Fix service account email format for sovereign cloud projects

GCD documentation shows service account emails use the format:
  name@project-id.PREFIX.iam.gserviceaccount.com

For sovereign cloud project IDs like 'eu0:my-project', the service account
email should be:
  cluster-m@my-project.eu0.iam.gserviceaccount.com

Updated GetDefaultServiceAccount to:
- Check if project ID has a known sovereign cloud prefix
- Swap format from 'prefix:project-id' to 'project-id.prefix'
- Apply only to known sovereign prefixes (maintains backward compatibility
  for organization-scoped projects)

Reference: https://berlin.devsitetest.how/iam/docs/service-accounts-create

Author: barbacbd

pkg/types/gcp/platform.go

@@ -6,6 +6,7 @@ import (
 	"strings"
 
 	"github.com/sirupsen/logrus"
+	"k8s.io/apimachinery/pkg/util/sets"
 
 	"github.com/openshift/installer/pkg/types/dns"
 )
@@ -206,16 +207,32 @@ func GetConfiguredServiceAccount(platform *Platform, mpool *MachinePool) string
 
 // GetDefaultServiceAccount returns the default service account email to use based on role.
 // The default should be used when an existing service account is not configured.
-// For sovereign cloud projects (e.g., eu0:project-id), extracts the project name after the colon.
+// For sovereign cloud project IDs (e.g., eu0:project-id), the service account email format is:
+//
+//	service-account-name@project-id.eu0.iam.gserviceaccount.com
+//
+// For standard project IDs, the format is:
+//
+//	service-account-name@project-id.iam.gserviceaccount.com
 func GetDefaultServiceAccount(platform *Platform, clusterID string, role string) string {
 	projectID := platform.ProjectID
-	// For sovereign cloud project IDs in format "prefix:project-id", use only the project-id part
+
+	// For sovereign cloud project IDs in format "prefix:project-id", swap to "project-id.prefix"
 	if strings.Contains(projectID, ":") {
 		parts := strings.SplitN(projectID, ":", 2)
 		if len(parts) == 2 {
-			projectID = parts[1]
+			prefix := parts[0]
+			if sets.New(sovereignCloudProjectPrefixes...).Has(prefix) {
+				// Sovereign cloud: swap to project-id.prefix format
+				projectID = fmt.Sprintf("%s.%s", parts[1], prefix)
+			} else {
+				// For non-sovereign colon-formatted projects (e.g., orgname:project-id),
+				// strip the prefix for backward compatibility
+				projectID = parts[1]
+			}
 		}
 	}
+
 	return fmt.Sprintf("%s-%s@%s.iam.gserviceaccount.com", clusterID, role[0:1], projectID)
 }
 
@@ -240,14 +257,9 @@ func GetCloudEnvironmentWithRegion(projectID, region string) string {
 	// Check if project ID has a known sovereign cloud prefix
 	if strings.Contains(projectID, ":") {
 		parts := strings.SplitN(projectID, ":", 2)
-		if len(parts) == 2 {
-			prefix := parts[0]
-			for _, knownPrefix := range sovereignCloudProjectPrefixes {
-				if prefix == knownPrefix {
-					// Known sovereign prefix is definitive - this IS a sovereign cloud project
-					return CloudEnvironmentSovereign
-				}
-			}
+		if len(parts) == 2 && sets.New(sovereignCloudProjectPrefixes...).Has(parts[0]) {
+			// Known sovereign prefix is definitive - this IS a sovereign cloud project
+			return CloudEnvironmentSovereign
 		}
 	}