public CredentialRetriever googleApplicationDefaultCredentials() {
    return () -> {
      try {
        if (imageReference.getRegistry().endsWith("gcr.io")
            || imageReference.getRegistry().endsWith("docker.pkg.dev")) {
          GoogleCredentials googleCredentials = googleCredentialsProvider.get();
          logger.accept(LogEvent.info("Google ADC found"));
          if (googleCredentials.createScopedRequired()) { // not scoped if service account
            // The short-lived OAuth2 access token to be generated from the service account with
            // refreshIfExpired() below will have one-hour expiry (as of Aug 2019). Instead of using
            // an access token, it is technically possible to use the service account private key to
            // auth with GCR, but it does not worth writing complex code to achieve that.
            logger.accept(LogEvent.info("ADC is a service account. Setting GCS read-write scope"));
            List<String> scope = Collections.singletonList(OAUTH_SCOPE_STORAGE_READ_WRITE);
            googleCredentials = googleCredentials.createScoped(scope);
          }
          googleCredentials.refreshIfExpired();

          logGotCredentialsFrom("Google Application Default Credentials");
          AccessToken accessToken = googleCredentials.getAccessToken();
          // https://cloud.google.com/container-registry/docs/advanced-authentication#access_token
          return Optional.of(Credential.from("oauth2accesstoken", accessToken.getTokenValue()));
        }

      } catch (IOException ex) { // Includes the case where ADC is simply not available.
        logger.accept(
            LogEvent.info("ADC not present or error fetching access token: " + ex.getMessage()));
      }
      return Optional.empty();
    };
  }
@Test
  public void testGoogleApplicationDefaultCredentials_adcNotPresent()
      throws CredentialRetrievalException {
    CredentialRetrieverFactory credentialRetrieverFactory =
        new CredentialRetrieverFactory(
            ImageReference.of("awesome.gcr.io", "repository", null),
            mockLogger,
            mockDockerCredentialHelperFactory,
            () -> {
              throw new IOException("ADC not present");
            },
            Collections.emptyMap());

    Assert.assertFalse(
        credentialRetrieverFactory.googleApplicationDefaultCredentials().retrieve().isPresent());

    Mockito.verify(mockLogger)
        .accept(LogEvent.info("ADC not present or error fetching access token: ADC not present"));
  }