fix: redact pkcs12 password in logs

[dervoeti]

Description

The CSI node_publish_volume handler logs the full SecretVolumeSelector in the issuing secret for Pod INFO event. CompatibilityOptions derived Debug, so the user-provided PKCS#12 keystore password (from the secrets.stackable.tech/format.compatibility.tls-pkcs12.password volume attribute) was written to operator stdout in cleartext on every successful mount.

tls_pkcs12_password is now wrapped with the existing Unloggable<T> wrapper.

Reproduction

Mount a tls-pkcs12 volume with the password annotation:

volumeClaimTemplate:
  metadata:
    annotations:
      secrets.stackable.tech/class: <class>
      secrets.stackable.tech/scope: pod
      secrets.stackable.tech/format: tls-pkcs12
      secrets.stackable.tech/format.compatibility.tls-pkcs12.password: "SUPERSECRET"

Before:

INFO ... issuing secret for Pod ... selector=SecretVolumeSelector { ... compat: CompatibilityOptions { tls_pkcs12_password: Some("SUPERSECRET") } ... }

After:

INFO ... issuing secret for Pod ... selector=SecretVolumeSelector { ... compat: CompatibilityOptions { tls_pkcs12_password: Some(<redacted>) } ... }

Definition of Done Checklist

• Not all of these items are applicable to all PRs, the author should update this template to only leave the boxes in that are relevant
• Please make sure all these things are done and tick the boxes

Author

• Changes are OpenShift compatible
• CRD changes approved
• CRD documentation for all fields, following the style guide.
• Helm chart can be installed and deployed operator works
• Integration tests passed (for non trivial changes)
• Changes need to be "offline" compatible
• Links to generated (nightly) docs added
• Release note snippet added

Reviewer

• Code contains useful comments
• Code contains useful logging statements
• (Integration-)Test cases added
• Documentation added or updated. Follows the style guide.
• Changelog updated
• Cargo.toml only contains references to git tags (not specific commits or branches)

Acceptance

• Feature Tracker has been updated
• Proper release label has been added
• Links to generated (nightly) docs added
• Release note snippet added
• Add type/deprecation label & add to the deprecation schedule
• Add type/experimental label & add to the experimental features tracker

[Techassi]

LGTM, nice catch!

One suggestion about Default on Unloggable.

[lfrancke]

Should this have release notes?

[dervoeti]

Should this have release notes?

I don't think so, it's nice but just a detail.