redact cloud-storage credentials in `omnictl get`

[mnbf9rca]

Problem Description

An LLM, exploring cluster configuration in preparation for other work, ran omnictl get etcdbackups3configs -o yaml which printed the secretaccesskey in plaintext.

Solution

mark secretaccesskey (and similar fields) sensitive so omnictl get redacts by default, with an explicit flag to reveal, mirroring how the UI's Settings > Backups flow never re-displays the key.

Alternative Solutions

Implement a secret store and allow key access by reference

Notes

No response

[utkuozdemir]

Thank you very much for the report.

This is a shortcoming we are aware of. It is readable only by Omni admins, so it is not exposed to everyone, but we will discuss this to see what we can do about it, also will consider your suggestion.