Given that envvars are often used for secrets, IMHO it would be useful to have a mode that only lists the defined variable names without their values. (I’m even tempted to say it should be the default, to be honest.) This was previously discussed in T340005, but the outcome there was to truncate the values to 50 characters, which is enough to fully “leak” many secrets (even OAuth consumer secrets for Wikimedia wikis are shorter than that).
Currently, the only way to list envvars without values is using questionable pipelines or unsupported low-level APIs (I think):
$ toolforge envvars list | awk '{ print $1 }' $ toolforge envvars list --json | jq -r '.[] | .name' $ kubectl get secrets