Redact password of variables type user

[benjaminguttmann-avtq]

Is your feature request related to a problem? Please describe.
It seems if you create a variable of type user and setting a password for it, the respective password is not redacted when deploying the manifest.
Describe the solution you'd like
I would like the password (or the whole user options) to be redacted.
Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

Add a variable type user with

variables:
- name: usertest
  type: user
  options:
    username: passwordtestuser
    password: supersecretpassword

during deploy

bosh -d prometheus deploy /tmp/manifest.yml
Using environment '10.200.1.9' as client 'admin'

Using deployment 'prometheus'

Release 'postgres/49' already exists.

Release 'bpm/1.2.20' already exists.

Release 'prometheus/30.9.0' already exists.

Release 'epo-monitoring-boshrelease/0.18.0' already exists.

Release 'a9s-consul/35' already exists.

  variables:
+ - name: usertest
+   options:
+     password: supersecretpassword
+     username: passwordtestuser
+   type: user

same happens if I refer to the password as another variable from credhub, it prints the non-redacted password.

[rkoster]

Is there a particular reason why you need to use ((usertest.password)) instead of ((usertest_password)), also the first syntax can also be achieved by using a --vars-file. I'm just trying to understand the usecase for using a static variable of type user and still wanting to use the variables section, which is for dynamic variables.

[benjaminguttmann-avtq]

We use a deployment where they expect a user variable format, but with values that are generated and used in other jobs.
So far we created that user manually, which does not make much sense, instead of creating it via the manifest and setting the username and password to the related credhub values.

By doing so I recognized that the password is shown and not redacted.

So it is bascially something like this

variables:

• name: secret_password
  type: password
• name: usertest
  type: user
  options:
  username: some_user_name
  password: ((secret_password))

[benjaminguttmann-avtq]

@rkoster any update on this topic?