LGTM

@cjcullen you know about metadata server availability issues. This is added a timeout when talking to metadata server. Thoughts?

I think this is fine. All of the GCE metadata server flakiness I've seen manifests as a connection refused error.

In what case do we use the GCP credentialprovider in a non GCP environment? Or is this just preventing a possible error case from hanging indefinitely and leaking goroutines/fds?

@cjcullen at least in the image pulling keyring code we have, it tries to use the GCP credentialprovider even if you're not on GCP

Hmmm. I'm hoping that's either in parallel or a faster fail than this 10s timeout?

Either way, I think adding a timeout is probably a good thing.

In the environments where we've seen this happen, it seems to hang for a long time

#28871 improves the situation, but does not absolve it completely. Either way, from a code hygiene standpoint we should never allow the use of http.DefaultClient in the project. I would like to still see this merged if there are no objections.

To elaborate, the credential provider is still used to make other remote calls that are not being protected with any timeout, or use the default transport requirements consistent with rest of project.

GCE e2e build/test passed for commit 5366bfe.

• Test Results
• Build Log
• Test Artifacts
• Internal Jenkins Results

@k8s-bot test this [submit-queue is verifying that this PR is safe to merge]

GCE e2e build/test passed for commit 5366bfe.

• Test Results
• Build Log
• Test Artifacts
• Internal Jenkins Results

Automatic merge from submit-queue