{"foo.default.svc:80", false},
		{"https://foo.default.svc:80", false},
	}
	for _, tt := range tests {
		t.Run(tt.in, func(t *testing.T) {
			if got := isAllowedKubernetesAudience(tt.in); got != tt.want {
				t.Errorf("isAllowedKubernetesAudience() = %v, want %v", got, tt.want)
			}
		})
	}

		clusterID:              clusterID,
		remoteKubeClientGetter: remoteKubeClientGetter,
	}
}

func (a *KubeJWTAuthenticator) AuthenticatorType() string {
	return KubeJWTAuthenticatorType
}

func isAllowedKubernetesAudience(a string) bool {
	// We do not use url.Parse() as it *requires* the protocol.
	a = strings.TrimPrefix(a, "https://")
	a = strings.TrimPrefix(a, "http://")
	return strings.HasPrefix(a, "kubernetes.default.svc")
}