A simple demo describing a contrived way to provision and authenticate a device to Google IoT Core where the private key used for authentication is permanently embedded in hardware (a Trusted Platform Module (TPM))

What? Well, I noticed that the existing documentation for IoT uses openssl to generate actual key-paris…

Whats an attribute certificate? I didn’t know either but its basically an x509 certificate that makes claims about a system and the bearer and critically establishes a “link” between the bearer and some other provided credential. In my case i assetting up a grpc-based TPM remote attestation client-server.

Within that…

Samples which demonstrate getting and using impersonated credentials for Google Cloud Service Accounts.

Use the impersonated token to access GCP Services and IdTokens for Cloud Run, Cloud Functions, Endpoints

• Start with Service Account SA1
• Use SA1 to impersonate SA2
• Use SA2 to get an id_token
• Use SA2 to access a…

A script in golang which demonstrates how to allow a user temporary, time-limited membership to a Google Group. (firecall access, just in time access)

You can use this to set on-demand firecall access based on google groups.

For example, if you need to let a specific user access to a…

BigQuery AEAD encryption functions uses TINK Keysets.

Works fine but all samples included there describe how to generate an encoded key using a BQ function itself: KEYS.NEW_KEYSET(‘AEAD_AES_GCM_256’)

However, what if you

a) already have a raw AEAD_AES_GCM_256 that you want to use with BQ or

b) you've already generated a…

Code snippet to create a GCS Signed URL in Cloud Run, Cloud Functions and GCE VMs

• Why am i writing this repo?
  because it isn’t clear that in those environment that with some languages you can “just use” the default credentials (node, java recentntly go) while in python, you should use…

Ever needed to know how Google Cloud IAM roles and permissions change over time? Ever wanted to map roles<->permissions thats easily queryable in a BQ dataset?

Why you ask?

The easiest usecase is to have a way to reverse map “which permissions are in this role? or Which roles include…

Kubernetes service for gRPC xDS loadbalancing that allows even distribution of k8s gRPC service->service api calls.

gRPC loadbalancinng can take many different schemes as described here Load Balancing in gRPC. The particular scheme described here is pretty unique and experimental: xDS server for gRPC.

Note, normally kubernetes services are exposed…