This week at work I settled on a secret delivery mechanism that bootstraps with #kubernetes (or puppet if a service isn't containerized)