Secrets should go in a vault and retrieved with the help of a workload identity.