ateapi startup log prints the raw postgres connection string, which can include the db password #1832

ateapi logs all flag values at startup (logFlagValues in cmd/ateapi/main.go), and that includes --postgres-connection-string as is. Checked Cloud Logging on one of our GKE clusters, the startup line is there with the full 262 char DSN in it, on every restart.

With the bundled postgres and Cloud SQL IAM auth the DSN has no password, so nothing leaked on our clusters. But for an external database, or Cloud SQL withIAM_AUTH=false, the DSN carries the db password. ate-setup already knows this: it stores the DSN in a Secret ("The DSN can carry a password ... which is why this is a Secret and not the ConfigMap") and redacts it in its own output withredactDSN. Then ateapi prints it to stdout at Info, which undoes the Secret.

This is a plain Go string from a flag, so the debug_redact work in #1743 cannot cover it. It was listed there as one of the non-proto leaks.