Merge pull request #66314 from jlowdermilk/cmdtokensource-reset

gcp client auth plugin: persist default cache on unauthorized Kubernetes-commit: c04fe8c27c9053a37face46abfebc45b9ac23dd7
2025-06-24 14:12:18 +00:00 · 2018-09-14 00:49:21 -07:00 · 2018-09-14 00:49:21 -07:00 · 86dcffcdde
commit 86dcffcdde
parent 37c3c02ec9 b345654764
3 changed files with 155 additions and 106 deletions
--- a/Godeps/Godeps.json
+++ b/Godeps/Godeps.json
@ -272,335 +272,335 @@
 		},
 		{
 			"ImportPath": "k8s.io/api/admissionregistration/v1alpha1",
-			"Rev": "89dfcd0b11286f217f32aa407276dc34f2c61fa9"
+			"Rev": "f456898a08e4bbc5891694118f3819f324de12ff"
 		},
 		{
 			"ImportPath": "k8s.io/api/admissionregistration/v1beta1",
-			"Rev": "89dfcd0b11286f217f32aa407276dc34f2c61fa9"
+			"Rev": "f456898a08e4bbc5891694118f3819f324de12ff"
 		},
 		{
 			"ImportPath": "k8s.io/api/apps/v1",
-			"Rev": "89dfcd0b11286f217f32aa407276dc34f2c61fa9"
+			"Rev": "f456898a08e4bbc5891694118f3819f324de12ff"
 		},
 		{
 			"ImportPath": "k8s.io/api/apps/v1beta1",
-			"Rev": "89dfcd0b11286f217f32aa407276dc34f2c61fa9"
+			"Rev": "f456898a08e4bbc5891694118f3819f324de12ff"
 		},
 		{
 			"ImportPath": "k8s.io/api/apps/v1beta2",
-			"Rev": "89dfcd0b11286f217f32aa407276dc34f2c61fa9"
+			"Rev": "f456898a08e4bbc5891694118f3819f324de12ff"
 		},
 		{
 			"ImportPath": "k8s.io/api/authentication/v1",
-			"Rev": "89dfcd0b11286f217f32aa407276dc34f2c61fa9"
+			"Rev": "f456898a08e4bbc5891694118f3819f324de12ff"
 		},
 		{
 			"ImportPath": "k8s.io/api/authentication/v1beta1",
-			"Rev": "89dfcd0b11286f217f32aa407276dc34f2c61fa9"
+			"Rev": "f456898a08e4bbc5891694118f3819f324de12ff"
 		},
 		{
 			"ImportPath": "k8s.io/api/authorization/v1",
-			"Rev": "89dfcd0b11286f217f32aa407276dc34f2c61fa9"
+			"Rev": "f456898a08e4bbc5891694118f3819f324de12ff"
 		},
 		{
 			"ImportPath": "k8s.io/api/authorization/v1beta1",
-			"Rev": "89dfcd0b11286f217f32aa407276dc34f2c61fa9"
+			"Rev": "f456898a08e4bbc5891694118f3819f324de12ff"
 		},
 		{
 			"ImportPath": "k8s.io/api/autoscaling/v1",
-			"Rev": "89dfcd0b11286f217f32aa407276dc34f2c61fa9"
+			"Rev": "f456898a08e4bbc5891694118f3819f324de12ff"
 		},
 		{
 			"ImportPath": "k8s.io/api/autoscaling/v2beta1",
-			"Rev": "89dfcd0b11286f217f32aa407276dc34f2c61fa9"
+			"Rev": "f456898a08e4bbc5891694118f3819f324de12ff"
 		},
 		{
 			"ImportPath": "k8s.io/api/autoscaling/v2beta2",
-			"Rev": "89dfcd0b11286f217f32aa407276dc34f2c61fa9"
+			"Rev": "f456898a08e4bbc5891694118f3819f324de12ff"
 		},
 		{
 			"ImportPath": "k8s.io/api/batch/v1",
-			"Rev": "89dfcd0b11286f217f32aa407276dc34f2c61fa9"
+			"Rev": "f456898a08e4bbc5891694118f3819f324de12ff"
 		},
 		{
 			"ImportPath": "k8s.io/api/batch/v1beta1",
-			"Rev": "89dfcd0b11286f217f32aa407276dc34f2c61fa9"
+			"Rev": "f456898a08e4bbc5891694118f3819f324de12ff"
 		},
 		{
 			"ImportPath": "k8s.io/api/batch/v2alpha1",
-			"Rev": "89dfcd0b11286f217f32aa407276dc34f2c61fa9"
+			"Rev": "f456898a08e4bbc5891694118f3819f324de12ff"
 		},
 		{
 			"ImportPath": "k8s.io/api/certificates/v1beta1",
-			"Rev": "89dfcd0b11286f217f32aa407276dc34f2c61fa9"
+			"Rev": "f456898a08e4bbc5891694118f3819f324de12ff"
 		},
 		{
 			"ImportPath": "k8s.io/api/coordination/v1beta1",
-			"Rev": "89dfcd0b11286f217f32aa407276dc34f2c61fa9"
+			"Rev": "f456898a08e4bbc5891694118f3819f324de12ff"
 		},
 		{
 			"ImportPath": "k8s.io/api/core/v1",
-			"Rev": "89dfcd0b11286f217f32aa407276dc34f2c61fa9"
+			"Rev": "f456898a08e4bbc5891694118f3819f324de12ff"
 		},
 		{
 			"ImportPath": "k8s.io/api/events/v1beta1",
-			"Rev": "89dfcd0b11286f217f32aa407276dc34f2c61fa9"
+			"Rev": "f456898a08e4bbc5891694118f3819f324de12ff"
 		},
 		{
 			"ImportPath": "k8s.io/api/extensions/v1beta1",
-			"Rev": "89dfcd0b11286f217f32aa407276dc34f2c61fa9"
+			"Rev": "f456898a08e4bbc5891694118f3819f324de12ff"
 		},
 		{
 			"ImportPath": "k8s.io/api/imagepolicy/v1alpha1",
-			"Rev": "89dfcd0b11286f217f32aa407276dc34f2c61fa9"
+			"Rev": "f456898a08e4bbc5891694118f3819f324de12ff"
 		},
 		{
 			"ImportPath": "k8s.io/api/networking/v1",
-			"Rev": "89dfcd0b11286f217f32aa407276dc34f2c61fa9"
+			"Rev": "f456898a08e4bbc5891694118f3819f324de12ff"
 		},
 		{
 			"ImportPath": "k8s.io/api/policy/v1beta1",
-			"Rev": "89dfcd0b11286f217f32aa407276dc34f2c61fa9"
+			"Rev": "f456898a08e4bbc5891694118f3819f324de12ff"
 		},
 		{
 			"ImportPath": "k8s.io/api/rbac/v1",
-			"Rev": "89dfcd0b11286f217f32aa407276dc34f2c61fa9"
+			"Rev": "f456898a08e4bbc5891694118f3819f324de12ff"
 		},
 		{
 			"ImportPath": "k8s.io/api/rbac/v1alpha1",
-			"Rev": "89dfcd0b11286f217f32aa407276dc34f2c61fa9"
+			"Rev": "f456898a08e4bbc5891694118f3819f324de12ff"
 		},
 		{
 			"ImportPath": "k8s.io/api/rbac/v1beta1",
-			"Rev": "89dfcd0b11286f217f32aa407276dc34f2c61fa9"
+			"Rev": "f456898a08e4bbc5891694118f3819f324de12ff"
 		},
