func WriteTokenSecret(ctx context.Context, core corev1.CoreV1Interface, oauthSecret *v1.Secret) error {
	secret := readSecret(oauthSecret)
	if secret == nil {
		return nil  
	}
	token, err := Token(ctx, secret.privateKey, secret.scopes...)
	if err != nil {
		return fmt.Errorf("error creating an OAuth access token for secret %s/%s: %v", oauthSecret.Namespace, oauthSecret.Name, err)
	}
	return writeSecret(core, token.AccessToken, secret.secretNamespace, secret.secretName)
}
WriteTokenSecret will, given a Kubernetes core object and a
*v1.Secret (oauthSecret) which contains the service account information,
write a new secret with the opaque token that can be used with the Kubernetes
service catalog.
oauthSecret should contain the fields:
- "key": which has the Google service account JWT information
- "secretName": which is the desired name of the secret we will create here
- "secretNamespace: the desired namespace of the secret this function creates
- "scopes": the scopes of the access token
package auth
import (
	"context"
	"encoding/json"
	"fmt"
	"github.com/golang/glog"
	"golang.org/x/oauth2"
	"golang.org/x/oauth2/google"
	"k8s.io/api/core/v1"
	apierrors "k8s.io/apimachinery/pkg/api/errors"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	corev1 "k8s.io/client-go/kubernetes/typed/core/v1"
)
const (
	keyKey             = "key"
	secretNameKey      = "secretName"
	secretNamespaceKey = "secretNamespace"
	scopesKey          = "scopes"
	tokenKey           = "token"
)
type GoogleOAuthSecret struct {
	privateKey []byte
	scopes []string
	secretName string
	secretNamespace string
}
func Token(ctx context.Context, privateKey []byte, scopes ...string) (*oauth2.Token, error) {
	jwt, err := google.JWTConfigFromJSON(privateKey, scopes...)
	if err != nil {
		return nil, fmt.Errorf("error creating JWT Config: %v", err)
	}
	token, err := jwt.TokenSource(ctx).Token()
	if err != nil {
		return nil, fmt.Errorf("error getting token: %v", err)
	}
	return token, nil
}