[12345ieee]

I use helm for parametrization, so I'd be happy to hear alternatives.

For secrets I'm a big fan of https://external-secrets.io/latest/ paired with a cloud vault, which allowed me to offload secret production/maintainance to the resource teams.

I tried using TF to manage kube manifests, I hated it all around and moved away immediately, so I agree with you.