How should Kubernetes ConfigMaps and Secrets be implemented for production?

Use external secret managers or encryption-at-rest where appropriate, restrict RBAC, mount only required values, rotate secrets, and avoid exposing secrets through logs or command lines.