 		{
 			"ImportPath": "k8s.io/api/scheduling/v1alpha1",
-			"Rev": "89dfcd0b11286f217f32aa407276dc34f2c61fa9"
+			"Rev": "f456898a08e4bbc5891694118f3819f324de12ff"
 		},
 		{
 			"ImportPath": "k8s.io/api/scheduling/v1beta1",
-			"Rev": "89dfcd0b11286f217f32aa407276dc34f2c61fa9"
+			"Rev": "f456898a08e4bbc5891694118f3819f324de12ff"
 		},
 		{
 			"ImportPath": "k8s.io/api/settings/v1alpha1",
-			"Rev": "89dfcd0b11286f217f32aa407276dc34f2c61fa9"
+			"Rev": "f456898a08e4bbc5891694118f3819f324de12ff"
 		},
 		{
 			"ImportPath": "k8s.io/api/storage/v1",
-			"Rev": "89dfcd0b11286f217f32aa407276dc34f2c61fa9"
+			"Rev": "f456898a08e4bbc5891694118f3819f324de12ff"
 		},
 		{
 			"ImportPath": "k8s.io/api/storage/v1alpha1",
-			"Rev": "89dfcd0b11286f217f32aa407276dc34f2c61fa9"
+			"Rev": "f456898a08e4bbc5891694118f3819f324de12ff"
 		},
 		{
 			"ImportPath": "k8s.io/api/storage/v1beta1",
-			"Rev": "89dfcd0b11286f217f32aa407276dc34f2c61fa9"
+			"Rev": "f456898a08e4bbc5891694118f3819f324de12ff"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/api/apitesting",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/api/apitesting/fuzzer",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/api/apitesting/roundtrip",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/api/equality",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/api/errors",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/api/meta",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/api/resource",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/apis/meta/fuzzer",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/apis/meta/internalversion",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/apis/meta/v1",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/apis/meta/v1beta1",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/conversion",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/conversion/queryparams",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/fields",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/labels",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/runtime",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/runtime/schema",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/runtime/serializer",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/runtime/serializer/json",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/runtime/serializer/protobuf",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/runtime/serializer/recognizer",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/runtime/serializer/streaming",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/runtime/serializer/versioning",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/selection",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/types",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/cache",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/clock",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/diff",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/errors",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/framer",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/httpstream",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/httpstream/spdy",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/intstr",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/json",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/mergepatch",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/naming",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/net",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/remotecommand",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/runtime",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/sets",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/strategicpatch",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/validation",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/validation/field",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/wait",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/util/yaml",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/version",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/pkg/watch",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/third_party/forked/golang/json",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/third_party/forked/golang/netutil",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/apimachinery/third_party/forked/golang/reflect",
-			"Rev": "6429050ef506887d121f3e7306e894f8900d8a63"
+			"Rev": "99c5fa21f87204c2875a7f7ba977895d79b35c44"
 		},
 		{
 			"ImportPath": "k8s.io/kube-openapi/pkg/util/proto",
--- a/plugin/pkg/client/auth/gcp/gcp.go
+++ b/plugin/pkg/client/auth/gcp/gcp.go
@ -174,7 +174,13 @@ func parseScopes(gcpConfig map[string]string) []string {
 }

