govc sessions

[kextrac]

I need to understand a little more about how govc is using the .govmomi/sessions/.
If I pass GOVC_PASSWORD="incorrect-password" the .govmomi/sessions/ works without issue. Unsure of the lifetime of that session, and is somewhat problematic for my workflow (multiple users logging in as root to perform an action) as the prior session of a different user could be hijacked by simply supplying GOVC_USERNAME="otheruser" to perform operations as that user. I would think that I would have the option to issue discrete commands as a particular user, and that each govc command would require authentication. Perhaps there is such an option that I'm not aware of?

Logged in as root, on a host where my team runs govc command, I can perform functions as 'alice' if there is a valid session for 'alice' in ~/.govmomi/sessions/

export GOVC_USERNAME=alice
export GOVC_URL=https://vcenter1.example.com
govc datacenter.info -u https://vcenter1.example.com

The solution is to run govc session.logout at the end of my script I guess. I just wasn't aware of this sessions persistence nor do I know where to find documentation on this.

[dougm]

There is an option to turn off the session cache, -persist-session=false or via env export GOVC_PERSIST_SESSION=false
See: https://github.com/vmware/govmomi/blob/main/govc/USAGE.md#govc-usage

We should make this more clear in the docs and add more details.

[tenthirtyam]

Added in #3239.