)

func NewCredFetcher(credtype, trustdomain, jwtPath, identityProvider string) (security.CredFetcher, error) {
	switch credtype {
	case security.GCE:
		return plugin.CreateGCEPlugin(trustdomain, jwtPath, identityProvider), nil
	case security.JWT, "":
		// If unset, also default to JWT for backwards compatibility
		if jwtPath == "" {
			return nil, nil // no cred fetcher - using certificates only
		}

	tokenCache     string
	// mutex lock is required to avoid race condition when updating token file and token cache.
	tokenMutex sync.RWMutex
}

// CreateGCEPlugin creates a Google credential fetcher plugin. Return the pointer to the created plugin.
func CreateGCEPlugin(audience, jwtPath, identityProvider string) *GCEPlugin {
	p := &GCEPlugin{
		aud:              audience,
		jwtPath:          jwtPath,

		rotationInterval = 5 * time.Minute
	})

	for id, tc := range testCases {
		// These tests should not run in parallel because they share one metadata server.
		t.Run(id, func(t *testing.T) {
			p := CreateGCEPlugin("", tc.jwtPath, "")
			if err := creatJWTFile(tc.jwtPath); err != nil {
				t.Fatalf("%s, creatJWTFile() returns err: %v", id, err)
			}
			ms.Reset()
			ms.setToken(tc.jwt)