "roles/iam.workloadIdentityUser"
  member             = each.value
}

{
  "type": "external_account",
  "audience": "//iam.googleapis.com/projects/[GCP_PROJECT_NUMBER]/locations/global/workloadIdentityPools/[GCP_WIF_POOL_ID]/providers/[GCP_WIF_POOL_PROVIDER_ID]",
  "subject_token_type": "urn:ietf:params:oauth:token-type:jwt",
  "token_url": "https://sts.googleapis.com/v1/token",
  "service_account_impersonation_url": "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/[GCP_GSA_EMAIL_ADDRESS]:generateAccessToken",
  "credential_source": {
    "file": "/var/run/secrets/eks.amazonaws.com/serviceaccount/token",
    "format": {
      "type": "text"
    }
  }
}

apiVersion: v1
kind: ConfigMap
metadata:
  name: gcp-credential
  namespace: [名前空間]
data:
  gcp.json: |
    {
      "type": "external_account",
      "audience": "//iam.googleapis.com/projects/[GCP_PROJECT_NUMBER]/locations/global/workloadIdentityPools/[GCP_WIF_POOL_ID]/providers/[GCP_WIF_POOL_PROVIDER_ID]",
      "subject_token_type": "urn:ietf:params:oauth:token-type:jwt",
      "token_url": "https://sts.googleapis.com/v1/token",
      "service_account_impersonation_url": "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/[GCP_GSA_EMAIL_ADDRESS]:generateAccessToken",
      "credential_source": {
        "file": "/var/run/secrets/eks.amazonaws.com/serviceaccount/token",
        "format": {
          "type": "text"
        }
      }
    }

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::[AWS_ACCOUNT_ID]]:oidc-provider/oidc.eks.[REGION].amazonaws.com/id/[PROVIDER_ID]"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "oidc.eks.ap-northeast-1.amazonaws.com/id/[PROVIDER_ID]:sub": "system:serviceaccount:[名前空間]:[KSA 名]",
          "oidc.eks.ap-northeast-1.amazonaws.com/id/[PROVIDER_ID]:aud": "sts.amazonaws.com"
        }
      }
    }
  ]
}

apiVersion: v1
kind: ServiceAccount
metadata:
  name: [KSA 名]
  namespace: [名前空間]
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::[AWS_ACCOUNT_ID]:role/[ROLE_NAME]

KSA_TOKEN_PATH="/var/run/secrets/eks.amazonaws.com/serviceacrcount/token"
KSA_TOKEN=$(cat $KSA_TOKEN_PATH)

response=$(curl -s -X POST \
  -H "Content-Type: application/json" \
  -d "{
    \"grant_type\": \"urn:ietf:params:oauth:grant-type:token-exchange\",
    \"requested_token_type\": \"urn:ietf:params:oauth:token-type:access_token\",
    \"subject_token_type\": \"urn:ietf:params:oauth:token-type:jwt\",
    \"subject_token\": \"$KSA_TOKEN\",
    \"scope\": \"https://www.googleapis.com/auth/cloud-platform\",
    \"audience\": \"//iam.googleapis.com/projects/[GCP_PROJECT_NUMBER]/locations/global/workloadIdentityPools/[GCP_WIF_POOL_ID]/providers/[GCP_WIF_POOL_PROVIDER_ID]\"
  }" \
  "https://sts.googleapis.com/v1/token")

OAUTH2_TOKEN=$(echo $response | jq -r '.access_token')
REQUEST_BODY=$(
  cat <<EOF
{
  "scope": ["https://www.googleapis.com/auth/cloud-platform"]
}
EOF
)
response=$(curl -s -X POST \
  -H "Authorization: Bearer $OAUTH2_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$REQUEST_BODY" \
  "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/[GCP_GSA_EMAIL_ADDRESS]:generateAccessToken")

#!/bin/bash

set -e

GCP_PROJECT_NUMBER=
WORKLOAD_IDENTITY_POOL_ID=
WORKLOAD_IDENTITY_PROVIDER_ID=
GSA_EMAIL=
KSA_TOKEN_PATH="/var/run/secrets/eks.amazonaws.com/serviceaccount/token"

# 1. OIDC トークンを用して Google OAuth 2.0 Access Token の取得
KSA_TOKEN=$(cat $KSA_TOKEN_PATH)
response=$(curl -s -X POST \
  -H "Content-Type: application/json" \
  -d "{
    \"grant_type\": \"urn:ietf:params:oauth:grant-type:token-exchange\",
    \"requested_token_type\": \"urn:ietf:params:oauth:token-type:access_token\",
    \"subject_token_type\": \"urn:ietf:params:oauth:token-type:jwt\",
    \"subject_token\": \"$KSA_TOKEN\",
    \"scope\": \"https://www.googleapis.com/auth/cloud-platform\",
    \"audience\": \"//iam.googleapis.com/projects/$GCP_PROJECT_NUMBER/locations/global/workloadIdentityPools/$WORKLOAD_IDENTITY_POOL_ID/providers/$WORKLOAD_IDENTITY_PROVIDER_ID\"
  }" \
  "https://sts.googleapis.com/v1/token")

echo "[INFO] Token Exchange Response: $response"

# 2. Google OAuth 2.0 Access Tokenの抽出
OAUTH2_TOKEN=$(echo $response | jq -r '.access_token')
echo "[INFO] Google OAuth 2.0 Access Token: $OAUTH2_TOKEN"

# 3. IAM Credentials API にリクエストを送信して GSA のアクセストークンを取得
REQUEST_BODY=$(
  cat <<EOF
{
  "scope": ["https://www.googleapis.com/auth/cloud-platform"]
}
EOF
)

response=$(curl -s -X POST \
  -H "Authorization: Bearer $OAUTH2_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$REQUEST_BODY" \
  "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/$GSA_EMAIL:generateAccessToken")

echo "[INFO] IAMCredentials API Response: $response"

