A GKE microservice needs credentials for an on-premises third-party database that must be rotatable and follow best practices. How should you store and manage the credentials?

Storing credentials as a Kubernetes Secret with the Cloud KMS plugin for encryption/decryption is the most secure and manageable approach. Kubernetes Secrets provide a native way to store sensitive information, and the Cloud KMS plugin ensures that the secrets are encrypted at rest and decrypted only when needed by authorized workloads, fulfilling the rotatable and best practices requirements. Storing credentials in a sidecar container proxy could work for connection, but doesn't inherently manage the secret's lifecycle or encryption. A service mesh manages network traffic, not credential storage or encryption. Storing credentials on an encrypted volume mount via a PersistentVolumeClaim is less ideal because it couples the secret to the volume and doesn't offer the same level of granular access control or rotation capabilities as Kubernetes Secrets integrated with KMS.