auth/credentials: add sentinel error for DetectDefault when no credentials are detected

[karlkfi]

Motivation

In Config Sync, we have some code in one of our controllers that does different things depending on whether or not the K8s Deployment has configured authentication or not. For example, on AWS we still export Prometheus metrics, but disable Cloud Monitoring metrics.

To do this, we call credentials.DetectDefault and check for an error message that starts with credentials: could not find default credentials. This implies that credentials were not configured at all, so it can still surface other errors as configuration errors. https://github.com/googleapis/google-cloud-go/blob/auth/v0.12.1/auth/credentials/detect.go#L108

This case would be easier to detect and less fragile with a sentinel error.

Proposed solution

The credentials.DetectDefault function could return a new sentinel error, named something like CredentialsNotFoundError when all detection methods are skipped. This would allow Config Sync to check for the sentinel error by type with errors.Is, instead of by error string prefix.

Alternatives considered

To ensure that the code doesn't start failing in the future due to an error message text change, we tried to add tests to verify the credentials.DetectDefault error message, but found that while that's possible locally, there's no way to make credentials.DetectDefault produce the credentials: could not find default credentials. error when running in Prow on GKE/GCE, because metadata.OnGCE() will return true, and the allowOnGCECheck test variable is package local. This alternate feature has been requested before: #4920.

If we could force-disable the OnGCE check, by setting an env var, like GCE_METADATA_HOST="", that would also work for us, and help other use cases, like integration testing, but adding a sentinel error sounds easier and less risky.

Another potentially less risky option would be to add an option to DetectOptions to disable the OnGCE check. That way it wouldn't need to use an env var. Then we could set that in our tests and continue using the error string match.