# 4. GSA アクセストークンの抽出
GSA_ACCESS_TOKEN=$(echo $response | jq -r '.accessToken')
echo "[INFO] GSA Token: $GSA_ACCESS_TOKEN"

# 5. GSA アクセストークンを使用して GCS にアクセス
BUCKET_NAME="ren510dev"
response=$(curl -s -X GET \
  -H "Authorization: Bearer $GSA_ACCESS_TOKEN" \
  "https://storage.googleapis.com/storage/v1/b/$BUCKET_NAME/o")

echo "[INFO] Objects in bucket:"
echo "$response" | jq -r '.items[] | [.name, .size] | @tsv'

### EKS Pod の中でスクリプトを実行します
root@wif-sample-5ccd44995-sjzsd:~# ./check.sh

### 1 の出力結果
[INFO] Token Exchange Response: {
  "access_token": "ya29.d.c0AY_VpXXXXXXXXXXXX",
  "issued_token_type": "urn:ietf:params:oauth:token-type:access_token",
  "token_type": "Bearer",
  "expires_in": 3599
}

### 2 の出力結果
[INFO] Google OAuth 2.0 Access Token: ya29.d.c0AY_VpXXXXXXXXXXXX

### 3 の出力結果
[INFO] IAMCredentials API Response: {
  "accessToken": "ya29.c.c0AY_VpXXXXXXXXXXXX",
  "expireTime": "2024-07-07T08:40:01Z"
}

### 4 の出力結果
[INFO] GSA Token: ya29.c.c0AY_VpXXXXXXXXXXXX

### 5 の出力結果
[INFO] Objects in bucket:
sample.txt	17
sample2.txt	17

oauth2/google: status code 403: {\n \"error\": {\n   \"code\": 403,\n   \"message\": \"Permission 'iam.serviceAccounts.getAccessToken' denied on resource

apiVersion: v1
kind: ServiceAccount
metadata:
  name: [KSA 名]
  namespace: [名前空間]
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::[AWS_ACCOUNT_ID]:role/[ROLE_NAME]
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: gcp-credential
  namespace: [名前空間]
data:
  gcp.json: |
    {
      "type": "external_account",
      "audience": "//iam.googleapis.com/projects/[GCP_PROJECT_NUMBER]/locations/global/workloadIdentityPools/[GCP_WIF_POOL_ID]/providers/[GCP_WIF_POOL_PROVIDER_ID]",
      "subject_token_type": "urn:ietf:params:oauth:token-type:jwt",
      "token_url": "https://sts.googleapis.com/v1/token",
      "service_account_impersonation_url": "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/[GCP_GSA_EMAIL_ADDRESS]:generateAccessToken",
      "credential_source": {
        "file": "/var/run/secrets/eks.amazonaws.com/serviceaccount/token",
        "format": {
          "type": "text"
        }
      }
    }
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: [デプロイメント名]
  namespace: [名前空間]
spec:
  selector:
    matchLabels:
      app: [Pod 名]
  replicas: 1
  template:
    metadata:
      labels:
        app: [Pod 名]
    spec:
      serviceAccountName: [KSA 名]
      containers:
        - name: [コンテナ名]
          image: golang:latest
          imagePullPolicy: Always
          command: ['sleep', 'infinity']
          env:
            - name: GOOGLE_APPLICATION_CREDENTIALS # この環境変数を指定することで SDK はデフォルトで指定された JSON を認証情報として使用
              value: /credentials/gcp.json # ConfigMap から配置した JSON のパスを GOOGLE_APPLICATION_CREDENTIALS へ登録
          volumeMounts:
            - name: gcp-credential
              mountPath: /credentials
      volumes:
        - name: gcp-credential
          configMap:
            name: gcp-credential

package main

import (
	"context"
	"fmt"
	"log"
	"os"

	"cloud.google.com/go/storage"
	"google.golang.org/api/iterator"
	"google.golang.org/api/option"
)

const (
	credentialFilePath = "/credentials/gcp.json" // 認証プロファイル（JSON）のパス
	projectID          = ""                      // GCP プロジェクト ID
	bucketName         = ""                      // GCS バケット名
)

func main() {
	ctx := context.Background()

	fmt.Println("[DEBUG] Project ID: ", projectID)

	credentialData, err := os.ReadFile(credentialFilePath)
	if err != nil {
		log.Fatalf("Unable to read the credential file: %v", err)
	}

	fmt.Println("[DEBUG] Credential data: ", string(credentialData))

	// 特定のバケット内のオブジェクトリストを取得
	storageClient, err := storage.NewClient(ctx, option.WithCredentialsJSON(credentialData))
	if err != nil {
		log.Fatalf("Failed to create storage client: %v", err)
	}
	defer storageClient.Close()

	err = listObjects(ctx, storageClient, bucketName)
	if err != nil {
		log.Fatalf("Failed to list objects: %v", err)
	}
}

// 必須ロール: roles/storage.objectViewer (Storage Object Viewer)
func listObjects(ctx context.Context, client *storage.Client, bucketName string) error {
	it := client.Bucket(bucketName).Objects(ctx, nil)

	for {
		objectAttrs, err := it.Next()
		if err == iterator.Done {
			break
		}
		if err != nil {
			return fmt.Errorf("error while listing objects: %w", err)
		}

		fmt.Printf("[INFO] Object: %s, Size: %d bytes\n", objectAttrs.Name, objectAttrs.Size)
	}

	return nil
}