stefanprodan / mgob

MongoDB dockerized backup agent. Runs schedule backups with retention, S3 & SFTP upload, notifications, instrumentation with Prometheus and more.
MIT License
769 stars 152 forks source link

Generated GCP credentials not cleared after backup #144

Closed jonnydgreen closed 1 year ago

jonnydgreen commented 3 years ago

Hi! I have been successfully using mgob for a while now with GCP storage. I have noticed that the generated GCP credentials from this line are not cleared after a backup and left in the running pod(s). These are located at: ~/.gcloud/credentials.db From a security perspective, I think it would be good to clear this after a backup has been run. I'm thinking of something like:

revoke := fmt.Sprintf("gcloud auth revoke")

_, err := sh.Command("/bin/sh", "-c", revoke).CombinedOutput()
if err != nil {
    return "", errors.Wrapf(err, "gcloud auth revoke for plan %v failed", plan.Name)
}

What do think? Do you agree? Happy to do the work and submit a PR for this :)