stefanprodan / mgob

MongoDB dockerized backup agent. Runs schedule backups with retention, S3 & SFTP upload, notifications, instrumentation with Prometheus and more.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Generated GCP credentials not cleared after backup

jonnydgreen opened this issue · comments

Hi! I have been successfully using mgob for a while now with GCP storage. I have noticed that the generated GCP credentials from this line are not cleared after a backup and left in the running pod(s). These are located at: ~/.gcloud/credentials.db From a security perspective, I think it would be good to clear this after a backup has been run. I'm thinking of something like:

revoke := fmt.Sprintf("gcloud auth revoke")

_, err := sh.Command("/bin/sh", "-c", revoke).CombinedOutput()
if err != nil {
	return "", errors.Wrapf(err, "gcloud auth revoke for plan %v failed", plan.Name)
}

What do think? Do you agree? Happy to do the work and submit a PR for this :)