 func (g *gcpAuthProvider) WrapTransport(rt http.RoundTripper) http.RoundTripper {
-	return &conditionalTransport{&oauth2.Transport{Source: g.tokenSource, Base: rt}, g.persister}
+	var resetCache map[string]string
+	if cts, ok := g.tokenSource.(*cachedTokenSource); ok {
+		resetCache = cts.baseCache()
+	} else {
+		resetCache = make(map[string]string)
+	}
+	return &conditionalTransport{&oauth2.Transport{Source: g.tokenSource, Base: rt}, g.persister, resetCache}
 }

 func (g *gcpAuthProvider) Login() error { return nil }
@ -247,6 +253,19 @@ func (t *cachedTokenSource) update(tok *oauth2.Token) map[string]string {
 	return ret
 }

+// baseCache is the base configuration value for this TokenSource, without any cached ephemeral tokens.
+func (t *cachedTokenSource) baseCache() map[string]string {
+	t.lk.Lock()
+	defer t.lk.Unlock()
+	ret := map[string]string{}
+	for k, v := range t.cache {
+		ret[k] = v
+	}
+	delete(ret, "access-token")
+	delete(ret, "expiry")
+	return ret
+}
+
 type commandTokenSource struct {
 	cmd       string
 	args      []string
@ -337,6 +356,7 @@ func parseJSONPath(input interface{}, name, template string) (string, error) {
 type conditionalTransport struct {
 	oauthTransport *oauth2.Transport
 	persister      restclient.AuthProviderConfigPersister
+	resetCache     map[string]string
 }

