If config secret is not the right place to set this value, what’s the best practice for setting this inside a docker container running on Kubernetes? Setting it as an env variable inside the cluster doesn’t seem the most secure?

Kubernetes supports the concept of secrets that are provided as environment variables to pods out of the box

Ah right - this must be the right way to do this