Support default compute metadata service account JWTs lacking GCE metadata

[mbrancato]

The GKE metadata service (and I think Cloud Run) does not implement the GCE metadata fields but is obtained using the standard method as a gce identity would be using http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity. This makes it easy to obtain the JWT for a service identity using the GCP auto-auth method in Vault Agent. The problem is that when authenticating to a role with type="gce", the GCP auth method complains:

[ERROR] auth.handler: error authenticating: error="Error making API request.

URL: PUT https://vault.vault.svc:8200/v1/auth/gcp/login
Code: 400. Errors:

* expected JWT to have claims with GCE metadata" backoff=1s

Here, the Vault agent successfully obtained a JWT for the assigned service account, but the auth method couldn't accept it. The service account does NOT need the iam.serviceAccounts.signJwt permission or any assigned roles really to obtain this JWT.

Switching to a role with type="iam" means that with auto-auth in Vault Agent, we must specify the project and service account instead of simply asking for the default identity. This requires the iam.serviceAccounts.signJwt permission but doesn't really provide any benefit to the identity validation process.

It would be nice if with type="gce" roles, that if bound_service_accounts is set, the GCE metadata is not needed unless there is a bound_projects, bound_zones, etc. on the role.

A workaround for this right now is to mix the two. Use Vault Agent auto-auth with type="gce" and configure the GCP auth role with type="iam" and the proper bound_service_accounts. This will result in an error: role requires that service account JWTs expire within 900 seconds. This is because the GCE default assigned identities get a JWT valid for 1 hour. The "fix" is to set jwt_exp="3600" on the role.

Related to #85

[L-u-k-e]

🙌 Thank you for this workaround! FYI the correct name of the parameter is actually: max_jwt_exp https://www.vaultproject.io/api-docs/auth/gcp#iam-only-parameters