agent/gcp: derive service account from credentials instead of hardcoding 'default'

[Damini008]

Problem

When type=iam and no service_account is explicitly set in the
auto_auth config, the Vault agent was sending the literal string
"default" to the GCP IAM SignJwt API, which rejects it with:

Error 400: Invalid form of account ID default.
Should be [Gaia ID | Email | Unique ID]

This happened because serviceAccount was hardcoded to "default" at
construction time, which prevented the fallback to
credentials.ClientEmail (populated from GOOGLE_APPLICATION_CREDENTIALS)
from ever being reached.

Fix

• Remove the hardcoded "default" from the constructor
• In the IAM branch of Authenticate, fall back to
  credentials.ClientEmail when no explicit service_account is configured
• For the GCE branch, apply "default" locally as a metadata-server
  alias — this is valid for GCE and behaviour is unchanged

Testing

Added unit tests covering:

• No service_account configured → field is empty (key regression guard)
• Explicit service_account → preserved as-is
• GCE type without service_account → empty at construction
• Missing type, missing role, nil config → all return errors

Related

Fixes: hashicorp/vault-plugin-auth-gcp#183

[vercel]

Deployment failed for project vault-ui with the following error:

The `vercel.json` schema validation failed with the following message: should NOT have additional property `public`

Learn More: https://vercel.com/docs/concepts/projects/project-configuration

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
vault-ui	Error		Aug 11, 2026 4:12pm

[hashicorp-cla-app]

All committers have signed the CLA.

[hashicorp-cla-app]

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

---

Damini008 seems not to be a GitHub user.
You need a GitHub account to be able to sign the CLA.
If you have already a GitHub account, please add the email address used for this commit to your account.

_{Have you signed the CLA already but the status is still pending? Recheck it.}

[vercel]

Deployment failed for project vault-ui with the following error:

The `vercel.json` schema validation failed with the following message: should NOT have additional property `public`

Learn More: https://vercel.com/docs/concepts/projects/project-configuration

[vercel]

Deployment failed for project vault-ui with the following error:

The `vercel.json` schema validation failed with the following message: should NOT have additional property `public`

Learn More: https://vercel.com/docs/concepts/projects/project-configuration

[vercel]

Deployment failed for project vault-ui with the following error:

The `vercel.json` schema validation failed with the following message: should NOT have additional property `public`

Learn More: https://vercel.com/docs/concepts/projects/project-configuration