Do not reveal WAL-G keys in the dblab container log
We print WAL-G keys (configured in the DLE config file, retrieval.spec.physicalRestore.options.envs) in the DLE container log twice:
- If DEBUG is enabled, the config contents is printed fully as it loaded (
[DEBUG] Config loaded ...). - When the retrieval process is starting, we print once again the values of WAL-G configuration (
[INFO] Run job: physicalRestore. Options: {walg ...).
Security-wise, this is OK in the case of GCS (because the keys are stored in sa.json which contents is not revealed), but for other cases such as AWS S3,. or MinIO, it is definitely not secure and inconvenient.
Moving envs to a separate file or to environment variables would solve the former (which is easy to disable anyways, switching the DEBUG mode off), but not the latter.
One of ways to solve it would be:
- print
retrieval.spec.physicalRestore.options.envsonly in the case if DEBUG is enabled, or do not print them at all, never - if we continue printing them in DEBUG mode, warn the DLE administrator about it (documentation, the very first line in logs, etc)
Thanks @ssi444 for reporting this.
cc @akartasov