-
Notifications
You must be signed in to change notification settings - Fork 796
Open
Labels
priority: p2Moderately-important priority. Fix may not be included in next release.Moderately-important priority. Fix may not be included in next release.status:awaiting user responsetype: bugError or flaw in code with unintended results or allowing sub-optimal usage patterns.Error or flaw in code with unintended results or allowing sub-optimal usage patterns.
Description
Environment
- Python: 3.13
google-genaiversion: latest (viallama-index-llms-google-genai)- Platform: GKE with Workload Identity
- OS: Linux (container)
Description
When creating a google.genai.Client with vertexai=True and an explicit project, the client.models.get() call checks Vertex AI API enablement against the credentials' GCP project (from Workload Identity / ADC), not the project passed in the config.
This does not happen with the Go SDK (google.golang.org/genai) using the same cross-project setup.
Steps to reproduce
import google.genai
client = google.genai.Client(
vertexai=True,
project="project-a", # Vertex AI API enabled here
location="us-central1",
api_key=None,
)
# Credentials come from Workload Identity in "project-b"
# (Vertex AI API NOT enabled in project-b)
client.models.get(model="gemini-2.5-flash-lite")Expected behavior
The models.get() call should use project-a (the explicitly configured project) for the API request, where Vertex AI API is enabled.
Actual behavior
The SDK sends the request against project-b (the credentials' project), resulting in:
google.genai.errors.ClientError: 403 PERMISSION_DENIED.
Vertex AI API has not been used in project <project-b-number> before or it is disabled.
Stack trace
File "google/genai/models.py", line 4633, in get
response = self._api_client.request('get', path, request_dict, http_options)
File "google/genai/_api_client.py", line 1375, in request
response = self._request(http_request, http_options, stream=False)
...
google.genai.errors.ClientError: 403 PERMISSION_DENIED.
{'error': {'code': 403, 'message': 'Vertex AI API has not been used in project <project-b-number>...'}}
Additional context
- The Go SDK (
google.golang.org/genai) works correctly with the identical cross-project setup (same service account, same Workload Identity binding, same target project). - The credentials' service account has the necessary IAM roles in the target project.
- Setting
GOOGLE_GENAI_USE_VERTEXAI=truedoes not help sincevertexai_configalready setsvertexai=Trueinternally.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
priority: p2Moderately-important priority. Fix may not be included in next release.Moderately-important priority. Fix may not be included in next release.status:awaiting user responsetype: bugError or flaw in code with unintended results or allowing sub-optimal usage patterns.Error or flaw in code with unintended results or allowing sub-optimal usage patterns.