 var _ net.RoundTripperWrapper = &conditionalTransport{}
@ -354,8 +374,7 @@ func (t *conditionalTransport) RoundTrip(req *http.Request) (*http.Response, err

 	if res.StatusCode == 401 {
 		glog.V(4).Infof("The credentials that were supplied are invalid for the target cluster")
-		emptyCache := make(map[string]string)
-		t.persister.Persist(emptyCache)
+		t.persister.Persist(t.resetCache)
 	}

 	return res, nil
--- a/plugin/pkg/client/auth/gcp/gcp_test.go
+++ b/plugin/pkg/client/auth/gcp/gcp_test.go
@ -442,37 +442,61 @@ func (t *MockTransport) RoundTrip(req *http.Request) (*http.Response, error) {
 	return t.res, nil
 }

-func TestClearingCredentials(t *testing.T) {
+func Test_cmdTokenSource_roundTrip(t *testing.T) {

+	accessToken := "fakeToken"
 	fakeExpiry := time.Now().Add(time.Hour)
-
-	cache := map[string]string{
-		"access-token": "fakeToken",
-		"expiry":       fakeExpiry.String(),
+	fakeExpiryStr := fakeExpiry.Format(time.RFC3339Nano)
+	fs := &fakeTokenSource{
+		token: &oauth2.Token{
+			AccessToken: accessToken,
+			Expiry:      fakeExpiry,
+		},
 	}

-	cts := cachedTokenSource{
-		source:      nil,
-		accessToken: cache["access-token"],
-		expiry:      fakeExpiry,
-		persister:   nil,
-		cache:       nil,
+	cmdCache := map[string]string{
+		"cmd-path": "/path/to/tokensource/cmd",
+		"cmd-args": "--output=json",
+	}
+	cmdCacheUpdated := map[string]string{
+		"cmd-path":     "/path/to/tokensource/cmd",
+		"cmd-args":     "--output=json",
+		"access-token": accessToken,
+		"expiry":       fakeExpiryStr,
+	}
+	simpleCacheUpdated := map[string]string{
+		"access-token": accessToken,
+		"expiry":       fakeExpiryStr,
 	}

 	tests := []struct {
 		name                     string
 		res                      http.Response
-		cache map[string]string
+		baseCache, expectedCache map[string]string
 	}{
 		{
 			"Unauthorized",
 			http.Response{StatusCode: 401},
 			make(map[string]string),
+			make(map[string]string),
+		},
+		{
+			"Unauthorized, nonempty defaultCache",
+			http.Response{StatusCode: 401},
+			cmdCache,
+			cmdCache,
 		},
 		{
 			"Authorized",
 			http.Response{StatusCode: 200},
-			cache,
+			make(map[string]string),
+			simpleCacheUpdated,
+		},
+		{
+			"Authorized, nonempty defaultCache",
+			http.Response{StatusCode: 200},
+			cmdCache,
+			cmdCacheUpdated,
 		},
 	}

@ -480,17 +504,23 @@ func TestClearingCredentials(t *testing.T) {
 	req := http.Request{Header: http.Header{}}

 	for _, tc := range tests {
-		authProvider := gcpAuthProvider{&cts, persister}
+		cts, err := newCachedTokenSource(accessToken, fakeExpiry.String(), persister, fs, tc.baseCache)
+		if err != nil {
+			t.Fatalf("unexpected error from newCachedTokenSource: %v", err)
+		}
+		authProvider := gcpAuthProvider{cts, persister}

 		fakeTransport := MockTransport{&tc.res}
-
 		transport := (authProvider.WrapTransport(&fakeTransport))
-		persister.Persist(cache)
+		// call Token to persist/update cache
+		if _, err := cts.Token(); err != nil {
+			t.Fatalf("unexpected error from cachedTokenSource.Token(): %v", err)
+		}

 		transport.RoundTrip(&req)

-		if got := persister.read(); !reflect.DeepEqual(got, tc.cache) {
-			t.Errorf("got cache %v, want %v", got, tc.cache)
+		if got := persister.read(); !reflect.DeepEqual(got, tc.expectedCache) {
+			t.Errorf("got cache %v, want %v", got, tc.expectedCache)
 		}
 	}