How should secrets in containers be designed for production in Container Security?

Use external secret stores or Kubernetes Secrets with encryption and access controls, workload identity, and rotation. The implementation should be justified by measurable requirements, kept as simple as the problem allows, and validated with realistic tests, telemetry, failure handling, and documented tradeoffs.