Better secret scrubber

[cbeauchesne]

Motivation

Better harness against secrets leakages.

Changes

Rather than scrubbing secrets every time we write a file (and exposing ourself to forget to call this when logging a new file), this PR instrument the python open method to scrub any written data, picking all the known environment variable names that store secrets.

It will offer a secure-by-design solution for any write operations (including logging method)

Though, it's not a silver bullet, here a non exhaustive list on how to continue leaking secrets, any idea to address those is welcome :

• encode the secret. For instance, if it's in a JSON file, and the secret contains a ", it will be encoded, defeating the replace method
• assert os.environ is False -> will fail, and will print in stdout the value of os.environ
• print(os.environ) in a failed test will also print os.environ
• store the secret no in os.environ (though, .env file is supported)
• forget to add a new var name
• execute a subprocess that is not in python, or in python, but not importing scrubber.py, and this subprocess write a file with the leaked secret. For instance, read/write volumes mounted in the docker container ...

Workflow

1. ⚠️ Create your PR as draft ⚠️
2. Work on you PR until the CI passes (if something not related to your task is failing, you can ignore it)
3. Mark it as ready for review
   • Test logic is modified? -> Get a review from RFC owner. We're working on refining the codeowners file quickly.
   • Framework is modified, or non obvious usage of it -> get a review from R&P team

🚀 Once your PR is reviewed, you can merge it!

🛟 #apm-shared-testing 🛟

Reviewer checklist

• If PR title starts with [<language>], double-check that only <language> is impacted by the change
• No system-tests internal is modified. Otherwise, I have the approval from R&P team
• CI is green, or failing jobs are not related to this change (and you are 100% sure about this statement)
• A docker base image is modified?
  • the relevant build-XXX-image label is present
• A scenario is added (or removed)?
  • Get a review from R&P team