dont you hate secrets in kubernetes?

hey all, im setting up a new cluster and trying to figure out the best way to manage sensitive information like API keys and database passwords. ive seen ConfigMaps and Secrets, but im wondering about more advanced patterns like using external secret managers (like Vault or cloud provider secrets managers) or even more secure ways to inject secrets at runtime. what are your go-to strategies and why? any pitfalls to watch out for?