// When fails to get expiration time from token, always refresh the token.
	if err != nil || exp.IsZero() {
		return true
	}
	rotate := now.After(exp.Add(-gracePeriod))
	gcecredLog.Debugf("credential expiration: %s, grace period: %s, should rotate: %t",
		exp.String(), gracePeriod.String(), rotate)
	return rotate
}

// GetPlatformCredential fetches the GCE VM identity jwt token from its metadata server,

// 1. if all containers finished, use the latest time
// 2. if the pod has Ready=False condition, use the last transition time
// 3. if the pod has been deleted, use the `deletionTimestamp - grace_period` to estimate the moment of deletion
// 4. fallback to pod's creation time
//
// Pods owned by Kubelet are marked with Ready=False condition when
// transitioning to terminal phase, thus being handled by (1.) or (2.).