import base64


def diff_kubernetes_secret(secret, desired_fields):
    """Computes a set of changed fields (either added, removed, or modified)
    between the given existing secret and the set of desired fields.

    :param secret: an existing secret as a KubernetesAPIResponse containing
                   encoded secret data
    :type secret: KubernetesAPIResponse
    :param desired_fields: a dict of desired fields
    :type desired_fields: dict[str, str]
    :return: set[str]
    """
    current_keys = set(secret.data.keys())
    desired_keys = set(desired_fields.keys())

    differences = current_keys.symmetric_difference(desired_keys)

    for field in current_keys.intersection(desired_keys):
        decoded_bytes = base64.b64decode(secret.data[field])
        decoded_str = decoded_bytes.decode('utf-8')
        if decoded_str != desired_fields[field]:
            differences.add(field)

    return differences