Helm and Secrets
Helm releases read from their release Secrets without the helm binary; Secret values fetched only on request.
Helm
Release values, rendered manifests, notes and revision history are
decoded from the release Secrets. The helm binary is not invoked, and
nothing needs to be installed.
The Helm listing watches only its own release Secrets (owner=helm),
so it updates when a release is installed or upgraded without watching
every Secret in the cluster.
Secrets
Keys and byte sizes are listed without retrieving values. Each value is
fetched individually on request, and the YAML view redacts data.
Search indexes Secrets by name only; their contents are never read into the index.