Spring Cloud Vault with GCP-IAM Auth Method for multiple projects

[ralimardanov]

Good day,
Does this plugin supports multiple project authentication with vault?
I have 2 projects in one of them is my GKE cluster with deployed Vault. I use Spring Cloud Vault for application bootstrap.
Everything is working fine for application also running inside this cluster, it's able to get secrets and etc. Config was done using this docs.

I can't authenticate using service account inside another project. I get such kind of errors inside my application:

[RequestedSecret [path='secret/secret_path', mode=ROTATE]] Lease [leaseId='null', leaseDuration=PT0S, renewable=false] Cannot login using GCP-IAM: could not find service account 'projects/-/serviceAccounts/<service_name>': googleapi: Error 403: Permission iam.serviceAccounts.get is required to perform this operation on service account projects/-/serviceAccounts/<service_name>., forbidden; nested exception is org.springframework.web.client.HttpServerErrorException$InternalServerError: 500 Internal Server Error: [{"errors":["could not find service account 'projects/-/serviceAccounts/<service_name>': googleapi: Error 403: Permission iam.serviceAccounts.get is required to perform this operation on service account projects/-/serviceAccounts/<service_name>., forbidden"]} ]

And such kind of errors when I try to login via GCP console:

vault login -method=gcp role="my-iam-role-preprod" service_account="sa_name" project="project_id" jwt_exp="15m" [email protected]

Error authenticating: Error making API request.
URL: PUT <vault_addr>/v1/auth/gcp/login Code: 500. Errors:
could not find service account 'projects/-/serviceAccounts/<sa_name>': googleapi: Error 403: Permission
iam.serviceAccounts.get is required to perform this operation on service account projects/-/serviceAccounts/<sa_name>.,
forbidden

Config done from my side is like this:
I've configured vault in dev-mode using helm chart. Then created workload identity user for cluster to use and add annotations to vault service account inside GKE. It has browser and service account key admin permissions.
For application in the same project, I added service account token creator to workload identity user used by this application.

Inside vault, I've enabled gcp authentication, created secret, policy with read capabilities to this secret and created role:

vault write auth/gcp/role/my-iam-role type="iam" policies="<policy_name>" bound_service_accounts="service_account_email"

This is my bootstrap.properties file:

spring.application.name=<app_name>
spring.cloud.vault.uri=<vault_addr>
spring.cloud.vault.authentication=GCP_IAM
spring.cloud.vault.gcp-iam.role=${VAULT_IAM_ROLE}
spring.cloud.vault.gcp-iam.service-account-id=${VAULT_IAM_SA}
spring.cloud.vault.gcp-iam.project-id=${VAULT_SA_PROJECT_ID}
spring.cloud.vault.generic.enabled=false
spring.cloud.vault.fail-fast=false
spring.cloud.vault.kv.enabled=true
spring.cloud.vault.kv.backend=secret
spring.cloud.vault.kv.profile-separator='/'
spring.cloud.vault.kv.default-context=<app_name>
spring.cloud.vault.kv.application-name=<app_name>

So inside one project it works as expected. When I try to do the same from another project, it throughs an errors mentioned above. I wasn't able to find any info about how authentication to vault can be configured for cross project. For second project I've created role named my-iam-role-preprod.