One other consideration: If you use something like the Secrets Store CSI Driver and map the resulting k8s Secret to an env variable, it won't update even if the CSI Driver updates the underlying k8s Secret. If it's mounted as a file it will update and you could potentially detect the change and reload your app.