Environent variables shown even if mounted from secretKeyRef

[cf-sewe]

I am puzzled with why environment variable values are shown by Headlamp, even though they are mounted via secretKeyRef and the Headlamp service account has no access to secrets nor permission to run exec.

I only found this PR: #2728. It looks OK, because it actually would hide secret values by default at least.
But with the current implementation, values are shown always and as clear text.

More concrete questions are:

• Which PR changed the behaviour (where is this change implemented). Maybe it contains the motivation for this to understand if this is a bug or a feature.
• How can we ensure secrets are not exposed by Headlamp?

[cf-sewe]

Or does it show the key used in the env definition? In my case key equals password (for a test instance), so maybe I draw wrong conclusion. But I think if thats the case, this UX could be improved to better show this is from a secret.

        - name: spring.datasource.password
          valueFrom:
            secretKeyRef:
              name: example-mariadb
              key: example