GCP: Use WithCredentialsJSON when Possible

Prior to this commit, using a GCP Service Account with a Key failed
in scenarios where an alternate UNIVERSE_DOMAIN is needed. The GCP
SDK codepath for WithCredentialsJSON will correctly determine
the Universe Domain, so we should call that whenever our credentials
contain the private key.

Author: patrickdillon

pkg/asset/installconfig/gcp/client.go

@@ -720,7 +720,7 @@ func (c *Client) GetNamespacedTagValue(ctx context.Context, tagNamespacedName st
 }
 
 func (c *Client) getKeyManagementClient(ctx context.Context) (*kms.KeyManagementClient, error) {
-	kmsClient, err := kms.NewKeyManagementClient(ctx, option.WithCredentials(c.ssn.Credentials))
+	kmsClient, err := kms.NewKeyManagementClient(ctx, CredentialOption(c.ssn))
 	if err != nil {
 		return nil, fmt.Errorf("failed to create kms key management client: %w", err)
 	}

pkg/asset/installconfig/gcp/services.go

@@ -59,6 +59,17 @@ func CreateEndpointOption(endpointName string, service ServiceNameGCP) option.Cl
 	return option.WithEndpoint(endpoint)
 }
 
+// CredentialOption returns the appropriate client option for the session credentials.
+// When raw credential JSON is available, WithCredentialsJSON is used so that the
+// Google API library can apply self-signed JWT authentication for non-default
+// universe domains (e.g., Google Cloud Dedicated).
+func CredentialOption(ssn *Session) option.ClientOption {
+	if len(ssn.Credentials.JSON) > 0 {
+		return option.WithCredentialsJSON(ssn.Credentials.JSON)
+	}
+	return option.WithCredentials(ssn.Credentials)
+}
+
 // getOptions creates the options for use during service creation.
 func getOptions(ctx context.Context) ([]option.ClientOption, error) {
 	ssn, err := GetSession(ctx)
@@ -67,7 +78,7 @@ func getOptions(ctx context.Context) ([]option.ClientOption, error) {
 	}
 
 	options := []option.ClientOption{
-		option.WithCredentials(ssn.Credentials),
+		CredentialOption(ssn),
 	}
 	return options, nil
 }

pkg/quota/gcp/gcp.go

@@ -35,7 +35,7 @@ func Load(ctx context.Context, project string, endpoint *gcptypes.PSCEndpoint, s
 	if err != nil {
 		return nil, errors.Wrap(err, "failed to create services svc")
 	}
-	metricsOptions := []option.ClientOption{option.WithCredentials(ssn.Credentials)}
+	metricsOptions := []option.ClientOption{gcpconfig.CredentialOption(ssn)}
 	metricsSvc, err := monitoring.NewMetricClient(ctx, metricsOptions...)
 	if err != nil {
 		return nil, errors.Wrap(err, "failed to create metrics svc")