Do not reveal WAL-G keys in the dblab container log

We print WAL-G keys (configured in the DLE config file, retrieval.spec.physicalRestore.options.envs) in the DLE container log twice:

  1. If DEBUG is enabled, the config contents is printed fully as it loaded ([DEBUG] Config loaded ...).
  2. When the retrieval process is starting, we print once again the values of WAL-G configuration ([INFO] Run job: physicalRestore. Options: {walg ...).

Security-wise, this is OK in the case of GCS (because the keys are stored in sa.json which contents is not revealed), but for other cases such as AWS S3,. or MinIO, it is definitely not secure and inconvenient.

Moving envs to a separate file or to environment variables would solve the former (which is easy to disable anyways, switching the DEBUG mode off), but not the latter.

One of ways to solve it would be:

  • print retrieval.spec.physicalRestore.options.envs only in the case if DEBUG is enabled, or do not print them at all, never
  • if we continue printing them in DEBUG mode, warn the DLE administrator about it (documentation, the very first line in logs, etc)

Thanks @ssi444 for reporting this.

cc @akartasov