[domenkozar]

I'll reply, even though I don't like the tone the first sentance sets :)

I'm not sure exactly what parts of the comment are about secrets rather than how infrastructure should be done, but I see that secrets and configuration have very different lifetimes so they should be provisioned separately. The config can for example be in the git if it's free of secrets.

Secrets are provisioned at runtime, while config is build time.

`secretspec.toml` is in the version control and it tells you all about what's going to happen at runtime.