> Yeah, we investigated that route, but on stateless containers it seemed really cumbersome?

I agree, it could be cumbersome without something to manage the secrets. I use OpenShift / k8s at work so injecting these secrets is trivial.