From 66ab6b1f29dfb5fbed837e99f79ae9fb9e146be9 Mon Sep 17 00:00:00 2001
From: Mark van Holsteijn <mark.van.holsteijn@gmail.com>
Date: Fri, 26 Nov 2021 16:41:55 +0100
Subject: [PATCH] improved readme

---
 README.md | 25 ++++++++++++++++---------
 1 file changed, 16 insertions(+), 9 deletions(-)

diff --git a/README.md b/README.md
index d31dca4..9061637 100644
--- a/README.md
+++ b/README.md
@@ -29,7 +29,7 @@ target_cluster = {
 }
 
 ## DNS managed zone accessible from the public internet
-dns_managed_zone = "google-binx-dev"
+dns_managed_zone = "my-managed-zone"
 accessors = [
     "user:markvanholsteijn@binx.io",
 ]
@@ -50,6 +50,20 @@ $ terraform init
 $ terraform apply
 ```
 
+After the apply, the required IAP proxy command is printed:
+```
+iap_proxy_command = <<EOT
+simple-iap-proxy  \
+  --rename-auth-header \
+  --target-url https://iap-proxy.my.cloud.dev \
+  --iap-audience 1234567890-j9onig1ofcgle7iogv8fceu04v8hriuv.apps.googleusercontent.com \
+  --service-account iap-proxy-accessor@my-project.iam.gserviceaccount.com \
+  --certificate-file server.crt \
+  --key-file server.key
+
+EOT
+```
+
 ## start the IAP proxy
 To start the IAP proxy, you need a certificate. To generate a self-signed certificate, type:
 
@@ -62,17 +76,10 @@ $ openssl req -new -x509 -sha256 \
     -days 3650 \
     -out server.crt
 ```
-Now you can start the proxy, type:
+Now you can start the proxy, by copying the outputted command:
 
 ```shell-terminal
 $ go install github.com/binxio/simple-iap-proxy@0.2.0
-$ simple-iap-proxy \
-   --target-url $target_url \
-   --key-file server.key \
-   --certificate-file server.crt \
-   --rename-auth-header \
-   --audience $audience \
-   --service-account $service_account &
 ```
 The reason for the self-signed certificate is that kubectl will not send the credentials over HTTP.