Bug: Environment variable with valueFrom.secretKeyRef displays secret key name instead of actual value

Summary

Headlamp incorrectly displays the Secret key name instead of the actual Secret value for environment variables that use valueFrom.secretKeyRef.

Environment

• Headlamp version: 0.39.0
• Kubernetes version: 1.24+

Expected Behavior

When viewing a Pod's environment variables in Headlamp, if an environment variable uses valueFrom.secretKeyRef to reference a Secret, Headlamp should display the actual decoded value from the Secret, similar to how it handles directly set environment variables.

Actual Behavior

Headlamp displays the Secret key name (e.g., "elastic") instead of the actual Secret value.

Steps to Reproduce

1. Create a Secret:

apiVersion: v1
kind: Secret
metadata:
  name: elasticsearch-es-elastic-user
  namespace: ragflow
data:
  elastic: clpURmVrTG54SVlXdGltR01haHJ6QjBR

2. Create a Deployment with env var from Secret:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: ragflow
  namespace: ragflow
spec:
  template:
    spec:
      containers:
      - name: ragflow
        env:
        - name: MYSQL_PASSWORD
          value: "infiniflow@2023"
        - name: ELASTIC_PASSWORD
          valueFrom:
            secretKeyRef:
              name: elasticsearch-es-elastic-user
              key: elastic

3. In Headlamp, navigate to the Pod and view environment variables

4. Observe the incorrect display

Detailed Comparison

Verification

# Secret content (base64)
kubectl get secret elasticsearch-es-elastic-user -n ragflow -o jsonpath='{.data.elastic}'
# Output: clpURmVrTG54SVlXdGltR01haHJ6QjBR

# Decoded value
kubectl get secret elasticsearch-es-elastic-user -n ragflow -o jsonpath='{.data.elastic}' | base64 -d
# Output: rZTFekLnxIYWtimGMahrzB0Q

# Pod environment variable (actual value)
kubectl exec -n ragflow <pod-name> -- printenv ELASTIC_PASSWORD
# Output: rZTFekLnxIYWtimGMahrzB0Q ✅

# But Headlamp shows: "elastic" ❌

Impact

• Severity: Low (cosmetic issue only)
• Functionality: Not affected - Pod environment variables are correctly set
• Security: Could cause confusion - users might think the password is "elastic"

Additional Context

• Other Kubernetes UI tools (like k9s, Octant) correctly display the actual Secret value
• The Pod receives the correct value, this is purely a Headlamp UI display bug
• Related to discussion Environent variables shown even if mounted from secretKeyRef #3641 about Secret permissions and display

Suggested Fix

Headlamp should:

1. Read the Secret referenced by valueFrom.secretKeyRef
2. Decode the base64 value
3. Display the decoded value (similar to how directly set env vars are displayed)
4. Optionally apply masking (e.g., **** or show first 4 chars only) for security