func withOAuth2Client(context.Context) (context.Context, error) {
	// TODO(mtaufen): Someday, might want to change this so that we can test
	// TokenProjection with an API audience set to the external provider with
	// requests against external endpoints (in which case we'd send
	// a different token with a non-Kubernetes audience).

	// By default, use the default http transport with the system root bundle,
	// since it's validating against the external internet.
	rt := http.DefaultTransport
	if inClusterDiscovery {
		// If in-cluster discovery, then use the in-cluster config so we can
		// authenticate with the API server.
		cfg, err := rest.InClusterConfig()
		if err != nil {
			return nil, err
		}
		rt, err = rest.TransportFor(cfg)
		if err != nil {
			return nil, fmt.Errorf("could not get roundtripper: %v", err)
		}
	}

	ctx := context.WithValue(context.Background(),
		oauth2.HTTPClient, &http.Client{
			Transport: rt,
		})
	return ctx, nil
}
// withOAuth2Client returns a context that includes an HTTP Client, under the
// oauth2.HTTPClient key. If  --in-cluster-discovery is true, the client will
// use the Kubernetes InClusterConfig. Otherwise it will use
// http.DefaultTransport.
// The `oidc` library respects the oauth2.HTTPClient context key; if it is set,
// the library will use the provided http.Client rather than the default
// HTTP client.
// This allows us to ensure requests get routed to the API server for
// --in-cluster-discovery, in a client configured with the appropriate CA.
withOAuth2Client returns a context that includes an HTTP Client, under the
oauth2.HTTPClient key. If  --in-cluster-discovery is true, the client will
use the Kubernetes InClusterConfig. Otherwise it will use
http.DefaultTransport.
The `oidc` library respects the oauth2.HTTPClient context key; if it is set,
the library will use the provided http.Client rather than the default
HTTP client.
This allows us to ensure requests get routed to the API server for
in-cluster-discovery, in a client configured with the appropriate CA.
// withOAuth2Client returns a context that includes an HTTP Client under the // oauth2 . HTTPClient key . If -- in - cluster - discovery is true the client will // use the Kubernetes InClusterConfig . Otherwise it will use // http . DefaultTransport . // The ` oidc ` library respects the oauth2 . HTTPClient context key ; if it is set // the library will use the provided http . Client rather than the default // HTTP client . // This allows us to ensure requests get routed to the API server for // -- in - cluster - discovery in a client configured with the appropriate CA .
func withOAuth2Client(context.Context) (context.Context, error) {
	rt := http.DefaultTransport
	if inClusterDiscovery {
		cfg, err := rest.InClusterConfig()
		if err != nil {
			return nil, err
		}
		rt, err = rest.TransportFor(cfg)
		if err != nil {
			return nil, fmt.Errorf("could not get roundtripper: %v", err)
		}
	}
	ctx := context.WithValue(context.Background(),
		oauth2.HTTPClient, &http.Client{
			Transport: rt,
		})
	return ctx, nil
}
func withOAuth2Client ( context . Context ) ( context . Context , error ) { rt := http . DefaultTransport if inClusterDiscovery { cfg , err := rest . InClusterConfig ( ) if err != nil { return nil , err } rt , err = rest . TransportFor ( cfg ) if err != nil { return nil , fmt . Errorf ( " " , err ) } } ctx := context . WithValue ( context . Background ( ) , oauth2 . HTTPClient , & http . Client { Transport : rt , } ) return ctx , nil }
withOAuth2Client returns a context that includes an HTTP Client, under the
oauth2.HTTPClient key.
withOAuth2Client returns a context that includes an HTTP Client under the oauth2 . HTTPClient key .
// TODO(mtaufen): Someday, might want to change this so that we can test // TokenProjection with an API audience set to the external provider with // requests against external endpoints (in which case we'd send // a different token with a non-Kubernetes audience). // By default, use the default http transport with the system root bundle, // since it's validating against the external internet. // If in-cluster discovery, then use the in-cluster config so we can // authenticate with the API server.