secrets management

[hall]

Seems the general nix approach to secrets management is to read a file at (app) runtime. The easiest approach here is probably kustomize's secretGenerator (there are also tools like helm-secrets or vals; which I'm open to but will leave for later consideration as I'd rather not add them for the sake of having them).

The outcome of this issue should be both the ability to read secrets from an arbitrary file, without writing anything to the store, and a section on how to do so in the docs. Given my current leaning toward kustomize (as it's builtin to kubectl anyway), the former half will like occur as part of a more general task to support kustomize.

[hall]

I decided against kustomize as it has proven itself to be, once again, not very kustomizable; in this case, it's not able to read files outside of the directory where kustomization.yaml resides. Besides, adding support for vals was very straightforward and enables using several different providers.

This solves my need so I'm going to close this but I'd be happy to consider alternatives if others find a need.