fix(sa-key-rotator): prevent private key log leakage and add active key guard - #190
Merged
Conversation
…ey guard - Separate stdout and stderr during key generation using a temp file to prevent leaking private key material to logs on parse error or corrupting JSON payload - Add explicit validation for non-empty active_key_id before IAM key pruning to prevent accidental deletion of all keys
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request improves error handling and safety in the service account key rotation script. Specifically, it refactors key generation to capture stderr in a temporary file for better error reporting on failure, and adds a safety check in the key pruning function to prevent accidental deletion of all keys if the active key ID is empty. There are no review comments to address.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Follow-up fixes to #189 address code review feedback on
rotate_sa_keys.sh:generate_sa_key_in_memory:gcloudstderr to an isolated temporary file (err_out=$(mktemp)).prune_older_iam_keys:active_key_idis non-empty before initiating IAM key deletion, preventing accidental deletion of all keys ifactive_key_idis unresolved.Verification
gcs-fuse-testandgcs-fuse-test-ml../deploy.sh.