identityProvider: "",
			expectedErr:      "invalid credential fetcher type foo",
			expectedToken:    "",
			expectedIdp:      "",
		},
	}

	// Disable token refresh for GCE VM credential fetcher.
	plugin.SetTokenRotation(false)
	for id, tc := range testCases {
		id, tc := id, tc
		t.Run(id, func(t *testing.T) {
			t.Parallel()
			cf, err := NewCredFetcher(
				tc.fetcherType, tc.trustdomain, tc.jwtPath, tc.identityProvider)

// rotateToken determines whether to start periodic token rotation job.
// This is enabled by default.
var rotateToken = true

// SetTokenRotation enable/disable periodic token rotation job.
// This is only for testing purpose, not thread safe.
func SetTokenRotation(enable bool) {
	rotateToken = enable
}

// GCEPlugin is the plugin object.
type GCEPlugin struct {

			jwtPath:      fmt.Sprintf("/tmp/security-pkg-credentialfetcher-plugin-gcetest-%s", uuid.New().String()),
		},
	}

	SetTokenRotation(false)
	ms, err := StartMetadataServer()
	if err != nil {
		t.Fatalf("StartMetadataServer() returns err: %v", err)
	}
	t.Cleanup(func() {
		ms.Stop()
		SetTokenRotation(true)
	})

	for id, tc := range testCases {
		p := GCEPlugin{
			tokenCache: tc.jwt,