fixup! update timeout for tests to avoid ctx deadline errors

- update validation for service account validation call to use `select` instead of `sleep`
- add `validateServiceAccountKeyTimeout` to config. This makes it easier to control the timeout from tests so tests do not have to run for long with the default timeout

internal/credential/attributes_test.go

@@ -121,6 +121,7 @@ func TestGetCredentialsConfig(t *testing.T) {
 			expected: &Config{
 				Zone:                             "us-central-1a",
 				Scopes:                           []string{defaultGCPScope},
+				validateServiceAccountKeyTimeout: defaultValidateServiceAccountKeyTimeout,
 			},
 		},
 		{
@@ -128,6 +129,7 @@ func TestGetCredentialsConfig(t *testing.T) {
 			attrs: nil,
 			expected: &Config{
 				Scopes:                           []string{defaultGCPScope},
+				validateServiceAccountKeyTimeout: defaultValidateServiceAccountKeyTimeout,
 			},
 		},
 		{
@@ -160,6 +162,7 @@ func TestGetCredentialsConfig(t *testing.T) {
 				PrivateKey:                       "test-private-key",
 				PrivateKeyId:                     "test-private-key-id",
 				Scopes:                           []string{defaultGCPScope},
+				validateServiceAccountKeyTimeout: defaultValidateServiceAccountKeyTimeout,
 			},
 		},
 		{
@@ -226,6 +229,7 @@ func TestGetCredentialsConfig(t *testing.T) {
 				PrivateKeyId:                     "test-private-key-id",
 				ClientEmail:                      "test@test.com",
 				Scopes:                           []string{defaultGCPScope},
+				validateServiceAccountKeyTimeout: defaultValidateServiceAccountKeyTimeout,
 			},
 		},
 		{
@@ -248,6 +252,7 @@ func TestGetCredentialsConfig(t *testing.T) {
 				ClientEmail:                      "test@test.com",
 				TargetServiceAccountId:           "test-target-service-account",
 				Scopes:                           []string{defaultGCPScope},
+				validateServiceAccountKeyTimeout: defaultValidateServiceAccountKeyTimeout,
 			},
 		},
 	}

internal/credential/config.go

@@ -41,6 +41,9 @@ const (
 	// and then controlling the service account's access by granting it IAM roles.
 	// https://cloud.google.com/compute/docs/access/service-accounts#scopes_best_practice
 	defaultGCPScope = "https://www.googleapis.com/auth/cloud-platform"
+	// defaultValidateServiceAccountKeyTimeout is the timeout for validating
+	// a service account key.
+	defaultValidateServiceAccountKeyTimeout = 5 * time.Second
 )
 
 // Config is the configuration for the GCP credential.
@@ -52,6 +55,7 @@ type Config struct {
 	ClientEmail                      string
 	TargetServiceAccountId           string
 	Scopes                           []string
+	validateServiceAccountKeyTimeout time.Duration
 }
 
 // credentials represents a simplified version of the GCP credentials file format.
@@ -79,6 +83,7 @@ func NewConfig(opt ...Option) (*Config, error) {
 		TargetServiceAccountId:           opts.WithTargetServiceAccountId,
 		Zone:                             opts.WithZone,
 		Scopes:                           opts.WithScopes,
+		validateServiceAccountKeyTimeout: defaultValidateServiceAccountKeyTimeout,
 	}
 	return c, nil
 }
@@ -104,6 +109,7 @@ func (c *Config) clone() *Config {
 		ClientEmail:                      c.ClientEmail,
 		TargetServiceAccountId:           c.TargetServiceAccountId,
 		Scopes:                           c.Scopes,
+		validateServiceAccountKeyTimeout: c.validateServiceAccountKeyTimeout,
 	}
 }
 

