in proxy/lib/proxy/proxy.go [296:304]
func (s *Service) lockedMaybePrefetchNextToken(ctx context.Context, now time.Time) {
// check if we don't need to fetch because the token doesn't expire for a while
if now.Add(gcpAccessTokenFetchAhead).Before(s.gcpAccessToken.expire) {
return
}
// prefetch a new token on a new go routine that will not have the lock.
go s.unlockFetchAccessTokenForSA(ctx)
}