title: API must be enabled for service account project
body: <p>We have an issue with a service account 'defaulting' to the project where it was created when enabling APIs before creating resources.</p>
  
  <p>The SA was created under project A but it has <code>Owner</code> rights for project B. </p>
  
  <p>We're trying to create a resource (GKE cluster) in <strong>project B</strong> but it's complaining we need to enable the Kubernetes API on <strong>project A</strong> first (we are passing <code>--project</code> to the cluster create command to avoid any ambiguity around where we're trying to create the cluster. this is also the case for the get-credentials command).</p>
  
  <pre><code>ERROR: (gcloud.container.clusters.create) ResponseError: code=403, message=Kubernetes Engine API has not been used in project PROJECT_NUMBER before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/container.googleapis.com/overview?project=PROJECT_NUMBER then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.
  </code></pre>
  
  <p><code>PROJECT_NUMBER</code> here is the number of project A, not B. The required API is already enabled on project B.</p>
  
  <p>Is there something flawed in our approach to the use of service accounts here?</p>