Filter deployment metadata before logging it

Control-plane responses can mix routine deployment state with credential material. Before logging or forwarding them, project only the fields needed for verification, such as lifecycle state and immutable image identity; omit secrets, encrypted credential blobs, and unrelated service configuration. Treat encrypted values as sensitive metadata: encryption at rest is not a reason to copy them into transcripts or support artifacts. Filter at the client boundary so the raw response is not captured by downstream logs. The exact field allowlist depends on the provider schema and should be reviewed when that schema changes.

Applies when: reading cloud deployment metadata through a CLI, API, or support tool. Keywords: control plane deployment metadata credentials encrypted redact filter logs digest