}{
		{
			// pod and secret
			sa:  sa,
			pod: pod,
			sec: sec,
			// really fast
			exp: 0,
			// nil audience
			aud: nil,
			err: "internal error, token can only be bound to one object type",
		},
		{
			// pod
			sa:  sa,
			pod: pod,
			// empty audience
			aud: []string{},
			exp: 100,

			sc: &jwt.Claims{
				Subject:   "system:serviceaccount:myns:mysvcacct",

			wantGeneration: 1,
		},
		{
			name:                  "service account token feature enabled, before: none, update: audience=gcp",
			old:                   driverWithNothing,
			update:                driverWithServiceAccountTokenGCP,
			wantTokenRequests:     []storage.TokenRequest{{Audience: gcp}},
			wantRequiresRepublish: &enabled,
			wantGeneration:        1,
		},
		{

	tokenMutex sync.RWMutex
}

// CreateGCEPlugin creates a Google credential fetcher plugin. Return the pointer to the created plugin.
func CreateGCEPlugin(audience, jwtPath, identityProvider string) *GCEPlugin {
	p := &GCEPlugin{
		aud:              audience,
		jwtPath:          jwtPath,
		identityProvider: identityProvider,
		closing:          make(chan bool),
	}
	if rotateToken {
		go p.startTokenRotationJob()
	}

apiVersion: release-notes/v2
kind: feature
area: security
issue:
  - 49913
releaseNotes:
- |

  uid: uidValue
spec:
  attachRequired: true
  fsGroupPolicy: fsGroupPolicyValue
  podInfoOnMount: true
  requiresRepublish: true
  seLinuxMount: true
  storageCapacity: true
  tokenRequests:
  - audience: audienceValue
    expirationSeconds: 2
  volumeLifecycleModes:

  uid: uidValue
spec:
  attachRequired: true
  fsGroupPolicy: fsGroupPolicyValue
  podInfoOnMount: true
  requiresRepublish: true
  seLinuxMount: true
  storageCapacity: true
  tokenRequests:
  - audience: audienceValue
    expirationSeconds: 2
  volumeLifecycleModes:

    "podInfoOnMount": true,
    "volumeLifecycleModes": [
      "volumeLifecycleModesValue"
    ],
    "storageCapacity": true,
    "fsGroupPolicy": "fsGroupPolicyValue",
    "tokenRequests": [
      {
        "audience": "audienceValue",
        "expirationSeconds": 2
      }
    ],
    "requiresRepublish": true,
    "seLinuxMount": true
  }

readme = "README.md"
requires-python = ">=3.8"
authors = [
    { name = "Sebastián Ramírez", email = "******@****.***" },
]
classifiers = [
    "Intended Audience :: Information Technology",
    "Intended Audience :: System Administrators",
    "Operating System :: OS Independent",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python",
    "Topic :: Internet",

    "podInfoOnMount": true,
    "volumeLifecycleModes": [
      "volumeLifecycleModesValue"
    ],
    "storageCapacity": true,
    "fsGroupPolicy": "fsGroupPolicyValue",
    "tokenRequests": [
      {
        "audience": "audienceValue",
        "expirationSeconds": 2
      }
    ],
    "requiresRepublish": true,
    "seLinuxMount": true
  }

        "properties": {
          "audiences": {
            "description": "Audiences are the intendend audiences of the token. A recipient of a token must identify themself with an identifier in the list of audiences of the token, and otherwise should reject the token. A token issued for multiple audiences may be used to authenticate against any of the audiences listed but implies a high degree of trust between the target audiences.",