internal/credential/config_test.go

@@ -410,6 +410,7 @@ func TestNewConfig(t *testing.T) {
 				TargetServiceAccountId:           "target-service-account@example.com",
 				Zone:                             "test-zone",
 				Scopes:                           []string{"scope1", "scope2"},
+				validateServiceAccountKeyTimeout: defaultValidateServiceAccountKeyTimeout,
 			},
 			expectError: false,
 		},
@@ -418,6 +419,7 @@ func TestNewConfig(t *testing.T) {
 			options: []Option{},
 			expected: &Config{
 				Scopes:                           []string{defaultGCPScope},
+				validateServiceAccountKeyTimeout: defaultValidateServiceAccountKeyTimeout,
 			},
 			expectError: false,
 		},
@@ -449,6 +451,7 @@ func TestNewConfig(t *testing.T) {
 				TargetServiceAccountId:           "target-service-account@example.com",
 				Zone:                             "test-zone",
 				Scopes:                           []string{defaultGCPScope},
+				validateServiceAccountKeyTimeout: defaultValidateServiceAccountKeyTimeout,
 			},
 			expectError: false,
 		},

internal/credential/rotate.go

@@ -32,9 +32,6 @@ const (
 	// required to delete a service account key.
 	// This permission is required to rotate service account keys.
 	IAMServiceAccountKeysDeletePermission = "iam.serviceAccountKeys.delete"
-	// validateServiceAccountKeyTimeout is the timeout for validating
-	// a service account key.
-	validateServiceAccountKeyTimeout = 5 * time.Second
 )
 
 // ServiceAccountPrivateKey represents a decoded PrivateKeyData
@@ -161,7 +158,20 @@ func (c *Config) ValidateServiceAccountKey(
 	var validatePermissionsErr error
 	var validationCallbackErr error
 
-	for start := time.Now(); time.Since(start) < validateServiceAccountKeyTimeout; time.Sleep(200 * time.Millisecond) {
+	ticker := time.NewTicker(200 * time.Millisecond)
+	defer ticker.Stop()
+
+	ctx, cancel := context.WithTimeout(ctx, c.validateServiceAccountKeyTimeout)
+	defer cancel()
+
+	for {
+		select {
+		case <-ctx.Done():
+			if ctx.Err() == context.DeadlineExceeded {
+				return fmt.Errorf("failed to validate service account key before timeout: %w", errors.Join(validatePermissionsErr, validationCallbackErr))
+			}
+			return ctx.Err()
+		case <-ticker.C:
 			_, validatePermissionsErr = c.ValidateIamPermissions(ctx, permissions, opts...)
 
 			if validateCredsCallback != nil {
@@ -172,8 +182,7 @@ func (c *Config) ValidateServiceAccountKey(
 				return nil
 			}
 		}
-
-	return errors.Join(validatePermissionsErr, validationCallbackErr)
+	}
 }
 
 func (c *Config) DeletePrivateKey(ctx context.Context, opts ...option.ClientOption) error {

internal/credential/rotate_test.go

@@ -7,6 +7,7 @@ import (
 	"context"
 	"errors"
 	"testing"
+	"time"
 
 	"cloud.google.com/go/iam/admin/apiv1/adminpb"
 	"cloud.google.com/go/iam/apiv1/iampb"
@@ -30,6 +31,7 @@ func TestRotateServiceAccountKey(t *testing.T) {
 			},
 		},
 	}
+	testValidateTimeout := 1 * time.Second
 
