attrRequestPrincipal = "request.auth.principal" // authenticated principal of the request.
	attrRequestAudiences = "request.auth.audiences" // intended audience(s) for this authentication information.
	attrRequestPresenter = "request.auth.presenter" // authorized presenter of the credential.

func newCachedAuthToken() func(audience string) string {
	fn := func(accessKey, secretKey, audience string) (s string, err error) {
		k := cacheKey{accessKey: accessKey, secretKey: secretKey, audience: audience}

		var ok bool
		s, ok = cacheLRU.Get(k)
		if !ok {
			s, err = authenticateNode(accessKey, secretKey, audience)
			if err != nil {
				return "", err
			}
			cacheLRU.Add(k, s)

	tokenMutex sync.RWMutex
}

// CreateGCEPlugin creates a Google credential fetcher plugin. Return the pointer to the created plugin.
func CreateGCEPlugin(audience, jwtPath, identityProvider string) *GCEPlugin {
	p := &GCEPlugin{
		aud:              audience,
		jwtPath:          jwtPath,
		identityProvider: identityProvider,
		closing:          make(chan bool),
	}
	if rotateToken {
		go p.startTokenRotationJob()
	}

apiVersion: release-notes/v2
kind: feature
area: security
issue:
  - 49913
releaseNotes:
- |

  uid: uidValue
spec:
  attachRequired: true
  fsGroupPolicy: fsGroupPolicyValue
  podInfoOnMount: true
  requiresRepublish: true
  seLinuxMount: true
  storageCapacity: true
  tokenRequests:
  - audience: audienceValue
    expirationSeconds: 2
  volumeLifecycleModes:

    "podInfoOnMount": true,
    "volumeLifecycleModes": [
      "volumeLifecycleModesValue"
    ],
    "storageCapacity": true,
    "fsGroupPolicy": "fsGroupPolicyValue",
    "tokenRequests": [
      {
        "audience": "audienceValue",
        "expirationSeconds": 2
      }
    ],
    "requiresRepublish": true,
    "seLinuxMount": true
  }

    "podInfoOnMount": true,
    "volumeLifecycleModes": [
      "volumeLifecycleModesValue"
    ],
    "storageCapacity": true,
    "fsGroupPolicy": "fsGroupPolicyValue",
    "tokenRequests": [
      {
        "audience": "audienceValue",
        "expirationSeconds": 2
      }
    ],
    "requiresRepublish": true,
    "seLinuxMount": true
  }

  uid: uidValue
spec:
  attachRequired: true
  fsGroupPolicy: fsGroupPolicyValue
  podInfoOnMount: true
  requiresRepublish: true
  seLinuxMount: true
  storageCapacity: true
  tokenRequests:
  - audience: audienceValue
    expirationSeconds: 2
  volumeLifecycleModes:

  uid: uidValue
spec:
  attachRequired: true
  fsGroupPolicy: fsGroupPolicyValue
  podInfoOnMount: true
  requiresRepublish: true
  seLinuxMount: true
  storageCapacity: true
  tokenRequests:
  - audience: audienceValue
    expirationSeconds: 2
  volumeLifecycleModes:

  uid: uidValue
spec:
  attachRequired: true
  fsGroupPolicy: fsGroupPolicyValue
  podInfoOnMount: true
  requiresRepublish: true
  seLinuxMount: true
  storageCapacity: true
  tokenRequests:
  - audience: audienceValue
    expirationSeconds: 2
  volumeLifecycleModes: