I found happiness by either using AWS KMS (I assume other clouds offerings can do the same) by then storing the encrypted blob in K8s Secrets or through the Vault sidecar approach (obviously when using Vault only).
It's sad but undeniable anecdote, most easily explained by ignorance; Red Hat is just an IBM brand serviced by low skill/cost IT drones now.
The fact that Kubernetes uses base64 for storing secrets by default is another head shaker. One would think self respect would preclude this sort of thing.
Edit: There is reason to do it explained above[1] - to store binary data in the yaml, but doesn't change fact you don't have to use it.
[0] https://kubernetes.io/docs/concepts/configuration/secret/#ba...
Yes it is.
Caution:
Kubernetes Secrets are, by default, stored as unencrypted base64-encoded strings.
Citation requested.