Repository: deepset-ai/haystack

Issue:
REST API: pipeline environment variable value is output in logs
**Describe the bug**

Following the documentation on running the REST API and when using an environment variable for a parameter in a REST API pipeline YAML file, the actual value of the secret is output to the logs. The secret is not exposed publicly and only in the application logs, however, if one uses some log aggregation system, this risks sending the secret to those systems.

Example:

`docker-compose.yml`

```
  haystack-api:
    image: "deepset/haystack:cpu"
    volumes:
      - ./rest_api/rest_api/pipeline:/opt/pipelines
    ports:
      - 8000:8000
    restart: on-failure
    environment:
      - PIPELINE_YAML_PATH=/opt/pipelines/pipelines.haystack-pipeline.yml
      - TOKENIZERS_PARALLELISM=false
      - RETRIEVER_PARAMS_API_KEY=${OPENAI_API_KEY}
```

pipeline step

```
  - name: Retriever
    type: EmbeddingRetriever
    params:
      document_store: DocumentStore
      top_k: 2
      batch_size: 8
      embedding_model: "text-embedding-ada-002"
      max_seq_len: 1024
```

Log

```
04/15/2023 08:57:53 PM Param 'api_key' of component 'Retriever' overwritten with environment variable 'RETRIEVER_PARAMS_API_KEY' value 'sk-abcd'.
```

**Error message**

n/a

**Expected behavior**

Logging does not output the actual secret.

**Additional context**

n/a

**To Reproduce**


**FAQ Check**
- [x] Have you had a look at [our new FAQ page](https://docs.haystack.deepset.ai/docs/faq)?

**System:**
 - OS: macOS
 - GPU/CPU: CPU
 - Haystack version (commit or version number):  1.15.1
 - DocumentStore: OpenSearchDocumentStore
 - Reader: n/a
 - Retriever: EmbeddingRetriever



Discussion:

Resolving patch:
diff --git a/haystack/pipelines/config.py b/haystack/pipelines/config.py
--- a/haystack/pipelines/config.py
+++ b/haystack/pipelines/config.py
@@ -87,7 +87,7 @@ def get_component_definitions(
                         param_name,
                         name,
                         key,
-                        value,
+                        "***",
                     )
     return component_definitions
 


Test patch:
diff --git a/test/pipelines/test_pipeline.py b/test/pipelines/test_pipeline.py
--- a/test/pipelines/test_pipeline.py
+++ b/test/pipelines/test_pipeline.py
@@ -1682,7 +1682,7 @@ def __init__(self, uncopiable: ssl.SSLContext):
     get_component_definitions(pipeline.get_config())
 
 
-def test_pipeline_env_vars_do_not_modify__component_config(monkeypatch):
+def test_pipeline_env_vars_do_not_modify__component_config(caplog, monkeypatch):
     class DummyNode(MockNode):
         def __init__(self, replaceable: str):
             self.replaceable = replaceable
@@ -1697,7 +1697,10 @@ def __init__(self, replaceable: str):
     original_pipeline_config = deepcopy(pipeline.get_config())
 
     no_env_defs = get_component_definitions(pipeline.get_config(), overwrite_with_env_variables=False)
-    env_defs = get_component_definitions(pipeline.get_config(), overwrite_with_env_variables=True)
+
+    with caplog.at_level(logging.INFO):
+        env_defs = get_component_definitions(pipeline.get_config(), overwrite_with_env_variables=True)
+        assert "overwritten with environment variable 'NODE_PARAMS_REPLACEABLE' value '***'." in caplog.text
 
     new_component_config = deepcopy(node._component_config)
     new_pipeline_config = deepcopy(pipeline.get_config())