 	tests := []struct {
 		name          string
@@ -79,6 +81,7 @@ func TestRotateServiceAccountKey(t *testing.T) {
 				PrivateKey:                       "some-private-key",
 				PrivateKeyId:                     "some-private-key-id",
 				ClientEmail:                      "client@example.com",
+				validateServiceAccountKeyTimeout: testValidateTimeout,
 			},
 			setup: func() {
 				testIAMAdminServer.testCreateServiceAccountKeyError = nil
@@ -92,6 +95,7 @@ func TestRotateServiceAccountKey(t *testing.T) {
 				PrivateKey:                       "some-private-key",
 				PrivateKeyId:                     "some-private-key-id",
 				ClientEmail:                      "client@example.com",
+				validateServiceAccountKeyTimeout: testValidateTimeout,
 			},
 			setup: func() {
 				testIAMAdminServer.testCreateServiceAccountKeyError = nil
@@ -261,6 +265,104 @@ func TestValidateIamPermissions(t *testing.T) {
 		})
 	}
 }
+
+func TestValidateServiceAccountKey(t *testing.T) {
+	ctx := context.Background()
+	testResourceServer := &testResourceServer{}
+	testValidateTimeout := 1 * time.Second
+
+	tests := []struct {
+		name                    string
+		config                  *Config
+		permissions             []string
+		validateCredsCallback   ValidateCredsCallback
+		testIamPermissionsError error
+		expectedError           error
+	}{
+		{
+			name: "Successful validation",
+			config: &Config{
+				ProjectId:                        "test-project-id",
+				PrivateKey:                       "test-private-key",
+				ClientEmail:                      "test@test.com",
+				validateServiceAccountKeyTimeout: testValidateTimeout,
+			},
+			permissions: []string{
+				ComputeInstancesListPermission,
+				IAMServiceAccountKeysCreatePermission,
+				IAMServiceAccountKeysDeletePermission,
+			},
+			validateCredsCallback: func(c *Config, opts ...googleOption.ClientOption) error {
+				return nil
+			},
+			expectedError: nil,
+		},
+		{
+			name: "Validation callback returns error",
+			config: &Config{
+				ProjectId:                        "test-project-id",
+				PrivateKey:                       "test-private-key",
+				ClientEmail:                      "test@test.com",
+				validateServiceAccountKeyTimeout: testValidateTimeout,
+			},
+			permissions: []string{
+				ComputeInstancesListPermission,
+				IAMServiceAccountKeysCreatePermission,
+				IAMServiceAccountKeysDeletePermission,
+			},
+			validateCredsCallback: func(c *Config, opts ...googleOption.ClientOption) error {
+				return errors.New("validation callback error")
+			},
+			expectedError: errors.New("validation callback error"),
+		},
+		{
+			name: "IAM permissions validation returns error",
+			config: &Config{
+				ProjectId:                        "test-project-id",
+				PrivateKey:                       "test-private-key",
+				ClientEmail:                      "test@test.com",
+				validateServiceAccountKeyTimeout: testValidateTimeout,
+			},
+			permissions: []string{
+				ComputeInstancesListPermission,
+				IAMServiceAccountKeysCreatePermission,
+				IAMServiceAccountKeysDeletePermission,
+			},
+			testIamPermissionsError: errors.New("IAM permissions error"),
+			expectedError:           errors.New("failed to validate IAM permissions"),
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			testResourceServer.testIamPermissionsResponse = &iampb.TestIamPermissionsResponse{
+				Permissions: tt.permissions,
+			}
+			testResourceServer.testIamPermissionsError = tt.testIamPermissionsError
+
+			gsrv := NewGRPCServer()
+			resourcemanagerpb.RegisterProjectsServer(gsrv.Server, testResourceServer)
+			addr, err := gsrv.Start()
+			require.NoError(t, err)
+
+			testOptions := []googleOption.ClientOption{
+				googleOption.WithEndpoint(addr),
+				googleOption.WithoutAuthentication(),
+				googleOption.WithGRPCDialOption(grpc.WithTransportCredentials(insecure.NewCredentials())),
+				googleOption.WithTokenSource(nil),
+			}
+
+			err = tt.config.ValidateServiceAccountKey(ctx, tt.permissions, tt.validateCredsCallback, testOptions...)
+			if tt.expectedError != nil {
+				require.ErrorContains(t, err, tt.expectedError.Error())
+				return
+			}
+
+			require.NoError(t, err)
+		})
+	}
+}
+
 func TestDeletePrivateKey(t *testing.T) {
 	testIAMAdminServer := &testIAMAdminServer{}