how do you handle secrets in containerized environments?

hey everyone, im lookin to get some thoughts on managing sensitive info like api keys and database credentials in microservices deployed on kubernetes. weve been using env vars, but it feels a bit insecure and hard to manage rotation. are configmaps and secrets the only options, or are there better external secret management solutions people are using effectively? whats your go-to best practices here?