k3s secrets.yaml produces an unexpected result after decryption - kubernetes

Question

I am taking over a k3s cluster and am trying to solve a problem with this:
apiVersion: v1
kind: Secret
metadata:
name: clouddesktop-prod-secrets
namespace: clouddesktop-prod
data:
tskey: dHNrZXkta0drTWVWNkNOVFJMLVNlRkZKVFFRalM3RDgzRllvVkxCTQ==
... is used along with with this snippet in my deployment.yaml
- name: AUTHKEY
valueFrom:
secretKeyRef:
name: clouddesktop-prod-secrets
key: tskey
If I am understanding it correctly, the value under tskey will be "decrypted" and then made available as an envirnment variable called ENV_AUTHKEY.
In other words the decryption process that k3s applies will convert the encrypted value "dHNrZXkta0drTWVWNkNOVFJMLVNlRkZKVFFRalM3RDgzRllvVkxCTQ==" into a plaintext value, e.g. "tskey-abc145f" and makes it available to the runnning container as environment variable "ENV_AUTHKEY"
I have verified that indeed an environment variable called "ENV_AUTHKEY" is created, in other words that k3s appends ENV_ to the name.
But as far as I can tell the plaintext is wrong. The environment variable "ENV_AUTHKEY" is indeed created, but, it seems to not have the expected value.
Now by the documentation left for me by my predecessor, I am to create the encrypted value with this simple step:
echo -n "tskey-abc145f" | base64
So I am using base64 as the "encryption" expecting that this is what k3s expects. But the eventually decrypted value appears to me to be incorrect.
What I am trying to determine is what k3s will use to decrypt my encrypted value.

Answer 1

To view how kubernetes would encode the input string, you "may" run the following:
echo -n "tskey-abc145f" | base64
dHNrZXktYWJjMTQ1Zg==
In the following example, I am creating a secret from the command line and providing the key and value in plain text format.
kubectl create secret generic clouddesktop-prod-secrets -n clouddesktop-prod --from-literal=tskey=tskey-abc145f
Verify the secret and its encoded value; here, you can notice the value is encoded automatically. However, when you create a secret using a manifest file, you would have to provided base64 encoded string.
kubectl get secret clouddesktop-prod-secrets -n clouddesktop-prod
apiVersion: v1
kind: Secret
metadata:
name: clouddesktop-prod-secrets
namespace: clouddesktop-prod
data:
tskey: dHNrZXktYWJjMTQ1Zg==
Validate that the encoded value present in the secret is decoding back to the original string(tskey-abc145f):
kubectl get secrets -n clouddesktop-prod clouddesktop-prod-secrets -o go-template='{{.data.tskey|base64decode}}'
tskey-abc145f
Tested on k3s:
k3s --version
k3s version v1.23.3+k3s1 (5fb370e5)
go version go1.17.5