I just deployed glusterfs that is mounted on all machines. It's pretty slow by itself but is good enough for secrets that are just read at startup.

Just mount it at the same path on all hosts and then bind-mount it into the container and it will work no matter where the container is scheduled

Have to think about backup strategy yourself tho.