New GCP provisioner: service account not enabled problem

[concretevitamin]

Before new GCP provisioner #2681

git checkout 394ec4ad8
sky launch -i0 --down --cpus 2 --cloud gcp  -y 'curl -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?format=standard&audience=gcp"'

This prints the identity correctly.

After the new GCP provisioner

git checkout 318553bb6 
sky launch -i0 --down --cpus 2 --cloud gcp  -y 'curl -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?format=standard&audience=gcp"'

This prints

{"error":"invalid_request","error_description":"Service account not enabled on this instance"}