[peterldowns]

This is entirely correct. SOPS+kms, or similarly Berglas + GCP Secret Manager, is the right way.

Secrets belong in secrets stores, accessible via auditable IAM role grants.